Microsoft.SecurityInsights automationRules 2021-09-01-preview

  • Article

Bicep resource definition

The automationRules resource type is an extension resource, which means you can apply it to another resource.

Use the scope property on this resource to set the scope for this resource. See Set scope on extension resources in Bicep.

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.SecurityInsights/automationRules resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.SecurityInsights/automationRules@2021-09-01-preview' = {
  name: 'string'
  scope: resourceSymbolicName
  etag: 'string'
  properties: {
    actions: [
      {
        order: int
        actionType: 'string'
        // For remaining properties, see AutomationRuleAction objects
      }
    ]
    displayName: 'string'
    order: int
    triggeringLogic: {
      conditions: [
        {
          conditionType: 'string'
          // For remaining properties, see AutomationRuleCondition objects
        }
      ]
      expirationTimeUtc: 'string'
      isEnabled: bool
      triggersOn: 'Incidents'
      triggersWhen: 'Created'
    }
  }
}

AutomationRuleAction objects

Set the actionType property to specify the type of object.

For ModifyProperties, use:

  actionType: 'ModifyProperties'
  actionConfiguration: {
    classification: 'string'
    classificationComment: 'string'
    classificationReason: 'string'
    labels: [
      {
        labelName: 'string'
      }
    ]
    owner: {
      assignedTo: 'string'
      email: 'string'
      objectId: 'string'
      userPrincipalName: 'string'
    }
    severity: 'string'
    status: 'string'
  }

For RunPlaybook, use:

  actionType: 'RunPlaybook'
  actionConfiguration: {
    logicAppResourceId: 'string'
    tenantId: 'string'
  }

AutomationRuleCondition objects

Set the conditionType property to specify the type of object.

For Property, use:

  conditionType: 'Property'
  conditionProperties: {
    operator: 'string'
    propertyName: 'string'
    propertyValues: [
      'string'
    ]
  }

Property values

automationRules

Name Description Value
name The resource name string (required)
scope Use when creating an extension resource at a scope that is different than the deployment scope. Target resource

For Bicep, set this property to the symbolic name of the resource to apply the extension resource.
etag Etag of the azure resource string
properties Automation rule properties AutomationRuleProperties

AutomationRuleProperties

Name Description Value
actions The actions to execute when the automation rule is triggered AutomationRuleAction[] (required)
displayName The display name of the automation rule string (required)
order The order of execution of the automation rule int (required)
triggeringLogic The triggering logic of the automation rule AutomationRuleTriggeringLogic (required)

AutomationRuleAction

Name Description Value
order The order of execution of the automation rule action int (required)
actionType Set the object type ModifyProperties
RunPlaybook (required)

AutomationRuleModifyPropertiesAction

Name Description Value
actionType The type of the automation rule action 'ModifyProperties' (required)
actionConfiguration The configuration of the modify properties automation rule action AutomationRuleModifyPropertiesActionConfiguration (required)

AutomationRuleModifyPropertiesActionConfiguration

Name Description Value
classification The reason the incident was closed 'BenignPositive'
'FalsePositive'
'TruePositive'
'Undetermined'
classificationComment Describes the reason the incident was closed string
classificationReason The classification reason the incident was closed with 'InaccurateData'
'IncorrectAlertLogic'
'SuspiciousActivity'
'SuspiciousButExpected'
labels List of labels to add to the incident IncidentLabel[]
owner Describes a user that the incident is assigned to IncidentOwnerInfo
severity The severity of the incident 'High'
'Informational'
'Low'
'Medium'
status The status of the incident 'Active'
'Closed'
'New'

IncidentLabel

Name Description Value
labelName The name of the label string (required)

IncidentOwnerInfo

Name Description Value
assignedTo The name of the user the incident is assigned to. string
email The email of the user the incident is assigned to. string
objectId The object id of the user the incident is assigned to. string
userPrincipalName The user principal name of the user the incident is assigned to. string

AutomationRuleRunPlaybookAction

Name Description Value
actionType The type of the automation rule action 'RunPlaybook' (required)
actionConfiguration The configuration of the run playbook automation rule action AutomationRuleRunPlaybookActionConfiguration (required)

