Content Packages - List

Service:

Sentinel

API Version:

2024-03-01

Gets all installed packages.

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/contentPackages?api-version=2024-03-01

With optional parameters:

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/contentPackages?api-version=2024-03-01&$filter={$filter}&$orderby={$orderby}&$search={$search}&$count={$count}&$top={$top}&$skip={$skip}&$skipToken={$skipToken}

URI Parameters

Name	In	Required	Type	Description
resourceGroupName	path	True	string	The name of the resource group. The name is case insensitive.
subscriptionId	path	True	string	The ID of the target subscription.
workspaceName	path	True	string	The name of the workspace. Regex pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
api-version	query	True	string	The API version to use for this operation.
$count	query		boolean	Instructs the server to return only object count without actual body. Optional.
$filter	query		string	Filters the results, based on a Boolean condition. Optional.
$orderby	query		string	Sorts the results. Optional.
$search	query		string	Searches for a substring in the response. Optional.
$skip	query		integer int32	Used to skip n elements in the OData query (offset). Returns a nextLink to the next page of results if there are any left.
$skipToken	query		string	Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.
$top	query		integer int32	Returns only the first n results. Optional.

Responses

Name	Type	Description
200 OK	packageList	OK
Other Status Codes	CloudError	Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

Get all available packages.

Sample Request

HTTP

GET https://management.azure.com/subscriptions/d0cfeab2-9ae0-4464-9919-dccaee2e48f0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/contentPackages?api-version=2024-03-01

Sample Response

Status code:

200

{
  "value": [
    {
      "id": "/subscriptions/d0cfeab2-9ae0-4464-9919-dccaee2e48f0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/contentPackages",
      "name": "str.azure-sentinel-solution-str",
      "type": "Microsoft.SecurityInsights/contentpackages",
      "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
      "properties": {
        "contentId": "str.azure-sentinel-solution-str",
        "contentProductId": "str.azure-sentinel-solution-str-sl-igl6jawr4gwmu",
        "contentKind": "Solution",
        "contentSchemaVersion": "3.0.0",
        "version": "2.0.0",
        "displayName": "str"
      },
      "systemData": {
        "createdBy": "string",
        "createdByType": "User",
        "createdAt": "2020-04-27T21:53:29.0928001Z",
        "lastModifiedBy": "string",
        "lastModifiedByType": "User",
        "lastModifiedAt": "2020-04-27T21:53:29.0928001Z"
      }
    }
  ]
}

Definitions

Name	Description
CloudError	Error response structure.
CloudErrorBody	Error details.
createdByType	The type of identity that created the resource.
flag	Flag indicates if this is a newly published package.
kind	Type of the content item we depend on
metadataAuthor	Publisher or creator of the content item.
metadataCategories	ies for the solution content item
metadataDependencies	Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex dependencies.
metadataSource	The original source of the content item, where it comes from.
metadataSupport	Support information for the content item.
operator	Operator used for list of dependencies in criteria array.
packageKind	The package kind
packageList	List available packages.
packageModel	Represents a Package in Azure Security Insights.
sourceKind	Source type of the content
supportTier	Type of support for content item
systemData	Metadata pertaining to creation and last modification of the resource.

CloudError

Error response structure.

Name	Type	Description
error	CloudErrorBody	Error data

CloudErrorBody

Error details.

Name	Type	Description
code	string	An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
message	string	A message describing the error, intended to be suitable for display in a user interface.

createdByType

The type of identity that created the resource.

Name	Type	Description
Application	string
Key	string
ManagedIdentity	string
User	string

flag

Flag indicates if this is a newly published package.

Name	Type	Description
false	string
true	string

kind

Type of the content item we depend on

Name	Type	Description
AnalyticsRule	string
AnalyticsRuleTemplate	string
AutomationRule	string
AzureFunction	string
DataConnector	string
DataType	string
HuntingQuery	string
InvestigationQuery	string
LogicAppsCustomConnector	string
Parser	string
Playbook	string
PlaybookTemplate	string
Solution	string
Watchlist	string
WatchlistTemplate	string
Workbook	string
WorkbookTemplate	string

metadataAuthor

Publisher or creator of the content item.

