diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ActionsOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ActionsOperations.cs
index 8c0055f2654db..44c5dc6e767ae 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ActionsOperations.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ActionsOperations.cs
@@ -54,8 +54,7 @@ internal ActionsOperations(SecurityInsightsClient client)
         /// Gets all actions of alert rule.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -69,7 +68,7 @@ internal ActionsOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -86,15 +85,26 @@ internal ActionsOperations(SecurityInsightsClient client)
         /// </return>
         public async Task<AzureOperationResponse<IPage<ActionResponse>>> ListByAlertRuleWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string ruleId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -111,10 +121,6 @@ internal ActionsOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -220,14 +226,13 @@ internal ActionsOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -237,10 +242,6 @@ internal ActionsOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -289,8 +290,7 @@ internal ActionsOperations(SecurityInsightsClient client)
         /// Gets the action of alert rule.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -307,7 +307,7 @@ internal ActionsOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -324,15 +324,26 @@ internal ActionsOperations(SecurityInsightsClient client)
         /// </return>
         public async Task<AzureOperationResponse<ActionResponse>> GetWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string ruleId, string actionId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -349,10 +360,6 @@ internal ActionsOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -464,14 +471,13 @@ internal ActionsOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -481,10 +487,6 @@ internal ActionsOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -533,8 +535,7 @@ internal ActionsOperations(SecurityInsightsClient client)
         /// Creates or updates the action of alert rule.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -554,7 +555,7 @@ internal ActionsOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -571,15 +572,26 @@ internal ActionsOperations(SecurityInsightsClient client)
         /// </return>
         public async Task<AzureOperationResponse<ActionResponse>> CreateOrUpdateWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string ruleId, string actionId, ActionRequest action, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -596,10 +608,6 @@ internal ActionsOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -726,14 +734,13 @@ internal ActionsOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200 && (int)_statusCode != 201)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -743,10 +750,6 @@ internal ActionsOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -813,8 +816,7 @@ internal ActionsOperations(SecurityInsightsClient client)
         /// Delete the action of alert rule.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -831,7 +833,7 @@ internal ActionsOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="ValidationException">
@@ -845,15 +847,26 @@ internal ActionsOperations(SecurityInsightsClient client)
         /// </return>
         public async Task<AzureOperationResponse> DeleteWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string ruleId, string actionId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -870,10 +883,6 @@ internal ActionsOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -985,14 +994,13 @@ internal ActionsOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200 && (int)_statusCode != 204)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -1002,10 +1010,6 @@ internal ActionsOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -1044,7 +1048,7 @@ internal ActionsOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -1140,14 +1144,13 @@ internal ActionsOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -1157,10 +1160,6 @@ internal ActionsOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ActionsOperationsExtensions.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ActionsOperationsExtensions.cs
index 2d58d876af271..acea07a714f04 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ActionsOperationsExtensions.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ActionsOperationsExtensions.cs
@@ -28,8 +28,7 @@ public static partial class ActionsOperationsExtensions
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -49,8 +48,7 @@ public static IPage<ActionResponse> ListByAlertRule(this IActionsOperations oper
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -76,8 +74,7 @@ public static IPage<ActionResponse> ListByAlertRule(this IActionsOperations oper
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -100,8 +97,7 @@ public static ActionResponse Get(this IActionsOperations operations, string reso
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -130,8 +126,7 @@ public static ActionResponse Get(this IActionsOperations operations, string reso
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -157,8 +152,7 @@ public static ActionResponse CreateOrUpdate(this IActionsOperations operations,
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -190,8 +184,7 @@ public static ActionResponse CreateOrUpdate(this IActionsOperations operations,
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -214,8 +207,7 @@ public static void Delete(this IActionsOperations operations, string resourceGro
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/AlertRuleTemplatesOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/AlertRuleTemplatesOperations.cs
index f7c4e5f1d8e1e..79826efb27b97 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/AlertRuleTemplatesOperations.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/AlertRuleTemplatesOperations.cs
@@ -54,8 +54,7 @@ internal AlertRuleTemplatesOperations(SecurityInsightsClient client)
         /// Gets all alert rule templates.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -66,7 +65,7 @@ internal AlertRuleTemplatesOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -83,15 +82,26 @@ internal AlertRuleTemplatesOperations(SecurityInsightsClient client)
         /// </return>
         public async Task<AzureOperationResponse<IPage<AlertRuleTemplate>>> ListWithHttpMessagesAsync(string resourceGroupName, string workspaceName, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -108,10 +118,6 @@ internal AlertRuleTemplatesOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -211,14 +217,13 @@ internal AlertRuleTemplatesOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -228,10 +233,6 @@ internal AlertRuleTemplatesOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -280,8 +281,7 @@ internal AlertRuleTemplatesOperations(SecurityInsightsClient client)
         /// Gets the alert rule template.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -295,7 +295,7 @@ internal AlertRuleTemplatesOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -312,15 +312,26 @@ internal AlertRuleTemplatesOperations(SecurityInsightsClient client)
         /// </return>
         public async Task<AzureOperationResponse<AlertRuleTemplate>> GetWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string alertRuleTemplateId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -337,10 +348,6 @@ internal AlertRuleTemplatesOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -446,14 +453,13 @@ internal AlertRuleTemplatesOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -463,10 +469,6 @@ internal AlertRuleTemplatesOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -523,7 +525,7 @@ internal AlertRuleTemplatesOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -619,14 +621,13 @@ internal AlertRuleTemplatesOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -636,10 +637,6 @@ internal AlertRuleTemplatesOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/AlertRuleTemplatesOperationsExtensions.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/AlertRuleTemplatesOperationsExtensions.cs
index 8db2e5377500c..fdd5d9d5f7e8c 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/AlertRuleTemplatesOperationsExtensions.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/AlertRuleTemplatesOperationsExtensions.cs
@@ -28,8 +28,7 @@ public static partial class AlertRuleTemplatesOperationsExtensions
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -46,8 +45,7 @@ public static IPage<AlertRuleTemplate> List(this IAlertRuleTemplatesOperations o
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -70,8 +68,7 @@ public static IPage<AlertRuleTemplate> List(this IAlertRuleTemplatesOperations o
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -91,8 +88,7 @@ public static AlertRuleTemplate Get(this IAlertRuleTemplatesOperations operation
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/AlertRulesOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/AlertRulesOperations.cs
index 81b3fcd83e961..6847fc261f900 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/AlertRulesOperations.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/AlertRulesOperations.cs
@@ -54,8 +54,7 @@ internal AlertRulesOperations(SecurityInsightsClient client)
         /// Gets all alert rules.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -66,7 +65,7 @@ internal AlertRulesOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -83,15 +82,26 @@ internal AlertRulesOperations(SecurityInsightsClient client)
         /// </return>
         public async Task<AzureOperationResponse<IPage<AlertRule>>> ListWithHttpMessagesAsync(string resourceGroupName, string workspaceName, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -108,10 +118,6 @@ internal AlertRulesOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -211,14 +217,13 @@ internal AlertRulesOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -228,10 +233,6 @@ internal AlertRulesOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -280,8 +281,7 @@ internal AlertRulesOperations(SecurityInsightsClient client)
         /// Gets the alert rule.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -295,7 +295,7 @@ internal AlertRulesOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -312,15 +312,26 @@ internal AlertRulesOperations(SecurityInsightsClient client)
         /// </return>
         public async Task<AzureOperationResponse<AlertRule>> GetWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string ruleId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -337,10 +348,6 @@ internal AlertRulesOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -446,14 +453,13 @@ internal AlertRulesOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -463,10 +469,6 @@ internal AlertRulesOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -515,8 +517,7 @@ internal AlertRulesOperations(SecurityInsightsClient client)
         /// Creates or updates the alert rule.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -533,7 +534,7 @@ internal AlertRulesOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -550,15 +551,26 @@ internal AlertRulesOperations(SecurityInsightsClient client)
         /// </return>
         public async Task<AzureOperationResponse<AlertRule>> CreateOrUpdateWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string ruleId, AlertRule alertRule, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -575,10 +587,6 @@ internal AlertRulesOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -695,14 +703,13 @@ internal AlertRulesOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200 && (int)_statusCode != 201)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -712,10 +719,6 @@ internal AlertRulesOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -782,8 +785,7 @@ internal AlertRulesOperations(SecurityInsightsClient client)
         /// Delete the alert rule.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -797,7 +799,7 @@ internal AlertRulesOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="ValidationException">
@@ -811,15 +813,26 @@ internal AlertRulesOperations(SecurityInsightsClient client)
         /// </return>
         public async Task<AzureOperationResponse> DeleteWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string ruleId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -836,10 +849,6 @@ internal AlertRulesOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -945,14 +954,13 @@ internal AlertRulesOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200 && (int)_statusCode != 204)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -962,10 +970,6 @@ internal AlertRulesOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -1004,7 +1008,7 @@ internal AlertRulesOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -1100,14 +1104,13 @@ internal AlertRulesOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -1117,10 +1120,6 @@ internal AlertRulesOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/AlertRulesOperationsExtensions.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/AlertRulesOperationsExtensions.cs
index 9aa94cc42f9dd..a6cb51c14cabe 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/AlertRulesOperationsExtensions.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/AlertRulesOperationsExtensions.cs
@@ -28,8 +28,7 @@ public static partial class AlertRulesOperationsExtensions
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -46,8 +45,7 @@ public static IPage<AlertRule> List(this IAlertRulesOperations operations, strin
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -70,8 +68,7 @@ public static IPage<AlertRule> List(this IAlertRulesOperations operations, strin
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -91,8 +88,7 @@ public static AlertRule Get(this IAlertRulesOperations operations, string resour
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -118,8 +114,7 @@ public static AlertRule Get(this IAlertRulesOperations operations, string resour
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -142,8 +137,7 @@ public static AlertRule CreateOrUpdate(this IAlertRulesOperations operations, st
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -172,8 +166,7 @@ public static AlertRule CreateOrUpdate(this IAlertRulesOperations operations, st
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -193,8 +186,7 @@ public static void Delete(this IAlertRulesOperations operations, string resource
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/BookmarksOperationsExtensions.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/BookmarksOperationsExtensions.cs
deleted file mode 100644
index 00b4bf29cc5ad..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/BookmarksOperationsExtensions.cs
+++ /dev/null
@@ -1,248 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights
-{
-    using Microsoft.Rest;
-    using Microsoft.Rest.Azure;
-    using Models;
-    using System.Threading;
-    using System.Threading.Tasks;
-
-    /// <summary>
-    /// Extension methods for BookmarksOperations.
-    /// </summary>
-    public static partial class BookmarksOperationsExtensions
-    {
-            /// <summary>
-            /// Gets all bookmarks.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
-            /// </param>
-            /// <param name='workspaceName'>
-            /// The name of the workspace.
-            /// </param>
-            public static IPage<Bookmark> List(this IBookmarksOperations operations, string resourceGroupName, string workspaceName)
-            {
-                return operations.ListAsync(resourceGroupName, workspaceName).GetAwaiter().GetResult();
-            }
-
-            /// <summary>
-            /// Gets all bookmarks.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
-            /// </param>
-            /// <param name='workspaceName'>
-            /// The name of the workspace.
-            /// </param>
-            /// <param name='cancellationToken'>
-            /// The cancellation token.
-            /// </param>
-            public static async Task<IPage<Bookmark>> ListAsync(this IBookmarksOperations operations, string resourceGroupName, string workspaceName, CancellationToken cancellationToken = default(CancellationToken))
-            {
-                using (var _result = await operations.ListWithHttpMessagesAsync(resourceGroupName, workspaceName, null, cancellationToken).ConfigureAwait(false))
-                {
-                    return _result.Body;
-                }
-            }
-
-            /// <summary>
-            /// Gets a bookmark.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
-            /// </param>
-            /// <param name='workspaceName'>
-            /// The name of the workspace.
-            /// </param>
-            /// <param name='bookmarkId'>
-            /// Bookmark ID
-            /// </param>
-            public static Bookmark Get(this IBookmarksOperations operations, string resourceGroupName, string workspaceName, string bookmarkId)
-            {
-                return operations.GetAsync(resourceGroupName, workspaceName, bookmarkId).GetAwaiter().GetResult();
-            }
-
-            /// <summary>
-            /// Gets a bookmark.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
-            /// </param>
-            /// <param name='workspaceName'>
-            /// The name of the workspace.
-            /// </param>
-            /// <param name='bookmarkId'>
-            /// Bookmark ID
-            /// </param>
-            /// <param name='cancellationToken'>
-            /// The cancellation token.
-            /// </param>
-            public static async Task<Bookmark> GetAsync(this IBookmarksOperations operations, string resourceGroupName, string workspaceName, string bookmarkId, CancellationToken cancellationToken = default(CancellationToken))
-            {
-                using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, workspaceName, bookmarkId, null, cancellationToken).ConfigureAwait(false))
-                {
-                    return _result.Body;
-                }
-            }
-
-            /// <summary>
-            /// Creates or updates the bookmark.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
-            /// </param>
-            /// <param name='workspaceName'>
-            /// The name of the workspace.
-            /// </param>
-            /// <param name='bookmarkId'>
-            /// Bookmark ID
-            /// </param>
-            /// <param name='bookmark'>
-            /// The bookmark
-            /// </param>
-            public static Bookmark CreateOrUpdate(this IBookmarksOperations operations, string resourceGroupName, string workspaceName, string bookmarkId, Bookmark bookmark)
-            {
-                return operations.CreateOrUpdateAsync(resourceGroupName, workspaceName, bookmarkId, bookmark).GetAwaiter().GetResult();
-            }
-
-            /// <summary>
-            /// Creates or updates the bookmark.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
-            /// </param>
-            /// <param name='workspaceName'>
-            /// The name of the workspace.
-            /// </param>
-            /// <param name='bookmarkId'>
-            /// Bookmark ID
-            /// </param>
-            /// <param name='bookmark'>
-            /// The bookmark
-            /// </param>
-            /// <param name='cancellationToken'>
-            /// The cancellation token.
-            /// </param>
-            public static async Task<Bookmark> CreateOrUpdateAsync(this IBookmarksOperations operations, string resourceGroupName, string workspaceName, string bookmarkId, Bookmark bookmark, CancellationToken cancellationToken = default(CancellationToken))
-            {
-                using (var _result = await operations.CreateOrUpdateWithHttpMessagesAsync(resourceGroupName, workspaceName, bookmarkId, bookmark, null, cancellationToken).ConfigureAwait(false))
-                {
-                    return _result.Body;
-                }
-            }
-
-            /// <summary>
-            /// Delete the bookmark.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
-            /// </param>
-            /// <param name='workspaceName'>
-            /// The name of the workspace.
-            /// </param>
-            /// <param name='bookmarkId'>
-            /// Bookmark ID
-            /// </param>
-            public static void Delete(this IBookmarksOperations operations, string resourceGroupName, string workspaceName, string bookmarkId)
-            {
-                operations.DeleteAsync(resourceGroupName, workspaceName, bookmarkId).GetAwaiter().GetResult();
-            }
-
-            /// <summary>
-            /// Delete the bookmark.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
-            /// </param>
-            /// <param name='workspaceName'>
-            /// The name of the workspace.
-            /// </param>
-            /// <param name='bookmarkId'>
-            /// Bookmark ID
-            /// </param>
-            /// <param name='cancellationToken'>
-            /// The cancellation token.
-            /// </param>
-            public static async Task DeleteAsync(this IBookmarksOperations operations, string resourceGroupName, string workspaceName, string bookmarkId, CancellationToken cancellationToken = default(CancellationToken))
-            {
-                (await operations.DeleteWithHttpMessagesAsync(resourceGroupName, workspaceName, bookmarkId, null, cancellationToken).ConfigureAwait(false)).Dispose();
-            }
-
-            /// <summary>
-            /// Gets all bookmarks.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='nextPageLink'>
-            /// The NextLink from the previous successful call to List operation.
-            /// </param>
-            public static IPage<Bookmark> ListNext(this IBookmarksOperations operations, string nextPageLink)
-            {
-                return operations.ListNextAsync(nextPageLink).GetAwaiter().GetResult();
-            }
-
-            /// <summary>
-            /// Gets all bookmarks.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='nextPageLink'>
-            /// The NextLink from the previous successful call to List operation.
-            /// </param>
-            /// <param name='cancellationToken'>
-            /// The cancellation token.
-            /// </param>
-            public static async Task<IPage<Bookmark>> ListNextAsync(this IBookmarksOperations operations, string nextPageLink, CancellationToken cancellationToken = default(CancellationToken))
-            {
-                using (var _result = await operations.ListNextWithHttpMessagesAsync(nextPageLink, null, cancellationToken).ConfigureAwait(false))
-                {
-                    return _result.Body;
-                }
-            }
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/DataConnectorsOperationsExtensions.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/DataConnectorsOperationsExtensions.cs
deleted file mode 100644
index 63790d1dae244..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/DataConnectorsOperationsExtensions.cs
+++ /dev/null
@@ -1,248 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights
-{
-    using Microsoft.Rest;
-    using Microsoft.Rest.Azure;
-    using Models;
-    using System.Threading;
-    using System.Threading.Tasks;
-
-    /// <summary>
-    /// Extension methods for DataConnectorsOperations.
-    /// </summary>
-    public static partial class DataConnectorsOperationsExtensions
-    {
-            /// <summary>
-            /// Gets all data connectors.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
-            /// </param>
-            /// <param name='workspaceName'>
-            /// The name of the workspace.
-            /// </param>
-            public static IPage<DataConnector> List(this IDataConnectorsOperations operations, string resourceGroupName, string workspaceName)
-            {
-                return operations.ListAsync(resourceGroupName, workspaceName).GetAwaiter().GetResult();
-            }
-
-            /// <summary>
-            /// Gets all data connectors.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
-            /// </param>
-            /// <param name='workspaceName'>
-            /// The name of the workspace.
-            /// </param>
-            /// <param name='cancellationToken'>
-            /// The cancellation token.
-            /// </param>
-            public static async Task<IPage<DataConnector>> ListAsync(this IDataConnectorsOperations operations, string resourceGroupName, string workspaceName, CancellationToken cancellationToken = default(CancellationToken))
-            {
-                using (var _result = await operations.ListWithHttpMessagesAsync(resourceGroupName, workspaceName, null, cancellationToken).ConfigureAwait(false))
-                {
-                    return _result.Body;
-                }
-            }
-
-            /// <summary>
-            /// Gets a data connector.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
-            /// </param>
-            /// <param name='workspaceName'>
-            /// The name of the workspace.
-            /// </param>
-            /// <param name='dataConnectorId'>
-            /// Connector ID
-            /// </param>
-            public static DataConnector Get(this IDataConnectorsOperations operations, string resourceGroupName, string workspaceName, string dataConnectorId)
-            {
-                return operations.GetAsync(resourceGroupName, workspaceName, dataConnectorId).GetAwaiter().GetResult();
-            }
-
-            /// <summary>
-            /// Gets a data connector.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
-            /// </param>
-            /// <param name='workspaceName'>
-            /// The name of the workspace.
-            /// </param>
-            /// <param name='dataConnectorId'>
-            /// Connector ID
-            /// </param>
-            /// <param name='cancellationToken'>
-            /// The cancellation token.
-            /// </param>
-            public static async Task<DataConnector> GetAsync(this IDataConnectorsOperations operations, string resourceGroupName, string workspaceName, string dataConnectorId, CancellationToken cancellationToken = default(CancellationToken))
-            {
-                using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, workspaceName, dataConnectorId, null, cancellationToken).ConfigureAwait(false))
-                {
-                    return _result.Body;
-                }
-            }
-
-            /// <summary>
-            /// Creates or updates the data connector.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
-            /// </param>
-            /// <param name='workspaceName'>
-            /// The name of the workspace.
-            /// </param>
-            /// <param name='dataConnectorId'>
-            /// Connector ID
-            /// </param>
-            /// <param name='dataConnector'>
-            /// The data connector
-            /// </param>
-            public static DataConnector CreateOrUpdate(this IDataConnectorsOperations operations, string resourceGroupName, string workspaceName, string dataConnectorId, DataConnector dataConnector)
-            {
-                return operations.CreateOrUpdateAsync(resourceGroupName, workspaceName, dataConnectorId, dataConnector).GetAwaiter().GetResult();
-            }
-
-            /// <summary>
-            /// Creates or updates the data connector.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
-            /// </param>
-            /// <param name='workspaceName'>
-            /// The name of the workspace.
-            /// </param>
-            /// <param name='dataConnectorId'>
-            /// Connector ID
-            /// </param>
-            /// <param name='dataConnector'>
-            /// The data connector
-            /// </param>
-            /// <param name='cancellationToken'>
-            /// The cancellation token.
-            /// </param>
-            public static async Task<DataConnector> CreateOrUpdateAsync(this IDataConnectorsOperations operations, string resourceGroupName, string workspaceName, string dataConnectorId, DataConnector dataConnector, CancellationToken cancellationToken = default(CancellationToken))
-            {
-                using (var _result = await operations.CreateOrUpdateWithHttpMessagesAsync(resourceGroupName, workspaceName, dataConnectorId, dataConnector, null, cancellationToken).ConfigureAwait(false))
-                {
-                    return _result.Body;
-                }
-            }
-
-            /// <summary>
-            /// Delete the data connector.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
-            /// </param>
-            /// <param name='workspaceName'>
-            /// The name of the workspace.
-            /// </param>
-            /// <param name='dataConnectorId'>
-            /// Connector ID
-            /// </param>
-            public static void Delete(this IDataConnectorsOperations operations, string resourceGroupName, string workspaceName, string dataConnectorId)
-            {
-                operations.DeleteAsync(resourceGroupName, workspaceName, dataConnectorId).GetAwaiter().GetResult();
-            }
-
-            /// <summary>
-            /// Delete the data connector.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
-            /// </param>
-            /// <param name='workspaceName'>
-            /// The name of the workspace.
-            /// </param>
-            /// <param name='dataConnectorId'>
-            /// Connector ID
-            /// </param>
-            /// <param name='cancellationToken'>
-            /// The cancellation token.
-            /// </param>
-            public static async Task DeleteAsync(this IDataConnectorsOperations operations, string resourceGroupName, string workspaceName, string dataConnectorId, CancellationToken cancellationToken = default(CancellationToken))
-            {
-                (await operations.DeleteWithHttpMessagesAsync(resourceGroupName, workspaceName, dataConnectorId, null, cancellationToken).ConfigureAwait(false)).Dispose();
-            }
-
-            /// <summary>
-            /// Gets all data connectors.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='nextPageLink'>
-            /// The NextLink from the previous successful call to List operation.
-            /// </param>
-            public static IPage<DataConnector> ListNext(this IDataConnectorsOperations operations, string nextPageLink)
-            {
-                return operations.ListNextAsync(nextPageLink).GetAwaiter().GetResult();
-            }
-
-            /// <summary>
-            /// Gets all data connectors.
-            /// </summary>
-            /// <param name='operations'>
-            /// The operations group for this extension method.
-            /// </param>
-            /// <param name='nextPageLink'>
-            /// The NextLink from the previous successful call to List operation.
-            /// </param>
-            /// <param name='cancellationToken'>
-            /// The cancellation token.
-            /// </param>
-            public static async Task<IPage<DataConnector>> ListNextAsync(this IDataConnectorsOperations operations, string nextPageLink, CancellationToken cancellationToken = default(CancellationToken))
-            {
-                using (var _result = await operations.ListNextWithHttpMessagesAsync(nextPageLink, null, cancellationToken).ConfigureAwait(false))
-                {
-                    return _result.Body;
-                }
-            }
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IActionsOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IActionsOperations.cs
index f42d11eaf67f9..600f56ce88f51 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IActionsOperations.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IActionsOperations.cs
@@ -27,8 +27,7 @@ public partial interface IActionsOperations
         /// Gets all actions of alert rule.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -42,7 +41,7 @@ public partial interface IActionsOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -56,8 +55,7 @@ public partial interface IActionsOperations
         /// Gets the action of alert rule.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -74,7 +72,7 @@ public partial interface IActionsOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -88,8 +86,7 @@ public partial interface IActionsOperations
         /// Creates or updates the action of alert rule.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -109,7 +106,7 @@ public partial interface IActionsOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -123,8 +120,7 @@ public partial interface IActionsOperations
         /// Delete the action of alert rule.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -141,7 +137,7 @@ public partial interface IActionsOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.ValidationException">
@@ -160,7 +156,7 @@ public partial interface IActionsOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IAlertRuleTemplatesOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IAlertRuleTemplatesOperations.cs
index 0ad2eb676cff9..51aa9a0d54484 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IAlertRuleTemplatesOperations.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IAlertRuleTemplatesOperations.cs
@@ -27,8 +27,7 @@ public partial interface IAlertRuleTemplatesOperations
         /// Gets all alert rule templates.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -39,7 +38,7 @@ public partial interface IAlertRuleTemplatesOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -53,8 +52,7 @@ public partial interface IAlertRuleTemplatesOperations
         /// Gets the alert rule template.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -68,7 +66,7 @@ public partial interface IAlertRuleTemplatesOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -90,7 +88,7 @@ public partial interface IAlertRuleTemplatesOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IAlertRulesOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IAlertRulesOperations.cs
index cf07ca8d976fa..43ed4229a82c4 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IAlertRulesOperations.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IAlertRulesOperations.cs
@@ -27,8 +27,7 @@ public partial interface IAlertRulesOperations
         /// Gets all alert rules.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -39,7 +38,7 @@ public partial interface IAlertRulesOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -53,8 +52,7 @@ public partial interface IAlertRulesOperations
         /// Gets the alert rule.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -68,7 +66,7 @@ public partial interface IAlertRulesOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -82,8 +80,7 @@ public partial interface IAlertRulesOperations
         /// Creates or updates the alert rule.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -100,7 +97,7 @@ public partial interface IAlertRulesOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -114,8 +111,7 @@ public partial interface IAlertRulesOperations
         /// Delete the alert rule.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -129,7 +125,7 @@ public partial interface IAlertRulesOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.ValidationException">
@@ -148,7 +144,7 @@ public partial interface IAlertRulesOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IIncidentCommentsOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IIncidentCommentsOperations.cs
index b631e37547e1e..e858d5a733985 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IIncidentCommentsOperations.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IIncidentCommentsOperations.cs
@@ -25,11 +25,10 @@ namespace Microsoft.Azure.Management.SecurityInsights
     public partial interface IIncidentCommentsOperations
     {
         /// <summary>
-        /// Gets all incident comments.
+        /// Gets all comments for a given incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -53,7 +52,7 @@ public partial interface IIncidentCommentsOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -64,11 +63,10 @@ public partial interface IIncidentCommentsOperations
         /// </exception>
         Task<AzureOperationResponse<IPage<IncidentComment>>> ListByIncidentWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, ODataQuery<IncidentComment> odataQuery = default(ODataQuery<IncidentComment>), string skipToken = default(string), Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
         /// <summary>
-        /// Gets an incident comment.
+        /// Gets a comment for a given incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -85,7 +83,7 @@ public partial interface IIncidentCommentsOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -96,11 +94,10 @@ public partial interface IIncidentCommentsOperations
         /// </exception>
         Task<AzureOperationResponse<IncidentComment>> GetWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, string incidentCommentId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
         /// <summary>
-        /// Creates the incident comment.
+        /// Creates or updates a comment for a given incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -114,13 +111,16 @@ public partial interface IIncidentCommentsOperations
         /// <param name='message'>
         /// The comment message
         /// </param>
+        /// <param name='etag'>
+        /// Etag of the azure resource
+        /// </param>
         /// <param name='customHeaders'>
         /// The headers that will be added to request.
         /// </param>
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -129,9 +129,37 @@ public partial interface IIncidentCommentsOperations
         /// <exception cref="Microsoft.Rest.ValidationException">
         /// Thrown when a required parameter is null
         /// </exception>
-        Task<AzureOperationResponse<IncidentComment>> CreateCommentWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, string incidentCommentId, string message, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        Task<AzureOperationResponse<IncidentComment>> CreateCommentWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, string incidentCommentId, string message, string etag = default(string), Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        /// <summary>
+        /// Deletes a comment for a given incident.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='incidentId'>
+        /// Incident ID
+        /// </param>
+        /// <param name='incidentCommentId'>
+        /// Incident comment ID
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse> DeleteCommentWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, string incidentCommentId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
         /// <summary>
-        /// Gets all incident comments.
+        /// Gets all comments for a given incident.
         /// </summary>
         /// <param name='nextPageLink'>
         /// The NextLink from the previous successful call to List operation.
@@ -142,7 +170,7 @@ public partial interface IIncidentCommentsOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IBookmarksOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IIncidentRelationsOperations.cs
similarity index 58%
rename from sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IBookmarksOperations.cs
rename to sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IIncidentRelationsOperations.cs
index 13d1d9379a05e..439674e147faa 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IBookmarksOperations.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IIncidentRelationsOperations.cs
@@ -12,6 +12,7 @@ namespace Microsoft.Azure.Management.SecurityInsights
 {
     using Microsoft.Rest;
     using Microsoft.Rest.Azure;
+    using Microsoft.Rest.Azure.OData;
     using Models;
     using System.Collections;
     using System.Collections.Generic;
@@ -19,27 +20,39 @@ namespace Microsoft.Azure.Management.SecurityInsights
     using System.Threading.Tasks;
 
     /// <summary>
-    /// BookmarksOperations operations.
+    /// IncidentRelationsOperations operations.
     /// </summary>
-    public partial interface IBookmarksOperations
+    public partial interface IIncidentRelationsOperations
     {
         /// <summary>
-        /// Gets all bookmarks.
+        /// Gets all relations for a given incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
         /// </param>
+        /// <param name='incidentId'>
+        /// Incident ID
+        /// </param>
+        /// <param name='odataQuery'>
+        /// OData parameters to apply to the operation.
+        /// </param>
+        /// <param name='skipToken'>
+        /// Skiptoken is only used if a previous operation returned a partial
+        /// result. If a previous response contains a nextLink element, the
+        /// value of the nextLink element will include a skiptoken parameter
+        /// that specifies a starting point to use for subsequent calls.
+        /// Optional.
+        /// </param>
         /// <param name='customHeaders'>
         /// The headers that will be added to request.
         /// </param>
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -48,19 +61,21 @@ public partial interface IBookmarksOperations
         /// <exception cref="Microsoft.Rest.ValidationException">
         /// Thrown when a required parameter is null
         /// </exception>
-        Task<AzureOperationResponse<IPage<Bookmark>>> ListWithHttpMessagesAsync(string resourceGroupName, string workspaceName, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        Task<AzureOperationResponse<IPage<Relation>>> ListWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, ODataQuery<Relation> odataQuery = default(ODataQuery<Relation>), string skipToken = default(string), Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
         /// <summary>
-        /// Gets a bookmark.
+        /// Gets a relation for a given incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
         /// </param>
-        /// <param name='bookmarkId'>
-        /// Bookmark ID
+        /// <param name='incidentId'>
+        /// Incident ID
+        /// </param>
+        /// <param name='relationName'>
+        /// Relation Name
         /// </param>
         /// <param name='customHeaders'>
         /// The headers that will be added to request.
@@ -68,7 +83,7 @@ public partial interface IBookmarksOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -77,22 +92,27 @@ public partial interface IBookmarksOperations
         /// <exception cref="Microsoft.Rest.ValidationException">
         /// Thrown when a required parameter is null
         /// </exception>
-        Task<AzureOperationResponse<Bookmark>> GetWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string bookmarkId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        Task<AzureOperationResponse<Relation>> GetRelationWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, string relationName, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
         /// <summary>
-        /// Creates or updates the bookmark.
+        /// Creates or updates a relation for a given incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
         /// </param>
-        /// <param name='bookmarkId'>
-        /// Bookmark ID
+        /// <param name='incidentId'>
+        /// Incident ID
         /// </param>
-        /// <param name='bookmark'>
-        /// The bookmark
+        /// <param name='relationName'>
+        /// Relation Name
+        /// </param>
+        /// <param name='relatedResourceId'>
+        /// The resource ID of the related resource
+        /// </param>
+        /// <param name='etag'>
+        /// Etag of the azure resource
         /// </param>
         /// <param name='customHeaders'>
         /// The headers that will be added to request.
@@ -100,7 +120,7 @@ public partial interface IBookmarksOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -109,19 +129,21 @@ public partial interface IBookmarksOperations
         /// <exception cref="Microsoft.Rest.ValidationException">
         /// Thrown when a required parameter is null
         /// </exception>
-        Task<AzureOperationResponse<Bookmark>> CreateOrUpdateWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string bookmarkId, Bookmark bookmark, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        Task<AzureOperationResponse<Relation>> CreateOrUpdateRelationWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, string relationName, string relatedResourceId, string etag = default(string), Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
         /// <summary>
-        /// Delete the bookmark.
+        /// Deletes a relation for a given incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
         /// </param>
-        /// <param name='bookmarkId'>
-        /// Bookmark ID
+        /// <param name='incidentId'>
+        /// Incident ID
+        /// </param>
+        /// <param name='relationName'>
+        /// Relation Name
         /// </param>
         /// <param name='customHeaders'>
         /// The headers that will be added to request.
@@ -129,15 +151,15 @@ public partial interface IBookmarksOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.ValidationException">
         /// Thrown when a required parameter is null
         /// </exception>
-        Task<AzureOperationResponse> DeleteWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string bookmarkId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        Task<AzureOperationResponse> DeleteRelationWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, string relationName, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
         /// <summary>
-        /// Gets all bookmarks.
+        /// Gets all relations for a given incident.
         /// </summary>
         /// <param name='nextPageLink'>
         /// The NextLink from the previous successful call to List operation.
@@ -148,7 +170,7 @@ public partial interface IBookmarksOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -157,6 +179,6 @@ public partial interface IBookmarksOperations
         /// <exception cref="Microsoft.Rest.ValidationException">
         /// Thrown when a required parameter is null
         /// </exception>
-        Task<AzureOperationResponse<IPage<Bookmark>>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        Task<AzureOperationResponse<IPage<Relation>>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
     }
 }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IIncidentsOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IIncidentsOperations.cs
index ff001b53476e0..86fb696847f16 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IIncidentsOperations.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IIncidentsOperations.cs
@@ -27,8 +27,7 @@ public partial interface IIncidentsOperations
         /// Gets all incidents.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -55,7 +54,7 @@ public partial interface IIncidentsOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -66,11 +65,10 @@ public partial interface IIncidentsOperations
         /// </exception>
         Task<AzureOperationResponse<IPage<Incident>>> ListWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string filter = default(string), string orderby = default(string), int? top = default(int?), string skipToken = default(string), Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
         /// <summary>
-        /// Gets an incident.
+        /// Gets a given incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -84,7 +82,7 @@ public partial interface IIncidentsOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -95,11 +93,10 @@ public partial interface IIncidentsOperations
         /// </exception>
         Task<AzureOperationResponse<Incident>> GetWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
         /// <summary>
-        /// Creates or updates the incident.
+        /// Creates or updates an incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -116,7 +113,7 @@ public partial interface IIncidentsOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -127,11 +124,10 @@ public partial interface IIncidentsOperations
         /// </exception>
         Task<AzureOperationResponse<Incident>> CreateOrUpdateWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, Incident incident, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
         /// <summary>
-        /// Delete the incident.
+        /// Deletes a given incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -145,7 +141,7 @@ public partial interface IIncidentsOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.ValidationException">
@@ -153,6 +149,90 @@ public partial interface IIncidentsOperations
         /// </exception>
         Task<AzureOperationResponse> DeleteWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
         /// <summary>
+        /// Gets all alerts for an incident.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='incidentId'>
+        /// Incident ID
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse<IncidentAlertList>> ListOfAlertsWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        /// <summary>
+        /// Gets all bookmarks for an incident.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='incidentId'>
+        /// Incident ID
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse<IncidentBookmarkList>> ListOfBookmarksWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        /// <summary>
+        /// Gets all entities for an incident.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='incidentId'>
+        /// Incident ID
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse<IncidentEntitiesResponse>> ListOfEntitiesWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        /// <summary>
         /// Gets all incidents.
         /// </summary>
         /// <param name='nextPageLink'>
@@ -164,7 +244,7 @@ public partial interface IIncidentsOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IOperations.cs
index 9ab3684610fda..0a2f9899d822a 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IOperations.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IOperations.cs
@@ -33,7 +33,7 @@ public partial interface IOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -56,7 +56,7 @@ public partial interface IOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ISecurityInsightsClient.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ISecurityInsightsClient.cs
index 5b212079b6286..1e9da93ccc1e1 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ISecurityInsightsClient.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ISecurityInsightsClient.cs
@@ -42,14 +42,14 @@ public partial interface ISecurityInsightsClient : System.IDisposable
         ServiceClientCredentials Credentials { get; }
 
         /// <summary>
-        /// API version for the operation
+        /// The ID of the target subscription.
         /// </summary>
-        string ApiVersion { get; }
+        string SubscriptionId { get; set; }
 
         /// <summary>
-        /// Azure subscription ID
+        /// The API version to use for this operation.
         /// </summary>
-        string SubscriptionId { get; set; }
+        string ApiVersion { get; }
 
         /// <summary>
         /// The preferred language for the response.
@@ -71,44 +71,64 @@ public partial interface ISecurityInsightsClient : System.IDisposable
 
 
         /// <summary>
-        /// Gets the IOperations.
+        /// Gets the IIncidentsOperations.
         /// </summary>
-        IOperations Operations { get; }
+        IIncidentsOperations Incidents { get; }
 
         /// <summary>
-        /// Gets the IAlertRulesOperations.
+        /// Gets the IIncidentCommentsOperations.
         /// </summary>
-        IAlertRulesOperations AlertRules { get; }
+        IIncidentCommentsOperations IncidentComments { get; }
 
         /// <summary>
-        /// Gets the IActionsOperations.
+        /// Gets the IIncidentRelationsOperations.
         /// </summary>
-        IActionsOperations Actions { get; }
+        IIncidentRelationsOperations IncidentRelations { get; }
 
         /// <summary>
-        /// Gets the IAlertRuleTemplatesOperations.
+        /// Gets the IThreatIntelligenceIndicatorOperations.
         /// </summary>
-        IAlertRuleTemplatesOperations AlertRuleTemplates { get; }
+        IThreatIntelligenceIndicatorOperations ThreatIntelligenceIndicator { get; }
 
         /// <summary>
-        /// Gets the IBookmarksOperations.
+        /// Gets the IThreatIntelligenceIndicatorsOperations.
         /// </summary>
-        IBookmarksOperations Bookmarks { get; }
+        IThreatIntelligenceIndicatorsOperations ThreatIntelligenceIndicators { get; }
 
         /// <summary>
-        /// Gets the IDataConnectorsOperations.
+        /// Gets the IThreatIntelligenceIndicatorMetricsOperations.
         /// </summary>
-        IDataConnectorsOperations DataConnectors { get; }
+        IThreatIntelligenceIndicatorMetricsOperations ThreatIntelligenceIndicatorMetrics { get; }
 
         /// <summary>
-        /// Gets the IIncidentsOperations.
+        /// Gets the IWatchlistsOperations.
         /// </summary>
-        IIncidentsOperations Incidents { get; }
+        IWatchlistsOperations Watchlists { get; }
 
         /// <summary>
-        /// Gets the IIncidentCommentsOperations.
+        /// Gets the IWatchlistItemsOperations.
         /// </summary>
-        IIncidentCommentsOperations IncidentComments { get; }
+        IWatchlistItemsOperations WatchlistItems { get; }
+
+        /// <summary>
+        /// Gets the IOperations.
+        /// </summary>
+        IOperations Operations { get; }
+
+        /// <summary>
+        /// Gets the IAlertRulesOperations.
+        /// </summary>
+        IAlertRulesOperations AlertRules { get; }
+
+        /// <summary>
+        /// Gets the IActionsOperations.
+        /// </summary>
+        IActionsOperations Actions { get; }
+
+        /// <summary>
+        /// Gets the IAlertRuleTemplatesOperations.
+        /// </summary>
+        IAlertRuleTemplatesOperations AlertRuleTemplates { get; }
 
