iotSecuritySolutionAnalytics.json

{
  "swagger": "2.0",
  "info": {
    "title": "Security Center",
    "description": "API spec for Microsoft.Security (Azure Security Center) resource provider",
    "version": "2019-05-01-preview"
  },
  "host": "management.azure.com",
  "schemes": [
    "https"
  ],
  "consumes": [
    "application/json"
  ],
  "produces": [
    "application/json"
  ],
  "security": [
    {
      "azure_auth": [
        "user_impersonation"
      ]
    }
  ],
  "securityDefinitions": {
    "azure_auth": {
      "type": "oauth2",
      "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize",
      "flow": "implicit",
      "description": "Azure Active Directory OAuth2 Flow",
      "scopes": {
        "user_impersonation": "impersonate your user account"
      }
    }
  },
  "paths": {
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/iotSecuritySolutions/{solutionName}/Analytics": {
      "get": {
        "x-ms-examples": {
          "Get Security Solutions Analytics": {
            "$ref": "./examples/IoTSecuritySolutionsAnalytics/GetIoTSecuritySolutionsSecurityAnalytics_example.json"
          }
        },
        "tags": [
          "IoT Security Solutions Analytics"
        ],
        "description": "Security Analytics of a security solution",
        "operationId": "IoTSecuritySolutionsAnalytics_Get",
        "parameters": [
          {
            "$ref": "../../../common/v1/types.json#/parameters/ApiVersion"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/SubscriptionId"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/SolutionName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/IoTSecuritySolutionAnalyticsModel"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common/v1/types.json#/definitions/CloudError"
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/iotSecuritySolutions/{solutionName}/Analytics/AggregatedAlert/{aggregatedAlertName}": {
      "get": {
        "x-ms-examples": {
          "Get Security Solutions Analytics": {
            "$ref": "./examples/IoTSecuritySolutionsAnalytics/GetIoTSecuritySolutionsSecurityAggregatedAlert_example.json"
          }
        },
        "tags": [
          "IoT Security Solutions Analytics"
        ],
        "description": "Security Analytics of a security solution",
        "operationId": "IoTSecuritySolutionsAnalyticsAggregatedAlert_Get",
        "parameters": [
          {
            "$ref": "../../../common/v1/types.json#/parameters/ApiVersion"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/SubscriptionId"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/SolutionName"
          },
          {
            "$ref": "#/parameters/AggregatedAlertName"
          },
          {
            "name": "$top",
            "in": "query",
            "description": "The number of results to retrieve.",
            "required": false,
            "type": "integer"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/IoTSecurityAggregatedAlert"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common/v1/types.json#/definitions/CloudError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/iotSecuritySolutions/{solutionName}/Analytics/AggregatedAlert/{aggregatedAlertName}/Dismiss": {
      "put": {
        "x-ms-examples": {
          "Get Security Solutions Analytics": {
            "$ref": "./examples/IoTSecuritySolutionsAnalytics/PutIoTSecuritySolutionsSecurityAggregatedAlertDismiss_example.json"
          }
        },
        "tags": [
          "IoT Security Solutions Analytics"
        ],
        "description": "Security Analytics of a security solution",
        "operationId": "IoTSecuritySolutionsAnalyticsAggregatedAlertDismiss_Put",
        "parameters": [
          {
            "$ref": "../../../common/v1/types.json#/parameters/ApiVersion"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/SubscriptionId"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/SolutionName"
          },
          {
            "$ref": "#/parameters/AggregatedAlertName"
          }
        ],
        "responses": {
          "200": {
            "description": "Dismissed"
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common/v1/types.json#/definitions/CloudError"
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/iotSecuritySolutions/{solutionName}/Analytics/AggregatedRecommendation/{aggregatedRecommendationName}": {
      "get": {
        "x-ms-examples": {
          "Get Security Solutions Analytics": {
            "$ref": "./examples/IoTSecuritySolutionsAnalytics/GetIoTSecuritySolutionsSecurityRecommendation_example.json"
          }
        },
        "tags": [
          "IoT Security Solutions Analytics"
        ],
