azure-sdk-for-go: github.com/Azure/azure-sdk-for-go/services/securityinsight/mgmt/v1.0/securityinsight Index | Files | Directories

package securityinsight

import "github.com/Azure/azure-sdk-for-go/services/securityinsight/mgmt/v1.0/securityinsight"

Package securityinsight implements the Azure ARM Securityinsight service API version 2020-01-01.

API spec for Microsoft.SecurityInsights (Azure Security Insights) resource provider

Index

Package Files

actions.go alertrules.go alertruletemplates.go bookmarks.go client.go dataconnectors.go enums.go incidentcomments.go incidents.go models.go operations.go version.go

Constants

const (
    // DefaultBaseURI is the default URI used for the service Securityinsight
    DefaultBaseURI = "https://management.azure.com"
)

func UserAgent Uses

func UserAgent() string

UserAgent returns the UserAgent string to use when sending http.Requests.

func Version Uses

func Version() string

Version returns the semantic version (see http://semver.org) of the client.

type AADDataConnector Uses

type AADDataConnector struct {
    // AADDataConnectorProperties - AAD (Azure Active Directory) data connector properties.
    *AADDataConnectorProperties `json:"properties,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
    // Kind - Possible values include: 'KindDataConnector', 'KindAzureActiveDirectory', 'KindAzureAdvancedThreatProtection', 'KindAzureSecurityCenter', 'KindAmazonWebServicesCloudTrail', 'KindMicrosoftCloudAppSecurity', 'KindMicrosoftDefenderAdvancedThreatProtection', 'KindOffice365', 'KindThreatIntelligence'
    Kind KindBasicDataConnector `json:"kind,omitempty"`
}

AADDataConnector represents AAD (Azure Active Directory) data connector.

func (AADDataConnector) AsAADDataConnector Uses

func (adc AADDataConnector) AsAADDataConnector() (*AADDataConnector, bool)

AsAADDataConnector is the BasicDataConnector implementation for AADDataConnector.

func (AADDataConnector) AsAATPDataConnector Uses

func (adc AADDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool)

AsAATPDataConnector is the BasicDataConnector implementation for AADDataConnector.

func (AADDataConnector) AsASCDataConnector Uses

func (adc AADDataConnector) AsASCDataConnector() (*ASCDataConnector, bool)

AsASCDataConnector is the BasicDataConnector implementation for AADDataConnector.

func (AADDataConnector) AsAwsCloudTrailDataConnector Uses

func (adc AADDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool)

AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for AADDataConnector.

func (AADDataConnector) AsBasicDataConnector Uses

func (adc AADDataConnector) AsBasicDataConnector() (BasicDataConnector, bool)

AsBasicDataConnector is the BasicDataConnector implementation for AADDataConnector.

func (AADDataConnector) AsDataConnector Uses

func (adc AADDataConnector) AsDataConnector() (*DataConnector, bool)

AsDataConnector is the BasicDataConnector implementation for AADDataConnector.

func (AADDataConnector) AsMCASDataConnector Uses

func (adc AADDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool)

AsMCASDataConnector is the BasicDataConnector implementation for AADDataConnector.

func (AADDataConnector) AsMDATPDataConnector Uses

func (adc AADDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool)

AsMDATPDataConnector is the BasicDataConnector implementation for AADDataConnector.

func (AADDataConnector) AsOfficeDataConnector Uses

func (adc AADDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool)

AsOfficeDataConnector is the BasicDataConnector implementation for AADDataConnector.

func (AADDataConnector) AsTIDataConnector Uses

func (adc AADDataConnector) AsTIDataConnector() (*TIDataConnector, bool)

AsTIDataConnector is the BasicDataConnector implementation for AADDataConnector.

func (AADDataConnector) MarshalJSON Uses

func (adc AADDataConnector) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for AADDataConnector.

func (*AADDataConnector) UnmarshalJSON Uses

func (adc *AADDataConnector) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for AADDataConnector struct.

type AADDataConnectorProperties Uses

type AADDataConnectorProperties struct {
    // TenantID - The tenant id to connect to, and get the data from.
    TenantID *string `json:"tenantId,omitempty"`
    // DataTypes - The available data types for the connector.
    DataTypes *AlertsDataTypeOfDataConnector `json:"dataTypes,omitempty"`
}

AADDataConnectorProperties AAD (Azure Active Directory) data connector properties.

type AATPDataConnector Uses

type AATPDataConnector struct {
    // AATPDataConnectorProperties - AATP (Azure Advanced Threat Protection) data connector properties.
    *AATPDataConnectorProperties `json:"properties,omitempty"`
    // Kind - Possible values include: 'KindDataConnector', 'KindAzureActiveDirectory', 'KindAzureAdvancedThreatProtection', 'KindAzureSecurityCenter', 'KindAmazonWebServicesCloudTrail', 'KindMicrosoftCloudAppSecurity', 'KindMicrosoftDefenderAdvancedThreatProtection', 'KindOffice365', 'KindThreatIntelligence'
    Kind KindBasicDataConnector `json:"kind,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
}

AATPDataConnector represents AATP (Azure Advanced Threat Protection) data connector.

func (AATPDataConnector) AsAADDataConnector Uses

func (adc AATPDataConnector) AsAADDataConnector() (*AADDataConnector, bool)

AsAADDataConnector is the BasicDataConnector implementation for AATPDataConnector.

func (AATPDataConnector) AsAATPDataConnector Uses

func (adc AATPDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool)

AsAATPDataConnector is the BasicDataConnector implementation for AATPDataConnector.

func (AATPDataConnector) AsASCDataConnector Uses

func (adc AATPDataConnector) AsASCDataConnector() (*ASCDataConnector, bool)

AsASCDataConnector is the BasicDataConnector implementation for AATPDataConnector.

func (AATPDataConnector) AsAwsCloudTrailDataConnector Uses

func (adc AATPDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool)

AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for AATPDataConnector.

func (AATPDataConnector) AsBasicDataConnector Uses

func (adc AATPDataConnector) AsBasicDataConnector() (BasicDataConnector, bool)

AsBasicDataConnector is the BasicDataConnector implementation for AATPDataConnector.

func (AATPDataConnector) AsDataConnector Uses

func (adc AATPDataConnector) AsDataConnector() (*DataConnector, bool)

AsDataConnector is the BasicDataConnector implementation for AATPDataConnector.

func (AATPDataConnector) AsMCASDataConnector Uses

func (adc AATPDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool)

AsMCASDataConnector is the BasicDataConnector implementation for AATPDataConnector.

func (AATPDataConnector) AsMDATPDataConnector Uses

func (adc AATPDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool)

AsMDATPDataConnector is the BasicDataConnector implementation for AATPDataConnector.

func (AATPDataConnector) AsOfficeDataConnector Uses

func (adc AATPDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool)

AsOfficeDataConnector is the BasicDataConnector implementation for AATPDataConnector.

func (AATPDataConnector) AsTIDataConnector Uses

func (adc AATPDataConnector) AsTIDataConnector() (*TIDataConnector, bool)

AsTIDataConnector is the BasicDataConnector implementation for AATPDataConnector.

func (AATPDataConnector) MarshalJSON Uses

func (adc AATPDataConnector) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for AATPDataConnector.

func (*AATPDataConnector) UnmarshalJSON Uses

func (adc *AATPDataConnector) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for AATPDataConnector struct.

type AATPDataConnectorProperties Uses

type AATPDataConnectorProperties struct {
    // TenantID - The tenant id to connect to, and get the data from.
    TenantID *string `json:"tenantId,omitempty"`
    // DataTypes - The available data types for the connector.
    DataTypes *AlertsDataTypeOfDataConnector `json:"dataTypes,omitempty"`
}

AATPDataConnectorProperties AATP (Azure Advanced Threat Protection) data connector properties.

type ASCDataConnector Uses

type ASCDataConnector struct {
    // ASCDataConnectorProperties - ASC (Azure Security Center) data connector properties.
    *ASCDataConnectorProperties `json:"properties,omitempty"`
    // Kind - Possible values include: 'KindDataConnector', 'KindAzureActiveDirectory', 'KindAzureAdvancedThreatProtection', 'KindAzureSecurityCenter', 'KindAmazonWebServicesCloudTrail', 'KindMicrosoftCloudAppSecurity', 'KindMicrosoftDefenderAdvancedThreatProtection', 'KindOffice365', 'KindThreatIntelligence'
    Kind KindBasicDataConnector `json:"kind,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
}

ASCDataConnector represents ASC (Azure Security Center) data connector.

func (ASCDataConnector) AsAADDataConnector Uses

func (adc ASCDataConnector) AsAADDataConnector() (*AADDataConnector, bool)

AsAADDataConnector is the BasicDataConnector implementation for ASCDataConnector.

func (ASCDataConnector) AsAATPDataConnector Uses

func (adc ASCDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool)

AsAATPDataConnector is the BasicDataConnector implementation for ASCDataConnector.

func (ASCDataConnector) AsASCDataConnector Uses

func (adc ASCDataConnector) AsASCDataConnector() (*ASCDataConnector, bool)

AsASCDataConnector is the BasicDataConnector implementation for ASCDataConnector.

func (ASCDataConnector) AsAwsCloudTrailDataConnector Uses

func (adc ASCDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool)

AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for ASCDataConnector.

func (ASCDataConnector) AsBasicDataConnector Uses

func (adc ASCDataConnector) AsBasicDataConnector() (BasicDataConnector, bool)

AsBasicDataConnector is the BasicDataConnector implementation for ASCDataConnector.

func (ASCDataConnector) AsDataConnector Uses

func (adc ASCDataConnector) AsDataConnector() (*DataConnector, bool)

AsDataConnector is the BasicDataConnector implementation for ASCDataConnector.

func (ASCDataConnector) AsMCASDataConnector Uses

func (adc ASCDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool)

AsMCASDataConnector is the BasicDataConnector implementation for ASCDataConnector.

func (ASCDataConnector) AsMDATPDataConnector Uses

func (adc ASCDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool)

AsMDATPDataConnector is the BasicDataConnector implementation for ASCDataConnector.

func (ASCDataConnector) AsOfficeDataConnector Uses

func (adc ASCDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool)

AsOfficeDataConnector is the BasicDataConnector implementation for ASCDataConnector.

func (ASCDataConnector) AsTIDataConnector Uses

func (adc ASCDataConnector) AsTIDataConnector() (*TIDataConnector, bool)

AsTIDataConnector is the BasicDataConnector implementation for ASCDataConnector.

func (ASCDataConnector) MarshalJSON Uses

func (adc ASCDataConnector) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for ASCDataConnector.

func (*ASCDataConnector) UnmarshalJSON Uses

func (adc *ASCDataConnector) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for ASCDataConnector struct.

type ASCDataConnectorProperties Uses

type ASCDataConnectorProperties struct {
    // SubscriptionID - The subscription id to connect to, and get the data from.
    SubscriptionID *string `json:"subscriptionId,omitempty"`
    // DataTypes - The available data types for the connector.
    DataTypes *AlertsDataTypeOfDataConnector `json:"dataTypes,omitempty"`
}

ASCDataConnectorProperties ASC (Azure Security Center) data connector properties.

type ActionPropertiesBase Uses

type ActionPropertiesBase struct {
    // LogicAppResourceID - Logic App Resource Id, /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}.
    LogicAppResourceID *string `json:"logicAppResourceId,omitempty"`
}

ActionPropertiesBase action property bag base.

type ActionRequest Uses

type ActionRequest struct {
    // ActionRequestProperties - Action properties for put request
    *ActionRequestProperties `json:"properties,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
}

ActionRequest action for alert rule.

func (ActionRequest) MarshalJSON Uses

func (ar ActionRequest) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for ActionRequest.

func (*ActionRequest) UnmarshalJSON Uses

func (ar *ActionRequest) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for ActionRequest struct.

type ActionRequestProperties Uses

type ActionRequestProperties struct {
    // TriggerURI - Logic App Callback URL for this specific workflow.
    TriggerURI *string `json:"triggerUri,omitempty"`
    // LogicAppResourceID - Logic App Resource Id, /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}.
    LogicAppResourceID *string `json:"logicAppResourceId,omitempty"`
}

ActionRequestProperties action property bag.

type ActionResponse Uses

type ActionResponse struct {
    autorest.Response `json:"-"`
    // Etag - Etag of the action.
    Etag *string `json:"etag,omitempty"`
    // ActionResponseProperties - Action properties for get request
    *ActionResponseProperties `json:"properties,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
}

ActionResponse action for alert rule.

func (ActionResponse) MarshalJSON Uses

func (ar ActionResponse) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for ActionResponse.

func (*ActionResponse) UnmarshalJSON Uses

func (ar *ActionResponse) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for ActionResponse struct.

type ActionResponseProperties Uses

type ActionResponseProperties struct {
    // WorkflowID - The name of the logic app's workflow.
    WorkflowID *string `json:"workflowId,omitempty"`
    // LogicAppResourceID - Logic App Resource Id, /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}.
    LogicAppResourceID *string `json:"logicAppResourceId,omitempty"`
}

ActionResponseProperties action property bag.

type ActionsClient Uses

type ActionsClient struct {
    BaseClient
}

ActionsClient is the API spec for Microsoft.SecurityInsights (Azure Security Insights) resource provider

func NewActionsClient Uses

func NewActionsClient(subscriptionID string) ActionsClient

NewActionsClient creates an instance of the ActionsClient client.

func NewActionsClientWithBaseURI Uses

func NewActionsClientWithBaseURI(baseURI string, subscriptionID string) ActionsClient

NewActionsClientWithBaseURI creates an instance of the ActionsClient client using a custom endpoint. Use this when interacting with an Azure cloud that uses a non-standard base URI (sovereign clouds, Azure stack).

func (ActionsClient) ListByAlertRule Uses

func (client ActionsClient) ListByAlertRule(ctx context.Context, resourceGroupName string, workspaceName string, ruleID string) (result ActionsListPage, err error)

ListByAlertRule gets all actions of alert rule. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. ruleID - alert rule ID

func (ActionsClient) ListByAlertRuleComplete Uses

func (client ActionsClient) ListByAlertRuleComplete(ctx context.Context, resourceGroupName string, workspaceName string, ruleID string) (result ActionsListIterator, err error)

ListByAlertRuleComplete enumerates all values, automatically crossing page boundaries as required.

func (ActionsClient) ListByAlertRulePreparer Uses

func (client ActionsClient) ListByAlertRulePreparer(ctx context.Context, resourceGroupName string, workspaceName string, ruleID string) (*http.Request, error)

ListByAlertRulePreparer prepares the ListByAlertRule request.

func (ActionsClient) ListByAlertRuleResponder Uses

func (client ActionsClient) ListByAlertRuleResponder(resp *http.Response) (result ActionsList, err error)

ListByAlertRuleResponder handles the response to the ListByAlertRule request. The method always closes the http.Response Body.

func (ActionsClient) ListByAlertRuleSender Uses

func (client ActionsClient) ListByAlertRuleSender(req *http.Request) (*http.Response, error)

ListByAlertRuleSender sends the ListByAlertRule request. The method will close the http.Response Body if it receives an error.

type ActionsList Uses

type ActionsList struct {
    autorest.Response `json:"-"`
    // NextLink - READ-ONLY; URL to fetch the next set of actions.
    NextLink *string `json:"nextLink,omitempty"`
    // Value - Array of actions.
    Value *[]ActionResponse `json:"value,omitempty"`
}

ActionsList list all the actions.

func (ActionsList) IsEmpty Uses

func (al ActionsList) IsEmpty() bool

IsEmpty returns true if the ListResult contains no values.

func (ActionsList) MarshalJSON Uses

func (al ActionsList) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for ActionsList.

type ActionsListIterator Uses

type ActionsListIterator struct {
    // contains filtered or unexported fields
}

ActionsListIterator provides access to a complete listing of ActionResponse values.

func NewActionsListIterator Uses

func NewActionsListIterator(page ActionsListPage) ActionsListIterator

Creates a new instance of the ActionsListIterator type.

func (*ActionsListIterator) Next Uses

func (iter *ActionsListIterator) Next() error

Next advances to the next value. If there was an error making the request the iterator does not advance and the error is returned. Deprecated: Use NextWithContext() instead.

func (*ActionsListIterator) NextWithContext Uses

func (iter *ActionsListIterator) NextWithContext(ctx context.Context) (err error)

NextWithContext advances to the next value. If there was an error making the request the iterator does not advance and the error is returned.

func (ActionsListIterator) NotDone Uses

func (iter ActionsListIterator) NotDone() bool

NotDone returns true if the enumeration should be started or is not yet complete.

func (ActionsListIterator) Response Uses

func (iter ActionsListIterator) Response() ActionsList

Response returns the raw server response from the last page request.

func (ActionsListIterator) Value Uses

func (iter ActionsListIterator) Value() ActionResponse

Value returns the current value or a zero-initialized value if the iterator has advanced beyond the end of the collection.

type ActionsListPage Uses

type ActionsListPage struct {
    // contains filtered or unexported fields
}

ActionsListPage contains a page of ActionResponse values.

func NewActionsListPage Uses

func NewActionsListPage(cur ActionsList, getNextPage func(context.Context, ActionsList) (ActionsList, error)) ActionsListPage

Creates a new instance of the ActionsListPage type.

func (*ActionsListPage) Next Uses

func (page *ActionsListPage) Next() error

Next advances to the next page of values. If there was an error making the request the page does not advance and the error is returned. Deprecated: Use NextWithContext() instead.

func (*ActionsListPage) NextWithContext Uses

func (page *ActionsListPage) NextWithContext(ctx context.Context) (err error)

NextWithContext advances to the next page of values. If there was an error making the request the page does not advance and the error is returned.

func (ActionsListPage) NotDone Uses

func (page ActionsListPage) NotDone() bool

NotDone returns true if the page enumeration should be started or is not yet complete.

func (ActionsListPage) Response Uses

func (page ActionsListPage) Response() ActionsList

Response returns the raw server response from the last page request.

func (ActionsListPage) Values Uses

func (page ActionsListPage) Values() []ActionResponse

Values returns the slice of values for the current page or nil if there are no values.

type AlertRule Uses

type AlertRule struct {
    autorest.Response `json:"-"`
    // Kind - Possible values include: 'KindAlertRule', 'KindFusion', 'KindMicrosoftSecurityIncidentCreation', 'KindScheduled'
    Kind Kind `json:"kind,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
}

AlertRule alert rule.

func (AlertRule) AsAlertRule Uses

func (ar AlertRule) AsAlertRule() (*AlertRule, bool)

AsAlertRule is the BasicAlertRule implementation for AlertRule.

func (AlertRule) AsBasicAlertRule Uses

func (ar AlertRule) AsBasicAlertRule() (BasicAlertRule, bool)

AsBasicAlertRule is the BasicAlertRule implementation for AlertRule.

func (AlertRule) AsFusionAlertRule Uses

func (ar AlertRule) AsFusionAlertRule() (*FusionAlertRule, bool)

AsFusionAlertRule is the BasicAlertRule implementation for AlertRule.

func (AlertRule) AsMicrosoftSecurityIncidentCreationAlertRule Uses

func (ar AlertRule) AsMicrosoftSecurityIncidentCreationAlertRule() (*MicrosoftSecurityIncidentCreationAlertRule, bool)

AsMicrosoftSecurityIncidentCreationAlertRule is the BasicAlertRule implementation for AlertRule.

func (AlertRule) AsScheduledAlertRule Uses

func (ar AlertRule) AsScheduledAlertRule() (*ScheduledAlertRule, bool)

AsScheduledAlertRule is the BasicAlertRule implementation for AlertRule.

func (AlertRule) MarshalJSON Uses

func (ar AlertRule) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for AlertRule.

type AlertRuleKind Uses

type AlertRuleKind string

AlertRuleKind enumerates the values for alert rule kind.

const (
    // Fusion ...
    Fusion AlertRuleKind = "Fusion"
    // MicrosoftSecurityIncidentCreation ...
    MicrosoftSecurityIncidentCreation AlertRuleKind = "MicrosoftSecurityIncidentCreation"
    // Scheduled ...
    Scheduled AlertRuleKind = "Scheduled"
)

func PossibleAlertRuleKindValues Uses

func PossibleAlertRuleKindValues() []AlertRuleKind

PossibleAlertRuleKindValues returns an array of possible values for the AlertRuleKind const type.

type AlertRuleModel Uses

type AlertRuleModel struct {
    autorest.Response `json:"-"`
    Value             BasicAlertRule `json:"value,omitempty"`
}

AlertRuleModel ...

func (*AlertRuleModel) UnmarshalJSON Uses

func (arm *AlertRuleModel) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for AlertRuleModel struct.

type AlertRuleTemplate Uses

type AlertRuleTemplate struct {
    autorest.Response `json:"-"`
    // Kind - Possible values include: 'KindBasicAlertRuleTemplateKindAlertRuleTemplate', 'KindBasicAlertRuleTemplateKindFusion', 'KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleTemplateKindScheduled'
    Kind KindBasicAlertRuleTemplate `json:"kind,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
}

AlertRuleTemplate alert rule template.

func (AlertRuleTemplate) AsAlertRuleTemplate Uses

func (art AlertRuleTemplate) AsAlertRuleTemplate() (*AlertRuleTemplate, bool)

AsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for AlertRuleTemplate.

