content_templates

Creates, updates, deletes, gets or lists a content_templates resource.

Overview

Name	content_templates
Type	Resource
Id	azure.sentinel.content_templates

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
etag	string	Etag of the azure resource
properties	object	template properties

list

Name	Datatype	Description
etag	string	Etag of the azure resource
properties	object	template properties

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	subscriptionId, resourceGroupName, workspaceName, templateId		Gets a template byt its identifier. Expandable properties: - properties/mainTemplate - properties/dependantTemplates
list	select	subscriptionId, resourceGroupName, workspaceName	$filter, $orderby, $expand, $search, $count, $top, $skip, $skipToken	Gets all installed templates. Expandable properties: - properties/mainTemplate - properties/dependantTemplates
delete	delete	subscriptionId, resourceGroupName, workspaceName, templateId		Delete an installed template.
install	exec	subscriptionId, resourceGroupName, workspaceName, templateId		Install a template.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
resourceGroupName	string	The name of the resource group. The name is case insensitive.
subscriptionId	string	The ID of the target subscription.
templateId	string	template Id
workspaceName	string	The name of the workspace.
$count	boolean	Instructs the server to return only object count without actual body. Optional.
$expand	string	Expands the object with optional fiends that are not included by default. Optional.
$filter	string	Filters the results, based on a Boolean condition. Optional.
$orderby	string	Sorts the results. Optional.
$search	string	Searches for a substring in the response. Optional.
$skip	integer (int32)	Used to skip n elements in the OData query (offset). Returns a nextLink to the next page of results if there are any left.
$skipToken	string	Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.
$top	integer (int32)	Returns only the first n results. Optional.

SELECT examples

get

Gets a template byt its identifier.
Expandable properties:
- properties/mainTemplate
- properties/dependantTemplates

SELECT
etag,
properties
FROM azure.sentinel.content_templates
WHERE subscriptionId = '{{ subscriptionId }}' -- required
AND resourceGroupName = '{{ resourceGroupName }}' -- required
AND workspaceName = '{{ workspaceName }}' -- required
AND templateId = '{{ templateId }}' -- required
;

list

Gets all installed templates.
Expandable properties:
- properties/mainTemplate
- properties/dependantTemplates

SELECT
etag,
properties
FROM azure.sentinel.content_templates
WHERE subscriptionId = '{{ subscriptionId }}' -- required
AND resourceGroupName = '{{ resourceGroupName }}' -- required
AND workspaceName = '{{ workspaceName }}' -- required
AND $filter = '{{ $filter }}'
AND $orderby = '{{ $orderby }}'
AND $expand = '{{ $expand }}'
AND $search = '{{ $search }}'
AND $count = '{{ $count }}'
AND $top = '{{ $top }}'
AND $skip = '{{ $skip }}'
AND $skipToken = '{{ $skipToken }}'
;

DELETE examples

delete

Delete an installed template.

DELETE FROM azure.sentinel.content_templates
WHERE subscriptionId = '{{ subscriptionId }}' --required
AND resourceGroupName = '{{ resourceGroupName }}' --required
AND workspaceName = '{{ workspaceName }}' --required
AND templateId = '{{ templateId }}' --required
;

Lifecycle Methods

install

Install a template.

EXEC azure.sentinel.content_templates.install 
@subscriptionId='{{ subscriptionId }}' --required, 
@resourceGroupName='{{ resourceGroupName }}' --required, 
@workspaceName='{{ workspaceName }}' --required, 
@templateId='{{ templateId }}' --required 
@@json=
'{
"etag": "{{ etag }}", 
"properties": "{{ properties }}"
}'
;