        "description": "Security Analytics of a security solution",
        "operationId": "IoTSecuritySolutionsAnalyticsRecommendation_Get",
        "parameters": [
          {
            "$ref": "../../../common/v1/types.json#/parameters/ApiVersion"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/SubscriptionId"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/SolutionName"
          },
          {
            "$ref": "#/parameters/AggregatedRecommendationName"
          },
          {
            "name": "$top",
            "in": "query",
            "description": "The number of results to retrieve.",
            "required": false,
            "type": "integer"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/IoTSecurityAggregatedRecommendation"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common/v1/types.json#/definitions/CloudError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    }
  },
  "definitions": {
    "IoTSeverityMetrics": {
      "type": "object",
      "description": "Severity metrics",
      "properties": {
        "high": {
          "type": "integer",
          "description": "count of high severity items"
        },
        "medium": {
          "type": "integer",
          "description": "count of medium severity items"
        },
        "low": {
          "type": "integer",
          "description": "count of low severity items"
        }
      }
    },
    "IoTSecuritySolutionAnalyticsModel": {
      "description": "Security Analytics of a security solution",
      "properties": {
        "metrics": {
          "type": "object", 
          "$ref": "#/definitions/IoTSeverityMetrics",
          "description": "Security Analytics of a security solution",
          "readOnly": true
        },
        "unhealthyDevices": {
          "type": "integer",
          "readOnly": true,
          "description": "number of unhealthy devices"
        },
        "devicesMetrics": {
          "description": "The list of devices metrics by the aggregated date.",
          "type": "array",
          "items": {
            "properties": {
              "date": {
                "type": "string",
                "format": "date-time",
                "description": "the date of the metrics"
              },
              "devicesMetrics": {
                "type": "object",
                "$ref": "#/definitions/IoTSeverityMetrics",
                "description": "devices alerts count by severity."
              }
            }
          }
        },
        "topAlertedDevices": {
          "description": "The list of devices with the most attacked.",
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/IoTSecurityDeviceAlerts",
            "description": "top 3 devices with most attacked alerts."
          }
        },
        "mostPrevalentDevices": {
          "description": "The list of most prevalent devices.",
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/IoTSecurityDeviceAlerts",
            "description": "most prevalent devices."
          }
        }
      }
    },
    "IoTSecurityAggregatedAlertList": {
      "description": "List of IoT aggregated security alerts",
      "required": [
        "value"
      ],
      "properties": {
        "value": {
          "type": "array",
          "description": "List of aggregated alerts data",
          "items": {
            "$ref": "#/definitions/IoTSecurityAggregatedAlert"
          }
        },
        "nextLink": {
          "readOnly": true,
          "type": "string",
          "description": "The URI to fetch the next page."
        }
      }
    },
    "IoTSecurityAggregatedRecommendationList": {
      "description": "List of IoT aggregated security recommendations",
      "required": [
        "value"
      ],
      "properties": {
        "value": {
          "type": "array",
          "description": "List of aggregated alerts data",
          "items": {
            "$ref": "#/definitions/IoTSecurityAggregatedRecommendation"
          }
        },
        "nextLink": {
          "readOnly": true,
          "type": "string",
          "description": "The URI to fetch the next page."
        }
      }
    },
    "IoTSecurityDeviceAlertsList": {
      "description": "List of devices with the count of raised alerts",
      "required": [
        "value"
      ],
      "properties": {
        "value": {
          "type": "array",
          "description": "List of aggregated alerts data",
          "items": {
            "$ref": "#/definitions/IoTSecurityDeviceAlerts"
          }
        },
        "nextLink": {
          "readOnly": true,
          "type": "string",
          "description": "The URI to fetch the next page."