func (AlertRuleTemplate) AsBasicAlertRuleTemplate Uses

func (art AlertRuleTemplate) AsBasicAlertRuleTemplate() (BasicAlertRuleTemplate, bool)

AsBasicAlertRuleTemplate is the BasicAlertRuleTemplate implementation for AlertRuleTemplate.

func (AlertRuleTemplate) AsFusionAlertRuleTemplate Uses

func (art AlertRuleTemplate) AsFusionAlertRuleTemplate() (*FusionAlertRuleTemplate, bool)

AsFusionAlertRuleTemplate is the BasicAlertRuleTemplate implementation for AlertRuleTemplate.

func (AlertRuleTemplate) AsMicrosoftSecurityIncidentCreationAlertRuleTemplate Uses

func (art AlertRuleTemplate) AsMicrosoftSecurityIncidentCreationAlertRuleTemplate() (*MicrosoftSecurityIncidentCreationAlertRuleTemplate, bool)

AsMicrosoftSecurityIncidentCreationAlertRuleTemplate is the BasicAlertRuleTemplate implementation for AlertRuleTemplate.

func (AlertRuleTemplate) AsScheduledAlertRuleTemplate Uses

func (art AlertRuleTemplate) AsScheduledAlertRuleTemplate() (*ScheduledAlertRuleTemplate, bool)

AsScheduledAlertRuleTemplate is the BasicAlertRuleTemplate implementation for AlertRuleTemplate.

func (AlertRuleTemplate) MarshalJSON Uses

func (art AlertRuleTemplate) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for AlertRuleTemplate.

type AlertRuleTemplateDataSource Uses

type AlertRuleTemplateDataSource struct {
    // ConnectorID - The connector id that provides the following data types
    ConnectorID *string `json:"connectorId,omitempty"`
    // DataTypes - The data types used by the alert rule template
    DataTypes *[]string `json:"dataTypes,omitempty"`
}

AlertRuleTemplateDataSource alert rule template data sources

type AlertRuleTemplateModel Uses

type AlertRuleTemplateModel struct {
    autorest.Response `json:"-"`
    Value             BasicAlertRuleTemplate `json:"value,omitempty"`
}

AlertRuleTemplateModel ...

func (*AlertRuleTemplateModel) UnmarshalJSON Uses

func (artm *AlertRuleTemplateModel) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for AlertRuleTemplateModel struct.

type AlertRuleTemplatesClient Uses

type AlertRuleTemplatesClient struct {
    BaseClient
}

AlertRuleTemplatesClient is the API spec for Microsoft.SecurityInsights (Azure Security Insights) resource provider

func NewAlertRuleTemplatesClient Uses

func NewAlertRuleTemplatesClient(subscriptionID string) AlertRuleTemplatesClient

NewAlertRuleTemplatesClient creates an instance of the AlertRuleTemplatesClient client.

func NewAlertRuleTemplatesClientWithBaseURI Uses

func NewAlertRuleTemplatesClientWithBaseURI(baseURI string, subscriptionID string) AlertRuleTemplatesClient

NewAlertRuleTemplatesClientWithBaseURI creates an instance of the AlertRuleTemplatesClient client using a custom endpoint. Use this when interacting with an Azure cloud that uses a non-standard base URI (sovereign clouds, Azure stack).

func (AlertRuleTemplatesClient) Get Uses

func (client AlertRuleTemplatesClient) Get(ctx context.Context, resourceGroupName string, workspaceName string, alertRuleTemplateID string) (result AlertRuleTemplateModel, err error)

Get gets the alert rule template. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. alertRuleTemplateID - alert rule template ID

func (AlertRuleTemplatesClient) GetPreparer Uses

func (client AlertRuleTemplatesClient) GetPreparer(ctx context.Context, resourceGroupName string, workspaceName string, alertRuleTemplateID string) (*http.Request, error)

GetPreparer prepares the Get request.

func (AlertRuleTemplatesClient) GetResponder Uses

func (client AlertRuleTemplatesClient) GetResponder(resp *http.Response) (result AlertRuleTemplateModel, err error)

GetResponder handles the response to the Get request. The method always closes the http.Response Body.

func (AlertRuleTemplatesClient) GetSender Uses

func (client AlertRuleTemplatesClient) GetSender(req *http.Request) (*http.Response, error)

GetSender sends the Get request. The method will close the http.Response Body if it receives an error.

func (AlertRuleTemplatesClient) List Uses

func (client AlertRuleTemplatesClient) List(ctx context.Context, resourceGroupName string, workspaceName string) (result AlertRuleTemplatesListPage, err error)

List gets all alert rule templates. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace.

func (AlertRuleTemplatesClient) ListComplete Uses

func (client AlertRuleTemplatesClient) ListComplete(ctx context.Context, resourceGroupName string, workspaceName string) (result AlertRuleTemplatesListIterator, err error)

ListComplete enumerates all values, automatically crossing page boundaries as required.

func (AlertRuleTemplatesClient) ListPreparer Uses

func (client AlertRuleTemplatesClient) ListPreparer(ctx context.Context, resourceGroupName string, workspaceName string) (*http.Request, error)

ListPreparer prepares the List request.

func (AlertRuleTemplatesClient) ListResponder Uses

func (client AlertRuleTemplatesClient) ListResponder(resp *http.Response) (result AlertRuleTemplatesList, err error)

ListResponder handles the response to the List request. The method always closes the http.Response Body.

func (AlertRuleTemplatesClient) ListSender Uses

func (client AlertRuleTemplatesClient) ListSender(req *http.Request) (*http.Response, error)

ListSender sends the List request. The method will close the http.Response Body if it receives an error.

type AlertRuleTemplatesList Uses

type AlertRuleTemplatesList struct {
    autorest.Response `json:"-"`
    // NextLink - READ-ONLY; URL to fetch the next set of alert rule templates.
    NextLink *string `json:"nextLink,omitempty"`
    // Value - Array of alert rule templates.
    Value *[]BasicAlertRuleTemplate `json:"value,omitempty"`
}

AlertRuleTemplatesList list all the alert rule templates.

func (AlertRuleTemplatesList) IsEmpty Uses

func (artl AlertRuleTemplatesList) IsEmpty() bool

IsEmpty returns true if the ListResult contains no values.

func (AlertRuleTemplatesList) MarshalJSON Uses

func (artl AlertRuleTemplatesList) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for AlertRuleTemplatesList.

func (*AlertRuleTemplatesList) UnmarshalJSON Uses

func (artl *AlertRuleTemplatesList) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for AlertRuleTemplatesList struct.

type AlertRuleTemplatesListIterator Uses

type AlertRuleTemplatesListIterator struct {
    // contains filtered or unexported fields
}

AlertRuleTemplatesListIterator provides access to a complete listing of AlertRuleTemplate values.

func NewAlertRuleTemplatesListIterator Uses

func NewAlertRuleTemplatesListIterator(page AlertRuleTemplatesListPage) AlertRuleTemplatesListIterator

Creates a new instance of the AlertRuleTemplatesListIterator type.

func (*AlertRuleTemplatesListIterator) Next Uses

func (iter *AlertRuleTemplatesListIterator) Next() error

Next advances to the next value. If there was an error making the request the iterator does not advance and the error is returned. Deprecated: Use NextWithContext() instead.

func (*AlertRuleTemplatesListIterator) NextWithContext Uses

func (iter *AlertRuleTemplatesListIterator) NextWithContext(ctx context.Context) (err error)

NextWithContext advances to the next value. If there was an error making the request the iterator does not advance and the error is returned.

func (AlertRuleTemplatesListIterator) NotDone Uses

func (iter AlertRuleTemplatesListIterator) NotDone() bool

NotDone returns true if the enumeration should be started or is not yet complete.

func (AlertRuleTemplatesListIterator) Response Uses

func (iter AlertRuleTemplatesListIterator) Response() AlertRuleTemplatesList

Response returns the raw server response from the last page request.

func (AlertRuleTemplatesListIterator) Value Uses

func (iter AlertRuleTemplatesListIterator) Value() BasicAlertRuleTemplate

Value returns the current value or a zero-initialized value if the iterator has advanced beyond the end of the collection.

type AlertRuleTemplatesListPage Uses

type AlertRuleTemplatesListPage struct {
    // contains filtered or unexported fields
}

AlertRuleTemplatesListPage contains a page of BasicAlertRuleTemplate values.

func NewAlertRuleTemplatesListPage Uses

func NewAlertRuleTemplatesListPage(cur AlertRuleTemplatesList, getNextPage func(context.Context, AlertRuleTemplatesList) (AlertRuleTemplatesList, error)) AlertRuleTemplatesListPage

Creates a new instance of the AlertRuleTemplatesListPage type.

func (*AlertRuleTemplatesListPage) Next Uses

func (page *AlertRuleTemplatesListPage) Next() error

Next advances to the next page of values. If there was an error making the request the page does not advance and the error is returned. Deprecated: Use NextWithContext() instead.

func (*AlertRuleTemplatesListPage) NextWithContext Uses

func (page *AlertRuleTemplatesListPage) NextWithContext(ctx context.Context) (err error)

NextWithContext advances to the next page of values. If there was an error making the request the page does not advance and the error is returned.

func (AlertRuleTemplatesListPage) NotDone Uses

func (page AlertRuleTemplatesListPage) NotDone() bool

NotDone returns true if the page enumeration should be started or is not yet complete.

func (AlertRuleTemplatesListPage) Response Uses

func (page AlertRuleTemplatesListPage) Response() AlertRuleTemplatesList

Response returns the raw server response from the last page request.

func (AlertRuleTemplatesListPage) Values Uses

func (page AlertRuleTemplatesListPage) Values() []BasicAlertRuleTemplate

Values returns the slice of values for the current page or nil if there are no values.

type AlertRulesClient Uses

type AlertRulesClient struct {
    BaseClient
}

AlertRulesClient is the API spec for Microsoft.SecurityInsights (Azure Security Insights) resource provider

func NewAlertRulesClient Uses

func NewAlertRulesClient(subscriptionID string) AlertRulesClient

NewAlertRulesClient creates an instance of the AlertRulesClient client.

func NewAlertRulesClientWithBaseURI Uses

func NewAlertRulesClientWithBaseURI(baseURI string, subscriptionID string) AlertRulesClient

NewAlertRulesClientWithBaseURI creates an instance of the AlertRulesClient client using a custom endpoint. Use this when interacting with an Azure cloud that uses a non-standard base URI (sovereign clouds, Azure stack).

func (AlertRulesClient) CreateOrUpdate Uses

func (client AlertRulesClient) CreateOrUpdate(ctx context.Context, resourceGroupName string, workspaceName string, ruleID string, alertRule BasicAlertRule) (result AlertRuleModel, err error)

CreateOrUpdate creates or updates the alert rule. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. ruleID - alert rule ID alertRule - the alert rule

func (AlertRulesClient) CreateOrUpdateAction Uses

func (client AlertRulesClient) CreateOrUpdateAction(ctx context.Context, resourceGroupName string, workspaceName string, ruleID string, actionID string, action ActionRequest) (result ActionResponse, err error)

CreateOrUpdateAction creates or updates the action of alert rule. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. ruleID - alert rule ID actionID - action ID action - the action

func (AlertRulesClient) CreateOrUpdateActionPreparer Uses

func (client AlertRulesClient) CreateOrUpdateActionPreparer(ctx context.Context, resourceGroupName string, workspaceName string, ruleID string, actionID string, action ActionRequest) (*http.Request, error)

CreateOrUpdateActionPreparer prepares the CreateOrUpdateAction request.

func (AlertRulesClient) CreateOrUpdateActionResponder Uses

func (client AlertRulesClient) CreateOrUpdateActionResponder(resp *http.Response) (result ActionResponse, err error)

CreateOrUpdateActionResponder handles the response to the CreateOrUpdateAction request. The method always closes the http.Response Body.

func (AlertRulesClient) CreateOrUpdateActionSender Uses

func (client AlertRulesClient) CreateOrUpdateActionSender(req *http.Request) (*http.Response, error)

CreateOrUpdateActionSender sends the CreateOrUpdateAction request. The method will close the http.Response Body if it receives an error.

func (AlertRulesClient) CreateOrUpdatePreparer Uses

func (client AlertRulesClient) CreateOrUpdatePreparer(ctx context.Context, resourceGroupName string, workspaceName string, ruleID string, alertRule BasicAlertRule) (*http.Request, error)

CreateOrUpdatePreparer prepares the CreateOrUpdate request.

func (AlertRulesClient) CreateOrUpdateResponder Uses

func (client AlertRulesClient) CreateOrUpdateResponder(resp *http.Response) (result AlertRuleModel, err error)

CreateOrUpdateResponder handles the response to the CreateOrUpdate request. The method always closes the http.Response Body.

func (AlertRulesClient) CreateOrUpdateSender Uses

func (client AlertRulesClient) CreateOrUpdateSender(req *http.Request) (*http.Response, error)

CreateOrUpdateSender sends the CreateOrUpdate request. The method will close the http.Response Body if it receives an error.

func (AlertRulesClient) Delete Uses

func (client AlertRulesClient) Delete(ctx context.Context, resourceGroupName string, workspaceName string, ruleID string) (result autorest.Response, err error)

Delete delete the alert rule. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. ruleID - alert rule ID

func (AlertRulesClient) DeleteAction Uses

func (client AlertRulesClient) DeleteAction(ctx context.Context, resourceGroupName string, workspaceName string, ruleID string, actionID string) (result autorest.Response, err error)

DeleteAction delete the action of alert rule. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. ruleID - alert rule ID actionID - action ID

func (AlertRulesClient) DeleteActionPreparer Uses

func (client AlertRulesClient) DeleteActionPreparer(ctx context.Context, resourceGroupName string, workspaceName string, ruleID string, actionID string) (*http.Request, error)

DeleteActionPreparer prepares the DeleteAction request.

func (AlertRulesClient) DeleteActionResponder Uses

func (client AlertRulesClient) DeleteActionResponder(resp *http.Response) (result autorest.Response, err error)

DeleteActionResponder handles the response to the DeleteAction request. The method always closes the http.Response Body.

func (AlertRulesClient) DeleteActionSender Uses

func (client AlertRulesClient) DeleteActionSender(req *http.Request) (*http.Response, error)

DeleteActionSender sends the DeleteAction request. The method will close the http.Response Body if it receives an error.

func (AlertRulesClient) DeletePreparer Uses

func (client AlertRulesClient) DeletePreparer(ctx context.Context, resourceGroupName string, workspaceName string, ruleID string) (*http.Request, error)

DeletePreparer prepares the Delete request.

func (AlertRulesClient) DeleteResponder Uses

func (client AlertRulesClient) DeleteResponder(resp *http.Response) (result autorest.Response, err error)

DeleteResponder handles the response to the Delete request. The method always closes the http.Response Body.

func (AlertRulesClient) DeleteSender Uses

func (client AlertRulesClient) DeleteSender(req *http.Request) (*http.Response, error)

DeleteSender sends the Delete request. The method will close the http.Response Body if it receives an error.

func (AlertRulesClient) Get Uses

func (client AlertRulesClient) Get(ctx context.Context, resourceGroupName string, workspaceName string, ruleID string) (result AlertRuleModel, err error)

Get gets the alert rule. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. ruleID - alert rule ID

func (AlertRulesClient) GetAction Uses

func (client AlertRulesClient) GetAction(ctx context.Context, resourceGroupName string, workspaceName string, ruleID string, actionID string) (result ActionResponse, err error)

GetAction gets the action of alert rule. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. ruleID - alert rule ID actionID - action ID

func (AlertRulesClient) GetActionPreparer Uses

func (client AlertRulesClient) GetActionPreparer(ctx context.Context, resourceGroupName string, workspaceName string, ruleID string, actionID string) (*http.Request, error)

GetActionPreparer prepares the GetAction request.

func (AlertRulesClient) GetActionResponder Uses

func (client AlertRulesClient) GetActionResponder(resp *http.Response) (result ActionResponse, err error)

GetActionResponder handles the response to the GetAction request. The method always closes the http.Response Body.

func (AlertRulesClient) GetActionSender Uses

func (client AlertRulesClient) GetActionSender(req *http.Request) (*http.Response, error)

GetActionSender sends the GetAction request. The method will close the http.Response Body if it receives an error.

func (AlertRulesClient) GetPreparer Uses

func (client AlertRulesClient) GetPreparer(ctx context.Context, resourceGroupName string, workspaceName string, ruleID string) (*http.Request, error)

GetPreparer prepares the Get request.

func (AlertRulesClient) GetResponder Uses

func (client AlertRulesClient) GetResponder(resp *http.Response) (result AlertRuleModel, err error)

GetResponder handles the response to the Get request. The method always closes the http.Response Body.

func (AlertRulesClient) GetSender Uses

func (client AlertRulesClient) GetSender(req *http.Request) (*http.Response, error)

GetSender sends the Get request. The method will close the http.Response Body if it receives an error.

func (AlertRulesClient) List Uses

func (client AlertRulesClient) List(ctx context.Context, resourceGroupName string, workspaceName string) (result AlertRulesListPage, err error)

List gets all alert rules. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace.

func (AlertRulesClient) ListComplete Uses

func (client AlertRulesClient) ListComplete(ctx context.Context, resourceGroupName string, workspaceName string) (result AlertRulesListIterator, err error)

ListComplete enumerates all values, automatically crossing page boundaries as required.

func (AlertRulesClient) ListPreparer Uses

func (client AlertRulesClient) ListPreparer(ctx context.Context, resourceGroupName string, workspaceName string) (*http.Request, error)

ListPreparer prepares the List request.

func (AlertRulesClient) ListResponder Uses

func (client AlertRulesClient) ListResponder(resp *http.Response) (result AlertRulesList, err error)

ListResponder handles the response to the List request. The method always closes the http.Response Body.

func (AlertRulesClient) ListSender Uses

func (client AlertRulesClient) ListSender(req *http.Request) (*http.Response, error)

ListSender sends the List request. The method will close the http.Response Body if it receives an error.

type AlertRulesList Uses

type AlertRulesList struct {
    autorest.Response `json:"-"`
    // NextLink - READ-ONLY; URL to fetch the next set of alert rules.
    NextLink *string `json:"nextLink,omitempty"`
    // Value - Array of alert rules.
    Value *[]BasicAlertRule `json:"value,omitempty"`
}

AlertRulesList list all the alert rules.

func (AlertRulesList) IsEmpty Uses

func (arl AlertRulesList) IsEmpty() bool

IsEmpty returns true if the ListResult contains no values.

func (AlertRulesList) MarshalJSON Uses

func (arl AlertRulesList) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for AlertRulesList.

func (*AlertRulesList) UnmarshalJSON Uses

func (arl *AlertRulesList) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for AlertRulesList struct.

type AlertRulesListIterator Uses

type AlertRulesListIterator struct {
    // contains filtered or unexported fields
}

AlertRulesListIterator provides access to a complete listing of AlertRule values.

func NewAlertRulesListIterator Uses

func NewAlertRulesListIterator(page AlertRulesListPage) AlertRulesListIterator

Creates a new instance of the AlertRulesListIterator type.

func (*AlertRulesListIterator) Next Uses

func (iter *AlertRulesListIterator) Next() error

Next advances to the next value. If there was an error making the request the iterator does not advance and the error is returned. Deprecated: Use NextWithContext() instead.

func (*AlertRulesListIterator) NextWithContext Uses

func (iter *AlertRulesListIterator) NextWithContext(ctx context.Context) (err error)

NextWithContext advances to the next value. If there was an error making the request the iterator does not advance and the error is returned.

func (AlertRulesListIterator) NotDone Uses

func (iter AlertRulesListIterator) NotDone() bool

NotDone returns true if the enumeration should be started or is not yet complete.

func (AlertRulesListIterator) Response Uses

func (iter AlertRulesListIterator) Response() AlertRulesList

Response returns the raw server response from the last page request.

func (AlertRulesListIterator) Value Uses

func (iter AlertRulesListIterator) Value() BasicAlertRule

Value returns the current value or a zero-initialized value if the iterator has advanced beyond the end of the collection.

type AlertRulesListPage Uses

type AlertRulesListPage struct {
    // contains filtered or unexported fields
}

AlertRulesListPage contains a page of BasicAlertRule values.

func NewAlertRulesListPage Uses

func NewAlertRulesListPage(cur AlertRulesList, getNextPage func(context.Context, AlertRulesList) (AlertRulesList, error)) AlertRulesListPage

Creates a new instance of the AlertRulesListPage type.

func (*AlertRulesListPage) Next Uses

func (page *AlertRulesListPage) Next() error

Next advances to the next page of values. If there was an error making the request the page does not advance and the error is returned. Deprecated: Use NextWithContext() instead.

func (*AlertRulesListPage) NextWithContext Uses

func (page *AlertRulesListPage) NextWithContext(ctx context.Context) (err error)

NextWithContext advances to the next page of values. If there was an error making the request the page does not advance and the error is returned.

func (AlertRulesListPage) NotDone Uses

func (page AlertRulesListPage) NotDone() bool

NotDone returns true if the page enumeration should be started or is not yet complete.

func (AlertRulesListPage) Response Uses

func (page AlertRulesListPage) Response() AlertRulesList

Response returns the raw server response from the last page request.

func (AlertRulesListPage) Values Uses

func (page AlertRulesListPage) Values() []BasicAlertRule

Values returns the slice of values for the current page or nil if there are no values.