AutomationRuleRunPlaybookActionConfiguration

Name Description Value
logicAppResourceId The resource id of the playbook resource string
tenantId The tenant id of the playbook resource string

AutomationRuleTriggeringLogic

Name Description Value
conditions The conditions to evaluate to determine if the automation rule should be triggered on a given object AutomationRuleCondition[]
expirationTimeUtc Determines when the automation rule should automatically expire and be disabled. string
isEnabled Determines whether the automation rule is enabled or disabled. bool (required)
triggersOn The type of object the automation rule triggers on 'Incidents' (required)
triggersWhen The type of event the automation rule triggers on 'Created' (required)

AutomationRuleCondition

Name Description Value
conditionType Set the object type Property (required)

AutomationRulePropertyValuesCondition

Name Description Value
conditionType The type of the automation rule condition 'Property' (required)
conditionProperties The configuration of the automation rule condition AutomationRulePropertyValuesConditionProperties (required)

AutomationRulePropertyValuesConditionProperties

Name Description Value
operator The operator to use for evaluation the condition 'Contains'
'EndsWith'
'Equals'
'NotContains'
'NotEndsWith'
'NotEquals'
'NotStartsWith'
'StartsWith'
propertyName The property to evaluate 'AccountAadTenantId'
'AccountAadUserId'
'AccountNTDomain'
'AccountName'
'AccountObjectGuid'
'AccountPUID'
'AccountSid'
'AccountUPNSuffix'
'AzureResourceResourceId'
'AzureResourceSubscriptionId'
'CloudApplicationAppId'
'CloudApplicationAppName'
'DNSDomainName'
'FileDirectory'
'FileHashValue'
'FileName'
'HostAzureID'
'HostNTDomain'
'HostName'
'HostNetBiosName'
'HostOSVersion'
'IPAddress'
'IncidentDescription'
'IncidentProviderName'
'IncidentRelatedAnalyticRuleIds'
'IncidentSeverity'
'IncidentStatus'
'IncidentTactics'
'IncidentTitle'
'IoTDeviceId'
'IoTDeviceModel'
'IoTDeviceName'
'IoTDeviceOperatingSystem'
'IoTDeviceType'
'IoTDeviceVendor'
'MailMessageDeliveryAction'
'MailMessageDeliveryLocation'
'MailMessageP1Sender'
'MailMessageP2Sender'
'MailMessageRecipient'
'MailMessageSenderIP'
'MailMessageSubject'
'MailboxDisplayName'
'MailboxPrimaryAddress'
'MailboxUPN'
'MalwareCategory'
'MalwareName'
'ProcessCommandLine'
'ProcessId'
'RegistryKey'
'RegistryValueData'
'Url'
propertyValues The values to use for evaluating the condition string[]

Quickstart templates

The following quickstart templates deploy this resource type.

Template Description
Creates a new Microsoft Sentinel Automation Rule

Deploy to Azure		 This sample shows how to create a new automation rule in Microsoft Sentinel

ARM template resource definition

The automationRules resource type is an extension resource, which means you can apply it to another resource.

Use the scope property on this resource to set the scope for this resource. See Set scope on extension resources in ARM templates.

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.SecurityInsights/automationRules resource, add the following JSON to your template.

{
  "type": "Microsoft.SecurityInsights/automationRules",
  "apiVersion": "2021-09-01-preview",
  "name": "string",
  "scope": "string",
  "etag": "string",
  "properties": {
    "actions": [
      {
        "order": "int",
        "actionType": "string"
        // For remaining properties, see AutomationRuleAction objects
      }
    ],
    "displayName": "string",
    "order": "int",
    "triggeringLogic": {
      "conditions": [
        {
          "conditionType": "string"
          // For remaining properties, see AutomationRuleCondition objects
        }
      ],
      "expirationTimeUtc": "string",
      "isEnabled": "bool",
      "triggersOn": "Incidents",
      "triggersWhen": "Created"
    }
  }
}

AutomationRuleAction objects

Set the actionType property to specify the type of object.

