actions

Creates, updates, deletes, gets or lists an actions resource.

Overview

Name	actions
Type	Resource
Id	azure.security_insight.actions

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
etag	string	Etag of the action.
logicAppResourceId	string	Logic App Resource Id, /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}. Required.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
workflowId	string	The name of the logic app's workflow.

list_by_alert_rule

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
etag	string	Etag of the action.
logicAppResourceId	string	Logic App Resource Id, /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}. Required.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
workflowId	string	The name of the logic app's workflow.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, workspace_name, rule_id, action_id, subscription_id		Gets the action of alert rule.
list_by_alert_rule	select	resource_group_name, workspace_name, rule_id, subscription_id		Gets all actions of alert rule.
create_or_update	insert	resource_group_name, workspace_name, rule_id, action_id, subscription_id		Creates or updates the action of alert rule.
create_or_update	replace	resource_group_name, workspace_name, rule_id, action_id, subscription_id		Creates or updates the action of alert rule.
delete	delete	resource_group_name, workspace_name, rule_id, action_id, subscription_id		Delete the action of alert rule.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
action_id	string	Action ID. Required.
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
rule_id	string	Alert rule ID. Required.
subscription_id	string
workspace_name	string	The name of the monitor workspace. Required.

SELECT examples

get

Gets the action of alert rule.

SELECT
id,
name,
etag,
logicAppResourceId,
systemData,
type,
workflowId
FROM azure.security_insight.actions
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND rule_id = '{{ rule_id }}' -- required
AND action_id = '{{ action_id }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list_by_alert_rule

Gets all actions of alert rule.

SELECT
id,
name,
etag,
logicAppResourceId,
systemData,
type,
workflowId
FROM azure.security_insight.actions
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND rule_id = '{{ rule_id }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

INSERT examples

create_or_update

Creates or updates the action of alert rule.

INSERT INTO azure.security_insight.actions (
etag,
properties,
resource_group_name,
workspace_name,
rule_id,
action_id,
subscription_id
)
SELECT 
'{{ etag }}',
'{{ properties }}',
'{{ resource_group_name }}',
'{{ workspace_name }}',
'{{ rule_id }}',
'{{ action_id }}',
'{{ subscription_id }}'
RETURNING
id,
name,
etag,
properties,
systemData,
type
;

Manifest

# Description fields are for documentation purposes
- name: actions
props:
  - name: resource_group_name
    value: "{{ resource_group_name }}"
    description: Required parameter for the actions resource.
  - name: workspace_name
    value: "{{ workspace_name }}"
    description: Required parameter for the actions resource.
  - name: rule_id
    value: "{{ rule_id }}"
    description: Required parameter for the actions resource.
  - name: action_id
    value: "{{ action_id }}"
    description: Required parameter for the actions resource.
  - name: subscription_id
    value: "{{ subscription_id }}"
    description: Required parameter for the actions resource.
  - name: etag
    value: "{{ etag }}"
    description: |
      Etag of the azure resource.
  - name: properties
    description: |
      Action properties for put request.
    value:
      logicAppResourceId: "{{ logicAppResourceId }}"
      triggerUri: "{{ triggerUri }}"

REPLACE examples

create_or_update

Creates or updates the action of alert rule.

REPLACE azure.security_insight.actions
SET 
etag = '{{ etag }}',
properties = '{{ properties }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND rule_id = '{{ rule_id }}' --required
AND action_id = '{{ action_id }}' --required
AND subscription_id = '{{ subscription_id }}' --required
RETURNING
id,
name,
etag,
properties,
systemData,
type;

DELETE examples

delete

Delete the action of alert rule.

DELETE FROM azure.security_insight.actions
WHERE resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND rule_id = '{{ rule_id }}' --required
AND action_id = '{{ action_id }}' --required
AND subscription_id = '{{ subscription_id }}' --required
;