type AlertSeverity Uses

type AlertSeverity string

AlertSeverity enumerates the values for alert severity.

const (
    // High High severity
    High AlertSeverity = "High"
    // Informational Informational severity
    Informational AlertSeverity = "Informational"
    // Low Low severity
    Low AlertSeverity = "Low"
    // Medium Medium severity
    Medium AlertSeverity = "Medium"
)

func PossibleAlertSeverityValues Uses

func PossibleAlertSeverityValues() []AlertSeverity

PossibleAlertSeverityValues returns an array of possible values for the AlertSeverity const type.

type AlertsDataTypeOfDataConnector Uses

type AlertsDataTypeOfDataConnector struct {
    // Alerts - Alerts data type connection.
    Alerts *DataConnectorDataTypeCommon `json:"alerts,omitempty"`
}

AlertsDataTypeOfDataConnector alerts data type for data connectors.

type AttackTactic Uses

type AttackTactic string

AttackTactic enumerates the values for attack tactic.

const (
    // Collection ...
    Collection AttackTactic = "Collection"
    // CommandAndControl ...
    CommandAndControl AttackTactic = "CommandAndControl"
    // CredentialAccess ...
    CredentialAccess AttackTactic = "CredentialAccess"
    // DefenseEvasion ...
    DefenseEvasion AttackTactic = "DefenseEvasion"
    // Discovery ...
    Discovery AttackTactic = "Discovery"
    // Execution ...
    Execution AttackTactic = "Execution"
    // Exfiltration ...
    Exfiltration AttackTactic = "Exfiltration"
    // Impact ...
    Impact AttackTactic = "Impact"
    // InitialAccess ...
    InitialAccess AttackTactic = "InitialAccess"
    // LateralMovement ...
    LateralMovement AttackTactic = "LateralMovement"
    // Persistence ...
    Persistence AttackTactic = "Persistence"
    // PrivilegeEscalation ...
    PrivilegeEscalation AttackTactic = "PrivilegeEscalation"
)

func PossibleAttackTacticValues Uses

func PossibleAttackTacticValues() []AttackTactic

PossibleAttackTacticValues returns an array of possible values for the AttackTactic const type.

type AwsCloudTrailDataConnector Uses

type AwsCloudTrailDataConnector struct {
    // AwsCloudTrailDataConnectorProperties - Amazon Web Services CloudTrail data connector properties.
    *AwsCloudTrailDataConnectorProperties `json:"properties,omitempty"`
    // Kind - Possible values include: 'KindDataConnector', 'KindAzureActiveDirectory', 'KindAzureAdvancedThreatProtection', 'KindAzureSecurityCenter', 'KindAmazonWebServicesCloudTrail', 'KindMicrosoftCloudAppSecurity', 'KindMicrosoftDefenderAdvancedThreatProtection', 'KindOffice365', 'KindThreatIntelligence'
    Kind KindBasicDataConnector `json:"kind,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
}

AwsCloudTrailDataConnector represents Amazon Web Services CloudTrail data connector.

func (AwsCloudTrailDataConnector) AsAADDataConnector Uses

func (actdc AwsCloudTrailDataConnector) AsAADDataConnector() (*AADDataConnector, bool)

AsAADDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector.

func (AwsCloudTrailDataConnector) AsAATPDataConnector Uses

func (actdc AwsCloudTrailDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool)

AsAATPDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector.

func (AwsCloudTrailDataConnector) AsASCDataConnector Uses

func (actdc AwsCloudTrailDataConnector) AsASCDataConnector() (*ASCDataConnector, bool)

AsASCDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector.

func (AwsCloudTrailDataConnector) AsAwsCloudTrailDataConnector Uses

func (actdc AwsCloudTrailDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool)

AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector.

func (AwsCloudTrailDataConnector) AsBasicDataConnector Uses

func (actdc AwsCloudTrailDataConnector) AsBasicDataConnector() (BasicDataConnector, bool)

AsBasicDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector.

func (AwsCloudTrailDataConnector) AsDataConnector Uses

func (actdc AwsCloudTrailDataConnector) AsDataConnector() (*DataConnector, bool)

AsDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector.

func (AwsCloudTrailDataConnector) AsMCASDataConnector Uses

func (actdc AwsCloudTrailDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool)

AsMCASDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector.

func (AwsCloudTrailDataConnector) AsMDATPDataConnector Uses

func (actdc AwsCloudTrailDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool)

AsMDATPDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector.

func (AwsCloudTrailDataConnector) AsOfficeDataConnector Uses

func (actdc AwsCloudTrailDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool)

AsOfficeDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector.

func (AwsCloudTrailDataConnector) AsTIDataConnector Uses

func (actdc AwsCloudTrailDataConnector) AsTIDataConnector() (*TIDataConnector, bool)

AsTIDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector.

func (AwsCloudTrailDataConnector) MarshalJSON Uses

func (actdc AwsCloudTrailDataConnector) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for AwsCloudTrailDataConnector.

func (*AwsCloudTrailDataConnector) UnmarshalJSON Uses

func (actdc *AwsCloudTrailDataConnector) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for AwsCloudTrailDataConnector struct.

type AwsCloudTrailDataConnectorDataTypes Uses

type AwsCloudTrailDataConnectorDataTypes struct {
    // Logs - Logs data type.
    Logs *AwsCloudTrailDataConnectorDataTypesLogs `json:"logs,omitempty"`
}

AwsCloudTrailDataConnectorDataTypes the available data types for Amazon Web Services CloudTrail data connector.

type AwsCloudTrailDataConnectorDataTypesLogs Uses

type AwsCloudTrailDataConnectorDataTypesLogs struct {
    // State - Describe whether this data type connection is enabled or not. Possible values include: 'Enabled', 'Disabled'
    State DataTypeState `json:"state,omitempty"`
}

AwsCloudTrailDataConnectorDataTypesLogs logs data type.

type AwsCloudTrailDataConnectorProperties Uses

type AwsCloudTrailDataConnectorProperties struct {
    // AwsRoleArn - The Aws Role Arn (with CloudTrailReadOnly policy) that is used to access the Aws account.
    AwsRoleArn *string `json:"awsRoleArn,omitempty"`
    // DataTypes - The available data types for the connector.
    DataTypes *AwsCloudTrailDataConnectorDataTypes `json:"dataTypes,omitempty"`
}

AwsCloudTrailDataConnectorProperties amazon Web Services CloudTrail data connector properties.

type BaseClient Uses

type BaseClient struct {
    autorest.Client
    BaseURI        string
    SubscriptionID string
}

BaseClient is the base client for Securityinsight.

func New Uses

func New(subscriptionID string) BaseClient

New creates an instance of the BaseClient client.

func NewWithBaseURI Uses

func NewWithBaseURI(baseURI string, subscriptionID string) BaseClient

NewWithBaseURI creates an instance of the BaseClient client using a custom endpoint. Use this when interacting with an Azure cloud that uses a non-standard base URI (sovereign clouds, Azure stack).

type BasicAlertRule Uses

type BasicAlertRule interface {
    AsFusionAlertRule() (*FusionAlertRule, bool)
    AsMicrosoftSecurityIncidentCreationAlertRule() (*MicrosoftSecurityIncidentCreationAlertRule, bool)
    AsScheduledAlertRule() (*ScheduledAlertRule, bool)
    AsAlertRule() (*AlertRule, bool)
}

BasicAlertRule alert rule.

type BasicAlertRuleTemplate Uses

type BasicAlertRuleTemplate interface {
    AsFusionAlertRuleTemplate() (*FusionAlertRuleTemplate, bool)
    AsMicrosoftSecurityIncidentCreationAlertRuleTemplate() (*MicrosoftSecurityIncidentCreationAlertRuleTemplate, bool)
    AsScheduledAlertRuleTemplate() (*ScheduledAlertRuleTemplate, bool)
    AsAlertRuleTemplate() (*AlertRuleTemplate, bool)
}

BasicAlertRuleTemplate alert rule template.

type BasicDataConnector Uses

type BasicDataConnector interface {
    AsAADDataConnector() (*AADDataConnector, bool)
    AsAATPDataConnector() (*AATPDataConnector, bool)
    AsASCDataConnector() (*ASCDataConnector, bool)
    AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool)
    AsMCASDataConnector() (*MCASDataConnector, bool)
    AsMDATPDataConnector() (*MDATPDataConnector, bool)
    AsOfficeDataConnector() (*OfficeDataConnector, bool)
    AsTIDataConnector() (*TIDataConnector, bool)
    AsDataConnector() (*DataConnector, bool)
}

BasicDataConnector data connector.

type BasicSettings Uses

type BasicSettings interface {
    AsToggleSettings() (*ToggleSettings, bool)
    AsUebaSettings() (*UebaSettings, bool)
    AsSettings() (*Settings, bool)
}

BasicSettings the Settings.

type Bookmark Uses

type Bookmark struct {
    autorest.Response `json:"-"`
    // BookmarkProperties - Bookmark properties
    *BookmarkProperties `json:"properties,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
}

Bookmark represents a bookmark in Azure Security Insights.

func (Bookmark) MarshalJSON Uses

func (b Bookmark) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for Bookmark.

func (*Bookmark) UnmarshalJSON Uses

func (b *Bookmark) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for Bookmark struct.

type BookmarkList Uses

type BookmarkList struct {
    autorest.Response `json:"-"`
    // NextLink - READ-ONLY; URL to fetch the next set of cases.
    NextLink *string `json:"nextLink,omitempty"`
    // Value - Array of bookmarks.
    Value *[]Bookmark `json:"value,omitempty"`
}

BookmarkList list all the bookmarks.

func (BookmarkList) IsEmpty Uses

func (bl BookmarkList) IsEmpty() bool

IsEmpty returns true if the ListResult contains no values.

func (BookmarkList) MarshalJSON Uses

func (bl BookmarkList) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for BookmarkList.

type BookmarkListIterator Uses

type BookmarkListIterator struct {
    // contains filtered or unexported fields
}

BookmarkListIterator provides access to a complete listing of Bookmark values.

func NewBookmarkListIterator Uses

func NewBookmarkListIterator(page BookmarkListPage) BookmarkListIterator

Creates a new instance of the BookmarkListIterator type.

func (*BookmarkListIterator) Next Uses

func (iter *BookmarkListIterator) Next() error

Next advances to the next value. If there was an error making the request the iterator does not advance and the error is returned. Deprecated: Use NextWithContext() instead.

func (*BookmarkListIterator) NextWithContext Uses

func (iter *BookmarkListIterator) NextWithContext(ctx context.Context) (err error)

NextWithContext advances to the next value. If there was an error making the request the iterator does not advance and the error is returned.

func (BookmarkListIterator) NotDone Uses

func (iter BookmarkListIterator) NotDone() bool

NotDone returns true if the enumeration should be started or is not yet complete.

func (BookmarkListIterator) Response Uses

func (iter BookmarkListIterator) Response() BookmarkList

Response returns the raw server response from the last page request.

func (BookmarkListIterator) Value Uses

func (iter BookmarkListIterator) Value() Bookmark

Value returns the current value or a zero-initialized value if the iterator has advanced beyond the end of the collection.

type BookmarkListPage Uses

type BookmarkListPage struct {
    // contains filtered or unexported fields
}

BookmarkListPage contains a page of Bookmark values.

func NewBookmarkListPage Uses

func NewBookmarkListPage(cur BookmarkList, getNextPage func(context.Context, BookmarkList) (BookmarkList, error)) BookmarkListPage

Creates a new instance of the BookmarkListPage type.

func (*BookmarkListPage) Next Uses

func (page *BookmarkListPage) Next() error

Next advances to the next page of values. If there was an error making the request the page does not advance and the error is returned. Deprecated: Use NextWithContext() instead.

func (*BookmarkListPage) NextWithContext Uses

func (page *BookmarkListPage) NextWithContext(ctx context.Context) (err error)

NextWithContext advances to the next page of values. If there was an error making the request the page does not advance and the error is returned.

func (BookmarkListPage) NotDone Uses

func (page BookmarkListPage) NotDone() bool

NotDone returns true if the page enumeration should be started or is not yet complete.

func (BookmarkListPage) Response Uses

func (page BookmarkListPage) Response() BookmarkList

Response returns the raw server response from the last page request.

func (BookmarkListPage) Values Uses

func (page BookmarkListPage) Values() []Bookmark

Values returns the slice of values for the current page or nil if there are no values.

type BookmarkProperties Uses

type BookmarkProperties struct {
    // Created - The time the bookmark was created
    Created *date.Time `json:"created,omitempty"`
    // CreatedBy - Describes a user that created the bookmark
    CreatedBy *UserInfo `json:"createdBy,omitempty"`
    // DisplayName - The display name of the bookmark
    DisplayName *string `json:"displayName,omitempty"`
    // Labels - List of labels relevant to this bookmark
    Labels *[]string `json:"labels,omitempty"`
    // Notes - The notes of the bookmark
    Notes *string `json:"notes,omitempty"`
    // Query - The query of the bookmark.
    Query *string `json:"query,omitempty"`
    // QueryResult - The query result of the bookmark.
    QueryResult *string `json:"queryResult,omitempty"`
    // Updated - The last time the bookmark was updated
    Updated *date.Time `json:"updated,omitempty"`
    // UpdatedBy - Describes a user that updated the bookmark
    UpdatedBy *UserInfo `json:"updatedBy,omitempty"`
    // IncidentInfo - Describes an incident that relates to bookmark
    IncidentInfo *IncidentInfo `json:"incidentInfo,omitempty"`
}

BookmarkProperties describes bookmark properties

type BookmarksClient Uses

type BookmarksClient struct {
    BaseClient
}

BookmarksClient is the API spec for Microsoft.SecurityInsights (Azure Security Insights) resource provider

func NewBookmarksClient Uses

func NewBookmarksClient(subscriptionID string) BookmarksClient

NewBookmarksClient creates an instance of the BookmarksClient client.

func NewBookmarksClientWithBaseURI Uses

func NewBookmarksClientWithBaseURI(baseURI string, subscriptionID string) BookmarksClient

NewBookmarksClientWithBaseURI creates an instance of the BookmarksClient client using a custom endpoint. Use this when interacting with an Azure cloud that uses a non-standard base URI (sovereign clouds, Azure stack).

func (BookmarksClient) CreateOrUpdate Uses

func (client BookmarksClient) CreateOrUpdate(ctx context.Context, resourceGroupName string, workspaceName string, bookmarkID string, bookmark Bookmark) (result Bookmark, err error)

CreateOrUpdate creates or updates the bookmark. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. bookmarkID - bookmark ID bookmark - the bookmark

func (BookmarksClient) CreateOrUpdatePreparer Uses

func (client BookmarksClient) CreateOrUpdatePreparer(ctx context.Context, resourceGroupName string, workspaceName string, bookmarkID string, bookmark Bookmark) (*http.Request, error)

CreateOrUpdatePreparer prepares the CreateOrUpdate request.

func (BookmarksClient) CreateOrUpdateResponder Uses

func (client BookmarksClient) CreateOrUpdateResponder(resp *http.Response) (result Bookmark, err error)

CreateOrUpdateResponder handles the response to the CreateOrUpdate request. The method always closes the http.Response Body.

func (BookmarksClient) CreateOrUpdateSender Uses

func (client BookmarksClient) CreateOrUpdateSender(req *http.Request) (*http.Response, error)

CreateOrUpdateSender sends the CreateOrUpdate request. The method will close the http.Response Body if it receives an error.

func (BookmarksClient) Delete Uses

func (client BookmarksClient) Delete(ctx context.Context, resourceGroupName string, workspaceName string, bookmarkID string) (result autorest.Response, err error)

Delete delete the bookmark. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. bookmarkID - bookmark ID

func (BookmarksClient) DeletePreparer Uses

func (client BookmarksClient) DeletePreparer(ctx context.Context, resourceGroupName string, workspaceName string, bookmarkID string) (*http.Request, error)

DeletePreparer prepares the Delete request.

func (BookmarksClient) DeleteResponder Uses

func (client BookmarksClient) DeleteResponder(resp *http.Response) (result autorest.Response, err error)

DeleteResponder handles the response to the Delete request. The method always closes the http.Response Body.

func (BookmarksClient) DeleteSender Uses

func (client BookmarksClient) DeleteSender(req *http.Request) (*http.Response, error)

DeleteSender sends the Delete request. The method will close the http.Response Body if it receives an error.

func (BookmarksClient) Get Uses

func (client BookmarksClient) Get(ctx context.Context, resourceGroupName string, workspaceName string, bookmarkID string) (result Bookmark, err error)

Get gets a bookmark. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. bookmarkID - bookmark ID

func (BookmarksClient) GetPreparer Uses

func (client BookmarksClient) GetPreparer(ctx context.Context, resourceGroupName string, workspaceName string, bookmarkID string) (*http.Request, error)

GetPreparer prepares the Get request.

func (BookmarksClient) GetResponder Uses

func (client BookmarksClient) GetResponder(resp *http.Response) (result Bookmark, err error)

GetResponder handles the response to the Get request. The method always closes the http.Response Body.

func (BookmarksClient) GetSender Uses

func (client BookmarksClient) GetSender(req *http.Request) (*http.Response, error)

GetSender sends the Get request. The method will close the http.Response Body if it receives an error.

func (BookmarksClient) List Uses

func (client BookmarksClient) List(ctx context.Context, resourceGroupName string, workspaceName string) (result BookmarkListPage, err error)

List gets all bookmarks. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace.

func (BookmarksClient) ListComplete Uses

func (client BookmarksClient) ListComplete(ctx context.Context, resourceGroupName string, workspaceName string) (result BookmarkListIterator, err error)

ListComplete enumerates all values, automatically crossing page boundaries as required.

func (BookmarksClient) ListPreparer Uses

func (client BookmarksClient) ListPreparer(ctx context.Context, resourceGroupName string, workspaceName string) (*http.Request, error)

ListPreparer prepares the List request.

func (BookmarksClient) ListResponder Uses

func (client BookmarksClient) ListResponder(resp *http.Response) (result BookmarkList, err error)

ListResponder handles the response to the List request. The method always closes the http.Response Body.

func (BookmarksClient) ListSender Uses

func (client BookmarksClient) ListSender(req *http.Request) (*http.Response, error)

ListSender sends the List request. The method will close the http.Response Body if it receives an error.

type CaseSeverity Uses

type CaseSeverity string

CaseSeverity enumerates the values for case severity.

const (
    // CaseSeverityCritical Critical severity
    CaseSeverityCritical CaseSeverity = "Critical"
    // CaseSeverityHigh High severity
    CaseSeverityHigh CaseSeverity = "High"
    // CaseSeverityInformational Informational severity
    CaseSeverityInformational CaseSeverity = "Informational"
    // CaseSeverityLow Low severity
    CaseSeverityLow CaseSeverity = "Low"
    // CaseSeverityMedium Medium severity
    CaseSeverityMedium CaseSeverity = "Medium"
)

func PossibleCaseSeverityValues Uses

func PossibleCaseSeverityValues() []CaseSeverity

PossibleCaseSeverityValues returns an array of possible values for the CaseSeverity const type.

type ClientInfo Uses

type ClientInfo struct {
    // Email - The email of the client.
    Email *string `json:"email,omitempty"`
    // Name - The name of the client.
    Name *string `json:"name,omitempty"`
    // ObjectID - The object id of the client.
    ObjectID *uuid.UUID `json:"objectId,omitempty"`
    // UserPrincipalName - The user principal name of the client.
    UserPrincipalName *string `json:"userPrincipalName,omitempty"`
}

ClientInfo information on the client (user or application) that made some action

type CloudError Uses

type CloudError struct {
    // Error - The error object of the CloudError response
    Error *ErrorResponse `json:"error,omitempty"`
}

CloudError an error response for a resource management request.

type DataConnector Uses

type DataConnector struct {
    autorest.Response `json:"-"`
    // Kind - Possible values include: 'KindDataConnector', 'KindAzureActiveDirectory', 'KindAzureAdvancedThreatProtection', 'KindAzureSecurityCenter', 'KindAmazonWebServicesCloudTrail', 'KindMicrosoftCloudAppSecurity', 'KindMicrosoftDefenderAdvancedThreatProtection', 'KindOffice365', 'KindThreatIntelligence'
    Kind KindBasicDataConnector `json:"kind,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
}

DataConnector data connector.

func (DataConnector) AsAADDataConnector Uses

func (dc DataConnector) AsAADDataConnector() (*AADDataConnector, bool)

AsAADDataConnector is the BasicDataConnector implementation for DataConnector.

func (DataConnector) AsAATPDataConnector Uses

func (dc DataConnector) AsAATPDataConnector() (*AATPDataConnector, bool)

AsAATPDataConnector is the BasicDataConnector implementation for DataConnector.

func (DataConnector) AsASCDataConnector Uses

func (dc DataConnector) AsASCDataConnector() (*ASCDataConnector, bool)

AsASCDataConnector is the BasicDataConnector implementation for DataConnector.

func (DataConnector) AsAwsCloudTrailDataConnector Uses

func (dc DataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool)

AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for DataConnector.

func (DataConnector) AsBasicDataConnector Uses

func (dc DataConnector) AsBasicDataConnector() (BasicDataConnector, bool)

AsBasicDataConnector is the BasicDataConnector implementation for DataConnector.

func (DataConnector) AsDataConnector Uses

func (dc DataConnector) AsDataConnector() (*DataConnector, bool)

