Content Packages - List

Gets all installed packages.

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/contentPackages?api-version=2023-11-01
GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/contentPackages?api-version=2023-11-01&$filter={$filter}&$orderby={$orderby}&$search={$search}&$count={$count}&$top={$top}&$skip={$skip}&$skipToken={$skipToken}

URI Parameters

Name In Required Type Description
resourceGroupName
path True

string

The name of the resource group. The name is case insensitive.

subscriptionId
path True

string

The ID of the target subscription.

workspaceName
path True

string

The name of the workspace.

Regex pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$

api-version
query True

string

The API version to use for this operation.

$count
query

boolean

Instructs the server to return only object count without actual body. Optional.

$filter
query

string

Filters the results, based on a Boolean condition. Optional.

$orderby
query

string

Sorts the results. Optional.

$search
query

string

Searches for a substring in the response. Optional.

$skip
query

integer

int32

Used to skip n elements in the OData query (offset). Returns a nextLink to the next page of results if there are any left.

$skipToken
query

string

Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.

$top
query

integer

int32

Returns only the first n results. Optional.

Responses

Name Type Description
200 OK

packageList

OK

Other Status Codes

CloudError

Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

Get all available packages.

Sample Request

GET https://management.azure.com/subscriptions/d0cfeab2-9ae0-4464-9919-dccaee2e48f0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/contentPackages?api-version=2023-11-01

Sample Response

{
  "value": [
    {
      "id": "/subscriptions/d0cfeab2-9ae0-4464-9919-dccaee2e48f0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/contentPackages",
      "name": "str.azure-sentinel-solution-str",
      "type": "Microsoft.SecurityInsights/contentpackages",
      "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
      "properties": {
        "contentId": "str.azure-sentinel-solution-str",
        "contentProductId": "str.azure-sentinel-solution-str-sl-igl6jawr4gwmu",
        "contentKind": "Solution",
        "contentSchemaVersion": "3.0.0",
        "version": "2.0.0",
        "displayName": "str"
      },
      "systemData": {
        "createdBy": "string",
        "createdByType": "User",
        "createdAt": "2020-04-27T21:53:29.0928001Z",
        "lastModifiedBy": "string",
        "lastModifiedByType": "User",
        "lastModifiedAt": "2020-04-27T21:53:29.0928001Z"
      }
    }
  ]
}

Definitions

Name Description
CloudError

Error response structure.

CloudErrorBody

Error details.

createdByType

The type of identity that created the resource.

flag

Flag indicates if this is a newly published package.

kind

Type of the content item we depend on

metadataAuthor

Publisher or creator of the content item.

metadataCategories

ies for the solution content item

metadataDependencies

Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex dependencies.

metadataSource

The original source of the content item, where it comes from.

metadataSupport

Support information for the content item.

operator

Operator used for list of dependencies in criteria array.

packageKind

The package kind

packageList

List available packages.

packageModel

Represents a Package in Azure Security Insights.

sourceKind

Source type of the content

supportTier

Type of support for content item

systemData

Metadata pertaining to creation and last modification of the resource.

CloudError

Error response structure.

Name Type Description
error

CloudErrorBody

Error data

CloudErrorBody

Error details.

Name Type Description
code

string

An identifier for the error. Codes are invariant and are intended to be consumed programmatically.

message

string

A message describing the error, intended to be suitable for display in a user interface.

createdByType

The type of identity that created the resource.

Name Type Description
Application

string

Key

string

ManagedIdentity

string

User

string

flag

Flag indicates if this is a newly published package.

Name Type Description
false

string

true

string

kind

Type of the content item we depend on

Name Type Description
AnalyticsRule

string

AnalyticsRuleTemplate

string

AutomationRule

string

AzureFunction

string

DataConnector

string

DataType

string

HuntingQuery

string

InvestigationQuery

string

LogicAppsCustomConnector

string

Parser

string

Playbook

string

PlaybookTemplate

string

Solution

string

Watchlist

string

WatchlistTemplate

string

Workbook

string

WorkbookTemplate

string

metadataAuthor

Publisher or creator of the content item.