For ModifyProperties, use:

  "actionType": "ModifyProperties",
  "actionConfiguration": {
    "classification": "string",
    "classificationComment": "string",
    "classificationReason": "string",
    "labels": [
      {
        "labelName": "string"
      }
    ],
    "owner": {
      "assignedTo": "string",
      "email": "string",
      "objectId": "string",
      "userPrincipalName": "string"
    },
    "severity": "string",
    "status": "string"
  }

For RunPlaybook, use:

  "actionType": "RunPlaybook",
  "actionConfiguration": {
    "logicAppResourceId": "string",
    "tenantId": "string"
  }

AutomationRuleCondition objects

Set the conditionType property to specify the type of object.

For Property, use:

  "conditionType": "Property",
  "conditionProperties": {
    "operator": "string",
    "propertyName": "string",
    "propertyValues": [ "string" ]
  }

Property values

automationRules

Name Description Value
type The resource type 'Microsoft.SecurityInsights/automationRules'
apiVersion The resource api version '2021-09-01-preview'
name The resource name string (required)
scope Use when creating an extension resource at a scope that is different than the deployment scope. Target resource

For JSON, set the value to the full name of the resource to apply the extension resource to.
etag Etag of the azure resource string
properties Automation rule properties AutomationRuleProperties

AutomationRuleProperties

Name Description Value
actions The actions to execute when the automation rule is triggered AutomationRuleAction[] (required)
displayName The display name of the automation rule string (required)
order The order of execution of the automation rule int (required)
triggeringLogic The triggering logic of the automation rule AutomationRuleTriggeringLogic (required)

AutomationRuleAction

Name Description Value
order The order of execution of the automation rule action int (required)
actionType Set the object type ModifyProperties
RunPlaybook (required)

AutomationRuleModifyPropertiesAction

Name Description Value
actionType The type of the automation rule action 'ModifyProperties' (required)
actionConfiguration The configuration of the modify properties automation rule action AutomationRuleModifyPropertiesActionConfiguration (required)

AutomationRuleModifyPropertiesActionConfiguration

Name Description Value
classification The reason the incident was closed 'BenignPositive'
'FalsePositive'
'TruePositive'
'Undetermined'
classificationComment Describes the reason the incident was closed string
classificationReason The classification reason the incident was closed with 'InaccurateData'
'IncorrectAlertLogic'
'SuspiciousActivity'
'SuspiciousButExpected'
labels List of labels to add to the incident IncidentLabel[]
owner Describes a user that the incident is assigned to IncidentOwnerInfo
severity The severity of the incident 'High'
'Informational'
'Low'
'Medium'
status The status of the incident 'Active'
'Closed'
'New'

IncidentLabel

Name Description Value
labelName The name of the label string (required)

IncidentOwnerInfo

Name Description Value
assignedTo The name of the user the incident is assigned to. string
email The email of the user the incident is assigned to. string
objectId The object id of the user the incident is assigned to. string
userPrincipalName The user principal name of the user the incident is assigned to. string

AutomationRuleRunPlaybookAction

Name Description Value
actionType The type of the automation rule action 'RunPlaybook' (required)
actionConfiguration The configuration of the run playbook automation rule action AutomationRuleRunPlaybookActionConfiguration (required)

AutomationRuleRunPlaybookActionConfiguration

Name Description Value
logicAppResourceId The resource id of the playbook resource string
tenantId The tenant id of the playbook resource string

AutomationRuleTriggeringLogic

Name Description Value
conditions The conditions to evaluate to determine if the automation rule should be triggered on a given object AutomationRuleCondition[]
expirationTimeUtc Determines when the automation rule should automatically expire and be disabled. string
isEnabled Determines whether the automation rule is enabled or disabled. bool (required)
triggersOn The type of object the automation rule triggers on 'Incidents' (required)
triggersWhen The type of event the automation rule triggers on 'Created' (required)

AutomationRuleCondition

Name Description Value
conditionType Set the object type Property (required)

AutomationRulePropertyValuesCondition

Name Description Value
conditionType The type of the automation rule condition 'Property' (required)
conditionProperties The configuration of the automation rule condition AutomationRulePropertyValuesConditionProperties (required)