AsDataConnector is the BasicDataConnector implementation for DataConnector.

func (DataConnector) AsMCASDataConnector Uses

func (dc DataConnector) AsMCASDataConnector() (*MCASDataConnector, bool)

AsMCASDataConnector is the BasicDataConnector implementation for DataConnector.

func (DataConnector) AsMDATPDataConnector Uses

func (dc DataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool)

AsMDATPDataConnector is the BasicDataConnector implementation for DataConnector.

func (DataConnector) AsOfficeDataConnector Uses

func (dc DataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool)

AsOfficeDataConnector is the BasicDataConnector implementation for DataConnector.

func (DataConnector) AsTIDataConnector Uses

func (dc DataConnector) AsTIDataConnector() (*TIDataConnector, bool)

AsTIDataConnector is the BasicDataConnector implementation for DataConnector.

func (DataConnector) MarshalJSON Uses

func (dc DataConnector) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for DataConnector.

type DataConnectorDataTypeCommon Uses

type DataConnectorDataTypeCommon struct {
    // State - Describe whether this data type connection is enabled or not. Possible values include: 'Enabled', 'Disabled'
    State DataTypeState `json:"state,omitempty"`
}

DataConnectorDataTypeCommon common field for data type in data connectors.

type DataConnectorKind Uses

type DataConnectorKind string

DataConnectorKind enumerates the values for data connector kind.

const (
    // DataConnectorKindAmazonWebServicesCloudTrail ...
    DataConnectorKindAmazonWebServicesCloudTrail DataConnectorKind = "AmazonWebServicesCloudTrail"
    // DataConnectorKindAzureActiveDirectory ...
    DataConnectorKindAzureActiveDirectory DataConnectorKind = "AzureActiveDirectory"
    // DataConnectorKindAzureAdvancedThreatProtection ...
    DataConnectorKindAzureAdvancedThreatProtection DataConnectorKind = "AzureAdvancedThreatProtection"
    // DataConnectorKindAzureSecurityCenter ...
    DataConnectorKindAzureSecurityCenter DataConnectorKind = "AzureSecurityCenter"
    // DataConnectorKindMicrosoftCloudAppSecurity ...
    DataConnectorKindMicrosoftCloudAppSecurity DataConnectorKind = "MicrosoftCloudAppSecurity"
    // DataConnectorKindMicrosoftDefenderAdvancedThreatProtection ...
    DataConnectorKindMicrosoftDefenderAdvancedThreatProtection DataConnectorKind = "MicrosoftDefenderAdvancedThreatProtection"
    // DataConnectorKindOffice365 ...
    DataConnectorKindOffice365 DataConnectorKind = "Office365"
    // DataConnectorKindThreatIntelligence ...
    DataConnectorKindThreatIntelligence DataConnectorKind = "ThreatIntelligence"
)

func PossibleDataConnectorKindValues Uses

func PossibleDataConnectorKindValues() []DataConnectorKind

PossibleDataConnectorKindValues returns an array of possible values for the DataConnectorKind const type.

type DataConnectorList Uses

type DataConnectorList struct {
    autorest.Response `json:"-"`
    // NextLink - READ-ONLY; URL to fetch the next set of data connectors.
    NextLink *string `json:"nextLink,omitempty"`
    // Value - Array of data connectors.
    Value *[]BasicDataConnector `json:"value,omitempty"`
}

DataConnectorList list all the data connectors.

func (DataConnectorList) IsEmpty Uses

func (dcl DataConnectorList) IsEmpty() bool

IsEmpty returns true if the ListResult contains no values.

func (DataConnectorList) MarshalJSON Uses

func (dcl DataConnectorList) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for DataConnectorList.

func (*DataConnectorList) UnmarshalJSON Uses

func (dcl *DataConnectorList) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for DataConnectorList struct.

type DataConnectorListIterator Uses

type DataConnectorListIterator struct {
    // contains filtered or unexported fields
}

DataConnectorListIterator provides access to a complete listing of DataConnector values.

func NewDataConnectorListIterator Uses

func NewDataConnectorListIterator(page DataConnectorListPage) DataConnectorListIterator

Creates a new instance of the DataConnectorListIterator type.

func (*DataConnectorListIterator) Next Uses

func (iter *DataConnectorListIterator) Next() error

Next advances to the next value. If there was an error making the request the iterator does not advance and the error is returned. Deprecated: Use NextWithContext() instead.

func (*DataConnectorListIterator) NextWithContext Uses

func (iter *DataConnectorListIterator) NextWithContext(ctx context.Context) (err error)

NextWithContext advances to the next value. If there was an error making the request the iterator does not advance and the error is returned.

func (DataConnectorListIterator) NotDone Uses

func (iter DataConnectorListIterator) NotDone() bool

NotDone returns true if the enumeration should be started or is not yet complete.

func (DataConnectorListIterator) Response Uses

func (iter DataConnectorListIterator) Response() DataConnectorList

Response returns the raw server response from the last page request.

func (DataConnectorListIterator) Value Uses

func (iter DataConnectorListIterator) Value() BasicDataConnector

Value returns the current value or a zero-initialized value if the iterator has advanced beyond the end of the collection.

type DataConnectorListPage Uses

type DataConnectorListPage struct {
    // contains filtered or unexported fields
}

DataConnectorListPage contains a page of BasicDataConnector values.

func NewDataConnectorListPage Uses

func NewDataConnectorListPage(cur DataConnectorList, getNextPage func(context.Context, DataConnectorList) (DataConnectorList, error)) DataConnectorListPage

Creates a new instance of the DataConnectorListPage type.

func (*DataConnectorListPage) Next Uses

func (page *DataConnectorListPage) Next() error

Next advances to the next page of values. If there was an error making the request the page does not advance and the error is returned. Deprecated: Use NextWithContext() instead.

func (*DataConnectorListPage) NextWithContext Uses

func (page *DataConnectorListPage) NextWithContext(ctx context.Context) (err error)

NextWithContext advances to the next page of values. If there was an error making the request the page does not advance and the error is returned.

func (DataConnectorListPage) NotDone Uses

func (page DataConnectorListPage) NotDone() bool

NotDone returns true if the page enumeration should be started or is not yet complete.

func (DataConnectorListPage) Response Uses

func (page DataConnectorListPage) Response() DataConnectorList

Response returns the raw server response from the last page request.

func (DataConnectorListPage) Values Uses

func (page DataConnectorListPage) Values() []BasicDataConnector

Values returns the slice of values for the current page or nil if there are no values.

type DataConnectorModel Uses

type DataConnectorModel struct {
    autorest.Response `json:"-"`
    Value             BasicDataConnector `json:"value,omitempty"`
}

DataConnectorModel ...

func (*DataConnectorModel) UnmarshalJSON Uses

func (dcm *DataConnectorModel) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for DataConnectorModel struct.

type DataConnectorTenantID Uses

type DataConnectorTenantID struct {
    // TenantID - The tenant id to connect to, and get the data from.
    TenantID *string `json:"tenantId,omitempty"`
}

DataConnectorTenantID properties data connector on tenant level.

type DataConnectorWithAlertsProperties Uses

type DataConnectorWithAlertsProperties struct {
    // DataTypes - The available data types for the connector.
    DataTypes *AlertsDataTypeOfDataConnector `json:"dataTypes,omitempty"`
}

DataConnectorWithAlertsProperties data connector properties.

type DataConnectorsClient Uses

type DataConnectorsClient struct {
    BaseClient
}

DataConnectorsClient is the API spec for Microsoft.SecurityInsights (Azure Security Insights) resource provider

func NewDataConnectorsClient Uses

func NewDataConnectorsClient(subscriptionID string) DataConnectorsClient

NewDataConnectorsClient creates an instance of the DataConnectorsClient client.

func NewDataConnectorsClientWithBaseURI Uses

func NewDataConnectorsClientWithBaseURI(baseURI string, subscriptionID string) DataConnectorsClient

NewDataConnectorsClientWithBaseURI creates an instance of the DataConnectorsClient client using a custom endpoint. Use this when interacting with an Azure cloud that uses a non-standard base URI (sovereign clouds, Azure stack).

func (DataConnectorsClient) CreateOrUpdate Uses

func (client DataConnectorsClient) CreateOrUpdate(ctx context.Context, resourceGroupName string, workspaceName string, dataConnectorID string, dataConnector BasicDataConnector) (result DataConnectorModel, err error)

CreateOrUpdate creates or updates the data connector. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. dataConnectorID - connector ID dataConnector - the data connector

func (DataConnectorsClient) CreateOrUpdatePreparer Uses

func (client DataConnectorsClient) CreateOrUpdatePreparer(ctx context.Context, resourceGroupName string, workspaceName string, dataConnectorID string, dataConnector BasicDataConnector) (*http.Request, error)

CreateOrUpdatePreparer prepares the CreateOrUpdate request.

func (DataConnectorsClient) CreateOrUpdateResponder Uses

func (client DataConnectorsClient) CreateOrUpdateResponder(resp *http.Response) (result DataConnectorModel, err error)

CreateOrUpdateResponder handles the response to the CreateOrUpdate request. The method always closes the http.Response Body.

func (DataConnectorsClient) CreateOrUpdateSender Uses

func (client DataConnectorsClient) CreateOrUpdateSender(req *http.Request) (*http.Response, error)

CreateOrUpdateSender sends the CreateOrUpdate request. The method will close the http.Response Body if it receives an error.

func (DataConnectorsClient) Delete Uses

func (client DataConnectorsClient) Delete(ctx context.Context, resourceGroupName string, workspaceName string, dataConnectorID string) (result autorest.Response, err error)

Delete delete the data connector. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. dataConnectorID - connector ID

func (DataConnectorsClient) DeletePreparer Uses

func (client DataConnectorsClient) DeletePreparer(ctx context.Context, resourceGroupName string, workspaceName string, dataConnectorID string) (*http.Request, error)

DeletePreparer prepares the Delete request.

func (DataConnectorsClient) DeleteResponder Uses

func (client DataConnectorsClient) DeleteResponder(resp *http.Response) (result autorest.Response, err error)

DeleteResponder handles the response to the Delete request. The method always closes the http.Response Body.

func (DataConnectorsClient) DeleteSender Uses

func (client DataConnectorsClient) DeleteSender(req *http.Request) (*http.Response, error)

DeleteSender sends the Delete request. The method will close the http.Response Body if it receives an error.

func (DataConnectorsClient) Get Uses

func (client DataConnectorsClient) Get(ctx context.Context, resourceGroupName string, workspaceName string, dataConnectorID string) (result DataConnectorModel, err error)

Get gets a data connector. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. dataConnectorID - connector ID

func (DataConnectorsClient) GetPreparer Uses

func (client DataConnectorsClient) GetPreparer(ctx context.Context, resourceGroupName string, workspaceName string, dataConnectorID string) (*http.Request, error)

GetPreparer prepares the Get request.

func (DataConnectorsClient) GetResponder Uses

func (client DataConnectorsClient) GetResponder(resp *http.Response) (result DataConnectorModel, err error)

GetResponder handles the response to the Get request. The method always closes the http.Response Body.

func (DataConnectorsClient) GetSender Uses

func (client DataConnectorsClient) GetSender(req *http.Request) (*http.Response, error)

GetSender sends the Get request. The method will close the http.Response Body if it receives an error.

func (DataConnectorsClient) List Uses

func (client DataConnectorsClient) List(ctx context.Context, resourceGroupName string, workspaceName string) (result DataConnectorListPage, err error)

List gets all data connectors. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace.

func (DataConnectorsClient) ListComplete Uses

func (client DataConnectorsClient) ListComplete(ctx context.Context, resourceGroupName string, workspaceName string) (result DataConnectorListIterator, err error)

ListComplete enumerates all values, automatically crossing page boundaries as required.

func (DataConnectorsClient) ListPreparer Uses

func (client DataConnectorsClient) ListPreparer(ctx context.Context, resourceGroupName string, workspaceName string) (*http.Request, error)

ListPreparer prepares the List request.

func (DataConnectorsClient) ListResponder Uses

func (client DataConnectorsClient) ListResponder(resp *http.Response) (result DataConnectorList, err error)

ListResponder handles the response to the List request. The method always closes the http.Response Body.

func (DataConnectorsClient) ListSender Uses

func (client DataConnectorsClient) ListSender(req *http.Request) (*http.Response, error)

ListSender sends the List request. The method will close the http.Response Body if it receives an error.

type DataTypeState Uses

type DataTypeState string

DataTypeState enumerates the values for data type state.

const (
    // Disabled ...
    Disabled DataTypeState = "Disabled"
    // Enabled ...
    Enabled DataTypeState = "Enabled"
)

func PossibleDataTypeStateValues Uses

func PossibleDataTypeStateValues() []DataTypeState

PossibleDataTypeStateValues returns an array of possible values for the DataTypeState const type.

type ErrorAdditionalInfo Uses

type ErrorAdditionalInfo struct {
    // Type - READ-ONLY; The additional info type.
    Type *string `json:"type,omitempty"`
    // Info - READ-ONLY; The additional info.
    Info interface{} `json:"info,omitempty"`
}

ErrorAdditionalInfo the resource management error additional info.

type ErrorResponse Uses

type ErrorResponse struct {
    // Code - READ-ONLY; The error code.
    Code *string `json:"code,omitempty"`
    // Message - READ-ONLY; The error message.
    Message *string `json:"message,omitempty"`
    // Target - READ-ONLY; The error target.
    Target *string `json:"target,omitempty"`
    // Details - READ-ONLY; The error details.
    Details *[]ErrorResponse `json:"details,omitempty"`
    // AdditionalInfo - READ-ONLY; The error additional info.
    AdditionalInfo *[]ErrorAdditionalInfo `json:"additionalInfo,omitempty"`
}

ErrorResponse common error response for all Azure Resource Manager APIs to return error details for failed operations. (This also follows the OData error response format.)

type FusionAlertRule Uses

type FusionAlertRule struct {
    // FusionAlertRuleProperties - Fusion alert rule properties
    *FusionAlertRuleProperties `json:"properties,omitempty"`
    // Kind - Possible values include: 'KindAlertRule', 'KindFusion', 'KindMicrosoftSecurityIncidentCreation', 'KindScheduled'
    Kind Kind `json:"kind,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
}

FusionAlertRule represents Fusion alert rule.

func (FusionAlertRule) AsAlertRule Uses

func (far FusionAlertRule) AsAlertRule() (*AlertRule, bool)

AsAlertRule is the BasicAlertRule implementation for FusionAlertRule.

func (FusionAlertRule) AsBasicAlertRule Uses

func (far FusionAlertRule) AsBasicAlertRule() (BasicAlertRule, bool)

AsBasicAlertRule is the BasicAlertRule implementation for FusionAlertRule.

func (FusionAlertRule) AsFusionAlertRule Uses

func (far FusionAlertRule) AsFusionAlertRule() (*FusionAlertRule, bool)

AsFusionAlertRule is the BasicAlertRule implementation for FusionAlertRule.

func (FusionAlertRule) AsMicrosoftSecurityIncidentCreationAlertRule Uses

func (far FusionAlertRule) AsMicrosoftSecurityIncidentCreationAlertRule() (*MicrosoftSecurityIncidentCreationAlertRule, bool)

AsMicrosoftSecurityIncidentCreationAlertRule is the BasicAlertRule implementation for FusionAlertRule.

func (FusionAlertRule) AsScheduledAlertRule Uses

func (far FusionAlertRule) AsScheduledAlertRule() (*ScheduledAlertRule, bool)

AsScheduledAlertRule is the BasicAlertRule implementation for FusionAlertRule.

func (FusionAlertRule) MarshalJSON Uses

func (far FusionAlertRule) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for FusionAlertRule.

func (*FusionAlertRule) UnmarshalJSON Uses

func (far *FusionAlertRule) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for FusionAlertRule struct.

type FusionAlertRuleProperties Uses

type FusionAlertRuleProperties struct {
    // AlertRuleTemplateName - The Name of the alert rule template used to create this rule.
    AlertRuleTemplateName *string `json:"alertRuleTemplateName,omitempty"`
    // Description - READ-ONLY; The description of the alert rule.
    Description *string `json:"description,omitempty"`
    // DisplayName - READ-ONLY; The display name for alerts created by this alert rule.
    DisplayName *string `json:"displayName,omitempty"`
    // Enabled - Determines whether this alert rule is enabled or disabled.
    Enabled *bool `json:"enabled,omitempty"`
    // LastModifiedUtc - READ-ONLY; The last time that this alert has been modified.
    LastModifiedUtc *date.Time `json:"lastModifiedUtc,omitempty"`
    // Severity - READ-ONLY; The severity for alerts created by this alert rule. Possible values include: 'High', 'Medium', 'Low', 'Informational'
    Severity AlertSeverity `json:"severity,omitempty"`
    // Tactics - READ-ONLY; The tactics of the alert rule
    Tactics *[]AttackTactic `json:"tactics,omitempty"`
}

FusionAlertRuleProperties fusion alert rule base property bag.

func (FusionAlertRuleProperties) MarshalJSON Uses

func (farp FusionAlertRuleProperties) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for FusionAlertRuleProperties.

type FusionAlertRuleTemplate Uses

type FusionAlertRuleTemplate struct {
    // FusionAlertRuleTemplateProperties - Fusion alert rule template properties
    *FusionAlertRuleTemplateProperties `json:"properties,omitempty"`
    // Kind - Possible values include: 'KindBasicAlertRuleTemplateKindAlertRuleTemplate', 'KindBasicAlertRuleTemplateKindFusion', 'KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleTemplateKindScheduled'
    Kind KindBasicAlertRuleTemplate `json:"kind,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
}

FusionAlertRuleTemplate represents Fusion alert rule template.

func (FusionAlertRuleTemplate) AsAlertRuleTemplate Uses

func (fart FusionAlertRuleTemplate) AsAlertRuleTemplate() (*AlertRuleTemplate, bool)

AsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for FusionAlertRuleTemplate.

func (FusionAlertRuleTemplate) AsBasicAlertRuleTemplate Uses

func (fart FusionAlertRuleTemplate) AsBasicAlertRuleTemplate() (BasicAlertRuleTemplate, bool)

AsBasicAlertRuleTemplate is the BasicAlertRuleTemplate implementation for FusionAlertRuleTemplate.

func (FusionAlertRuleTemplate) AsFusionAlertRuleTemplate Uses

func (fart FusionAlertRuleTemplate) AsFusionAlertRuleTemplate() (*FusionAlertRuleTemplate, bool)

AsFusionAlertRuleTemplate is the BasicAlertRuleTemplate implementation for FusionAlertRuleTemplate.

func (FusionAlertRuleTemplate) AsMicrosoftSecurityIncidentCreationAlertRuleTemplate Uses

func (fart FusionAlertRuleTemplate) AsMicrosoftSecurityIncidentCreationAlertRuleTemplate() (*MicrosoftSecurityIncidentCreationAlertRuleTemplate, bool)

AsMicrosoftSecurityIncidentCreationAlertRuleTemplate is the BasicAlertRuleTemplate implementation for FusionAlertRuleTemplate.

func (FusionAlertRuleTemplate) AsScheduledAlertRuleTemplate Uses

func (fart FusionAlertRuleTemplate) AsScheduledAlertRuleTemplate() (*ScheduledAlertRuleTemplate, bool)

AsScheduledAlertRuleTemplate is the BasicAlertRuleTemplate implementation for FusionAlertRuleTemplate.

func (FusionAlertRuleTemplate) MarshalJSON Uses

func (fart FusionAlertRuleTemplate) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for FusionAlertRuleTemplate.

func (*FusionAlertRuleTemplate) UnmarshalJSON Uses

func (fart *FusionAlertRuleTemplate) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for FusionAlertRuleTemplate struct.

type FusionAlertRuleTemplateProperties Uses

type FusionAlertRuleTemplateProperties struct {
    // AlertRulesCreatedByTemplateCount - the number of alert rules that were created by this template
    AlertRulesCreatedByTemplateCount *int32 `json:"alertRulesCreatedByTemplateCount,omitempty"`
    // CreatedDateUTC - READ-ONLY; The time that this alert rule template has been added.
    CreatedDateUTC *date.Time `json:"createdDateUTC,omitempty"`
    // Description - The description of the alert rule template.
    Description *string `json:"description,omitempty"`
    // DisplayName - The display name for alert rule template.
    DisplayName *string `json:"displayName,omitempty"`
    // RequiredDataConnectors - The required data connectors for this template
    RequiredDataConnectors *[]AlertRuleTemplateDataSource `json:"requiredDataConnectors,omitempty"`
    // Status - The alert rule template status. Possible values include: 'Installed', 'Available', 'NotAvailable'
    Status TemplateStatus `json:"status,omitempty"`
    // Severity - The severity for alerts created by this alert rule. Possible values include: 'High', 'Medium', 'Low', 'Informational'
    Severity AlertSeverity `json:"severity,omitempty"`
    // Tactics - The tactics of the alert rule template
    Tactics *[]AttackTactic `json:"tactics,omitempty"`
}

FusionAlertRuleTemplateProperties represents Fusion alert rule template properties

func (FusionAlertRuleTemplateProperties) MarshalJSON Uses

func (fartp FusionAlertRuleTemplateProperties) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for FusionAlertRuleTemplateProperties.

type Incident Uses

type Incident struct {
    autorest.Response `json:"-"`
    // IncidentProperties - Incident properties
    *IncidentProperties `json:"properties,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
}

