Автоматизация Microsoft.SecurityInsightsRules 2025-03-01

Определение ресурсов Bicep

Тип ресурса automationRules можно развернуть с помощью операций, предназначенных для следующих операций:

Список измененных свойств в каждой версии API см. в журнала изменений.

Формат ресурса

Чтобы создать ресурс Microsoft.SecurityInsights/automationRules, добавьте следующий Bicep в шаблон.

resource symbolicname 'Microsoft.SecurityInsights/automationRules@2025-03-01' = {
  scope: resourceSymbolicName or scope
  etag: 'string'
  name: 'string'
  properties: {
    actions: [
      {
        order: int
        actionType: 'string'
        // For remaining properties, see AutomationRuleAction objects
      }
    ]
    displayName: 'string'
    order: int
    triggeringLogic: {
      conditions: [
        {
          conditionType: 'string'
          // For remaining properties, see AutomationRuleCondition objects
        }
      ]
      expirationTimeUtc: 'string'
      isEnabled: bool
      triggersOn: 'string'
      triggersWhen: 'string'
    }
  }
}

Объекты AutomationRuleCondition

Задайте свойство conditionType , чтобы указать тип объекта.

Для Boolean используйте:

{
  conditionProperties: {
    innerConditions: [
      {
        conditionType: 'string'
        // For remaining properties, see AutomationRuleCondition objects
      }
    ]
    operator: 'string'
  }
  conditionType: 'Boolean'
}

Для свойства используйте:

{
  conditionProperties: {
    operator: 'string'
    propertyName: 'string'
    propertyValues: [
      'string'
    ]
  }
  conditionType: 'Property'
}

Для PropertyArray используйте:

{
  conditionProperties: {
    arrayConditionType: 'string'
    arrayType: 'string'
    itemConditions: [
      {
        conditionType: 'string'
        // For remaining properties, see AutomationRuleCondition objects
      }
    ]
  }
  conditionType: 'PropertyArray'
}

Для PropertyArrayChanged используйте:

{
  conditionProperties: {
    arrayType: 'string'
    changeType: 'string'
  }
  conditionType: 'PropertyArrayChanged'
}

Для PropertyChanged используйте:

{
  conditionProperties: {
    changeType: 'string'
    operator: 'string'
    propertyName: 'string'
    propertyValues: [
      'string'
    ]
  }
  conditionType: 'PropertyChanged'
}

Объекты AutomationRuleAction

Задайте свойство actionType , чтобы указать тип объекта.

Для AddIncidentTask используйте:

{
  actionConfiguration: {
    description: 'string'
    title: 'string'
  }
  actionType: 'AddIncidentTask'
}

Для ModifyProperties используйте:

{
  actionConfiguration: {
    classification: 'string'
    classificationComment: 'string'
    classificationReason: 'string'
    labels: [
      {
        labelName: 'string'
      }
    ]
    owner: {
      assignedTo: 'string'
      email: 'string'
      objectId: 'string'
      ownerType: 'string'
      userPrincipalName: 'string'
    }
    severity: 'string'
    status: 'string'
  }
  actionType: 'ModifyProperties'
}

Для RunPlaybook используйте:

{
  actionConfiguration: {
    logicAppResourceId: 'string'
    tenantId: 'string'
  }
  actionType: 'RunPlaybook'
}

Значения свойств

Microsoft.SecurityInsights/automationRules

AddIncidentTaskActionProperties

AutomationRuleAction

AutomationRuleAddIncidentTaskAction

AutomationRuleBooleanCondition

AutomationRuleCondition

AutomationRuleModifyPropertiesAction

AutomationRuleProperties

AutomationRulePropertyArrayChangedValuesCondition

AutomationRulePropertyArrayValuesCondition

AutomationRulePropertyValuesChangedCondition

AutomationRulePropertyValuesCondition

AutomationRuleRunPlaybookAction

AutomationRuleTriggeringLogic

BooleanConditionProperties

IncidentLabel

IncidentOwnerInfo

IncidentPropertiesAction

PlaybookActionProperties

PropertyArrayChangedConditionProperties

PropertyArrayConditionProperties

PropertyChangedConditionProperties

PropertyConditionProperties

Определение ресурса шаблона ARM

Тип ресурса automationRules можно развернуть с помощью операций, предназначенных для следующих операций:

Список измененных свойств в каждой версии API см. в журнала изменений.

Формат ресурса

Чтобы создать ресурс Microsoft.SecurityInsights/automationRules, добавьте следующий код JSON в шаблон.

