content_template

Creates, updates, deletes, gets or lists a content_template resource.

Overview

Name	content_template
Type	Resource
Id	azure.security_insight.content_template

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
author	object	The creator of the content item.
categories	object	Categories for the item.
contentId	string	Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name.
contentKind	string	The kind of content the template is for. Known values are: "DataConnector", "DataType", "Workbook", "WorkbookTemplate", "Playbook", "PlaybookTemplate", "AnalyticsRuleTemplate", "AnalyticsRule", "HuntingQuery", "InvestigationQuery", "Parser", "Watchlist", "WatchlistTemplate", "Solution", "AzureFunction", "LogicAppsCustomConnector", "AutomationRule", "ResourcesDataConnector", "Notebook", "Standalone", "SummaryRule", and "CustomDetection". (DataConnector, DataType, Workbook, WorkbookTemplate, Playbook, PlaybookTemplate, AnalyticsRuleTemplate, AnalyticsRule, HuntingQuery, InvestigationQuery, Parser, Watchlist, WatchlistTemplate, Solution, AzureFunction, LogicAppsCustomConnector, AutomationRule, ResourcesDataConnector, Notebook, Standalone, SummaryRule, CustomDetection)
contentProductId	string	Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template.
contentSchemaVersion	string	Schema version of the content. Can be used to distinguish between different flow based on the schema version.
customVersion	string	The custom version of the content. A optional free text.
dependantTemplates	array	Dependant templates. Expandable.
dependencies	object	Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
displayName	string	The display name of the template.
etag	string	Etag of the azure resource.
firstPublishDate	string (date)	first publish date content item.
icon	string	the icon identifier. this id can later be fetched from the content metadata.
isDeprecated	string	Flag indicates if this template is deprecated. Known values are: "true" and "false". (true, false)
lastPublishDate	string (date)	last publish date for the content item.
mainTemplate	object	The JSON of the ARM template to deploy active content. Expandable.
packageId	string	the package Id contains this template.
packageKind	string	the packageKind of the package contains this template. Known values are: "Solution" and "Standalone". (Solution, Standalone)
packageName	string	the name of the package contains this template.
packageVersion	string	Version of the package. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks.
previewImages	array	preview image file names. These will be taken from the solution artifacts.
previewImagesDark	array	preview image file names. These will be taken from the solution artifacts. used for dark theme support.
providers	array	Providers for the content item.
source	object	Source of the content. This is where/how it was created.
support	object	Support information for the template - type, name, contact information.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
threatAnalysisTactics	array	the tactics the resource covers.
threatAnalysisTechniques	array	the techniques the resource covers, these have to be aligned with the tactics being used.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
version	string	Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, workspace_name, template_id, subscription_id		Gets a template byt its identifier. Expandable properties: * properties/mainTemplate * properties/dependantTemplates.
delete	delete	resource_group_name, workspace_name, template_id, subscription_id		Delete an installed template.
install	exec	resource_group_name, workspace_name, template_id, subscription_id		Install a template.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string
template_id	string	template Id. Required.
workspace_name	string	The name of the monitor workspace. Required.

SELECT examples

get

Gets a template byt its identifier. Expandable properties: * properties/mainTemplate * properties/dependantTemplates.

SELECT
id,
name,
author,
categories,
contentId,
contentKind,
contentProductId,
contentSchemaVersion,
customVersion,
dependantTemplates,
dependencies,
displayName,
etag,
firstPublishDate,
icon,
isDeprecated,
lastPublishDate,
mainTemplate,
packageId,
packageKind,
packageName,
packageVersion,
previewImages,
previewImagesDark,
providers,
source,
support,
systemData,
threatAnalysisTactics,
threatAnalysisTechniques,
type,
version
FROM azure.security_insight.content_template
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND template_id = '{{ template_id }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

DELETE examples

delete

Delete an installed template.

DELETE FROM azure.security_insight.content_template
WHERE resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND template_id = '{{ template_id }}' --required
AND subscription_id = '{{ subscription_id }}' --required
;

Lifecycle Methods

install

Install a template.

EXEC azure.security_insight.content_template.install 
@resource_group_name='{{ resource_group_name }}' --required, 
@workspace_name='{{ workspace_name }}' --required, 
@template_id='{{ template_id }}' --required, 
@subscription_id='{{ subscription_id }}' --required 
@@json=
'{
"properties": "{{ properties }}", 
"etag": "{{ etag }}"
}'
;