     }
 }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IThreatIntelligenceIndicatorMetricsOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IThreatIntelligenceIndicatorMetricsOperations.cs
new file mode 100644
index 0000000000000..d8ed64f46c3c0
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IThreatIntelligenceIndicatorMetricsOperations.cs
@@ -0,0 +1,57 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Azure;
+    using Models;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Threading;
+    using System.Threading.Tasks;
+
+    /// <summary>
+    /// ThreatIntelligenceIndicatorMetricsOperations operations.
+    /// </summary>
+    public partial interface IThreatIntelligenceIndicatorMetricsOperations
+    {
+        /// <summary>
+        /// Get threat intelligence indicators metrics (Indicators counts by
+        /// Type, Threat Type, Source).
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse<ThreatIntelligenceMetricsList>> ListWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IThreatIntelligenceIndicatorOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IThreatIntelligenceIndicatorOperations.cs
new file mode 100644
index 0000000000000..dd78235326e08
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IThreatIntelligenceIndicatorOperations.cs
@@ -0,0 +1,276 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Azure;
+    using Models;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Threading;
+    using System.Threading.Tasks;
+
+    /// <summary>
+    /// ThreatIntelligenceIndicatorOperations operations.
+    /// </summary>
+    public partial interface IThreatIntelligenceIndicatorOperations
+    {
+        /// <summary>
+        /// Create a new threat intelligence indicator.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='threatIntelligenceProperties'>
+        /// Properties of threat intelligence indicators to create and update.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse<ThreatIntelligenceInformation>> CreateIndicatorWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, ThreatIntelligenceIndicatorModelForRequestBody threatIntelligenceProperties, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        /// <summary>
+        /// View a threat intelligence indicator by name.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='name'>
+        /// Threat intelligence indicator name field.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse<ThreatIntelligenceInformation>> GetWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        /// <summary>
+        /// Update a threat Intelligence indicator.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='name'>
+        /// Threat intelligence indicator name field.
+        /// </param>
+        /// <param name='threatIntelligenceProperties'>
+        /// Properties of threat intelligence indicators to create and update.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse<ThreatIntelligenceInformation>> CreateWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name, ThreatIntelligenceIndicatorModelForRequestBody threatIntelligenceProperties, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        /// <summary>
+        /// Delete a threat intelligence indicator.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='name'>
+        /// Threat intelligence indicator name field.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse> DeleteWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        /// <summary>
+        /// Query threat intelligence indicators as per filtering criteria.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='threatIntelligenceFilteringCriteria'>
+        /// Filtering criteria for querying threat intelligence indicators.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse<IPage<ThreatIntelligenceInformation>>> QueryIndicatorsWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, ThreatIntelligenceFilteringCriteria threatIntelligenceFilteringCriteria, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        /// <summary>
+        /// Append tags to a threat intelligence indicator.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='name'>
+        /// Threat intelligence indicator name field.
+        /// </param>
+        /// <param name='threatIntelligenceTags'>
+        /// List of tags to be appended.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse> AppendTagsWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name, IList<string> threatIntelligenceTags = default(IList<string>), Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        /// <summary>
+        /// Replace tags added to a threat intelligence indicator.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='name'>
+        /// Threat intelligence indicator name field.
+        /// </param>
+        /// <param name='threatIntelligenceReplaceTags'>
+        /// Tags in the threat intelligence indicator to be replaced.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse<ThreatIntelligenceInformation>> ReplaceTagsWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name, ThreatIntelligenceIndicatorModelForRequestBody threatIntelligenceReplaceTags, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        /// <summary>
+        /// Query threat intelligence indicators as per filtering criteria.
+        /// </summary>
+        /// <param name='nextPageLink'>
+        /// The NextLink from the previous successful call to List operation.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse<IPage<ThreatIntelligenceInformation>>> QueryIndicatorsNextWithHttpMessagesAsync(string nextPageLink, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IThreatIntelligenceIndicatorsOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IThreatIntelligenceIndicatorsOperations.cs
new file mode 100644
index 0000000000000..57a6f6ad2245d
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IThreatIntelligenceIndicatorsOperations.cs
@@ -0,0 +1,94 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Azure;
+    using Models;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Threading;
+    using System.Threading.Tasks;
+
+    /// <summary>
+    /// ThreatIntelligenceIndicatorsOperations operations.
+    /// </summary>
+    public partial interface IThreatIntelligenceIndicatorsOperations
+    {
+        /// <summary>
+        /// Get all threat intelligence indicators.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='filter'>
+        /// Filters the results, based on a Boolean condition. Optional.
+        /// </param>
+        /// <param name='top'>
+        /// Returns only the first n results. Optional.
+        /// </param>
+        /// <param name='skipToken'>
+        /// Skiptoken is only used if a previous operation returned a partial
+        /// result. If a previous response contains a nextLink element, the
+        /// value of the nextLink element will include a skiptoken parameter
+        /// that specifies a starting point to use for subsequent calls.
+        /// Optional.
+        /// </param>
+        /// <param name='orderby'>
+        /// Sorts the results. Optional.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse<IPage<ThreatIntelligenceInformation>>> ListWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string filter = default(string), int? top = default(int?), string skipToken = default(string), string orderby = default(string), Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        /// <summary>
+        /// Get all threat intelligence indicators.
+        /// </summary>
+        /// <param name='nextPageLink'>
+        /// The NextLink from the previous successful call to List operation.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse<IPage<ThreatIntelligenceInformation>>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IDataConnectorsOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IWatchlistItemsOperations.cs
similarity index 54%
rename from sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IDataConnectorsOperations.cs
rename to sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IWatchlistItemsOperations.cs
index 22ae7053616e8..58791d6504813 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IDataConnectorsOperations.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IWatchlistItemsOperations.cs
@@ -19,27 +19,40 @@ namespace Microsoft.Azure.Management.SecurityInsights
     using System.Threading.Tasks;
 
     /// <summary>
-    /// DataConnectorsOperations operations.
+    /// WatchlistItemsOperations operations.
     /// </summary>
-    public partial interface IDataConnectorsOperations
+    public partial interface IWatchlistItemsOperations
     {
         /// <summary>
-        /// Gets all data connectors.
+        /// Get all watchlist Items.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
         /// </param>
+        /// <param name='watchlistAlias'>
+        /// The watchlist alias
+        /// </param>
+        /// <param name='skipToken'>
+        /// Skiptoken is only used if a previous operation returned a partial
+        /// result. If a previous response contains a nextLink element, the
+        /// value of the nextLink element will include a skiptoken parameter
+        /// that specifies a starting point to use for subsequent calls.
+        /// Optional.
+        /// </param>
         /// <param name='customHeaders'>
         /// The headers that will be added to request.
         /// </param>
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -48,19 +61,25 @@ public partial interface IDataConnectorsOperations
         /// <exception cref="Microsoft.Rest.ValidationException">
         /// Thrown when a required parameter is null
         /// </exception>
-        Task<AzureOperationResponse<IPage<DataConnector>>> ListWithHttpMessagesAsync(string resourceGroupName, string workspaceName, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        Task<AzureOperationResponse<IPage<WatchlistItem>>> ListWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, string skipToken = default(string), Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
         /// <summary>
-        /// Gets a data connector.
+        /// Get a watchlist item.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
         /// </param>
-        /// <param name='dataConnectorId'>
-        /// Connector ID
+        /// <param name='watchlistAlias'>
+        /// The watchlist alias
+        /// </param>
+        /// <param name='watchlistItemId'>
+        /// The watchlist item id (GUID)
         /// </param>
         /// <param name='customHeaders'>
         /// The headers that will be added to request.
@@ -68,7 +87,7 @@ public partial interface IDataConnectorsOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -77,22 +96,25 @@ public partial interface IDataConnectorsOperations
         /// <exception cref="Microsoft.Rest.ValidationException">
         /// Thrown when a required parameter is null
         /// </exception>
-        Task<AzureOperationResponse<DataConnector>> GetWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string dataConnectorId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        Task<AzureOperationResponse<WatchlistItem>> GetWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, string watchlistItemId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
         /// <summary>
-        /// Creates or updates the data connector.
+        /// Delete a watchlist item.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
         /// </param>
-        /// <param name='dataConnectorId'>
-        /// Connector ID
+        /// <param name='watchlistAlias'>
+        /// The watchlist alias
         /// </param>
-        /// <param name='dataConnector'>
-        /// The data connector
+        /// <param name='watchlistItemId'>
+        /// The watchlist item id (GUID)
         /// </param>
         /// <param name='customHeaders'>
         /// The headers that will be added to request.
@@ -100,28 +122,34 @@ public partial interface IDataConnectorsOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
-        /// <exception cref="Microsoft.Rest.SerializationException">
-        /// Thrown when unable to deserialize the response
-        /// </exception>
         /// <exception cref="Microsoft.Rest.ValidationException">
         /// Thrown when a required parameter is null
         /// </exception>
-        Task<AzureOperationResponse<DataConnector>> CreateOrUpdateWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string dataConnectorId, DataConnector dataConnector, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        Task<AzureOperationResponse> DeleteWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, string watchlistItemId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
         /// <summary>
-        /// Delete the data connector.
+        /// Create or update a watchlist item.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The
-        /// name is case insensitive.
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
         /// </param>
-        /// <param name='dataConnectorId'>
-        /// Connector ID
+        /// <param name='watchlistAlias'>
+        /// The watchlist alias
+        /// </param>
+        /// <param name='watchlistItemId'>
+        /// The watchlist item id (GUID)
+        /// </param>
+        /// <param name='watchlistItem'>
+        /// The watchlist item
         /// </param>
         /// <param name='customHeaders'>
         /// The headers that will be added to request.
@@ -129,15 +157,18 @@ public partial interface IDataConnectorsOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
+        /// <exception cref="Microsoft.Rest.SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
         /// <exception cref="Microsoft.Rest.ValidationException">
         /// Thrown when a required parameter is null
         /// </exception>
-        Task<AzureOperationResponse> DeleteWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string dataConnectorId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        Task<AzureOperationResponse<WatchlistItem>> CreateOrUpdateWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, string watchlistItemId, WatchlistItem watchlistItem, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
         /// <summary>
-        /// Gets all data connectors.
+        /// Get all watchlist Items.
         /// </summary>
         /// <param name='nextPageLink'>
         /// The NextLink from the previous successful call to List operation.
@@ -148,7 +179,7 @@ public partial interface IDataConnectorsOperations
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="Microsoft.Rest.Azure.CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="Microsoft.Rest.SerializationException">
@@ -157,6 +188,6 @@ public partial interface IDataConnectorsOperations
         /// <exception cref="Microsoft.Rest.ValidationException">
         /// Thrown when a required parameter is null
         /// </exception>
-        Task<AzureOperationResponse<IPage<DataConnector>>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        Task<AzureOperationResponse<IPage<WatchlistItem>>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
     }
 }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IWatchlistsOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IWatchlistsOperations.cs
new file mode 100644
index 0000000000000..543f804052359
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IWatchlistsOperations.cs
@@ -0,0 +1,184 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Azure;
+    using Models;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Threading;
+    using System.Threading.Tasks;
+
+    /// <summary>
+    /// WatchlistsOperations operations.
+    /// </summary>
+    public partial interface IWatchlistsOperations
+    {
+        /// <summary>
+        /// Get all watchlists, without watchlist items.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='skipToken'>
+        /// Skiptoken is only used if a previous operation returned a partial
+        /// result. If a previous response contains a nextLink element, the
+        /// value of the nextLink element will include a skiptoken parameter
+        /// that specifies a starting point to use for subsequent calls.
+        /// Optional.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse<IPage<Watchlist>>> ListWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string skipToken = default(string), Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        /// <summary>
+        /// Get a watchlist, without its watchlist items.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='watchlistAlias'>
+        /// The watchlist alias
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse<Watchlist>> GetWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        /// <summary>
+        /// Delete a watchlist.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='watchlistAlias'>
+        /// The watchlist alias
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse> DeleteWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        /// <summary>
+        /// Create or update a Watchlist and its Watchlist Items (bulk
+        /// creation, e.g. through text/csv content type). To create a
+        /// Watchlist and its Items, we should call this endpoint with
+        /// rawContent and contentType properties.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='watchlistAlias'>
+        /// The watchlist alias
+        /// </param>
+        /// <param name='watchlist'>
+        /// The watchlist
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse<Watchlist>> CreateOrUpdateWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, Watchlist watchlist, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+        /// <summary>
+        /// Get all watchlists, without watchlist items.
+        /// </summary>
+        /// <param name='nextPageLink'>
+        /// The NextLink from the previous successful call to List operation.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// The headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="Microsoft.Rest.ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        Task<AzureOperationResponse<IPage<Watchlist>>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken));
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentCommentsOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentCommentsOperations.cs
index f41d71bf75ab6..fd7f4a3c5d64b 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentCommentsOperations.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentCommentsOperations.cs
@@ -52,11 +52,10 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
         public SecurityInsightsClient Client { get; private set; }
 
         /// <summary>
-        /// Gets all incident comments.
+        /// Gets all comments for a given incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -79,7 +78,7 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -96,15 +95,26 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
         /// </return>
         public async Task<AzureOperationResponse<IPage<IncidentComment>>> ListByIncidentWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, ODataQuery<IncidentComment> odataQuery = default(ODataQuery<IncidentComment>), string skipToken = default(string), Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -121,10 +131,6 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -244,14 +250,13 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -261,10 +266,6 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -310,11 +311,10 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
         }
 
         /// <summary>
-        /// Gets an incident comment.
+        /// Gets a comment for a given incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -331,7 +331,7 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -348,15 +348,26 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
         /// </return>
         public async Task<AzureOperationResponse<IncidentComment>> GetWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, string incidentCommentId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -373,10 +384,6 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -488,14 +495,13 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -505,10 +511,6 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -554,11 +556,10 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
         }
 
         /// <summary>
-        /// Creates the incident comment.
+        /// Creates or updates a comment for a given incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -572,13 +573,16 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
         /// <param name='message'>
         /// The comment message
         /// </param>
+        /// <param name='etag'>
+        /// Etag of the azure resource
+        /// </param>
         /// <param name='customHeaders'>
         /// Headers that will be added to request.
         /// </param>
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -593,17 +597,28 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
         /// <return>
         /// A response object containing the response body and response headers.
         /// </return>
-        public async Task<AzureOperationResponse<IncidentComment>> CreateCommentWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, string incidentCommentId, string message, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        public async Task<AzureOperationResponse<IncidentComment>> CreateCommentWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, string incidentCommentId, string message, string etag = default(string), Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -620,10 +635,6 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -653,8 +664,9 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
                 throw new ValidationException(ValidationRules.CannotBeNull, "message");
             }
             IncidentComment incidentComment = new IncidentComment();
-            if (message != null)
+            if (etag != null || message != null)
             {
+                incidentComment.Etag = etag;
                 incidentComment.Message = message;
             }
             // Tracing
@@ -749,16 +761,15 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
             HttpStatusCode _statusCode = _httpResponse.StatusCode;
             cancellationToken.ThrowIfCancellationRequested();
             string _responseContent = null;
-            if ((int)_statusCode != 201)
+            if ((int)_statusCode != 200 && (int)_statusCode != 201)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -768,10 +779,6 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -792,6 +799,24 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
                 _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
             }
             // Deserialize Response
+            if ((int)_statusCode == 200)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<IncidentComment>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            // Deserialize Response
             if ((int)_statusCode == 201)
             {
                 _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
@@ -817,7 +842,231 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
         }
 
         /// <summary>
-        /// Gets all incident comments.
+        /// Deletes a comment for a given incident.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='incidentId'>
+        /// Incident ID
+        /// </param>
+        /// <param name='incidentCommentId'>
+        /// Incident comment ID
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse> DeleteCommentWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, string incidentCommentId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
+            if (Client.SubscriptionId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
+            }
+            if (Client.SubscriptionId != null)
+            {
+                if (Client.SubscriptionId.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
+                }
+            }
+            if (resourceGroupName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName");
+            }
+            if (resourceGroupName != null)
+            {
+                if (resourceGroupName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90);
+                }
+                if (resourceGroupName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
+                }
+            }
+            if (workspaceName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "workspaceName");
+            }
+            if (workspaceName != null)
+            {
+                if (workspaceName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "workspaceName", 90);
+                }
+                if (workspaceName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
+                }
+            }
+            if (incidentId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "incidentId");
+            }
+            if (incidentCommentId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "incidentCommentId");
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("workspaceName", workspaceName);
+                tracingParameters.Add("incidentId", incidentId);
+                tracingParameters.Add("incidentCommentId", incidentCommentId);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "DeleteComment", tracingParameters);
+            }
+            // Construct URL
+            var _baseUrl = Client.BaseUri.AbsoluteUri;
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/comments/{incidentCommentId}").ToString();
+            _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
+            _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
+            _url = _url.Replace("{incidentId}", System.Uri.EscapeDataString(incidentId));
+            _url = _url.Replace("{incidentCommentId}", System.Uri.EscapeDataString(incidentCommentId));
+            List<string> _queryParameters = new List<string>();
+            if (Client.ApiVersion != null)
+            {
+                _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(Client.ApiVersion)));
+            }
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("DELETE");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200 && (int)_statusCode != 204)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
+                {
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+        /// <summary>
+        /// Gets all comments for a given incident.
         /// </summary>
         /// <param name='nextPageLink'>
         /// The NextLink from the previous successful call to List operation.
@@ -828,7 +1077,7 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -924,14 +1173,13 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -941,10 +1189,6 @@ internal IncidentCommentsOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentCommentsOperationsExtensions.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentCommentsOperationsExtensions.cs
index 753d695eeb08f..59a3a9aca9848 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentCommentsOperationsExtensions.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentCommentsOperationsExtensions.cs
@@ -23,14 +23,13 @@ namespace Microsoft.Azure.Management.SecurityInsights
     public static partial class IncidentCommentsOperationsExtensions
     {
             /// <summary>
-            /// Gets all incident comments.
+            /// Gets all comments for a given incident.
             /// </summary>
             /// <param name='operations'>
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -53,14 +52,13 @@ public static partial class IncidentCommentsOperationsExtensions
             }
 
             /// <summary>
-            /// Gets all incident comments.
+            /// Gets all comments for a given incident.
             /// </summary>
             /// <param name='operations'>
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -89,14 +87,13 @@ public static partial class IncidentCommentsOperationsExtensions
             }
 
             /// <summary>
-            /// Gets an incident comment.
+            /// Gets a comment for a given incident.
             /// </summary>
             /// <param name='operations'>
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -113,14 +110,13 @@ public static IncidentComment Get(this IIncidentCommentsOperations operations, s
             }
 
             /// <summary>
-            /// Gets an incident comment.
+            /// Gets a comment for a given incident.
             /// </summary>
             /// <param name='operations'>
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -143,14 +139,13 @@ public static IncidentComment Get(this IIncidentCommentsOperations operations, s
             }
 
             /// <summary>
-            /// Creates the incident comment.
+            /// Creates or updates a comment for a given incident.
             /// </summary>
             /// <param name='operations'>
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -164,20 +159,22 @@ public static IncidentComment Get(this IIncidentCommentsOperations operations, s
             /// <param name='message'>
             /// The comment message
             /// </param>
-            public static IncidentComment CreateComment(this IIncidentCommentsOperations operations, string resourceGroupName, string workspaceName, string incidentId, string incidentCommentId, string message)
+            /// <param name='etag'>
+            /// Etag of the azure resource
+            /// </param>
+            public static IncidentComment CreateComment(this IIncidentCommentsOperations operations, string resourceGroupName, string workspaceName, string incidentId, string incidentCommentId, string message, string etag = default(string))
             {
-                return operations.CreateCommentAsync(resourceGroupName, workspaceName, incidentId, incidentCommentId, message).GetAwaiter().GetResult();
+                return operations.CreateCommentAsync(resourceGroupName, workspaceName, incidentId, incidentCommentId, message, etag).GetAwaiter().GetResult();
             }
 
             /// <summary>
-            /// Creates the incident comment.
+            /// Creates or updates a comment for a given incident.
             /// </summary>
             /// <param name='operations'>
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -191,19 +188,71 @@ public static IncidentComment CreateComment(this IIncidentCommentsOperations ope
             /// <param name='message'>
             /// The comment message
             /// </param>
+            /// <param name='etag'>
+            /// Etag of the azure resource
+            /// </param>
             /// <param name='cancellationToken'>
             /// The cancellation token.
             /// </param>
-            public static async Task<IncidentComment> CreateCommentAsync(this IIncidentCommentsOperations operations, string resourceGroupName, string workspaceName, string incidentId, string incidentCommentId, string message, CancellationToken cancellationToken = default(CancellationToken))
+            public static async Task<IncidentComment> CreateCommentAsync(this IIncidentCommentsOperations operations, string resourceGroupName, string workspaceName, string incidentId, string incidentCommentId, string message, string etag = default(string), CancellationToken cancellationToken = default(CancellationToken))
             {
-                using (var _result = await operations.CreateCommentWithHttpMessagesAsync(resourceGroupName, workspaceName, incidentId, incidentCommentId, message, null, cancellationToken).ConfigureAwait(false))
+                using (var _result = await operations.CreateCommentWithHttpMessagesAsync(resourceGroupName, workspaceName, incidentId, incidentCommentId, message, etag, null, cancellationToken).ConfigureAwait(false))
                 {
                     return _result.Body;
                 }
             }
 
             /// <summary>
-            /// Gets all incident comments.
+            /// Deletes a comment for a given incident.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='incidentId'>
+            /// Incident ID
+            /// </param>
+            /// <param name='incidentCommentId'>
+            /// Incident comment ID
+            /// </param>
+            public static void DeleteComment(this IIncidentCommentsOperations operations, string resourceGroupName, string workspaceName, string incidentId, string incidentCommentId)
+            {
+                operations.DeleteCommentAsync(resourceGroupName, workspaceName, incidentId, incidentCommentId).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Deletes a comment for a given incident.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='incidentId'>
+            /// Incident ID
+            /// </param>
+            /// <param name='incidentCommentId'>
+            /// Incident comment ID
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task DeleteCommentAsync(this IIncidentCommentsOperations operations, string resourceGroupName, string workspaceName, string incidentId, string incidentCommentId, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                (await operations.DeleteCommentWithHttpMessagesAsync(resourceGroupName, workspaceName, incidentId, incidentCommentId, null, cancellationToken).ConfigureAwait(false)).Dispose();
+            }
+
+            /// <summary>
+            /// Gets all comments for a given incident.
             /// </summary>
             /// <param name='operations'>
             /// The operations group for this extension method.
@@ -217,7 +266,7 @@ public static IPage<IncidentComment> ListByIncidentNext(this IIncidentCommentsOp
             }
 
             /// <summary>
-            /// Gets all incident comments.
+            /// Gets all comments for a given incident.
             /// </summary>
             /// <param name='operations'>
             /// The operations group for this extension method.
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/BookmarksOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentRelationsOperations.cs
similarity index 80%
rename from sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/BookmarksOperations.cs
rename to sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentRelationsOperations.cs
index d5543ca885972..6967ab1725c11 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/BookmarksOperations.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentRelationsOperations.cs
@@ -12,6 +12,7 @@ namespace Microsoft.Azure.Management.SecurityInsights
 {
     using Microsoft.Rest;
     using Microsoft.Rest.Azure;
+    using Microsoft.Rest.Azure.OData;
     using Models;
     using Newtonsoft.Json;
     using System.Collections;
@@ -23,12 +24,12 @@ namespace Microsoft.Azure.Management.SecurityInsights
     using System.Threading.Tasks;
 
     /// <summary>
-    /// BookmarksOperations operations.
+    /// IncidentRelationsOperations operations.
     /// </summary>
-    internal partial class BookmarksOperations : IServiceOperations<SecurityInsightsClient>, IBookmarksOperations
+    internal partial class IncidentRelationsOperations : IServiceOperations<SecurityInsightsClient>, IIncidentRelationsOperations
     {
         /// <summary>
-        /// Initializes a new instance of the BookmarksOperations class.
+        /// Initializes a new instance of the IncidentRelationsOperations class.
         /// </summary>
         /// <param name='client'>
         /// Reference to the service client.
@@ -36,7 +37,7 @@ internal partial class BookmarksOperations : IServiceOperations<SecurityInsights
         /// <exception cref="System.ArgumentNullException">
         /// Thrown when a required parameter is null
         /// </exception>
-        internal BookmarksOperations(SecurityInsightsClient client)
+        internal IncidentRelationsOperations(SecurityInsightsClient client)
         {
             if (client == null)
             {
@@ -51,22 +52,33 @@ internal BookmarksOperations(SecurityInsightsClient client)
         public SecurityInsightsClient Client { get; private set; }
 
         /// <summary>
-        /// Gets all bookmarks.
+        /// Gets all relations for a given incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
         /// </param>
+        /// <param name='incidentId'>
+        /// Incident ID
+        /// </param>
+        /// <param name='odataQuery'>
+        /// OData parameters to apply to the operation.
+        /// </param>
+        /// <param name='skipToken'>
+        /// Skiptoken is only used if a previous operation returned a partial result.
+        /// If a previous response contains a nextLink element, the value of the
+        /// nextLink element will include a skiptoken parameter that specifies a
+        /// starting point to use for subsequent calls. Optional.
+        /// </param>
         /// <param name='customHeaders'>
         /// Headers that will be added to request.
         /// </param>
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -81,17 +93,28 @@ internal BookmarksOperations(SecurityInsightsClient client)
         /// <return>
         /// A response object containing the response body and response headers.
         /// </return>
-        public async Task<AzureOperationResponse<IPage<Bookmark>>> ListWithHttpMessagesAsync(string resourceGroupName, string workspaceName, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        public async Task<AzureOperationResponse<IPage<Relation>>> ListWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, ODataQuery<Relation> odataQuery = default(ODataQuery<Relation>), string skipToken = default(string), Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -108,10 +131,6 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -128,6 +147,10 @@ internal BookmarksOperations(SecurityInsightsClient client)
                     throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
                 }
             }
+            if (incidentId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "incidentId");
+            }
             // Tracing
             bool _shouldTrace = ServiceClientTracing.IsEnabled;
             string _invocationId = null;
@@ -135,22 +158,38 @@ internal BookmarksOperations(SecurityInsightsClient client)
             {
                 _invocationId = ServiceClientTracing.NextInvocationId.ToString();
                 Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("odataQuery", odataQuery);
                 tracingParameters.Add("resourceGroupName", resourceGroupName);
                 tracingParameters.Add("workspaceName", workspaceName);
+                tracingParameters.Add("incidentId", incidentId);
+                tracingParameters.Add("skipToken", skipToken);
                 tracingParameters.Add("cancellationToken", cancellationToken);
                 ServiceClientTracing.Enter(_invocationId, this, "List", tracingParameters);
             }
             // Construct URL
             var _baseUrl = Client.BaseUri.AbsoluteUri;
-            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks").ToString();
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/relations").ToString();
             _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
             _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
             _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
+            _url = _url.Replace("{incidentId}", System.Uri.EscapeDataString(incidentId));
             List<string> _queryParameters = new List<string>();
+            if (odataQuery != null)
+            {
+                var _odataFilter = odataQuery.ToString();
+                if (!string.IsNullOrEmpty(_odataFilter))
+                {
+                    _queryParameters.Add(_odataFilter);
+                }
+            }
             if (Client.ApiVersion != null)
             {
                 _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(Client.ApiVersion)));
             }
+            if (skipToken != null)
+            {
+                _queryParameters.Add(string.Format("$skipToken={0}", System.Uri.EscapeDataString(skipToken)));
+            }
             if (_queryParameters.Count > 0)
             {
                 _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
@@ -211,14 +250,13 @@ internal BookmarksOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -228,10 +266,6 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -244,7 +278,7 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 throw ex;
             }
             // Create Result
-            var _result = new AzureOperationResponse<IPage<Bookmark>>();
+            var _result = new AzureOperationResponse<IPage<Relation>>();
             _result.Request = _httpRequest;
             _result.Response = _httpResponse;
             if (_httpResponse.Headers.Contains("x-ms-request-id"))
@@ -257,7 +291,7 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
                 try
                 {
-                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Page<Bookmark>>(_responseContent, Client.DeserializationSettings);
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Page<Relation>>(_responseContent, Client.DeserializationSettings);
                 }
                 catch (JsonException ex)
                 {
@@ -277,17 +311,19 @@ internal BookmarksOperations(SecurityInsightsClient client)
         }
 
         /// <summary>
-        /// Gets a bookmark.
+        /// Gets a relation for a given incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
         /// </param>
-        /// <param name='bookmarkId'>
-        /// Bookmark ID
+        /// <param name='incidentId'>
+        /// Incident ID
+        /// </param>
+        /// <param name='relationName'>
+        /// Relation Name
         /// </param>
         /// <param name='customHeaders'>
         /// Headers that will be added to request.
@@ -295,7 +331,7 @@ internal BookmarksOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -310,17 +346,28 @@ internal BookmarksOperations(SecurityInsightsClient client)
         /// <return>
         /// A response object containing the response body and response headers.
         /// </return>
-        public async Task<AzureOperationResponse<Bookmark>> GetWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string bookmarkId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        public async Task<AzureOperationResponse<Relation>> GetRelationWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, string relationName, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -337,10 +384,6 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -357,9 +400,13 @@ internal BookmarksOperations(SecurityInsightsClient client)
                     throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
                 }
             }
-            if (bookmarkId == null)
+            if (incidentId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "incidentId");
+            }
+            if (relationName == null)
             {
-                throw new ValidationException(ValidationRules.CannotBeNull, "bookmarkId");
+                throw new ValidationException(ValidationRules.CannotBeNull, "relationName");
             }
             // Tracing
             bool _shouldTrace = ServiceClientTracing.IsEnabled;
@@ -370,17 +417,19 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
                 tracingParameters.Add("resourceGroupName", resourceGroupName);
                 tracingParameters.Add("workspaceName", workspaceName);
-                tracingParameters.Add("bookmarkId", bookmarkId);
+                tracingParameters.Add("incidentId", incidentId);
+                tracingParameters.Add("relationName", relationName);
                 tracingParameters.Add("cancellationToken", cancellationToken);
-                ServiceClientTracing.Enter(_invocationId, this, "Get", tracingParameters);
+                ServiceClientTracing.Enter(_invocationId, this, "GetRelation", tracingParameters);
             }
             // Construct URL
             var _baseUrl = Client.BaseUri.AbsoluteUri;
-            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks/{bookmarkId}").ToString();
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/relations/{relationName}").ToString();
             _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
             _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
             _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
-            _url = _url.Replace("{bookmarkId}", System.Uri.EscapeDataString(bookmarkId));
+            _url = _url.Replace("{incidentId}", System.Uri.EscapeDataString(incidentId));
+            _url = _url.Replace("{relationName}", System.Uri.EscapeDataString(relationName));
             List<string> _queryParameters = new List<string>();
             if (Client.ApiVersion != null)
             {
@@ -446,14 +495,13 @@ internal BookmarksOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -463,10 +511,6 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -479,7 +523,7 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 throw ex;
             }
             // Create Result
-            var _result = new AzureOperationResponse<Bookmark>();
+            var _result = new AzureOperationResponse<Relation>();
             _result.Request = _httpRequest;
             _result.Response = _httpResponse;
             if (_httpResponse.Headers.Contains("x-ms-request-id"))
@@ -492,7 +536,7 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
                 try
                 {
-                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Bookmark>(_responseContent, Client.DeserializationSettings);
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Relation>(_responseContent, Client.DeserializationSettings);
                 }
                 catch (JsonException ex)
                 {
@@ -512,20 +556,25 @@ internal BookmarksOperations(SecurityInsightsClient client)
         }
 
         /// <summary>
-        /// Creates or updates the bookmark.
+        /// Creates or updates a relation for a given incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
         /// </param>
-        /// <param name='bookmarkId'>
-        /// Bookmark ID
+        /// <param name='incidentId'>
+        /// Incident ID
+        /// </param>
+        /// <param name='relationName'>
+        /// Relation Name
         /// </param>
-        /// <param name='bookmark'>
-        /// The bookmark
+        /// <param name='relatedResourceId'>
+        /// The resource ID of the related resource
+        /// </param>
+        /// <param name='etag'>
+        /// Etag of the azure resource
         /// </param>
         /// <param name='customHeaders'>
         /// Headers that will be added to request.
@@ -533,7 +582,7 @@ internal BookmarksOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -548,17 +597,28 @@ internal BookmarksOperations(SecurityInsightsClient client)
         /// <return>
         /// A response object containing the response body and response headers.
         /// </return>
-        public async Task<AzureOperationResponse<Bookmark>> CreateOrUpdateWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string bookmarkId, Bookmark bookmark, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        public async Task<AzureOperationResponse<Relation>> CreateOrUpdateRelationWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, string relationName, string relatedResourceId, string etag = default(string), Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -575,10 +635,6 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -595,17 +651,23 @@ internal BookmarksOperations(SecurityInsightsClient client)
                     throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
                 }
             }
-            if (bookmarkId == null)
+            if (incidentId == null)
             {
-                throw new ValidationException(ValidationRules.CannotBeNull, "bookmarkId");
+                throw new ValidationException(ValidationRules.CannotBeNull, "incidentId");
             }
-            if (bookmark == null)
+            if (relationName == null)
             {
-                throw new ValidationException(ValidationRules.CannotBeNull, "bookmark");
+                throw new ValidationException(ValidationRules.CannotBeNull, "relationName");
             }
-            if (bookmark != null)
+            if (relatedResourceId == null)
             {
-                bookmark.Validate();
+                throw new ValidationException(ValidationRules.CannotBeNull, "relatedResourceId");
+            }
+            Relation relation = new Relation();
+            if (etag != null || relatedResourceId != null)
+            {
+                relation.Etag = etag;
+                relation.RelatedResourceId = relatedResourceId;
             }
             // Tracing
             bool _shouldTrace = ServiceClientTracing.IsEnabled;
@@ -616,18 +678,20 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
                 tracingParameters.Add("resourceGroupName", resourceGroupName);
                 tracingParameters.Add("workspaceName", workspaceName);
-                tracingParameters.Add("bookmarkId", bookmarkId);
-                tracingParameters.Add("bookmark", bookmark);
+                tracingParameters.Add("incidentId", incidentId);
+                tracingParameters.Add("relationName", relationName);
+                tracingParameters.Add("relation", relation);
                 tracingParameters.Add("cancellationToken", cancellationToken);
-                ServiceClientTracing.Enter(_invocationId, this, "CreateOrUpdate", tracingParameters);
+                ServiceClientTracing.Enter(_invocationId, this, "CreateOrUpdateRelation", tracingParameters);
             }
             // Construct URL
             var _baseUrl = Client.BaseUri.AbsoluteUri;
-            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks/{bookmarkId}").ToString();
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/relations/{relationName}").ToString();
             _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
             _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
             _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
-            _url = _url.Replace("{bookmarkId}", System.Uri.EscapeDataString(bookmarkId));
+            _url = _url.Replace("{incidentId}", System.Uri.EscapeDataString(incidentId));
+            _url = _url.Replace("{relationName}", System.Uri.EscapeDataString(relationName));
             List<string> _queryParameters = new List<string>();
             if (Client.ApiVersion != null)
             {
@@ -671,9 +735,9 @@ internal BookmarksOperations(SecurityInsightsClient client)
 
             // Serialize Request
             string _requestContent = null;
-            if(bookmark != null)
+            if(relation != null)
             {
-                _requestContent = Rest.Serialization.SafeJsonConvert.SerializeObject(bookmark, Client.SerializationSettings);
+                _requestContent = Rest.Serialization.SafeJsonConvert.SerializeObject(relation, Client.SerializationSettings);
                 _httpRequest.Content = new StringContent(_requestContent, System.Text.Encoding.UTF8);
                 _httpRequest.Content.Headers.ContentType =System.Net.Http.Headers.MediaTypeHeaderValue.Parse("application/json; charset=utf-8");
             }
@@ -699,14 +763,13 @@ internal BookmarksOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200 && (int)_statusCode != 201)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -716,10 +779,6 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -732,7 +791,7 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 throw ex;
             }
             // Create Result
-            var _result = new AzureOperationResponse<Bookmark>();
+            var _result = new AzureOperationResponse<Relation>();
             _result.Request = _httpRequest;
             _result.Response = _httpResponse;
             if (_httpResponse.Headers.Contains("x-ms-request-id"))
@@ -745,7 +804,7 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
                 try
                 {
-                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Bookmark>(_responseContent, Client.DeserializationSettings);
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Relation>(_responseContent, Client.DeserializationSettings);
                 }
                 catch (JsonException ex)
                 {
@@ -763,7 +822,7 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
                 try
                 {
-                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Bookmark>(_responseContent, Client.DeserializationSettings);
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Relation>(_responseContent, Client.DeserializationSettings);
                 }
                 catch (JsonException ex)
                 {
@@ -783,17 +842,19 @@ internal BookmarksOperations(SecurityInsightsClient client)
         }
 
         /// <summary>
-        /// Delete the bookmark.
+        /// Deletes a relation for a given incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
         /// </param>
-        /// <param name='bookmarkId'>
-        /// Bookmark ID
+        /// <param name='incidentId'>
+        /// Incident ID
+        /// </param>
+        /// <param name='relationName'>
+        /// Relation Name
         /// </param>
         /// <param name='customHeaders'>
         /// Headers that will be added to request.
@@ -801,7 +862,7 @@ internal BookmarksOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="ValidationException">
@@ -813,17 +874,28 @@ internal BookmarksOperations(SecurityInsightsClient client)
         /// <return>
         /// A response object containing the response body and response headers.
         /// </return>
-        public async Task<AzureOperationResponse> DeleteWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string bookmarkId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        public async Task<AzureOperationResponse> DeleteRelationWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, string relationName, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -840,10 +912,6 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -860,9 +928,13 @@ internal BookmarksOperations(SecurityInsightsClient client)
                     throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
                 }
             }
-            if (bookmarkId == null)
+            if (incidentId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "incidentId");
+            }
+            if (relationName == null)
             {
-                throw new ValidationException(ValidationRules.CannotBeNull, "bookmarkId");
+                throw new ValidationException(ValidationRules.CannotBeNull, "relationName");
             }
             // Tracing
             bool _shouldTrace = ServiceClientTracing.IsEnabled;
@@ -873,17 +945,19 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
                 tracingParameters.Add("resourceGroupName", resourceGroupName);
                 tracingParameters.Add("workspaceName", workspaceName);
-                tracingParameters.Add("bookmarkId", bookmarkId);
+                tracingParameters.Add("incidentId", incidentId);
+                tracingParameters.Add("relationName", relationName);
                 tracingParameters.Add("cancellationToken", cancellationToken);
-                ServiceClientTracing.Enter(_invocationId, this, "Delete", tracingParameters);
+                ServiceClientTracing.Enter(_invocationId, this, "DeleteRelation", tracingParameters);
             }
             // Construct URL
             var _baseUrl = Client.BaseUri.AbsoluteUri;
-            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks/{bookmarkId}").ToString();
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/relations/{relationName}").ToString();
             _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
             _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
             _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
-            _url = _url.Replace("{bookmarkId}", System.Uri.EscapeDataString(bookmarkId));
+            _url = _url.Replace("{incidentId}", System.Uri.EscapeDataString(incidentId));
+            _url = _url.Replace("{relationName}", System.Uri.EscapeDataString(relationName));
             List<string> _queryParameters = new List<string>();
             if (Client.ApiVersion != null)
             {
@@ -949,14 +1023,13 @@ internal BookmarksOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200 && (int)_statusCode != 204)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -966,10 +1039,6 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -997,7 +1066,7 @@ internal BookmarksOperations(SecurityInsightsClient client)
         }
 
         /// <summary>
-        /// Gets all bookmarks.
+        /// Gets all relations for a given incident.
         /// </summary>
         /// <param name='nextPageLink'>
         /// The NextLink from the previous successful call to List operation.
@@ -1008,7 +1077,7 @@ internal BookmarksOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -1023,7 +1092,7 @@ internal BookmarksOperations(SecurityInsightsClient client)
         /// <return>
         /// A response object containing the response body and response headers.
         /// </return>
-        public async Task<AzureOperationResponse<IPage<Bookmark>>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        public async Task<AzureOperationResponse<IPage<Relation>>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
             if (nextPageLink == null)
             {
@@ -1104,14 +1173,13 @@ internal BookmarksOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -1121,10 +1189,6 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -1137,7 +1201,7 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 throw ex;
             }
             // Create Result
-            var _result = new AzureOperationResponse<IPage<Bookmark>>();
+            var _result = new AzureOperationResponse<IPage<Relation>>();
             _result.Request = _httpRequest;
             _result.Response = _httpResponse;
             if (_httpResponse.Headers.Contains("x-ms-request-id"))
@@ -1150,7 +1214,7 @@ internal BookmarksOperations(SecurityInsightsClient client)
                 _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
                 try
                 {
-                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Page<Bookmark>>(_responseContent, Client.DeserializationSettings);
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Page<Relation>>(_responseContent, Client.DeserializationSettings);
                 }
                 catch (JsonException ex)
                 {
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentRelationsOperationsExtensions.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentRelationsOperationsExtensions.cs
new file mode 100644
index 0000000000000..3a64800b542cc
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentRelationsOperationsExtensions.cs
@@ -0,0 +1,289 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Azure;
+    using Microsoft.Rest.Azure.OData;
+    using Models;
+    using System.Threading;
+    using System.Threading.Tasks;
+
+    /// <summary>
+    /// Extension methods for IncidentRelationsOperations.
+    /// </summary>
+    public static partial class IncidentRelationsOperationsExtensions
+    {
+            /// <summary>
+            /// Gets all relations for a given incident.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='incidentId'>
+            /// Incident ID
+            /// </param>
+            /// <param name='odataQuery'>
+            /// OData parameters to apply to the operation.
+            /// </param>
+            /// <param name='skipToken'>
+            /// Skiptoken is only used if a previous operation returned a partial result.
+            /// If a previous response contains a nextLink element, the value of the
+            /// nextLink element will include a skiptoken parameter that specifies a
+            /// starting point to use for subsequent calls. Optional.
+            /// </param>
+            public static IPage<Relation> List(this IIncidentRelationsOperations operations, string resourceGroupName, string workspaceName, string incidentId, ODataQuery<Relation> odataQuery = default(ODataQuery<Relation>), string skipToken = default(string))
+            {
+                return operations.ListAsync(resourceGroupName, workspaceName, incidentId, odataQuery, skipToken).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Gets all relations for a given incident.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='incidentId'>
+            /// Incident ID
+            /// </param>
+            /// <param name='odataQuery'>
+            /// OData parameters to apply to the operation.
+            /// </param>
+            /// <param name='skipToken'>
+            /// Skiptoken is only used if a previous operation returned a partial result.
+            /// If a previous response contains a nextLink element, the value of the
+            /// nextLink element will include a skiptoken parameter that specifies a
+            /// starting point to use for subsequent calls. Optional.
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<IPage<Relation>> ListAsync(this IIncidentRelationsOperations operations, string resourceGroupName, string workspaceName, string incidentId, ODataQuery<Relation> odataQuery = default(ODataQuery<Relation>), string skipToken = default(string), CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.ListWithHttpMessagesAsync(resourceGroupName, workspaceName, incidentId, odataQuery, skipToken, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+            /// <summary>
+            /// Gets a relation for a given incident.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='incidentId'>
+            /// Incident ID
+            /// </param>
+            /// <param name='relationName'>
+            /// Relation Name
+            /// </param>
+            public static Relation GetRelation(this IIncidentRelationsOperations operations, string resourceGroupName, string workspaceName, string incidentId, string relationName)
+            {
+                return operations.GetRelationAsync(resourceGroupName, workspaceName, incidentId, relationName).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Gets a relation for a given incident.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='incidentId'>
+            /// Incident ID
+            /// </param>
+            /// <param name='relationName'>
+            /// Relation Name
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<Relation> GetRelationAsync(this IIncidentRelationsOperations operations, string resourceGroupName, string workspaceName, string incidentId, string relationName, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.GetRelationWithHttpMessagesAsync(resourceGroupName, workspaceName, incidentId, relationName, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+            /// <summary>
+            /// Creates or updates a relation for a given incident.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='incidentId'>
+            /// Incident ID
+            /// </param>
+            /// <param name='relationName'>
+            /// Relation Name
+            /// </param>
+            /// <param name='relatedResourceId'>
+            /// The resource ID of the related resource
+            /// </param>
+            /// <param name='etag'>
+            /// Etag of the azure resource
+            /// </param>
+            public static Relation CreateOrUpdateRelation(this IIncidentRelationsOperations operations, string resourceGroupName, string workspaceName, string incidentId, string relationName, string relatedResourceId, string etag = default(string))
+            {
+                return operations.CreateOrUpdateRelationAsync(resourceGroupName, workspaceName, incidentId, relationName, relatedResourceId, etag).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Creates or updates a relation for a given incident.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='incidentId'>
+            /// Incident ID
+            /// </param>
+            /// <param name='relationName'>
+            /// Relation Name
+            /// </param>
+            /// <param name='relatedResourceId'>
+            /// The resource ID of the related resource
+            /// </param>
+            /// <param name='etag'>
+            /// Etag of the azure resource
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<Relation> CreateOrUpdateRelationAsync(this IIncidentRelationsOperations operations, string resourceGroupName, string workspaceName, string incidentId, string relationName, string relatedResourceId, string etag = default(string), CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.CreateOrUpdateRelationWithHttpMessagesAsync(resourceGroupName, workspaceName, incidentId, relationName, relatedResourceId, etag, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+            /// <summary>
+            /// Deletes a relation for a given incident.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='incidentId'>
+            /// Incident ID
+            /// </param>
+            /// <param name='relationName'>
+            /// Relation Name
+            /// </param>
+            public static void DeleteRelation(this IIncidentRelationsOperations operations, string resourceGroupName, string workspaceName, string incidentId, string relationName)
+            {
+                operations.DeleteRelationAsync(resourceGroupName, workspaceName, incidentId, relationName).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Deletes a relation for a given incident.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='incidentId'>
+            /// Incident ID
+            /// </param>
+            /// <param name='relationName'>
+            /// Relation Name
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task DeleteRelationAsync(this IIncidentRelationsOperations operations, string resourceGroupName, string workspaceName, string incidentId, string relationName, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                (await operations.DeleteRelationWithHttpMessagesAsync(resourceGroupName, workspaceName, incidentId, relationName, null, cancellationToken).ConfigureAwait(false)).Dispose();
+            }
+
+            /// <summary>
+            /// Gets all relations for a given incident.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='nextPageLink'>
+            /// The NextLink from the previous successful call to List operation.
+            /// </param>
+            public static IPage<Relation> ListNext(this IIncidentRelationsOperations operations, string nextPageLink)
+            {
+                return operations.ListNextAsync(nextPageLink).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Gets all relations for a given incident.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='nextPageLink'>
+            /// The NextLink from the previous successful call to List operation.
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<IPage<Relation>> ListNextAsync(this IIncidentRelationsOperations operations, string nextPageLink, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.ListNextWithHttpMessagesAsync(nextPageLink, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentsOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentsOperations.cs
index ce19d6fbf1998..eca0c4b709f87 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentsOperations.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentsOperations.cs
@@ -54,8 +54,7 @@ internal IncidentsOperations(SecurityInsightsClient client)
         /// Gets all incidents.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -81,7 +80,7 @@ internal IncidentsOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -98,15 +97,26 @@ internal IncidentsOperations(SecurityInsightsClient client)
         /// </return>
         public async Task<AzureOperationResponse<IPage<Incident>>> ListWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string filter = default(string), string orderby = default(string), int? top = default(int?), string skipToken = default(string), Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -123,10 +133,6 @@ internal IncidentsOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -246,14 +252,13 @@ internal IncidentsOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -263,10 +268,6 @@ internal IncidentsOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -312,11 +313,10 @@ internal IncidentsOperations(SecurityInsightsClient client)
         }
 