{
  "type": "Microsoft.SecurityInsights/automationRules",
  "apiVersion": "2025-03-01",
  "name": "string",
  "etag": "string",
  "properties": {
    "actions": [ {
      "order": "int",
      "actionType": "string"
      // For remaining properties, see AutomationRuleAction objects
    } ],
    "displayName": "string",
    "order": "int",
    "triggeringLogic": {
      "conditions": [ {
        "conditionType": "string"
        // For remaining properties, see AutomationRuleCondition objects
      } ],
      "expirationTimeUtc": "string",
      "isEnabled": "bool",
      "triggersOn": "string",
      "triggersWhen": "string"
    }
  }
}

Объекты AutomationRuleCondition

Задайте свойство conditionType , чтобы указать тип объекта.

Для Boolean используйте:

{
  "conditionProperties": {
    "innerConditions": [ {
      "conditionType": "string"
      // For remaining properties, see AutomationRuleCondition objects
    } ],
    "operator": "string"
  },
  "conditionType": "Boolean"
}

Для свойства используйте:

{
  "conditionProperties": {
    "operator": "string",
    "propertyName": "string",
    "propertyValues": [ "string" ]
  },
  "conditionType": "Property"
}

Для PropertyArray используйте:

{
  "conditionProperties": {
    "arrayConditionType": "string",
    "arrayType": "string",
    "itemConditions": [ {
      "conditionType": "string"
      // For remaining properties, see AutomationRuleCondition objects
    } ]
  },
  "conditionType": "PropertyArray"
}

Для PropertyArrayChanged используйте:

{
  "conditionProperties": {
    "arrayType": "string",
    "changeType": "string"
  },
  "conditionType": "PropertyArrayChanged"
}

Для PropertyChanged используйте:

{
  "conditionProperties": {
    "changeType": "string",
    "operator": "string",
    "propertyName": "string",
    "propertyValues": [ "string" ]
  },
  "conditionType": "PropertyChanged"
}

Объекты AutomationRuleAction

Задайте свойство actionType , чтобы указать тип объекта.

Для AddIncidentTask используйте:

{
  "actionConfiguration": {
    "description": "string",
    "title": "string"
  },
  "actionType": "AddIncidentTask"
}

Для ModifyProperties используйте:

{
  "actionConfiguration": {
    "classification": "string",
    "classificationComment": "string",
    "classificationReason": "string",
    "labels": [
      {
        "labelName": "string"
      }
    ],
    "owner": {
      "assignedTo": "string",
      "email": "string",
      "objectId": "string",
      "ownerType": "string",
      "userPrincipalName": "string"
    },
    "severity": "string",
    "status": "string"
  },
  "actionType": "ModifyProperties"
}

Для RunPlaybook используйте:

{
  "actionConfiguration": {
    "logicAppResourceId": "string",
    "tenantId": "string"
  },
  "actionType": "RunPlaybook"
}

Значения свойств

Microsoft.SecurityInsights/automationRules

AddIncidentTaskActionProperties

AutomationRuleAction

AutomationRuleAddIncidentTaskAction

AutomationRuleBooleanCondition

AutomationRuleCondition

AutomationRuleModifyPropertiesAction

AutomationRuleProperties

AutomationRulePropertyArrayChangedValuesCondition

AutomationRulePropertyArrayValuesCondition

AutomationRulePropertyValuesChangedCondition

AutomationRulePropertyValuesCondition

AutomationRuleRunPlaybookAction

AutomationRuleTriggeringLogic

BooleanConditionProperties

IncidentLabel

IncidentOwnerInfo

IncidentPropertiesAction

PlaybookActionProperties

PropertyArrayChangedConditionProperties

PropertyArrayConditionProperties

PropertyChangedConditionProperties

PropertyConditionProperties

Примеры использования

Шаблоны быстрого запуска Azure

Следующие шаблоны быстрого запуска Azure развертывают этот тип ресурса.

Template	Description
Создает новое правило автоматизации Microsoft Sentinel	В этом примере показано, как создать новое правило автоматизации в Microsoft Sentinel

Определение ресурса Terraform (поставщик AzAPI)

Тип ресурса automationRules можно развернуть с помощью операций, предназначенных для следующих операций:

Список измененных свойств в каждой версии API см. в журнала изменений.

Формат ресурса

Чтобы создать ресурс Microsoft.SecurityInsights/automationRules, добавьте следующий объект Terraform в шаблон.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.SecurityInsights/automationRules@2025-03-01"
  name = "string"
  parent_id = "string"
  body = {
    etag = "string"
    properties = {
      actions = [
        {
          order = int
          actionType = "string"
          // For remaining properties, see AutomationRuleAction objects
        }
      ]
      displayName = "string"
      order = int
      triggeringLogic = {
        conditions = [
          {
            conditionType = "string"
            // For remaining properties, see AutomationRuleCondition objects
          }
        ]
        expirationTimeUtc = "string"
        isEnabled = bool
        triggersOn = "string"
        triggersWhen = "string"
      }
    }
  }
}

Объекты AutomationRuleCondition

Задайте свойство conditionType , чтобы указать тип объекта.

