bookmarks

Creates, updates, deletes, gets or lists a bookmarks resource.

Overview

Name	bookmarks
Type	Resource
Id	azure.security_insight.bookmarks

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
created	string (date-time)	The time the bookmark was created.
createdBy	object	Describes a user that created the bookmark.
displayName	string	The display name of the bookmark. Required.
entityMappings	array	Describes the entity mappings of the bookmark.
etag	string	Etag of the azure resource.
eventTime	string (date-time)	The bookmark event time.
incidentInfo	object	Describes an incident that relates to bookmark.
labels	array	List of labels relevant to this bookmark.
notes	string	The notes of the bookmark.
query	string	The query of the bookmark. Required.
queryEndTime	string (date-time)	The end time for the query.
queryResult	string	The query result of the bookmark.
queryStartTime	string (date-time)	The start time for the query.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tactics	array	A list of relevant mitre attacks.
techniques	array	A list of relevant mitre techniques.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
updated	string (date-time)	The last time the bookmark was updated.
updatedBy	object	Describes a user that updated the bookmark.

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
created	string (date-time)	The time the bookmark was created.
createdBy	object	Describes a user that created the bookmark.
displayName	string	The display name of the bookmark. Required.
entityMappings	array	Describes the entity mappings of the bookmark.
etag	string	Etag of the azure resource.
eventTime	string (date-time)	The bookmark event time.
incidentInfo	object	Describes an incident that relates to bookmark.
labels	array	List of labels relevant to this bookmark.
notes	string	The notes of the bookmark.
query	string	The query of the bookmark. Required.
queryEndTime	string (date-time)	The end time for the query.
queryResult	string	The query result of the bookmark.
queryStartTime	string (date-time)	The start time for the query.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tactics	array	A list of relevant mitre attacks.
techniques	array	A list of relevant mitre techniques.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
updated	string (date-time)	The last time the bookmark was updated.
updatedBy	object	Describes a user that updated the bookmark.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, workspace_name, bookmark_id, subscription_id		Gets a bookmark.
list	select	resource_group_name, workspace_name, subscription_id		Gets all bookmarks.
create_or_update	insert	resource_group_name, workspace_name, bookmark_id, subscription_id		Creates or updates the bookmark.
create_or_update	replace	resource_group_name, workspace_name, bookmark_id, subscription_id		Creates or updates the bookmark.
delete	delete	resource_group_name, workspace_name, bookmark_id, subscription_id		Delete the bookmark.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
bookmark_id	string	Bookmark ID. Required.
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string
workspace_name	string	The name of the monitor workspace. Required.

SELECT examples

get

Gets a bookmark.

SELECT
id,
name,
created,
createdBy,
displayName,
entityMappings,
etag,
eventTime,
incidentInfo,
labels,
notes,
query,
queryEndTime,
queryResult,
queryStartTime,
systemData,
tactics,
techniques,
type,
updated,
updatedBy
FROM azure.security_insight.bookmarks
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND bookmark_id = '{{ bookmark_id }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list

Gets all bookmarks.

SELECT
id,
name,
created,
createdBy,
displayName,
entityMappings,
etag,
eventTime,
incidentInfo,
labels,
notes,
query,
queryEndTime,
queryResult,
queryStartTime,
systemData,
tactics,
techniques,
type,
updated,
updatedBy
FROM azure.security_insight.bookmarks
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

INSERT examples

create_or_update

Creates or updates the bookmark.

INSERT INTO azure.security_insight.bookmarks (
properties,
etag,
resource_group_name,
workspace_name,
bookmark_id,
subscription_id
)
SELECT 
'{{ properties }}',
'{{ etag }}',
'{{ resource_group_name }}',
'{{ workspace_name }}',
'{{ bookmark_id }}',
'{{ subscription_id }}'
RETURNING
id,
name,
etag,
properties,
systemData,
type
;

Manifest

# Description fields are for documentation purposes
- name: bookmarks
props:
  - name: resource_group_name
    value: "{{ resource_group_name }}"
    description: Required parameter for the bookmarks resource.
  - name: workspace_name
    value: "{{ workspace_name }}"
    description: Required parameter for the bookmarks resource.
  - name: bookmark_id
    value: "{{ bookmark_id }}"
    description: Required parameter for the bookmarks resource.
  - name: subscription_id
    value: "{{ subscription_id }}"
    description: Required parameter for the bookmarks resource.
  - name: properties
    description: |
      Bookmark properties.
    value:
      created: "{{ created }}"
      createdBy:
        email: "{{ email }}"
        name: "{{ name }}"
        objectId: "{{ objectId }}"
      displayName: "{{ displayName }}"
      labels:
        - "{{ labels }}"
      notes: "{{ notes }}"
      query: "{{ query }}"
      queryResult: "{{ queryResult }}"
      updated: "{{ updated }}"
      updatedBy:
        email: "{{ email }}"
        name: "{{ name }}"
        objectId: "{{ objectId }}"
      eventTime: "{{ eventTime }}"
      queryStartTime: "{{ queryStartTime }}"
      queryEndTime: "{{ queryEndTime }}"
      incidentInfo:
        incidentId: "{{ incidentId }}"
        severity: "{{ severity }}"
        title: "{{ title }}"
        relationName: "{{ relationName }}"
      entityMappings:
        - entityType: "{{ entityType }}"
          fieldMappings: "{{ fieldMappings }}"
      tactics:
        - "{{ tactics }}"
      techniques:
        - "{{ techniques }}"
  - name: etag
    value: "{{ etag }}"
    description: |
      Etag of the azure resource.

REPLACE examples

create_or_update

Creates or updates the bookmark.

REPLACE azure.security_insight.bookmarks
SET 
properties = '{{ properties }}',
etag = '{{ etag }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND bookmark_id = '{{ bookmark_id }}' --required
AND subscription_id = '{{ subscription_id }}' --required
RETURNING
id,
name,
etag,
properties,
systemData,
type;

DELETE examples

delete

Delete the bookmark.

DELETE FROM azure.security_insight.bookmarks
WHERE resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND bookmark_id = '{{ bookmark_id }}' --required
AND subscription_id = '{{ subscription_id }}' --required
;