entities

Creates, updates, deletes, gets or lists an entities resource.

Overview

Name	entities
Type	Resource
Id	azure.security_insight.entities

Fields

The following fields are returned by SELECT queries:

get_insights

Name	Datatype	Description
metaData	object	The metadata from the get insights operation results.
value	array	The insights result values.

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
kind	string	Metadata used by portal/tooling/etc to render different UX experiences for resources of the same type; e.g. ApiApps are a kind of Microsoft.Web/sites type. If supported, the resource provider must validate and persist this value. Required. Known values are: "Account", "Host", "File", "AzureResource", "CloudApplication", "DnsResolution", "FileHash", "Ip", "Malware", "Process", "RegistryKey", "RegistryValue", "SecurityGroup", "Url", "IoTDevice", "SecurityAlert", "Bookmark", "MailCluster", "MailMessage", "Mailbox", "SubmissionMail", and "Nic".
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
kind	string	Metadata used by portal/tooling/etc to render different UX experiences for resources of the same type; e.g. ApiApps are a kind of Microsoft.Web/sites type. If supported, the resource provider must validate and persist this value. Required. Known values are: "Account", "Host", "File", "AzureResource", "CloudApplication", "DnsResolution", "FileHash", "Ip", "Malware", "Process", "RegistryKey", "RegistryValue", "SecurityGroup", "Url", "IoTDevice", "SecurityAlert", "Bookmark", "MailCluster", "MailMessage", "Mailbox", "SubmissionMail", and "Nic".
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_insights	select	resource_group_name, workspace_name, entity_id, subscription_id		Execute Insights for an entity.
get	select	resource_group_name, workspace_name, entity_id, subscription_id		Gets an entity.
list	select	resource_group_name, workspace_name, subscription_id		Gets all entities.
run_playbook	exec	resource_group_name, workspace_name, entity_identifier, subscription_id, logicAppsResourceId		Triggers playbook on a specific entity.
expand	exec	resource_group_name, workspace_name, entity_id, subscription_id		Expands an entity.
queries	exec	resource_group_name, workspace_name, entity_id, subscription_id, kind		Get Insights and Activities for an entity.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
entity_id	string	entity ID. Required.
entity_identifier	string	entity ID. Required.
kind	string	The Kind parameter for queries. "Insight" Required.
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string
workspace_name	string	The name of the workspace. Required.

SELECT examples

get_insights

Execute Insights for an entity.

SELECT
metaData,
value
FROM azure.security_insight.entities
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND entity_id = '{{ entity_id }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

get

Gets an entity.

SELECT
id,
name,
kind,
systemData,
type
FROM azure.security_insight.entities
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND entity_id = '{{ entity_id }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list

Gets all entities.

SELECT
id,
name,
kind,
systemData,
type
FROM azure.security_insight.entities
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

Lifecycle Methods

run_playbook

Triggers playbook on a specific entity.

EXEC azure.security_insight.entities.run_playbook 
@resource_group_name='{{ resource_group_name }}' --required, 
@workspace_name='{{ workspace_name }}' --required, 
@entity_identifier='{{ entity_identifier }}' --required, 
@subscription_id='{{ subscription_id }}' --required 
@@json=
'{
"incidentArmId": "{{ incidentArmId }}", 
"tenantId": "{{ tenantId }}", 
"logicAppsResourceId": "{{ logicAppsResourceId }}"
}'
;

expand

Expands an entity.

EXEC azure.security_insight.entities.expand 
@resource_group_name='{{ resource_group_name }}' --required, 
@workspace_name='{{ workspace_name }}' --required, 
@entity_id='{{ entity_id }}' --required, 
@subscription_id='{{ subscription_id }}' --required 
@@json=
'{
"endTime": "{{ endTime }}", 
"expansionId": "{{ expansionId }}", 
"startTime": "{{ startTime }}"
}'
;

queries

Get Insights and Activities for an entity.

EXEC azure.security_insight.entities.queries 
@resource_group_name='{{ resource_group_name }}' --required, 
@workspace_name='{{ workspace_name }}' --required, 
@entity_id='{{ entity_id }}' --required, 
@subscription_id='{{ subscription_id }}' --required, 
@kind='{{ kind }}' --required
;