Для Boolean используйте:

{
  conditionProperties = {
    innerConditions = [
      {
        conditionType = "string"
        // For remaining properties, see AutomationRuleCondition objects
      }
    ]
    operator = "string"
  }
  conditionType = "Boolean"
}

Для свойства используйте:

{
  conditionProperties = {
    operator = "string"
    propertyName = "string"
    propertyValues = [
      "string"
    ]
  }
  conditionType = "Property"
}

Для PropertyArray используйте:

{
  conditionProperties = {
    arrayConditionType = "string"
    arrayType = "string"
    itemConditions = [
      {
        conditionType = "string"
        // For remaining properties, see AutomationRuleCondition objects
      }
    ]
  }
  conditionType = "PropertyArray"
}

Для PropertyArrayChanged используйте:

{
  conditionProperties = {
    arrayType = "string"
    changeType = "string"
  }
  conditionType = "PropertyArrayChanged"
}

Для PropertyChanged используйте:

{
  conditionProperties = {
    changeType = "string"
    operator = "string"
    propertyName = "string"
    propertyValues = [
      "string"
    ]
  }
  conditionType = "PropertyChanged"
}

Объекты AutomationRuleAction

Задайте свойство actionType , чтобы указать тип объекта.

Для AddIncidentTask используйте:

{
  actionConfiguration = {
    description = "string"
    title = "string"
  }
  actionType = "AddIncidentTask"
}

Для ModifyProperties используйте:

{
  actionConfiguration = {
    classification = "string"
    classificationComment = "string"
    classificationReason = "string"
    labels = [
      {
        labelName = "string"
      }
    ]
    owner = {
      assignedTo = "string"
      email = "string"
      objectId = "string"
      ownerType = "string"
      userPrincipalName = "string"
    }
    severity = "string"
    status = "string"
  }
  actionType = "ModifyProperties"
}

Для RunPlaybook используйте:

{
  actionConfiguration = {
    logicAppResourceId = "string"
    tenantId = "string"
  }
  actionType = "RunPlaybook"
}

Значения свойств

Microsoft.SecurityInsights/automationRules

AddIncidentTaskActionProperties

AutomationRuleAction

AutomationRuleAddIncidentTaskAction

AutomationRuleBooleanCondition

AutomationRuleCondition

AutomationRuleModifyPropertiesAction

AutomationRuleProperties

AutomationRulePropertyArrayChangedValuesCondition

AutomationRulePropertyArrayValuesCondition

AutomationRulePropertyValuesChangedCondition

AutomationRulePropertyValuesCondition

AutomationRuleRunPlaybookAction

AutomationRuleTriggeringLogic

BooleanConditionProperties

IncidentLabel

IncidentOwnerInfo

IncidentPropertiesAction

PlaybookActionProperties

PropertyArrayChangedConditionProperties

PropertyArrayConditionProperties

PropertyChangedConditionProperties

PropertyConditionProperties

Примеры использования

Примеры Terraform

Простой пример развертывания правила автоматизации Sentinel.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "workspace" {
  type      = "Microsoft.OperationalInsights/workspaces@2022-10-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    properties = {
      features = {
        disableLocalAuth                            = false
        enableLogAccessUsingOnlyResourcePermissions = true
      }
      publicNetworkAccessForIngestion = "Enabled"
      publicNetworkAccessForQuery     = "Enabled"
      retentionInDays                 = 30
      sku = {
        name = "PerGB2018"
      }
      workspaceCapping = {
        dailyQuotaGb = -1
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "onboardingState" {
  type      = "Microsoft.SecurityInsights/onboardingStates@2023-06-01-preview"
  parent_id = azapi_resource.workspace.id
  name      = "default"
  body = {
    properties = {
      customerManagedKey = false
    }
  }
}

resource "azapi_resource" "automationRule" {
  type      = "Microsoft.SecurityInsights/automationRules@2022-10-01-preview"
  parent_id = azapi_resource.workspace.id
  name      = "3b862818-ad7b-409e-83be-8812f2a06d37"
  body = {
    properties = {
      actions = [
        {
          actionConfiguration = {
            classification        = ""
            classificationComment = ""
            classificationReason  = ""
            severity              = ""
            status                = "Active"
          }
          actionType = "ModifyProperties"
          order      = 1
        },
      ]
      displayName = "acctest-SentinelAutoRule-230630033910945846"
      order       = 1
      triggeringLogic = {
        isEnabled    = true
        triggersOn   = "Incidents"
        triggersWhen = "Created"
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
  depends_on                = [azapi_resource.onboardingState]
}