         /// <summary>
-        /// Gets an incident.
+        /// Gets a given incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -330,7 +330,7 @@ internal IncidentsOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -347,15 +347,26 @@ internal IncidentsOperations(SecurityInsightsClient client)
         /// </return>
         public async Task<AzureOperationResponse<Incident>> GetWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -372,10 +383,6 @@ internal IncidentsOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -481,14 +488,13 @@ internal IncidentsOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -498,10 +504,6 @@ internal IncidentsOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -547,11 +549,10 @@ internal IncidentsOperations(SecurityInsightsClient client)
         }
 
         /// <summary>
-        /// Creates or updates the incident.
+        /// Creates or updates an incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -568,7 +569,7 @@ internal IncidentsOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -585,15 +586,26 @@ internal IncidentsOperations(SecurityInsightsClient client)
         /// </return>
         public async Task<AzureOperationResponse<Incident>> CreateOrUpdateWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, Incident incident, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -610,10 +622,6 @@ internal IncidentsOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -734,14 +742,13 @@ internal IncidentsOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200 && (int)_statusCode != 201)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -751,10 +758,6 @@ internal IncidentsOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -818,11 +821,10 @@ internal IncidentsOperations(SecurityInsightsClient client)
         }
 
         /// <summary>
-        /// Delete the incident.
+        /// Deletes a given incident.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
@@ -836,7 +838,7 @@ internal IncidentsOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="ValidationException">
@@ -850,15 +852,26 @@ internal IncidentsOperations(SecurityInsightsClient client)
         /// </return>
         public async Task<AzureOperationResponse> DeleteWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -875,10 +888,6 @@ internal IncidentsOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
             }
             if (workspaceName == null)
             {
@@ -984,14 +993,13 @@ internal IncidentsOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200 && (int)_statusCode != 204)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -1001,10 +1009,6 @@ internal IncidentsOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -1032,10 +1036,16 @@ internal IncidentsOperations(SecurityInsightsClient client)
         }
 
         /// <summary>
-        /// Gets all incidents.
+        /// Gets all alerts for an incident.
         /// </summary>
-        /// <param name='nextPageLink'>
-        /// The NextLink from the previous successful call to List operation.
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='incidentId'>
+        /// Incident ID
         /// </param>
         /// <param name='customHeaders'>
         /// Headers that will be added to request.
@@ -1043,7 +1053,7 @@ internal IncidentsOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -1058,11 +1068,63 @@ internal IncidentsOperations(SecurityInsightsClient client)
         /// <return>
         /// A response object containing the response body and response headers.
         /// </return>
-        public async Task<AzureOperationResponse<IPage<Incident>>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        public async Task<AzureOperationResponse<IncidentAlertList>> ListOfAlertsWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
-            if (nextPageLink == null)
+            if (Client.ApiVersion == null)
             {
-                throw new ValidationException(ValidationRules.CannotBeNull, "nextPageLink");
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
+            if (Client.SubscriptionId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
+            }
+            if (Client.SubscriptionId != null)
+            {
+                if (Client.SubscriptionId.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
+                }
+            }
+            if (resourceGroupName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName");
+            }
+            if (resourceGroupName != null)
+            {
+                if (resourceGroupName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90);
+                }
+                if (resourceGroupName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
+                }
+            }
+            if (workspaceName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "workspaceName");
+            }
+            if (workspaceName != null)
+            {
+                if (workspaceName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "workspaceName", 90);
+                }
+                if (workspaceName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
+                }
+            }
+            if (incidentId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "incidentId");
             }
             // Tracing
             bool _shouldTrace = ServiceClientTracing.IsEnabled;
@@ -1071,14 +1133,24 @@ internal IncidentsOperations(SecurityInsightsClient client)
             {
                 _invocationId = ServiceClientTracing.NextInvocationId.ToString();
                 Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
-                tracingParameters.Add("nextPageLink", nextPageLink);
+                tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("workspaceName", workspaceName);
+                tracingParameters.Add("incidentId", incidentId);
                 tracingParameters.Add("cancellationToken", cancellationToken);
-                ServiceClientTracing.Enter(_invocationId, this, "ListNext", tracingParameters);
+                ServiceClientTracing.Enter(_invocationId, this, "ListOfAlerts", tracingParameters);
             }
             // Construct URL
-            string _url = "{nextLink}";
-            _url = _url.Replace("{nextLink}", nextPageLink);
+            var _baseUrl = Client.BaseUri.AbsoluteUri;
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/alerts").ToString();
+            _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
+            _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
+            _url = _url.Replace("{incidentId}", System.Uri.EscapeDataString(incidentId));
             List<string> _queryParameters = new List<string>();
+            if (Client.ApiVersion != null)
+            {
+                _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(Client.ApiVersion)));
+            }
             if (_queryParameters.Count > 0)
             {
                 _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
@@ -1086,7 +1158,7 @@ internal IncidentsOperations(SecurityInsightsClient client)
             // Create HTTP transport objects
             var _httpRequest = new HttpRequestMessage();
             HttpResponseMessage _httpResponse = null;
-            _httpRequest.Method = new HttpMethod("GET");
+            _httpRequest.Method = new HttpMethod("POST");
             _httpRequest.RequestUri = new System.Uri(_url);
             // Set Headers
             if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
@@ -1139,14 +1211,13 @@ internal IncidentsOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -1156,10 +1227,646 @@ internal IncidentsOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
                 {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse<IncidentAlertList>();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 200)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<IncidentAlertList>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+        /// <summary>
+        /// Gets all bookmarks for an incident.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='incidentId'>
+        /// Incident ID
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse<IncidentBookmarkList>> ListOfBookmarksWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
+            if (Client.SubscriptionId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
+            }
+            if (Client.SubscriptionId != null)
+            {
+                if (Client.SubscriptionId.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
+                }
+            }
+            if (resourceGroupName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName");
+            }
+            if (resourceGroupName != null)
+            {
+                if (resourceGroupName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90);
+                }
+                if (resourceGroupName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
+                }
+            }
+            if (workspaceName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "workspaceName");
+            }
+            if (workspaceName != null)
+            {
+                if (workspaceName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "workspaceName", 90);
+                }
+                if (workspaceName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
                 }
+            }
+            if (incidentId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "incidentId");
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("workspaceName", workspaceName);
+                tracingParameters.Add("incidentId", incidentId);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "ListOfBookmarks", tracingParameters);
+            }
+            // Construct URL
+            var _baseUrl = Client.BaseUri.AbsoluteUri;
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/bookmarks").ToString();
+            _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
+            _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
+            _url = _url.Replace("{incidentId}", System.Uri.EscapeDataString(incidentId));
+            List<string> _queryParameters = new List<string>();
+            if (Client.ApiVersion != null)
+            {
+                _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(Client.ApiVersion)));
+            }
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("POST");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
+                {
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse<IncidentBookmarkList>();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 200)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<IncidentBookmarkList>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+        /// <summary>
+        /// Gets all entities for an incident.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='incidentId'>
+        /// Incident ID
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse<IncidentEntitiesResponse>> ListOfEntitiesWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string incidentId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
+            if (Client.SubscriptionId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
+            }
+            if (Client.SubscriptionId != null)
+            {
+                if (Client.SubscriptionId.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
+                }
+            }
+            if (resourceGroupName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName");
+            }
+            if (resourceGroupName != null)
+            {
+                if (resourceGroupName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90);
+                }
+                if (resourceGroupName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
+                }
+            }
+            if (workspaceName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "workspaceName");
+            }
+            if (workspaceName != null)
+            {
+                if (workspaceName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "workspaceName", 90);
+                }
+                if (workspaceName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
+                }
+            }
+            if (incidentId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "incidentId");
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("workspaceName", workspaceName);
+                tracingParameters.Add("incidentId", incidentId);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "ListOfEntities", tracingParameters);
+            }
+            // Construct URL
+            var _baseUrl = Client.BaseUri.AbsoluteUri;
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/entities").ToString();
+            _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
+            _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
+            _url = _url.Replace("{incidentId}", System.Uri.EscapeDataString(incidentId));
+            List<string> _queryParameters = new List<string>();
+            if (Client.ApiVersion != null)
+            {
+                _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(Client.ApiVersion)));
+            }
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("POST");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
+                {
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse<IncidentEntitiesResponse>();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 200)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<IncidentEntitiesResponse>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+        /// <summary>
+        /// Gets all incidents.
+        /// </summary>
+        /// <param name='nextPageLink'>
+        /// The NextLink from the previous successful call to List operation.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse<IPage<Incident>>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (nextPageLink == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "nextPageLink");
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("nextPageLink", nextPageLink);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "ListNext", tracingParameters);
+            }
+            // Construct URL
+            string _url = "{nextLink}";
+            _url = _url.Replace("{nextLink}", nextPageLink);
+            List<string> _queryParameters = new List<string>();
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("GET");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentsOperationsExtensions.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentsOperationsExtensions.cs
index 0a6828e63fefc..e3e743b99b6bd 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentsOperationsExtensions.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/IncidentsOperationsExtensions.cs
@@ -28,8 +28,7 @@ public static partial class IncidentsOperationsExtensions
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -61,8 +60,7 @@ public static partial class IncidentsOperationsExtensions
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -94,14 +92,13 @@ public static partial class IncidentsOperationsExtensions
             }
 
             /// <summary>
-            /// Gets an incident.
+            /// Gets a given incident.
             /// </summary>
             /// <param name='operations'>
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -115,14 +112,13 @@ public static Incident Get(this IIncidentsOperations operations, string resource
             }
 
             /// <summary>
-            /// Gets an incident.
+            /// Gets a given incident.
             /// </summary>
             /// <param name='operations'>
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -142,14 +138,13 @@ public static Incident Get(this IIncidentsOperations operations, string resource
             }
 
             /// <summary>
-            /// Creates or updates the incident.
+            /// Creates or updates an incident.
             /// </summary>
             /// <param name='operations'>
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -166,14 +161,13 @@ public static Incident CreateOrUpdate(this IIncidentsOperations operations, stri
             }
 
             /// <summary>
-            /// Creates or updates the incident.
+            /// Creates or updates an incident.
             /// </summary>
             /// <param name='operations'>
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -196,14 +190,13 @@ public static Incident CreateOrUpdate(this IIncidentsOperations operations, stri
             }
 
             /// <summary>
-            /// Delete the incident.
+            /// Deletes a given incident.
             /// </summary>
             /// <param name='operations'>
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -217,14 +210,13 @@ public static void Delete(this IIncidentsOperations operations, string resourceG
             }
 
             /// <summary>
-            /// Delete the incident.
+            /// Deletes a given incident.
             /// </summary>
             /// <param name='operations'>
             /// The operations group for this extension method.
             /// </param>
             /// <param name='resourceGroupName'>
-            /// The name of the resource group within the user's subscription. The name is
-            /// case insensitive.
+            /// The name of the resource group. The name is case insensitive.
             /// </param>
             /// <param name='workspaceName'>
             /// The name of the workspace.
@@ -240,6 +232,144 @@ public static void Delete(this IIncidentsOperations operations, string resourceG
                 (await operations.DeleteWithHttpMessagesAsync(resourceGroupName, workspaceName, incidentId, null, cancellationToken).ConfigureAwait(false)).Dispose();
             }
 
+            /// <summary>
+            /// Gets all alerts for an incident.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='incidentId'>
+            /// Incident ID
+            /// </param>
+            public static IncidentAlertList ListOfAlerts(this IIncidentsOperations operations, string resourceGroupName, string workspaceName, string incidentId)
+            {
+                return operations.ListOfAlertsAsync(resourceGroupName, workspaceName, incidentId).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Gets all alerts for an incident.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='incidentId'>
+            /// Incident ID
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<IncidentAlertList> ListOfAlertsAsync(this IIncidentsOperations operations, string resourceGroupName, string workspaceName, string incidentId, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.ListOfAlertsWithHttpMessagesAsync(resourceGroupName, workspaceName, incidentId, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+            /// <summary>
+            /// Gets all bookmarks for an incident.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='incidentId'>
+            /// Incident ID
+            /// </param>
+            public static IncidentBookmarkList ListOfBookmarks(this IIncidentsOperations operations, string resourceGroupName, string workspaceName, string incidentId)
+            {
+                return operations.ListOfBookmarksAsync(resourceGroupName, workspaceName, incidentId).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Gets all bookmarks for an incident.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='incidentId'>
+            /// Incident ID
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<IncidentBookmarkList> ListOfBookmarksAsync(this IIncidentsOperations operations, string resourceGroupName, string workspaceName, string incidentId, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.ListOfBookmarksWithHttpMessagesAsync(resourceGroupName, workspaceName, incidentId, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+            /// <summary>
+            /// Gets all entities for an incident.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='incidentId'>
+            /// Incident ID
+            /// </param>
+            public static IncidentEntitiesResponse ListOfEntities(this IIncidentsOperations operations, string resourceGroupName, string workspaceName, string incidentId)
+            {
+                return operations.ListOfEntitiesAsync(resourceGroupName, workspaceName, incidentId).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Gets all entities for an incident.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='incidentId'>
+            /// Incident ID
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<IncidentEntitiesResponse> ListOfEntitiesAsync(this IIncidentsOperations operations, string resourceGroupName, string workspaceName, string incidentId, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.ListOfEntitiesWithHttpMessagesAsync(resourceGroupName, workspaceName, incidentId, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
             /// <summary>
             /// Gets all incidents.
             /// </summary>
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AADDataConnector.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AADDataConnector.cs
deleted file mode 100644
index d820cf3585077..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AADDataConnector.cs
+++ /dev/null
@@ -1,70 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using Microsoft.Rest;
-    using Microsoft.Rest.Serialization;
-    using Newtonsoft.Json;
-    using System.Linq;
-
-    /// <summary>
-    /// Represents AAD (Azure Active Directory) data connector.
-    /// </summary>
-    [Newtonsoft.Json.JsonObject("AzureActiveDirectory")]
-    [Rest.Serialization.JsonTransformation]
-    public partial class AADDataConnector : DataConnector
-    {
-        /// <summary>
-        /// Initializes a new instance of the AADDataConnector class.
-        /// </summary>
-        public AADDataConnector()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the AADDataConnector class.
-        /// </summary>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
-        /// <param name="etag">Etag of the azure resource</param>
-        /// <param name="tenantId">The tenant id to connect to, and get the
-        /// data from.</param>
-        /// <param name="dataTypes">The available data types for the
-        /// connector.</param>
-        public AADDataConnector(string id = default(string), string name = default(string), string type = default(string), string etag = default(string), string tenantId = default(string), AlertsDataTypeOfDataConnector dataTypes = default(AlertsDataTypeOfDataConnector))
-            : base(id, name, type, etag)
-        {
-            TenantId = tenantId;
-            DataTypes = dataTypes;
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-        /// <summary>
-        /// Gets or sets the tenant id to connect to, and get the data from.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.tenantId")]
-        public string TenantId { get; set; }
-
-        /// <summary>
-        /// Gets or sets the available data types for the connector.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.dataTypes")]
-        public AlertsDataTypeOfDataConnector DataTypes { get; set; }
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AATPDataConnector.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AATPDataConnector.cs
deleted file mode 100644
index f9c73a8b99f92..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AATPDataConnector.cs
+++ /dev/null
@@ -1,70 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using Microsoft.Rest;
-    using Microsoft.Rest.Serialization;
-    using Newtonsoft.Json;
-    using System.Linq;
-
-    /// <summary>
-    /// Represents AATP (Azure Advanced Threat Protection) data connector.
-    /// </summary>
-    [Newtonsoft.Json.JsonObject("AzureAdvancedThreatProtection")]
-    [Rest.Serialization.JsonTransformation]
-    public partial class AATPDataConnector : DataConnector
-    {
-        /// <summary>
-        /// Initializes a new instance of the AATPDataConnector class.
-        /// </summary>
-        public AATPDataConnector()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the AATPDataConnector class.
-        /// </summary>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
-        /// <param name="etag">Etag of the azure resource</param>
-        /// <param name="tenantId">The tenant id to connect to, and get the
-        /// data from.</param>
-        /// <param name="dataTypes">The available data types for the
-        /// connector.</param>
-        public AATPDataConnector(string id = default(string), string name = default(string), string type = default(string), string etag = default(string), string tenantId = default(string), AlertsDataTypeOfDataConnector dataTypes = default(AlertsDataTypeOfDataConnector))
-            : base(id, name, type, etag)
-        {
-            TenantId = tenantId;
-            DataTypes = dataTypes;
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-        /// <summary>
-        /// Gets or sets the tenant id to connect to, and get the data from.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.tenantId")]
-        public string TenantId { get; set; }
-
-        /// <summary>
-        /// Gets or sets the available data types for the connector.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.dataTypes")]
-        public AlertsDataTypeOfDataConnector DataTypes { get; set; }
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ASCDataConnector.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ASCDataConnector.cs
deleted file mode 100644
index b0885c94718dd..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ASCDataConnector.cs
+++ /dev/null
@@ -1,71 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using Microsoft.Rest;
-    using Microsoft.Rest.Serialization;
-    using Newtonsoft.Json;
-    using System.Linq;
-
-    /// <summary>
-    /// Represents ASC (Azure Security Center) data connector.
-    /// </summary>
-    [Newtonsoft.Json.JsonObject("AzureSecurityCenter")]
-    [Rest.Serialization.JsonTransformation]
-    public partial class ASCDataConnector : DataConnector
-    {
-        /// <summary>
-        /// Initializes a new instance of the ASCDataConnector class.
-        /// </summary>
-        public ASCDataConnector()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the ASCDataConnector class.
-        /// </summary>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
-        /// <param name="etag">Etag of the azure resource</param>
-        /// <param name="dataTypes">The available data types for the
-        /// connector.</param>
-        /// <param name="subscriptionId">The subscription id to connect to, and
-        /// get the data from.</param>
-        public ASCDataConnector(string id = default(string), string name = default(string), string type = default(string), string etag = default(string), AlertsDataTypeOfDataConnector dataTypes = default(AlertsDataTypeOfDataConnector), string subscriptionId = default(string))
-            : base(id, name, type, etag)
-        {
-            DataTypes = dataTypes;
-            SubscriptionId = subscriptionId;
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-        /// <summary>
-        /// Gets or sets the available data types for the connector.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.dataTypes")]
-        public AlertsDataTypeOfDataConnector DataTypes { get; set; }
-
-        /// <summary>
-        /// Gets or sets the subscription id to connect to, and get the data
-        /// from.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.subscriptionId")]
-        public string SubscriptionId { get; set; }
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AccountEntity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AccountEntity.cs
new file mode 100644
index 0000000000000..2ae363f6c42bb
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AccountEntity.cs
@@ -0,0 +1,194 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents an account entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("Account")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class AccountEntity : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the AccountEntity class.
+        /// </summary>
+        public AccountEntity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the AccountEntity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="aadTenantId">The Azure Active Directory tenant
+        /// id.</param>
+        /// <param name="aadUserId">The Azure Active Directory user id.</param>
+        /// <param name="accountName">The name of the account. This field
+        /// should hold only the name without any domain added to it, i.e.
+        /// administrator.</param>
+        /// <param name="displayName">The display name of the account.</param>
+        /// <param name="hostEntityId">The Host entity id that contains the
+        /// account in case it is a local account (not domain joined)</param>
+        /// <param name="isDomainJoined">Determines whether this is a domain
+        /// account.</param>
+        /// <param name="ntDomain">The NetBIOS domain name as it appears in the
+        /// alert format – domain\username. Examples: NT AUTHORITY.</param>
+        /// <param name="objectGuid">The objectGUID attribute is a single-value
+        /// attribute that is the unique identifier for the object, assigned by
+        /// active directory.</param>
+        /// <param name="puid">The Azure Active Directory Passport User
+        /// ID.</param>
+        /// <param name="sid">The account security identifier, e.g.
+        /// S-1-5-18.</param>
+        /// <param name="upnSuffix">The user principal name suffix for the
+        /// account, in some cases it is also the domain name. Examples:
+        /// contoso.com.</param>
+        /// <param name="dnsDomain">The fully qualified domain DNS
+        /// name.</param>
+        public AccountEntity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), string aadTenantId = default(string), string aadUserId = default(string), string accountName = default(string), string displayName = default(string), string hostEntityId = default(string), bool? isDomainJoined = default(bool?), string ntDomain = default(string), System.Guid? objectGuid = default(System.Guid?), string puid = default(string), string sid = default(string), string upnSuffix = default(string), string dnsDomain = default(string))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            AadTenantId = aadTenantId;
+            AadUserId = aadUserId;
+            AccountName = accountName;
+            DisplayName = displayName;
+            HostEntityId = hostEntityId;
+            IsDomainJoined = isDomainJoined;
+            NtDomain = ntDomain;
+            ObjectGuid = objectGuid;
+            Puid = puid;
+            Sid = sid;
+            UpnSuffix = upnSuffix;
+            DnsDomain = dnsDomain;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets the Azure Active Directory tenant id.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.aadTenantId")]
+        public string AadTenantId { get; private set; }
+
+        /// <summary>
+        /// Gets the Azure Active Directory user id.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.aadUserId")]
+        public string AadUserId { get; private set; }
+
+        /// <summary>
+        /// Gets the name of the account. This field should hold only the name
+        /// without any domain added to it, i.e. administrator.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.accountName")]
+        public string AccountName { get; private set; }
+
+        /// <summary>
+        /// Gets the display name of the account.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.displayName")]
+        public string DisplayName { get; private set; }
+
+        /// <summary>
+        /// Gets the Host entity id that contains the account in case it is a
+        /// local account (not domain joined)
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.hostEntityId")]
+        public string HostEntityId { get; private set; }
+
+        /// <summary>
+        /// Gets determines whether this is a domain account.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.isDomainJoined")]
+        public bool? IsDomainJoined { get; private set; }
+
+        /// <summary>
+        /// Gets the NetBIOS domain name as it appears in the alert format –
+        /// domain\username. Examples: NT AUTHORITY.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.ntDomain")]
+        public string NtDomain { get; private set; }
+
+        /// <summary>
+        /// Gets the objectGUID attribute is a single-value attribute that is
+        /// the unique identifier for the object, assigned by active directory.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.objectGuid")]
+        public System.Guid? ObjectGuid { get; private set; }
+
+        /// <summary>
+        /// Gets the Azure Active Directory Passport User ID.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.puid")]
+        public string Puid { get; private set; }
+
+        /// <summary>
+        /// Gets the account security identifier, e.g. S-1-5-18.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.sid")]
+        public string Sid { get; private set; }
+
+        /// <summary>
+        /// Gets the user principal name suffix for the account, in some cases
+        /// it is also the domain name. Examples: contoso.com.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.upnSuffix")]
+        public string UpnSuffix { get; private set; }
+
+        /// <summary>
+        /// Gets the fully qualified domain DNS name.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.dnsDomain")]
+        public string DnsDomain { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ActionRequest.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ActionRequest.cs
index 248caaf74c61c..c5d5843dc773e 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ActionRequest.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ActionRequest.cs
@@ -36,12 +36,17 @@ public ActionRequest()
         /// /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}.</param>
         /// <param name="triggerUri">Logic App Callback URL for this specific
         /// workflow.</param>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
         /// <param name="etag">Etag of the azure resource</param>
-        public ActionRequest(string logicAppResourceId, string triggerUri, string id = default(string), string name = default(string), string type = default(string), string etag = default(string))
-            : base(id, name, type, etag)
+        public ActionRequest(string logicAppResourceId, string triggerUri, string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), string etag = default(string))
+            : base(id, name, type, systemData, etag)
         {
             LogicAppResourceId = logicAppResourceId;
             TriggerUri = triggerUri;
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ActionResponse.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ActionResponse.cs
index 79f56df2404ec..ddd0355e63417 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ActionResponse.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ActionResponse.cs
@@ -34,14 +34,19 @@ public ActionResponse()
         /// </summary>
         /// <param name="logicAppResourceId">Logic App Resource Id,
         /// /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}.</param>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
         /// <param name="etag">Etag of the action.</param>
         /// <param name="workflowId">The name of the logic app's
         /// workflow.</param>
-        public ActionResponse(string logicAppResourceId, string id = default(string), string name = default(string), string type = default(string), string etag = default(string), string workflowId = default(string))
-            : base(id, name, type)
+        public ActionResponse(string logicAppResourceId, string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), string etag = default(string), string workflowId = default(string))
+            : base(id, name, type, systemData)
         {
             Etag = etag;
             LogicAppResourceId = logicAppResourceId;
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AlertRule.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AlertRule.cs
index 66598dd902927..a3f1fddbbe604 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AlertRule.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AlertRule.cs
@@ -28,12 +28,17 @@ public AlertRule()
         /// <summary>
         /// Initializes a new instance of the AlertRule class.
         /// </summary>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
         /// <param name="etag">Etag of the azure resource</param>
-        public AlertRule(string id = default(string), string name = default(string), string type = default(string), string etag = default(string))
-            : base(id, name, type, etag)
+        public AlertRule(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), string etag = default(string))
+            : base(id, name, type, systemData, etag)
         {
             CustomInit();
         }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AlertRuleTemplate.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AlertRuleTemplate.cs
index 5fd7734c55bcf..3a48612c9419f 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AlertRuleTemplate.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AlertRuleTemplate.cs
@@ -28,11 +28,16 @@ public AlertRuleTemplate()
         /// <summary>
         /// Initializes a new instance of the AlertRuleTemplate class.
         /// </summary>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
-        public AlertRuleTemplate(string id = default(string), string name = default(string), string type = default(string))
-            : base(id, name, type)
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        public AlertRuleTemplate(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData))
+            : base(id, name, type, systemData)
         {
             CustomInit();
         }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AlertStatus.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AlertStatus.cs
new file mode 100644
index 0000000000000..adad0750947c9
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AlertStatus.cs
@@ -0,0 +1,40 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+
+    /// <summary>
+    /// Defines values for AlertStatus.
+    /// </summary>
+    public static class AlertStatus
+    {
+        /// <summary>
+        /// Unknown value
+        /// </summary>
+        public const string Unknown = "Unknown";
+        /// <summary>
+        /// New alert
+        /// </summary>
+        public const string New = "New";
+        /// <summary>
+        /// Alert closed after handling
+        /// </summary>
+        public const string Resolved = "Resolved";
+        /// <summary>
+        /// Alert dismissed as false positive
+        /// </summary>
+        public const string Dismissed = "Dismissed";
+        /// <summary>
+        /// Alert is being handled
+        /// </summary>
+        public const string InProgress = "InProgress";
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AntispamMailDirection.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AntispamMailDirection.cs
new file mode 100644
index 0000000000000..ec3b3453953b9
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AntispamMailDirection.cs
@@ -0,0 +1,36 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+
+    /// <summary>
+    /// Defines values for AntispamMailDirection.
+    /// </summary>
+    public static class AntispamMailDirection
+    {
+        /// <summary>
+        /// Unknown
+        /// </summary>
+        public const string Unknown = "Unknown";
+        /// <summary>
+        /// Inbound
+        /// </summary>
+        public const string Inbound = "Inbound";
+        /// <summary>
+        /// Outbound
+        /// </summary>
+        public const string Outbound = "Outbound";
+        /// <summary>
+        /// Intraorg
+        /// </summary>
+        public const string Intraorg = "Intraorg";
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AwsCloudTrailDataConnector.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AwsCloudTrailDataConnector.cs
deleted file mode 100644
index ee41347c8b5a6..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AwsCloudTrailDataConnector.cs
+++ /dev/null
@@ -1,71 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using Microsoft.Rest;
-    using Microsoft.Rest.Serialization;
-    using Newtonsoft.Json;
-    using System.Linq;
-
-    /// <summary>
-    /// Represents Amazon Web Services CloudTrail data connector.
-    /// </summary>
-    [Newtonsoft.Json.JsonObject("AmazonWebServicesCloudTrail")]
-    [Rest.Serialization.JsonTransformation]
-    public partial class AwsCloudTrailDataConnector : DataConnector
-    {
-        /// <summary>
-        /// Initializes a new instance of the AwsCloudTrailDataConnector class.
-        /// </summary>
-        public AwsCloudTrailDataConnector()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the AwsCloudTrailDataConnector class.
-        /// </summary>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
-        /// <param name="etag">Etag of the azure resource</param>
-        /// <param name="awsRoleArn">The Aws Role Arn (with CloudTrailReadOnly
-        /// policy) that is used to access the Aws account.</param>
-        /// <param name="dataTypes">The available data types for the
-        /// connector.</param>
-        public AwsCloudTrailDataConnector(string id = default(string), string name = default(string), string type = default(string), string etag = default(string), string awsRoleArn = default(string), AwsCloudTrailDataConnectorDataTypes dataTypes = default(AwsCloudTrailDataConnectorDataTypes))
-            : base(id, name, type, etag)
-        {
-            AwsRoleArn = awsRoleArn;
-            DataTypes = dataTypes;
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-        /// <summary>
-        /// Gets or sets the Aws Role Arn (with CloudTrailReadOnly policy) that
-        /// is used to access the Aws account.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.awsRoleArn")]
-        public string AwsRoleArn { get; set; }
-
-        /// <summary>
-        /// Gets or sets the available data types for the connector.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.dataTypes")]
-        public AwsCloudTrailDataConnectorDataTypes DataTypes { get; set; }
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AwsCloudTrailDataConnectorDataTypesLogs.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AwsCloudTrailDataConnectorDataTypesLogs.cs
deleted file mode 100644
index 02803069b81e5..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AwsCloudTrailDataConnectorDataTypesLogs.cs
+++ /dev/null
@@ -1,48 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using System.Linq;
-
-    /// <summary>
-    /// Logs data type.
-    /// </summary>
-    public partial class AwsCloudTrailDataConnectorDataTypesLogs : DataConnectorDataTypeCommon
-    {
-        /// <summary>
-        /// Initializes a new instance of the
-        /// AwsCloudTrailDataConnectorDataTypesLogs class.
-        /// </summary>
-        public AwsCloudTrailDataConnectorDataTypesLogs()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the
-        /// AwsCloudTrailDataConnectorDataTypesLogs class.
-        /// </summary>
-        /// <param name="state">Describe whether this data type connection is
-        /// enabled or not. Possible values include: 'Enabled',
-        /// 'Disabled'</param>
-        public AwsCloudTrailDataConnectorDataTypesLogs(string state = default(string))
-            : base(state)
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AzureEntityResource.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AzureEntityResource.cs
new file mode 100644
index 0000000000000..ac65db7abfa7d
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AzureEntityResource.cs
@@ -0,0 +1,64 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using System.Linq;
+
+    /// <summary>
+    /// Entity Resource
+    /// </summary>
+    /// <remarks>
+    /// The resource model definition for an Azure Resource Manager resource
+    /// with an etag.
+    /// </remarks>
+    public partial class AzureEntityResource : Resource
+    {
+        /// <summary>
+        /// Initializes a new instance of the AzureEntityResource class.
+        /// </summary>
+        public AzureEntityResource()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the AzureEntityResource class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="etag">Resource Etag.</param>
+        public AzureEntityResource(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), string etag = default(string))
+            : base(id, name, type, systemData)
+        {
+            Etag = etag;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets resource Etag.
+        /// </summary>
+        [JsonProperty(PropertyName = "etag")]
+        public string Etag { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AzureResourceEntity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AzureResourceEntity.cs
new file mode 100644
index 0000000000000..7fbe3af558223
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AzureResourceEntity.cs
@@ -0,0 +1,98 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents an azure resource entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("AzureResource")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class AzureResourceEntity : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the AzureResourceEntity class.
+        /// </summary>
+        public AzureResourceEntity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the AzureResourceEntity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="resourceId">The azure resource id of the
+        /// resource</param>
+        /// <param name="subscriptionId">The subscription id of the
+        /// resource</param>
+        public AzureResourceEntity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), string resourceId = default(string), string subscriptionId = default(string))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            ResourceId = resourceId;
+            SubscriptionId = subscriptionId;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets the azure resource id of the resource
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.resourceId")]
+        public string ResourceId { get; private set; }
+
+        /// <summary>
+        /// Gets the subscription id of the resource
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.subscriptionId")]
+        public string SubscriptionId { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/CloudApplicationEntity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/CloudApplicationEntity.cs
new file mode 100644
index 0000000000000..e6d679a7d13ea
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/CloudApplicationEntity.cs
@@ -0,0 +1,110 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents a cloud application entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("CloudApplication")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class CloudApplicationEntity : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the CloudApplicationEntity class.
+        /// </summary>
+        public CloudApplicationEntity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the CloudApplicationEntity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="appId">The technical identifier of the
+        /// application.</param>
+        /// <param name="appName">The name of the related cloud
+        /// application.</param>
+        /// <param name="instanceName">The user defined instance name of the
+        /// cloud application. It is often used to distinguish between several
+        /// applications of the same type that a customer has.</param>
+        public CloudApplicationEntity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), int? appId = default(int?), string appName = default(string), string instanceName = default(string))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            AppId = appId;
+            AppName = appName;
+            InstanceName = instanceName;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets the technical identifier of the application.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.appId")]
+        public int? AppId { get; private set; }
+
+        /// <summary>
+        /// Gets the name of the related cloud application.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.appName")]
+        public string AppName { get; private set; }
+
+        /// <summary>
+        /// Gets the user defined instance name of the cloud application. It is
+        /// often used to distinguish between several applications of the same
+        /// type that a customer has.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.instanceName")]
+        public string InstanceName { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ConfidenceLevel.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ConfidenceLevel.cs
new file mode 100644
index 0000000000000..8cc0d1c0ca290
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ConfidenceLevel.cs
@@ -0,0 +1,33 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+
+    /// <summary>
+    /// Defines values for ConfidenceLevel.
+    /// </summary>
+    public static class ConfidenceLevel
+    {
+        /// <summary>
+        /// Unknown confidence, the is the default value
+        /// </summary>
+        public const string Unknown = "Unknown";
+        /// <summary>
+        /// Low confidence, meaning we have some doubts this is indeed
+        /// malicious or part of an attack
+        /// </summary>
+        public const string Low = "Low";
+        /// <summary>
+        /// High confidence that the alert is true positive malicious
+        /// </summary>
+        public const string High = "High";
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ConfidenceScoreStatus.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ConfidenceScoreStatus.cs
new file mode 100644
index 0000000000000..954928060d6cc
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ConfidenceScoreStatus.cs
@@ -0,0 +1,39 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+
+    /// <summary>
+    /// Defines values for ConfidenceScoreStatus.
+    /// </summary>
+    public static class ConfidenceScoreStatus
+    {
+        /// <summary>
+        /// Score will not be calculated for this alert as it is not supported
+        /// by virtual analyst
+        /// </summary>
+        public const string NotApplicable = "NotApplicable";
+        /// <summary>
+        /// No score was set yet and calculation is in progress
+        /// </summary>
+        public const string InProcess = "InProcess";
+        /// <summary>
+        /// Score is calculated and shown as part of the alert, but may be
+        /// updated again at a later time following the processing of
+        /// additional data
+        /// </summary>
+        public const string NotFinal = "NotFinal";
+        /// <summary>
+        /// Final score was calculated and available
+        /// </summary>
+        public const string Final = "Final";
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/LicenseStatus.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/CreatedByType.cs
similarity index 62%
rename from sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/LicenseStatus.cs
rename to sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/CreatedByType.cs
index 5791bdcbd9b92..3cd5fb995c533 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/LicenseStatus.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/CreatedByType.cs
@@ -12,11 +12,13 @@ namespace Microsoft.Azure.Management.SecurityInsights.Models
 {
 
