automation_rules

Creates, updates, deletes, gets or lists an automation_rules resource.

Overview

Name	automation_rules
Type	Resource
Id	azure.security_insight.automation_rules

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
actions	array	The actions to execute when the automation rule is triggered. Required.
createdBy	object	Information on the client (user or application) that made some action.
createdTimeUtc	string (date-time)	The time the automation rule was created.
displayName	string	The display name of the automation rule. Required.
etag	string	Etag of the azure resource.
lastModifiedBy	object	Information on the client (user or application) that made some action.
lastModifiedTimeUtc	string (date-time)	The last time the automation rule was updated.
order	integer	The order of execution of the automation rule. Required.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
triggeringLogic	object	Describes automation rule triggering logic. Required.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
actions	array	The actions to execute when the automation rule is triggered. Required.
createdBy	object	Information on the client (user or application) that made some action.
createdTimeUtc	string (date-time)	The time the automation rule was created.
displayName	string	The display name of the automation rule. Required.
etag	string	Etag of the azure resource.
lastModifiedBy	object	Information on the client (user or application) that made some action.
lastModifiedTimeUtc	string (date-time)	The last time the automation rule was updated.
order	integer	The order of execution of the automation rule. Required.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
triggeringLogic	object	Describes automation rule triggering logic. Required.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, workspace_name, automation_rule_id, subscription_id		Gets the automation rule.
list	select	resource_group_name, workspace_name, subscription_id		Gets all automation rules.
create_or_update	insert	resource_group_name, workspace_name, automation_rule_id, subscription_id, properties		Creates or updates the automation rule.
create_or_update	replace	resource_group_name, workspace_name, automation_rule_id, subscription_id, properties		Creates or updates the automation rule.
delete	delete	resource_group_name, workspace_name, automation_rule_id, subscription_id		Delete the automation rule.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
automation_rule_id	string	Automation rule ID. Required.
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string
workspace_name	string	The name of the monitor workspace. Required.

SELECT examples

get

Gets the automation rule.

SELECT
id,
name,
actions,
createdBy,
createdTimeUtc,
displayName,
etag,
lastModifiedBy,
lastModifiedTimeUtc,
order,
systemData,
triggeringLogic,
type
FROM azure.security_insight.automation_rules
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND automation_rule_id = '{{ automation_rule_id }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list

Gets all automation rules.

SELECT
id,
name,
actions,
createdBy,
createdTimeUtc,
displayName,
etag,
lastModifiedBy,
lastModifiedTimeUtc,
order,
systemData,
triggeringLogic,
type
FROM azure.security_insight.automation_rules
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

INSERT examples

create_or_update

Creates or updates the automation rule.

INSERT INTO azure.security_insight.automation_rules (
properties,
etag,
resource_group_name,
workspace_name,
automation_rule_id,
subscription_id
)
SELECT 
'{{ properties }}' /* required */,
'{{ etag }}',
'{{ resource_group_name }}',
'{{ workspace_name }}',
'{{ automation_rule_id }}',
'{{ subscription_id }}'
RETURNING
id,
name,
etag,
properties,
systemData,
type
;

Manifest

# Description fields are for documentation purposes
- name: automation_rules
props:
  - name: resource_group_name
    value: "{{ resource_group_name }}"
    description: Required parameter for the automation_rules resource.
  - name: workspace_name
    value: "{{ workspace_name }}"
    description: Required parameter for the automation_rules resource.
  - name: automation_rule_id
    value: "{{ automation_rule_id }}"
    description: Required parameter for the automation_rules resource.
  - name: subscription_id
    value: "{{ subscription_id }}"
    description: Required parameter for the automation_rules resource.
  - name: properties
    description: |
      Automation rule properties. Required.
    value:
      displayName: "{{ displayName }}"
      order: {{ order }}
      triggeringLogic:
        isEnabled: {{ isEnabled }}
        expirationTimeUtc: "{{ expirationTimeUtc }}"
        triggersOn: "{{ triggersOn }}"
        triggersWhen: "{{ triggersWhen }}"
        conditions:
          - conditionType: "{{ conditionType }}"
      actions:
        - order: {{ order }}
          actionType: "{{ actionType }}"
      lastModifiedTimeUtc: "{{ lastModifiedTimeUtc }}"
      createdTimeUtc: "{{ createdTimeUtc }}"
      lastModifiedBy:
        email: "{{ email }}"
        name: "{{ name }}"
        objectId: "{{ objectId }}"
        userPrincipalName: "{{ userPrincipalName }}"
      createdBy:
        email: "{{ email }}"
        name: "{{ name }}"
        objectId: "{{ objectId }}"
        userPrincipalName: "{{ userPrincipalName }}"
  - name: etag
    value: "{{ etag }}"
    description: |
      Etag of the azure resource.

REPLACE examples

create_or_update

Creates or updates the automation rule.

REPLACE azure.security_insight.automation_rules
SET 
properties = '{{ properties }}',
etag = '{{ etag }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND automation_rule_id = '{{ automation_rule_id }}' --required
AND subscription_id = '{{ subscription_id }}' --required
AND properties = '{{ properties }}' --required
RETURNING
id,
name,
etag,
properties,
systemData,
type;

DELETE examples

delete

Delete the automation rule.

DELETE FROM azure.security_insight.automation_rules
WHERE resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND automation_rule_id = '{{ automation_rule_id }}' --required
AND subscription_id = '{{ subscription_id }}' --required
;