iot_security_solutions_analytics_aggregated_alert

Creates, updates, deletes, gets or lists an iot_security_solutions_analytics_aggregated_alert resource.

Overview

Name	iot_security_solutions_analytics_aggregated_alert
Type	Resource
Id	azure.security.iot_security_solutions_analytics_aggregated_alert

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
actionTaken	string	IoT Security solution alert response.
aggregatedDateUtc	string (date)	Date of detection.
alertDisplayName	string	Display name of the alert type.
alertType	string	Name of the alert type.
count	integer	Number of alerts occurrences within the aggregated time window.
description	string	Description of the suspected vulnerability and meaning.
effectedResourceType	string	Azure resource ID of the resource that received the alerts.
logAnalyticsQuery	string	Log analytics query for getting the list of affected devices/alerts.
remediationSteps	string	Recommended steps for remediation.
reportedSeverity	string	Assessed alert severity. Known values are: "Informational", "Low", "Medium", and "High". (Informational, Low, Medium, High)
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
systemSource	string	The type of the alerted resource (Azure, Non-Azure).
tags	object	Resource tags.
topDevicesList	array	10 devices with the highest number of occurrences of this alert type, on this day.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
vendorName	string	Name of the organization that raised the alert.

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
actionTaken	string	IoT Security solution alert response.
aggregatedDateUtc	string (date)	Date of detection.
alertDisplayName	string	Display name of the alert type.
alertType	string	Name of the alert type.
count	integer	Number of alerts occurrences within the aggregated time window.
description	string	Description of the suspected vulnerability and meaning.
effectedResourceType	string	Azure resource ID of the resource that received the alerts.
logAnalyticsQuery	string	Log analytics query for getting the list of affected devices/alerts.
remediationSteps	string	Recommended steps for remediation.
reportedSeverity	string	Assessed alert severity. Known values are: "Informational", "Low", "Medium", and "High". (Informational, Low, Medium, High)
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
systemSource	string	The type of the alerted resource (Azure, Non-Azure).
tags	object	Resource tags.
topDevicesList	array	10 devices with the highest number of occurrences of this alert type, on this day.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
vendorName	string	Name of the organization that raised the alert.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, solution_name, aggregated_alert_name, subscription_id		Use this method to get a single the aggregated alert of yours IoT Security solution. This aggregation is performed by alert name.
list	select	resource_group_name, solution_name, subscription_id	$top	Use this method to get the aggregated alert list of yours IoT Security solution.
dismiss	exec	resource_group_name, solution_name, aggregated_alert_name, subscription_id		Use this method to dismiss an aggregated IoT Security Solution Alert.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
aggregated_alert_name	string	Identifier of the aggregated alert. Required.
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
solution_name	string	The name of the IoT Security solution. Required.
subscription_id	string
$top	integer	Number of results to retrieve. Default value is None.

SELECT examples

get

Use this method to get a single the aggregated alert of yours IoT Security solution. This aggregation is performed by alert name.

SELECT
id,
name,
actionTaken,
aggregatedDateUtc,
alertDisplayName,
alertType,
count,
description,
effectedResourceType,
logAnalyticsQuery,
remediationSteps,
reportedSeverity,
systemData,
systemSource,
tags,
topDevicesList,
type,
vendorName
FROM azure.security.iot_security_solutions_analytics_aggregated_alert
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND solution_name = '{{ solution_name }}' -- required
AND aggregated_alert_name = '{{ aggregated_alert_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list

Use this method to get the aggregated alert list of yours IoT Security solution.

SELECT
id,
name,
actionTaken,
aggregatedDateUtc,
alertDisplayName,
alertType,
count,
description,
effectedResourceType,
logAnalyticsQuery,
remediationSteps,
reportedSeverity,
systemData,
systemSource,
tags,
topDevicesList,
type,
vendorName
FROM azure.security.iot_security_solutions_analytics_aggregated_alert
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND solution_name = '{{ solution_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
AND $top = '{{ $top }}'
;

Lifecycle Methods

dismiss

Use this method to dismiss an aggregated IoT Security Solution Alert.

EXEC azure.security.iot_security_solutions_analytics_aggregated_alert.dismiss 
@resource_group_name='{{ resource_group_name }}' --required, 
@solution_name='{{ solution_name }}' --required, 
@aggregated_alert_name='{{ aggregated_alert_name }}' --required, 
@subscription_id='{{ subscription_id }}' --required
;