hunts

Creates, updates, deletes, gets or lists a hunts resource.

Overview

Name	hunts
Type	Resource
Id	azure.security_insight.hunts

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
attackTactics	array	A list of mitre attack tactics the hunt is associated with.
attackTechniques	array	A list of a mitre attack techniques the hunt is associated with.
description	string	The description of the hunt. Required.
displayName	string	The display name of the hunt. Required.
etag	string	Etag of the azure resource.
hypothesisStatus	string	The hypothesis status of the hunt. Known values are: "Unknown", "Invalidated", and "Validated". (Unknown, Invalidated, Validated)
labels	array	List of labels relevant to this hunt.
owner	object	Describes a user that the hunt is assigned to.
status	string	The status of the hunt. Known values are: "New", "Active", "Closed", "Backlog", "Approved", "Succeeded", "Failed", and "InProgress". (New, Active, Closed, Backlog, Approved, Succeeded, Failed, InProgress)
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
attackTactics	array	A list of mitre attack tactics the hunt is associated with.
attackTechniques	array	A list of a mitre attack techniques the hunt is associated with.
description	string	The description of the hunt. Required.
displayName	string	The display name of the hunt. Required.
etag	string	Etag of the azure resource.
hypothesisStatus	string	The hypothesis status of the hunt. Known values are: "Unknown", "Invalidated", and "Validated". (Unknown, Invalidated, Validated)
labels	array	List of labels relevant to this hunt.
owner	object	Describes a user that the hunt is assigned to.
status	string	The status of the hunt. Known values are: "New", "Active", "Closed", "Backlog", "Approved", "Succeeded", "Failed", and "InProgress". (New, Active, Closed, Backlog, Approved, Succeeded, Failed, InProgress)
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, workspace_name, hunt_id, subscription_id		Gets a hunt, without relations and comments.
list	select	resource_group_name, workspace_name, subscription_id	$filter, $orderby, $top, $skipToken	Gets all hunts, without relations and comments.
create_or_update	insert	resource_group_name, workspace_name, hunt_id, subscription_id		Create or update a hunt.
create_or_update	replace	resource_group_name, workspace_name, hunt_id, subscription_id		Create or update a hunt.
delete	delete	resource_group_name, workspace_name, hunt_id, subscription_id		Delete a hunt.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
hunt_id	string	The hunt id (GUID). Required.
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string
workspace_name	string	The name of the workspace. Required.
$filter	string	Filters the results, based on a Boolean condition. Optional. Default value is None.
$orderby	string	Sorts the results. Optional. Default value is None.
$skipToken	string	Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. Default value is None.
$top	integer	Returns only the first n results. Optional. Default value is None.

SELECT examples

get

Gets a hunt, without relations and comments.

SELECT
id,
name,
attackTactics,
attackTechniques,
description,
displayName,
etag,
hypothesisStatus,
labels,
owner,
status,
systemData,
type
FROM azure.security_insight.hunts
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND hunt_id = '{{ hunt_id }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list

Gets all hunts, without relations and comments.

SELECT
id,
name,
attackTactics,
attackTechniques,
description,
displayName,
etag,
hypothesisStatus,
labels,
owner,
status,
systemData,
type
FROM azure.security_insight.hunts
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
AND $filter = '{{ $filter }}'
AND $orderby = '{{ $orderby }}'
AND $top = '{{ $top }}'
AND $skipToken = '{{ $skipToken }}'
;

INSERT examples

create_or_update

Create or update a hunt.

INSERT INTO azure.security_insight.hunts (
properties,
etag,
resource_group_name,
workspace_name,
hunt_id,
subscription_id
)
SELECT 
'{{ properties }}',
'{{ etag }}',
'{{ resource_group_name }}',
'{{ workspace_name }}',
'{{ hunt_id }}',
'{{ subscription_id }}'
RETURNING
id,
name,
etag,
properties,
systemData,
type
;

Manifest

# Description fields are for documentation purposes
- name: hunts
props:
  - name: resource_group_name
    value: "{{ resource_group_name }}"
    description: Required parameter for the hunts resource.
  - name: workspace_name
    value: "{{ workspace_name }}"
    description: Required parameter for the hunts resource.
  - name: hunt_id
    value: "{{ hunt_id }}"
    description: Required parameter for the hunts resource.
  - name: subscription_id
    value: "{{ subscription_id }}"
    description: Required parameter for the hunts resource.
  - name: properties
    description: |
      Hunt properties.
    value:
      displayName: "{{ displayName }}"
      description: "{{ description }}"
      status: "{{ status }}"
      hypothesisStatus: "{{ hypothesisStatus }}"
      attackTactics:
        - "{{ attackTactics }}"
      attackTechniques:
        - "{{ attackTechniques }}"
      labels:
        - "{{ labels }}"
      owner:
        email: "{{ email }}"
        assignedTo: "{{ assignedTo }}"
        objectId: "{{ objectId }}"
        userPrincipalName: "{{ userPrincipalName }}"
        ownerType: "{{ ownerType }}"
  - name: etag
    value: "{{ etag }}"
    description: |
      Etag of the azure resource.

REPLACE examples

create_or_update

Create or update a hunt.

REPLACE azure.security_insight.hunts
SET 
properties = '{{ properties }}',
etag = '{{ etag }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND hunt_id = '{{ hunt_id }}' --required
AND subscription_id = '{{ subscription_id }}' --required
RETURNING
id,
name,
etag,
properties,
systemData,
type;

DELETE examples

delete

Delete a hunt.

DELETE FROM azure.security_insight.hunts
WHERE resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND hunt_id = '{{ hunt_id }}' --required
AND subscription_id = '{{ subscription_id }}' --required
;