Name Type Description
email

string

Email of author contact

link

string

Link for author/vendor page

name

string

Name of the author. Company or person.

metadataCategories

ies for the solution content item

Name Type Description
domains

string[]

domain for the solution content item

verticals

string[]

Industry verticals for the solution content item

metadataDependencies

Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex dependencies.

Name Type Description
contentId

string

Id of the content item we depend on

criteria

metadataDependencies[]

This is the list of dependencies we must fulfill, according to the AND/OR operator

kind

kind

Type of the content item we depend on

name

string

Name of the content item

operator

operator

Operator used for list of dependencies in criteria array.

version

string

Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.

metadataSource

The original source of the content item, where it comes from.

Name Type Description
kind

sourceKind

Source type of the content

name

string

Name of the content source. The repo name, solution name, LA workspace name etc.

sourceId

string

ID of the content source. The solution ID, workspace ID, etc

metadataSupport

Support information for the content item.

Name Type Description
email

string

Email of support contact

link

string

Link for support help, like to support page to open a ticket etc.

name

string

Name of the support contact. Company or person.

tier

supportTier

Type of support for content item

operator

Operator used for list of dependencies in criteria array.

Name Type Description
AND

string

OR

string

packageKind

The package kind

Name Type Description
Solution

string

Standalone

string

packageList

List available packages.

Name Type Description
nextLink

string

URL to fetch the next set of packages.

value

packageModel[]

Array of packages.

packageModel

Represents a Package in Azure Security Insights.

Name Type Description
etag

string

Etag of the azure resource

id

string

Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}

name

string

The name of the resource

properties.author

metadataAuthor

The author of the package

properties.categories

metadataCategories

The categories of the package

properties.contentId

string

The content id of the package

properties.contentKind

packageKind

The package kind

properties.contentProductId

string

Unique ID for the content. It should be generated based on the contentId, contentKind and the contentVersion of the package

properties.contentSchemaVersion

string

The version of the content schema.

properties.dependencies

metadataDependencies

The support tier of the package

properties.description

string

The description of the package

properties.displayName

string

The display name of the package

properties.firstPublishDate

string

first publish date package item

properties.icon

string

the icon identifier. this id can later be fetched from the content metadata

properties.isDeprecated

flag

Flag indicates if this template is deprecated

properties.isFeatured

flag

Flag indicates if this package is among the featured list.

properties.isNew

flag

Flag indicates if this is a newly published package.

properties.isPreview

flag

Flag indicates if this package is in preview.

properties.lastPublishDate

string

last publish date for the package item

properties.providers

string[]

Providers for the package item

properties.publisherDisplayName

string

The publisher display name of the package

properties.source

metadataSource

The source of the package

properties.support

metadataSupport

The support tier of the package

properties.threatAnalysisTactics

string[]

the tactics the resource covers

properties.threatAnalysisTechniques

string[]

the techniques the resource covers, these have to be aligned with the tactics being used

properties.version

string

the latest version number of the package

systemData

systemData

Azure Resource Manager metadata containing createdBy and modifiedBy information.

type

string

The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

sourceKind

Source type of the content

Name Type Description
Community

string

LocalWorkspace

string

Solution

string

SourceRepository

string

supportTier

Type of support for content item

Name Type Description
Community

string

Microsoft

string

Partner

string

systemData

Metadata pertaining to creation and last modification of the resource.

Name Type Description
createdAt

string

The timestamp of resource creation (UTC).

createdBy

string

The identity that created the resource.

createdByType

createdByType

The type of identity that created the resource.

lastModifiedAt

string

The timestamp of resource last modification (UTC)

lastModifiedBy

string

The identity that last modified the resource.

lastModifiedByType

createdByType

The type of identity that last modified the resource.