        }
      }
    },
    "IoTSecurityAggregatedAlert": {
      "type": "object",
      "description": "Security Solution",
      "properties": {
        "alertType": {
          "readOnly": true,
          "type": "string",
          "description": "Name of the alert type"
        },
        "alertDisplayName": {
          "readOnly": true,
          "type": "string",
          "description": "Display name of the alert type"
        },
        "AggregatedDateUtc": {
          "readOnly": true,
          "type": "string",
          "format": "date",
          "description": "The date the incidents were detected by the vendor"
        },
        "vendorName": {
          "readOnly": true,
          "type": "string",
          "description": "Name of the vendor that discovered the incident"
        },
        "reportedSeverity": {
          "readOnly": true,
          "type": "string",
          "enum": [
            "Informational",
            "Low",
            "Medium",
            "High"
          ],
          "x-ms-enum": {
            "name": "reportedSeverity",
            "modelAsString": true,
            "values": [
              {
                "value": "Informational"
              },
              {
                "value": "Low"
              },
              {
                "value": "Medium"
              },
              {
                "value": "High"
              }
            ]
          },
          "description": "Estimated severity of this alert"
        },
        "remediationSteps": {
          "readOnly": true,
          "type": "string",
          "description": "Recommended steps for remediation"
        },
        "description": {
          "readOnly": true,
          "type": "string",
          "description": "Description of the incident and what it means"
        },
        "count": {
          "readOnly": true,
          "type": "integer",
          "description": "Occurrence number of the alert within the aggregated date"
        },
        "effectedResourceType": {
          "readOnly": true,
          "type": "string",
          "description": "Azure resource ID of the resource that got the alerts"
        },
        "systemSource": {
          "readOnly": true,
          "type": "string",
          "description": "The type of the alerted resource (Azure, Non-Azure)"
        },
        "actionTaken": {
          "readOnly": true,
          "type": "string",
          "description": "The action that was taken as a response to the alert (Active, Blocked etc.)"
        },
        "logAnalyticsQuery": {
          "readOnly": true,
          "type": "string",
          "description": "query in log analytics to get the list of affected devices/alerts"
        }
      },
      "allOf": [
        {
          "$ref": "../../../common/v1/types.json#/definitions/Resource"
        }
      ]
    },
    "IoTSecurityAggregatedRecommendation": {
      "type": "object",
      "description": "Security Solution",
      "properties": {
        "recommendationName": {
          "readOnly": true,
          "type": "string",
          "description": "Name of the alert type"
        },
        "recommendationDisplayName": {
          "readOnly": true,
          "type": "string",
          "description": "Display name of the alert type"
        },
        "description": {
          "readOnly": true,
          "type": "string",
          "description": "Description of the incident and what it means"
        },
        "recommendationTypeId": {
          "description": "The recommendation-type GUID.",
          "type": "string"
        },
        "detectedBy": {
          "readOnly": true,
          "type": "string",
          "description": "Name of the vendor that discovered the incident"
        },
        "reportedSeverity": {
          "readOnly": true,
          "type": "string",
          "enum": [
            "Informational",
            "Low",
            "Medium",
            "High"
          ],
          "x-ms-enum": {
            "name": "reportedSeverity",
            "modelAsString": true,
            "values": [
              {
                "value": "Informational"
              },
              {
                "value": "Low"
              },
              {
                "value": "Medium"
              },
              {
                "value": "High"
              }
            ]
          },
          "description": "Estimated severity of this alert"
        },
        "healthyDevices": {
          "readOnly": true,
          "type": "integer",
          "description": "the number of the healthy devices within the solution"
        },
        "unhealthyDevices": {
          "readOnly": true,
          "type": "integer",
          "description": "the number of the unhealthy devices within the solution"
        },
        "logAnalyticsQuery": {
          "readOnly": true,
          "type": "string",
          "description": "query in log analytics to get the list of affected devices/alerts"
        }
      },
      "allOf": [
        {
          "$ref": "../../../common/v1/types.json#/definitions/Resource"
        }
      ]
    },
    "IoTSecurityDeviceAlerts": {
      "type": "object",
      "description": "Statistic information about the number of alerts per device during the last period",
      "properties": {
        "deviceId": {
          "readOnly": true,
          "type": "string",
          "description": "Name of the alert type"
        },
        "alertsCount": {
          "readOnly": true,
          "type": "integer",
          "description": "the number of alerts raised for this device"
        }
      }
    }
  },
  "parameters": {
    "SolutionName": {
      "name": "solutionName",
      "in": "path",
      "required": true,
      "description": "The solution manager name",
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "AggregatedAlertName": {
      "name": "aggregatedAlertName",
      "in": "path",
      "required": true,
      "description": "Identifier of the aggregated alert",
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "AggregatedRecommendationName": {
      "name": "aggregatedRecommendationName",
      "in": "path",
      "required": true,
      "description": "Identifier of the aggregated alert",
      "type": "string",
      "x-ms-parameter-location": "method"
    }
  }
}