content_templates

Creates, updates, deletes, gets or lists a content_templates resource.

Overview

Name	content_templates
Type	Resource
Id	azure.security_insight.content_templates

Fields

The following fields are returned by SELECT queries:

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
author	object	The creator of the content item.
categories	object	Categories for the item.
contentId	string	Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name.
contentKind	string	The kind of content the template is for. Known values are: "DataConnector", "DataType", "Workbook", "WorkbookTemplate", "Playbook", "PlaybookTemplate", "AnalyticsRuleTemplate", "AnalyticsRule", "HuntingQuery", "InvestigationQuery", "Parser", "Watchlist", "WatchlistTemplate", "Solution", "AzureFunction", "LogicAppsCustomConnector", "AutomationRule", "ResourcesDataConnector", "Notebook", "Standalone", "SummaryRule", and "CustomDetection". (DataConnector, DataType, Workbook, WorkbookTemplate, Playbook, PlaybookTemplate, AnalyticsRuleTemplate, AnalyticsRule, HuntingQuery, InvestigationQuery, Parser, Watchlist, WatchlistTemplate, Solution, AzureFunction, LogicAppsCustomConnector, AutomationRule, ResourcesDataConnector, Notebook, Standalone, SummaryRule, CustomDetection)
contentProductId	string	Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template.
contentSchemaVersion	string	Schema version of the content. Can be used to distinguish between different flow based on the schema version.
customVersion	string	The custom version of the content. A optional free text.
dependantTemplates	array	Dependant templates. Expandable.
dependencies	object	Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
displayName	string	The display name of the template.
etag	string	Etag of the azure resource.
firstPublishDate	string (date)	first publish date content item.
icon	string	the icon identifier. this id can later be fetched from the content metadata.
isDeprecated	string	Flag indicates if this template is deprecated. Known values are: "true" and "false". (true, false)
lastPublishDate	string (date)	last publish date for the content item.
mainTemplate	object	The JSON of the ARM template to deploy active content. Expandable.
packageId	string	the package Id contains this template.
packageKind	string	the packageKind of the package contains this template. Known values are: "Solution" and "Standalone". (Solution, Standalone)
packageName	string	the name of the package contains this template.
packageVersion	string	Version of the package. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks.
previewImages	array	preview image file names. These will be taken from the solution artifacts.
previewImagesDark	array	preview image file names. These will be taken from the solution artifacts. used for dark theme support.
providers	array	Providers for the content item.
source	object	Source of the content. This is where/how it was created.
support	object	Support information for the template - type, name, contact information.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
threatAnalysisTactics	array	the tactics the resource covers.
threatAnalysisTechniques	array	the techniques the resource covers, these have to be aligned with the tactics being used.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
version	string	Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list	select	resource_group_name, workspace_name, subscription_id	$filter, $orderby, $expand, $search, $count, $top, $skip, $skipToken	Gets all installed templates. Expandable properties: * properties/mainTemplate * properties/dependantTemplates.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string
workspace_name	string	The name of the monitor workspace. Required.
$count	boolean	Instructs the server to return only object count without actual body. Optional. Default value is None.
$expand	string	Expands the object with optional fiends that are not included by default. Optional. Default value is None.
$filter	string	Filters the results, based on a Boolean condition. Optional. Default value is None.
$orderby	string	Sorts the results. Optional. Default value is None.
$search	string	Searches for a substring in the response. Optional. Default value is None.
$skip	integer	Used to skip n elements in the OData query (offset). Returns a nextLink to the next page of results if there are any left. Default value is None.
$skipToken	string	Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. Default value is None.
$top	integer	Returns only the first n results. Optional. Default value is None.

SELECT examples

list

Gets all installed templates. Expandable properties: * properties/mainTemplate * properties/dependantTemplates.

SELECT
id,
name,
author,
categories,
contentId,
contentKind,
contentProductId,
contentSchemaVersion,
customVersion,
dependantTemplates,
dependencies,
displayName,
etag,
firstPublishDate,
icon,
isDeprecated,
lastPublishDate,
mainTemplate,
packageId,
packageKind,
packageName,
packageVersion,
previewImages,
previewImagesDark,
providers,
source,
support,
systemData,
threatAnalysisTactics,
threatAnalysisTechniques,
type,
version
FROM azure.security_insight.content_templates
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
AND $filter = '{{ $filter }}'
AND $orderby = '{{ $orderby }}'
AND $expand = '{{ $expand }}'
AND $search = '{{ $search }}'
AND $count = '{{ $count }}'
AND $top = '{{ $top }}'
AND $skip = '{{ $skip }}'
AND $skipToken = '{{ $skipToken }}'
;