AutomationRulePropertyValuesConditionProperties

Name Description Value
operator The operator to use for evaluation the condition 'Contains'
'EndsWith'
'Equals'
'NotContains'
'NotEndsWith'
'NotEquals'
'NotStartsWith'
'StartsWith'
propertyName The property to evaluate 'AccountAadTenantId'
'AccountAadUserId'
'AccountNTDomain'
'AccountName'
'AccountObjectGuid'
'AccountPUID'
'AccountSid'
'AccountUPNSuffix'
'AzureResourceResourceId'
'AzureResourceSubscriptionId'
'CloudApplicationAppId'
'CloudApplicationAppName'
'DNSDomainName'
'FileDirectory'
'FileHashValue'
'FileName'
'HostAzureID'
'HostNTDomain'
'HostName'
'HostNetBiosName'
'HostOSVersion'
'IPAddress'
'IncidentDescription'
'IncidentProviderName'
'IncidentRelatedAnalyticRuleIds'
'IncidentSeverity'
'IncidentStatus'
'IncidentTactics'
'IncidentTitle'
'IoTDeviceId'
'IoTDeviceModel'
'IoTDeviceName'
'IoTDeviceOperatingSystem'
'IoTDeviceType'
'IoTDeviceVendor'
'MailMessageDeliveryAction'
'MailMessageDeliveryLocation'
'MailMessageP1Sender'
'MailMessageP2Sender'
'MailMessageRecipient'
'MailMessageSenderIP'
'MailMessageSubject'
'MailboxDisplayName'
'MailboxPrimaryAddress'
'MailboxUPN'
'MalwareCategory'
'MalwareName'
'ProcessCommandLine'
'ProcessId'
'RegistryKey'
'RegistryValueData'
'Url'
propertyValues The values to use for evaluating the condition string[]

Quickstart templates

The following quickstart templates deploy this resource type.

Template Description
Creates a new Microsoft Sentinel Automation Rule

Deploy to Azure		 This sample shows how to create a new automation rule in Microsoft Sentinel

Terraform (AzAPI provider) resource definition

The automationRules resource type is an extension resource, which means you can apply it to another resource.

Use the parent_id property on this resource to set the scope for this resource.

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.SecurityInsights/automationRules resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.SecurityInsights/automationRules@2021-09-01-preview"
  name = "string"
  parent_id = "string"
  body = jsonencode({
    properties = {
      actions = [
        {
          order = int
          actionType = "string"
          // For remaining properties, see AutomationRuleAction objects
        }
      ]
      displayName = "string"
      order = int
      triggeringLogic = {
        conditions = [
          {
            conditionType = "string"
            // For remaining properties, see AutomationRuleCondition objects
          }
        ]
        expirationTimeUtc = "string"
        isEnabled = bool
        triggersOn = "Incidents"
        triggersWhen = "Created"
      }
    }
    etag = "string"
  })
}

AutomationRuleAction objects

Set the actionType property to specify the type of object.

For ModifyProperties, use:

  actionType = "ModifyProperties"
  actionConfiguration = {
    classification = "string"
    classificationComment = "string"
    classificationReason = "string"
    labels = [
      {
        labelName = "string"
      }
    ]
    owner = {
      assignedTo = "string"
      email = "string"
      objectId = "string"
      userPrincipalName = "string"
    }
    severity = "string"
    status = "string"
  }

For RunPlaybook, use:

  actionType = "RunPlaybook"
  actionConfiguration = {
    logicAppResourceId = "string"
    tenantId = "string"
  }

AutomationRuleCondition objects

Set the conditionType property to specify the type of object.

For Property, use:

  conditionType = "Property"
  conditionProperties = {
    operator = "string"
    propertyName = "string"
    propertyValues = [
      "string"
    ]
  }

Property values

automationRules

Name Description Value
type The resource type "Microsoft.SecurityInsights/automationRules@2021-09-01-preview"
name The resource name string (required)
parent_id The ID of the resource to apply this extension resource to. string (required)
etag Etag of the azure resource string
properties Automation rule properties AutomationRuleProperties

AutomationRuleProperties

Name Description Value
actions The actions to execute when the automation rule is triggered AutomationRuleAction[] (required)
displayName The display name of the automation rule string (required)
order The order of execution of the automation rule int (required)
triggeringLogic The triggering logic of the automation rule AutomationRuleTriggeringLogic (required)

AutomationRuleAction

Name Description Value
order The order of execution of the automation rule action int (required)
actionType Set the object type ModifyProperties
RunPlaybook (required)