Name	Type	Description
email	string	Email of author contact
link	string	Link for author/vendor page
name	string	Name of the author. Company or person.

metadataCategories

ies for the solution content item

Name	Type	Description
domains	string[]	domain for the solution content item
verticals	string[]	Industry verticals for the solution content item

metadataDependencies

Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex dependencies.

Name	Type	Description
contentId	string	Id of the content item we depend on
criteria	metadataDependencies[]	This is the list of dependencies we must fulfill, according to the AND/OR operator
kind	kind	Type of the content item we depend on
name	string	Name of the content item
operator	operator	Operator used for list of dependencies in criteria array.
version	string	Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.

metadataSource

The original source of the content item, where it comes from.

Name	Type	Description
kind	sourceKind	Source type of the content
name	string	Name of the content source. The repo name, solution name, LA workspace name etc.
sourceId	string	ID of the content source. The solution ID, workspace ID, etc

metadataSupport

Support information for the content item.

Name	Type	Description
email	string	Email of support contact
link	string	Link for support help, like to support page to open a ticket etc.
name	string	Name of the support contact. Company or person.
tier	supportTier	Type of support for content item

operator

Operator used for list of dependencies in criteria array.

Name	Type	Description
AND	string
OR	string

packageKind

The package kind

Name	Type	Description
Solution	string
Standalone	string

packageList

List available packages.

Name	Type	Description
nextLink	string	URL to fetch the next set of packages.
value	packageModel[]	Array of packages.

packageModel

Represents a Package in Azure Security Insights.

Name	Type	Description
etag	string	Etag of the azure resource
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}
name	string	The name of the resource
properties.author	metadataAuthor	The author of the package
properties.categories	metadataCategories	The categories of the package
properties.contentId	string	The content id of the package
properties.contentKind	packageKind	The package kind
properties.contentProductId	string	Unique ID for the content. It should be generated based on the contentId, contentKind and the contentVersion of the package
properties.contentSchemaVersion	string	The version of the content schema.
properties.dependencies	metadataDependencies	The support tier of the package
properties.description	string	The description of the package
properties.displayName	string	The display name of the package
properties.firstPublishDate	string	first publish date package item
properties.icon	string	the icon identifier. this id can later be fetched from the content metadata
properties.isDeprecated	flag	Flag indicates if this template is deprecated
properties.isFeatured	flag	Flag indicates if this package is among the featured list.
properties.isNew	flag	Flag indicates if this is a newly published package.
properties.isPreview	flag	Flag indicates if this package is in preview.
properties.lastPublishDate	string	last publish date for the package item
properties.providers	string[]	Providers for the package item
properties.publisherDisplayName	string	The publisher display name of the package
properties.source	metadataSource	The source of the package
properties.support	metadataSupport	The support tier of the package
properties.threatAnalysisTactics	string[]	the tactics the resource covers
properties.threatAnalysisTechniques	string[]	the techniques the resource covers, these have to be aligned with the tactics being used
properties.version	string	the latest version number of the package
systemData	systemData	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

sourceKind

Source type of the content

Name	Type	Description
Community	string
LocalWorkspace	string
Solution	string
SourceRepository	string

supportTier

Type of support for content item

Name	Type	Description
Community	string
Microsoft	string
Partner	string

systemData

Metadata pertaining to creation and last modification of the resource.

Name	Type	Description
createdAt	string	The timestamp of resource creation (UTC).
createdBy	string	The identity that created the resource.
createdByType	createdByType	The type of identity that created the resource.
lastModifiedAt	string	The timestamp of resource last modification (UTC)
lastModifiedBy	string	The identity that last modified the resource.
lastModifiedByType	createdByType	The type of identity that last modified the resource.