     /// <summary>
-    /// Defines values for LicenseStatus.
+    /// Defines values for CreatedByType.
     /// </summary>
-    public static class LicenseStatus
+    public static class CreatedByType
     {
-        public const string Enabled = "Enabled";
-        public const string Disabled = "Disabled";
+        public const string User = "User";
+        public const string Application = "Application";
+        public const string ManagedIdentity = "ManagedIdentity";
+        public const string Key = "Key";
     }
 }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DataConnector.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DataConnector.cs
deleted file mode 100644
index 41ea4bba92e3e..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DataConnector.cs
+++ /dev/null
@@ -1,47 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using System.Linq;
-
-    /// <summary>
-    /// Data connector.
-    /// </summary>
-    public partial class DataConnector : ResourceWithEtag
-    {
-        /// <summary>
-        /// Initializes a new instance of the DataConnector class.
-        /// </summary>
-        public DataConnector()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the DataConnector class.
-        /// </summary>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
-        /// <param name="etag">Etag of the azure resource</param>
-        public DataConnector(string id = default(string), string name = default(string), string type = default(string), string etag = default(string))
-            : base(id, name, type, etag)
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DataConnectorKind.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DataConnectorKind.cs
deleted file mode 100644
index 6db67ec03c55b..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DataConnectorKind.cs
+++ /dev/null
@@ -1,28 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-
-    /// <summary>
-    /// Defines values for DataConnectorKind.
-    /// </summary>
-    public static class DataConnectorKind
-    {
-        public const string AzureActiveDirectory = "AzureActiveDirectory";
-        public const string AzureSecurityCenter = "AzureSecurityCenter";
-        public const string MicrosoftCloudAppSecurity = "MicrosoftCloudAppSecurity";
-        public const string ThreatIntelligence = "ThreatIntelligence";
-        public const string Office365 = "Office365";
-        public const string AmazonWebServicesCloudTrail = "AmazonWebServicesCloudTrail";
-        public const string AzureAdvancedThreatProtection = "AzureAdvancedThreatProtection";
-        public const string MicrosoftDefenderAdvancedThreatProtection = "MicrosoftDefenderAdvancedThreatProtection";
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DeliveryAction.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DeliveryAction.cs
new file mode 100644
index 0000000000000..80e8366eaa8ee
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DeliveryAction.cs
@@ -0,0 +1,93 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using Newtonsoft.Json.Converters;
+    using System.Runtime;
+    using System.Runtime.Serialization;
+
+    /// <summary>
+    /// Defines values for DeliveryAction.
+    /// </summary>
+    [JsonConverter(typeof(StringEnumConverter))]
+    public enum DeliveryAction
+    {
+        /// <summary>
+        /// Unknown
+        /// </summary>
+        [EnumMember(Value = "Unknown")]
+        Unknown,
+        /// <summary>
+        /// DeliveredAsSpam
+        /// </summary>
+        [EnumMember(Value = "DeliveredAsSpam")]
+        DeliveredAsSpam,
+        /// <summary>
+        /// Delivered
+        /// </summary>
+        [EnumMember(Value = "Delivered")]
+        Delivered,
+        /// <summary>
+        /// Blocked
+        /// </summary>
+        [EnumMember(Value = "Blocked")]
+        Blocked,
+        /// <summary>
+        /// Replaced
+        /// </summary>
+        [EnumMember(Value = "Replaced")]
+        Replaced
+    }
+    internal static class DeliveryActionEnumExtension
+    {
+        internal static string ToSerializedValue(this DeliveryAction? value)
+        {
+            return value == null ? null : ((DeliveryAction)value).ToSerializedValue();
+        }
+
+        internal static string ToSerializedValue(this DeliveryAction value)
+        {
+            switch( value )
+            {
+                case DeliveryAction.Unknown:
+                    return "Unknown";
+                case DeliveryAction.DeliveredAsSpam:
+                    return "DeliveredAsSpam";
+                case DeliveryAction.Delivered:
+                    return "Delivered";
+                case DeliveryAction.Blocked:
+                    return "Blocked";
+                case DeliveryAction.Replaced:
+                    return "Replaced";
+            }
+            return null;
+        }
+
+        internal static DeliveryAction? ParseDeliveryAction(this string value)
+        {
+            switch( value )
+            {
+                case "Unknown":
+                    return DeliveryAction.Unknown;
+                case "DeliveredAsSpam":
+                    return DeliveryAction.DeliveredAsSpam;
+                case "Delivered":
+                    return DeliveryAction.Delivered;
+                case "Blocked":
+                    return DeliveryAction.Blocked;
+                case "Replaced":
+                    return DeliveryAction.Replaced;
+            }
+            return null;
+        }
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DeliveryLocation.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DeliveryLocation.cs
new file mode 100644
index 0000000000000..1b77e05e79295
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DeliveryLocation.cs
@@ -0,0 +1,129 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using Newtonsoft.Json.Converters;
+    using System.Runtime;
+    using System.Runtime.Serialization;
+
+    /// <summary>
+    /// Defines values for DeliveryLocation.
+    /// </summary>
+    [JsonConverter(typeof(StringEnumConverter))]
+    public enum DeliveryLocation
+    {
+        /// <summary>
+        /// Unknown
+        /// </summary>
+        [EnumMember(Value = "Unknown")]
+        Unknown,
+        /// <summary>
+        /// Inbox
+        /// </summary>
+        [EnumMember(Value = "Inbox")]
+        Inbox,
+        /// <summary>
+        /// JunkFolder
+        /// </summary>
+        [EnumMember(Value = "JunkFolder")]
+        JunkFolder,
+        /// <summary>
+        /// DeletedFolder
+        /// </summary>
+        [EnumMember(Value = "DeletedFolder")]
+        DeletedFolder,
+        /// <summary>
+        /// Quarantine
+        /// </summary>
+        [EnumMember(Value = "Quarantine")]
+        Quarantine,
+        /// <summary>
+        /// External
+        /// </summary>
+        [EnumMember(Value = "External")]
+        External,
+        /// <summary>
+        /// Failed
+        /// </summary>
+        [EnumMember(Value = "Failed")]
+        Failed,
+        /// <summary>
+        /// Dropped
+        /// </summary>
+        [EnumMember(Value = "Dropped")]
+        Dropped,
+        /// <summary>
+        /// Forwarded
+        /// </summary>
+        [EnumMember(Value = "Forwarded")]
+        Forwarded
+    }
+    internal static class DeliveryLocationEnumExtension
+    {
+        internal static string ToSerializedValue(this DeliveryLocation? value)
+        {
+            return value == null ? null : ((DeliveryLocation)value).ToSerializedValue();
+        }
+
+        internal static string ToSerializedValue(this DeliveryLocation value)
+        {
+            switch( value )
+            {
+                case DeliveryLocation.Unknown:
+                    return "Unknown";
+                case DeliveryLocation.Inbox:
+                    return "Inbox";
+                case DeliveryLocation.JunkFolder:
+                    return "JunkFolder";
+                case DeliveryLocation.DeletedFolder:
+                    return "DeletedFolder";
+                case DeliveryLocation.Quarantine:
+                    return "Quarantine";
+                case DeliveryLocation.External:
+                    return "External";
+                case DeliveryLocation.Failed:
+                    return "Failed";
+                case DeliveryLocation.Dropped:
+                    return "Dropped";
+                case DeliveryLocation.Forwarded:
+                    return "Forwarded";
+            }
+            return null;
+        }
+
+        internal static DeliveryLocation? ParseDeliveryLocation(this string value)
+        {
+            switch( value )
+            {
+                case "Unknown":
+                    return DeliveryLocation.Unknown;
+                case "Inbox":
+                    return DeliveryLocation.Inbox;
+                case "JunkFolder":
+                    return DeliveryLocation.JunkFolder;
+                case "DeletedFolder":
+                    return DeliveryLocation.DeletedFolder;
+                case "Quarantine":
+                    return DeliveryLocation.Quarantine;
+                case "External":
+                    return DeliveryLocation.External;
+                case "Failed":
+                    return DeliveryLocation.Failed;
+                case "Dropped":
+                    return DeliveryLocation.Dropped;
+                case "Forwarded":
+                    return DeliveryLocation.Forwarded;
+            }
+            return null;
+        }
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DnsEntity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DnsEntity.cs
new file mode 100644
index 0000000000000..575cb10971d1a
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DnsEntity.cs
@@ -0,0 +1,116 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents a dns entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("DnsResolution")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class DnsEntity : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the DnsEntity class.
+        /// </summary>
+        public DnsEntity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the DnsEntity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="dnsServerIpEntityId">An ip entity id for the dns
+        /// server resolving the request</param>
+        /// <param name="domainName">The name of the dns record associated with
+        /// the alert</param>
+        /// <param name="hostIpAddressEntityId">An ip entity id for the dns
+        /// request client</param>
+        /// <param name="ipAddressEntityIds">Ip entity identifiers for the
+        /// resolved ip address.</param>
+        public DnsEntity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), string dnsServerIpEntityId = default(string), string domainName = default(string), string hostIpAddressEntityId = default(string), IList<string> ipAddressEntityIds = default(IList<string>))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            DnsServerIpEntityId = dnsServerIpEntityId;
+            DomainName = domainName;
+            HostIpAddressEntityId = hostIpAddressEntityId;
+            IpAddressEntityIds = ipAddressEntityIds;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets an ip entity id for the dns server resolving the request
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.dnsServerIpEntityId")]
+        public string DnsServerIpEntityId { get; private set; }
+
+        /// <summary>
+        /// Gets the name of the dns record associated with the alert
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.domainName")]
+        public string DomainName { get; private set; }
+
+        /// <summary>
+        /// Gets an ip entity id for the dns request client
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.hostIpAddressEntityId")]
+        public string HostIpAddressEntityId { get; private set; }
+
+        /// <summary>
+        /// Gets ip entity identifiers for the resolved ip address.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.ipAddressEntityIds")]
+        public IList<string> IpAddressEntityIds { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ElevationToken.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ElevationToken.cs
new file mode 100644
index 0000000000000..810dfb319f6e1
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ElevationToken.cs
@@ -0,0 +1,75 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using Newtonsoft.Json.Converters;
+    using System.Runtime;
+    using System.Runtime.Serialization;
+
+    /// <summary>
+    /// Defines values for ElevationToken.
+    /// </summary>
+    [JsonConverter(typeof(StringEnumConverter))]
+    public enum ElevationToken
+    {
+        /// <summary>
+        /// Default elevation token
+        /// </summary>
+        [EnumMember(Value = "Default")]
+        Default,
+        /// <summary>
+        /// Full elevation token
+        /// </summary>
+        [EnumMember(Value = "Full")]
+        Full,
+        /// <summary>
+        /// Limited elevation token
+        /// </summary>
+        [EnumMember(Value = "Limited")]
+        Limited
+    }
+    internal static class ElevationTokenEnumExtension
+    {
+        internal static string ToSerializedValue(this ElevationToken? value)
+        {
+            return value == null ? null : ((ElevationToken)value).ToSerializedValue();
+        }
+
+        internal static string ToSerializedValue(this ElevationToken value)
+        {
+            switch( value )
+            {
+                case ElevationToken.Default:
+                    return "Default";
+                case ElevationToken.Full:
+                    return "Full";
+                case ElevationToken.Limited:
+                    return "Limited";
+            }
+            return null;
+        }
+
+        internal static ElevationToken? ParseElevationToken(this string value)
+        {
+            switch( value )
+            {
+                case "Default":
+                    return ElevationToken.Default;
+                case "Full":
+                    return ElevationToken.Full;
+                case "Limited":
+                    return ElevationToken.Limited;
+            }
+            return null;
+        }
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Entity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Entity.cs
new file mode 100644
index 0000000000000..a7a4e29d8d966
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Entity.cs
@@ -0,0 +1,83 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using System.Linq;
+
+    /// <summary>
+    /// Specific entity.
+    /// </summary>
+    public partial class Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the Entity class.
+        /// </summary>
+        public Entity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the Entity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        public Entity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData))
+        {
+            Id = id;
+            Name = name;
+            Type = type;
+            SystemData = systemData;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}
+        /// </summary>
+        [JsonProperty(PropertyName = "id")]
+        public string Id { get; private set; }
+
+        /// <summary>
+        /// Gets the name of the resource
+        /// </summary>
+        [JsonProperty(PropertyName = "name")]
+        public string Name { get; private set; }
+
+        /// <summary>
+        /// Gets the type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"
+        /// </summary>
+        [JsonProperty(PropertyName = "type")]
+        public string Type { get; private set; }
+
+        /// <summary>
+        /// Gets azure Resource Manager metadata containing createdBy and
+        /// modifiedBy information.
+        /// </summary>
+        [JsonProperty(PropertyName = "systemData")]
+        public SystemData SystemData { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/EntityCommonProperties.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/EntityCommonProperties.cs
new file mode 100644
index 0000000000000..1ea2909c2bb81
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/EntityCommonProperties.cs
@@ -0,0 +1,67 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Entity common property bag.
+    /// </summary>
+    public partial class EntityCommonProperties
+    {
+        /// <summary>
+        /// Initializes a new instance of the EntityCommonProperties class.
+        /// </summary>
+        public EntityCommonProperties()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the EntityCommonProperties class.
+        /// </summary>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        public EntityCommonProperties(IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string))
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "friendlyName")]
+        public string FriendlyName { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/EntityEdges.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/EntityEdges.cs
new file mode 100644
index 0000000000000..440e7c2ed591f
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/EntityEdges.cs
@@ -0,0 +1,63 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// The edge that connects the entity to the other entity.
+    /// </summary>
+    public partial class EntityEdges
+    {
+        /// <summary>
+        /// Initializes a new instance of the EntityEdges class.
+        /// </summary>
+        public EntityEdges()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the EntityEdges class.
+        /// </summary>
+        /// <param name="targetEntityId">The target entity Id.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        public EntityEdges(string targetEntityId = default(string), IDictionary<string, object> additionalData = default(IDictionary<string, object>))
+        {
+            TargetEntityId = targetEntityId;
+            AdditionalData = additionalData;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets or sets the target entity Id.
+        /// </summary>
+        [JsonProperty(PropertyName = "targetEntityId")]
+        public string TargetEntityId { get; set; }
+
+        /// <summary>
+        /// Gets or sets a bag of custom fields that should be part of the
+        /// entity and will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "additionalData")]
+        public IDictionary<string, object> AdditionalData { get; set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/EntityKind.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/EntityKind.cs
new file mode 100644
index 0000000000000..43c66ddc82a53
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/EntityKind.cs
@@ -0,0 +1,75 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Newtonsoft.Json;
+    using System.Linq;
+
+    /// <summary>
+    /// Describes an entity with kind.
+    /// </summary>
+    public partial class EntityKind
+    {
+        /// <summary>
+        /// Initializes a new instance of the EntityKind class.
+        /// </summary>
+        public EntityKind()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the EntityKind class.
+        /// </summary>
+        /// <param name="kind">The kind of the entity. Possible values include:
+        /// 'Account', 'Host', 'File', 'AzureResource', 'CloudApplication',
+        /// 'DnsResolution', 'FileHash', 'Ip', 'Malware', 'Process',
+        /// 'RegistryKey', 'RegistryValue', 'SecurityGroup', 'Url',
+        /// 'IoTDevice', 'SecurityAlert', 'Bookmark', 'MailCluster',
+        /// 'MailMessage', 'Mailbox', 'SubmissionMail'</param>
+        public EntityKind(string kind)
+        {
+            Kind = kind;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets or sets the kind of the entity. Possible values include:
+        /// 'Account', 'Host', 'File', 'AzureResource', 'CloudApplication',
+        /// 'DnsResolution', 'FileHash', 'Ip', 'Malware', 'Process',
+        /// 'RegistryKey', 'RegistryValue', 'SecurityGroup', 'Url',
+        /// 'IoTDevice', 'SecurityAlert', 'Bookmark', 'MailCluster',
+        /// 'MailMessage', 'Mailbox', 'SubmissionMail'
+        /// </summary>
+        [JsonProperty(PropertyName = "kind")]
+        public string Kind { get; set; }
+
+        /// <summary>
+        /// Validate the object.
+        /// </summary>
+        /// <exception cref="ValidationException">
+        /// Thrown if validation fails
+        /// </exception>
+        public virtual void Validate()
+        {
+            if (Kind == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "Kind");
+            }
+        }
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/EntityKindEnum.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/EntityKindEnum.cs
new file mode 100644
index 0000000000000..9d2b8d711433a
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/EntityKindEnum.cs
@@ -0,0 +1,104 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+
+    /// <summary>
+    /// Defines values for EntityKindEnum.
+    /// </summary>
+    public static class EntityKindEnum
+    {
+        /// <summary>
+        /// Entity represents account in the system.
+        /// </summary>
+        public const string Account = "Account";
+        /// <summary>
+        /// Entity represents host in the system.
+        /// </summary>
+        public const string Host = "Host";
+        /// <summary>
+        /// Entity represents file in the system.
+        /// </summary>
+        public const string File = "File";
+        /// <summary>
+        /// Entity represents azure resource in the system.
+        /// </summary>
+        public const string AzureResource = "AzureResource";
+        /// <summary>
+        /// Entity represents cloud application in the system.
+        /// </summary>
+        public const string CloudApplication = "CloudApplication";
+        /// <summary>
+        /// Entity represents dns resolution in the system.
+        /// </summary>
+        public const string DnsResolution = "DnsResolution";
+        /// <summary>
+        /// Entity represents file hash in the system.
+        /// </summary>
+        public const string FileHash = "FileHash";
+        /// <summary>
+        /// Entity represents ip in the system.
+        /// </summary>
+        public const string Ip = "Ip";
+        /// <summary>
+        /// Entity represents malware in the system.
+        /// </summary>
+        public const string Malware = "Malware";
+        /// <summary>
+        /// Entity represents process in the system.
+        /// </summary>
+        public const string Process = "Process";
+        /// <summary>
+        /// Entity represents registry key in the system.
+        /// </summary>
+        public const string RegistryKey = "RegistryKey";
+        /// <summary>
+        /// Entity represents registry value in the system.
+        /// </summary>
+        public const string RegistryValue = "RegistryValue";
+        /// <summary>
+        /// Entity represents security group in the system.
+        /// </summary>
+        public const string SecurityGroup = "SecurityGroup";
+        /// <summary>
+        /// Entity represents url in the system.
+        /// </summary>
+        public const string Url = "Url";
+        /// <summary>
+        /// Entity represents IoT device in the system.
+        /// </summary>
+        public const string IoTDevice = "IoTDevice";
+        /// <summary>
+        /// Entity represents security alert in the system.
+        /// </summary>
+        public const string SecurityAlert = "SecurityAlert";
+        /// <summary>
+        /// Entity represents bookmark in the system.
+        /// </summary>
+        public const string Bookmark = "Bookmark";
+        /// <summary>
+        /// Entity represents mail cluster in the system.
+        /// </summary>
+        public const string MailCluster = "MailCluster";
+        /// <summary>
+        /// Entity represents mail message in the system.
+        /// </summary>
+        public const string MailMessage = "MailMessage";
+        /// <summary>
+        /// Entity represents mailbox in the system.
+        /// </summary>
+        public const string Mailbox = "Mailbox";
+        /// <summary>
+        /// Entity represents submission mail in the system.
+        /// </summary>
+        public const string SubmissionMail = "SubmissionMail";
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ErrorDetail.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ErrorDetail.cs
new file mode 100644
index 0000000000000..f100dc6720818
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ErrorDetail.cs
@@ -0,0 +1,85 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// The error detail.
+    /// </summary>
+    public partial class ErrorDetail
+    {
+        /// <summary>
+        /// Initializes a new instance of the ErrorDetail class.
+        /// </summary>
+        public ErrorDetail()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the ErrorDetail class.
+        /// </summary>
+        /// <param name="code">The error code.</param>
+        /// <param name="message">The error message.</param>
+        /// <param name="target">The error target.</param>
+        /// <param name="details">The error details.</param>
+        /// <param name="additionalInfo">The error additional info.</param>
+        public ErrorDetail(string code = default(string), string message = default(string), string target = default(string), IList<ErrorDetail> details = default(IList<ErrorDetail>), IList<ErrorAdditionalInfo> additionalInfo = default(IList<ErrorAdditionalInfo>))
+        {
+            Code = code;
+            Message = message;
+            Target = target;
+            Details = details;
+            AdditionalInfo = additionalInfo;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets the error code.
+        /// </summary>
+        [JsonProperty(PropertyName = "code")]
+        public string Code { get; private set; }
+
+        /// <summary>
+        /// Gets the error message.
+        /// </summary>
+        [JsonProperty(PropertyName = "message")]
+        public string Message { get; private set; }
+
+        /// <summary>
+        /// Gets the error target.
+        /// </summary>
+        [JsonProperty(PropertyName = "target")]
+        public string Target { get; private set; }
+
+        /// <summary>
+        /// Gets the error details.
+        /// </summary>
+        [JsonProperty(PropertyName = "details")]
+        public IList<ErrorDetail> Details { get; private set; }
+
+        /// <summary>
+        /// Gets the error additional info.
+        /// </summary>
+        [JsonProperty(PropertyName = "additionalInfo")]
+        public IList<ErrorAdditionalInfo> AdditionalInfo { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ErrorResponse.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ErrorResponse.cs
index a60cf83241746..7d2ad4e463770 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ErrorResponse.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ErrorResponse.cs
@@ -11,17 +11,15 @@
 namespace Microsoft.Azure.Management.SecurityInsights.Models
 {
     using Newtonsoft.Json;
-    using System.Collections;
-    using System.Collections.Generic;
     using System.Linq;
 
     /// <summary>
-    /// Error Response
+    /// Error response
     /// </summary>
     /// <remarks>
     /// Common error response for all Azure Resource Manager APIs to return
     /// error details for failed operations. (This also follows the OData error
-    /// response format.)
+    /// response format.).
     /// </remarks>
     public partial class ErrorResponse
     {
@@ -36,18 +34,10 @@ public ErrorResponse()
         /// <summary>
         /// Initializes a new instance of the ErrorResponse class.
         /// </summary>
-        /// <param name="code">The error code.</param>
-        /// <param name="message">The error message.</param>
-        /// <param name="target">The error target.</param>
-        /// <param name="details">The error details.</param>
-        /// <param name="additionalInfo">The error additional info.</param>
-        public ErrorResponse(string code = default(string), string message = default(string), string target = default(string), IList<ErrorResponse> details = default(IList<ErrorResponse>), IList<ErrorAdditionalInfo> additionalInfo = default(IList<ErrorAdditionalInfo>))
+        /// <param name="error">The error object.</param>
+        public ErrorResponse(ErrorDetail error = default(ErrorDetail))
         {
-            Code = code;
-            Message = message;
-            Target = target;
-            Details = details;
-            AdditionalInfo = additionalInfo;
+            Error = error;
             CustomInit();
         }
 
@@ -57,34 +47,10 @@ public ErrorResponse()
         partial void CustomInit();
 
         /// <summary>
-        /// Gets the error code.
+        /// Gets or sets the error object.
         /// </summary>
-        [JsonProperty(PropertyName = "code")]
-        public string Code { get; private set; }
-
-        /// <summary>
-        /// Gets the error message.
-        /// </summary>
-        [JsonProperty(PropertyName = "message")]
-        public string Message { get; private set; }
-
-        /// <summary>
-        /// Gets the error target.
-        /// </summary>
-        [JsonProperty(PropertyName = "target")]
-        public string Target { get; private set; }
-
-        /// <summary>
-        /// Gets the error details.
-        /// </summary>
-        [JsonProperty(PropertyName = "details")]
-        public IList<ErrorResponse> Details { get; private set; }
-
-        /// <summary>
-        /// Gets the error additional info.
-        /// </summary>
-        [JsonProperty(PropertyName = "additionalInfo")]
-        public IList<ErrorAdditionalInfo> AdditionalInfo { get; private set; }
+        [JsonProperty(PropertyName = "error")]
+        public ErrorDetail Error { get; set; }
 
     }
 }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ErrorResponseException.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ErrorResponseException.cs
new file mode 100644
index 0000000000000..93959aa48c537
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ErrorResponseException.cs
@@ -0,0 +1,62 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+
+    /// <summary>
+    /// Exception thrown for an invalid response with ErrorResponse
+    /// information.
+    /// </summary>
+    public partial class ErrorResponseException : RestException
+    {
+        /// <summary>
+        /// Gets information about the associated HTTP request.
+        /// </summary>
+        public HttpRequestMessageWrapper Request { get; set; }
+
+        /// <summary>
+        /// Gets information about the associated HTTP response.
+        /// </summary>
+        public HttpResponseMessageWrapper Response { get; set; }
+
+        /// <summary>
+        /// Gets or sets the body object.
+        /// </summary>
+        public ErrorResponse Body { get; set; }
+
+        /// <summary>
+        /// Initializes a new instance of the ErrorResponseException class.
+        /// </summary>
+        public ErrorResponseException()
+        {
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the ErrorResponseException class.
+        /// </summary>
+        /// <param name="message">The exception message.</param>
+        public ErrorResponseException(string message)
+            : this(message, null)
+        {
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the ErrorResponseException class.
+        /// </summary>
+        /// <param name="message">The exception message.</param>
+        /// <param name="innerException">Inner exception.</param>
+        public ErrorResponseException(string message, System.Exception innerException)
+            : base(message, innerException)
+        {
+        }
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/FileEntity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/FileEntity.cs
new file mode 100644
index 0000000000000..40bbc9d001384
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/FileEntity.cs
@@ -0,0 +1,116 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents a file entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("File")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class FileEntity : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the FileEntity class.
+        /// </summary>
+        public FileEntity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the FileEntity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="directory">The full path to the file.</param>
+        /// <param name="fileHashEntityIds">The file hash entity identifiers
+        /// associated with this file</param>
+        /// <param name="fileName">The file name without path (some alerts
+        /// might not include path).</param>
+        /// <param name="hostEntityId">The Host entity id which the file
+        /// belongs to</param>
+        public FileEntity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), string directory = default(string), IList<string> fileHashEntityIds = default(IList<string>), string fileName = default(string), string hostEntityId = default(string))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            Directory = directory;
+            FileHashEntityIds = fileHashEntityIds;
+            FileName = fileName;
+            HostEntityId = hostEntityId;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets the full path to the file.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.directory")]
+        public string Directory { get; private set; }
+
+        /// <summary>
+        /// Gets the file hash entity identifiers associated with this file
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.fileHashEntityIds")]
+        public IList<string> FileHashEntityIds { get; private set; }
+
+        /// <summary>
+        /// Gets the file name without path (some alerts might not include
+        /// path).
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.fileName")]
+        public string FileName { get; private set; }
+
+        /// <summary>
+        /// Gets the Host entity id which the file belongs to
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.hostEntityId")]
+        public string HostEntityId { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/FileHashAlgorithm.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/FileHashAlgorithm.cs
new file mode 100644
index 0000000000000..c0bdf6b8df93b
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/FileHashAlgorithm.cs
@@ -0,0 +1,40 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+
+    /// <summary>
+    /// Defines values for FileHashAlgorithm.
+    /// </summary>
+    public static class FileHashAlgorithm
+    {
+        /// <summary>
+        /// Unknown hash algorithm
+        /// </summary>
+        public const string Unknown = "Unknown";
+        /// <summary>
+        /// MD5 hash type
+        /// </summary>
+        public const string MD5 = "MD5";
+        /// <summary>
+        /// SHA1 hash type
+        /// </summary>
+        public const string SHA1 = "SHA1";
+        /// <summary>
+        /// SHA256 hash type
+        /// </summary>
+        public const string SHA256 = "SHA256";
+        /// <summary>
+        /// SHA256 Authenticode hash type
+        /// </summary>
+        public const string SHA256AC = "SHA256AC";
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/FileHashEntity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/FileHashEntity.cs
new file mode 100644
index 0000000000000..d2ebd8fa56475
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/FileHashEntity.cs
@@ -0,0 +1,98 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents a file hash entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("FileHash")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class FileHashEntity : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the FileHashEntity class.
+        /// </summary>
+        public FileHashEntity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the FileHashEntity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="algorithm">The hash algorithm type. Possible values
+        /// include: 'Unknown', 'MD5', 'SHA1', 'SHA256', 'SHA256AC'</param>
+        /// <param name="hashValue">The file hash value.</param>
+        public FileHashEntity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), string algorithm = default(string), string hashValue = default(string))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            Algorithm = algorithm;
+            HashValue = hashValue;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets the hash algorithm type. Possible values include: 'Unknown',
+        /// 'MD5', 'SHA1', 'SHA256', 'SHA256AC'
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.algorithm")]
+        public string Algorithm { get; private set; }
+
+        /// <summary>
+        /// Gets the file hash value.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.hashValue")]
+        public string HashValue { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/FusionAlertRule.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/FusionAlertRule.cs
index c47cecd45ac36..b50d56ed8f5cf 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/FusionAlertRule.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/FusionAlertRule.cs
@@ -39,9 +39,14 @@ public FusionAlertRule()
         /// template used to create this rule.</param>
         /// <param name="enabled">Determines whether this alert rule is enabled
         /// or disabled.</param>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
         /// <param name="etag">Etag of the azure resource</param>
         /// <param name="description">The description of the alert
         /// rule.</param>
@@ -53,8 +58,8 @@ public FusionAlertRule()
         /// alert rule. Possible values include: 'High', 'Medium', 'Low',
         /// 'Informational'</param>
         /// <param name="tactics">The tactics of the alert rule</param>
-        public FusionAlertRule(string alertRuleTemplateName, bool enabled, string id = default(string), string name = default(string), string type = default(string), string etag = default(string), string description = default(string), string displayName = default(string), System.DateTime? lastModifiedUtc = default(System.DateTime?), string severity = default(string), IList<string> tactics = default(IList<string>))
-            : base(id, name, type, etag)
+        public FusionAlertRule(string alertRuleTemplateName, bool enabled, string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), string etag = default(string), string description = default(string), string displayName = default(string), System.DateTime? lastModifiedUtc = default(System.DateTime?), string severity = default(string), IList<string> tactics = default(IList<string>))
+            : base(id, name, type, systemData, etag)
         {
             AlertRuleTemplateName = alertRuleTemplateName;
             Description = description;
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/FusionAlertRuleTemplate.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/FusionAlertRuleTemplate.cs
index 54a55ee9dc979..00805d4b10070 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/FusionAlertRuleTemplate.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/FusionAlertRuleTemplate.cs
@@ -35,9 +35,14 @@ public FusionAlertRuleTemplate()
         /// <summary>
         /// Initializes a new instance of the FusionAlertRuleTemplate class.
         /// </summary>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
         /// <param name="alertRulesCreatedByTemplateCount">the number of alert
         /// rules that were created by this template</param>
         /// <param name="createdDateUTC">The time that this alert rule template
@@ -55,8 +60,8 @@ public FusionAlertRuleTemplate()
         /// 'Informational'</param>
         /// <param name="tactics">The tactics of the alert rule
         /// template</param>
-        public FusionAlertRuleTemplate(string id = default(string), string name = default(string), string type = default(string), int? alertRulesCreatedByTemplateCount = default(int?), System.DateTime? createdDateUTC = default(System.DateTime?), string description = default(string), string displayName = default(string), IList<AlertRuleTemplateDataSource> requiredDataConnectors = default(IList<AlertRuleTemplateDataSource>), string status = default(string), string severity = default(string), IList<string> tactics = default(IList<string>))
-            : base(id, name, type)
+        public FusionAlertRuleTemplate(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), int? alertRulesCreatedByTemplateCount = default(int?), System.DateTime? createdDateUTC = default(System.DateTime?), string description = default(string), string displayName = default(string), IList<AlertRuleTemplateDataSource> requiredDataConnectors = default(IList<AlertRuleTemplateDataSource>), string status = default(string), string severity = default(string), IList<string> tactics = default(IList<string>))
+            : base(id, name, type, systemData)
         {
             AlertRulesCreatedByTemplateCount = alertRulesCreatedByTemplateCount;
             CreatedDateUTC = createdDateUTC;
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/GeoLocation.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/GeoLocation.cs
new file mode 100644
index 0000000000000..5538c24adb388
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/GeoLocation.cs
@@ -0,0 +1,116 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using System.Linq;
+
+    /// <summary>
+    /// The geo-location context attached to the ip entity
+    /// </summary>
+    public partial class GeoLocation
+    {
+        /// <summary>
+        /// Initializes a new instance of the GeoLocation class.
+        /// </summary>
+        public GeoLocation()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the GeoLocation class.
+        /// </summary>
+        /// <param name="asn">Autonomous System Number</param>
+        /// <param name="city">City name</param>
+        /// <param name="countryCode">The country code according to ISO 3166
+        /// format</param>
+        /// <param name="countryName">Country name according to ISO 3166 Alpha
+        /// 2: the lowercase of the English Short Name</param>
+        /// <param name="latitude">The longitude of the identified location,
+        /// expressed as a floating point number with range of -180 to 180,
+        /// with positive numbers representing East and negative numbers
+        /// representing West. Latitude and longitude are derived from the city
+        /// or postal code.</param>
+        /// <param name="longitude">The latitude of the identified location,
+        /// expressed as a floating point number with range of - 90 to 90, with
+        /// positive numbers representing North and negative numbers
+        /// representing South. Latitude and longitude are derived from the
+        /// city or postal code.</param>
+        /// <param name="state">State name</param>
+        public GeoLocation(int? asn = default(int?), string city = default(string), string countryCode = default(string), string countryName = default(string), double? latitude = default(double?), double? longitude = default(double?), string state = default(string))
+        {
+            Asn = asn;
+            City = city;
+            CountryCode = countryCode;
+            CountryName = countryName;
+            Latitude = latitude;
+            Longitude = longitude;
+            State = state;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets autonomous System Number
+        /// </summary>
+        [JsonProperty(PropertyName = "asn")]
+        public int? Asn { get; private set; }
+
+        /// <summary>
+        /// Gets city name
+        /// </summary>
+        [JsonProperty(PropertyName = "city")]
+        public string City { get; private set; }
+
+        /// <summary>
+        /// Gets the country code according to ISO 3166 format
+        /// </summary>
+        [JsonProperty(PropertyName = "countryCode")]
+        public string CountryCode { get; private set; }
+
+        /// <summary>
+        /// Gets country name according to ISO 3166 Alpha 2: the lowercase of
+        /// the English Short Name
+        /// </summary>
+        [JsonProperty(PropertyName = "countryName")]
+        public string CountryName { get; private set; }
+
+        /// <summary>
+        /// Gets the longitude of the identified location, expressed as a
+        /// floating point number with range of -180 to 180, with positive
+        /// numbers representing East and negative numbers representing West.
+        /// Latitude and longitude are derived from the city or postal code.
+        /// </summary>
+        [JsonProperty(PropertyName = "latitude")]
+        public double? Latitude { get; private set; }
+
+        /// <summary>
+        /// Gets the latitude of the identified location, expressed as a
+        /// floating point number with range of - 90 to 90, with positive
+        /// numbers representing North and negative numbers representing South.
+        /// Latitude and longitude are derived from the city or postal code.
+        /// </summary>
+        [JsonProperty(PropertyName = "longitude")]
+        public double? Longitude { get; private set; }
+
+        /// <summary>
+        /// Gets state name
+        /// </summary>
+        [JsonProperty(PropertyName = "state")]
+        public string State { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/HostEntity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/HostEntity.cs
new file mode 100644
index 0000000000000..c9f2118c37073
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/HostEntity.cs
@@ -0,0 +1,165 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents a host entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("Host")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class HostEntity : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the HostEntity class.
+        /// </summary>
+        public HostEntity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the HostEntity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="azureID">The azure resource id of the VM.</param>
+        /// <param name="dnsDomain">The DNS domain that this host belongs to.
+        /// Should contain the compete DNS suffix for the domain</param>
+        /// <param name="hostName">The hostname without the domain
+        /// suffix.</param>
+        /// <param name="isDomainJoined">Determines whether this host belongs
+        /// to a domain.</param>
+        /// <param name="netBiosName">The host name (pre-windows2000).</param>
+        /// <param name="ntDomain">The NT domain that this host belongs
+        /// to.</param>
+        /// <param name="omsAgentID">The OMS agent id, if the host has OMS
+        /// agent installed.</param>
+        /// <param name="osFamily">The operating system type. Possible values
+        /// include: 'Linux', 'Windows', 'Android', 'IOS', 'Unknown'</param>
+        /// <param name="osVersion">A free text representation of the operating
+        /// system. This field is meant to hold specific versions the are more
+        /// fine grained than OSFamily or future values not supported by
+        /// OSFamily enumeration</param>
+        public HostEntity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), string azureID = default(string), string dnsDomain = default(string), string hostName = default(string), bool? isDomainJoined = default(bool?), string netBiosName = default(string), string ntDomain = default(string), string omsAgentID = default(string), OSFamily? osFamily = default(OSFamily?), string osVersion = default(string))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            AzureID = azureID;
+            DnsDomain = dnsDomain;
+            HostName = hostName;
+            IsDomainJoined = isDomainJoined;
+            NetBiosName = netBiosName;
+            NtDomain = ntDomain;
+            OmsAgentID = omsAgentID;
+            OsFamily = osFamily;
+            OsVersion = osVersion;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets the azure resource id of the VM.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.azureID")]
+        public string AzureID { get; private set; }
+
+        /// <summary>
+        /// Gets the DNS domain that this host belongs to. Should contain the
+        /// compete DNS suffix for the domain
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.dnsDomain")]
+        public string DnsDomain { get; private set; }
+
+        /// <summary>
+        /// Gets the hostname without the domain suffix.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.hostName")]
+        public string HostName { get; private set; }
+
+        /// <summary>
+        /// Gets determines whether this host belongs to a domain.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.isDomainJoined")]
+        public bool? IsDomainJoined { get; private set; }
+
+        /// <summary>
+        /// Gets the host name (pre-windows2000).
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.netBiosName")]
+        public string NetBiosName { get; private set; }
+
+        /// <summary>
+        /// Gets the NT domain that this host belongs to.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.ntDomain")]
+        public string NtDomain { get; private set; }
+
+        /// <summary>
+        /// Gets the OMS agent id, if the host has OMS agent installed.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.omsAgentID")]
+        public string OmsAgentID { get; private set; }
+
+        /// <summary>
+        /// Gets or sets the operating system type. Possible values include:
+        /// 'Linux', 'Windows', 'Android', 'IOS', 'Unknown'
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.osFamily")]
+        public OSFamily? OsFamily { get; set; }
+
+        /// <summary>
+        /// Gets a free text representation of the operating system. This field
+        /// is meant to hold specific versions the are more fine grained than
+        /// OSFamily or future values not supported by OSFamily enumeration
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.osVersion")]
+        public string OsVersion { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Bookmark.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/HuntingBookmark.cs
similarity index 64%
rename from sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Bookmark.cs
rename to sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/HuntingBookmark.cs
index 24573b469b66b..b8308cccc64b8 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Bookmark.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/HuntingBookmark.cs
@@ -18,31 +18,42 @@ namespace Microsoft.Azure.Management.SecurityInsights.Models
     using System.Linq;
 
     /// <summary>
-    /// Represents a bookmark in Azure Security Insights.
+    /// Represents a Hunting bookmark entity.
     /// </summary>
+    [Newtonsoft.Json.JsonObject("Bookmark")]
     [Rest.Serialization.JsonTransformation]
-    public partial class Bookmark : ResourceWithEtag
+    public partial class HuntingBookmark : Entity
     {
         /// <summary>
-        /// Initializes a new instance of the Bookmark class.
+        /// Initializes a new instance of the HuntingBookmark class.
         /// </summary>
-        public Bookmark()
+        public HuntingBookmark()
         {
             CustomInit();
         }
 
         /// <summary>
-        /// Initializes a new instance of the Bookmark class.
+        /// Initializes a new instance of the HuntingBookmark class.
         /// </summary>
         /// <param name="displayName">The display name of the bookmark</param>
         /// <param name="query">The query of the bookmark.</param>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
-        /// <param name="etag">Etag of the azure resource</param>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
         /// <param name="created">The time the bookmark was created</param>
         /// <param name="createdBy">Describes a user that created the
         /// bookmark</param>
+        /// <param name="eventTime">The time of the event</param>
         /// <param name="labels">List of labels relevant to this
         /// bookmark</param>
         /// <param name="notes">The notes of the bookmark</param>
@@ -51,26 +62,23 @@ public Bookmark()
         /// updated</param>
         /// <param name="updatedBy">Describes a user that updated the
         /// bookmark</param>
-        /// <param name="eventTime">The bookmark event time</param>
-        /// <param name="queryStartTime">The start time for the query</param>
-        /// <param name="queryEndTime">The end time for the query</param>
         /// <param name="incidentInfo">Describes an incident that relates to
         /// bookmark</param>
-        public Bookmark(string displayName, string query, string id = default(string), string name = default(string), string type = default(string), string etag = default(string), System.DateTime? created = default(System.DateTime?), UserInfo createdBy = default(UserInfo), IList<string> labels = default(IList<string>), string notes = default(string), string queryResult = default(string), System.DateTime? updated = default(System.DateTime?), UserInfo updatedBy = default(UserInfo), System.DateTime? eventTime = default(System.DateTime?), System.DateTime? queryStartTime = default(System.DateTime?), System.DateTime? queryEndTime = default(System.DateTime?), IncidentInfo incidentInfo = default(IncidentInfo))
-            : base(id, name, type, etag)
+        public HuntingBookmark(string displayName, string query, string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), System.DateTime? created = default(System.DateTime?), UserInfo createdBy = default(UserInfo), System.DateTime? eventTime = default(System.DateTime?), IList<string> labels = default(IList<string>), string notes = default(string), string queryResult = default(string), System.DateTime? updated = default(System.DateTime?), UserInfo updatedBy = default(UserInfo), IncidentInfo incidentInfo = default(IncidentInfo))
+            : base(id, name, type, systemData)
         {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
             Created = created;
             CreatedBy = createdBy;
             DisplayName = displayName;
+            EventTime = eventTime;
             Labels = labels;
             Notes = notes;
             Query = query;
             QueryResult = queryResult;
             Updated = updated;
             UpdatedBy = updatedBy;
-            EventTime = eventTime;
-            QueryStartTime = queryStartTime;
-            QueryEndTime = queryEndTime;
             IncidentInfo = incidentInfo;
             CustomInit();
         }
@@ -80,6 +88,21 @@ public Bookmark()
         /// </summary>
         partial void CustomInit();
 
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
         /// <summary>
         /// Gets or sets the time the bookmark was created
         /// </summary>
@@ -98,6 +121,12 @@ public Bookmark()
         [JsonProperty(PropertyName = "properties.displayName")]
         public string DisplayName { get; set; }
 
+        /// <summary>
+        /// Gets or sets the time of the event
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.eventTime")]
+        public System.DateTime? EventTime { get; set; }
+
         /// <summary>
         /// Gets or sets list of labels relevant to this bookmark
         /// </summary>
@@ -134,24 +163,6 @@ public Bookmark()
         [JsonProperty(PropertyName = "properties.updatedBy")]
         public UserInfo UpdatedBy { get; set; }
 
-        /// <summary>
-        /// Gets or sets the bookmark event time
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.eventTime")]
-        public System.DateTime? EventTime { get; set; }
-
-        /// <summary>
-        /// Gets or sets the start time for the query
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.queryStartTime")]
-        public System.DateTime? QueryStartTime { get; set; }
-
-        /// <summary>
-        /// Gets or sets the end time for the query
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.queryEndTime")]
-        public System.DateTime? QueryEndTime { get; set; }
-
         /// <summary>
         /// Gets or sets describes an incident that relates to bookmark
         /// </summary>
@@ -174,14 +185,6 @@ public virtual void Validate()
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "Query");
             }
-            if (CreatedBy != null)
-            {
-                CreatedBy.Validate();
-            }
-            if (UpdatedBy != null)
-            {
-                UpdatedBy.Validate();
-            }
         }
     }
 }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Incident.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Incident.cs
index 9d7d25e0af371..d70233e5c3c6e 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Incident.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Incident.cs
@@ -39,9 +39,14 @@ public Incident()
         /// <param name="status">The status of the incident. Possible values
         /// include: 'New', 'Active', 'Closed'</param>
         /// <param name="title">The title of the incident</param>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
         /// <param name="etag">Etag of the azure resource</param>
         /// <param name="additionalData">Additional data on the
         /// incident</param>
@@ -72,8 +77,8 @@ public Incident()
         /// to</param>
         /// <param name="relatedAnalyticRuleIds">List of resource ids of
         /// Analytic rules related to the incident</param>
-        public Incident(string severity, string status, string title, string id = default(string), string name = default(string), string type = default(string), string etag = default(string), IncidentAdditionalData additionalData = default(IncidentAdditionalData), string classification = default(string), string classificationComment = default(string), string classificationReason = default(string), System.DateTime? createdTimeUtc = default(System.DateTime?), string description = default(string), System.DateTime? firstActivityTimeUtc = default(System.DateTime?), string incidentUrl = default(string), int? incidentNumber = default(int?), IList<IncidentLabel> labels = default(IList<IncidentLabel>), System.DateTime? lastActivityTimeUtc = default(System.DateTime?), System.DateTime? lastModifiedTimeUtc = default(System.DateTime?), IncidentOwnerInfo owner = default(IncidentOwnerInfo), IList<string> relatedAnalyticRuleIds = default(IList<string>))
-            : base(id, name, type, etag)
+        public Incident(string severity, string status, string title, string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), string etag = default(string), IncidentAdditionalData additionalData = default(IncidentAdditionalData), string classification = default(string), string classificationComment = default(string), string classificationReason = default(string), System.DateTime? createdTimeUtc = default(System.DateTime?), string description = default(string), System.DateTime? firstActivityTimeUtc = default(System.DateTime?), string incidentUrl = default(string), int? incidentNumber = default(int?), IList<IncidentLabel> labels = default(IList<IncidentLabel>), System.DateTime? lastActivityTimeUtc = default(System.DateTime?), System.DateTime? lastModifiedTimeUtc = default(System.DateTime?), IncidentOwnerInfo owner = default(IncidentOwnerInfo), IList<string> relatedAnalyticRuleIds = default(IList<string>))
+            : base(id, name, type, systemData, etag)
         {
             AdditionalData = additionalData;
             Classification = classification;
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeConsentList.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IncidentAlertList.cs
similarity index 63%
rename from sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeConsentList.cs
rename to sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IncidentAlertList.cs
index 18fff9f137df9..79db6d79bfc51 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeConsentList.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IncidentAlertList.cs
@@ -17,27 +17,24 @@ namespace Microsoft.Azure.Management.SecurityInsights.Models
     using System.Linq;
 
     /// <summary>
-    /// List of all the office365 consents.
+    /// List of incident alerts.
     /// </summary>
-    public partial class OfficeConsentList
+    public partial class IncidentAlertList
     {
         /// <summary>
-        /// Initializes a new instance of the OfficeConsentList class.
+        /// Initializes a new instance of the IncidentAlertList class.
         /// </summary>
-        public OfficeConsentList()
+        public IncidentAlertList()
         {
             CustomInit();
         }
 