Incident represents an incident in Azure Security Insights.

func (Incident) MarshalJSON Uses

func (i Incident) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for Incident.

func (*Incident) UnmarshalJSON Uses

func (i *Incident) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for Incident struct.

type IncidentAdditionalData Uses

type IncidentAdditionalData struct {
    // AlertsCount - READ-ONLY; The number of alerts in the incident
    AlertsCount *int32 `json:"alertsCount,omitempty"`
    // BookmarksCount - READ-ONLY; The number of bookmarks in the incident
    BookmarksCount *int32 `json:"bookmarksCount,omitempty"`
    // CommentsCount - READ-ONLY; The number of comments in the incident
    CommentsCount *int32 `json:"commentsCount,omitempty"`
    // AlertProductNames - READ-ONLY; List of product names of alerts in the incident
    AlertProductNames *[]string `json:"alertProductNames,omitempty"`
    // Tactics - READ-ONLY; The tactics associated with incident
    Tactics *[]AttackTactic `json:"tactics,omitempty"`
}

IncidentAdditionalData incident additional data property bag.

type IncidentClassification Uses

type IncidentClassification string

IncidentClassification enumerates the values for incident classification.

const (
    // BenignPositive Incident was benign positive
    BenignPositive IncidentClassification = "BenignPositive"
    // FalsePositive Incident was false positive
    FalsePositive IncidentClassification = "FalsePositive"
    // TruePositive Incident was true positive
    TruePositive IncidentClassification = "TruePositive"
    // Undetermined Incident classification was undetermined
    Undetermined IncidentClassification = "Undetermined"
)

func PossibleIncidentClassificationValues Uses

func PossibleIncidentClassificationValues() []IncidentClassification

PossibleIncidentClassificationValues returns an array of possible values for the IncidentClassification const type.

type IncidentClassificationReason Uses

type IncidentClassificationReason string

IncidentClassificationReason enumerates the values for incident classification reason.

const (
    // InaccurateData Classification reason was inaccurate data
    InaccurateData IncidentClassificationReason = "InaccurateData"
    // IncorrectAlertLogic Classification reason was incorrect alert logic
    IncorrectAlertLogic IncidentClassificationReason = "IncorrectAlertLogic"
    // SuspiciousActivity Classification reason was suspicious activity
    SuspiciousActivity IncidentClassificationReason = "SuspiciousActivity"
    // SuspiciousButExpected Classification reason was suspicious but expected
    SuspiciousButExpected IncidentClassificationReason = "SuspiciousButExpected"
)

func PossibleIncidentClassificationReasonValues Uses

func PossibleIncidentClassificationReasonValues() []IncidentClassificationReason

PossibleIncidentClassificationReasonValues returns an array of possible values for the IncidentClassificationReason const type.

type IncidentComment Uses

type IncidentComment struct {
    autorest.Response `json:"-"`
    // IncidentCommentProperties - Incident comment properties
    *IncidentCommentProperties `json:"properties,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
}

IncidentComment represents an incident comment

func (IncidentComment) MarshalJSON Uses

func (ic IncidentComment) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for IncidentComment.

func (*IncidentComment) UnmarshalJSON Uses

func (ic *IncidentComment) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for IncidentComment struct.

type IncidentCommentList Uses

type IncidentCommentList struct {
    autorest.Response `json:"-"`
    // NextLink - READ-ONLY; URL to fetch the next set of comments.
    NextLink *string `json:"nextLink,omitempty"`
    // Value - Array of comments.
    Value *[]IncidentComment `json:"value,omitempty"`
}

IncidentCommentList list of incident comments.

func (IncidentCommentList) IsEmpty Uses

func (icl IncidentCommentList) IsEmpty() bool

IsEmpty returns true if the ListResult contains no values.

func (IncidentCommentList) MarshalJSON Uses

func (icl IncidentCommentList) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for IncidentCommentList.

type IncidentCommentListIterator Uses

type IncidentCommentListIterator struct {
    // contains filtered or unexported fields
}

IncidentCommentListIterator provides access to a complete listing of IncidentComment values.

func NewIncidentCommentListIterator Uses

func NewIncidentCommentListIterator(page IncidentCommentListPage) IncidentCommentListIterator

Creates a new instance of the IncidentCommentListIterator type.

func (*IncidentCommentListIterator) Next Uses

func (iter *IncidentCommentListIterator) Next() error

Next advances to the next value. If there was an error making the request the iterator does not advance and the error is returned. Deprecated: Use NextWithContext() instead.

func (*IncidentCommentListIterator) NextWithContext Uses

func (iter *IncidentCommentListIterator) NextWithContext(ctx context.Context) (err error)

NextWithContext advances to the next value. If there was an error making the request the iterator does not advance and the error is returned.

func (IncidentCommentListIterator) NotDone Uses

func (iter IncidentCommentListIterator) NotDone() bool

NotDone returns true if the enumeration should be started or is not yet complete.

func (IncidentCommentListIterator) Response Uses

func (iter IncidentCommentListIterator) Response() IncidentCommentList

Response returns the raw server response from the last page request.

func (IncidentCommentListIterator) Value Uses

func (iter IncidentCommentListIterator) Value() IncidentComment

Value returns the current value or a zero-initialized value if the iterator has advanced beyond the end of the collection.

type IncidentCommentListPage Uses

type IncidentCommentListPage struct {
    // contains filtered or unexported fields
}

IncidentCommentListPage contains a page of IncidentComment values.

func NewIncidentCommentListPage Uses

func NewIncidentCommentListPage(cur IncidentCommentList, getNextPage func(context.Context, IncidentCommentList) (IncidentCommentList, error)) IncidentCommentListPage

Creates a new instance of the IncidentCommentListPage type.

func (*IncidentCommentListPage) Next Uses

func (page *IncidentCommentListPage) Next() error

Next advances to the next page of values. If there was an error making the request the page does not advance and the error is returned. Deprecated: Use NextWithContext() instead.

func (*IncidentCommentListPage) NextWithContext Uses

func (page *IncidentCommentListPage) NextWithContext(ctx context.Context) (err error)

NextWithContext advances to the next page of values. If there was an error making the request the page does not advance and the error is returned.

func (IncidentCommentListPage) NotDone Uses

func (page IncidentCommentListPage) NotDone() bool

NotDone returns true if the page enumeration should be started or is not yet complete.

func (IncidentCommentListPage) Response Uses

func (page IncidentCommentListPage) Response() IncidentCommentList

Response returns the raw server response from the last page request.

func (IncidentCommentListPage) Values Uses

func (page IncidentCommentListPage) Values() []IncidentComment

Values returns the slice of values for the current page or nil if there are no values.

type IncidentCommentProperties Uses

type IncidentCommentProperties struct {
    // CreatedTimeUtc - READ-ONLY; The time the comment was created
    CreatedTimeUtc *date.Time `json:"createdTimeUtc,omitempty"`
    // Message - The comment message
    Message *string `json:"message,omitempty"`
    // Author - READ-ONLY; Describes the client that created the comment
    Author *ClientInfo `json:"author,omitempty"`
}

IncidentCommentProperties incident comment property bag.

func (IncidentCommentProperties) MarshalJSON Uses

func (icp IncidentCommentProperties) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for IncidentCommentProperties.

type IncidentCommentsClient Uses

type IncidentCommentsClient struct {
    BaseClient
}

IncidentCommentsClient is the API spec for Microsoft.SecurityInsights (Azure Security Insights) resource provider

func NewIncidentCommentsClient Uses

func NewIncidentCommentsClient(subscriptionID string) IncidentCommentsClient

NewIncidentCommentsClient creates an instance of the IncidentCommentsClient client.

func NewIncidentCommentsClientWithBaseURI Uses

func NewIncidentCommentsClientWithBaseURI(baseURI string, subscriptionID string) IncidentCommentsClient

NewIncidentCommentsClientWithBaseURI creates an instance of the IncidentCommentsClient client using a custom endpoint. Use this when interacting with an Azure cloud that uses a non-standard base URI (sovereign clouds, Azure stack).

func (IncidentCommentsClient) CreateComment Uses

func (client IncidentCommentsClient) CreateComment(ctx context.Context, resourceGroupName string, workspaceName string, incidentID string, incidentCommentID string, incidentComment IncidentComment) (result IncidentComment, err error)

CreateComment creates the incident comment. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. incidentID - incident ID incidentCommentID - incident comment ID incidentComment - the incident comment

func (IncidentCommentsClient) CreateCommentPreparer Uses

func (client IncidentCommentsClient) CreateCommentPreparer(ctx context.Context, resourceGroupName string, workspaceName string, incidentID string, incidentCommentID string, incidentComment IncidentComment) (*http.Request, error)

CreateCommentPreparer prepares the CreateComment request.

func (IncidentCommentsClient) CreateCommentResponder Uses

func (client IncidentCommentsClient) CreateCommentResponder(resp *http.Response) (result IncidentComment, err error)

CreateCommentResponder handles the response to the CreateComment request. The method always closes the http.Response Body.

func (IncidentCommentsClient) CreateCommentSender Uses

func (client IncidentCommentsClient) CreateCommentSender(req *http.Request) (*http.Response, error)

CreateCommentSender sends the CreateComment request. The method will close the http.Response Body if it receives an error.

func (IncidentCommentsClient) Get Uses

func (client IncidentCommentsClient) Get(ctx context.Context, resourceGroupName string, workspaceName string, incidentID string, incidentCommentID string) (result IncidentComment, err error)

Get gets an incident comment. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. incidentID - incident ID incidentCommentID - incident comment ID

func (IncidentCommentsClient) GetPreparer Uses

func (client IncidentCommentsClient) GetPreparer(ctx context.Context, resourceGroupName string, workspaceName string, incidentID string, incidentCommentID string) (*http.Request, error)

GetPreparer prepares the Get request.

func (IncidentCommentsClient) GetResponder Uses

func (client IncidentCommentsClient) GetResponder(resp *http.Response) (result IncidentComment, err error)

GetResponder handles the response to the Get request. The method always closes the http.Response Body.

func (IncidentCommentsClient) GetSender Uses

func (client IncidentCommentsClient) GetSender(req *http.Request) (*http.Response, error)

GetSender sends the Get request. The method will close the http.Response Body if it receives an error.

func (IncidentCommentsClient) ListByIncident Uses

func (client IncidentCommentsClient) ListByIncident(ctx context.Context, resourceGroupName string, workspaceName string, incidentID string, filter string, orderby string, top *int32, skipToken string) (result IncidentCommentListPage, err error)

ListByIncident gets all incident comments. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. incidentID - incident ID filter - filters the results, based on a Boolean condition. Optional. orderby - sorts the results. Optional. top - returns only the first n results. Optional. skipToken - skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.

func (IncidentCommentsClient) ListByIncidentComplete Uses

func (client IncidentCommentsClient) ListByIncidentComplete(ctx context.Context, resourceGroupName string, workspaceName string, incidentID string, filter string, orderby string, top *int32, skipToken string) (result IncidentCommentListIterator, err error)

ListByIncidentComplete enumerates all values, automatically crossing page boundaries as required.

func (IncidentCommentsClient) ListByIncidentPreparer Uses

func (client IncidentCommentsClient) ListByIncidentPreparer(ctx context.Context, resourceGroupName string, workspaceName string, incidentID string, filter string, orderby string, top *int32, skipToken string) (*http.Request, error)

ListByIncidentPreparer prepares the ListByIncident request.

func (IncidentCommentsClient) ListByIncidentResponder Uses

func (client IncidentCommentsClient) ListByIncidentResponder(resp *http.Response) (result IncidentCommentList, err error)

ListByIncidentResponder handles the response to the ListByIncident request. The method always closes the http.Response Body.

func (IncidentCommentsClient) ListByIncidentSender Uses

func (client IncidentCommentsClient) ListByIncidentSender(req *http.Request) (*http.Response, error)

ListByIncidentSender sends the ListByIncident request. The method will close the http.Response Body if it receives an error.

type IncidentInfo Uses

type IncidentInfo struct {
    // IncidentID - Incident Id
    IncidentID *string `json:"incidentId,omitempty"`
    // Severity - The severity of the incident. Possible values include: 'CaseSeverityCritical', 'CaseSeverityHigh', 'CaseSeverityMedium', 'CaseSeverityLow', 'CaseSeverityInformational'
    Severity CaseSeverity `json:"severity,omitempty"`
    // Title - The title of the incident
    Title *string `json:"title,omitempty"`
    // RelationName - Relation Name
    RelationName *string `json:"relationName,omitempty"`
}

IncidentInfo describes related incident information for the bookmark

type IncidentLabel Uses

type IncidentLabel struct {
    // LabelName - The name of the label
    LabelName *string `json:"labelName,omitempty"`
    // LabelType - READ-ONLY; The type of the label. Possible values include: 'User', 'System'
    LabelType IncidentLabelType `json:"labelType,omitempty"`
}

IncidentLabel represents an incident label

func (IncidentLabel) MarshalJSON Uses

func (il IncidentLabel) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for IncidentLabel.

type IncidentLabelType Uses

type IncidentLabelType string

IncidentLabelType enumerates the values for incident label type.

const (
    // System Label automatically created by the system
    System IncidentLabelType = "System"
    // User Label manually created by a user
    User IncidentLabelType = "User"
)

func PossibleIncidentLabelTypeValues Uses

func PossibleIncidentLabelTypeValues() []IncidentLabelType

PossibleIncidentLabelTypeValues returns an array of possible values for the IncidentLabelType const type.

type IncidentList Uses

type IncidentList struct {
    autorest.Response `json:"-"`
    // NextLink - READ-ONLY; URL to fetch the next set of incidents.
    NextLink *string `json:"nextLink,omitempty"`
    // Value - Array of incidents.
    Value *[]Incident `json:"value,omitempty"`
}

IncidentList list all the incidents.

func (IncidentList) IsEmpty Uses

func (il IncidentList) IsEmpty() bool

IsEmpty returns true if the ListResult contains no values.

func (IncidentList) MarshalJSON Uses

func (il IncidentList) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for IncidentList.

type IncidentListIterator Uses

type IncidentListIterator struct {
    // contains filtered or unexported fields
}

IncidentListIterator provides access to a complete listing of Incident values.

func NewIncidentListIterator Uses

func NewIncidentListIterator(page IncidentListPage) IncidentListIterator

Creates a new instance of the IncidentListIterator type.

func (*IncidentListIterator) Next Uses

func (iter *IncidentListIterator) Next() error

Next advances to the next value. If there was an error making the request the iterator does not advance and the error is returned. Deprecated: Use NextWithContext() instead.

func (*IncidentListIterator) NextWithContext Uses

func (iter *IncidentListIterator) NextWithContext(ctx context.Context) (err error)

NextWithContext advances to the next value. If there was an error making the request the iterator does not advance and the error is returned.

func (IncidentListIterator) NotDone Uses

func (iter IncidentListIterator) NotDone() bool

NotDone returns true if the enumeration should be started or is not yet complete.

func (IncidentListIterator) Response Uses

func (iter IncidentListIterator) Response() IncidentList

Response returns the raw server response from the last page request.

func (IncidentListIterator) Value Uses

func (iter IncidentListIterator) Value() Incident

Value returns the current value or a zero-initialized value if the iterator has advanced beyond the end of the collection.

type IncidentListPage Uses

type IncidentListPage struct {
    // contains filtered or unexported fields
}

IncidentListPage contains a page of Incident values.

func NewIncidentListPage Uses

func NewIncidentListPage(cur IncidentList, getNextPage func(context.Context, IncidentList) (IncidentList, error)) IncidentListPage

Creates a new instance of the IncidentListPage type.

func (*IncidentListPage) Next Uses

func (page *IncidentListPage) Next() error

Next advances to the next page of values. If there was an error making the request the page does not advance and the error is returned. Deprecated: Use NextWithContext() instead.

func (*IncidentListPage) NextWithContext Uses

func (page *IncidentListPage) NextWithContext(ctx context.Context) (err error)

NextWithContext advances to the next page of values. If there was an error making the request the page does not advance and the error is returned.

func (IncidentListPage) NotDone Uses

func (page IncidentListPage) NotDone() bool

NotDone returns true if the page enumeration should be started or is not yet complete.

func (IncidentListPage) Response Uses

func (page IncidentListPage) Response() IncidentList

Response returns the raw server response from the last page request.

func (IncidentListPage) Values Uses

func (page IncidentListPage) Values() []Incident

Values returns the slice of values for the current page or nil if there are no values.

type IncidentOwnerInfo Uses

type IncidentOwnerInfo struct {
    // Email - The email of the user the incident is assigned to.
    Email *string `json:"email,omitempty"`
    // AssignedTo - The name of the user the incident is assigned to.
    AssignedTo *string `json:"assignedTo,omitempty"`
    // ObjectID - The object id of the user the incident is assigned to.
    ObjectID *uuid.UUID `json:"objectId,omitempty"`
    // UserPrincipalName - The user principal name of the user the incident is assigned to.
    UserPrincipalName *string `json:"userPrincipalName,omitempty"`
}

IncidentOwnerInfo information on the user an incident is assigned to

type IncidentProperties Uses

type IncidentProperties struct {
    // AdditionalData - READ-ONLY; Additional data on the incident
    AdditionalData *IncidentAdditionalData `json:"additionalData,omitempty"`
    // Classification - The reason the incident was closed. Possible values include: 'Undetermined', 'TruePositive', 'BenignPositive', 'FalsePositive'
    Classification IncidentClassification `json:"classification,omitempty"`
    // ClassificationComment - Describes the reason the incident was closed
    ClassificationComment *string `json:"classificationComment,omitempty"`
    // ClassificationReason - The classification reason the incident was closed with. Possible values include: 'SuspiciousActivity', 'SuspiciousButExpected', 'IncorrectAlertLogic', 'InaccurateData'
    ClassificationReason IncidentClassificationReason `json:"classificationReason,omitempty"`
    // CreatedTimeUtc - READ-ONLY; The time the incident was created
    CreatedTimeUtc *date.Time `json:"createdTimeUtc,omitempty"`
    // Description - The description of the incident
    Description *string `json:"description,omitempty"`
    // FirstActivityTimeUtc - The time of the first activity in the incident
    FirstActivityTimeUtc *date.Time `json:"firstActivityTimeUtc,omitempty"`
    // IncidentURL - READ-ONLY; The deep-link url to the incident in Azure portal
    IncidentURL *string `json:"incidentUrl,omitempty"`
    // IncidentNumber - READ-ONLY; A sequential number
    IncidentNumber *int32 `json:"incidentNumber,omitempty"`
    // Labels - List of labels relevant to this incident
    Labels *[]IncidentLabel `json:"labels,omitempty"`
    // LastActivityTimeUtc - The time of the last activity in the incident
    LastActivityTimeUtc *date.Time `json:"lastActivityTimeUtc,omitempty"`
    // LastModifiedTimeUtc - READ-ONLY; The last time the incident was updated
    LastModifiedTimeUtc *date.Time `json:"lastModifiedTimeUtc,omitempty"`
    // Owner - Describes a user that the incident is assigned to
    Owner *IncidentOwnerInfo `json:"owner,omitempty"`
    // RelatedAnalyticRuleIds - READ-ONLY; List of resource ids of Analytic rules related to the incident
    RelatedAnalyticRuleIds *[]string `json:"relatedAnalyticRuleIds,omitempty"`
    // Severity - The severity of the incident. Possible values include: 'IncidentSeverityHigh', 'IncidentSeverityMedium', 'IncidentSeverityLow', 'IncidentSeverityInformational'
    Severity IncidentSeverity `json:"severity,omitempty"`
    // Status - The status of the incident. Possible values include: 'IncidentStatusNew', 'IncidentStatusActive', 'IncidentStatusClosed'
    Status IncidentStatus `json:"status,omitempty"`
    // Title - The title of the incident
    Title *string `json:"title,omitempty"`
}

IncidentProperties describes incident properties

func (IncidentProperties) MarshalJSON Uses

func (IP IncidentProperties) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for IncidentProperties.

type IncidentSeverity Uses

type IncidentSeverity string

IncidentSeverity enumerates the values for incident severity.

const (
    // IncidentSeverityHigh High severity
    IncidentSeverityHigh IncidentSeverity = "High"
    // IncidentSeverityInformational Informational severity
    IncidentSeverityInformational IncidentSeverity = "Informational"
    // IncidentSeverityLow Low severity
    IncidentSeverityLow IncidentSeverity = "Low"
    // IncidentSeverityMedium Medium severity
    IncidentSeverityMedium IncidentSeverity = "Medium"
)

func PossibleIncidentSeverityValues Uses

func PossibleIncidentSeverityValues() []IncidentSeverity

PossibleIncidentSeverityValues returns an array of possible values for the IncidentSeverity const type.

type IncidentStatus Uses

type IncidentStatus string

IncidentStatus enumerates the values for incident status.

const (
    // IncidentStatusActive An active incident which is being handled
    IncidentStatusActive IncidentStatus = "Active"
    // IncidentStatusClosed A non-active incident
    IncidentStatusClosed IncidentStatus = "Closed"
    // IncidentStatusNew An active incident which isn't being handled currently
    IncidentStatusNew IncidentStatus = "New"
)

func PossibleIncidentStatusValues Uses

func PossibleIncidentStatusValues() []IncidentStatus

PossibleIncidentStatusValues returns an array of possible values for the IncidentStatus const type.

