metadata

Creates, updates, deletes, gets or lists a metadata resource.

Overview

Name	metadata
Type	Resource
Id	azure.security_insight.metadata

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
author	object	The creator of the content item.
categories	object	Categories for the solution content item.
contentId	string	Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Can be optionally set for user created content to define dependencies. If an active content item is made from a template, both will have the same contentId.
contentSchemaVersion	string	Schema version of the content. Can be used to distinguish between different flow based on the schema version.
customVersion	string	The custom version of the content. A optional free text.
dependencies	object	Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
etag	string	Etag of the azure resource.
firstPublishDate	string (date)	first publish date of solution content item.
icon	string	the icon identifier. this id can later be fetched from the solution template.
kind	string	The kind of content the metadata is for. Required.
lastPublishDate	string (date)	last publish date of solution content item.
parentId	string	Full parent resource ID of the content item the metadata is for. This is the full resource ID including the scope (subscription and resource group). Required.
previewImages	array	preview image file names. These will be taken from the solution artifacts.
previewImagesDark	array	preview image file names. These will be taken from the solution artifacts. used for dark theme support.
providers	array	Providers for the solution content item.
source	object	Source of the content. This is where/how it was created.
support	object	Support information for the metadata - type, name, contact information.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
threatAnalysisTactics	array	the tactics the resource covers.
threatAnalysisTechniques	array	the techniques the resource covers, these have to be aligned with the tactics being used.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
version	string	Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM template best practices. Can also be any string, but then we cannot guarantee any version checks.

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
author	object	The creator of the content item.
categories	object	Categories for the solution content item.
contentId	string	Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Can be optionally set for user created content to define dependencies. If an active content item is made from a template, both will have the same contentId.
contentSchemaVersion	string	Schema version of the content. Can be used to distinguish between different flow based on the schema version.
customVersion	string	The custom version of the content. A optional free text.
dependencies	object	Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
etag	string	Etag of the azure resource.
firstPublishDate	string (date)	first publish date of solution content item.
icon	string	the icon identifier. this id can later be fetched from the solution template.
kind	string	The kind of content the metadata is for. Required.
lastPublishDate	string (date)	last publish date of solution content item.
parentId	string	Full parent resource ID of the content item the metadata is for. This is the full resource ID including the scope (subscription and resource group). Required.
previewImages	array	preview image file names. These will be taken from the solution artifacts.
previewImagesDark	array	preview image file names. These will be taken from the solution artifacts. used for dark theme support.
providers	array	Providers for the solution content item.
source	object	Source of the content. This is where/how it was created.
support	object	Support information for the metadata - type, name, contact information.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
threatAnalysisTactics	array	the tactics the resource covers.
threatAnalysisTechniques	array	the techniques the resource covers, these have to be aligned with the tactics being used.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
version	string	Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM template best practices. Can also be any string, but then we cannot guarantee any version checks.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, workspace_name, metadata_name, subscription_id		Get a Metadata.
list	select	resource_group_name, workspace_name, subscription_id	$filter, $orderby, $top, $skip	List of all metadata.
create	insert	resource_group_name, workspace_name, metadata_name, subscription_id		Create a Metadata.
update	update	resource_group_name, workspace_name, metadata_name, subscription_id		Update an existing Metadata.
delete	delete	resource_group_name, workspace_name, metadata_name, subscription_id		Delete a Metadata.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
metadata_name	string	The Metadata name. Required.
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string
workspace_name	string	The name of the monitor workspace. Required.
$filter	string	Filters the results, based on a Boolean condition. Optional. Default value is None.
$orderby	string	Sorts the results. Optional. Default value is None.
$skip	integer	Used to skip n elements in the OData query (offset). Returns a nextLink to the next page of results if there are any left. Default value is None.
$top	integer	Returns only the first n results. Optional. Default value is None.

SELECT examples

get

Get a Metadata.