         /// <summary>
-        /// Initializes a new instance of the OfficeConsentList class.
+        /// Initializes a new instance of the IncidentAlertList class.
         /// </summary>
-        /// <param name="value">Array of the consents.</param>
-        /// <param name="nextLink">URL to fetch the next set of office
-        /// consents.</param>
-        public OfficeConsentList(IList<OfficeConsent> value, string nextLink = default(string))
+        /// <param name="value">Array of incident alerts.</param>
+        public IncidentAlertList(IList<SecurityAlert> value)
         {
-            NextLink = nextLink;
             Value = value;
             CustomInit();
         }
@@ -48,16 +45,10 @@ public OfficeConsentList()
         partial void CustomInit();
 
         /// <summary>
-        /// Gets URL to fetch the next set of office consents.
-        /// </summary>
-        [JsonProperty(PropertyName = "nextLink")]
-        public string NextLink { get; private set; }
-
-        /// <summary>
-        /// Gets or sets array of the consents.
+        /// Gets or sets array of incident alerts.
         /// </summary>
         [JsonProperty(PropertyName = "value")]
-        public IList<OfficeConsent> Value { get; set; }
+        public IList<SecurityAlert> Value { get; set; }
 
         /// <summary>
         /// Validate the object.
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IncidentBookmarkList.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IncidentBookmarkList.cs
new file mode 100644
index 0000000000000..721d7dc4a0a80
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IncidentBookmarkList.cs
@@ -0,0 +1,77 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// List of incident bookmarks.
+    /// </summary>
+    public partial class IncidentBookmarkList
+    {
+        /// <summary>
+        /// Initializes a new instance of the IncidentBookmarkList class.
+        /// </summary>
+        public IncidentBookmarkList()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the IncidentBookmarkList class.
+        /// </summary>
+        /// <param name="value">Array of incident bookmarks.</param>
+        public IncidentBookmarkList(IList<HuntingBookmark> value)
+        {
+            Value = value;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets or sets array of incident bookmarks.
+        /// </summary>
+        [JsonProperty(PropertyName = "value")]
+        public IList<HuntingBookmark> Value { get; set; }
+
+        /// <summary>
+        /// Validate the object.
+        /// </summary>
+        /// <exception cref="ValidationException">
+        /// Thrown if validation fails
+        /// </exception>
+        public virtual void Validate()
+        {
+            if (Value == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "Value");
+            }
+            if (Value != null)
+            {
+                foreach (var element in Value)
+                {
+                    if (element != null)
+                    {
+                        element.Validate();
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IncidentComment.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IncidentComment.cs
index d1031fc39c108..ddd11a29a4ea4 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IncidentComment.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IncidentComment.cs
@@ -19,7 +19,7 @@ namespace Microsoft.Azure.Management.SecurityInsights.Models
     /// Represents an incident comment
     /// </summary>
     [Rest.Serialization.JsonTransformation]
-    public partial class IncidentComment : Resource
+    public partial class IncidentComment : ResourceWithEtag
     {
         /// <summary>
         /// Initializes a new instance of the IncidentComment class.
@@ -33,17 +33,26 @@ public IncidentComment()
         /// Initializes a new instance of the IncidentComment class.
         /// </summary>
         /// <param name="message">The comment message</param>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="etag">Etag of the azure resource</param>
         /// <param name="createdTimeUtc">The time the comment was
         /// created</param>
+        /// <param name="lastModifiedTimeUtc">The time the comment was
+        /// updated</param>
         /// <param name="author">Describes the client that created the
         /// comment</param>
-        public IncidentComment(string message, string id = default(string), string name = default(string), string type = default(string), System.DateTime? createdTimeUtc = default(System.DateTime?), ClientInfo author = default(ClientInfo))
-            : base(id, name, type)
+        public IncidentComment(string message, string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), string etag = default(string), System.DateTime? createdTimeUtc = default(System.DateTime?), System.DateTime? lastModifiedTimeUtc = default(System.DateTime?), ClientInfo author = default(ClientInfo))
+            : base(id, name, type, systemData, etag)
         {
             CreatedTimeUtc = createdTimeUtc;
+            LastModifiedTimeUtc = lastModifiedTimeUtc;
             Message = message;
             Author = author;
             CustomInit();
@@ -60,6 +69,12 @@ public IncidentComment()
         [JsonProperty(PropertyName = "properties.createdTimeUtc")]
         public System.DateTime? CreatedTimeUtc { get; private set; }
 
+        /// <summary>
+        /// Gets the time the comment was updated
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.lastModifiedTimeUtc")]
+        public System.DateTime? LastModifiedTimeUtc { get; private set; }
+
         /// <summary>
         /// Gets or sets the comment message
         /// </summary>
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IncidentEntitiesResponse.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IncidentEntitiesResponse.cs
new file mode 100644
index 0000000000000..977788a73b0b0
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IncidentEntitiesResponse.cs
@@ -0,0 +1,64 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// The incident related entities response.
+    /// </summary>
+    public partial class IncidentEntitiesResponse
+    {
+        /// <summary>
+        /// Initializes a new instance of the IncidentEntitiesResponse class.
+        /// </summary>
+        public IncidentEntitiesResponse()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the IncidentEntitiesResponse class.
+        /// </summary>
+        /// <param name="entities">Array of the incident related
+        /// entities.</param>
+        /// <param name="metaData">The metadata from the incident related
+        /// entities results.</param>
+        public IncidentEntitiesResponse(IList<Entity> entities = default(IList<Entity>), IList<IncidentEntitiesResultsMetadata> metaData = default(IList<IncidentEntitiesResultsMetadata>))
+        {
+            Entities = entities;
+            MetaData = metaData;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets or sets array of the incident related entities.
+        /// </summary>
+        [JsonProperty(PropertyName = "entities")]
+        public IList<Entity> Entities { get; set; }
+
+        /// <summary>
+        /// Gets or sets the metadata from the incident related entities
+        /// results.
+        /// </summary>
+        [JsonProperty(PropertyName = "metaData")]
+        public IList<IncidentEntitiesResultsMetadata> MetaData { get; set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IncidentEntitiesResultsMetadata.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IncidentEntitiesResultsMetadata.cs
new file mode 100644
index 0000000000000..4731429847eb9
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IncidentEntitiesResultsMetadata.cs
@@ -0,0 +1,88 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Newtonsoft.Json;
+    using System.Linq;
+
+    /// <summary>
+    /// Information of a specific aggregation in the incident related entities
+    /// result.
+    /// </summary>
+    public partial class IncidentEntitiesResultsMetadata
+    {
+        /// <summary>
+        /// Initializes a new instance of the IncidentEntitiesResultsMetadata
+        /// class.
+        /// </summary>
+        public IncidentEntitiesResultsMetadata()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the IncidentEntitiesResultsMetadata
+        /// class.
+        /// </summary>
+        /// <param name="count">Total number of aggregations of the given kind
+        /// in the incident related entities result.</param>
+        /// <param name="entityKind">The kind of the aggregated entity.
+        /// Possible values include: 'Account', 'Host', 'File',
+        /// 'AzureResource', 'CloudApplication', 'DnsResolution', 'FileHash',
+        /// 'Ip', 'Malware', 'Process', 'RegistryKey', 'RegistryValue',
+        /// 'SecurityGroup', 'Url', 'IoTDevice', 'SecurityAlert', 'Bookmark',
+        /// 'MailCluster', 'MailMessage', 'Mailbox', 'SubmissionMail'</param>
+        public IncidentEntitiesResultsMetadata(int count, string entityKind)
+        {
+            Count = count;
+            EntityKind = entityKind;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets or sets total number of aggregations of the given kind in the
+        /// incident related entities result.
+        /// </summary>
+        [JsonProperty(PropertyName = "count")]
+        public int Count { get; set; }
+
+        /// <summary>
+        /// Gets or sets the kind of the aggregated entity. Possible values
+        /// include: 'Account', 'Host', 'File', 'AzureResource',
+        /// 'CloudApplication', 'DnsResolution', 'FileHash', 'Ip', 'Malware',
+        /// 'Process', 'RegistryKey', 'RegistryValue', 'SecurityGroup', 'Url',
+        /// 'IoTDevice', 'SecurityAlert', 'Bookmark', 'MailCluster',
+        /// 'MailMessage', 'Mailbox', 'SubmissionMail'
+        /// </summary>
+        [JsonProperty(PropertyName = "entityKind")]
+        public string EntityKind { get; set; }
+
+        /// <summary>
+        /// Validate the object.
+        /// </summary>
+        /// <exception cref="ValidationException">
+        /// Thrown if validation fails
+        /// </exception>
+        public virtual void Validate()
+        {
+            if (EntityKind == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "EntityKind");
+            }
+        }
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IoTDeviceEntity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IoTDeviceEntity.cs
new file mode 100644
index 0000000000000..bf806cb66aa6c
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IoTDeviceEntity.cs
@@ -0,0 +1,225 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents an IoT device entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("IoTDevice")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class IoTDeviceEntity : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the IoTDeviceEntity class.
+        /// </summary>
+        public IoTDeviceEntity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the IoTDeviceEntity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="deviceId">The ID of the IoT Device in the IoT
+        /// Hub</param>
+        /// <param name="deviceName">The friendly name of the device</param>
+        /// <param name="source">The source of the device</param>
+        /// <param name="iotSecurityAgentId">The ID of the security agent
+        /// running on the device</param>
+        /// <param name="deviceType">The type of the device</param>
+        /// <param name="vendor">The vendor of the device</param>
+        /// <param name="edgeId">The ID of the edge device</param>
+        /// <param name="macAddress">The MAC address of the device</param>
+        /// <param name="model">The model of the device</param>
+        /// <param name="serialNumber">The serial number of the device</param>
+        /// <param name="firmwareVersion">The firmware version of the
+        /// device</param>
+        /// <param name="operatingSystem">The operating system of the
+        /// device</param>
+        /// <param name="iotHubEntityId">The AzureResource entity id of the IoT
+        /// Hub</param>
+        /// <param name="hostEntityId">The Host entity id of this
+        /// device</param>
+        /// <param name="ipAddressEntityId">The IP entity if of this
+        /// device</param>
+        /// <param name="threatIntelligence">A list of TI contexts attached to
+        /// the IoTDevice entity.</param>
+        /// <param name="protocols">A list of protocols of the IoTDevice
+        /// entity.</param>
+        public IoTDeviceEntity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), string deviceId = default(string), string deviceName = default(string), string source = default(string), System.Guid? iotSecurityAgentId = default(System.Guid?), string deviceType = default(string), string vendor = default(string), string edgeId = default(string), string macAddress = default(string), string model = default(string), string serialNumber = default(string), string firmwareVersion = default(string), string operatingSystem = default(string), string iotHubEntityId = default(string), string hostEntityId = default(string), string ipAddressEntityId = default(string), IList<ThreatIntelligence> threatIntelligence = default(IList<ThreatIntelligence>), IList<string> protocols = default(IList<string>))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            DeviceId = deviceId;
+            DeviceName = deviceName;
+            Source = source;
+            IotSecurityAgentId = iotSecurityAgentId;
+            DeviceType = deviceType;
+            Vendor = vendor;
+            EdgeId = edgeId;
+            MacAddress = macAddress;
+            Model = model;
+            SerialNumber = serialNumber;
+            FirmwareVersion = firmwareVersion;
+            OperatingSystem = operatingSystem;
+            IotHubEntityId = iotHubEntityId;
+            HostEntityId = hostEntityId;
+            IpAddressEntityId = ipAddressEntityId;
+            ThreatIntelligence = threatIntelligence;
+            Protocols = protocols;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets the ID of the IoT Device in the IoT Hub
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.deviceId")]
+        public string DeviceId { get; private set; }
+
+        /// <summary>
+        /// Gets the friendly name of the device
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.deviceName")]
+        public string DeviceName { get; private set; }
+
+        /// <summary>
+        /// Gets the source of the device
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.source")]
+        public string Source { get; private set; }
+
+        /// <summary>
+        /// Gets the ID of the security agent running on the device
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.iotSecurityAgentId")]
+        public System.Guid? IotSecurityAgentId { get; private set; }
+
+        /// <summary>
+        /// Gets the type of the device
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.deviceType")]
+        public string DeviceType { get; private set; }
+
+        /// <summary>
+        /// Gets the vendor of the device
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.vendor")]
+        public string Vendor { get; private set; }
+
+        /// <summary>
+        /// Gets the ID of the edge device
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.edgeId")]
+        public string EdgeId { get; private set; }
+
+        /// <summary>
+        /// Gets the MAC address of the device
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.macAddress")]
+        public string MacAddress { get; private set; }
+
+        /// <summary>
+        /// Gets the model of the device
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.model")]
+        public string Model { get; private set; }
+
+        /// <summary>
+        /// Gets the serial number of the device
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.serialNumber")]
+        public string SerialNumber { get; private set; }
+
+        /// <summary>
+        /// Gets the firmware version of the device
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.firmwareVersion")]
+        public string FirmwareVersion { get; private set; }
+
+        /// <summary>
+        /// Gets the operating system of the device
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.operatingSystem")]
+        public string OperatingSystem { get; private set; }
+
+        /// <summary>
+        /// Gets the AzureResource entity id of the IoT Hub
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.iotHubEntityId")]
+        public string IotHubEntityId { get; private set; }
+
+        /// <summary>
+        /// Gets the Host entity id of this device
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.hostEntityId")]
+        public string HostEntityId { get; private set; }
+
+        /// <summary>
+        /// Gets the IP entity if of this device
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.ipAddressEntityId")]
+        public string IpAddressEntityId { get; private set; }
+
+        /// <summary>
+        /// Gets a list of TI contexts attached to the IoTDevice entity.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.threatIntelligence")]
+        public IList<ThreatIntelligence> ThreatIntelligence { get; private set; }
+
+        /// <summary>
+        /// Gets a list of protocols of the IoTDevice entity.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.protocols")]
+        public IList<string> Protocols { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IpEntity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IpEntity.cs
new file mode 100644
index 0000000000000..92ad4e8230635
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/IpEntity.cs
@@ -0,0 +1,108 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents an ip entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("Ip")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class IpEntity : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the IpEntity class.
+        /// </summary>
+        public IpEntity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the IpEntity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="address">The IP address as string, e.g. 127.0.0.1
+        /// (either in Ipv4 or Ipv6)</param>
+        /// <param name="location">The geo-location context attached to the ip
+        /// entity</param>
+        /// <param name="threatIntelligence">A list of TI contexts attached to
+        /// the ip entity.</param>
+        public IpEntity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), string address = default(string), GeoLocation location = default(GeoLocation), IList<ThreatIntelligence> threatIntelligence = default(IList<ThreatIntelligence>))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            Address = address;
+            Location = location;
+            ThreatIntelligence = threatIntelligence;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets the IP address as string, e.g. 127.0.0.1 (either in Ipv4 or
+        /// Ipv6)
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.address")]
+        public string Address { get; private set; }
+
+        /// <summary>
+        /// Gets or sets the geo-location context attached to the ip entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.location")]
+        public GeoLocation Location { get; set; }
+
+        /// <summary>
+        /// Gets a list of TI contexts attached to the ip entity.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.threatIntelligence")]
+        public IList<ThreatIntelligence> ThreatIntelligence { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/KillChainIntent.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/KillChainIntent.cs
new file mode 100644
index 0000000000000..8fe2ba76d4313
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/KillChainIntent.cs
@@ -0,0 +1,136 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+
+    /// <summary>
+    /// Defines values for KillChainIntent.
+    /// </summary>
+    public static class KillChainIntent
+    {
+        /// <summary>
+        /// The default value.
+        /// </summary>
+        public const string Unknown = "Unknown";
+        /// <summary>
+        /// Probing could be an attempt to access a certain resource regardless
+        /// of a malicious intent or a failed attempt to gain access to a
+        /// target system to gather information prior to exploitation. This
+        /// step is usually detected as an attempt originating from outside the
+        /// network in attempt to scan the target system and find a way in.
+        /// </summary>
+        public const string Probing = "Probing";
+        /// <summary>
+        /// Exploitation is the stage where an attacker manage to get foothold
+        /// on the attacked resource. This stage is applicable not only for
+        /// compute hosts, but also for resources such as user accounts,
+        /// certificates etc. Adversaries will often be able to control the
+        /// resource after this stage.
+        /// </summary>
+        public const string Exploitation = "Exploitation";
+        /// <summary>
+        /// Persistence is any access, action, or configuration change to a
+        /// system that gives an adversary a persistent presence on that
+        /// system. Adversaries will often need to maintain access to systems
+        /// through interruptions such as system restarts, loss of credentials,
+        /// or other failures that would require a remote access tool to
+        /// restart or alternate backdoor for them to regain access.
+        /// </summary>
+        public const string Persistence = "Persistence";
+        /// <summary>
+        /// Privilege escalation is the result of actions that allow an
+        /// adversary to obtain a higher level of permissions on a system or
+        /// network. Certain tools or actions require a higher level of
+        /// privilege to work and are likely necessary at many points
+        /// throughout an operation. User accounts with permissions to access
+        /// specific systems or perform specific functions necessary for
+        /// adversaries to achieve their objective may also be considered an
+        /// escalation of privilege.
+        /// </summary>
+        public const string PrivilegeEscalation = "PrivilegeEscalation";
+        /// <summary>
+        /// Defense evasion consists of techniques an adversary may use to
+        /// evade detection or avoid other defenses. Sometimes these actions
+        /// are the same as or variations of techniques in other categories
+        /// that have the added benefit of subverting a particular defense or
+        /// mitigation.
+        /// </summary>
+        public const string DefenseEvasion = "DefenseEvasion";
+        /// <summary>
+        /// Credential access represents techniques resulting in access to or
+        /// control over system, domain, or service credentials that are used
+        /// within an enterprise environment. Adversaries will likely attempt
+        /// to obtain legitimate credentials from users or administrator
+        /// accounts (local system administrator or domain users with
+        /// administrator access) to use within the network. With sufficient
+        /// access within a network, an adversary can create accounts for later
+        /// use within the environment.
+        /// </summary>
+        public const string CredentialAccess = "CredentialAccess";
+        /// <summary>
+        /// Discovery consists of techniques that allow the adversary to gain
+        /// knowledge about the system and internal network. When adversaries
+        /// gain access to a new system, they must orient themselves to what
+        /// they now have control of and what benefits operating from that
+        /// system give to their current objective or overall goals during the
+        /// intrusion. The operating system provides many native tools that aid
+        /// in this post-compromise information-gathering phase.
+        /// </summary>
+        public const string Discovery = "Discovery";
+        /// <summary>
+        /// Lateral movement consists of techniques that enable an adversary to
+        /// access and control remote systems on a network and could, but does
+        /// not necessarily, include execution of tools on remote systems. The
+        /// lateral movement techniques could allow an adversary to gather
+        /// information from a system without needing additional tools, such as
+        /// a remote access tool. An adversary can use lateral movement for
+        /// many purposes, including remote Execution of tools, pivoting to
+        /// additional systems, access to specific information or files, access
+        /// to additional credentials, or to cause an effect.
+        /// </summary>
+        public const string LateralMovement = "LateralMovement";
+        /// <summary>
+        /// The execution tactic represents techniques that result in execution
+        /// of adversary-controlled code on a local or remote system. This
+        /// tactic is often used in conjunction with lateral movement to expand
+        /// access to remote systems on a network.
+        /// </summary>
+        public const string Execution = "Execution";
+        /// <summary>
+        /// Collection consists of techniques used to identify and gather
+        /// information, such as sensitive files, from a target network prior
+        /// to exfiltration. This category also covers locations on a system or
+        /// network where the adversary may look for information to exfiltrate.
+        /// </summary>
+        public const string Collection = "Collection";
+        /// <summary>
+        /// Exfiltration refers to techniques and attributes that result or aid
+        /// in the adversary removing files and information from a target
+        /// network. This category also covers locations on a system or network
+        /// where the adversary may look for information to exfiltrate.
+        /// </summary>
+        public const string Exfiltration = "Exfiltration";
+        /// <summary>
+        /// The command and control tactic represents how adversaries
+        /// communicate with systems under their control within a target
+        /// network.
+        /// </summary>
+        public const string CommandAndControl = "CommandAndControl";
+        /// <summary>
+        /// The impact intent primary objective is to directly reduce the
+        /// availability or integrity of a system, service, or network;
+        /// including manipulation of data to impact a business or operational
+        /// process. This would often refer to techniques such as ransom-ware,
+        /// defacement, data manipulation and others.
+        /// </summary>
+        public const string Impact = "Impact";
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MCASDataConnector.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MCASDataConnector.cs
deleted file mode 100644
index 77df2ea8a0738..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MCASDataConnector.cs
+++ /dev/null
@@ -1,70 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using Microsoft.Rest;
-    using Microsoft.Rest.Serialization;
-    using Newtonsoft.Json;
-    using System.Linq;
-
-    /// <summary>
-    /// Represents MCAS (Microsoft Cloud App Security) data connector.
-    /// </summary>
-    [Newtonsoft.Json.JsonObject("MicrosoftCloudAppSecurity")]
-    [Rest.Serialization.JsonTransformation]
-    public partial class MCASDataConnector : DataConnector
-    {
-        /// <summary>
-        /// Initializes a new instance of the MCASDataConnector class.
-        /// </summary>
-        public MCASDataConnector()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the MCASDataConnector class.
-        /// </summary>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
-        /// <param name="etag">Etag of the azure resource</param>
-        /// <param name="tenantId">The tenant id to connect to, and get the
-        /// data from.</param>
-        /// <param name="dataTypes">The available data types for the
-        /// connector.</param>
-        public MCASDataConnector(string id = default(string), string name = default(string), string type = default(string), string etag = default(string), string tenantId = default(string), MCASDataConnectorDataTypes dataTypes = default(MCASDataConnectorDataTypes))
-            : base(id, name, type, etag)
-        {
-            TenantId = tenantId;
-            DataTypes = dataTypes;
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-        /// <summary>
-        /// Gets or sets the tenant id to connect to, and get the data from.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.tenantId")]
-        public string TenantId { get; set; }
-
-        /// <summary>
-        /// Gets or sets the available data types for the connector.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.dataTypes")]
-        public MCASDataConnectorDataTypes DataTypes { get; set; }
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MCASDataConnectorDataTypes.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MCASDataConnectorDataTypes.cs
deleted file mode 100644
index 0c04dc116f3e1..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MCASDataConnectorDataTypes.cs
+++ /dev/null
@@ -1,55 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using Newtonsoft.Json;
-    using System.Linq;
-
-    /// <summary>
-    /// The available data types for MCAS (Microsoft Cloud App Security) data
-    /// connector.
-    /// </summary>
-    public partial class MCASDataConnectorDataTypes : AlertsDataTypeOfDataConnector
-    {
-        /// <summary>
-        /// Initializes a new instance of the MCASDataConnectorDataTypes class.
-        /// </summary>
-        public MCASDataConnectorDataTypes()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the MCASDataConnectorDataTypes class.
-        /// </summary>
-        /// <param name="alerts">Alerts data type connection.</param>
-        /// <param name="discoveryLogs">Discovery log data type
-        /// connection.</param>
-        public MCASDataConnectorDataTypes(DataConnectorDataTypeCommon alerts = default(DataConnectorDataTypeCommon), DataConnectorDataTypeCommon discoveryLogs = default(DataConnectorDataTypeCommon))
-            : base(alerts)
-        {
-            DiscoveryLogs = discoveryLogs;
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-        /// <summary>
-        /// Gets or sets discovery log data type connection.
-        /// </summary>
-        [JsonProperty(PropertyName = "discoveryLogs")]
-        public DataConnectorDataTypeCommon DiscoveryLogs { get; set; }
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MDATPDataConnector.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MDATPDataConnector.cs
deleted file mode 100644
index 5cbec5f4150b6..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MDATPDataConnector.cs
+++ /dev/null
@@ -1,71 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using Microsoft.Rest;
-    using Microsoft.Rest.Serialization;
-    using Newtonsoft.Json;
-    using System.Linq;
-
-    /// <summary>
-    /// Represents MDATP (Microsoft Defender Advanced Threat Protection) data
-    /// connector.
-    /// </summary>
-    [Newtonsoft.Json.JsonObject("MicrosoftDefenderAdvancedThreatProtection")]
-    [Rest.Serialization.JsonTransformation]
-    public partial class MDATPDataConnector : DataConnector
-    {
-        /// <summary>
-        /// Initializes a new instance of the MDATPDataConnector class.
-        /// </summary>
-        public MDATPDataConnector()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the MDATPDataConnector class.
-        /// </summary>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
-        /// <param name="etag">Etag of the azure resource</param>
-        /// <param name="tenantId">The tenant id to connect to, and get the
-        /// data from.</param>
-        /// <param name="dataTypes">The available data types for the
-        /// connector.</param>
-        public MDATPDataConnector(string id = default(string), string name = default(string), string type = default(string), string etag = default(string), string tenantId = default(string), AlertsDataTypeOfDataConnector dataTypes = default(AlertsDataTypeOfDataConnector))
-            : base(id, name, type, etag)
-        {
-            TenantId = tenantId;
-            DataTypes = dataTypes;
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-        /// <summary>
-        /// Gets or sets the tenant id to connect to, and get the data from.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.tenantId")]
-        public string TenantId { get; set; }
-
-        /// <summary>
-        /// Gets or sets the available data types for the connector.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.dataTypes")]
-        public AlertsDataTypeOfDataConnector DataTypes { get; set; }
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MailClusterEntity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MailClusterEntity.cs
new file mode 100644
index 0000000000000..79d74752017a5
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MailClusterEntity.cs
@@ -0,0 +1,215 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents a mail cluster entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("MailCluster")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class MailClusterEntity : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the MailClusterEntity class.
+        /// </summary>
+        public MailClusterEntity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the MailClusterEntity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="networkMessageIds">The mail message IDs that are part
+        /// of the mail cluster</param>
+        /// <param name="countByDeliveryStatus">Count of mail messages by
+        /// DeliveryStatus string representation</param>
+        /// <param name="countByThreatType">Count of mail messages by
+        /// ThreatType string representation</param>
+        /// <param name="countByProtectionStatus">Count of mail messages by
+        /// ProtectionStatus string representation</param>
+        /// <param name="threats">The threats of mail messages that are part of
+        /// the mail cluster</param>
+        /// <param name="query">The query that was used to identify the
+        /// messages of the mail cluster</param>
+        /// <param name="queryTime">The query time</param>
+        /// <param name="mailCount">The number of mail messages that are part
+        /// of the mail cluster</param>
+        /// <param name="isVolumeAnomaly">Is this a volume anomaly mail
+        /// cluster</param>
+        /// <param name="source">The source of the mail cluster (default is
+        /// 'O365 ATP')</param>
+        /// <param name="clusterSourceIdentifier">The id of the cluster
+        /// source</param>
+        /// <param name="clusterSourceType">The type of the cluster
+        /// source</param>
+        /// <param name="clusterQueryStartTime">The cluster query start
+        /// time</param>
+        /// <param name="clusterQueryEndTime">The cluster query end
+        /// time</param>
+        /// <param name="clusterGroup">The cluster group</param>
+        public MailClusterEntity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), IList<string> networkMessageIds = default(IList<string>), object countByDeliveryStatus = default(object), object countByThreatType = default(object), object countByProtectionStatus = default(object), IList<string> threats = default(IList<string>), string query = default(string), System.DateTime? queryTime = default(System.DateTime?), int? mailCount = default(int?), bool? isVolumeAnomaly = default(bool?), string source = default(string), string clusterSourceIdentifier = default(string), string clusterSourceType = default(string), System.DateTime? clusterQueryStartTime = default(System.DateTime?), System.DateTime? clusterQueryEndTime = default(System.DateTime?), string clusterGroup = default(string))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            NetworkMessageIds = networkMessageIds;
+            CountByDeliveryStatus = countByDeliveryStatus;
+            CountByThreatType = countByThreatType;
+            CountByProtectionStatus = countByProtectionStatus;
+            Threats = threats;
+            Query = query;
+            QueryTime = queryTime;
+            MailCount = mailCount;
+            IsVolumeAnomaly = isVolumeAnomaly;
+            Source = source;
+            ClusterSourceIdentifier = clusterSourceIdentifier;
+            ClusterSourceType = clusterSourceType;
+            ClusterQueryStartTime = clusterQueryStartTime;
+            ClusterQueryEndTime = clusterQueryEndTime;
+            ClusterGroup = clusterGroup;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets the mail message IDs that are part of the mail cluster
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.networkMessageIds")]
+        public IList<string> NetworkMessageIds { get; private set; }
+
+        /// <summary>
+        /// Gets count of mail messages by DeliveryStatus string representation
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.countByDeliveryStatus")]
+        public object CountByDeliveryStatus { get; private set; }
+
+        /// <summary>
+        /// Gets count of mail messages by ThreatType string representation
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.countByThreatType")]
+        public object CountByThreatType { get; private set; }
+
+        /// <summary>
+        /// Gets count of mail messages by ProtectionStatus string
+        /// representation
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.countByProtectionStatus")]
+        public object CountByProtectionStatus { get; private set; }
+
+        /// <summary>
+        /// Gets the threats of mail messages that are part of the mail cluster
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.threats")]
+        public IList<string> Threats { get; private set; }
+
+        /// <summary>
+        /// Gets the query that was used to identify the messages of the mail
+        /// cluster
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.query")]
+        public string Query { get; private set; }
+
+        /// <summary>
+        /// Gets the query time
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.queryTime")]
+        public System.DateTime? QueryTime { get; private set; }
+
+        /// <summary>
+        /// Gets the number of mail messages that are part of the mail cluster
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.mailCount")]
+        public int? MailCount { get; private set; }
+
+        /// <summary>
+        /// Gets is this a volume anomaly mail cluster
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.isVolumeAnomaly")]
+        public bool? IsVolumeAnomaly { get; private set; }
+
+        /// <summary>
+        /// Gets the source of the mail cluster (default is 'O365 ATP')
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.source")]
+        public string Source { get; private set; }
+
+        /// <summary>
+        /// Gets the id of the cluster source
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.clusterSourceIdentifier")]
+        public string ClusterSourceIdentifier { get; private set; }
+
+        /// <summary>
+        /// Gets the type of the cluster source
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.clusterSourceType")]
+        public string ClusterSourceType { get; private set; }
+
+        /// <summary>
+        /// Gets the cluster query start time
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.clusterQueryStartTime")]
+        public System.DateTime? ClusterQueryStartTime { get; private set; }
+
+        /// <summary>
+        /// Gets the cluster query end time
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.clusterQueryEndTime")]
+        public System.DateTime? ClusterQueryEndTime { get; private set; }
+
+        /// <summary>
+        /// Gets the cluster group
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.clusterGroup")]
+        public string ClusterGroup { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MailMessageEntity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MailMessageEntity.cs
new file mode 100644
index 0000000000000..3ae71bd9ae363
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MailMessageEntity.cs
@@ -0,0 +1,304 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents a mail message entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("MailMessage")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class MailMessageEntity : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the MailMessageEntity class.
+        /// </summary>
+        public MailMessageEntity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the MailMessageEntity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="fileEntityIds">The File entity ids of this mail
+        /// message's attachments</param>
+        /// <param name="recipient">The recipient of this mail message. Note
+        /// that in case of multiple recipients the mail message is forked and
+        /// each copy has one recipient</param>
+        /// <param name="urls">The Urls contained in this mail message</param>
+        /// <param name="threats">The threats of this mail message</param>
+        /// <param name="p1Sender">The p1 sender's email address</param>
+        /// <param name="p1SenderDisplayName">The p1 sender's display
+        /// name</param>
+        /// <param name="p1SenderDomain">The p1 sender's domain</param>
+        /// <param name="senderIP">The sender's IP address</param>
+        /// <param name="p2Sender">The p2 sender's email address</param>
+        /// <param name="p2SenderDisplayName">The p2 sender's display
+        /// name</param>
+        /// <param name="p2SenderDomain">The p2 sender's domain</param>
+        /// <param name="receiveDate">The receive date of this message</param>
+        /// <param name="networkMessageId">The network message id of this mail
+        /// message</param>
+        /// <param name="internetMessageId">The internet message id of this
+        /// mail message</param>
+        /// <param name="subject">The subject of this mail message</param>
+        /// <param name="language">The language of this mail message</param>
+        /// <param name="threatDetectionMethods">The threat detection
+        /// methods</param>
+        /// <param name="bodyFingerprintBin1">The bodyFingerprintBin1</param>
+        /// <param name="bodyFingerprintBin2">The bodyFingerprintBin2</param>
+        /// <param name="bodyFingerprintBin3">The bodyFingerprintBin3</param>
+        /// <param name="bodyFingerprintBin4">The bodyFingerprintBin4</param>
+        /// <param name="bodyFingerprintBin5">The bodyFingerprintBin5</param>
+        /// <param name="antispamDirection">The directionality of this mail
+        /// message. Possible values include: 'Unknown', 'Inbound', 'Outbound',
+        /// 'Intraorg'</param>
+        /// <param name="deliveryAction">The delivery action of this mail
+        /// message like Delivered, Blocked, Replaced etc. Possible values
+        /// include: 'Unknown', 'DeliveredAsSpam', 'Delivered', 'Blocked',
+        /// 'Replaced'</param>
+        /// <param name="deliveryLocation">The delivery location of this mail
+        /// message like Inbox, JunkFolder etc. Possible values include:
+        /// 'Unknown', 'Inbox', 'JunkFolder', 'DeletedFolder', 'Quarantine',
+        /// 'External', 'Failed', 'Dropped', 'Forwarded'</param>
+        public MailMessageEntity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), IList<string> fileEntityIds = default(IList<string>), string recipient = default(string), IList<string> urls = default(IList<string>), IList<string> threats = default(IList<string>), string p1Sender = default(string), string p1SenderDisplayName = default(string), string p1SenderDomain = default(string), string senderIP = default(string), string p2Sender = default(string), string p2SenderDisplayName = default(string), string p2SenderDomain = default(string), System.DateTime? receiveDate = default(System.DateTime?), System.Guid? networkMessageId = default(System.Guid?), string internetMessageId = default(string), string subject = default(string), string language = default(string), IList<string> threatDetectionMethods = default(IList<string>), int? bodyFingerprintBin1 = default(int?), int? bodyFingerprintBin2 = default(int?), int? bodyFingerprintBin3 = default(int?), int? bodyFingerprintBin4 = default(int?), int? bodyFingerprintBin5 = default(int?), string antispamDirection = default(string), DeliveryAction? deliveryAction = default(DeliveryAction?), DeliveryLocation? deliveryLocation = default(DeliveryLocation?))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            FileEntityIds = fileEntityIds;
+            Recipient = recipient;
+            Urls = urls;
+            Threats = threats;
+            P1Sender = p1Sender;
+            P1SenderDisplayName = p1SenderDisplayName;
+            P1SenderDomain = p1SenderDomain;
+            SenderIP = senderIP;
+            P2Sender = p2Sender;
+            P2SenderDisplayName = p2SenderDisplayName;
+            P2SenderDomain = p2SenderDomain;
+            ReceiveDate = receiveDate;
+            NetworkMessageId = networkMessageId;
+            InternetMessageId = internetMessageId;
+            Subject = subject;
+            Language = language;
+            ThreatDetectionMethods = threatDetectionMethods;
+            BodyFingerprintBin1 = bodyFingerprintBin1;
+            BodyFingerprintBin2 = bodyFingerprintBin2;
+            BodyFingerprintBin3 = bodyFingerprintBin3;
+            BodyFingerprintBin4 = bodyFingerprintBin4;
+            BodyFingerprintBin5 = bodyFingerprintBin5;
+            AntispamDirection = antispamDirection;
+            DeliveryAction = deliveryAction;
+            DeliveryLocation = deliveryLocation;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets the File entity ids of this mail message's attachments
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.fileEntityIds")]
+        public IList<string> FileEntityIds { get; private set; }
+
+        /// <summary>
+        /// Gets the recipient of this mail message. Note that in case of
+        /// multiple recipients the mail message is forked and each copy has
+        /// one recipient
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.recipient")]
+        public string Recipient { get; private set; }
+
+        /// <summary>
+        /// Gets the Urls contained in this mail message
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.urls")]
+        public IList<string> Urls { get; private set; }
+
+        /// <summary>
+        /// Gets the threats of this mail message
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.threats")]
+        public IList<string> Threats { get; private set; }
+
+        /// <summary>
+        /// Gets the p1 sender's email address
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.p1Sender")]
+        public string P1Sender { get; private set; }
+
+        /// <summary>
+        /// Gets the p1 sender's display name
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.p1SenderDisplayName")]
+        public string P1SenderDisplayName { get; private set; }
+
+        /// <summary>
+        /// Gets the p1 sender's domain
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.p1SenderDomain")]
+        public string P1SenderDomain { get; private set; }
+
+        /// <summary>
+        /// Gets the sender's IP address
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.senderIP")]
+        public string SenderIP { get; private set; }
+
+        /// <summary>
+        /// Gets the p2 sender's email address
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.p2Sender")]
+        public string P2Sender { get; private set; }
+
+        /// <summary>
+        /// Gets the p2 sender's display name
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.p2SenderDisplayName")]
+        public string P2SenderDisplayName { get; private set; }
+
+        /// <summary>
+        /// Gets the p2 sender's domain
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.p2SenderDomain")]
+        public string P2SenderDomain { get; private set; }
+
+        /// <summary>
+        /// Gets the receive date of this message
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.receiveDate")]
+        public System.DateTime? ReceiveDate { get; private set; }
+
+        /// <summary>
+        /// Gets the network message id of this mail message
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.networkMessageId")]
+        public System.Guid? NetworkMessageId { get; private set; }
+
+        /// <summary>
+        /// Gets the internet message id of this mail message
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.internetMessageId")]
+        public string InternetMessageId { get; private set; }
+
+        /// <summary>
+        /// Gets the subject of this mail message
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.subject")]
+        public string Subject { get; private set; }
+
+        /// <summary>
+        /// Gets the language of this mail message
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.language")]
+        public string Language { get; private set; }
+
+        /// <summary>
+        /// Gets the threat detection methods
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.threatDetectionMethods")]
+        public IList<string> ThreatDetectionMethods { get; private set; }
+
+        /// <summary>
+        /// Gets or sets the bodyFingerprintBin1
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.bodyFingerprintBin1")]
+        public int? BodyFingerprintBin1 { get; set; }
+
+        /// <summary>
+        /// Gets or sets the bodyFingerprintBin2
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.bodyFingerprintBin2")]
+        public int? BodyFingerprintBin2 { get; set; }
+
+        /// <summary>
+        /// Gets or sets the bodyFingerprintBin3
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.bodyFingerprintBin3")]
+        public int? BodyFingerprintBin3 { get; set; }
+
+        /// <summary>
+        /// Gets or sets the bodyFingerprintBin4
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.bodyFingerprintBin4")]
+        public int? BodyFingerprintBin4 { get; set; }
+
+        /// <summary>
+        /// Gets or sets the bodyFingerprintBin5
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.bodyFingerprintBin5")]
+        public int? BodyFingerprintBin5 { get; set; }
+
+        /// <summary>
+        /// Gets or sets the directionality of this mail message. Possible
+        /// values include: 'Unknown', 'Inbound', 'Outbound', 'Intraorg'
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.antispamDirection")]
+        public string AntispamDirection { get; set; }
+
+        /// <summary>
+        /// Gets or sets the delivery action of this mail message like
+        /// Delivered, Blocked, Replaced etc. Possible values include:
+        /// 'Unknown', 'DeliveredAsSpam', 'Delivered', 'Blocked', 'Replaced'
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.deliveryAction")]
+        public DeliveryAction? DeliveryAction { get; set; }
+
+        /// <summary>
+        /// Gets or sets the delivery location of this mail message like Inbox,
+        /// JunkFolder etc. Possible values include: 'Unknown', 'Inbox',
+        /// 'JunkFolder', 'DeletedFolder', 'Quarantine', 'External', 'Failed',
+        /// 'Dropped', 'Forwarded'
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.deliveryLocation")]
+        public DeliveryLocation? DeliveryLocation { get; set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MailboxEntity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MailboxEntity.cs
new file mode 100644
index 0000000000000..27f98521c87bb
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MailboxEntity.cs
@@ -0,0 +1,117 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents a mailbox entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("Mailbox")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class MailboxEntity : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the MailboxEntity class.
+        /// </summary>
+        public MailboxEntity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the MailboxEntity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="mailboxPrimaryAddress">The mailbox's primary
+        /// address</param>
+        /// <param name="displayName">The mailbox's display name</param>
+        /// <param name="upn">The mailbox's UPN</param>
+        /// <param name="externalDirectoryObjectId">The AzureAD identifier of
+        /// mailbox. Similar to AadUserId in account entity but this property
+        /// is specific to mailbox object on office side</param>
+        public MailboxEntity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), string mailboxPrimaryAddress = default(string), string displayName = default(string), string upn = default(string), System.Guid? externalDirectoryObjectId = default(System.Guid?))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            MailboxPrimaryAddress = mailboxPrimaryAddress;
+            DisplayName = displayName;
+            Upn = upn;
+            ExternalDirectoryObjectId = externalDirectoryObjectId;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets the mailbox's primary address
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.mailboxPrimaryAddress")]
+        public string MailboxPrimaryAddress { get; private set; }
+
+        /// <summary>
+        /// Gets the mailbox's display name
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.displayName")]
+        public string DisplayName { get; private set; }
+
+        /// <summary>
+        /// Gets the mailbox's UPN
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.upn")]
+        public string Upn { get; private set; }
+
+        /// <summary>
+        /// Gets the AzureAD identifier of mailbox. Similar to AadUserId in
+        /// account entity but this property is specific to mailbox object on
+        /// office side
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.externalDirectoryObjectId")]
+        public System.Guid? ExternalDirectoryObjectId { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MalwareEntity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MalwareEntity.cs
new file mode 100644
index 0000000000000..d0db206af2a2d
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MalwareEntity.cs
@@ -0,0 +1,118 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents a malware entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("Malware")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class MalwareEntity : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the MalwareEntity class.
+        /// </summary>
+        public MalwareEntity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the MalwareEntity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="category">The malware category by the vendor, e.g.
+        /// Trojan</param>
+        /// <param name="fileEntityIds">List of linked file entity identifiers
+        /// on which the malware was found</param>
+        /// <param name="malwareName">The malware name by the vendor, e.g.
+        /// Win32/Toga!rfn</param>
+        /// <param name="processEntityIds">List of linked process entity
+        /// identifiers on which the malware was found.</param>
+        public MalwareEntity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), string category = default(string), IList<string> fileEntityIds = default(IList<string>), string malwareName = default(string), IList<string> processEntityIds = default(IList<string>))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            Category = category;
+            FileEntityIds = fileEntityIds;
+            MalwareName = malwareName;
+            ProcessEntityIds = processEntityIds;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets the malware category by the vendor, e.g. Trojan
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.category")]
+        public string Category { get; private set; }
+
+        /// <summary>
+        /// Gets list of linked file entity identifiers on which the malware
+        /// was found
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.fileEntityIds")]
+        public IList<string> FileEntityIds { get; private set; }
+
+        /// <summary>
+        /// Gets the malware name by the vendor, e.g. Win32/Toga!rfn
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.malwareName")]
+        public string MalwareName { get; private set; }
+
+        /// <summary>
+        /// Gets list of linked process entity identifiers on which the malware
+        /// was found.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.processEntityIds")]
+        public IList<string> ProcessEntityIds { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MicrosoftSecurityIncidentCreationAlertRule.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MicrosoftSecurityIncidentCreationAlertRule.cs
index c8775e0769254..2603ccb07ba1c 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MicrosoftSecurityIncidentCreationAlertRule.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MicrosoftSecurityIncidentCreationAlertRule.cs
@@ -46,9 +46,14 @@ public MicrosoftSecurityIncidentCreationAlertRule()
         /// this alert rule.</param>
         /// <param name="enabled">Determines whether this alert rule is enabled
         /// or disabled.</param>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
         /// <param name="etag">Etag of the azure resource</param>
         /// <param name="displayNamesFilter">the alerts' displayNames on which
         /// the cases will be generated</param>
@@ -62,8 +67,8 @@ public MicrosoftSecurityIncidentCreationAlertRule()
         /// rule.</param>
         /// <param name="lastModifiedUtc">The last time that this alert has
         /// been modified.</param>
-        public MicrosoftSecurityIncidentCreationAlertRule(string productFilter, string displayName, bool enabled, string id = default(string), string name = default(string), string type = default(string), string etag = default(string), IList<string> displayNamesFilter = default(IList<string>), IList<string> displayNamesExcludeFilter = default(IList<string>), IList<string> severitiesFilter = default(IList<string>), string alertRuleTemplateName = default(string), string description = default(string), System.DateTime? lastModifiedUtc = default(System.DateTime?))
-            : base(id, name, type, etag)
+        public MicrosoftSecurityIncidentCreationAlertRule(string productFilter, string displayName, bool enabled, string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), string etag = default(string), IList<string> displayNamesFilter = default(IList<string>), IList<string> displayNamesExcludeFilter = default(IList<string>), IList<string> severitiesFilter = default(IList<string>), string alertRuleTemplateName = default(string), string description = default(string), System.DateTime? lastModifiedUtc = default(System.DateTime?))
+            : base(id, name, type, systemData, etag)
         {
             DisplayNamesFilter = displayNamesFilter;
             DisplayNamesExcludeFilter = displayNamesExcludeFilter;
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MicrosoftSecurityIncidentCreationAlertRuleTemplate.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MicrosoftSecurityIncidentCreationAlertRuleTemplate.cs
index e28afd8d01410..1f3488e0716ca 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MicrosoftSecurityIncidentCreationAlertRuleTemplate.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/MicrosoftSecurityIncidentCreationAlertRuleTemplate.cs
@@ -42,9 +42,14 @@ public MicrosoftSecurityIncidentCreationAlertRuleTemplate()
         /// App Security', 'Azure Security Center', 'Azure Advanced Threat
         /// Protection', 'Azure Active Directory Identity Protection', 'Azure
         /// Security Center for IoT'</param>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
         /// <param name="alertRulesCreatedByTemplateCount">the number of alert
         /// rules that were created by this template</param>
         /// <param name="createdDateUTC">The time that this alert rule template
@@ -63,8 +68,8 @@ public MicrosoftSecurityIncidentCreationAlertRuleTemplate()
         /// which the cases will not be generated</param>
         /// <param name="severitiesFilter">the alerts' severities on which the
         /// cases will be generated</param>
-        public MicrosoftSecurityIncidentCreationAlertRuleTemplate(string productFilter, string id = default(string), string name = default(string), string type = default(string), int? alertRulesCreatedByTemplateCount = default(int?), System.DateTime? createdDateUTC = default(System.DateTime?), string description = default(string), string displayName = default(string), IList<AlertRuleTemplateDataSource> requiredDataConnectors = default(IList<AlertRuleTemplateDataSource>), string status = default(string), IList<string> displayNamesFilter = default(IList<string>), IList<string> displayNamesExcludeFilter = default(IList<string>), IList<string> severitiesFilter = default(IList<string>))
-            : base(id, name, type)
+        public MicrosoftSecurityIncidentCreationAlertRuleTemplate(string productFilter, string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), int? alertRulesCreatedByTemplateCount = default(int?), System.DateTime? createdDateUTC = default(System.DateTime?), string description = default(string), string displayName = default(string), IList<AlertRuleTemplateDataSource> requiredDataConnectors = default(IList<AlertRuleTemplateDataSource>), string status = default(string), IList<string> displayNamesFilter = default(IList<string>), IList<string> displayNamesExcludeFilter = default(IList<string>), IList<string> severitiesFilter = default(IList<string>))
+            : base(id, name, type, systemData)
         {
             AlertRulesCreatedByTemplateCount = alertRulesCreatedByTemplateCount;
             CreatedDateUTC = createdDateUTC;
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OSFamily.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OSFamily.cs
new file mode 100644
index 0000000000000..3bf17ab77d582
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OSFamily.cs
@@ -0,0 +1,93 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using Newtonsoft.Json.Converters;
+    using System.Runtime;
+    using System.Runtime.Serialization;
+
+    /// <summary>
+    /// Defines values for OSFamily.
+    /// </summary>
+    [JsonConverter(typeof(StringEnumConverter))]
+    public enum OSFamily
+    {
+        /// <summary>
+        /// Host with Linux operating system.
+        /// </summary>
+        [EnumMember(Value = "Linux")]
+        Linux,
+        /// <summary>
+        /// Host with Windows operating system.
+        /// </summary>
+        [EnumMember(Value = "Windows")]
+        Windows,
+        /// <summary>
+        /// Host with Android operating system.
+        /// </summary>
+        [EnumMember(Value = "Android")]
+        Android,
+        /// <summary>
+        /// Host with IOS operating system.
+        /// </summary>
+        [EnumMember(Value = "IOS")]
+        IOS,
+        /// <summary>
+        /// Host with Unknown operating system.
+        /// </summary>
+        [EnumMember(Value = "Unknown")]
+        Unknown
+    }
+    internal static class OSFamilyEnumExtension
+    {
+        internal static string ToSerializedValue(this OSFamily? value)
+        {
+            return value == null ? null : ((OSFamily)value).ToSerializedValue();
+        }
+
+        internal static string ToSerializedValue(this OSFamily value)
+        {
+            switch( value )
+            {
+                case OSFamily.Linux:
+                    return "Linux";
+                case OSFamily.Windows:
+                    return "Windows";
+                case OSFamily.Android:
+                    return "Android";
+                case OSFamily.IOS:
+                    return "IOS";
+                case OSFamily.Unknown:
+                    return "Unknown";
+            }
+            return null;
+        }
+
+        internal static OSFamily? ParseOSFamily(this string value)
+        {
+            switch( value )
+            {
+                case "Linux":
+                    return OSFamily.Linux;
+                case "Windows":
+                    return OSFamily.Windows;
+                case "Android":
+                    return OSFamily.Android;
+                case "IOS":
+                    return OSFamily.IOS;
+                case "Unknown":
+                    return OSFamily.Unknown;
+            }
+            return null;
+        }
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeConsent.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeConsent.cs
deleted file mode 100644
index d07012d86d16c..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeConsent.cs
+++ /dev/null
@@ -1,68 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using Microsoft.Rest;
-    using Microsoft.Rest.Serialization;
-    using Newtonsoft.Json;
-    using System.Linq;
-
-    /// <summary>
-    /// Consent for Office365 tenant that already made.
-    /// </summary>
-    [Rest.Serialization.JsonTransformation]
-    public partial class OfficeConsent : Resource
-    {
-        /// <summary>
-        /// Initializes a new instance of the OfficeConsent class.
-        /// </summary>
-        public OfficeConsent()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the OfficeConsent class.
-        /// </summary>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
-        /// <param name="tenantId">The tenantId of the Office365 with the
-        /// consent.</param>
-        /// <param name="tenantName">The tenant name of the Office365 with the
-        /// consent.</param>
-        public OfficeConsent(string id = default(string), string name = default(string), string type = default(string), string tenantId = default(string), string tenantName = default(string))
-            : base(id, name, type)
-        {
-            TenantId = tenantId;
-            TenantName = tenantName;
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-        /// <summary>
-        /// Gets or sets the tenantId of the Office365 with the consent.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.tenantId")]
-        public string TenantId { get; set; }
-
-        /// <summary>
-        /// Gets the tenant name of the Office365 with the consent.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.tenantName")]
-        public string TenantName { get; private set; }
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeDataConnector.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeDataConnector.cs
deleted file mode 100644
index 425a8b2bf0a33..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeDataConnector.cs
+++ /dev/null
@@ -1,70 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using Microsoft.Rest;
-    using Microsoft.Rest.Serialization;
-    using Newtonsoft.Json;
-    using System.Linq;
-
-    /// <summary>
-    /// Represents office data connector.
-    /// </summary>
-    [Newtonsoft.Json.JsonObject("Office365")]
-    [Rest.Serialization.JsonTransformation]
-    public partial class OfficeDataConnector : DataConnector
-    {
-        /// <summary>
-        /// Initializes a new instance of the OfficeDataConnector class.
-        /// </summary>
-        public OfficeDataConnector()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the OfficeDataConnector class.
-        /// </summary>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
-        /// <param name="etag">Etag of the azure resource</param>
-        /// <param name="tenantId">The tenant id to connect to, and get the
-        /// data from.</param>
-        /// <param name="dataTypes">The available data types for the
-        /// connector.</param>
-        public OfficeDataConnector(string id = default(string), string name = default(string), string type = default(string), string etag = default(string), string tenantId = default(string), OfficeDataConnectorDataTypes dataTypes = default(OfficeDataConnectorDataTypes))
-            : base(id, name, type, etag)
-        {
-            TenantId = tenantId;
-            DataTypes = dataTypes;
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-        /// <summary>
-        /// Gets or sets the tenant id to connect to, and get the data from.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.tenantId")]
-        public string TenantId { get; set; }
-
-        /// <summary>
-        /// Gets or sets the available data types for the connector.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.dataTypes")]
-        public OfficeDataConnectorDataTypes DataTypes { get; set; }
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeDataConnectorDataTypes.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeDataConnectorDataTypes.cs
deleted file mode 100644
index 278bc09539aac..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeDataConnectorDataTypes.cs
+++ /dev/null
@@ -1,69 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using Newtonsoft.Json;
-    using System.Linq;
-
-    /// <summary>
-    /// The available data types for office data connector.
-    /// </summary>
-    public partial class OfficeDataConnectorDataTypes
-    {
-        /// <summary>
-        /// Initializes a new instance of the OfficeDataConnectorDataTypes
-        /// class.
-        /// </summary>
-        public OfficeDataConnectorDataTypes()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the OfficeDataConnectorDataTypes
-        /// class.
-        /// </summary>
-        /// <param name="exchange">Exchange data type connection.</param>
-        /// <param name="sharePoint">SharePoint data type connection.</param>
-        /// <param name="teams">Teams data type connection.</param>
-        public OfficeDataConnectorDataTypes(OfficeDataConnectorDataTypesExchange exchange = default(OfficeDataConnectorDataTypesExchange), OfficeDataConnectorDataTypesSharePoint sharePoint = default(OfficeDataConnectorDataTypesSharePoint), OfficeDataConnectorDataTypesTeams teams = default(OfficeDataConnectorDataTypesTeams))
-        {
-            Exchange = exchange;
-            SharePoint = sharePoint;
-            Teams = teams;
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-        /// <summary>
-        /// Gets or sets exchange data type connection.
-        /// </summary>
-        [JsonProperty(PropertyName = "exchange")]
-        public OfficeDataConnectorDataTypesExchange Exchange { get; set; }
-
-        /// <summary>
-        /// Gets or sets sharePoint data type connection.
-        /// </summary>
-        [JsonProperty(PropertyName = "sharePoint")]
-        public OfficeDataConnectorDataTypesSharePoint SharePoint { get; set; }
-
-        /// <summary>
-        /// Gets or sets teams data type connection.
-        /// </summary>
-        [JsonProperty(PropertyName = "teams")]
-        public OfficeDataConnectorDataTypesTeams Teams { get; set; }
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeDataConnectorDataTypesExchange.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeDataConnectorDataTypesExchange.cs
deleted file mode 100644
index b06d0c806844d..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeDataConnectorDataTypesExchange.cs
+++ /dev/null
@@ -1,48 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using System.Linq;
-
-    /// <summary>
-    /// Exchange data type connection.
-    /// </summary>
-    public partial class OfficeDataConnectorDataTypesExchange : DataConnectorDataTypeCommon
-    {
-        /// <summary>
-        /// Initializes a new instance of the
-        /// OfficeDataConnectorDataTypesExchange class.
-        /// </summary>
-        public OfficeDataConnectorDataTypesExchange()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the
-        /// OfficeDataConnectorDataTypesExchange class.
-        /// </summary>
-        /// <param name="state">Describe whether this data type connection is
-        /// enabled or not. Possible values include: 'Enabled',
-        /// 'Disabled'</param>
-        public OfficeDataConnectorDataTypesExchange(string state = default(string))
-            : base(state)
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeDataConnectorDataTypesSharePoint.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeDataConnectorDataTypesSharePoint.cs
deleted file mode 100644
index ffe852f246520..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeDataConnectorDataTypesSharePoint.cs
+++ /dev/null
@@ -1,48 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using System.Linq;
-
-    /// <summary>
-    /// SharePoint data type connection.
-    /// </summary>
-    public partial class OfficeDataConnectorDataTypesSharePoint : DataConnectorDataTypeCommon
-    {
-        /// <summary>
-        /// Initializes a new instance of the
-        /// OfficeDataConnectorDataTypesSharePoint class.
-        /// </summary>
-        public OfficeDataConnectorDataTypesSharePoint()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the
-        /// OfficeDataConnectorDataTypesSharePoint class.
-        /// </summary>
-        /// <param name="state">Describe whether this data type connection is
-        /// enabled or not. Possible values include: 'Enabled',
-        /// 'Disabled'</param>
-        public OfficeDataConnectorDataTypesSharePoint(string state = default(string))
-            : base(state)
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Operation.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Operation.cs
index c5d3af3929eb8..31a7102091967 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Operation.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Operation.cs
@@ -31,10 +31,12 @@ public Operation()
         /// </summary>
         /// <param name="display">Properties of the operation</param>
         /// <param name="name">Name of the operation</param>
-        public Operation(OperationDisplay display = default(OperationDisplay), string name = default(string))
+        /// <param name="origin">The origin of the operation</param>
+        public Operation(OperationDisplay display = default(OperationDisplay), string name = default(string), string origin = default(string))
         {
             Display = display;
             Name = name;
+            Origin = origin;
             CustomInit();
         }
 