type IncidentsClient Uses

type IncidentsClient struct {
    BaseClient
}

IncidentsClient is the API spec for Microsoft.SecurityInsights (Azure Security Insights) resource provider

func NewIncidentsClient Uses

func NewIncidentsClient(subscriptionID string) IncidentsClient

NewIncidentsClient creates an instance of the IncidentsClient client.

func NewIncidentsClientWithBaseURI Uses

func NewIncidentsClientWithBaseURI(baseURI string, subscriptionID string) IncidentsClient

NewIncidentsClientWithBaseURI creates an instance of the IncidentsClient client using a custom endpoint. Use this when interacting with an Azure cloud that uses a non-standard base URI (sovereign clouds, Azure stack).

func (IncidentsClient) CreateOrUpdate Uses

func (client IncidentsClient) CreateOrUpdate(ctx context.Context, resourceGroupName string, workspaceName string, incidentID string, incident Incident) (result Incident, err error)

CreateOrUpdate creates or updates the incident. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. incidentID - incident ID incident - the incident

func (IncidentsClient) CreateOrUpdatePreparer Uses

func (client IncidentsClient) CreateOrUpdatePreparer(ctx context.Context, resourceGroupName string, workspaceName string, incidentID string, incident Incident) (*http.Request, error)

CreateOrUpdatePreparer prepares the CreateOrUpdate request.

func (IncidentsClient) CreateOrUpdateResponder Uses

func (client IncidentsClient) CreateOrUpdateResponder(resp *http.Response) (result Incident, err error)

CreateOrUpdateResponder handles the response to the CreateOrUpdate request. The method always closes the http.Response Body.

func (IncidentsClient) CreateOrUpdateSender Uses

func (client IncidentsClient) CreateOrUpdateSender(req *http.Request) (*http.Response, error)

CreateOrUpdateSender sends the CreateOrUpdate request. The method will close the http.Response Body if it receives an error.

func (IncidentsClient) Delete Uses

func (client IncidentsClient) Delete(ctx context.Context, resourceGroupName string, workspaceName string, incidentID string) (result autorest.Response, err error)

Delete delete the incident. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. incidentID - incident ID

func (IncidentsClient) DeletePreparer Uses

func (client IncidentsClient) DeletePreparer(ctx context.Context, resourceGroupName string, workspaceName string, incidentID string) (*http.Request, error)

DeletePreparer prepares the Delete request.

func (IncidentsClient) DeleteResponder Uses

func (client IncidentsClient) DeleteResponder(resp *http.Response) (result autorest.Response, err error)

DeleteResponder handles the response to the Delete request. The method always closes the http.Response Body.

func (IncidentsClient) DeleteSender Uses

func (client IncidentsClient) DeleteSender(req *http.Request) (*http.Response, error)

DeleteSender sends the Delete request. The method will close the http.Response Body if it receives an error.

func (IncidentsClient) Get Uses

func (client IncidentsClient) Get(ctx context.Context, resourceGroupName string, workspaceName string, incidentID string) (result Incident, err error)

Get gets an incident. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. incidentID - incident ID

func (IncidentsClient) GetPreparer Uses

func (client IncidentsClient) GetPreparer(ctx context.Context, resourceGroupName string, workspaceName string, incidentID string) (*http.Request, error)

GetPreparer prepares the Get request.

func (IncidentsClient) GetResponder Uses

func (client IncidentsClient) GetResponder(resp *http.Response) (result Incident, err error)

GetResponder handles the response to the Get request. The method always closes the http.Response Body.

func (IncidentsClient) GetSender Uses

func (client IncidentsClient) GetSender(req *http.Request) (*http.Response, error)

GetSender sends the Get request. The method will close the http.Response Body if it receives an error.

func (IncidentsClient) List Uses

func (client IncidentsClient) List(ctx context.Context, resourceGroupName string, workspaceName string, filter string, orderby string, top *int32, skipToken string) (result IncidentListPage, err error)

List gets all incidents. Parameters: resourceGroupName - the name of the resource group within the user's subscription. The name is case insensitive. workspaceName - the name of the workspace. filter - filters the results, based on a Boolean condition. Optional. orderby - sorts the results. Optional. top - returns only the first n results. Optional. skipToken - skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.

func (IncidentsClient) ListComplete Uses

func (client IncidentsClient) ListComplete(ctx context.Context, resourceGroupName string, workspaceName string, filter string, orderby string, top *int32, skipToken string) (result IncidentListIterator, err error)

ListComplete enumerates all values, automatically crossing page boundaries as required.

func (IncidentsClient) ListPreparer Uses

func (client IncidentsClient) ListPreparer(ctx context.Context, resourceGroupName string, workspaceName string, filter string, orderby string, top *int32, skipToken string) (*http.Request, error)

ListPreparer prepares the List request.

func (IncidentsClient) ListResponder Uses

func (client IncidentsClient) ListResponder(resp *http.Response) (result IncidentList, err error)

ListResponder handles the response to the List request. The method always closes the http.Response Body.

func (IncidentsClient) ListSender Uses

func (client IncidentsClient) ListSender(req *http.Request) (*http.Response, error)

ListSender sends the List request. The method will close the http.Response Body if it receives an error.

type Kind Uses

type Kind string

Kind enumerates the values for kind.

const (
    // KindAlertRule ...
    KindAlertRule Kind = "AlertRule"
    // KindFusion ...
    KindFusion Kind = "Fusion"
    // KindMicrosoftSecurityIncidentCreation ...
    KindMicrosoftSecurityIncidentCreation Kind = "MicrosoftSecurityIncidentCreation"
    // KindScheduled ...
    KindScheduled Kind = "Scheduled"
)

func PossibleKindValues Uses

func PossibleKindValues() []Kind

PossibleKindValues returns an array of possible values for the Kind const type.

type KindBasicAlertRuleTemplate Uses

type KindBasicAlertRuleTemplate string

KindBasicAlertRuleTemplate enumerates the values for kind basic alert rule template.

const (
    // KindBasicAlertRuleTemplateKindAlertRuleTemplate ...
    KindBasicAlertRuleTemplateKindAlertRuleTemplate KindBasicAlertRuleTemplate = "AlertRuleTemplate"
    // KindBasicAlertRuleTemplateKindFusion ...
    KindBasicAlertRuleTemplateKindFusion KindBasicAlertRuleTemplate = "Fusion"
    // KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation ...
    KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation KindBasicAlertRuleTemplate = "MicrosoftSecurityIncidentCreation"
    // KindBasicAlertRuleTemplateKindScheduled ...
    KindBasicAlertRuleTemplateKindScheduled KindBasicAlertRuleTemplate = "Scheduled"
)

func PossibleKindBasicAlertRuleTemplateValues Uses

func PossibleKindBasicAlertRuleTemplateValues() []KindBasicAlertRuleTemplate

PossibleKindBasicAlertRuleTemplateValues returns an array of possible values for the KindBasicAlertRuleTemplate const type.

type KindBasicDataConnector Uses

type KindBasicDataConnector string

KindBasicDataConnector enumerates the values for kind basic data connector.

const (
    // KindAmazonWebServicesCloudTrail ...
    KindAmazonWebServicesCloudTrail KindBasicDataConnector = "AmazonWebServicesCloudTrail"
    // KindAzureActiveDirectory ...
    KindAzureActiveDirectory KindBasicDataConnector = "AzureActiveDirectory"
    // KindAzureAdvancedThreatProtection ...
    KindAzureAdvancedThreatProtection KindBasicDataConnector = "AzureAdvancedThreatProtection"
    // KindAzureSecurityCenter ...
    KindAzureSecurityCenter KindBasicDataConnector = "AzureSecurityCenter"
    // KindDataConnector ...
    KindDataConnector KindBasicDataConnector = "DataConnector"
    // KindMicrosoftCloudAppSecurity ...
    KindMicrosoftCloudAppSecurity KindBasicDataConnector = "MicrosoftCloudAppSecurity"
    // KindMicrosoftDefenderAdvancedThreatProtection ...
    KindMicrosoftDefenderAdvancedThreatProtection KindBasicDataConnector = "MicrosoftDefenderAdvancedThreatProtection"
    // KindOffice365 ...
    KindOffice365 KindBasicDataConnector = "Office365"
    // KindThreatIntelligence ...
    KindThreatIntelligence KindBasicDataConnector = "ThreatIntelligence"
)

func PossibleKindBasicDataConnectorValues Uses

func PossibleKindBasicDataConnectorValues() []KindBasicDataConnector

PossibleKindBasicDataConnectorValues returns an array of possible values for the KindBasicDataConnector const type.

type KindBasicSettings Uses

type KindBasicSettings string

KindBasicSettings enumerates the values for kind basic settings.

const (
    // KindSettings ...
    KindSettings KindBasicSettings = "Settings"
    // KindToggleSettings ...
    KindToggleSettings KindBasicSettings = "ToggleSettings"
    // KindUebaSettings ...
    KindUebaSettings KindBasicSettings = "UebaSettings"
)

func PossibleKindBasicSettingsValues Uses

func PossibleKindBasicSettingsValues() []KindBasicSettings

PossibleKindBasicSettingsValues returns an array of possible values for the KindBasicSettings const type.

type LicenseStatus Uses

type LicenseStatus string

LicenseStatus enumerates the values for license status.

const (
    // LicenseStatusDisabled ...
    LicenseStatusDisabled LicenseStatus = "Disabled"
    // LicenseStatusEnabled ...
    LicenseStatusEnabled LicenseStatus = "Enabled"
)

func PossibleLicenseStatusValues Uses

func PossibleLicenseStatusValues() []LicenseStatus

PossibleLicenseStatusValues returns an array of possible values for the LicenseStatus const type.

type MCASDataConnector Uses

type MCASDataConnector struct {
    // MCASDataConnectorProperties - MCAS (Microsoft Cloud App Security) data connector properties.
    *MCASDataConnectorProperties `json:"properties,omitempty"`
    // Kind - Possible values include: 'KindDataConnector', 'KindAzureActiveDirectory', 'KindAzureAdvancedThreatProtection', 'KindAzureSecurityCenter', 'KindAmazonWebServicesCloudTrail', 'KindMicrosoftCloudAppSecurity', 'KindMicrosoftDefenderAdvancedThreatProtection', 'KindOffice365', 'KindThreatIntelligence'
    Kind KindBasicDataConnector `json:"kind,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
}

MCASDataConnector represents MCAS (Microsoft Cloud App Security) data connector.

func (MCASDataConnector) AsAADDataConnector Uses

func (mdc MCASDataConnector) AsAADDataConnector() (*AADDataConnector, bool)

AsAADDataConnector is the BasicDataConnector implementation for MCASDataConnector.

func (MCASDataConnector) AsAATPDataConnector Uses

func (mdc MCASDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool)

AsAATPDataConnector is the BasicDataConnector implementation for MCASDataConnector.

func (MCASDataConnector) AsASCDataConnector Uses

func (mdc MCASDataConnector) AsASCDataConnector() (*ASCDataConnector, bool)

AsASCDataConnector is the BasicDataConnector implementation for MCASDataConnector.

func (MCASDataConnector) AsAwsCloudTrailDataConnector Uses

func (mdc MCASDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool)

AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for MCASDataConnector.

func (MCASDataConnector) AsBasicDataConnector Uses

func (mdc MCASDataConnector) AsBasicDataConnector() (BasicDataConnector, bool)

AsBasicDataConnector is the BasicDataConnector implementation for MCASDataConnector.

func (MCASDataConnector) AsDataConnector Uses

func (mdc MCASDataConnector) AsDataConnector() (*DataConnector, bool)

AsDataConnector is the BasicDataConnector implementation for MCASDataConnector.

func (MCASDataConnector) AsMCASDataConnector Uses

func (mdc MCASDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool)

AsMCASDataConnector is the BasicDataConnector implementation for MCASDataConnector.

func (MCASDataConnector) AsMDATPDataConnector Uses

func (mdc MCASDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool)

AsMDATPDataConnector is the BasicDataConnector implementation for MCASDataConnector.

func (MCASDataConnector) AsOfficeDataConnector Uses

func (mdc MCASDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool)

AsOfficeDataConnector is the BasicDataConnector implementation for MCASDataConnector.

func (MCASDataConnector) AsTIDataConnector Uses

func (mdc MCASDataConnector) AsTIDataConnector() (*TIDataConnector, bool)

AsTIDataConnector is the BasicDataConnector implementation for MCASDataConnector.

func (MCASDataConnector) MarshalJSON Uses

func (mdc MCASDataConnector) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for MCASDataConnector.

func (*MCASDataConnector) UnmarshalJSON Uses

func (mdc *MCASDataConnector) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for MCASDataConnector struct.

type MCASDataConnectorDataTypes Uses

type MCASDataConnectorDataTypes struct {
    // DiscoveryLogs - Discovery log data type connection.
    DiscoveryLogs *DataConnectorDataTypeCommon `json:"discoveryLogs,omitempty"`
    // Alerts - Alerts data type connection.
    Alerts *DataConnectorDataTypeCommon `json:"alerts,omitempty"`
}

MCASDataConnectorDataTypes the available data types for MCAS (Microsoft Cloud App Security) data connector.

type MCASDataConnectorProperties Uses

type MCASDataConnectorProperties struct {
    // TenantID - The tenant id to connect to, and get the data from.
    TenantID *string `json:"tenantId,omitempty"`
    // DataTypes - The available data types for the connector.
    DataTypes *MCASDataConnectorDataTypes `json:"dataTypes,omitempty"`
}

MCASDataConnectorProperties MCAS (Microsoft Cloud App Security) data connector properties.

type MDATPDataConnector Uses

type MDATPDataConnector struct {
    // MDATPDataConnectorProperties - MDATP (Microsoft Defender Advanced Threat Protection) data connector properties.
    *MDATPDataConnectorProperties `json:"properties,omitempty"`
    // Kind - Possible values include: 'KindDataConnector', 'KindAzureActiveDirectory', 'KindAzureAdvancedThreatProtection', 'KindAzureSecurityCenter', 'KindAmazonWebServicesCloudTrail', 'KindMicrosoftCloudAppSecurity', 'KindMicrosoftDefenderAdvancedThreatProtection', 'KindOffice365', 'KindThreatIntelligence'
    Kind KindBasicDataConnector `json:"kind,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
}

MDATPDataConnector represents MDATP (Microsoft Defender Advanced Threat Protection) data connector.

func (MDATPDataConnector) AsAADDataConnector Uses

func (mdc MDATPDataConnector) AsAADDataConnector() (*AADDataConnector, bool)

AsAADDataConnector is the BasicDataConnector implementation for MDATPDataConnector.

func (MDATPDataConnector) AsAATPDataConnector Uses

func (mdc MDATPDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool)

AsAATPDataConnector is the BasicDataConnector implementation for MDATPDataConnector.

func (MDATPDataConnector) AsASCDataConnector Uses

func (mdc MDATPDataConnector) AsASCDataConnector() (*ASCDataConnector, bool)

AsASCDataConnector is the BasicDataConnector implementation for MDATPDataConnector.

func (MDATPDataConnector) AsAwsCloudTrailDataConnector Uses

func (mdc MDATPDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool)

AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for MDATPDataConnector.

func (MDATPDataConnector) AsBasicDataConnector Uses

func (mdc MDATPDataConnector) AsBasicDataConnector() (BasicDataConnector, bool)

AsBasicDataConnector is the BasicDataConnector implementation for MDATPDataConnector.

func (MDATPDataConnector) AsDataConnector Uses

func (mdc MDATPDataConnector) AsDataConnector() (*DataConnector, bool)

AsDataConnector is the BasicDataConnector implementation for MDATPDataConnector.

func (MDATPDataConnector) AsMCASDataConnector Uses

func (mdc MDATPDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool)

AsMCASDataConnector is the BasicDataConnector implementation for MDATPDataConnector.

func (MDATPDataConnector) AsMDATPDataConnector Uses

func (mdc MDATPDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool)

AsMDATPDataConnector is the BasicDataConnector implementation for MDATPDataConnector.

func (MDATPDataConnector) AsOfficeDataConnector Uses

func (mdc MDATPDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool)

AsOfficeDataConnector is the BasicDataConnector implementation for MDATPDataConnector.

func (MDATPDataConnector) AsTIDataConnector Uses

func (mdc MDATPDataConnector) AsTIDataConnector() (*TIDataConnector, bool)

AsTIDataConnector is the BasicDataConnector implementation for MDATPDataConnector.

func (MDATPDataConnector) MarshalJSON Uses

func (mdc MDATPDataConnector) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for MDATPDataConnector.

func (*MDATPDataConnector) UnmarshalJSON Uses

func (mdc *MDATPDataConnector) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for MDATPDataConnector struct.

type MDATPDataConnectorProperties Uses

type MDATPDataConnectorProperties struct {
    // TenantID - The tenant id to connect to, and get the data from.
    TenantID *string `json:"tenantId,omitempty"`
    // DataTypes - The available data types for the connector.
    DataTypes *AlertsDataTypeOfDataConnector `json:"dataTypes,omitempty"`
}

MDATPDataConnectorProperties MDATP (Microsoft Defender Advanced Threat Protection) data connector properties.

type MicrosoftSecurityIncidentCreationAlertRule Uses

type MicrosoftSecurityIncidentCreationAlertRule struct {
    // MicrosoftSecurityIncidentCreationAlertRuleProperties - MicrosoftSecurityIncidentCreation rule properties
    *MicrosoftSecurityIncidentCreationAlertRuleProperties `json:"properties,omitempty"`
    // Kind - Possible values include: 'KindAlertRule', 'KindFusion', 'KindMicrosoftSecurityIncidentCreation', 'KindScheduled'
    Kind Kind `json:"kind,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
}

MicrosoftSecurityIncidentCreationAlertRule represents MicrosoftSecurityIncidentCreation rule.

func (MicrosoftSecurityIncidentCreationAlertRule) AsAlertRule Uses

func (msicar MicrosoftSecurityIncidentCreationAlertRule) AsAlertRule() (*AlertRule, bool)

AsAlertRule is the BasicAlertRule implementation for MicrosoftSecurityIncidentCreationAlertRule.

func (MicrosoftSecurityIncidentCreationAlertRule) AsBasicAlertRule Uses

func (msicar MicrosoftSecurityIncidentCreationAlertRule) AsBasicAlertRule() (BasicAlertRule, bool)

AsBasicAlertRule is the BasicAlertRule implementation for MicrosoftSecurityIncidentCreationAlertRule.

func (MicrosoftSecurityIncidentCreationAlertRule) AsFusionAlertRule Uses

func (msicar MicrosoftSecurityIncidentCreationAlertRule) AsFusionAlertRule() (*FusionAlertRule, bool)

AsFusionAlertRule is the BasicAlertRule implementation for MicrosoftSecurityIncidentCreationAlertRule.

func (MicrosoftSecurityIncidentCreationAlertRule) AsMicrosoftSecurityIncidentCreationAlertRule Uses

func (msicar MicrosoftSecurityIncidentCreationAlertRule) AsMicrosoftSecurityIncidentCreationAlertRule() (*MicrosoftSecurityIncidentCreationAlertRule, bool)

AsMicrosoftSecurityIncidentCreationAlertRule is the BasicAlertRule implementation for MicrosoftSecurityIncidentCreationAlertRule.

func (MicrosoftSecurityIncidentCreationAlertRule) AsScheduledAlertRule Uses

func (msicar MicrosoftSecurityIncidentCreationAlertRule) AsScheduledAlertRule() (*ScheduledAlertRule, bool)

AsScheduledAlertRule is the BasicAlertRule implementation for MicrosoftSecurityIncidentCreationAlertRule.

func (MicrosoftSecurityIncidentCreationAlertRule) MarshalJSON Uses

func (msicar MicrosoftSecurityIncidentCreationAlertRule) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for MicrosoftSecurityIncidentCreationAlertRule.

func (*MicrosoftSecurityIncidentCreationAlertRule) UnmarshalJSON Uses

func (msicar *MicrosoftSecurityIncidentCreationAlertRule) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for MicrosoftSecurityIncidentCreationAlertRule struct.

type MicrosoftSecurityIncidentCreationAlertRuleCommonProperties Uses

type MicrosoftSecurityIncidentCreationAlertRuleCommonProperties struct {
    // DisplayNamesFilter - the alerts' displayNames on which the cases will be generated
    DisplayNamesFilter *[]string `json:"displayNamesFilter,omitempty"`
    // DisplayNamesExcludeFilter - the alerts' displayNames on which the cases will not be generated
    DisplayNamesExcludeFilter *[]string `json:"displayNamesExcludeFilter,omitempty"`
    // ProductFilter - The alerts' productName on which the cases will be generated. Possible values include: 'MicrosoftCloudAppSecurity', 'AzureSecurityCenter', 'AzureAdvancedThreatProtection', 'AzureActiveDirectoryIdentityProtection', 'AzureSecurityCenterforIoT'
    ProductFilter MicrosoftSecurityProductName `json:"productFilter,omitempty"`
    // SeveritiesFilter - the alerts' severities on which the cases will be generated
    SeveritiesFilter *[]AlertSeverity `json:"severitiesFilter,omitempty"`
}

MicrosoftSecurityIncidentCreationAlertRuleCommonProperties microsoftSecurityIncidentCreation rule common property bag.

