Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a new kind of alert rules - NRT #15980

Merged
merged 8 commits into from
Oct 8, 2021
Merged

Add a new kind of alert rules - NRT #15980

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
4f55ee6
add NRT rule
necoh Sep 9, 2021
1d35865
add NRT rule
necoh Sep 9, 2021
6999abd
add NRT rule
necoh Sep 9, 2021
5b39876
add NRT rule
necoh Sep 9, 2021
75289e3
fix typo
necoh Sep 12, 2021
3a43573
fix typo
necoh Sep 12, 2021
8fbd8e7
add template version
necoh Sep 19, 2021
f66c4e9
fix
necoh Sep 30, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
195 changes: 159 additions & 36 deletions ...ts/resource-manager/Microsoft.SecurityInsights/preview/2021-09-01-preview/AlertRules.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,9 @@
"Get a Scheduled alert rule.": {
"$ref": "./examples/alertRules/GetScheduledAlertRule.json"
},
"Get an Nrt alert rule.": {
"$ref": "./examples/alertRules/GetNrtAlertRule.json"
},
"Get a Fusion alert rule.": {
"$ref": "./examples/alertRules/GetFusionAlertRule.json"
},
Expand Down Expand Up @@ -140,6 +143,9 @@
"Creates or updates a Scheduled alert rule.": {
"$ref": "./examples/alertRules/CreateScheduledAlertRule.json"
},
"Creates or updates a Nrt alert rule.": {
"$ref": "./examples/alertRules/CreateNrtAlertRule.json"
},
"Creates or updates a Fusion alert rule.": {
"$ref": "./examples/alertRules/CreateFusionAlertRule.json"
},
Expand Down Expand Up @@ -622,7 +628,8 @@
"MicrosoftSecurityIncidentCreation",
"Fusion",
"MLBehaviorAnalytics",
"ThreatIntelligence"
"ThreatIntelligence",
"NRT"
],
"type": "string",
"x-ms-enum": {
Expand All @@ -643,6 +650,9 @@
},
{
"value": "ThreatIntelligence"
},
{
"value": "NRT"
}
]
}
Expand Down Expand Up @@ -748,6 +758,47 @@
},
"type": "object"
},
"QueryBasedAlertRuleTemplateProperties": {
necoh marked this conversation as resolved.
Show resolved Hide resolved
"description": "Query based alert rule base property bag.",
necoh marked this conversation as resolved.
Show resolved Hide resolved
"properties": {
"query": {
"description": "The query that creates alerts for this rule.",
"type": "string"
},
"severity": {
"$ref": "./common/AlertTypes.json#/definitions/AlertSeverityEnum",
"description": "The severity for alerts created by this alert rule."
},
"tactics": {
"description": "The tactics of the alert rule",
"items": {
"$ref": "./common/AlertTypes.json#/definitions/AttackTactic"
},
"type": "array"
},
"version": {
"description": "The version of this template - in format <a.b.c>, where all are numbers. For example <1.0.2>.",
"type": "string"
},
"customDetails": {
"description": "Dictionary of string key-value pairs of columns to be attached to the alert",
"type": "object",
"additionalProperties": {
"type": "string"
}
},
"entityMappings": {
"$ref": "#/definitions/EntityMappings",
"description": "Array of the entity mappings of the alert rule"
},
"alertDetailsOverride": {
"type": "object",
"$ref": "#/definitions/AlertDetailsOverride",
"description": "The alert details override settings"
}
},
"type": "object"
},
"AlertRuleTemplatesList": {
"description": "List all the alert rule templates.",
"properties": {
Expand Down Expand Up @@ -1256,13 +1307,8 @@
"type": "object",
"x-ms-discriminator-value": "MicrosoftSecurityIncidentCreation"
},
"ScheduledAlertRuleProperties": {
"allOf": [
{
"$ref": "#/definitions/ScheduledAlertRuleCommonProperties"
}
],
"description": "Scheduled alert rule base property bag.",
"QueryBasedAlertRuleProperties": {
"description": "Query based alert rule base property bag.",
"properties": {
"alertRuleTemplateName": {
"description": "The Name of the alert rule template used to create this rule.",
Expand All @@ -1276,6 +1322,10 @@
"description": "The description of the alert rule.",
"type": "string"
},
"query": {
"description": "The query that creates alerts for this rule.",
"type": "string"
},
"displayName": {
"description": "The display name for alerts created by this alert rule.",
"type": "string"
Expand All @@ -1299,6 +1349,10 @@
"description": "Determines whether the suppression for this alert rule is enabled or disabled.",
"type": "boolean"
},
"severity": {
"$ref": "./common/AlertTypes.json#/definitions/AlertSeverityEnum",
"description": "The severity for alerts created by this alert rule."
},
"tactics": {
"description": "The tactics of the alert rule",
"items": {
Expand All @@ -1309,8 +1363,42 @@
"incidentConfiguration": {
"$ref": "#/definitions/IncidentConfiguration",
"description": "The settings of the incidents that created from alerts triggered by this analytics rule"
},
"customDetails": {
"description": "Dictionary of string key-value pairs of columns to be attached to the alert",
"type": "object",
"additionalProperties": {
"type": "string"
}
},
"entityMappings": {
"$ref": "#/definitions/EntityMappings",
"description": "Array of the entity mappings of the alert rule"
},
"alertDetailsOverride": {
"type": "object",
"$ref": "#/definitions/AlertDetailsOverride",
"description": "The alert details override settings"
}
},
"required": [
"displayName",
"enabled",
"suppressionEnabled",
"suppressionDuration"
],
"type": "object"
},
"ScheduledAlertRuleProperties": {
"allOf": [
{
"$ref": "#/definitions/ScheduledAlertRuleCommonProperties"
},
{
"$ref": "#/definitions/QueryBasedAlertRuleProperties"
}
],
"description": "Scheduled alert rule base property bag.",
"required": [
"displayName",
"enabled",
Expand All @@ -1325,6 +1413,15 @@
],
"type": "object"
},
"NrtAlertRuleProperties": {
"allOf": [
{
"$ref": "#/definitions/QueryBasedAlertRuleProperties"
}
],
"description": "Nrt alert rule base property bag.",
"type": "object"
},
"ScheduledAlertRuleTemplate": {
"allOf": [
{
Expand All @@ -1338,6 +1435,9 @@
{
"$ref": "#/definitions/AlertRuleTemplatePropertiesBase"
},
{
"$ref": "#/definitions/QueryBasedAlertRuleTemplateProperties"
},
{
"$ref": "#/definitions/ScheduledAlertRuleCommonProperties"
}
Comment on lines 1435 to 1443
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These kind of unnamed schema and multiple "allOf" section nested multiple layers usually not working well with SDK. If you don't need the SDK then they are fine.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@weidongxu-microsoft ,
As far as we understood, these multiple "allOf"s in the properties object do not create inheritance but union of those properties. The purpose is to avoid code duplication(instead of duplicate those common fields in several places).
We've generated C# classes and it looks fine.