@@ -55,5 +57,11 @@ public Operation()
         [JsonProperty(PropertyName = "name")]
         public string Name { get; set; }
 
+        /// <summary>
+        /// Gets or sets the origin of the operation
+        /// </summary>
+        [JsonProperty(PropertyName = "origin")]
+        public string Origin { get; set; }
+
     }
 }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ProcessEntity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ProcessEntity.cs
new file mode 100644
index 0000000000000..02f6eb64a9dd3
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ProcessEntity.cs
@@ -0,0 +1,161 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents a process entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("Process")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class ProcessEntity : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the ProcessEntity class.
+        /// </summary>
+        public ProcessEntity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the ProcessEntity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="accountEntityId">The account entity id running the
+        /// processes.</param>
+        /// <param name="commandLine">The command line used to create the
+        /// process</param>
+        /// <param name="creationTimeUtc">The time when the process started to
+        /// run</param>
+        /// <param name="elevationToken">The elevation token associated with
+        /// the process. Possible values include: 'Default', 'Full',
+        /// 'Limited'</param>
+        /// <param name="hostEntityId">The host entity id on which the process
+        /// was running</param>
+        /// <param name="hostLogonSessionEntityId">The session entity id in
+        /// which the process was running</param>
+        /// <param name="imageFileEntityId">Image file entity id</param>
+        /// <param name="parentProcessEntityId">The parent process entity
+        /// id.</param>
+        /// <param name="processId">The process ID</param>
+        public ProcessEntity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), string accountEntityId = default(string), string commandLine = default(string), System.DateTime? creationTimeUtc = default(System.DateTime?), ElevationToken? elevationToken = default(ElevationToken?), string hostEntityId = default(string), string hostLogonSessionEntityId = default(string), string imageFileEntityId = default(string), string parentProcessEntityId = default(string), string processId = default(string))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            AccountEntityId = accountEntityId;
+            CommandLine = commandLine;
+            CreationTimeUtc = creationTimeUtc;
+            ElevationToken = elevationToken;
+            HostEntityId = hostEntityId;
+            HostLogonSessionEntityId = hostLogonSessionEntityId;
+            ImageFileEntityId = imageFileEntityId;
+            ParentProcessEntityId = parentProcessEntityId;
+            ProcessId = processId;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets the account entity id running the processes.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.accountEntityId")]
+        public string AccountEntityId { get; private set; }
+
+        /// <summary>
+        /// Gets the command line used to create the process
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.commandLine")]
+        public string CommandLine { get; private set; }
+
+        /// <summary>
+        /// Gets the time when the process started to run
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.creationTimeUtc")]
+        public System.DateTime? CreationTimeUtc { get; private set; }
+
+        /// <summary>
+        /// Gets or sets the elevation token associated with the process.
+        /// Possible values include: 'Default', 'Full', 'Limited'
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.elevationToken")]
+        public ElevationToken? ElevationToken { get; set; }
+
+        /// <summary>
+        /// Gets the host entity id on which the process was running
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.hostEntityId")]
+        public string HostEntityId { get; private set; }
+
+        /// <summary>
+        /// Gets the session entity id in which the process was running
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.hostLogonSessionEntityId")]
+        public string HostLogonSessionEntityId { get; private set; }
+
+        /// <summary>
+        /// Gets image file entity id
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.imageFileEntityId")]
+        public string ImageFileEntityId { get; private set; }
+
+        /// <summary>
+        /// Gets the parent process entity id.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.parentProcessEntityId")]
+        public string ParentProcessEntityId { get; private set; }
+
+        /// <summary>
+        /// Gets the process ID
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.processId")]
+        public string ProcessId { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ProxyResource.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ProxyResource.cs
new file mode 100644
index 0000000000000..26002268bddab
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ProxyResource.cs
@@ -0,0 +1,55 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using System.Linq;
+
+    /// <summary>
+    /// Proxy Resource
+    /// </summary>
+    /// <remarks>
+    /// The resource model definition for a Azure Resource Manager proxy
+    /// resource. It will not have tags and a location
+    /// </remarks>
+    public partial class ProxyResource : Resource
+    {
+        /// <summary>
+        /// Initializes a new instance of the ProxyResource class.
+        /// </summary>
+        public ProxyResource()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the ProxyResource class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        public ProxyResource(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData))
+            : base(id, name, type, systemData)
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/RegistryHive.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/RegistryHive.cs
new file mode 100644
index 0000000000000..0860ca0264f82
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/RegistryHive.cs
@@ -0,0 +1,60 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+
+    /// <summary>
+    /// Defines values for RegistryHive.
+    /// </summary>
+    public static class RegistryHive
+    {
+        /// <summary>
+        /// HKEY_LOCAL_MACHINE
+        /// </summary>
+        public const string HKEYLOCALMACHINE = "HKEY_LOCAL_MACHINE";
+        /// <summary>
+        /// HKEY_CLASSES_ROOT
+        /// </summary>
+        public const string HKEYCLASSESROOT = "HKEY_CLASSES_ROOT";
+        /// <summary>
+        /// HKEY_CURRENT_CONFIG
+        /// </summary>
+        public const string HKEYCURRENTCONFIG = "HKEY_CURRENT_CONFIG";
+        /// <summary>
+        /// HKEY_USERS
+        /// </summary>
+        public const string HKEYUSERS = "HKEY_USERS";
+        /// <summary>
+        /// HKEY_CURRENT_USER_LOCAL_SETTINGS
+        /// </summary>
+        public const string HKEYCURRENTUSERLOCALSETTINGS = "HKEY_CURRENT_USER_LOCAL_SETTINGS";
+        /// <summary>
+        /// HKEY_PERFORMANCE_DATA
+        /// </summary>
+        public const string HKEYPERFORMANCEDATA = "HKEY_PERFORMANCE_DATA";
+        /// <summary>
+        /// HKEY_PERFORMANCE_NLSTEXT
+        /// </summary>
+        public const string HKEYPERFORMANCENLSTEXT = "HKEY_PERFORMANCE_NLSTEXT";
+        /// <summary>
+        /// HKEY_PERFORMANCE_TEXT
+        /// </summary>
+        public const string HKEYPERFORMANCETEXT = "HKEY_PERFORMANCE_TEXT";
+        /// <summary>
+        /// HKEY_A
+        /// </summary>
+        public const string HKEYA = "HKEY_A";
+        /// <summary>
+        /// HKEY_CURRENT_USER
+        /// </summary>
+        public const string HKEYCURRENTUSER = "HKEY_CURRENT_USER";
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/RegistryKeyEntity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/RegistryKeyEntity.cs
new file mode 100644
index 0000000000000..3663e6f019789
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/RegistryKeyEntity.cs
@@ -0,0 +1,105 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents a registry key entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("RegistryKey")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class RegistryKeyEntity : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the RegistryKeyEntity class.
+        /// </summary>
+        public RegistryKeyEntity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the RegistryKeyEntity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="hive">the hive that holds the registry key. Possible
+        /// values include: 'HKEY_LOCAL_MACHINE', 'HKEY_CLASSES_ROOT',
+        /// 'HKEY_CURRENT_CONFIG', 'HKEY_USERS',
+        /// 'HKEY_CURRENT_USER_LOCAL_SETTINGS', 'HKEY_PERFORMANCE_DATA',
+        /// 'HKEY_PERFORMANCE_NLSTEXT', 'HKEY_PERFORMANCE_TEXT', 'HKEY_A',
+        /// 'HKEY_CURRENT_USER'</param>
+        /// <param name="key">The registry key path.</param>
+        public RegistryKeyEntity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), string hive = default(string), string key = default(string))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            Hive = hive;
+            Key = key;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets the hive that holds the registry key. Possible values include:
+        /// 'HKEY_LOCAL_MACHINE', 'HKEY_CLASSES_ROOT', 'HKEY_CURRENT_CONFIG',
+        /// 'HKEY_USERS', 'HKEY_CURRENT_USER_LOCAL_SETTINGS',
+        /// 'HKEY_PERFORMANCE_DATA', 'HKEY_PERFORMANCE_NLSTEXT',
+        /// 'HKEY_PERFORMANCE_TEXT', 'HKEY_A', 'HKEY_CURRENT_USER'
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.hive")]
+        public string Hive { get; private set; }
+
+        /// <summary>
+        /// Gets the registry key path.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.key")]
+        public string Key { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/RegistryValueEntity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/RegistryValueEntity.cs
new file mode 100644
index 0000000000000..6ffb7d0590cb1
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/RegistryValueEntity.cs
@@ -0,0 +1,120 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents a registry value entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("RegistryValue")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class RegistryValueEntity : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the RegistryValueEntity class.
+        /// </summary>
+        public RegistryValueEntity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the RegistryValueEntity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="keyEntityId">The registry key entity id.</param>
+        /// <param name="valueData">String formatted representation of the
+        /// value data.</param>
+        /// <param name="valueName">The registry value name.</param>
+        /// <param name="valueType">Specifies the data types to use when
+        /// storing values in the registry, or identifies the data type of a
+        /// value in the registry. Possible values include: 'None', 'Unknown',
+        /// 'String', 'ExpandString', 'Binary', 'DWord', 'MultiString',
+        /// 'QWord'</param>
+        public RegistryValueEntity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), string keyEntityId = default(string), string valueData = default(string), string valueName = default(string), string valueType = default(string))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            KeyEntityId = keyEntityId;
+            ValueData = valueData;
+            ValueName = valueName;
+            ValueType = valueType;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets the registry key entity id.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.keyEntityId")]
+        public string KeyEntityId { get; private set; }
+
+        /// <summary>
+        /// Gets string formatted representation of the value data.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.valueData")]
+        public string ValueData { get; private set; }
+
+        /// <summary>
+        /// Gets the registry value name.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.valueName")]
+        public string ValueName { get; private set; }
+
+        /// <summary>
+        /// Gets specifies the data types to use when storing values in the
+        /// registry, or identifies the data type of a value in the registry.
+        /// Possible values include: 'None', 'Unknown', 'String',
+        /// 'ExpandString', 'Binary', 'DWord', 'MultiString', 'QWord'
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.valueType")]
+        public string ValueType { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/RegistryValueKind.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/RegistryValueKind.cs
new file mode 100644
index 0000000000000..76710dc818473
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/RegistryValueKind.cs
@@ -0,0 +1,52 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+
+    /// <summary>
+    /// Defines values for RegistryValueKind.
+    /// </summary>
+    public static class RegistryValueKind
+    {
+        /// <summary>
+        /// None
+        /// </summary>
+        public const string None = "None";
+        /// <summary>
+        /// Unknown value type
+        /// </summary>
+        public const string Unknown = "Unknown";
+        /// <summary>
+        /// String value type
+        /// </summary>
+        public const string String = "String";
+        /// <summary>
+        /// ExpandString value type
+        /// </summary>
+        public const string ExpandString = "ExpandString";
+        /// <summary>
+        /// Binary value type
+        /// </summary>
+        public const string Binary = "Binary";
+        /// <summary>
+        /// DWord value type
+        /// </summary>
+        public const string DWord = "DWord";
+        /// <summary>
+        /// MultiString value type
+        /// </summary>
+        public const string MultiString = "MultiString";
+        /// <summary>
+        /// QWord value type
+        /// </summary>
+        public const string QWord = "QWord";
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Relation.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Relation.cs
new file mode 100644
index 0000000000000..ece75207014c3
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Relation.cs
@@ -0,0 +1,105 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents a relation between two resources
+    /// </summary>
+    [Rest.Serialization.JsonTransformation]
+    public partial class Relation : ResourceWithEtag
+    {
+        /// <summary>
+        /// Initializes a new instance of the Relation class.
+        /// </summary>
+        public Relation()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the Relation class.
+        /// </summary>
+        /// <param name="relatedResourceId">The resource ID of the related
+        /// resource</param>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="etag">Etag of the azure resource</param>
+        /// <param name="relatedResourceName">The name of the related
+        /// resource</param>
+        /// <param name="relatedResourceType">The resource type of the related
+        /// resource</param>
+        /// <param name="relatedResourceKind">The resource kind of the related
+        /// resource</param>
+        public Relation(string relatedResourceId, string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), string etag = default(string), string relatedResourceName = default(string), string relatedResourceType = default(string), string relatedResourceKind = default(string))
+            : base(id, name, type, systemData, etag)
+        {
+            RelatedResourceId = relatedResourceId;
+            RelatedResourceName = relatedResourceName;
+            RelatedResourceType = relatedResourceType;
+            RelatedResourceKind = relatedResourceKind;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets or sets the resource ID of the related resource
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.relatedResourceId")]
+        public string RelatedResourceId { get; set; }
+
+        /// <summary>
+        /// Gets the name of the related resource
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.relatedResourceName")]
+        public string RelatedResourceName { get; private set; }
+
+        /// <summary>
+        /// Gets the resource type of the related resource
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.relatedResourceType")]
+        public string RelatedResourceType { get; private set; }
+
+        /// <summary>
+        /// Gets the resource kind of the related resource
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.relatedResourceKind")]
+        public string RelatedResourceKind { get; private set; }
+
+        /// <summary>
+        /// Validate the object.
+        /// </summary>
+        /// <exception cref="ValidationException">
+        /// Thrown if validation fails
+        /// </exception>
+        public virtual void Validate()
+        {
+            if (RelatedResourceId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "RelatedResourceId");
+            }
+        }
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Resource.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Resource.cs
index d200b48f9b425..650557babf57e 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Resource.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Resource.cs
@@ -16,8 +16,12 @@ namespace Microsoft.Azure.Management.SecurityInsights.Models
     using System.Linq;
 
     /// <summary>
-    /// An azure resource object
+    /// Resource
     /// </summary>
+    /// <remarks>
+    /// Common fields that are returned in the response for all Azure Resource
+    /// Manager resources
+    /// </remarks>
     public partial class Resource : IResource
     {
         /// <summary>
@@ -31,14 +35,20 @@ public Resource()
         /// <summary>
         /// Initializes a new instance of the Resource class.
         /// </summary>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
-        public Resource(string id = default(string), string name = default(string), string type = default(string))
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        public Resource(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData))
         {
             Id = id;
             Name = name;
             Type = type;
+            SystemData = systemData;
             CustomInit();
         }
 
@@ -48,22 +58,32 @@ public Resource()
         partial void CustomInit();
 
         /// <summary>
-        /// Gets azure resource Id
+        /// Gets fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}
         /// </summary>
         [JsonProperty(PropertyName = "id")]
         public string Id { get; private set; }
 
         /// <summary>
-        /// Gets azure resource name
+        /// Gets the name of the resource
         /// </summary>
         [JsonProperty(PropertyName = "name")]
         public string Name { get; private set; }
 
         /// <summary>
-        /// Gets azure resource type
+        /// Gets the type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"
         /// </summary>
         [JsonProperty(PropertyName = "type")]
         public string Type { get; private set; }
 
+        /// <summary>
+        /// Gets azure Resource Manager metadata containing createdBy and
+        /// modifiedBy information.
+        /// </summary>
+        [JsonProperty(PropertyName = "systemData")]
+        public SystemData SystemData { get; private set; }
+
     }
 }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ResourceWithEtag.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ResourceWithEtag.cs
index 16b8a40cb14bc..06227e57b6b53 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ResourceWithEtag.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ResourceWithEtag.cs
@@ -10,15 +10,13 @@
 
 namespace Microsoft.Azure.Management.SecurityInsights.Models
 {
-    using Microsoft.Rest;
-    using Microsoft.Rest.Azure;
     using Newtonsoft.Json;
     using System.Linq;
 
     /// <summary>
     /// An azure resource object with an Etag property
     /// </summary>
-    public partial class ResourceWithEtag : IResource
+    public partial class ResourceWithEtag : Resource
     {
         /// <summary>
         /// Initializes a new instance of the ResourceWithEtag class.
@@ -31,15 +29,18 @@ public ResourceWithEtag()
         /// <summary>
         /// Initializes a new instance of the ResourceWithEtag class.
         /// </summary>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
         /// <param name="etag">Etag of the azure resource</param>
-        public ResourceWithEtag(string id = default(string), string name = default(string), string type = default(string), string etag = default(string))
+        public ResourceWithEtag(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), string etag = default(string))
+            : base(id, name, type, systemData)
         {
-            Id = id;
-            Name = name;
-            Type = type;
             Etag = etag;
             CustomInit();
         }
@@ -49,24 +50,6 @@ public ResourceWithEtag()
         /// </summary>
         partial void CustomInit();
 
-        /// <summary>
-        /// Gets azure resource Id
-        /// </summary>
-        [JsonProperty(PropertyName = "id")]
-        public string Id { get; private set; }
-
-        /// <summary>
-        /// Gets azure resource name
-        /// </summary>
-        [JsonProperty(PropertyName = "name")]
-        public string Name { get; private set; }
-
-        /// <summary>
-        /// Gets azure resource type
-        /// </summary>
-        [JsonProperty(PropertyName = "type")]
-        public string Type { get; private set; }
-
         /// <summary>
         /// Gets or sets etag of the azure resource
         /// </summary>
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ScheduledAlertRule.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ScheduledAlertRule.cs
index cc53fa1d1090a..9298fca41ec1e 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ScheduledAlertRule.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ScheduledAlertRule.cs
@@ -44,9 +44,14 @@ public ScheduledAlertRule()
         /// triggered.</param>
         /// <param name="suppressionEnabled">Determines whether the suppression
         /// for this alert rule is enabled or disabled.</param>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
         /// <param name="etag">Etag of the azure resource</param>
         /// <param name="query">The query that creates alerts for this
         /// rule.</param>
@@ -69,8 +74,8 @@ public ScheduledAlertRule()
         /// <param name="lastModifiedUtc">The last time that this alert rule
         /// has been modified.</param>
         /// <param name="tactics">The tactics of the alert rule</param>
-        public ScheduledAlertRule(string displayName, bool enabled, System.TimeSpan suppressionDuration, bool suppressionEnabled, string id = default(string), string name = default(string), string type = default(string), string etag = default(string), string query = default(string), System.TimeSpan? queryFrequency = default(System.TimeSpan?), System.TimeSpan? queryPeriod = default(System.TimeSpan?), string severity = default(string), TriggerOperator? triggerOperator = default(TriggerOperator?), int? triggerThreshold = default(int?), string alertRuleTemplateName = default(string), string description = default(string), System.DateTime? lastModifiedUtc = default(System.DateTime?), IList<string> tactics = default(IList<string>))
-            : base(id, name, type, etag)
+        public ScheduledAlertRule(string displayName, bool enabled, System.TimeSpan suppressionDuration, bool suppressionEnabled, string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), string etag = default(string), string query = default(string), System.TimeSpan? queryFrequency = default(System.TimeSpan?), System.TimeSpan? queryPeriod = default(System.TimeSpan?), string severity = default(string), TriggerOperator? triggerOperator = default(TriggerOperator?), int? triggerThreshold = default(int?), string alertRuleTemplateName = default(string), string description = default(string), System.DateTime? lastModifiedUtc = default(System.DateTime?), IList<string> tactics = default(IList<string>))
+            : base(id, name, type, systemData, etag)
         {
             Query = query;
             QueryFrequency = queryFrequency;
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ScheduledAlertRuleTemplate.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ScheduledAlertRuleTemplate.cs
index 5308116350d2d..cef0acaf332cd 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ScheduledAlertRuleTemplate.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ScheduledAlertRuleTemplate.cs
@@ -35,9 +35,14 @@ public ScheduledAlertRuleTemplate()
         /// <summary>
         /// Initializes a new instance of the ScheduledAlertRuleTemplate class.
         /// </summary>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
         /// <param name="alertRulesCreatedByTemplateCount">the number of alert
         /// rules that were created by this template</param>
         /// <param name="createdDateUTC">The time that this alert rule template
@@ -66,8 +71,8 @@ public ScheduledAlertRuleTemplate()
         /// rule.</param>
         /// <param name="tactics">The tactics of the alert rule
         /// template</param>
-        public ScheduledAlertRuleTemplate(string id = default(string), string name = default(string), string type = default(string), int? alertRulesCreatedByTemplateCount = default(int?), System.DateTime? createdDateUTC = default(System.DateTime?), string description = default(string), string displayName = default(string), IList<AlertRuleTemplateDataSource> requiredDataConnectors = default(IList<AlertRuleTemplateDataSource>), string status = default(string), string query = default(string), System.TimeSpan? queryFrequency = default(System.TimeSpan?), System.TimeSpan? queryPeriod = default(System.TimeSpan?), string severity = default(string), TriggerOperator? triggerOperator = default(TriggerOperator?), int? triggerThreshold = default(int?), IList<string> tactics = default(IList<string>))
-            : base(id, name, type)
+        public ScheduledAlertRuleTemplate(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), int? alertRulesCreatedByTemplateCount = default(int?), System.DateTime? createdDateUTC = default(System.DateTime?), string description = default(string), string displayName = default(string), IList<AlertRuleTemplateDataSource> requiredDataConnectors = default(IList<AlertRuleTemplateDataSource>), string status = default(string), string query = default(string), System.TimeSpan? queryFrequency = default(System.TimeSpan?), System.TimeSpan? queryPeriod = default(System.TimeSpan?), string severity = default(string), TriggerOperator? triggerOperator = default(TriggerOperator?), int? triggerThreshold = default(int?), IList<string> tactics = default(IList<string>))
+            : base(id, name, type, systemData)
         {
             AlertRulesCreatedByTemplateCount = alertRulesCreatedByTemplateCount;
             CreatedDateUTC = createdDateUTC;
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/SecurityAlert.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/SecurityAlert.cs
new file mode 100644
index 0000000000000..b739518403f8a
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/SecurityAlert.cs
@@ -0,0 +1,320 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents a security alert entity.
+    /// </summary>
+    [Rest.Serialization.JsonTransformation]
+    public partial class SecurityAlert : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the SecurityAlert class.
+        /// </summary>
+        public SecurityAlert()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the SecurityAlert class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="alertDisplayName">The display name of the
+        /// alert.</param>
+        /// <param name="alertType">The type name of the alert.</param>
+        /// <param name="compromisedEntity">Display name of the main entity
+        /// being reported on.</param>
+        /// <param name="confidenceLevel">The confidence level of this alert.
+        /// Possible values include: 'Unknown', 'Low', 'High'</param>
+        /// <param name="confidenceReasons">The confidence reasons</param>
+        /// <param name="confidenceScore">The confidence score of the
+        /// alert.</param>
+        /// <param name="confidenceScoreStatus">The confidence score
+        /// calculation status, i.e. indicating if score calculation is pending
+        /// for this alert, not applicable or final. Possible values include:
+        /// 'NotApplicable', 'InProcess', 'NotFinal', 'Final'</param>
+        /// <param name="description">Alert description.</param>
+        /// <param name="endTimeUtc">The impact end time of the alert (the time
+        /// of the last event contributing to the alert).</param>
+        /// <param name="intent">Holds the alert intent stage(s) mapping for
+        /// this alert. Possible values include: 'Unknown', 'Probing',
+        /// 'Exploitation', 'Persistence', 'PrivilegeEscalation',
+        /// 'DefenseEvasion', 'CredentialAccess', 'Discovery',
+        /// 'LateralMovement', 'Execution', 'Collection', 'Exfiltration',
+        /// 'CommandAndControl', 'Impact'</param>
+        /// <param name="providerAlertId">The identifier of the alert inside
+        /// the product which generated the alert.</param>
+        /// <param name="processingEndTime">The time the alert was made
+        /// available for consumption.</param>
+        /// <param name="productComponentName">The name of a component inside
+        /// the product which generated the alert.</param>
+        /// <param name="productName">The name of the product which published
+        /// this alert.</param>
+        /// <param name="productVersion">The version of the product generating
+        /// the alert.</param>
+        /// <param name="remediationSteps">Manual action items to take to
+        /// remediate the alert.</param>
+        /// <param name="severity">The severity of the alert. Possible values
+        /// include: 'High', 'Medium', 'Low', 'Informational'</param>
+        /// <param name="startTimeUtc">The impact start time of the alert (the
+        /// time of the first event contributing to the alert).</param>
+        /// <param name="status">The lifecycle status of the alert. Possible
+        /// values include: 'Unknown', 'New', 'Resolved', 'Dismissed',
+        /// 'InProgress'</param>
+        /// <param name="systemAlertId">Holds the product identifier of the
+        /// alert for the product.</param>
+        /// <param name="tactics">The tactics of the alert</param>
+        /// <param name="timeGenerated">The time the alert was
+        /// generated.</param>
+        /// <param name="vendorName">The name of the vendor that raise the
+        /// alert.</param>
+        /// <param name="alertLink">The uri link of the alert.</param>
+        /// <param name="resourceIdentifiers">The list of resource identifiers
+        /// of the alert.</param>
+        public SecurityAlert(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), string alertDisplayName = default(string), string alertType = default(string), string compromisedEntity = default(string), string confidenceLevel = default(string), IList<SecurityAlertPropertiesConfidenceReasonsItem> confidenceReasons = default(IList<SecurityAlertPropertiesConfidenceReasonsItem>), double? confidenceScore = default(double?), string confidenceScoreStatus = default(string), string description = default(string), System.DateTime? endTimeUtc = default(System.DateTime?), string intent = default(string), string providerAlertId = default(string), System.DateTime? processingEndTime = default(System.DateTime?), string productComponentName = default(string), string productName = default(string), string productVersion = default(string), IList<string> remediationSteps = default(IList<string>), string severity = default(string), System.DateTime? startTimeUtc = default(System.DateTime?), string status = default(string), string systemAlertId = default(string), IList<string> tactics = default(IList<string>), System.DateTime? timeGenerated = default(System.DateTime?), string vendorName = default(string), string alertLink = default(string), IList<object> resourceIdentifiers = default(IList<object>))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            AlertDisplayName = alertDisplayName;
+            AlertType = alertType;
+            CompromisedEntity = compromisedEntity;
+            ConfidenceLevel = confidenceLevel;
+            ConfidenceReasons = confidenceReasons;
+            ConfidenceScore = confidenceScore;
+            ConfidenceScoreStatus = confidenceScoreStatus;
+            Description = description;
+            EndTimeUtc = endTimeUtc;
+            Intent = intent;
+            ProviderAlertId = providerAlertId;
+            ProcessingEndTime = processingEndTime;
+            ProductComponentName = productComponentName;
+            ProductName = productName;
+            ProductVersion = productVersion;
+            RemediationSteps = remediationSteps;
+            Severity = severity;
+            StartTimeUtc = startTimeUtc;
+            Status = status;
+            SystemAlertId = systemAlertId;
+            Tactics = tactics;
+            TimeGenerated = timeGenerated;
+            VendorName = vendorName;
+            AlertLink = alertLink;
+            ResourceIdentifiers = resourceIdentifiers;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets the display name of the alert.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.alertDisplayName")]
+        public string AlertDisplayName { get; private set; }
+
+        /// <summary>
+        /// Gets the type name of the alert.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.alertType")]
+        public string AlertType { get; private set; }
+
+        /// <summary>
+        /// Gets display name of the main entity being reported on.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.compromisedEntity")]
+        public string CompromisedEntity { get; private set; }
+
+        /// <summary>
+        /// Gets the confidence level of this alert. Possible values include:
+        /// 'Unknown', 'Low', 'High'
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.confidenceLevel")]
+        public string ConfidenceLevel { get; private set; }
+
+        /// <summary>
+        /// Gets the confidence reasons
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.confidenceReasons")]
+        public IList<SecurityAlertPropertiesConfidenceReasonsItem> ConfidenceReasons { get; private set; }
+
+        /// <summary>
+        /// Gets the confidence score of the alert.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.confidenceScore")]
+        public double? ConfidenceScore { get; private set; }
+
+        /// <summary>
+        /// Gets the confidence score calculation status, i.e. indicating if
+        /// score calculation is pending for this alert, not applicable or
+        /// final. Possible values include: 'NotApplicable', 'InProcess',
+        /// 'NotFinal', 'Final'
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.confidenceScoreStatus")]
+        public string ConfidenceScoreStatus { get; private set; }
+
+        /// <summary>
+        /// Gets alert description.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.description")]
+        public string Description { get; private set; }
+
+        /// <summary>
+        /// Gets the impact end time of the alert (the time of the last event
+        /// contributing to the alert).
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.endTimeUtc")]
+        public System.DateTime? EndTimeUtc { get; private set; }
+
+        /// <summary>
+        /// Gets holds the alert intent stage(s) mapping for this alert.
+        /// Possible values include: 'Unknown', 'Probing', 'Exploitation',
+        /// 'Persistence', 'PrivilegeEscalation', 'DefenseEvasion',
+        /// 'CredentialAccess', 'Discovery', 'LateralMovement', 'Execution',
+        /// 'Collection', 'Exfiltration', 'CommandAndControl', 'Impact'
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.intent")]
+        public string Intent { get; private set; }
+
+        /// <summary>
+        /// Gets the identifier of the alert inside the product which generated
+        /// the alert.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.providerAlertId")]
+        public string ProviderAlertId { get; private set; }
+
+        /// <summary>
+        /// Gets the time the alert was made available for consumption.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.processingEndTime")]
+        public System.DateTime? ProcessingEndTime { get; private set; }
+
+        /// <summary>
+        /// Gets the name of a component inside the product which generated the
+        /// alert.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.productComponentName")]
+        public string ProductComponentName { get; private set; }
+
+        /// <summary>
+        /// Gets the name of the product which published this alert.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.productName")]
+        public string ProductName { get; private set; }
+
+        /// <summary>
+        /// Gets the version of the product generating the alert.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.productVersion")]
+        public string ProductVersion { get; private set; }
+
+        /// <summary>
+        /// Gets manual action items to take to remediate the alert.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.remediationSteps")]
+        public IList<string> RemediationSteps { get; private set; }
+
+        /// <summary>
+        /// Gets or sets the severity of the alert. Possible values include:
+        /// 'High', 'Medium', 'Low', 'Informational'
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.severity")]
+        public string Severity { get; set; }
+
+        /// <summary>
+        /// Gets the impact start time of the alert (the time of the first
+        /// event contributing to the alert).
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.startTimeUtc")]
+        public System.DateTime? StartTimeUtc { get; private set; }
+
+        /// <summary>
+        /// Gets the lifecycle status of the alert. Possible values include:
+        /// 'Unknown', 'New', 'Resolved', 'Dismissed', 'InProgress'
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.status")]
+        public string Status { get; private set; }
+
+        /// <summary>
+        /// Gets holds the product identifier of the alert for the product.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.systemAlertId")]
+        public string SystemAlertId { get; private set; }
+
+        /// <summary>
+        /// Gets the tactics of the alert
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.tactics")]
+        public IList<string> Tactics { get; private set; }
+
+        /// <summary>
+        /// Gets the time the alert was generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.timeGenerated")]
+        public System.DateTime? TimeGenerated { get; private set; }
+
+        /// <summary>
+        /// Gets the name of the vendor that raise the alert.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.vendorName")]
+        public string VendorName { get; private set; }
+
+        /// <summary>
+        /// Gets the uri link of the alert.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.alertLink")]
+        public string AlertLink { get; private set; }
+
+        /// <summary>
+        /// Gets the list of resource identifiers of the alert.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.resourceIdentifiers")]
+        public IList<object> ResourceIdentifiers { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/SecurityAlertPropertiesConfidenceReasonsItem.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/SecurityAlertPropertiesConfidenceReasonsItem.cs
new file mode 100644
index 0000000000000..8abc0caf73252
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/SecurityAlertPropertiesConfidenceReasonsItem.cs
@@ -0,0 +1,61 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using System.Linq;
+
+    /// <summary>
+    /// confidence reason item
+    /// </summary>
+    public partial class SecurityAlertPropertiesConfidenceReasonsItem
+    {
+        /// <summary>
+        /// Initializes a new instance of the
+        /// SecurityAlertPropertiesConfidenceReasonsItem class.
+        /// </summary>
+        public SecurityAlertPropertiesConfidenceReasonsItem()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the
+        /// SecurityAlertPropertiesConfidenceReasonsItem class.
+        /// </summary>
+        /// <param name="reason">The reason's description</param>
+        /// <param name="reasonType">The type (category) of the reason</param>
+        public SecurityAlertPropertiesConfidenceReasonsItem(string reason = default(string), string reasonType = default(string))
+        {
+            Reason = reason;
+            ReasonType = reasonType;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets the reason's description
+        /// </summary>
+        [JsonProperty(PropertyName = "reason")]
+        public string Reason { get; private set; }
+
+        /// <summary>
+        /// Gets the type (category) of the reason
+        /// </summary>
+        [JsonProperty(PropertyName = "reasonType")]
+        public string ReasonType { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/SecurityGroupEntity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/SecurityGroupEntity.cs
new file mode 100644
index 0000000000000..3bf63df902af4
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/SecurityGroupEntity.cs
@@ -0,0 +1,110 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents a security group entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("SecurityGroup")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class SecurityGroupEntity : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the SecurityGroupEntity class.
+        /// </summary>
+        public SecurityGroupEntity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the SecurityGroupEntity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="distinguishedName">The group distinguished
+        /// name</param>
+        /// <param name="objectGuid">A single-value attribute that is the
+        /// unique identifier for the object, assigned by active
+        /// directory.</param>
+        /// <param name="sid">The SID attribute is a single-value attribute
+        /// that specifies the security identifier (SID) of the group</param>
+        public SecurityGroupEntity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), string distinguishedName = default(string), System.Guid? objectGuid = default(System.Guid?), string sid = default(string))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            DistinguishedName = distinguishedName;
+            ObjectGuid = objectGuid;
+            Sid = sid;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets the group distinguished name
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.distinguishedName")]
+        public string DistinguishedName { get; private set; }
+
+        /// <summary>
+        /// Gets a single-value attribute that is the unique identifier for the
+        /// object, assigned by active directory.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.objectGuid")]
+        public System.Guid? ObjectGuid { get; private set; }
+
+        /// <summary>
+        /// Gets the SID attribute is a single-value attribute that specifies
+        /// the security identifier (SID) of the group
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.sid")]
+        public string Sid { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Settings.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Settings.cs
deleted file mode 100644
index 8c278ec9b2f50..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Settings.cs
+++ /dev/null
@@ -1,47 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using System.Linq;
-
-    /// <summary>
-    /// The Settings.
-    /// </summary>
-    public partial class Settings : ResourceWithEtag
-    {
-        /// <summary>
-        /// Initializes a new instance of the Settings class.
-        /// </summary>
-        public Settings()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the Settings class.
-        /// </summary>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
-        /// <param name="etag">Etag of the azure resource</param>
-        public Settings(string id = default(string), string name = default(string), string type = default(string), string etag = default(string))
-            : base(id, name, type, etag)
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/StatusInMcas.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Source.cs
similarity index 72%
rename from sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/StatusInMcas.cs
rename to sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Source.cs
index 397794960d901..12261c5c8fa68 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/StatusInMcas.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Source.cs
@@ -12,11 +12,11 @@ namespace Microsoft.Azure.Management.SecurityInsights.Models
 {
 