SELECT
id,
name,
author,
categories,
contentId,
contentSchemaVersion,
customVersion,
dependencies,
etag,
firstPublishDate,
icon,
kind,
lastPublishDate,
parentId,
previewImages,
previewImagesDark,
providers,
source,
support,
systemData,
threatAnalysisTactics,
threatAnalysisTechniques,
type,
version
FROM azure.security_insight.metadata
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND metadata_name = '{{ metadata_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list

List of all metadata.

SELECT
id,
name,
author,
categories,
contentId,
contentSchemaVersion,
customVersion,
dependencies,
etag,
firstPublishDate,
icon,
kind,
lastPublishDate,
parentId,
previewImages,
previewImagesDark,
providers,
source,
support,
systemData,
threatAnalysisTactics,
threatAnalysisTechniques,
type,
version
FROM azure.security_insight.metadata
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
AND $filter = '{{ $filter }}'
AND $orderby = '{{ $orderby }}'
AND $top = '{{ $top }}'
AND $skip = '{{ $skip }}'
;

INSERT examples

create

Create a Metadata.

INSERT INTO azure.security_insight.metadata (
properties,
etag,
resource_group_name,
workspace_name,
metadata_name,
subscription_id
)
SELECT 
'{{ properties }}',
'{{ etag }}',
'{{ resource_group_name }}',
'{{ workspace_name }}',
'{{ metadata_name }}',
'{{ subscription_id }}'
RETURNING
id,
name,
etag,
properties,
systemData,
type
;

Manifest

# Description fields are for documentation purposes
- name: metadata
props:
  - name: resource_group_name
    value: "{{ resource_group_name }}"
    description: Required parameter for the metadata resource.
  - name: workspace_name
    value: "{{ workspace_name }}"
    description: Required parameter for the metadata resource.
  - name: metadata_name
    value: "{{ metadata_name }}"
    description: Required parameter for the metadata resource.
  - name: subscription_id
    value: "{{ subscription_id }}"
    description: Required parameter for the metadata resource.
  - name: properties
    description: |
      Metadata properties.
    value:
      contentId: "{{ contentId }}"
      parentId: "{{ parentId }}"
      version: "{{ version }}"
      kind: "{{ kind }}"
      source:
        kind: "{{ kind }}"
        name: "{{ name }}"
        sourceId: "{{ sourceId }}"
      author:
        name: "{{ name }}"
        email: "{{ email }}"
        link: "{{ link }}"
      support:
        tier: "{{ tier }}"
        name: "{{ name }}"
        email: "{{ email }}"
        link: "{{ link }}"
      dependencies:
        contentId: "{{ contentId }}"
        kind: "{{ kind }}"
        version: "{{ version }}"
        name: "{{ name }}"
        operator: "{{ operator }}"
        criteria:
          - contentId: "{{ contentId }}"
            kind: "{{ kind }}"
            version: "{{ version }}"
            name: "{{ name }}"
            operator: "{{ operator }}"
            criteria: "{{ criteria }}"
      categories:
        domains:
          - "{{ domains }}"
        verticals:
          - "{{ verticals }}"
      providers:
        - "{{ providers }}"
      firstPublishDate: "{{ firstPublishDate }}"
      lastPublishDate: "{{ lastPublishDate }}"
      customVersion: "{{ customVersion }}"
      contentSchemaVersion: "{{ contentSchemaVersion }}"
      icon: "{{ icon }}"
      threatAnalysisTactics:
        - "{{ threatAnalysisTactics }}"
      threatAnalysisTechniques:
        - "{{ threatAnalysisTechniques }}"
      previewImages:
        - "{{ previewImages }}"
      previewImagesDark:
        - "{{ previewImagesDark }}"
  - name: etag
    value: "{{ etag }}"
    description: |
      Etag of the azure resource.

UPDATE examples

update

Update an existing Metadata.

UPDATE azure.security_insight.metadata
SET 
etag = '{{ etag }}',
properties = '{{ properties }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND metadata_name = '{{ metadata_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
RETURNING
id,
name,
etag,
properties,
systemData,
type;

DELETE examples

delete

Delete a Metadata.

DELETE FROM azure.security_insight.metadata
WHERE resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND metadata_name = '{{ metadata_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
;