metadata

Creates, updates, deletes, gets or lists a metadata resource.

Overview

Name	metadata
Type	Resource
Id	azure.sentinel.metadata

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
etag	string	Etag of the azure resource
properties	object	Metadata properties

list

Name	Datatype	Description
etag	string	Etag of the azure resource
properties	object	Metadata properties

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	subscriptionId, resourceGroupName, workspaceName, metadataName		Get a Metadata.
list	select	subscriptionId, resourceGroupName, workspaceName	$filter, $orderby, $top, $skip	List of all metadata
create	insert	subscriptionId, resourceGroupName, workspaceName, metadataName		Create a Metadata.
update	update	subscriptionId, resourceGroupName, workspaceName, metadataName		Update an existing Metadata.
delete	delete	subscriptionId, resourceGroupName, workspaceName, metadataName		Delete a Metadata.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
metadataName	string	The Metadata name.
resourceGroupName	string	The name of the resource group. The name is case insensitive.
subscriptionId	string	The ID of the target subscription.
workspaceName	string	The name of the workspace.
$filter	string	Filters the results, based on a Boolean condition. Optional.
$orderby	string	Sorts the results. Optional.
$skip	integer (int32)	Used to skip n elements in the OData query (offset). Returns a nextLink to the next page of results if there are any left.
$top	integer (int32)	Returns only the first n results. Optional.

SELECT examples

get

Get a Metadata.

SELECT
etag,
properties
FROM azure.sentinel.metadata
WHERE subscriptionId = '{{ subscriptionId }}' -- required
AND resourceGroupName = '{{ resourceGroupName }}' -- required
AND workspaceName = '{{ workspaceName }}' -- required
AND metadataName = '{{ metadataName }}' -- required
;

list

List of all metadata

SELECT
etag,
properties
FROM azure.sentinel.metadata
WHERE subscriptionId = '{{ subscriptionId }}' -- required
AND resourceGroupName = '{{ resourceGroupName }}' -- required
AND workspaceName = '{{ workspaceName }}' -- required
AND $filter = '{{ $filter }}'
AND $orderby = '{{ $orderby }}'
AND $top = '{{ $top }}'
AND $skip = '{{ $skip }}'
;

INSERT examples

create

Create a Metadata.

INSERT INTO azure.sentinel.metadata (
data__etag,
data__properties,
subscriptionId,
resourceGroupName,
workspaceName,
metadataName
)
SELECT 
'{{ etag }}',
'{{ properties }}',
'{{ subscriptionId }}',
'{{ resourceGroupName }}',
'{{ workspaceName }}',
'{{ metadataName }}'
RETURNING
etag,
properties
;

Manifest

# Description fields are for documentation purposes
- name: metadata
  props:
    - name: subscriptionId
      value: string
      description: Required parameter for the metadata resource.
    - name: resourceGroupName
      value: string
      description: Required parameter for the metadata resource.
    - name: workspaceName
      value: string
      description: Required parameter for the metadata resource.
    - name: metadataName
      value: string
      description: Required parameter for the metadata resource.
    - name: etag
      value: string
      description: |
        Etag of the azure resource
    - name: properties
      value: object
      description: |
        Metadata properties

UPDATE examples

update

Update an existing Metadata.

UPDATE azure.sentinel.metadata
SET 
data__properties = '{{ properties }}'
WHERE 
subscriptionId = '{{ subscriptionId }}' --required
AND resourceGroupName = '{{ resourceGroupName }}' --required
AND workspaceName = '{{ workspaceName }}' --required
AND metadataName = '{{ metadataName }}' --required
RETURNING
etag,
properties;

DELETE examples

delete

Delete a Metadata.

DELETE FROM azure.sentinel.metadata
WHERE subscriptionId = '{{ subscriptionId }}' --required
AND resourceGroupName = '{{ resourceGroupName }}' --required
AND workspaceName = '{{ workspaceName }}' --required
AND metadataName = '{{ metadataName }}' --required
;