     /// <summary>
-    /// Defines values for StatusInMcas.
+    /// Defines values for Source.
     /// </summary>
-    public static class StatusInMcas
+    public static class Source
     {
-        public const string Enabled = "Enabled";
-        public const string Disabled = "Disabled";
+        public const string Localfile = "Local file";
+        public const string Remotestorage = "Remote storage";
     }
 }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/SubmissionMailEntity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/SubmissionMailEntity.cs
new file mode 100644
index 0000000000000..429d1745cb61f
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/SubmissionMailEntity.cs
@@ -0,0 +1,164 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents a submission mail entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("SubmissionMail")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class SubmissionMailEntity : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the SubmissionMailEntity class.
+        /// </summary>
+        public SubmissionMailEntity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the SubmissionMailEntity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="networkMessageId">The network message id of email to
+        /// which submission belongs</param>
+        /// <param name="submissionId">The submission id</param>
+        /// <param name="submitter">The submitter</param>
+        /// <param name="submissionDate">The submission date</param>
+        /// <param name="timestamp">The Time stamp when the message is received
+        /// (Mail)</param>
+        /// <param name="recipient">The recipient of the mail</param>
+        /// <param name="sender">The sender of the mail</param>
+        /// <param name="senderIp">The sender's IP</param>
+        /// <param name="subject">The subject of submission mail</param>
+        /// <param name="reportType">The submission type for the given
+        /// instance. This maps to Junk, Phish, Malware or NotJunk.</param>
+        public SubmissionMailEntity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), System.Guid? networkMessageId = default(System.Guid?), System.Guid? submissionId = default(System.Guid?), string submitter = default(string), System.DateTime? submissionDate = default(System.DateTime?), System.DateTime? timestamp = default(System.DateTime?), string recipient = default(string), string sender = default(string), string senderIp = default(string), string subject = default(string), string reportType = default(string))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            NetworkMessageId = networkMessageId;
+            SubmissionId = submissionId;
+            Submitter = submitter;
+            SubmissionDate = submissionDate;
+            Timestamp = timestamp;
+            Recipient = recipient;
+            Sender = sender;
+            SenderIp = senderIp;
+            Subject = subject;
+            ReportType = reportType;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets the network message id of email to which submission belongs
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.networkMessageId")]
+        public System.Guid? NetworkMessageId { get; private set; }
+
+        /// <summary>
+        /// Gets the submission id
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.submissionId")]
+        public System.Guid? SubmissionId { get; private set; }
+
+        /// <summary>
+        /// Gets the submitter
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.submitter")]
+        public string Submitter { get; private set; }
+
+        /// <summary>
+        /// Gets the submission date
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.submissionDate")]
+        public System.DateTime? SubmissionDate { get; private set; }
+
+        /// <summary>
+        /// Gets the Time stamp when the message is received (Mail)
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.timestamp")]
+        public System.DateTime? Timestamp { get; private set; }
+
+        /// <summary>
+        /// Gets the recipient of the mail
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.recipient")]
+        public string Recipient { get; private set; }
+
+        /// <summary>
+        /// Gets the sender of the mail
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.sender")]
+        public string Sender { get; private set; }
+
+        /// <summary>
+        /// Gets the sender's IP
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.senderIp")]
+        public string SenderIp { get; private set; }
+
+        /// <summary>
+        /// Gets the subject of submission mail
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.subject")]
+        public string Subject { get; private set; }
+
+        /// <summary>
+        /// Gets the submission type for the given instance. This maps to Junk,
+        /// Phish, Malware or NotJunk.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.reportType")]
+        public string ReportType { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/SystemData.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/SystemData.cs
new file mode 100644
index 0000000000000..fc614c190b311
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/SystemData.cs
@@ -0,0 +1,103 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using System.Linq;
+
+    /// <summary>
+    /// Metadata pertaining to creation and last modification of the resource.
+    /// </summary>
+    public partial class SystemData
+    {
+        /// <summary>
+        /// Initializes a new instance of the SystemData class.
+        /// </summary>
+        public SystemData()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the SystemData class.
+        /// </summary>
+        /// <param name="createdBy">The identity that created the
+        /// resource.</param>
+        /// <param name="createdByType">The type of identity that created the
+        /// resource. Possible values include: 'User', 'Application',
+        /// 'ManagedIdentity', 'Key'</param>
+        /// <param name="createdAt">The timestamp of resource creation
+        /// (UTC).</param>
+        /// <param name="lastModifiedBy">The identity that last modified the
+        /// resource.</param>
+        /// <param name="lastModifiedByType">The type of identity that last
+        /// modified the resource. Possible values include: 'User',
+        /// 'Application', 'ManagedIdentity', 'Key'</param>
+        /// <param name="lastModifiedAt">The timestamp of resource last
+        /// modification (UTC)</param>
+        public SystemData(string createdBy = default(string), string createdByType = default(string), System.DateTime? createdAt = default(System.DateTime?), string lastModifiedBy = default(string), string lastModifiedByType = default(string), System.DateTime? lastModifiedAt = default(System.DateTime?))
+        {
+            CreatedBy = createdBy;
+            CreatedByType = createdByType;
+            CreatedAt = createdAt;
+            LastModifiedBy = lastModifiedBy;
+            LastModifiedByType = lastModifiedByType;
+            LastModifiedAt = lastModifiedAt;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets or sets the identity that created the resource.
+        /// </summary>
+        [JsonProperty(PropertyName = "createdBy")]
+        public string CreatedBy { get; set; }
+
+        /// <summary>
+        /// Gets or sets the type of identity that created the resource.
+        /// Possible values include: 'User', 'Application', 'ManagedIdentity',
+        /// 'Key'
+        /// </summary>
+        [JsonProperty(PropertyName = "createdByType")]
+        public string CreatedByType { get; set; }
+
+        /// <summary>
+        /// Gets or sets the timestamp of resource creation (UTC).
+        /// </summary>
+        [JsonProperty(PropertyName = "createdAt")]
+        public System.DateTime? CreatedAt { get; set; }
+
+        /// <summary>
+        /// Gets or sets the identity that last modified the resource.
+        /// </summary>
+        [JsonProperty(PropertyName = "lastModifiedBy")]
+        public string LastModifiedBy { get; set; }
+
+        /// <summary>
+        /// Gets or sets the type of identity that last modified the resource.
+        /// Possible values include: 'User', 'Application', 'ManagedIdentity',
+        /// 'Key'
+        /// </summary>
+        [JsonProperty(PropertyName = "lastModifiedByType")]
+        public string LastModifiedByType { get; set; }
+
+        /// <summary>
+        /// Gets or sets the timestamp of resource last modification (UTC)
+        /// </summary>
+        [JsonProperty(PropertyName = "lastModifiedAt")]
+        public System.DateTime? LastModifiedAt { get; set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/TIDataConnector.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/TIDataConnector.cs
deleted file mode 100644
index caa1fc0f80a62..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/TIDataConnector.cs
+++ /dev/null
@@ -1,79 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using Microsoft.Rest;
-    using Microsoft.Rest.Serialization;
-    using Newtonsoft.Json;
-    using System.Linq;
-
-    /// <summary>
-    /// Represents threat intelligence data connector.
-    /// </summary>
-    [Newtonsoft.Json.JsonObject("ThreatIntelligence")]
-    [Rest.Serialization.JsonTransformation]
-    public partial class TIDataConnector : DataConnector
-    {
-        /// <summary>
-        /// Initializes a new instance of the TIDataConnector class.
-        /// </summary>
-        public TIDataConnector()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the TIDataConnector class.
-        /// </summary>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
-        /// <param name="etag">Etag of the azure resource</param>
-        /// <param name="tenantId">The tenant id to connect to, and get the
-        /// data from.</param>
-        /// <param name="tipLookbackPeriod">The lookback period for the feed to
-        /// be imported.</param>
-        /// <param name="dataTypes">The available data types for the
-        /// connector.</param>
-        public TIDataConnector(string id = default(string), string name = default(string), string type = default(string), string etag = default(string), string tenantId = default(string), System.DateTime? tipLookbackPeriod = default(System.DateTime?), TIDataConnectorDataTypes dataTypes = default(TIDataConnectorDataTypes))
-            : base(id, name, type, etag)
-        {
-            TenantId = tenantId;
-            TipLookbackPeriod = tipLookbackPeriod;
-            DataTypes = dataTypes;
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-        /// <summary>
-        /// Gets or sets the tenant id to connect to, and get the data from.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.tenantId")]
-        public string TenantId { get; set; }
-
-        /// <summary>
-        /// Gets or sets the lookback period for the feed to be imported.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.tipLookbackPeriod")]
-        public System.DateTime? TipLookbackPeriod { get; set; }
-
-        /// <summary>
-        /// Gets or sets the available data types for the connector.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.dataTypes")]
-        public TIDataConnectorDataTypes DataTypes { get; set; }
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/TIDataConnectorDataTypes.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/TIDataConnectorDataTypes.cs
deleted file mode 100644
index 92fdaf0c1d617..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/TIDataConnectorDataTypes.cs
+++ /dev/null
@@ -1,52 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using Newtonsoft.Json;
-    using System.Linq;
-
-    /// <summary>
-    /// The available data types for TI (Threat Intelligence) data connector.
-    /// </summary>
-    public partial class TIDataConnectorDataTypes
-    {
-        /// <summary>
-        /// Initializes a new instance of the TIDataConnectorDataTypes class.
-        /// </summary>
-        public TIDataConnectorDataTypes()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the TIDataConnectorDataTypes class.
-        /// </summary>
-        /// <param name="indicators">Data type for indicators
-        /// connection.</param>
-        public TIDataConnectorDataTypes(TIDataConnectorDataTypesIndicators indicators = default(TIDataConnectorDataTypesIndicators))
-        {
-            Indicators = indicators;
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-        /// <summary>
-        /// Gets or sets data type for indicators connection.
-        /// </summary>
-        [JsonProperty(PropertyName = "indicators")]
-        public TIDataConnectorDataTypesIndicators Indicators { get; set; }
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/TIDataConnectorDataTypesIndicators.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/TIDataConnectorDataTypesIndicators.cs
deleted file mode 100644
index 75d4809736719..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/TIDataConnectorDataTypesIndicators.cs
+++ /dev/null
@@ -1,48 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using System.Linq;
-
-    /// <summary>
-    /// Data type for indicators connection.
-    /// </summary>
-    public partial class TIDataConnectorDataTypesIndicators : DataConnectorDataTypeCommon
-    {
-        /// <summary>
-        /// Initializes a new instance of the
-        /// TIDataConnectorDataTypesIndicators class.
-        /// </summary>
-        public TIDataConnectorDataTypesIndicators()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the
-        /// TIDataConnectorDataTypesIndicators class.
-        /// </summary>
-        /// <param name="state">Describe whether this data type connection is
-        /// enabled or not. Possible values include: 'Enabled',
-        /// 'Disabled'</param>
-        public TIDataConnectorDataTypesIndicators(string state = default(string))
-            : base(state)
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DataConnectorDataTypeCommon.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceAppendTags.cs
similarity index 53%
rename from sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DataConnectorDataTypeCommon.cs
rename to sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceAppendTags.cs
index 322fd804d6c76..2b45b4e8ac260 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DataConnectorDataTypeCommon.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceAppendTags.cs
@@ -11,32 +11,33 @@
 namespace Microsoft.Azure.Management.SecurityInsights.Models
 {
     using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
     using System.Linq;
 
     /// <summary>
-    /// Common field for data type in data connectors.
+    /// Array of tags to be appended to the threat intelligence indicator.
     /// </summary>
-    public partial class DataConnectorDataTypeCommon
+    public partial class ThreatIntelligenceAppendTags
     {
         /// <summary>
-        /// Initializes a new instance of the DataConnectorDataTypeCommon
+        /// Initializes a new instance of the ThreatIntelligenceAppendTags
         /// class.
         /// </summary>
-        public DataConnectorDataTypeCommon()
+        public ThreatIntelligenceAppendTags()
         {
             CustomInit();
         }
 
         /// <summary>
-        /// Initializes a new instance of the DataConnectorDataTypeCommon
+        /// Initializes a new instance of the ThreatIntelligenceAppendTags
         /// class.
         /// </summary>
-        /// <param name="state">Describe whether this data type connection is
-        /// enabled or not. Possible values include: 'Enabled',
-        /// 'Disabled'</param>
-        public DataConnectorDataTypeCommon(string state = default(string))
+        /// <param name="threatIntelligenceTags">List of tags to be
+        /// appended.</param>
+        public ThreatIntelligenceAppendTags(IList<string> threatIntelligenceTags = default(IList<string>))
         {
-            State = state;
+            ThreatIntelligenceTags = threatIntelligenceTags;
             CustomInit();
         }
 
@@ -46,11 +47,10 @@ public DataConnectorDataTypeCommon()
         partial void CustomInit();
 
         /// <summary>
-        /// Gets or sets describe whether this data type connection is enabled
-        /// or not. Possible values include: 'Enabled', 'Disabled'
+        /// Gets or sets list of tags to be appended.
         /// </summary>
-        [JsonProperty(PropertyName = "state")]
-        public string State { get; set; }
+        [JsonProperty(PropertyName = "threatIntelligenceTags")]
+        public IList<string> ThreatIntelligenceTags { get; set; }
 
     }
 }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceExternalReference.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceExternalReference.cs
new file mode 100644
index 0000000000000..e1386be79a9b8
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceExternalReference.cs
@@ -0,0 +1,87 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Describes external reference
+    /// </summary>
+    public partial class ThreatIntelligenceExternalReference
+    {
+        /// <summary>
+        /// Initializes a new instance of the
+        /// ThreatIntelligenceExternalReference class.
+        /// </summary>
+        public ThreatIntelligenceExternalReference()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the
+        /// ThreatIntelligenceExternalReference class.
+        /// </summary>
+        /// <param name="description">External reference description</param>
+        /// <param name="externalId">External reference ID</param>
+        /// <param name="sourceName">External reference source name</param>
+        /// <param name="url">External reference URL</param>
+        /// <param name="hashes">External reference hashes</param>
+        public ThreatIntelligenceExternalReference(string description = default(string), string externalId = default(string), string sourceName = default(string), string url = default(string), IDictionary<string, string> hashes = default(IDictionary<string, string>))
+        {
+            Description = description;
+            ExternalId = externalId;
+            SourceName = sourceName;
+            Url = url;
+            Hashes = hashes;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets or sets external reference description
+        /// </summary>
+        [JsonProperty(PropertyName = "description")]
+        public string Description { get; set; }
+
+        /// <summary>
+        /// Gets or sets external reference ID
+        /// </summary>
+        [JsonProperty(PropertyName = "externalId")]
+        public string ExternalId { get; set; }
+
+        /// <summary>
+        /// Gets or sets external reference source name
+        /// </summary>
+        [JsonProperty(PropertyName = "sourceName")]
+        public string SourceName { get; set; }
+
+        /// <summary>
+        /// Gets or sets external reference URL
+        /// </summary>
+        [JsonProperty(PropertyName = "url")]
+        public string Url { get; set; }
+
+        /// <summary>
+        /// Gets or sets external reference hashes
+        /// </summary>
+        [JsonProperty(PropertyName = "hashes")]
+        public IDictionary<string, string> Hashes { get; set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceFilteringCriteria.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceFilteringCriteria.cs
new file mode 100644
index 0000000000000..9bf5d277fd86d
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceFilteringCriteria.cs
@@ -0,0 +1,156 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Filtering criteria for querying threat intelligence indicators.
+    /// </summary>
+    public partial class ThreatIntelligenceFilteringCriteria
+    {
+        /// <summary>
+        /// Initializes a new instance of the
+        /// ThreatIntelligenceFilteringCriteria class.
+        /// </summary>
+        public ThreatIntelligenceFilteringCriteria()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the
+        /// ThreatIntelligenceFilteringCriteria class.
+        /// </summary>
+        /// <param name="pageSize">Page size</param>
+        /// <param name="minConfidence">Minimum confidence.</param>
+        /// <param name="maxConfidence">Maximum confidence.</param>
+        /// <param name="minValidUntil">Start time for ValidUntil
+        /// filter.</param>
+        /// <param name="maxValidUntil">End time for ValidUntil filter.</param>
+        /// <param name="includeDisabled">Parameter to include/exclude disabled
+        /// indicators.</param>
+        /// <param name="sortBy">Columns to sort by and sorting order</param>
+        /// <param name="sources">Sources of threat intelligence
+        /// indicators</param>
+        /// <param name="patternTypes">Pattern types</param>
+        /// <param name="threatTypes">Threat types of threat intelligence
+        /// indicators</param>
+        /// <param name="ids">Ids of threat intelligence indicators</param>
+        /// <param name="keywords">Keywords for searching threat intelligence
+        /// indicators</param>
+        /// <param name="skipToken">Skip token.</param>
+        public ThreatIntelligenceFilteringCriteria(int? pageSize = default(int?), int? minConfidence = default(int?), int? maxConfidence = default(int?), string minValidUntil = default(string), string maxValidUntil = default(string), bool? includeDisabled = default(bool?), IList<ThreatIntelligenceSortingCriteria> sortBy = default(IList<ThreatIntelligenceSortingCriteria>), IList<string> sources = default(IList<string>), IList<string> patternTypes = default(IList<string>), IList<string> threatTypes = default(IList<string>), IList<string> ids = default(IList<string>), IList<string> keywords = default(IList<string>), string skipToken = default(string))
+        {
+            PageSize = pageSize;
+            MinConfidence = minConfidence;
+            MaxConfidence = maxConfidence;
+            MinValidUntil = minValidUntil;
+            MaxValidUntil = maxValidUntil;
+            IncludeDisabled = includeDisabled;
+            SortBy = sortBy;
+            Sources = sources;
+            PatternTypes = patternTypes;
+            ThreatTypes = threatTypes;
+            Ids = ids;
+            Keywords = keywords;
+            SkipToken = skipToken;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets or sets page size
+        /// </summary>
+        [JsonProperty(PropertyName = "pageSize")]
+        public int? PageSize { get; set; }
+
+        /// <summary>
+        /// Gets or sets minimum confidence.
+        /// </summary>
+        [JsonProperty(PropertyName = "minConfidence")]
+        public int? MinConfidence { get; set; }
+
+        /// <summary>
+        /// Gets or sets maximum confidence.
+        /// </summary>
+        [JsonProperty(PropertyName = "maxConfidence")]
+        public int? MaxConfidence { get; set; }
+
+        /// <summary>
+        /// Gets or sets start time for ValidUntil filter.
+        /// </summary>
+        [JsonProperty(PropertyName = "minValidUntil")]
+        public string MinValidUntil { get; set; }
+
+        /// <summary>
+        /// Gets or sets end time for ValidUntil filter.
+        /// </summary>
+        [JsonProperty(PropertyName = "maxValidUntil")]
+        public string MaxValidUntil { get; set; }
+
+        /// <summary>
+        /// Gets or sets parameter to include/exclude disabled indicators.
+        /// </summary>
+        [JsonProperty(PropertyName = "includeDisabled")]
+        public bool? IncludeDisabled { get; set; }
+
+        /// <summary>
+        /// Gets or sets columns to sort by and sorting order
+        /// </summary>
+        [JsonProperty(PropertyName = "sortBy")]
+        public IList<ThreatIntelligenceSortingCriteria> SortBy { get; set; }
+
+        /// <summary>
+        /// Gets or sets sources of threat intelligence indicators
+        /// </summary>
+        [JsonProperty(PropertyName = "sources")]
+        public IList<string> Sources { get; set; }
+
+        /// <summary>
+        /// Gets or sets pattern types
+        /// </summary>
+        [JsonProperty(PropertyName = "patternTypes")]
+        public IList<string> PatternTypes { get; set; }
+
+        /// <summary>
+        /// Gets or sets threat types of threat intelligence indicators
+        /// </summary>
+        [JsonProperty(PropertyName = "threatTypes")]
+        public IList<string> ThreatTypes { get; set; }
+
+        /// <summary>
+        /// Gets or sets ids of threat intelligence indicators
+        /// </summary>
+        [JsonProperty(PropertyName = "ids")]
+        public IList<string> Ids { get; set; }
+
+        /// <summary>
+        /// Gets or sets keywords for searching threat intelligence indicators
+        /// </summary>
+        [JsonProperty(PropertyName = "keywords")]
+        public IList<string> Keywords { get; set; }
+
+        /// <summary>
+        /// Gets or sets skip token.
+        /// </summary>
+        [JsonProperty(PropertyName = "skipToken")]
+        public string SkipToken { get; set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceGranularMarkingModel.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceGranularMarkingModel.cs
new file mode 100644
index 0000000000000..2d3c96bf489ed
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceGranularMarkingModel.cs
@@ -0,0 +1,72 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Describes threat granular marking model entity
+    /// </summary>
+    public partial class ThreatIntelligenceGranularMarkingModel
+    {
+        /// <summary>
+        /// Initializes a new instance of the
+        /// ThreatIntelligenceGranularMarkingModel class.
+        /// </summary>
+        public ThreatIntelligenceGranularMarkingModel()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the
+        /// ThreatIntelligenceGranularMarkingModel class.
+        /// </summary>
+        /// <param name="language">Language granular marking model</param>
+        /// <param name="markingRef">marking reference granular marking
+        /// model</param>
+        /// <param name="selectors">granular marking model selectors</param>
+        public ThreatIntelligenceGranularMarkingModel(string language = default(string), int? markingRef = default(int?), IList<string> selectors = default(IList<string>))
+        {
+            Language = language;
+            MarkingRef = markingRef;
+            Selectors = selectors;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets or sets language granular marking model
+        /// </summary>
+        [JsonProperty(PropertyName = "language")]
+        public string Language { get; set; }
+
+        /// <summary>
+        /// Gets or sets marking reference granular marking model
+        /// </summary>
+        [JsonProperty(PropertyName = "markingRef")]
+        public int? MarkingRef { get; set; }
+
+        /// <summary>
+        /// Gets or sets granular marking model selectors
+        /// </summary>
+        [JsonProperty(PropertyName = "selectors")]
+        public IList<string> Selectors { get; set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceIndicatorModel.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceIndicatorModel.cs
new file mode 100644
index 0000000000000..7e1bd7ed71817
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceIndicatorModel.cs
@@ -0,0 +1,312 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Threat intelligence indicator entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("indicator")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class ThreatIntelligenceIndicatorModel : ThreatIntelligenceInformation
+    {
+        /// <summary>
+        /// Initializes a new instance of the ThreatIntelligenceIndicatorModel
+        /// class.
+        /// </summary>
+        public ThreatIntelligenceIndicatorModel()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the ThreatIntelligenceIndicatorModel
+        /// class.
+        /// </summary>
+        /// <param name="etag">Etag of the azure resource</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="threatIntelligenceTags">List of tags</param>
+        /// <param name="lastUpdatedTimeUtc">Last updated time in UTC</param>
+        /// <param name="source">Source of a threat intelligence entity</param>
+        /// <param name="displayName">Display name of a threat intelligence
+        /// entity</param>
+        /// <param name="description">Description of a threat intelligence
+        /// entity</param>
+        /// <param name="indicatorTypes">Indicator types of threat intelligence
+        /// entities</param>
+        /// <param name="pattern">Pattern of a threat intelligence
+        /// entity</param>
+        /// <param name="patternType">Pattern type of a threat intelligence
+        /// entity</param>
+        /// <param name="patternVersion">Pattern version of a threat
+        /// intelligence entity</param>
+        /// <param name="killChainPhases">Kill chain phases</param>
+        /// <param name="parsedPattern">Parsed patterns</param>
+        /// <param name="externalId">External ID of threat intelligence
+        /// entity</param>
+        /// <param name="createdByRef">Created by reference of threat
+        /// intelligence entity</param>
+        /// <param name="defanged">Is threat intelligence entity
+        /// defanged</param>
+        /// <param name="externalLastUpdatedTimeUtc">External last updated time
+        /// in UTC</param>
+        /// <param name="externalReferences">External References</param>
+        /// <param name="granularMarkings">Granular Markings</param>
+        /// <param name="labels">Labels  of threat intelligence entity</param>
+        /// <param name="revoked">Is threat intelligence entity revoked</param>
+        /// <param name="confidence">Confidence of threat intelligence
+        /// entity</param>
+        /// <param name="objectMarkingRefs">Threat intelligence entity object
+        /// marking references</param>
+        /// <param name="language">Language of threat intelligence
+        /// entity</param>
+        /// <param name="threatTypes">Threat types</param>
+        /// <param name="validFrom">Valid from</param>
+        /// <param name="validUntil">Valid until</param>
+        /// <param name="created">Created by</param>
+        /// <param name="modified">Modified by</param>
+        /// <param name="extensions">Extensions map</param>
+        public ThreatIntelligenceIndicatorModel(string etag = default(string), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), IList<string> threatIntelligenceTags = default(IList<string>), string lastUpdatedTimeUtc = default(string), string source = default(string), string displayName = default(string), string description = default(string), IList<string> indicatorTypes = default(IList<string>), string pattern = default(string), string patternType = default(string), string patternVersion = default(string), IList<ThreatIntelligenceKillChainPhase> killChainPhases = default(IList<ThreatIntelligenceKillChainPhase>), IList<ThreatIntelligenceParsedPattern> parsedPattern = default(IList<ThreatIntelligenceParsedPattern>), string externalId = default(string), string createdByRef = default(string), bool? defanged = default(bool?), string externalLastUpdatedTimeUtc = default(string), IList<ThreatIntelligenceExternalReference> externalReferences = default(IList<ThreatIntelligenceExternalReference>), IList<ThreatIntelligenceGranularMarkingModel> granularMarkings = default(IList<ThreatIntelligenceGranularMarkingModel>), IList<string> labels = default(IList<string>), bool? revoked = default(bool?), int? confidence = default(int?), IList<string> objectMarkingRefs = default(IList<string>), string language = default(string), IList<string> threatTypes = default(IList<string>), string validFrom = default(string), string validUntil = default(string), string created = default(string), string modified = default(string), IDictionary<string, object> extensions = default(IDictionary<string, object>))
+            : base(etag)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            ThreatIntelligenceTags = threatIntelligenceTags;
+            LastUpdatedTimeUtc = lastUpdatedTimeUtc;
+            Source = source;
+            DisplayName = displayName;
+            Description = description;
+            IndicatorTypes = indicatorTypes;
+            Pattern = pattern;
+            PatternType = patternType;
+            PatternVersion = patternVersion;
+            KillChainPhases = killChainPhases;
+            ParsedPattern = parsedPattern;
+            ExternalId = externalId;
+            CreatedByRef = createdByRef;
+            Defanged = defanged;
+            ExternalLastUpdatedTimeUtc = externalLastUpdatedTimeUtc;
+            ExternalReferences = externalReferences;
+            GranularMarkings = granularMarkings;
+            Labels = labels;
+            Revoked = revoked;
+            Confidence = confidence;
+            ObjectMarkingRefs = objectMarkingRefs;
+            Language = language;
+            ThreatTypes = threatTypes;
+            ValidFrom = validFrom;
+            ValidUntil = validUntil;
+            Created = created;
+            Modified = modified;
+            Extensions = extensions;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets or sets list of tags
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.threatIntelligenceTags")]
+        public IList<string> ThreatIntelligenceTags { get; set; }
+
+        /// <summary>
+        /// Gets or sets last updated time in UTC
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.lastUpdatedTimeUtc")]
+        public string LastUpdatedTimeUtc { get; set; }
+
+        /// <summary>
+        /// Gets or sets source of a threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.source")]
+        public string Source { get; set; }
+
+        /// <summary>
+        /// Gets or sets display name of a threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.displayName")]
+        public string DisplayName { get; set; }
+
+        /// <summary>
+        /// Gets or sets description of a threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.description")]
+        public string Description { get; set; }
+
+        /// <summary>
+        /// Gets or sets indicator types of threat intelligence entities
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.indicatorTypes")]
+        public IList<string> IndicatorTypes { get; set; }
+
+        /// <summary>
+        /// Gets or sets pattern of a threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.pattern")]
+        public string Pattern { get; set; }
+
+        /// <summary>
+        /// Gets or sets pattern type of a threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.patternType")]
+        public string PatternType { get; set; }
+
+        /// <summary>
+        /// Gets or sets pattern version of a threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.patternVersion")]
+        public string PatternVersion { get; set; }
+
+        /// <summary>
+        /// Gets or sets kill chain phases
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.killChainPhases")]
+        public IList<ThreatIntelligenceKillChainPhase> KillChainPhases { get; set; }
+
+        /// <summary>
+        /// Gets or sets parsed patterns
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.parsedPattern")]
+        public IList<ThreatIntelligenceParsedPattern> ParsedPattern { get; set; }
+
+        /// <summary>
+        /// Gets or sets external ID of threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.externalId")]
+        public string ExternalId { get; set; }
+
+        /// <summary>
+        /// Gets or sets created by reference of threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.createdByRef")]
+        public string CreatedByRef { get; set; }
+
+        /// <summary>
+        /// Gets or sets is threat intelligence entity defanged
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.defanged")]
+        public bool? Defanged { get; set; }
+
+        /// <summary>
+        /// Gets or sets external last updated time in UTC
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.externalLastUpdatedTimeUtc")]
+        public string ExternalLastUpdatedTimeUtc { get; set; }
+
+        /// <summary>
+        /// Gets or sets external References
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.externalReferences")]
+        public IList<ThreatIntelligenceExternalReference> ExternalReferences { get; set; }
+
+        /// <summary>
+        /// Gets or sets granular Markings
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.granularMarkings")]
+        public IList<ThreatIntelligenceGranularMarkingModel> GranularMarkings { get; set; }
+
+        /// <summary>
+        /// Gets or sets labels  of threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.labels")]
+        public IList<string> Labels { get; set; }
+
+        /// <summary>
+        /// Gets or sets is threat intelligence entity revoked
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.revoked")]
+        public bool? Revoked { get; set; }
+
+        /// <summary>
+        /// Gets or sets confidence of threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.confidence")]
+        public int? Confidence { get; set; }
+
+        /// <summary>
+        /// Gets or sets threat intelligence entity object marking references
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.objectMarkingRefs")]
+        public IList<string> ObjectMarkingRefs { get; set; }
+
+        /// <summary>
+        /// Gets or sets language of threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.language")]
+        public string Language { get; set; }
+
+        /// <summary>
+        /// Gets or sets threat types
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.threatTypes")]
+        public IList<string> ThreatTypes { get; set; }
+
+        /// <summary>
+        /// Gets or sets valid from
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.validFrom")]
+        public string ValidFrom { get; set; }
+
+        /// <summary>
+        /// Gets or sets valid until
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.validUntil")]
+        public string ValidUntil { get; set; }
+
+        /// <summary>
+        /// Gets or sets created by
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.created")]
+        public string Created { get; set; }
+
+        /// <summary>
+        /// Gets or sets modified by
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.modified")]
+        public string Modified { get; set; }
+
+        /// <summary>
+        /// Gets or sets extensions map
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.extensions")]
+        public IDictionary<string, object> Extensions { get; set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceIndicatorModelForRequestBody.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceIndicatorModelForRequestBody.cs
new file mode 100644
index 0000000000000..6fd52f049272c
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceIndicatorModelForRequestBody.cs
@@ -0,0 +1,317 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Threat intelligence indicator entity used in request body.
+    /// </summary>
+    [Rest.Serialization.JsonTransformation]
+    public partial class ThreatIntelligenceIndicatorModelForRequestBody : ThreatIntelligenceResourceKind
+    {
+        /// <summary>
+        /// Initializes a new instance of the
+        /// ThreatIntelligenceIndicatorModelForRequestBody class.
+        /// </summary>
+        public ThreatIntelligenceIndicatorModelForRequestBody()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the
+        /// ThreatIntelligenceIndicatorModelForRequestBody class.
+        /// </summary>
+        /// <param name="etag">Etag of the azure resource</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="threatIntelligenceTags">List of tags</param>
+        /// <param name="lastUpdatedTimeUtc">Last updated time in UTC</param>
+        /// <param name="source">Source of a threat intelligence entity</param>
+        /// <param name="displayName">Display name of a threat intelligence
+        /// entity</param>
+        /// <param name="description">Description of a threat intelligence
+        /// entity</param>
+        /// <param name="indicatorTypes">Indicator types of threat intelligence
+        /// entities</param>
+        /// <param name="pattern">Pattern of a threat intelligence
+        /// entity</param>
+        /// <param name="patternType">Pattern type of a threat intelligence
+        /// entity</param>
+        /// <param name="patternVersion">Pattern version of a threat
+        /// intelligence entity</param>
+        /// <param name="killChainPhases">Kill chain phases</param>
+        /// <param name="parsedPattern">Parsed patterns</param>
+        /// <param name="externalId">External ID of threat intelligence
+        /// entity</param>
+        /// <param name="createdByRef">Created by reference of threat
+        /// intelligence entity</param>
+        /// <param name="defanged">Is threat intelligence entity
+        /// defanged</param>
+        /// <param name="externalLastUpdatedTimeUtc">External last updated time
+        /// in UTC</param>
+        /// <param name="externalReferences">External References</param>
+        /// <param name="granularMarkings">Granular Markings</param>
+        /// <param name="labels">Labels  of threat intelligence entity</param>
+        /// <param name="revoked">Is threat intelligence entity revoked</param>
+        /// <param name="confidence">Confidence of threat intelligence
+        /// entity</param>
+        /// <param name="objectMarkingRefs">Threat intelligence entity object
+        /// marking references</param>
+        /// <param name="language">Language of threat intelligence
+        /// entity</param>
+        /// <param name="threatTypes">Threat types</param>
+        /// <param name="validFrom">Valid from</param>
+        /// <param name="validUntil">Valid until</param>
+        /// <param name="created">Created by</param>
+        /// <param name="modified">Modified by</param>
+        /// <param name="extensions">Extensions map</param>
+        public ThreatIntelligenceIndicatorModelForRequestBody(string etag = default(string), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), IList<string> threatIntelligenceTags = default(IList<string>), string lastUpdatedTimeUtc = default(string), string source = default(string), string displayName = default(string), string description = default(string), IList<string> indicatorTypes = default(IList<string>), string pattern = default(string), string patternType = default(string), string patternVersion = default(string), IList<ThreatIntelligenceKillChainPhase> killChainPhases = default(IList<ThreatIntelligenceKillChainPhase>), IList<ThreatIntelligenceParsedPattern> parsedPattern = default(IList<ThreatIntelligenceParsedPattern>), string externalId = default(string), string createdByRef = default(string), bool? defanged = default(bool?), string externalLastUpdatedTimeUtc = default(string), IList<ThreatIntelligenceExternalReference> externalReferences = default(IList<ThreatIntelligenceExternalReference>), IList<ThreatIntelligenceGranularMarkingModel> granularMarkings = default(IList<ThreatIntelligenceGranularMarkingModel>), IList<string> labels = default(IList<string>), bool? revoked = default(bool?), int? confidence = default(int?), IList<string> objectMarkingRefs = default(IList<string>), string language = default(string), IList<string> threatTypes = default(IList<string>), string validFrom = default(string), string validUntil = default(string), string created = default(string), string modified = default(string), IDictionary<string, object> extensions = default(IDictionary<string, object>))
+        {
+            Etag = etag;
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            ThreatIntelligenceTags = threatIntelligenceTags;
+            LastUpdatedTimeUtc = lastUpdatedTimeUtc;
+            Source = source;
+            DisplayName = displayName;
+            Description = description;
+            IndicatorTypes = indicatorTypes;
+            Pattern = pattern;
+            PatternType = patternType;
+            PatternVersion = patternVersion;
+            KillChainPhases = killChainPhases;
+            ParsedPattern = parsedPattern;
+            ExternalId = externalId;
+            CreatedByRef = createdByRef;
+            Defanged = defanged;
+            ExternalLastUpdatedTimeUtc = externalLastUpdatedTimeUtc;
+            ExternalReferences = externalReferences;
+            GranularMarkings = granularMarkings;
+            Labels = labels;
+            Revoked = revoked;
+            Confidence = confidence;
+            ObjectMarkingRefs = objectMarkingRefs;
+            Language = language;
+            ThreatTypes = threatTypes;
+            ValidFrom = validFrom;
+            ValidUntil = validUntil;
+            Created = created;
+            Modified = modified;
+            Extensions = extensions;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets or sets etag of the azure resource
+        /// </summary>
+        [JsonProperty(PropertyName = "etag")]
+        public string Etag { get; set; }
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets or sets list of tags
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.threatIntelligenceTags")]
+        public IList<string> ThreatIntelligenceTags { get; set; }
+
+        /// <summary>
+        /// Gets or sets last updated time in UTC
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.lastUpdatedTimeUtc")]
+        public string LastUpdatedTimeUtc { get; set; }
+
+        /// <summary>
+        /// Gets or sets source of a threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.source")]
+        public string Source { get; set; }
+
+        /// <summary>
+        /// Gets or sets display name of a threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.displayName")]
+        public string DisplayName { get; set; }
+
+        /// <summary>
+        /// Gets or sets description of a threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.description")]
+        public string Description { get; set; }
+
+        /// <summary>
+        /// Gets or sets indicator types of threat intelligence entities
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.indicatorTypes")]
+        public IList<string> IndicatorTypes { get; set; }
+
+        /// <summary>
+        /// Gets or sets pattern of a threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.pattern")]
+        public string Pattern { get; set; }
+
+        /// <summary>
+        /// Gets or sets pattern type of a threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.patternType")]
+        public string PatternType { get; set; }
+
+        /// <summary>
+        /// Gets or sets pattern version of a threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.patternVersion")]
+        public string PatternVersion { get; set; }
+
+        /// <summary>
+        /// Gets or sets kill chain phases
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.killChainPhases")]
+        public IList<ThreatIntelligenceKillChainPhase> KillChainPhases { get; set; }
+
+        /// <summary>
+        /// Gets or sets parsed patterns
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.parsedPattern")]
+        public IList<ThreatIntelligenceParsedPattern> ParsedPattern { get; set; }
+
+        /// <summary>
+        /// Gets or sets external ID of threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.externalId")]
+        public string ExternalId { get; set; }
+
+        /// <summary>
+        /// Gets or sets created by reference of threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.createdByRef")]
+        public string CreatedByRef { get; set; }
+
+        /// <summary>
+        /// Gets or sets is threat intelligence entity defanged
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.defanged")]
+        public bool? Defanged { get; set; }
+
+        /// <summary>
+        /// Gets or sets external last updated time in UTC
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.externalLastUpdatedTimeUtc")]
+        public string ExternalLastUpdatedTimeUtc { get; set; }
+
+        /// <summary>
+        /// Gets or sets external References
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.externalReferences")]
+        public IList<ThreatIntelligenceExternalReference> ExternalReferences { get; set; }
+
+        /// <summary>
+        /// Gets or sets granular Markings
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.granularMarkings")]
+        public IList<ThreatIntelligenceGranularMarkingModel> GranularMarkings { get; set; }
+
+        /// <summary>
+        /// Gets or sets labels  of threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.labels")]
+        public IList<string> Labels { get; set; }
+
+        /// <summary>
+        /// Gets or sets is threat intelligence entity revoked
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.revoked")]
+        public bool? Revoked { get; set; }
+
+        /// <summary>
+        /// Gets or sets confidence of threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.confidence")]
+        public int? Confidence { get; set; }
+
+        /// <summary>
+        /// Gets or sets threat intelligence entity object marking references
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.objectMarkingRefs")]
+        public IList<string> ObjectMarkingRefs { get; set; }
+
+        /// <summary>
+        /// Gets or sets language of threat intelligence entity
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.language")]
+        public string Language { get; set; }
+
+        /// <summary>
+        /// Gets or sets threat types
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.threatTypes")]
+        public IList<string> ThreatTypes { get; set; }
+
+        /// <summary>
+        /// Gets or sets valid from
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.validFrom")]
+        public string ValidFrom { get; set; }
+
+        /// <summary>
+        /// Gets or sets valid until
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.validUntil")]
+        public string ValidUntil { get; set; }
+
+        /// <summary>
+        /// Gets or sets created by
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.created")]
+        public string Created { get; set; }
+
+        /// <summary>
+        /// Gets or sets modified by
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.modified")]
+        public string Modified { get; set; }
+
+        /// <summary>
+        /// Gets or sets extensions map
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.extensions")]
+        public IDictionary<string, object> Extensions { get; set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AlertsDataTypeOfDataConnector.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceInformation.cs
similarity index 58%
rename from sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AlertsDataTypeOfDataConnector.cs
rename to sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceInformation.cs
index 3a96fcd1dfe5d..078ef8bffc0d0 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AlertsDataTypeOfDataConnector.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceInformation.cs
@@ -14,27 +14,27 @@ namespace Microsoft.Azure.Management.SecurityInsights.Models
     using System.Linq;
 
