Content Templates - List

Service:

Sentinel

API Version:

2024-09-01

Gets all installed templates. Expandable properties:

• properties/mainTemplate
• properties/dependantTemplates

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/contentTemplates?api-version=2024-09-01

With optional parameters:

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/contentTemplates?api-version=2024-09-01&$filter={$filter}&$orderby={$orderby}&$expand={$expand}&$search={$search}&$count={$count}&$top={$top}&$skip={$skip}&$skipToken={$skipToken}

URI Parameters

Name	In	Required	Type	Description
resourceGroupName	path	True	string minLength: 1 maxLength: 90	The name of the resource group. The name is case insensitive.
subscriptionId	path	True	string (uuid)	The ID of the target subscription. The value must be an UUID.
workspaceName	path	True	string minLength: 1 maxLength: 90 pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$	The name of the workspace.
api-version	query	True	string minLength: 1	The API version to use for this operation.
$count	query		boolean	Instructs the server to return only object count without actual body. Optional.
$expand	query		string	Expands the object with optional fiends that are not included by default. Optional.
$filter	query		string	Filters the results, based on a Boolean condition. Optional.
$orderby	query		string	Sorts the results. Optional.
$search	query		string	Searches for a substring in the response. Optional.
$skip	query		integer (int32)	Used to skip n elements in the OData query (offset). Returns a nextLink to the next page of results if there are any left.
$skipToken	query		string	Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.
$top	query		integer (int32)	Returns only the first n results. Optional.

Responses

Name	Type	Description
200 OK	templateList	OK
Other Status Codes	CloudError	Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

Get all installed templates.

Sample request

HTTP

GET https://management.azure.com/subscriptions/d0cfeab2-9ae0-4464-9919-dccaee2e48f0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/contentTemplates?api-version=2024-09-01

Sample response

Status code:

200

{
  "value": [
    {
      "id": "/subscriptions/d0cfeab2-9ae0-4464-9919-dccaee2e48f0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/contentTemplates/8365ebfe-a381-45b7-ad08-7d818070e11f",
      "name": "8365ebfe-a381-45b7-ad08-7d818070e11f",
      "type": "Microsoft.SecurityInsights/contenttemplates",
      "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
      "properties": {
        "contentId": "contentId",
        "contentProductId": "packageId-wb-rimnsoeh4nt32",
        "packageVersion": "1.0.0",
        "version": "1.0.0",
        "displayName": "My installed template",
        "contentKind": "Workbooks",
        "packageId": "packageId",
        "source": {
          "kind": "Standalone",
          "name": "Source name"
        }
      },
      "systemData": {
        "createdBy": "string",
        "createdByType": "User",
        "createdAt": "2020-04-27T21:53:29.0928001Z",
        "lastModifiedBy": "string",
        "lastModifiedByType": "User",
        "lastModifiedAt": "2020-04-27T21:53:29.0928001Z"
      }
    }
  ]
}

Definitions

Name	Description
CloudError	Error response structure.
CloudErrorBody	Error details.
createdByType	The type of identity that created the resource.
flag	Flag indicates if this template is deprecated
kind	The kind of content the template is for.
metadataAuthor	Publisher or creator of the content item.
metadataCategories	ies for the solution content item
metadataDependencies	Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex dependencies.
metadataSource	The original source of the content item, where it comes from.
metadataSupport	Support information for the content item.
operator	Operator used for list of dependencies in criteria array.
packageKind	the packageKind of the package contains this template
sourceKind	Source type of the content
supportTier	Type of support for content item
systemData	Metadata pertaining to creation and last modification of the resource.
templateList	List of all the template.
templateModel	Template resource definition.
templateProperties	Template property bag.

CloudError

Object

Error response structure.

Name	Type	Description
error	CloudErrorBody	Error data

CloudErrorBody

Object

Error details.

Name	Type	Description
code	string	An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
message	string	A message describing the error, intended to be suitable for display in a user interface.

createdByType

Enumeration

The type of identity that created the resource.

Value	Description
User
Application
ManagedIdentity
Key

flag

Enumeration

Flag indicates if this template is deprecated

Value	Description
true
false

kind

Enumeration

The kind of content the template is for.

Value	Description
DataConnector
DataType
Workbook
WorkbookTemplate
Playbook
PlaybookTemplate
AnalyticsRuleTemplate
AnalyticsRule
HuntingQuery
InvestigationQuery
Parser
Watchlist
WatchlistTemplate
Solution
AzureFunction
LogicAppsCustomConnector
AutomationRule

metadataAuthor

Object

Publisher or creator of the content item.

Name	Type	Description
email	string	Email of author contact
link	string	Link for author/vendor page
name	string	Name of the author. Company or person.

metadataCategories

Object

ies for the solution content item

Name	Type	Description
domains	string[]	domain for the solution content item
verticals	string[]	Industry verticals for the solution content item

metadataDependencies

Object

Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex dependencies.

Name	Type	Description
contentId	string	Id of the content item we depend on
criteria	metadataDependencies[]	This is the list of dependencies we must fulfill, according to the AND/OR operator
kind	kind	Type of the content item we depend on
name	string	Name of the content item
operator	operator	Operator used for list of dependencies in criteria array.
version	string	Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.

metadataSource

Object

The original source of the content item, where it comes from.

