Bookmarks - List

Reference

Service:: Sentinel

API Version:: 2025-03-01

Gets all bookmarks.

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks?api-version=2025-03-01

URI Parameters

Name	In	Required	Type	Description
resourceGroupName	path	True	string minLength: 1 maxLength: 90	The name of the resource group. The name is case insensitive.
subscriptionId	path	True	string (uuid)	The ID of the target subscription. The value must be an UUID.
workspaceName	path	True	string minLength: 1 maxLength: 90 pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$	The name of the workspace.
api-version	query	True	string minLength: 1	The API version to use for this operation.

Responses

Name	Type	Description
200 OK	BookmarkList	OK, Operation successfully completed
Other Status Codes	CloudError	Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

Get all bookmarks.

Sample request

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks?api-version=2025-03-01

Sample response

Status code:: 200

{
  "value": [
    {
      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
      "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
      "type": "Microsoft.SecurityInsights/bookmarks",
      "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
      "properties": {
        "displayName": "My bookmark",
        "createdBy": {
          "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
          "email": "john@contoso.com",
          "name": "john doe"
        },
        "updatedBy": {
          "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
          "email": "john@contoso.com",
          "name": "john doe"
        },
        "updated": "2019-01-01T13:15:30Z",
        "created": "2019-01-01T13:15:30Z",
        "notes": "Found a suspicious activity",
        "labels": [
          "Tag1",
          "Tag2"
        ],
        "query": "SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)",
        "queryResult": "Security Event query result",
        "incidentInfo": {
          "incidentId": "DDA55F97-170B-40B9-B8ED-CBFD05481E7D",
          "severity": "Low",
          "title": "New case 1",
          "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0018"
        }
      }
    }
  ]
}

Definitions

Name	Description
Bookmark	Represents a bookmark in Azure Security Insights.
BookmarkList	List all the bookmarks.
CloudError	Error response structure.
CloudErrorBody	Error details.
createdByType	The type of identity that created the resource.
IncidentInfo	Describes related incident information for the bookmark
IncidentSeverity	The severity of the incident
systemData	Metadata pertaining to creation and last modification of the resource.
UserInfo	User information that made some action

Bookmark

Object

Represents a bookmark in Azure Security Insights.

Name	Type	Description
etag	string	Etag of the azure resource
id	string (arm-id)	Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
name	string	The name of the resource
properties.created	string (date-time)	The time the bookmark was created
properties.createdBy	UserInfo	Describes a user that created the bookmark
properties.displayName	string	The display name of the bookmark
properties.eventTime	string (date-time)	The bookmark event time
properties.incidentInfo	IncidentInfo	Describes an incident that relates to bookmark
properties.labels	string[]	List of labels relevant to this bookmark
properties.notes	string	The notes of the bookmark
properties.query	string	The query of the bookmark.
properties.queryEndTime	string (date-time)	The end time for the query
properties.queryResult	string	The query result of the bookmark.
properties.queryStartTime	string (date-time)	The start time for the query
properties.updated	string (date-time)	The last time the bookmark was updated
properties.updatedBy	UserInfo	Describes a user that updated the bookmark
systemData	systemData	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

BookmarkList

Object

List all the bookmarks.

Name	Type	Description
nextLink	string	URL to fetch the next set of cases.
value	Bookmark[]	Array of bookmarks.

CloudError

Object

Error response structure.

Name	Type	Description
error	CloudErrorBody	Error data

CloudErrorBody

Object

Error details.

Name	Type	Description
code	string	An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
message	string	A message describing the error, intended to be suitable for display in a user interface.

createdByType

Enumeration

The type of identity that created the resource.

Value	Description
Application
Key
ManagedIdentity
User

IncidentInfo

Object

Describes related incident information for the bookmark

Name	Type	Description
incidentId	string	Incident Id
relationName	string	Relation Name
severity	IncidentSeverity	The severity of the incident
title	string	The title of the incident

IncidentSeverity

Enumeration

The severity of the incident

Value	Description
High	High severity
Informational	Informational severity
Low	Low severity
Medium	Medium severity

systemData

Object

Metadata pertaining to creation and last modification of the resource.

Name	Type	Description
createdAt	string (date-time)	The timestamp of resource creation (UTC).
createdBy	string	The identity that created the resource.
createdByType	createdByType	The type of identity that created the resource.
lastModifiedAt	string (date-time)	The timestamp of resource last modification (UTC)
lastModifiedBy	string	The identity that last modified the resource.
lastModifiedByType	createdByType	The type of identity that last modified the resource.

UserInfo

Object

User information that made some action

Name	Type	Description
email	string	The email of the user.
name	string	The name of the user.
objectId	string (uuid)	The object id of the user.

Delen via

Bookmarks - List

URI Parameters

Responses

Security

azure_auth

Scopes

Examples

Get all bookmarks.

Sample request

Sample response

Definitions

Bookmark

BookmarkList

CloudError

CloudErrorBody

createdByType

IncidentInfo

IncidentSeverity

systemData

UserInfo

Aanvullende resources