type MicrosoftSecurityIncidentCreationAlertRuleProperties Uses

type MicrosoftSecurityIncidentCreationAlertRuleProperties struct {
    // AlertRuleTemplateName - The Name of the alert rule template used to create this rule.
    AlertRuleTemplateName *string `json:"alertRuleTemplateName,omitempty"`
    // Description - The description of the alert rule.
    Description *string `json:"description,omitempty"`
    // DisplayName - The display name for alerts created by this alert rule.
    DisplayName *string `json:"displayName,omitempty"`
    // Enabled - Determines whether this alert rule is enabled or disabled.
    Enabled *bool `json:"enabled,omitempty"`
    // LastModifiedUtc - READ-ONLY; The last time that this alert has been modified.
    LastModifiedUtc *date.Time `json:"lastModifiedUtc,omitempty"`
    // DisplayNamesFilter - the alerts' displayNames on which the cases will be generated
    DisplayNamesFilter *[]string `json:"displayNamesFilter,omitempty"`
    // DisplayNamesExcludeFilter - the alerts' displayNames on which the cases will not be generated
    DisplayNamesExcludeFilter *[]string `json:"displayNamesExcludeFilter,omitempty"`
    // ProductFilter - The alerts' productName on which the cases will be generated. Possible values include: 'MicrosoftCloudAppSecurity', 'AzureSecurityCenter', 'AzureAdvancedThreatProtection', 'AzureActiveDirectoryIdentityProtection', 'AzureSecurityCenterforIoT'
    ProductFilter MicrosoftSecurityProductName `json:"productFilter,omitempty"`
    // SeveritiesFilter - the alerts' severities on which the cases will be generated
    SeveritiesFilter *[]AlertSeverity `json:"severitiesFilter,omitempty"`
}

MicrosoftSecurityIncidentCreationAlertRuleProperties microsoftSecurityIncidentCreation rule property bag.

func (MicrosoftSecurityIncidentCreationAlertRuleProperties) MarshalJSON Uses

func (msicarp MicrosoftSecurityIncidentCreationAlertRuleProperties) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for MicrosoftSecurityIncidentCreationAlertRuleProperties.

type MicrosoftSecurityIncidentCreationAlertRuleTemplate Uses

type MicrosoftSecurityIncidentCreationAlertRuleTemplate struct {
    // MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties - MicrosoftSecurityIncidentCreation rule template properties
    *MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties `json:"properties,omitempty"`
    // Kind - Possible values include: 'KindBasicAlertRuleTemplateKindAlertRuleTemplate', 'KindBasicAlertRuleTemplateKindFusion', 'KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleTemplateKindScheduled'
    Kind KindBasicAlertRuleTemplate `json:"kind,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
}

MicrosoftSecurityIncidentCreationAlertRuleTemplate represents MicrosoftSecurityIncidentCreation rule template.

func (MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsAlertRuleTemplate Uses

func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsAlertRuleTemplate() (*AlertRuleTemplate, bool)

AsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MicrosoftSecurityIncidentCreationAlertRuleTemplate.

func (MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsBasicAlertRuleTemplate Uses

func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsBasicAlertRuleTemplate() (BasicAlertRuleTemplate, bool)

AsBasicAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MicrosoftSecurityIncidentCreationAlertRuleTemplate.

func (MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsFusionAlertRuleTemplate Uses

func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsFusionAlertRuleTemplate() (*FusionAlertRuleTemplate, bool)

AsFusionAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MicrosoftSecurityIncidentCreationAlertRuleTemplate.

func (MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsMicrosoftSecurityIncidentCreationAlertRuleTemplate Uses

func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsMicrosoftSecurityIncidentCreationAlertRuleTemplate() (*MicrosoftSecurityIncidentCreationAlertRuleTemplate, bool)

AsMicrosoftSecurityIncidentCreationAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MicrosoftSecurityIncidentCreationAlertRuleTemplate.

func (MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsScheduledAlertRuleTemplate Uses

func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsScheduledAlertRuleTemplate() (*ScheduledAlertRuleTemplate, bool)

AsScheduledAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MicrosoftSecurityIncidentCreationAlertRuleTemplate.

func (MicrosoftSecurityIncidentCreationAlertRuleTemplate) MarshalJSON Uses

func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for MicrosoftSecurityIncidentCreationAlertRuleTemplate.

func (*MicrosoftSecurityIncidentCreationAlertRuleTemplate) UnmarshalJSON Uses

func (msicart *MicrosoftSecurityIncidentCreationAlertRuleTemplate) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for MicrosoftSecurityIncidentCreationAlertRuleTemplate struct.

type MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties Uses

type MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties struct {
    // AlertRulesCreatedByTemplateCount - the number of alert rules that were created by this template
    AlertRulesCreatedByTemplateCount *int32 `json:"alertRulesCreatedByTemplateCount,omitempty"`
    // CreatedDateUTC - READ-ONLY; The time that this alert rule template has been added.
    CreatedDateUTC *date.Time `json:"createdDateUTC,omitempty"`
    // Description - The description of the alert rule template.
    Description *string `json:"description,omitempty"`
    // DisplayName - The display name for alert rule template.
    DisplayName *string `json:"displayName,omitempty"`
    // RequiredDataConnectors - The required data connectors for this template
    RequiredDataConnectors *[]AlertRuleTemplateDataSource `json:"requiredDataConnectors,omitempty"`
    // Status - The alert rule template status. Possible values include: 'Installed', 'Available', 'NotAvailable'
    Status TemplateStatus `json:"status,omitempty"`
    // DisplayNamesFilter - the alerts' displayNames on which the cases will be generated
    DisplayNamesFilter *[]string `json:"displayNamesFilter,omitempty"`
    // DisplayNamesExcludeFilter - the alerts' displayNames on which the cases will not be generated
    DisplayNamesExcludeFilter *[]string `json:"displayNamesExcludeFilter,omitempty"`
    // ProductFilter - The alerts' productName on which the cases will be generated. Possible values include: 'MicrosoftCloudAppSecurity', 'AzureSecurityCenter', 'AzureAdvancedThreatProtection', 'AzureActiveDirectoryIdentityProtection', 'AzureSecurityCenterforIoT'
    ProductFilter MicrosoftSecurityProductName `json:"productFilter,omitempty"`
    // SeveritiesFilter - the alerts' severities on which the cases will be generated
    SeveritiesFilter *[]AlertSeverity `json:"severitiesFilter,omitempty"`
}

MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties microsoftSecurityIncidentCreation rule template properties

func (MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties) MarshalJSON Uses

func (msicartp MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties.

type MicrosoftSecurityProductName Uses

type MicrosoftSecurityProductName string

MicrosoftSecurityProductName enumerates the values for microsoft security product name.

const (
    // AzureActiveDirectoryIdentityProtection ...
    AzureActiveDirectoryIdentityProtection MicrosoftSecurityProductName = "Azure Active Directory Identity Protection"
    // AzureAdvancedThreatProtection ...
    AzureAdvancedThreatProtection MicrosoftSecurityProductName = "Azure Advanced Threat Protection"
    // AzureSecurityCenter ...
    AzureSecurityCenter MicrosoftSecurityProductName = "Azure Security Center"
    // AzureSecurityCenterforIoT ...
    AzureSecurityCenterforIoT MicrosoftSecurityProductName = "Azure Security Center for IoT"
    // MicrosoftCloudAppSecurity ...
    MicrosoftCloudAppSecurity MicrosoftSecurityProductName = "Microsoft Cloud App Security"
)

func PossibleMicrosoftSecurityProductNameValues Uses

func PossibleMicrosoftSecurityProductNameValues() []MicrosoftSecurityProductName

PossibleMicrosoftSecurityProductNameValues returns an array of possible values for the MicrosoftSecurityProductName const type.

type OfficeConsent Uses

type OfficeConsent struct {
    // OfficeConsentProperties - Office consent properties
    *OfficeConsentProperties `json:"properties,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
}

OfficeConsent consent for Office365 tenant that already made.

func (OfficeConsent) MarshalJSON Uses

func (oc OfficeConsent) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for OfficeConsent.

func (*OfficeConsent) UnmarshalJSON Uses

func (oc *OfficeConsent) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for OfficeConsent struct.

type OfficeConsentList Uses

type OfficeConsentList struct {
    // NextLink - READ-ONLY; URL to fetch the next set of office consents.
    NextLink *string `json:"nextLink,omitempty"`
    // Value - Array of the consents.
    Value *[]OfficeConsent `json:"value,omitempty"`
}

OfficeConsentList list of all the office365 consents.

func (OfficeConsentList) MarshalJSON Uses

func (ocl OfficeConsentList) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for OfficeConsentList.

type OfficeConsentProperties Uses

type OfficeConsentProperties struct {
    // TenantID - The tenantId of the Office365 with the consent.
    TenantID *string `json:"tenantId,omitempty"`
    // TenantName - READ-ONLY; The tenant name of the Office365 with the consent.
    TenantName *string `json:"tenantName,omitempty"`
}

OfficeConsentProperties consent property bag.

func (OfficeConsentProperties) MarshalJSON Uses

func (ocp OfficeConsentProperties) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for OfficeConsentProperties.

type OfficeDataConnector Uses

type OfficeDataConnector struct {
    // OfficeDataConnectorProperties - Office data connector properties.
    *OfficeDataConnectorProperties `json:"properties,omitempty"`
    // Kind - Possible values include: 'KindDataConnector', 'KindAzureActiveDirectory', 'KindAzureAdvancedThreatProtection', 'KindAzureSecurityCenter', 'KindAmazonWebServicesCloudTrail', 'KindMicrosoftCloudAppSecurity', 'KindMicrosoftDefenderAdvancedThreatProtection', 'KindOffice365', 'KindThreatIntelligence'
    Kind KindBasicDataConnector `json:"kind,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
}

OfficeDataConnector represents office data connector.

func (OfficeDataConnector) AsAADDataConnector Uses

func (odc OfficeDataConnector) AsAADDataConnector() (*AADDataConnector, bool)

AsAADDataConnector is the BasicDataConnector implementation for OfficeDataConnector.

func (OfficeDataConnector) AsAATPDataConnector Uses

func (odc OfficeDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool)

AsAATPDataConnector is the BasicDataConnector implementation for OfficeDataConnector.

func (OfficeDataConnector) AsASCDataConnector Uses

func (odc OfficeDataConnector) AsASCDataConnector() (*ASCDataConnector, bool)

AsASCDataConnector is the BasicDataConnector implementation for OfficeDataConnector.

func (OfficeDataConnector) AsAwsCloudTrailDataConnector Uses

func (odc OfficeDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool)

AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for OfficeDataConnector.

func (OfficeDataConnector) AsBasicDataConnector Uses

func (odc OfficeDataConnector) AsBasicDataConnector() (BasicDataConnector, bool)

AsBasicDataConnector is the BasicDataConnector implementation for OfficeDataConnector.

func (OfficeDataConnector) AsDataConnector Uses

func (odc OfficeDataConnector) AsDataConnector() (*DataConnector, bool)

AsDataConnector is the BasicDataConnector implementation for OfficeDataConnector.

func (OfficeDataConnector) AsMCASDataConnector Uses

func (odc OfficeDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool)

AsMCASDataConnector is the BasicDataConnector implementation for OfficeDataConnector.

func (OfficeDataConnector) AsMDATPDataConnector Uses

func (odc OfficeDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool)

AsMDATPDataConnector is the BasicDataConnector implementation for OfficeDataConnector.

func (OfficeDataConnector) AsOfficeDataConnector Uses

func (odc OfficeDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool)

AsOfficeDataConnector is the BasicDataConnector implementation for OfficeDataConnector.

func (OfficeDataConnector) AsTIDataConnector Uses

func (odc OfficeDataConnector) AsTIDataConnector() (*TIDataConnector, bool)

AsTIDataConnector is the BasicDataConnector implementation for OfficeDataConnector.

func (OfficeDataConnector) MarshalJSON Uses

func (odc OfficeDataConnector) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for OfficeDataConnector.

func (*OfficeDataConnector) UnmarshalJSON Uses

func (odc *OfficeDataConnector) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for OfficeDataConnector struct.

type OfficeDataConnectorDataTypes Uses

type OfficeDataConnectorDataTypes struct {
    // Exchange - Exchange data type connection.
    Exchange *OfficeDataConnectorDataTypesExchange `json:"exchange,omitempty"`
    // SharePoint - SharePoint data type connection.
    SharePoint *OfficeDataConnectorDataTypesSharePoint `json:"sharePoint,omitempty"`
}

OfficeDataConnectorDataTypes the available data types for office data connector.

type OfficeDataConnectorDataTypesExchange Uses

type OfficeDataConnectorDataTypesExchange struct {
    // State - Describe whether this data type connection is enabled or not. Possible values include: 'Enabled', 'Disabled'
    State DataTypeState `json:"state,omitempty"`
}

OfficeDataConnectorDataTypesExchange exchange data type connection.

type OfficeDataConnectorDataTypesSharePoint Uses

type OfficeDataConnectorDataTypesSharePoint struct {
    // State - Describe whether this data type connection is enabled or not. Possible values include: 'Enabled', 'Disabled'
    State DataTypeState `json:"state,omitempty"`
}

OfficeDataConnectorDataTypesSharePoint sharePoint data type connection.

type OfficeDataConnectorProperties Uses

type OfficeDataConnectorProperties struct {
    // TenantID - The tenant id to connect to, and get the data from.
    TenantID *string `json:"tenantId,omitempty"`
    // DataTypes - The available data types for the connector.
    DataTypes *OfficeDataConnectorDataTypes `json:"dataTypes,omitempty"`
}

OfficeDataConnectorProperties office data connector properties.

type Operation Uses

type Operation struct {
    // Display - Properties of the operation
    Display *OperationDisplay `json:"display,omitempty"`
    // Name - Name of the operation
    Name *string `json:"name,omitempty"`
}

Operation operation provided by provider

type OperationDisplay Uses

type OperationDisplay struct {
    // Description - Description of the operation
    Description *string `json:"description,omitempty"`
    // Operation - Operation name
    Operation *string `json:"operation,omitempty"`
    // Provider - Provider name
    Provider *string `json:"provider,omitempty"`
    // Resource - Resource name
    Resource *string `json:"resource,omitempty"`
}

OperationDisplay properties of the operation

type OperationsClient Uses

type OperationsClient struct {
    BaseClient
}

OperationsClient is the API spec for Microsoft.SecurityInsights (Azure Security Insights) resource provider

func NewOperationsClient Uses

func NewOperationsClient(subscriptionID string) OperationsClient

NewOperationsClient creates an instance of the OperationsClient client.

func NewOperationsClientWithBaseURI Uses

func NewOperationsClientWithBaseURI(baseURI string, subscriptionID string) OperationsClient

NewOperationsClientWithBaseURI creates an instance of the OperationsClient client using a custom endpoint. Use this when interacting with an Azure cloud that uses a non-standard base URI (sovereign clouds, Azure stack).

func (OperationsClient) List Uses

func (client OperationsClient) List(ctx context.Context) (result OperationsListPage, err error)

List lists all operations available Azure Security Insights Resource Provider.

func (OperationsClient) ListComplete Uses

func (client OperationsClient) ListComplete(ctx context.Context) (result OperationsListIterator, err error)

ListComplete enumerates all values, automatically crossing page boundaries as required.

func (OperationsClient) ListPreparer Uses

func (client OperationsClient) ListPreparer(ctx context.Context) (*http.Request, error)

ListPreparer prepares the List request.

func (OperationsClient) ListResponder Uses

func (client OperationsClient) ListResponder(resp *http.Response) (result OperationsList, err error)

ListResponder handles the response to the List request. The method always closes the http.Response Body.

func (OperationsClient) ListSender Uses

func (client OperationsClient) ListSender(req *http.Request) (*http.Response, error)

ListSender sends the List request. The method will close the http.Response Body if it receives an error.

type OperationsList Uses

type OperationsList struct {
    autorest.Response `json:"-"`
    // NextLink - URL to fetch the next set of operations.
    NextLink *string `json:"nextLink,omitempty"`
    // Value - Array of operations
    Value *[]Operation `json:"value,omitempty"`
}

OperationsList lists the operations available in the SecurityInsights RP.

func (OperationsList) IsEmpty Uses

func (ol OperationsList) IsEmpty() bool

IsEmpty returns true if the ListResult contains no values.

type OperationsListIterator Uses

type OperationsListIterator struct {
    // contains filtered or unexported fields
}

OperationsListIterator provides access to a complete listing of Operation values.

func NewOperationsListIterator Uses

func NewOperationsListIterator(page OperationsListPage) OperationsListIterator

Creates a new instance of the OperationsListIterator type.

func (*OperationsListIterator) Next Uses

func (iter *OperationsListIterator) Next() error

Next advances to the next value. If there was an error making the request the iterator does not advance and the error is returned. Deprecated: Use NextWithContext() instead.

func (*OperationsListIterator) NextWithContext Uses

func (iter *OperationsListIterator) NextWithContext(ctx context.Context) (err error)

NextWithContext advances to the next value. If there was an error making the request the iterator does not advance and the error is returned.

func (OperationsListIterator) NotDone Uses

func (iter OperationsListIterator) NotDone() bool

NotDone returns true if the enumeration should be started or is not yet complete.

func (OperationsListIterator) Response Uses

func (iter OperationsListIterator) Response() OperationsList

Response returns the raw server response from the last page request.

func (OperationsListIterator) Value Uses

func (iter OperationsListIterator) Value() Operation

Value returns the current value or a zero-initialized value if the iterator has advanced beyond the end of the collection.

type OperationsListPage Uses

type OperationsListPage struct {
    // contains filtered or unexported fields
}

OperationsListPage contains a page of Operation values.

func NewOperationsListPage Uses

func NewOperationsListPage(cur OperationsList, getNextPage func(context.Context, OperationsList) (OperationsList, error)) OperationsListPage

Creates a new instance of the OperationsListPage type.

func (*OperationsListPage) Next Uses

func (page *OperationsListPage) Next() error

Next advances to the next page of values. If there was an error making the request the page does not advance and the error is returned. Deprecated: Use NextWithContext() instead.

func (*OperationsListPage) NextWithContext Uses

func (page *OperationsListPage) NextWithContext(ctx context.Context) (err error)

NextWithContext advances to the next page of values. If there was an error making the request the page does not advance and the error is returned.

func (OperationsListPage) NotDone Uses

func (page OperationsListPage) NotDone() bool

NotDone returns true if the page enumeration should be started or is not yet complete.

func (OperationsListPage) Response Uses

func (page OperationsListPage) Response() OperationsList

Response returns the raw server response from the last page request.

func (OperationsListPage) Values Uses

func (page OperationsListPage) Values() []Operation

Values returns the slice of values for the current page or nil if there are no values.

type Resource Uses

type Resource struct {
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
}

Resource an azure resource object

type ResourceWithEtag Uses

type ResourceWithEtag struct {
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
}

ResourceWithEtag an azure resource object with an Etag property

func (ResourceWithEtag) MarshalJSON Uses

func (rwe ResourceWithEtag) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for ResourceWithEtag.

type ScheduledAlertRule Uses

type ScheduledAlertRule struct {
    // ScheduledAlertRuleProperties - Scheduled alert rule properties
    *ScheduledAlertRuleProperties `json:"properties,omitempty"`
    // Kind - Possible values include: 'KindAlertRule', 'KindFusion', 'KindMicrosoftSecurityIncidentCreation', 'KindScheduled'
    Kind Kind `json:"kind,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
}

ScheduledAlertRule represents scheduled alert rule.

func (ScheduledAlertRule) AsAlertRule Uses

func (sar ScheduledAlertRule) AsAlertRule() (*AlertRule, bool)

AsAlertRule is the BasicAlertRule implementation for ScheduledAlertRule.

func (ScheduledAlertRule) AsBasicAlertRule Uses

func (sar ScheduledAlertRule) AsBasicAlertRule() (BasicAlertRule, bool)

AsBasicAlertRule is the BasicAlertRule implementation for ScheduledAlertRule.

func (ScheduledAlertRule) AsFusionAlertRule Uses

func (sar ScheduledAlertRule) AsFusionAlertRule() (*FusionAlertRule, bool)

AsFusionAlertRule is the BasicAlertRule implementation for ScheduledAlertRule.

func (ScheduledAlertRule) AsMicrosoftSecurityIncidentCreationAlertRule Uses

func (sar ScheduledAlertRule) AsMicrosoftSecurityIncidentCreationAlertRule() (*MicrosoftSecurityIncidentCreationAlertRule, bool)

AsMicrosoftSecurityIncidentCreationAlertRule is the BasicAlertRule implementation for ScheduledAlertRule.

func (ScheduledAlertRule) AsScheduledAlertRule Uses

func (sar ScheduledAlertRule) AsScheduledAlertRule() (*ScheduledAlertRule, bool)

AsScheduledAlertRule is the BasicAlertRule implementation for ScheduledAlertRule.

func (ScheduledAlertRule) MarshalJSON Uses

func (sar ScheduledAlertRule) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for ScheduledAlertRule.

func (*ScheduledAlertRule) UnmarshalJSON Uses

func (sar *ScheduledAlertRule) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for ScheduledAlertRule struct.

type ScheduledAlertRuleCommonProperties Uses

type ScheduledAlertRuleCommonProperties struct {
    // Query - The query that creates alerts for this rule.
    Query *string `json:"query,omitempty"`
    // QueryFrequency - The frequency (in ISO 8601 duration format) for this alert rule to run.
    QueryFrequency *string `json:"queryFrequency,omitempty"`
    // QueryPeriod - The period (in ISO 8601 duration format) that this alert rule looks at.
    QueryPeriod *string `json:"queryPeriod,omitempty"`
    // Severity - The severity for alerts created by this alert rule. Possible values include: 'High', 'Medium', 'Low', 'Informational'
    Severity AlertSeverity `json:"severity,omitempty"`
    // TriggerOperator - The operation against the threshold that triggers alert rule. Possible values include: 'GreaterThan', 'LessThan', 'Equal', 'NotEqual'
    TriggerOperator TriggerOperator `json:"triggerOperator,omitempty"`
    // TriggerThreshold - The threshold triggers this alert rule.
    TriggerThreshold *int32 `json:"triggerThreshold,omitempty"`
}

ScheduledAlertRuleCommonProperties schedule alert rule template property bag.

type ScheduledAlertRuleProperties Uses

type ScheduledAlertRuleProperties struct {
    // AlertRuleTemplateName - The Name of the alert rule template used to create this rule.
    AlertRuleTemplateName *string `json:"alertRuleTemplateName,omitempty"`
    // Description - The description of the alert rule.
    Description *string `json:"description,omitempty"`
    // DisplayName - The display name for alerts created by this alert rule.
    DisplayName *string `json:"displayName,omitempty"`
    // Enabled - Determines whether this alert rule is enabled or disabled.
    Enabled *bool `json:"enabled,omitempty"`
    // LastModifiedUtc - READ-ONLY; The last time that this alert rule has been modified.
    LastModifiedUtc *date.Time `json:"lastModifiedUtc,omitempty"`
    // SuppressionDuration - The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.
    SuppressionDuration *string `json:"suppressionDuration,omitempty"`
    // SuppressionEnabled - Determines whether the suppression for this alert rule is enabled or disabled.
    SuppressionEnabled *bool `json:"suppressionEnabled,omitempty"`
    // Tactics - The tactics of the alert rule
    Tactics *[]AttackTactic `json:"tactics,omitempty"`
    // Query - The query that creates alerts for this rule.
    Query *string `json:"query,omitempty"`
    // QueryFrequency - The frequency (in ISO 8601 duration format) for this alert rule to run.
    QueryFrequency *string `json:"queryFrequency,omitempty"`
    // QueryPeriod - The period (in ISO 8601 duration format) that this alert rule looks at.
    QueryPeriod *string `json:"queryPeriod,omitempty"`
    // Severity - The severity for alerts created by this alert rule. Possible values include: 'High', 'Medium', 'Low', 'Informational'
    Severity AlertSeverity `json:"severity,omitempty"`
    // TriggerOperator - The operation against the threshold that triggers alert rule. Possible values include: 'GreaterThan', 'LessThan', 'Equal', 'NotEqual'
    TriggerOperator TriggerOperator `json:"triggerOperator,omitempty"`
    // TriggerThreshold - The threshold triggers this alert rule.
    TriggerThreshold *int32 `json:"triggerThreshold,omitempty"`
}

ScheduledAlertRuleProperties scheduled alert rule base property bag.

func (ScheduledAlertRuleProperties) MarshalJSON Uses

func (sarp ScheduledAlertRuleProperties) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for ScheduledAlertRuleProperties.

type ScheduledAlertRuleTemplate Uses

type ScheduledAlertRuleTemplate struct {
    // ScheduledAlertRuleTemplateProperties - Scheduled alert rule template properties
    *ScheduledAlertRuleTemplateProperties `json:"properties,omitempty"`
    // Kind - Possible values include: 'KindBasicAlertRuleTemplateKindAlertRuleTemplate', 'KindBasicAlertRuleTemplateKindFusion', 'KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleTemplateKindScheduled'
    Kind KindBasicAlertRuleTemplate `json:"kind,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
}

ScheduledAlertRuleTemplate represents scheduled alert rule template.

func (ScheduledAlertRuleTemplate) AsAlertRuleTemplate Uses

func (sart ScheduledAlertRuleTemplate) AsAlertRuleTemplate() (*AlertRuleTemplate, bool)

AsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ScheduledAlertRuleTemplate.

func (ScheduledAlertRuleTemplate) AsBasicAlertRuleTemplate Uses

func (sart ScheduledAlertRuleTemplate) AsBasicAlertRuleTemplate() (BasicAlertRuleTemplate, bool)

AsBasicAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ScheduledAlertRuleTemplate.

func (ScheduledAlertRuleTemplate) AsFusionAlertRuleTemplate Uses

func (sart ScheduledAlertRuleTemplate) AsFusionAlertRuleTemplate() (*FusionAlertRuleTemplate, bool)

AsFusionAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ScheduledAlertRuleTemplate.

func (ScheduledAlertRuleTemplate) AsMicrosoftSecurityIncidentCreationAlertRuleTemplate Uses

func (sart ScheduledAlertRuleTemplate) AsMicrosoftSecurityIncidentCreationAlertRuleTemplate() (*MicrosoftSecurityIncidentCreationAlertRuleTemplate, bool)

AsMicrosoftSecurityIncidentCreationAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ScheduledAlertRuleTemplate.

func (ScheduledAlertRuleTemplate) AsScheduledAlertRuleTemplate Uses

func (sart ScheduledAlertRuleTemplate) AsScheduledAlertRuleTemplate() (*ScheduledAlertRuleTemplate, bool)

AsScheduledAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ScheduledAlertRuleTemplate.

func (ScheduledAlertRuleTemplate) MarshalJSON Uses

func (sart ScheduledAlertRuleTemplate) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for ScheduledAlertRuleTemplate.

func (*ScheduledAlertRuleTemplate) UnmarshalJSON Uses

func (sart *ScheduledAlertRuleTemplate) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for ScheduledAlertRuleTemplate struct.

type ScheduledAlertRuleTemplateProperties Uses

type ScheduledAlertRuleTemplateProperties struct {
    // AlertRulesCreatedByTemplateCount - the number of alert rules that were created by this template
    AlertRulesCreatedByTemplateCount *int32 `json:"alertRulesCreatedByTemplateCount,omitempty"`
    // CreatedDateUTC - READ-ONLY; The time that this alert rule template has been added.
    CreatedDateUTC *date.Time `json:"createdDateUTC,omitempty"`
    // Description - The description of the alert rule template.
    Description *string `json:"description,omitempty"`
    // DisplayName - The display name for alert rule template.
    DisplayName *string `json:"displayName,omitempty"`
    // RequiredDataConnectors - The required data connectors for this template
    RequiredDataConnectors *[]AlertRuleTemplateDataSource `json:"requiredDataConnectors,omitempty"`
    // Status - The alert rule template status. Possible values include: 'Installed', 'Available', 'NotAvailable'
    Status TemplateStatus `json:"status,omitempty"`
    // Query - The query that creates alerts for this rule.
    Query *string `json:"query,omitempty"`
    // QueryFrequency - The frequency (in ISO 8601 duration format) for this alert rule to run.
    QueryFrequency *string `json:"queryFrequency,omitempty"`
    // QueryPeriod - The period (in ISO 8601 duration format) that this alert rule looks at.
    QueryPeriod *string `json:"queryPeriod,omitempty"`
    // Severity - The severity for alerts created by this alert rule. Possible values include: 'High', 'Medium', 'Low', 'Informational'
    Severity AlertSeverity `json:"severity,omitempty"`
    // TriggerOperator - The operation against the threshold that triggers alert rule. Possible values include: 'GreaterThan', 'LessThan', 'Equal', 'NotEqual'
    TriggerOperator TriggerOperator `json:"triggerOperator,omitempty"`
    // TriggerThreshold - The threshold triggers this alert rule.
    TriggerThreshold *int32 `json:"triggerThreshold,omitempty"`
    // Tactics - The tactics of the alert rule template
    Tactics *[]AttackTactic `json:"tactics,omitempty"`
}

ScheduledAlertRuleTemplateProperties scheduled alert rule template properties

func (ScheduledAlertRuleTemplateProperties) MarshalJSON Uses

func (sartp ScheduledAlertRuleTemplateProperties) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for ScheduledAlertRuleTemplateProperties.

type SettingKind Uses

type SettingKind string

SettingKind enumerates the values for setting kind.

const (
    // SettingKindToggleSettings ...
    SettingKindToggleSettings SettingKind = "ToggleSettings"
    // SettingKindUebaSettings ...
    SettingKindUebaSettings SettingKind = "UebaSettings"
)

func PossibleSettingKindValues Uses

func PossibleSettingKindValues() []SettingKind

PossibleSettingKindValues returns an array of possible values for the SettingKind const type.

type Settings Uses

type Settings struct {
    // Kind - Possible values include: 'KindSettings', 'KindToggleSettings', 'KindUebaSettings'
    Kind KindBasicSettings `json:"kind,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
}

Settings the Settings.

func (Settings) AsBasicSettings Uses

func (s Settings) AsBasicSettings() (BasicSettings, bool)

AsBasicSettings is the BasicSettings implementation for Settings.

func (Settings) AsSettings Uses

func (s Settings) AsSettings() (*Settings, bool)

AsSettings is the BasicSettings implementation for Settings.

func (Settings) AsToggleSettings Uses

func (s Settings) AsToggleSettings() (*ToggleSettings, bool)

AsToggleSettings is the BasicSettings implementation for Settings.

func (Settings) AsUebaSettings Uses

func (s Settings) AsUebaSettings() (*UebaSettings, bool)

AsUebaSettings is the BasicSettings implementation for Settings.

func (Settings) MarshalJSON Uses

func (s Settings) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for Settings.

type StatusInMcas Uses

type StatusInMcas string

StatusInMcas enumerates the values for status in mcas.

const (
    // StatusInMcasDisabled ...
    StatusInMcasDisabled StatusInMcas = "Disabled"
    // StatusInMcasEnabled ...
    StatusInMcasEnabled StatusInMcas = "Enabled"
)

func PossibleStatusInMcasValues Uses

func PossibleStatusInMcasValues() []StatusInMcas

PossibleStatusInMcasValues returns an array of possible values for the StatusInMcas const type.

type TIDataConnector Uses

type TIDataConnector struct {
    // TIDataConnectorProperties - TI (Threat Intelligence) data connector properties.
    *TIDataConnectorProperties `json:"properties,omitempty"`
    // Kind - Possible values include: 'KindDataConnector', 'KindAzureActiveDirectory', 'KindAzureAdvancedThreatProtection', 'KindAzureSecurityCenter', 'KindAmazonWebServicesCloudTrail', 'KindMicrosoftCloudAppSecurity', 'KindMicrosoftDefenderAdvancedThreatProtection', 'KindOffice365', 'KindThreatIntelligence'
    Kind KindBasicDataConnector `json:"kind,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
}

TIDataConnector represents threat intelligence data connector.

func (TIDataConnector) AsAADDataConnector Uses

func (tdc TIDataConnector) AsAADDataConnector() (*AADDataConnector, bool)

AsAADDataConnector is the BasicDataConnector implementation for TIDataConnector.

func (TIDataConnector) AsAATPDataConnector Uses

func (tdc TIDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool)

AsAATPDataConnector is the BasicDataConnector implementation for TIDataConnector.

func (TIDataConnector) AsASCDataConnector Uses

func (tdc TIDataConnector) AsASCDataConnector() (*ASCDataConnector, bool)

AsASCDataConnector is the BasicDataConnector implementation for TIDataConnector.

func (TIDataConnector) AsAwsCloudTrailDataConnector Uses

func (tdc TIDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool)

AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for TIDataConnector.

func (TIDataConnector) AsBasicDataConnector Uses

func (tdc TIDataConnector) AsBasicDataConnector() (BasicDataConnector, bool)

AsBasicDataConnector is the BasicDataConnector implementation for TIDataConnector.

func (TIDataConnector) AsDataConnector Uses

func (tdc TIDataConnector) AsDataConnector() (*DataConnector, bool)

AsDataConnector is the BasicDataConnector implementation for TIDataConnector.

func (TIDataConnector) AsMCASDataConnector Uses

func (tdc TIDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool)

AsMCASDataConnector is the BasicDataConnector implementation for TIDataConnector.

func (TIDataConnector) AsMDATPDataConnector Uses

func (tdc TIDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool)

AsMDATPDataConnector is the BasicDataConnector implementation for TIDataConnector.

func (TIDataConnector) AsOfficeDataConnector Uses

func (tdc TIDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool)

AsOfficeDataConnector is the BasicDataConnector implementation for TIDataConnector.

func (TIDataConnector) AsTIDataConnector Uses

func (tdc TIDataConnector) AsTIDataConnector() (*TIDataConnector, bool)

AsTIDataConnector is the BasicDataConnector implementation for TIDataConnector.

func (TIDataConnector) MarshalJSON Uses

func (tdc TIDataConnector) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for TIDataConnector.

func (*TIDataConnector) UnmarshalJSON Uses

func (tdc *TIDataConnector) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for TIDataConnector struct.

type TIDataConnectorDataTypes Uses

type TIDataConnectorDataTypes struct {
    // Indicators - Data type for indicators connection.
    Indicators *TIDataConnectorDataTypesIndicators `json:"indicators,omitempty"`
}

TIDataConnectorDataTypes the available data types for TI (Threat Intelligence) data connector.

type TIDataConnectorDataTypesIndicators Uses

type TIDataConnectorDataTypesIndicators struct {
    // State - Describe whether this data type connection is enabled or not. Possible values include: 'Enabled', 'Disabled'
    State DataTypeState `json:"state,omitempty"`
}

TIDataConnectorDataTypesIndicators data type for indicators connection.

type TIDataConnectorProperties Uses

type TIDataConnectorProperties struct {
    // TenantID - The tenant id to connect to, and get the data from.
    TenantID *string `json:"tenantId,omitempty"`
    // DataTypes - The available data types for the connector.
    DataTypes *TIDataConnectorDataTypes `json:"dataTypes,omitempty"`
}

TIDataConnectorProperties TI (Threat Intelligence) data connector properties.

type TemplateStatus Uses

type TemplateStatus string

TemplateStatus enumerates the values for template status.

const (
    // Available Alert rule template is available.
    Available TemplateStatus = "Available"
    // Installed Alert rule template installed. and can not use more then once
    Installed TemplateStatus = "Installed"
    // NotAvailable Alert rule template is not available
    NotAvailable TemplateStatus = "NotAvailable"
)

func PossibleTemplateStatusValues Uses

func PossibleTemplateStatusValues() []TemplateStatus

PossibleTemplateStatusValues returns an array of possible values for the TemplateStatus const type.

type ThreatIntelligence Uses

type ThreatIntelligence struct {
    // Confidence - READ-ONLY; Confidence (must be between 0 and 1)
    Confidence *float64 `json:"confidence,omitempty"`
    // ProviderName - READ-ONLY; Name of the provider from whom this Threat Intelligence information was received
    ProviderName *string `json:"providerName,omitempty"`
    // ReportLink - READ-ONLY; Report link
    ReportLink *string `json:"reportLink,omitempty"`
    // ThreatDescription - READ-ONLY; Threat description (free text)
    ThreatDescription *string `json:"threatDescription,omitempty"`
    // ThreatName - READ-ONLY; Threat name (e.g. "Jedobot malware")
    ThreatName *string `json:"threatName,omitempty"`
    // ThreatType - READ-ONLY; Threat type (e.g. "Botnet")
    ThreatType *string `json:"threatType,omitempty"`
}

ThreatIntelligence threatIntelligence property bag.

type ToggleSettings Uses

type ToggleSettings struct {
    // ToggleSettingsProperties - toggle properties
    *ToggleSettingsProperties `json:"properties,omitempty"`
    // Kind - Possible values include: 'KindSettings', 'KindToggleSettings', 'KindUebaSettings'
    Kind KindBasicSettings `json:"kind,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
}

ToggleSettings settings with single toggle.

func (ToggleSettings) AsBasicSettings Uses

func (ts ToggleSettings) AsBasicSettings() (BasicSettings, bool)

AsBasicSettings is the BasicSettings implementation for ToggleSettings.

func (ToggleSettings) AsSettings Uses

func (ts ToggleSettings) AsSettings() (*Settings, bool)

AsSettings is the BasicSettings implementation for ToggleSettings.

func (ToggleSettings) AsToggleSettings Uses

func (ts ToggleSettings) AsToggleSettings() (*ToggleSettings, bool)

AsToggleSettings is the BasicSettings implementation for ToggleSettings.

func (ToggleSettings) AsUebaSettings Uses

func (ts ToggleSettings) AsUebaSettings() (*UebaSettings, bool)

AsUebaSettings is the BasicSettings implementation for ToggleSettings.

func (ToggleSettings) MarshalJSON Uses

func (ts ToggleSettings) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for ToggleSettings.

func (*ToggleSettings) UnmarshalJSON Uses

func (ts *ToggleSettings) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for ToggleSettings struct.

type ToggleSettingsProperties Uses

type ToggleSettingsProperties struct {
    // IsEnabled - Determines whether the setting is enable or disabled.
    IsEnabled *bool `json:"isEnabled,omitempty"`
}

ToggleSettingsProperties toggle property bag.

type TriggerOperator Uses

type TriggerOperator string

TriggerOperator enumerates the values for trigger operator.

const (
    // Equal ...
    Equal TriggerOperator = "Equal"
    // GreaterThan ...
    GreaterThan TriggerOperator = "GreaterThan"
    // LessThan ...
    LessThan TriggerOperator = "LessThan"
    // NotEqual ...
    NotEqual TriggerOperator = "NotEqual"
)

func PossibleTriggerOperatorValues Uses

func PossibleTriggerOperatorValues() []TriggerOperator

PossibleTriggerOperatorValues returns an array of possible values for the TriggerOperator const type.

type UebaSettings Uses

type UebaSettings struct {
    // UebaSettingsProperties - User and Entity Behavior Analytics settings properties
    *UebaSettingsProperties `json:"properties,omitempty"`
    // Kind - Possible values include: 'KindSettings', 'KindToggleSettings', 'KindUebaSettings'
    Kind KindBasicSettings `json:"kind,omitempty"`
    // ID - READ-ONLY; Azure resource Id
    ID  *string `json:"id,omitempty"`
    // Name - READ-ONLY; Azure resource name
    Name *string `json:"name,omitempty"`
    // Type - READ-ONLY; Azure resource type
    Type *string `json:"type,omitempty"`
    // Etag - Etag of the azure resource
    Etag *string `json:"etag,omitempty"`
}

UebaSettings represents settings for User and Entity Behavior Analytics enablement.

func (UebaSettings) AsBasicSettings Uses

func (us UebaSettings) AsBasicSettings() (BasicSettings, bool)

AsBasicSettings is the BasicSettings implementation for UebaSettings.

func (UebaSettings) AsSettings Uses

func (us UebaSettings) AsSettings() (*Settings, bool)

AsSettings is the BasicSettings implementation for UebaSettings.

func (UebaSettings) AsToggleSettings Uses

func (us UebaSettings) AsToggleSettings() (*ToggleSettings, bool)

AsToggleSettings is the BasicSettings implementation for UebaSettings.

func (UebaSettings) AsUebaSettings Uses

func (us UebaSettings) AsUebaSettings() (*UebaSettings, bool)

AsUebaSettings is the BasicSettings implementation for UebaSettings.

func (UebaSettings) MarshalJSON Uses

func (us UebaSettings) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for UebaSettings.

func (*UebaSettings) UnmarshalJSON Uses

func (us *UebaSettings) UnmarshalJSON(body []byte) error

UnmarshalJSON is the custom unmarshaler for UebaSettings struct.

type UebaSettingsProperties Uses

type UebaSettingsProperties struct {
    // AtpLicenseStatus - READ-ONLY; Determines whether the tenant has ATP (Advanced Threat Protection) license. Possible values include: 'LicenseStatusEnabled', 'LicenseStatusDisabled'
    AtpLicenseStatus LicenseStatus `json:"atpLicenseStatus,omitempty"`
    // IsEnabled - Determines whether User and Entity Behavior Analytics is enabled for this workspace.
    IsEnabled *bool `json:"isEnabled,omitempty"`
    // StatusInMcas - READ-ONLY; Determines whether User and Entity Behavior Analytics is enabled from MCAS (Microsoft Cloud App Security). Possible values include: 'StatusInMcasEnabled', 'StatusInMcasDisabled'
    StatusInMcas StatusInMcas `json:"statusInMcas,omitempty"`
}

UebaSettingsProperties user and Entity Behavior Analytics settings property bag.

func (UebaSettingsProperties) MarshalJSON Uses

func (usp UebaSettingsProperties) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for UebaSettingsProperties.

type UserInfo Uses

type UserInfo struct {
    // Email - READ-ONLY; The email of the user.
    Email *string `json:"email,omitempty"`
    // Name - READ-ONLY; The name of the user.
    Name *string `json:"name,omitempty"`
    // ObjectID - The object id of the user.
    ObjectID *uuid.UUID `json:"objectId,omitempty"`
}

UserInfo user information that made some action

func (UserInfo) MarshalJSON Uses

func (UI UserInfo) MarshalJSON() ([]byte, error)

MarshalJSON is the custom marshaler for UserInfo.

Directories

PathSynopsis
securityinsightapi

Package securityinsight imports 11 packages (graph) and is imported by 1 packages. Updated 2021-01-28. Refresh now. Tools for package owners.