Name	Type	Description
kind	sourceKind	Source type of the content
name	string	Name of the content source. The repo name, solution name, LA workspace name etc.
sourceId	string	ID of the content source. The solution ID, workspace ID, etc

metadataSupport

Object

Support information for the content item.

Name	Type	Description
email	string	Email of support contact
link	string	Link for support help, like to support page to open a ticket etc.
name	string	Name of the support contact. Company or person.
tier	supportTier	Type of support for content item

operator

Enumeration

Operator used for list of dependencies in criteria array.

Value	Description
AND
OR

packageKind

Enumeration

the packageKind of the package contains this template

Value	Description
Solution
Standalone

sourceKind

Enumeration

Source type of the content

Value	Description
LocalWorkspace
Community
Solution
SourceRepository

supportTier

Enumeration

Type of support for content item

Value	Description
Microsoft
Partner
Community

systemData

Object

Metadata pertaining to creation and last modification of the resource.

Name	Type	Description
createdAt	string (date-time)	The timestamp of resource creation (UTC).
createdBy	string	The identity that created the resource.
createdByType	createdByType	The type of identity that created the resource.
lastModifiedAt	string (date-time)	The timestamp of resource last modification (UTC)
lastModifiedBy	string	The identity that last modified the resource.
lastModifiedByType	createdByType	The type of identity that last modified the resource.

templateList

Object

List of all the template.

Name	Type	Description
nextLink	string	URL to fetch the next page of template.
value	templateModel[]	Array of templates.

templateModel

Object

Template resource definition.

Name	Type	Description
etag	string	Etag of the azure resource
id	string (arm-id)	Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
name	string	The name of the resource
properties.author	metadataAuthor	The creator of the content item.
properties.categories	metadataCategories	Categories for the item
properties.contentId	string	Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
properties.contentKind	kind	The kind of content the template is for.
properties.contentProductId	string	Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template
properties.contentSchemaVersion	string	Schema version of the content. Can be used to distinguish between different flow based on the schema version
properties.customVersion	string	The custom version of the content. A optional free text
properties.dependantTemplates	templateProperties[]	Dependant templates. Expandable.
properties.dependencies	metadataDependencies	Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
properties.displayName	string	The display name of the template
properties.firstPublishDate	string (date)	first publish date content item
properties.icon	string	the icon identifier. this id can later be fetched from the content metadata
properties.isDeprecated	flag	Flag indicates if this template is deprecated
properties.lastPublishDate	string (date)	last publish date for the content item
properties.mainTemplate	object	The JSON of the ARM template to deploy active content. Expandable.
properties.packageId	string	the package Id contains this template
properties.packageKind	packageKind	the packageKind of the package contains this template
properties.packageName	string	the name of the package contains this template
properties.packageVersion	string	Version of the package. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
properties.previewImages	string[]	preview image file names. These will be taken from the solution artifacts
properties.previewImagesDark	string[]	preview image file names. These will be taken from the solution artifacts. used for dark theme support
properties.providers	string[]	Providers for the content item
properties.source	metadataSource	Source of the content. This is where/how it was created.
properties.support	metadataSupport	Support information for the template - type, name, contact information
properties.threatAnalysisTactics	string[]	the tactics the resource covers
properties.threatAnalysisTechniques	string[]	the techniques the resource covers, these have to be aligned with the tactics being used
properties.version	string	Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
systemData	systemData	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

templateProperties

Object

Template property bag.

Name	Type	Description
author	metadataAuthor	The creator of the content item.
categories	metadataCategories	Categories for the item
contentId	string	Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
contentKind	kind	The kind of content the template is for.
contentProductId	string	Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template
contentSchemaVersion	string	Schema version of the content. Can be used to distinguish between different flow based on the schema version
customVersion	string	The custom version of the content. A optional free text
dependantTemplates	templateProperties[]	Dependant templates. Expandable.
dependencies	metadataDependencies	Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
displayName	string	The display name of the template
firstPublishDate	string (date)	first publish date content item
icon	string	the icon identifier. this id can later be fetched from the content metadata
isDeprecated	flag	Flag indicates if this template is deprecated
lastPublishDate	string (date)	last publish date for the content item
mainTemplate	object	The JSON of the ARM template to deploy active content. Expandable.
packageId	string	the package Id contains this template
packageKind	packageKind	the packageKind of the package contains this template
packageName	string	the name of the package contains this template
packageVersion	string	Version of the package. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
previewImages	string[]	preview image file names. These will be taken from the solution artifacts
previewImagesDark	string[]	preview image file names. These will be taken from the solution artifacts. used for dark theme support
providers	string[]	Providers for the content item
source	metadataSource	Source of the content. This is where/how it was created.
support	metadataSupport	Support information for the template - type, name, contact information
threatAnalysisTactics	string[]	the tactics the resource covers
threatAnalysisTechniques	string[]	the techniques the resource covers, these have to be aligned with the tactics being used
version	string	Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks