automations

Creates, updates, deletes, gets or lists an automations resource.

Overview

Name	automations
Type	Resource
Id	azure.security.automations

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
actions	array	A collection of the actions which are triggered if all the configured rules evaluations, within at least one rule set, are true.
description	string	The security automation description.
etag	string	Entity tag is used for comparing two or more entities from the same requested resource.
isEnabled	boolean	Indicates whether the security automation is enabled.
kind	string	Kind of the resource.
location	string	The geo-location where the resource lives.
scopes	array	A collection of scopes on which the security automations logic is applied. Supported scopes are the subscription itself or a resource group under that subscription. The automation will only apply on defined scopes.
sources	array	A collection of the source event types which evaluate the security automation set of rules.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Resource tags.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list_by_resource_group

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
actions	array	A collection of the actions which are triggered if all the configured rules evaluations, within at least one rule set, are true.
description	string	The security automation description.
etag	string	Entity tag is used for comparing two or more entities from the same requested resource.
isEnabled	boolean	Indicates whether the security automation is enabled.
kind	string	Kind of the resource.
location	string	The geo-location where the resource lives.
scopes	array	A collection of scopes on which the security automations logic is applied. Supported scopes are the subscription itself or a resource group under that subscription. The automation will only apply on defined scopes.
sources	array	A collection of the source event types which evaluate the security automation set of rules.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Resource tags.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
actions	array	A collection of the actions which are triggered if all the configured rules evaluations, within at least one rule set, are true.
description	string	The security automation description.
etag	string	Entity tag is used for comparing two or more entities from the same requested resource.
isEnabled	boolean	Indicates whether the security automation is enabled.
kind	string	Kind of the resource.
location	string	The geo-location where the resource lives.
scopes	array	A collection of scopes on which the security automations logic is applied. Supported scopes are the subscription itself or a resource group under that subscription. The automation will only apply on defined scopes.
sources	array	A collection of the source event types which evaluate the security automation set of rules.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Resource tags.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, automation_name, subscription_id		Retrieves information about the model of a security automation.
list_by_resource_group	select	resource_group_name, subscription_id		Lists all the security automations in the specified resource group. Use the 'nextLink' property in the response to get the next page of security automations for the specified resource group.
list	select	subscription_id		Lists all the security automations in the specified subscription. Use the 'nextLink' property in the response to get the next page of security automations for the specified subscription.
create_or_update	insert	resource_group_name, automation_name, subscription_id		Creates or updates a security automation. If a security automation is already created and a subsequent request is issued for the same automation id, then it will be updated.
update	update	resource_group_name, automation_name, subscription_id		Updates a security automation.
create_or_update	replace	resource_group_name, automation_name, subscription_id		Creates or updates a security automation. If a security automation is already created and a subsequent request is issued for the same automation id, then it will be updated.
delete	delete	resource_group_name, automation_name, subscription_id		Deletes a security automation.
validate	exec	resource_group_name, automation_name, subscription_id		Validates the security automation model before create or update. Any validation errors are returned to the client.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
automation_name	string	The security automation name. Required.
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string

SELECT examples

get

Retrieves information about the model of a security automation.

SELECT
id,
name,
actions,
description,
etag,
isEnabled,
kind,
location,
scopes,
sources,
systemData,
tags,
type
FROM azure.security.automations
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND automation_name = '{{ automation_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list_by_resource_group

Lists all the security automations in the specified resource group. Use the 'nextLink' property in the response to get the next page of security automations for the specified resource group.

SELECT
id,
name,
actions,
description,
etag,
isEnabled,
kind,
location,
scopes,
sources,
systemData,
tags,
type
FROM azure.security.automations
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list

Lists all the security automations in the specified subscription. Use the 'nextLink' property in the response to get the next page of security automations for the specified subscription.

SELECT
id,
name,
actions,
description,
etag,
isEnabled,
kind,
location,
scopes,
sources,
systemData,
tags,
type
FROM azure.security.automations
WHERE subscription_id = '{{ subscription_id }}' -- required
;

INSERT examples

create_or_update

Creates or updates a security automation. If a security automation is already created and a subsequent request is issued for the same automation id, then it will be updated.

INSERT INTO azure.security.automations (
properties,
tags,
location,
kind,
etag,
resource_group_name,
automation_name,
subscription_id
)
SELECT 
'{{ properties }}',
'{{ tags }}',
'{{ location }}',
'{{ kind }}',
'{{ etag }}',
'{{ resource_group_name }}',
'{{ automation_name }}',
'{{ subscription_id }}'
RETURNING
id,
name,
etag,
kind,
location,
properties,
systemData,
tags,
type
;

Manifest

# Description fields are for documentation purposes
- name: automations
props:
  - name: resource_group_name
    value: "{{ resource_group_name }}"
    description: Required parameter for the automations resource.
  - name: automation_name
    value: "{{ automation_name }}"
    description: Required parameter for the automations resource.
  - name: subscription_id
    value: "{{ subscription_id }}"
    description: Required parameter for the automations resource.
  - name: properties
    description: |
      Security automation data.
    value:
      description: "{{ description }}"
      isEnabled: {{ isEnabled }}
      scopes:
        - description: "{{ description }}"
          scopePath: "{{ scopePath }}"
      sources:
        - eventSource: "{{ eventSource }}"
          ruleSets: "{{ ruleSets }}"
      actions:
        - actionType: "{{ actionType }}"
  - name: tags
    value: "{{ tags }}"
    description: |
      Resource tags.
  - name: location
    value: "{{ location }}"
    description: |
      The geo-location where the resource lives.
  - name: kind
    value: "{{ kind }}"
    description: |
      Kind of the resource.
  - name: etag
    value: "{{ etag }}"
    description: |
      Entity tag is used for comparing two or more entities from the same requested resource.

UPDATE examples

update

Updates a security automation.

UPDATE azure.security.automations
SET 
tags = '{{ tags }}',
properties = '{{ properties }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND automation_name = '{{ automation_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
RETURNING
id,
name,
etag,
kind,
location,
properties,
systemData,
tags,
type;

REPLACE examples

create_or_update

Creates or updates a security automation. If a security automation is already created and a subsequent request is issued for the same automation id, then it will be updated.

REPLACE azure.security.automations
SET 
properties = '{{ properties }}',
tags = '{{ tags }}',
location = '{{ location }}',
kind = '{{ kind }}',
etag = '{{ etag }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND automation_name = '{{ automation_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
RETURNING
id,
name,
etag,
kind,
location,
properties,
systemData,
tags,
type;

DELETE examples

delete

Deletes a security automation.

DELETE FROM azure.security.automations
WHERE resource_group_name = '{{ resource_group_name }}' --required
AND automation_name = '{{ automation_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
;

Lifecycle Methods

validate

Validates the security automation model before create or update. Any validation errors are returned to the client.

EXEC azure.security.automations.validate 
@resource_group_name='{{ resource_group_name }}' --required, 
@automation_name='{{ automation_name }}' --required, 
@subscription_id='{{ subscription_id }}' --required 
@@json=
'{
"properties": "{{ properties }}", 
"tags": "{{ tags }}", 
"location": "{{ location }}", 
"kind": "{{ kind }}", 
"etag": "{{ etag }}"
}'
;