AutomationRuleModifyPropertiesAction

Name Description Value
actionType The type of the automation rule action "ModifyProperties" (required)
actionConfiguration The configuration of the modify properties automation rule action AutomationRuleModifyPropertiesActionConfiguration (required)

AutomationRuleModifyPropertiesActionConfiguration

Name Description Value
classification The reason the incident was closed "BenignPositive"
"FalsePositive"
"TruePositive"
"Undetermined"
classificationComment Describes the reason the incident was closed string
classificationReason The classification reason the incident was closed with "InaccurateData"
"IncorrectAlertLogic"
"SuspiciousActivity"
"SuspiciousButExpected"
labels List of labels to add to the incident IncidentLabel[]
owner Describes a user that the incident is assigned to IncidentOwnerInfo
severity The severity of the incident "High"
"Informational"
"Low"
"Medium"
status The status of the incident "Active"
"Closed"
"New"

IncidentLabel

Name Description Value
labelName The name of the label string (required)

IncidentOwnerInfo

Name Description Value
assignedTo The name of the user the incident is assigned to. string
email The email of the user the incident is assigned to. string
objectId The object id of the user the incident is assigned to. string
userPrincipalName The user principal name of the user the incident is assigned to. string

AutomationRuleRunPlaybookAction

Name Description Value
actionType The type of the automation rule action "RunPlaybook" (required)
actionConfiguration The configuration of the run playbook automation rule action AutomationRuleRunPlaybookActionConfiguration (required)

AutomationRuleRunPlaybookActionConfiguration

Name Description Value
logicAppResourceId The resource id of the playbook resource string
tenantId The tenant id of the playbook resource string

AutomationRuleTriggeringLogic

Name Description Value
conditions The conditions to evaluate to determine if the automation rule should be triggered on a given object AutomationRuleCondition[]
expirationTimeUtc Determines when the automation rule should automatically expire and be disabled. string
isEnabled Determines whether the automation rule is enabled or disabled. bool (required)
triggersOn The type of object the automation rule triggers on "Incidents" (required)
triggersWhen The type of event the automation rule triggers on "Created" (required)

AutomationRuleCondition

Name Description Value
conditionType Set the object type Property (required)

AutomationRulePropertyValuesCondition

Name Description Value
conditionType The type of the automation rule condition "Property" (required)
conditionProperties The configuration of the automation rule condition AutomationRulePropertyValuesConditionProperties (required)

AutomationRulePropertyValuesConditionProperties

Name Description Value
operator The operator to use for evaluation the condition "Contains"
"EndsWith"
"Equals"
"NotContains"
"NotEndsWith"
"NotEquals"
"NotStartsWith"
"StartsWith"
propertyName The property to evaluate "AccountAadTenantId"
"AccountAadUserId"
"AccountNTDomain"
"AccountName"
"AccountObjectGuid"
"AccountPUID"
"AccountSid"
"AccountUPNSuffix"
"AzureResourceResourceId"
"AzureResourceSubscriptionId"
"CloudApplicationAppId"
"CloudApplicationAppName"
"DNSDomainName"
"FileDirectory"
"FileHashValue"
"FileName"
"HostAzureID"
"HostNTDomain"
"HostName"
"HostNetBiosName"
"HostOSVersion"
"IPAddress"
"IncidentDescription"
"IncidentProviderName"
"IncidentRelatedAnalyticRuleIds"
"IncidentSeverity"
"IncidentStatus"
"IncidentTactics"
"IncidentTitle"
"IoTDeviceId"
"IoTDeviceModel"
"IoTDeviceName"
"IoTDeviceOperatingSystem"
"IoTDeviceType"
"IoTDeviceVendor"
"MailMessageDeliveryAction"
"MailMessageDeliveryLocation"
"MailMessageP1Sender"
"MailMessageP2Sender"
"MailMessageRecipient"
"MailMessageSenderIP"
"MailMessageSubject"
"MailboxDisplayName"
"MailboxPrimaryAddress"
"MailboxUPN"
"MalwareCategory"
"MalwareName"
"ProcessCommandLine"
"ProcessId"
"RegistryKey"
"RegistryValueData"
"Url"
propertyValues The values to use for evaluating the condition string[]