Copy link
Member

@weidongxu-microsoft weidongxu-microsoft Oct 1, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In this particular case, x-ms-client-flatten flatten all these hierarchies into the flat properties within ScheduledAlertRuleTemplate, so you are probably safe. But in other case you are likely getting meaningless class name or breaking changes on class name in future.

This is a suggestion. You are OK to ignore, as your are in preview version anyway.

Expand All @@ -1350,10 +1450,6 @@
"$ref": "./common/AlertTypes.json#/definitions/AttackTactic"
},
"type": "array"
},
"version": {
"description": "The version of this template - in format <a.b.c>, where all are numbers. For example <1.0.2>.",
"type": "string"
}
},
"required": [
Expand All @@ -1376,6 +1472,40 @@
"type": "object",
"x-ms-discriminator-value": "Scheduled"
},
"NrtAlertRuleTemplate": {
"allOf": [
{
"$ref": "#/definitions/AlertRuleTemplate"
}
],
"description": "Represents NRT alert rule template.",
"properties": {
"properties": {
"allOf": [
{
"$ref": "#/definitions/AlertRuleTemplatePropertiesBase"
},
{
"$ref": "#/definitions/QueryBasedAlertRuleTemplateProperties"
}
],
"description": "NRT alert rule template properties",
"required": [
"displayName",
"description",
"status",
"alertRulesCreatedByTemplateCount",
"severity",
"query",
"version"
],
"type": "object",
"x-ms-client-flatten": true
}
},
"type": "object",
"x-ms-discriminator-value": "NRT"
},
"EventGroupingSettings": {
"description": "Event grouping settings property bag.",
"properties": {
Expand Down Expand Up @@ -1414,13 +1544,26 @@
"type": "object",
"x-ms-discriminator-value": "Scheduled"
},
"NrtAlertRule": {
"allOf": [
{
"$ref": "#/definitions/AlertRule"
}
],
"description": "Represents NRT alert rule.",
"properties": {
"properties": {
"$ref": "#/definitions/NrtAlertRuleProperties",
"description": "NRT alert rule properties",
"x-ms-client-flatten": true
}
},
"type": "object",
"x-ms-discriminator-value": "NRT"
},
"ScheduledAlertRuleCommonProperties": {
"description": "Scheduled alert rule template property bag.",
"properties": {
"query": {
"description": "The query that creates alerts for this rule.",
"type": "string"
},
"queryFrequency": {
"description": "The frequency (in ISO 8601 duration format) for this alert rule to run.",
"format": "duration",
Expand All @@ -1431,10 +1574,6 @@
"format": "duration",
"type": "string"
},
"severity": {
"$ref": "./common/AlertTypes.json#/definitions/AlertSeverityEnum",
"description": "The severity for alerts created by this alert rule."
},
"triggerOperator": {
"$ref": "#/definitions/AlertRuleTriggerOperator",
"description": "The operation against the threshold that triggers alert rule."
Expand All @@ -1447,22 +1586,6 @@
"eventGroupingSettings": {
"$ref": "#/definitions/EventGroupingSettings",
"description": "The event grouping settings."
},
"customDetails": {
"description": "Dictionary of string key-value pairs of columns to be attached to the alert",
"type": "object",
"additionalProperties": {
"type": "string"
}
},
"entityMappings": {
"$ref": "#/definitions/EntityMappings",
"description": "Array of the entity mappings of the alert rule"
},
"alertDetailsOverride": {
"type": "object",
"$ref": "#/definitions/AlertDetailsOverride",
"description": "The alert details override settings"
}
},
"type": "object"
Expand Down
Loading