     /// <summary>
-    /// Alerts data type for data connectors.
+    /// Threat intelligence information object.
     /// </summary>
-    public partial class AlertsDataTypeOfDataConnector
+    public partial class ThreatIntelligenceInformation
     {
         /// <summary>
-        /// Initializes a new instance of the AlertsDataTypeOfDataConnector
+        /// Initializes a new instance of the ThreatIntelligenceInformation
         /// class.
         /// </summary>
-        public AlertsDataTypeOfDataConnector()
+        public ThreatIntelligenceInformation()
         {
             CustomInit();
         }
 
         /// <summary>
-        /// Initializes a new instance of the AlertsDataTypeOfDataConnector
+        /// Initializes a new instance of the ThreatIntelligenceInformation
         /// class.
         /// </summary>
-        /// <param name="alerts">Alerts data type connection.</param>
-        public AlertsDataTypeOfDataConnector(DataConnectorDataTypeCommon alerts = default(DataConnectorDataTypeCommon))
+        /// <param name="etag">Etag of the azure resource</param>
+        public ThreatIntelligenceInformation(string etag = default(string))
         {
-            Alerts = alerts;
+            Etag = etag;
             CustomInit();
         }
 
@@ -44,10 +44,10 @@ public AlertsDataTypeOfDataConnector()
         partial void CustomInit();
 
         /// <summary>
-        /// Gets or sets alerts data type connection.
+        /// Gets or sets etag of the azure resource
         /// </summary>
-        [JsonProperty(PropertyName = "alerts")]
-        public DataConnectorDataTypeCommon Alerts { get; set; }
+        [JsonProperty(PropertyName = "etag")]
+        public string Etag { get; set; }
 
     }
 }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceKillChainPhase.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceKillChainPhase.cs
new file mode 100644
index 0000000000000..d2d5131576deb
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceKillChainPhase.cs
@@ -0,0 +1,61 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using System.Linq;
+
+    /// <summary>
+    /// Describes threat kill chain phase entity
+    /// </summary>
+    public partial class ThreatIntelligenceKillChainPhase
+    {
+        /// <summary>
+        /// Initializes a new instance of the ThreatIntelligenceKillChainPhase
+        /// class.
+        /// </summary>
+        public ThreatIntelligenceKillChainPhase()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the ThreatIntelligenceKillChainPhase
+        /// class.
+        /// </summary>
+        /// <param name="killChainName">Kill chainName name</param>
+        /// <param name="phaseName">Phase name</param>
+        public ThreatIntelligenceKillChainPhase(string killChainName = default(string), string phaseName = default(string))
+        {
+            KillChainName = killChainName;
+            PhaseName = phaseName;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets or sets kill chainName name
+        /// </summary>
+        [JsonProperty(PropertyName = "killChainName")]
+        public string KillChainName { get; set; }
+
+        /// <summary>
+        /// Gets or sets phase name
+        /// </summary>
+        [JsonProperty(PropertyName = "phaseName")]
+        public string PhaseName { get; set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceMetric.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceMetric.cs
new file mode 100644
index 0000000000000..761fe5260d4a7
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceMetric.cs
@@ -0,0 +1,78 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Describes threat intelligence metric
+    /// </summary>
+    public partial class ThreatIntelligenceMetric
+    {
+        /// <summary>
+        /// Initializes a new instance of the ThreatIntelligenceMetric class.
+        /// </summary>
+        public ThreatIntelligenceMetric()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the ThreatIntelligenceMetric class.
+        /// </summary>
+        /// <param name="lastUpdatedTimeUtc">Last updated indicator
+        /// metric</param>
+        /// <param name="threatTypeMetrics">Threat type metrics</param>
+        /// <param name="patternTypeMetrics">Pattern type metrics</param>
+        /// <param name="sourceMetrics">Source metrics</param>
+        public ThreatIntelligenceMetric(string lastUpdatedTimeUtc = default(string), IList<ThreatIntelligenceMetricEntity> threatTypeMetrics = default(IList<ThreatIntelligenceMetricEntity>), IList<ThreatIntelligenceMetricEntity> patternTypeMetrics = default(IList<ThreatIntelligenceMetricEntity>), IList<ThreatIntelligenceMetricEntity> sourceMetrics = default(IList<ThreatIntelligenceMetricEntity>))
+        {
+            LastUpdatedTimeUtc = lastUpdatedTimeUtc;
+            ThreatTypeMetrics = threatTypeMetrics;
+            PatternTypeMetrics = patternTypeMetrics;
+            SourceMetrics = sourceMetrics;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets or sets last updated indicator metric
+        /// </summary>
+        [JsonProperty(PropertyName = "lastUpdatedTimeUtc")]
+        public string LastUpdatedTimeUtc { get; set; }
+
+        /// <summary>
+        /// Gets or sets threat type metrics
+        /// </summary>
+        [JsonProperty(PropertyName = "threatTypeMetrics")]
+        public IList<ThreatIntelligenceMetricEntity> ThreatTypeMetrics { get; set; }
+
+        /// <summary>
+        /// Gets or sets pattern type metrics
+        /// </summary>
+        [JsonProperty(PropertyName = "patternTypeMetrics")]
+        public IList<ThreatIntelligenceMetricEntity> PatternTypeMetrics { get; set; }
+
+        /// <summary>
+        /// Gets or sets source metrics
+        /// </summary>
+        [JsonProperty(PropertyName = "sourceMetrics")]
+        public IList<ThreatIntelligenceMetricEntity> SourceMetrics { get; set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DataConnectorWithAlertsProperties.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceMetricEntity.cs
similarity index 50%
rename from sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DataConnectorWithAlertsProperties.cs
rename to sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceMetricEntity.cs
index b11f7fa33d1b1..d5a5fe883fca1 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DataConnectorWithAlertsProperties.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceMetricEntity.cs
@@ -14,28 +14,29 @@ namespace Microsoft.Azure.Management.SecurityInsights.Models
     using System.Linq;
 
     /// <summary>
-    /// Data connector properties.
+    /// Describes threat intelligence metric entity
     /// </summary>
-    public partial class DataConnectorWithAlertsProperties
+    public partial class ThreatIntelligenceMetricEntity
     {
         /// <summary>
-        /// Initializes a new instance of the DataConnectorWithAlertsProperties
+        /// Initializes a new instance of the ThreatIntelligenceMetricEntity
         /// class.
         /// </summary>
-        public DataConnectorWithAlertsProperties()
+        public ThreatIntelligenceMetricEntity()
         {
             CustomInit();
         }
 
         /// <summary>
-        /// Initializes a new instance of the DataConnectorWithAlertsProperties
+        /// Initializes a new instance of the ThreatIntelligenceMetricEntity
         /// class.
         /// </summary>
-        /// <param name="dataTypes">The available data types for the
-        /// connector.</param>
-        public DataConnectorWithAlertsProperties(AlertsDataTypeOfDataConnector dataTypes = default(AlertsDataTypeOfDataConnector))
+        /// <param name="metricName">Metric name</param>
+        /// <param name="metricValue">Metric value</param>
+        public ThreatIntelligenceMetricEntity(string metricName = default(string), int? metricValue = default(int?))
         {
-            DataTypes = dataTypes;
+            MetricName = metricName;
+            MetricValue = metricValue;
             CustomInit();
         }
 
@@ -45,10 +46,16 @@ public DataConnectorWithAlertsProperties()
         partial void CustomInit();
 
         /// <summary>
-        /// Gets or sets the available data types for the connector.
+        /// Gets or sets metric name
         /// </summary>
-        [JsonProperty(PropertyName = "dataTypes")]
-        public AlertsDataTypeOfDataConnector DataTypes { get; set; }
+        [JsonProperty(PropertyName = "metricName")]
+        public string MetricName { get; set; }
+
+        /// <summary>
+        /// Gets or sets metric value
+        /// </summary>
+        [JsonProperty(PropertyName = "metricValue")]
+        public int? MetricValue { get; set; }
 
     }
 }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DataConnectorTenantId.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceMetrics.cs
similarity index 57%
rename from sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DataConnectorTenantId.cs
rename to sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceMetrics.cs
index 58c3b3457f4c1..dc805c507c02c 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DataConnectorTenantId.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceMetrics.cs
@@ -14,26 +14,25 @@ namespace Microsoft.Azure.Management.SecurityInsights.Models
     using System.Linq;
 
     /// <summary>
-    /// Properties data connector on tenant level.
+    /// Threat intelligence metrics.
     /// </summary>
-    public partial class DataConnectorTenantId
+    public partial class ThreatIntelligenceMetrics
     {
         /// <summary>
-        /// Initializes a new instance of the DataConnectorTenantId class.
+        /// Initializes a new instance of the ThreatIntelligenceMetrics class.
         /// </summary>
-        public DataConnectorTenantId()
+        public ThreatIntelligenceMetrics()
         {
             CustomInit();
         }
 
         /// <summary>
-        /// Initializes a new instance of the DataConnectorTenantId class.
+        /// Initializes a new instance of the ThreatIntelligenceMetrics class.
         /// </summary>
-        /// <param name="tenantId">The tenant id to connect to, and get the
-        /// data from.</param>
-        public DataConnectorTenantId(string tenantId = default(string))
+        /// <param name="properties">Threat intelligence metrics.</param>
+        public ThreatIntelligenceMetrics(ThreatIntelligenceMetric properties = default(ThreatIntelligenceMetric))
         {
-            TenantId = tenantId;
+            Properties = properties;
             CustomInit();
         }
 
@@ -43,10 +42,10 @@ public DataConnectorTenantId()
         partial void CustomInit();
 
         /// <summary>
-        /// Gets or sets the tenant id to connect to, and get the data from.
+        /// Gets or sets threat intelligence metrics.
         /// </summary>
-        [JsonProperty(PropertyName = "tenantId")]
-        public string TenantId { get; set; }
+        [JsonProperty(PropertyName = "properties")]
+        public ThreatIntelligenceMetric Properties { get; set; }
 
     }
 }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceMetricsList.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceMetricsList.cs
new file mode 100644
index 0000000000000..b192e78e34a71
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceMetricsList.cs
@@ -0,0 +1,72 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// List of all the threat intelligence metric fields (type/threat
+    /// type/source).
+    /// </summary>
+    public partial class ThreatIntelligenceMetricsList
+    {
+        /// <summary>
+        /// Initializes a new instance of the ThreatIntelligenceMetricsList
+        /// class.
+        /// </summary>
+        public ThreatIntelligenceMetricsList()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the ThreatIntelligenceMetricsList
+        /// class.
+        /// </summary>
+        /// <param name="value">Array of threat intelligence metric fields
+        /// (type/threat type/source).</param>
+        public ThreatIntelligenceMetricsList(IList<ThreatIntelligenceMetrics> value)
+        {
+            Value = value;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets or sets array of threat intelligence metric fields
+        /// (type/threat type/source).
+        /// </summary>
+        [JsonProperty(PropertyName = "value")]
+        public IList<ThreatIntelligenceMetrics> Value { get; set; }
+
+        /// <summary>
+        /// Validate the object.
+        /// </summary>
+        /// <exception cref="ValidationException">
+        /// Thrown if validation fails
+        /// </exception>
+        public virtual void Validate()
+        {
+            if (Value == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "Value");
+            }
+        }
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceParsedPattern.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceParsedPattern.cs
new file mode 100644
index 0000000000000..29c4b859325f8
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceParsedPattern.cs
@@ -0,0 +1,63 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Describes parsed pattern entity
+    /// </summary>
+    public partial class ThreatIntelligenceParsedPattern
+    {
+        /// <summary>
+        /// Initializes a new instance of the ThreatIntelligenceParsedPattern
+        /// class.
+        /// </summary>
+        public ThreatIntelligenceParsedPattern()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the ThreatIntelligenceParsedPattern
+        /// class.
+        /// </summary>
+        /// <param name="patternTypeKey">Pattern type key</param>
+        /// <param name="patternTypeValues">Pattern type keys</param>
+        public ThreatIntelligenceParsedPattern(string patternTypeKey = default(string), IList<ThreatIntelligenceParsedPatternTypeValue> patternTypeValues = default(IList<ThreatIntelligenceParsedPatternTypeValue>))
+        {
+            PatternTypeKey = patternTypeKey;
+            PatternTypeValues = patternTypeValues;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets or sets pattern type key
+        /// </summary>
+        [JsonProperty(PropertyName = "patternTypeKey")]
+        public string PatternTypeKey { get; set; }
+
+        /// <summary>
+        /// Gets or sets pattern type keys
+        /// </summary>
+        [JsonProperty(PropertyName = "patternTypeValues")]
+        public IList<ThreatIntelligenceParsedPatternTypeValue> PatternTypeValues { get; set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AwsCloudTrailDataConnectorDataTypes.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceParsedPatternTypeValue.cs
similarity index 52%
rename from sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AwsCloudTrailDataConnectorDataTypes.cs
rename to sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceParsedPatternTypeValue.cs
index 279ef3f6a6fd1..c0e546cef959d 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/AwsCloudTrailDataConnectorDataTypes.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceParsedPatternTypeValue.cs
@@ -14,28 +14,29 @@ namespace Microsoft.Azure.Management.SecurityInsights.Models
     using System.Linq;
 
     /// <summary>
-    /// The available data types for Amazon Web Services CloudTrail data
-    /// connector.
+    /// Describes threat kill chain phase entity
     /// </summary>
-    public partial class AwsCloudTrailDataConnectorDataTypes
+    public partial class ThreatIntelligenceParsedPatternTypeValue
     {
         /// <summary>
         /// Initializes a new instance of the
-        /// AwsCloudTrailDataConnectorDataTypes class.
+        /// ThreatIntelligenceParsedPatternTypeValue class.
         /// </summary>
-        public AwsCloudTrailDataConnectorDataTypes()
+        public ThreatIntelligenceParsedPatternTypeValue()
         {
             CustomInit();
         }
 
         /// <summary>
         /// Initializes a new instance of the
-        /// AwsCloudTrailDataConnectorDataTypes class.
+        /// ThreatIntelligenceParsedPatternTypeValue class.
         /// </summary>
-        /// <param name="logs">Logs data type.</param>
-        public AwsCloudTrailDataConnectorDataTypes(AwsCloudTrailDataConnectorDataTypesLogs logs = default(AwsCloudTrailDataConnectorDataTypesLogs))
+        /// <param name="valueType">Type of the value</param>
+        /// <param name="value">Value of parsed pattern</param>
+        public ThreatIntelligenceParsedPatternTypeValue(string valueType = default(string), string value = default(string))
         {
-            Logs = logs;
+            ValueType = valueType;
+            Value = value;
             CustomInit();
         }
 
@@ -45,10 +46,16 @@ public AwsCloudTrailDataConnectorDataTypes()
         partial void CustomInit();
 
         /// <summary>
-        /// Gets or sets logs data type.
+        /// Gets or sets type of the value
         /// </summary>
-        [JsonProperty(PropertyName = "logs")]
-        public AwsCloudTrailDataConnectorDataTypesLogs Logs { get; set; }
+        [JsonProperty(PropertyName = "valueType")]
+        public string ValueType { get; set; }
+
+        /// <summary>
+        /// Gets or sets value of parsed pattern
+        /// </summary>
+        [JsonProperty(PropertyName = "value")]
+        public string Value { get; set; }
 
     }
 }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/SettingKind.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceResourceInnerKind.cs
similarity index 61%
rename from sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/SettingKind.cs
rename to sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceResourceInnerKind.cs
index 663b0f801f7f0..04dd0a98dd9e3 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/SettingKind.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceResourceInnerKind.cs
@@ -12,11 +12,13 @@ namespace Microsoft.Azure.Management.SecurityInsights.Models
 {
 
     /// <summary>
-    /// Defines values for SettingKind.
+    /// Defines values for ThreatIntelligenceResourceInnerKind.
     /// </summary>
-    public static class SettingKind
+    public static class ThreatIntelligenceResourceInnerKind
     {
-        public const string UebaSettings = "UebaSettings";
-        public const string ToggleSettings = "ToggleSettings";
+        /// <summary>
+        /// Entity represents threat intelligence indicator in the system.
+        /// </summary>
+        public const string Indicator = "indicator";
     }
 }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeDataConnectorDataTypesTeams.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceResourceKind.cs
similarity index 55%
rename from sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeDataConnectorDataTypesTeams.cs
rename to sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceResourceKind.cs
index 583503a8e8e4c..8481324af1b1d 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/OfficeDataConnectorDataTypesTeams.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceResourceKind.cs
@@ -10,33 +10,29 @@
 
 namespace Microsoft.Azure.Management.SecurityInsights.Models
 {
+    using Newtonsoft.Json;
     using System.Linq;
 
     /// <summary>
-    /// Teams data type connection.
+    /// Describes an entity with kind.
     /// </summary>
-    public partial class OfficeDataConnectorDataTypesTeams : DataConnectorDataTypeCommon
+    public partial class ThreatIntelligenceResourceKind
     {
         /// <summary>
-        /// Initializes a new instance of the OfficeDataConnectorDataTypesTeams
+        /// Initializes a new instance of the ThreatIntelligenceResourceKind
         /// class.
         /// </summary>
-        public OfficeDataConnectorDataTypesTeams()
+        public ThreatIntelligenceResourceKind()
         {
             CustomInit();
         }
 
         /// <summary>
-        /// Initializes a new instance of the OfficeDataConnectorDataTypesTeams
-        /// class.
+        /// Static constructor for ThreatIntelligenceResourceKind class.
         /// </summary>
-        /// <param name="state">Describe whether this data type connection is
-        /// enabled or not. Possible values include: 'Enabled',
-        /// 'Disabled'</param>
-        public OfficeDataConnectorDataTypesTeams(string state = default(string))
-            : base(state)
+        static ThreatIntelligenceResourceKind()
         {
-            CustomInit();
+            Kind = "indicator";
         }
 
         /// <summary>
@@ -44,5 +40,11 @@ public OfficeDataConnectorDataTypesTeams()
         /// </summary>
         partial void CustomInit();
 
+        /// <summary>
+        /// The kind of the entity.
+        /// </summary>
+        [JsonProperty(PropertyName = "kind")]
+        public static string Kind { get; private set; }
+
     }
 }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceSortingCriteria.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceSortingCriteria.cs
new file mode 100644
index 0000000000000..cd40277bfd503
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceSortingCriteria.cs
@@ -0,0 +1,64 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Newtonsoft.Json;
+    using System.Linq;
+
+    /// <summary>
+    /// List of available columns for sorting
+    /// </summary>
+    public partial class ThreatIntelligenceSortingCriteria
+    {
+        /// <summary>
+        /// Initializes a new instance of the ThreatIntelligenceSortingCriteria
+        /// class.
+        /// </summary>
+        public ThreatIntelligenceSortingCriteria()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the ThreatIntelligenceSortingCriteria
+        /// class.
+        /// </summary>
+        /// <param name="itemKey">Column name</param>
+        /// <param name="sortOrder">Sorting order
+        /// (ascending/descending/unsorted). Possible values include:
+        /// 'unsorted', 'ascending', 'descending'</param>
+        public ThreatIntelligenceSortingCriteria(string itemKey = default(string), string sortOrder = default(string))
+        {
+            ItemKey = itemKey;
+            SortOrder = sortOrder;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets or sets column name
+        /// </summary>
+        [JsonProperty(PropertyName = "itemKey")]
+        public string ItemKey { get; set; }
+
+        /// <summary>
+        /// Gets or sets sorting order (ascending/descending/unsorted).
+        /// Possible values include: 'unsorted', 'ascending', 'descending'
+        /// </summary>
+        [JsonProperty(PropertyName = "sortOrder")]
+        public string SortOrder { get; set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DataTypeState.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceSortingOrder.cs
similarity index 63%
rename from sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DataTypeState.cs
rename to sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceSortingOrder.cs
index e2cdbff7312b4..f020a15d0ea20 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/DataTypeState.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ThreatIntelligenceSortingOrder.cs
@@ -12,11 +12,12 @@ namespace Microsoft.Azure.Management.SecurityInsights.Models
 {
 
     /// <summary>
-    /// Defines values for DataTypeState.
+    /// Defines values for ThreatIntelligenceSortingOrder.
     /// </summary>
-    public static class DataTypeState
+    public static class ThreatIntelligenceSortingOrder
     {
-        public const string Enabled = "Enabled";
-        public const string Disabled = "Disabled";
+        public const string Unsorted = "unsorted";
+        public const string Ascending = "ascending";
+        public const string Descending = "descending";
     }
 }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ToggleSettings.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ToggleSettings.cs
deleted file mode 100644
index 076630967b68c..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/ToggleSettings.cs
+++ /dev/null
@@ -1,60 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using Microsoft.Rest;
-    using Microsoft.Rest.Serialization;
-    using Newtonsoft.Json;
-    using System.Linq;
-
-    /// <summary>
-    /// Settings with single toggle.
-    /// </summary>
-    [Rest.Serialization.JsonTransformation]
-    public partial class ToggleSettings : Settings
-    {
-        /// <summary>
-        /// Initializes a new instance of the ToggleSettings class.
-        /// </summary>
-        public ToggleSettings()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the ToggleSettings class.
-        /// </summary>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
-        /// <param name="etag">Etag of the azure resource</param>
-        /// <param name="isEnabled">Determines whether the setting is enable or
-        /// disabled.</param>
-        public ToggleSettings(string id = default(string), string name = default(string), string type = default(string), string etag = default(string), bool? isEnabled = default(bool?))
-            : base(id, name, type, etag)
-        {
-            IsEnabled = isEnabled;
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-        /// <summary>
-        /// Gets or sets determines whether the setting is enable or disabled.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.isEnabled")]
-        public bool? IsEnabled { get; set; }
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/TrackedResource.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/TrackedResource.cs
new file mode 100644
index 0000000000000..491fc1d89b550
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/TrackedResource.cs
@@ -0,0 +1,89 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Tracked Resource
+    /// </summary>
+    /// <remarks>
+    /// The resource model definition for an Azure Resource Manager tracked top
+    /// level resource which has 'tags' and a 'location'
+    /// </remarks>
+    public partial class TrackedResource : Resource
+    {
+        /// <summary>
+        /// Initializes a new instance of the TrackedResource class.
+        /// </summary>
+        public TrackedResource()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the TrackedResource class.
+        /// </summary>
+        /// <param name="location">The geo-location where the resource
+        /// lives</param>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="tags">Resource tags.</param>
+        public TrackedResource(string location, string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, string> tags = default(IDictionary<string, string>))
+            : base(id, name, type, systemData)
+        {
+            Tags = tags;
+            Location = location;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets or sets resource tags.
+        /// </summary>
+        [JsonProperty(PropertyName = "tags")]
+        public IDictionary<string, string> Tags { get; set; }
+
+        /// <summary>
+        /// Gets or sets the geo-location where the resource lives
+        /// </summary>
+        [JsonProperty(PropertyName = "location")]
+        public string Location { get; set; }
+
+        /// <summary>
+        /// Validate the object.
+        /// </summary>
+        /// <exception cref="ValidationException">
+        /// Thrown if validation fails
+        /// </exception>
+        public virtual void Validate()
+        {
+            if (Location == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "Location");
+            }
+        }
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/UebaSettings.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/UebaSettings.cs
deleted file mode 100644
index 840992edae715..0000000000000
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/UebaSettings.cs
+++ /dev/null
@@ -1,84 +0,0 @@
-// <auto-generated>
-// Copyright (c) Microsoft Corporation. All rights reserved.
-// Licensed under the MIT License. See License.txt in the project root for
-// license information.
-//
-// Code generated by Microsoft (R) AutoRest Code Generator.
-// Changes may cause incorrect behavior and will be lost if the code is
-// regenerated.
-// </auto-generated>
-
-namespace Microsoft.Azure.Management.SecurityInsights.Models
-{
-    using Microsoft.Rest;
-    using Microsoft.Rest.Serialization;
-    using Newtonsoft.Json;
-    using System.Linq;
-
-    /// <summary>
-    /// Represents settings for User and Entity Behavior Analytics enablement.
-    /// </summary>
-    [Rest.Serialization.JsonTransformation]
-    public partial class UebaSettings : Settings
-    {
-        /// <summary>
-        /// Initializes a new instance of the UebaSettings class.
-        /// </summary>
-        public UebaSettings()
-        {
-            CustomInit();
-        }
-
-        /// <summary>
-        /// Initializes a new instance of the UebaSettings class.
-        /// </summary>
-        /// <param name="id">Azure resource Id</param>
-        /// <param name="name">Azure resource name</param>
-        /// <param name="type">Azure resource type</param>
-        /// <param name="etag">Etag of the azure resource</param>
-        /// <param name="atpLicenseStatus">Determines whether the tenant has
-        /// ATP (Advanced Threat Protection) license. Possible values include:
-        /// 'Enabled', 'Disabled'</param>
-        /// <param name="isEnabled">Determines whether User and Entity Behavior
-        /// Analytics is enabled for this workspace.</param>
-        /// <param name="statusInMcas">Determines whether User and Entity
-        /// Behavior Analytics is enabled from MCAS (Microsoft Cloud App
-        /// Security). Possible values include: 'Enabled', 'Disabled'</param>
-        public UebaSettings(string id = default(string), string name = default(string), string type = default(string), string etag = default(string), string atpLicenseStatus = default(string), bool? isEnabled = default(bool?), string statusInMcas = default(string))
-            : base(id, name, type, etag)
-        {
-            AtpLicenseStatus = atpLicenseStatus;
-            IsEnabled = isEnabled;
-            StatusInMcas = statusInMcas;
-            CustomInit();
-        }
-
-        /// <summary>
-        /// An initialization method that performs custom operations like setting defaults
-        /// </summary>
-        partial void CustomInit();
-
-        /// <summary>
-        /// Gets determines whether the tenant has ATP (Advanced Threat
-        /// Protection) license. Possible values include: 'Enabled', 'Disabled'
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.atpLicenseStatus")]
-        public string AtpLicenseStatus { get; private set; }
-
-        /// <summary>
-        /// Gets or sets determines whether User and Entity Behavior Analytics
-        /// is enabled for this workspace.
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.isEnabled")]
-        public bool? IsEnabled { get; set; }
-
-        /// <summary>
-        /// Gets determines whether User and Entity Behavior Analytics is
-        /// enabled from MCAS (Microsoft Cloud App Security). Possible values
-        /// include: 'Enabled', 'Disabled'
-        /// </summary>
-        [JsonProperty(PropertyName = "properties.statusInMcas")]
-        public string StatusInMcas { get; private set; }
-
-    }
-}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/UrlEntity.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/UrlEntity.cs
new file mode 100644
index 0000000000000..a31d999bd2e1e
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/UrlEntity.cs
@@ -0,0 +1,88 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents a url entity.
+    /// </summary>
+    [Newtonsoft.Json.JsonObject("Url")]
+    [Rest.Serialization.JsonTransformation]
+    public partial class UrlEntity : Entity
+    {
+        /// <summary>
+        /// Initializes a new instance of the UrlEntity class.
+        /// </summary>
+        public UrlEntity()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the UrlEntity class.
+        /// </summary>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="additionalData">A bag of custom fields that should be
+        /// part of the entity and will be presented to the user.</param>
+        /// <param name="friendlyName">The graph item display name which is a
+        /// short humanly readable description of the graph item instance. This
+        /// property is optional and might be system generated.</param>
+        /// <param name="url">A full URL the entity points to</param>
+        public UrlEntity(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), IDictionary<string, object> additionalData = default(IDictionary<string, object>), string friendlyName = default(string), string url = default(string))
+            : base(id, name, type, systemData)
+        {
+            AdditionalData = additionalData;
+            FriendlyName = friendlyName;
+            Url = url;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets a bag of custom fields that should be part of the entity and
+        /// will be presented to the user.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.additionalData")]
+        public IDictionary<string, object> AdditionalData { get; private set; }
+
+        /// <summary>
+        /// Gets the graph item display name which is a short humanly readable
+        /// description of the graph item instance. This property is optional
+        /// and might be system generated.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.friendlyName")]
+        public string FriendlyName { get; private set; }
+
+        /// <summary>
+        /// Gets a full URL the entity points to
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.url")]
+        public string Url { get; private set; }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/UserInfo.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/UserInfo.cs
index 3573080ba7374..22ee58fb1b3d1 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/UserInfo.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/UserInfo.cs
@@ -10,7 +10,6 @@
 
 namespace Microsoft.Azure.Management.SecurityInsights.Models
 {
-    using Microsoft.Rest;
     using Newtonsoft.Json;
     using System.Linq;
 
@@ -30,10 +29,10 @@ public UserInfo()
         /// <summary>
         /// Initializes a new instance of the UserInfo class.
         /// </summary>
-        /// <param name="objectId">The object id of the user.</param>
         /// <param name="email">The email of the user.</param>
         /// <param name="name">The name of the user.</param>
-        public UserInfo(System.Guid? objectId, string email = default(string), string name = default(string))
+        /// <param name="objectId">The object id of the user.</param>
+        public UserInfo(string email = default(string), string name = default(string), System.Guid? objectId = default(System.Guid?))
         {
             Email = email;
             Name = name;
@@ -64,18 +63,5 @@ public UserInfo()
         [JsonProperty(PropertyName = "objectId")]
         public System.Guid? ObjectId { get; set; }
 
-        /// <summary>
-        /// Validate the object.
-        /// </summary>
-        /// <exception cref="ValidationException">
-        /// Thrown if validation fails
-        /// </exception>
-        public virtual void Validate()
-        {
-            if (ObjectId == null)
-            {
-                throw new ValidationException(ValidationRules.CannotBeNull, "ObjectId");
-            }
-        }
     }
 }
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Watchlist.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Watchlist.cs
new file mode 100644
index 0000000000000..2468ac47f826e
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/Watchlist.cs
@@ -0,0 +1,276 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents a Watchlist in Azure Security Insights.
+    /// </summary>
+    [Rest.Serialization.JsonTransformation]
+    public partial class Watchlist : ResourceWithEtag
+    {
+        /// <summary>
+        /// Initializes a new instance of the Watchlist class.
+        /// </summary>
+        public Watchlist()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the Watchlist class.
+        /// </summary>
+        /// <param name="displayName">The display name of the watchlist</param>
+        /// <param name="provider">The provider of the watchlist</param>
+        /// <param name="source">The source of the watchlist. Possible values
+        /// include: 'Local file', 'Remote storage'</param>
+        /// <param name="itemsSearchKey">The search key is used to optimize
+        /// query performance when using watchlists for joins with other data.
+        /// For example, enable a column with IP addresses to be the designated
+        /// SearchKey field, then use this field as the key field when joining
+        /// to other event data by IP address.</param>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="etag">Etag of the azure resource</param>
+        /// <param name="watchlistId">The id (a Guid) of the watchlist</param>
+        /// <param name="created">The time the watchlist was created</param>
+        /// <param name="updated">The last time the watchlist was
+        /// updated</param>
+        /// <param name="createdBy">Describes a user that created the
+        /// watchlist</param>
+        /// <param name="updatedBy">Describes a user that updated the
+        /// watchlist</param>
+        /// <param name="description">A description of the watchlist</param>
+        /// <param name="watchlistType">The type of the watchlist</param>
+        /// <param name="watchlistAlias">The alias of the watchlist</param>
+        /// <param name="isDeleted">A flag that indicates if the watchlist is
+        /// deleted or not</param>
+        /// <param name="labels">List of labels relevant to this
+        /// watchlist</param>
+        /// <param name="defaultDuration">The default duration of a watchlist
+        /// (in ISO 8601 duration format)</param>
+        /// <param name="tenantId">The tenantId where the watchlist belongs
+        /// to</param>
+        /// <param name="numberOfLinesToSkip">The number of lines in a csv
+        /// content to skip before the header</param>
+        /// <param name="rawContent">The raw content that represents to
+        /// watchlist items to create. Example : This line will be skipped
+        /// header1,header2
+        /// value1,value2</param>
+        /// <param name="contentType">The content type of the raw content. For
+        /// now, only text/csv is valid</param>
+        /// <param name="uploadStatus">The status of the Watchlist upload :
+        /// New, InProgress or Complete. **Note** : When a Watchlist upload
+        /// status is InProgress, the Watchlist cannot be deleted</param>
+        public Watchlist(string displayName, string provider, string source, string itemsSearchKey, string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), string etag = default(string), string watchlistId = default(string), System.DateTime? created = default(System.DateTime?), System.DateTime? updated = default(System.DateTime?), UserInfo createdBy = default(UserInfo), UserInfo updatedBy = default(UserInfo), string description = default(string), string watchlistType = default(string), string watchlistAlias = default(string), bool? isDeleted = default(bool?), IList<string> labels = default(IList<string>), System.TimeSpan? defaultDuration = default(System.TimeSpan?), string tenantId = default(string), int? numberOfLinesToSkip = default(int?), string rawContent = default(string), string contentType = default(string), string uploadStatus = default(string))
+            : base(id, name, type, systemData, etag)
+        {
+            WatchlistId = watchlistId;
+            DisplayName = displayName;
+            Provider = provider;
+            Source = source;
+            Created = created;
+            Updated = updated;
+            CreatedBy = createdBy;
+            UpdatedBy = updatedBy;
+            Description = description;
+            WatchlistType = watchlistType;
+            WatchlistAlias = watchlistAlias;
+            IsDeleted = isDeleted;
+            Labels = labels;
+            DefaultDuration = defaultDuration;
+            TenantId = tenantId;
+            NumberOfLinesToSkip = numberOfLinesToSkip;
+            RawContent = rawContent;
+            ItemsSearchKey = itemsSearchKey;
+            ContentType = contentType;
+            UploadStatus = uploadStatus;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets or sets the id (a Guid) of the watchlist
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.watchlistId")]
+        public string WatchlistId { get; set; }
+
+        /// <summary>
+        /// Gets or sets the display name of the watchlist
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.displayName")]
+        public string DisplayName { get; set; }
+
+        /// <summary>
+        /// Gets or sets the provider of the watchlist
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.provider")]
+        public string Provider { get; set; }
+
+        /// <summary>
+        /// Gets or sets the source of the watchlist. Possible values include:
+        /// 'Local file', 'Remote storage'
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.source")]
+        public string Source { get; set; }
+
+        /// <summary>
+        /// Gets or sets the time the watchlist was created
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.created")]
+        public System.DateTime? Created { get; set; }
+
+        /// <summary>
+        /// Gets or sets the last time the watchlist was updated
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.updated")]
+        public System.DateTime? Updated { get; set; }
+
+        /// <summary>
+        /// Gets or sets describes a user that created the watchlist
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.createdBy")]
+        public UserInfo CreatedBy { get; set; }
+
+        /// <summary>
+        /// Gets or sets describes a user that updated the watchlist
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.updatedBy")]
+        public UserInfo UpdatedBy { get; set; }
+
+        /// <summary>
+        /// Gets or sets a description of the watchlist
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.description")]
+        public string Description { get; set; }
+
+        /// <summary>
+        /// Gets or sets the type of the watchlist
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.watchlistType")]
+        public string WatchlistType { get; set; }
+
+        /// <summary>
+        /// Gets or sets the alias of the watchlist
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.watchlistAlias")]
+        public string WatchlistAlias { get; set; }
+
+        /// <summary>
+        /// Gets or sets a flag that indicates if the watchlist is deleted or
+        /// not
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.isDeleted")]
+        public bool? IsDeleted { get; set; }
+
+        /// <summary>
+        /// Gets or sets list of labels relevant to this watchlist
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.labels")]
+        public IList<string> Labels { get; set; }
+
+        /// <summary>
+        /// Gets or sets the default duration of a watchlist (in ISO 8601
+        /// duration format)
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.defaultDuration")]
+        public System.TimeSpan? DefaultDuration { get; set; }
+
+        /// <summary>
+        /// Gets or sets the tenantId where the watchlist belongs to
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.tenantId")]
+        public string TenantId { get; set; }
+
+        /// <summary>
+        /// Gets or sets the number of lines in a csv content to skip before
+        /// the header
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.numberOfLinesToSkip")]
+        public int? NumberOfLinesToSkip { get; set; }
+
+        /// <summary>
+        /// Gets or sets the raw content that represents to watchlist items to
+        /// create. Example : This line will be skipped
+        /// header1,header2
+        /// value1,value2
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.rawContent")]
+        public string RawContent { get; set; }
+
+        /// <summary>
+        /// Gets or sets the search key is used to optimize query performance
+        /// when using watchlists for joins with other data. For example,
+        /// enable a column with IP addresses to be the designated SearchKey
+        /// field, then use this field as the key field when joining to other
+        /// event data by IP address.
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.itemsSearchKey")]
+        public string ItemsSearchKey { get; set; }
+
+        /// <summary>
+        /// Gets or sets the content type of the raw content. For now, only
+        /// text/csv is valid
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.contentType")]
+        public string ContentType { get; set; }
+
+        /// <summary>
+        /// Gets or sets the status of the Watchlist upload : New, InProgress
+        /// or Complete. **Note** : When a Watchlist upload status is
+        /// InProgress, the Watchlist cannot be deleted
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.uploadStatus")]
+        public string UploadStatus { get; set; }
+
+        /// <summary>
+        /// Validate the object.
+        /// </summary>
+        /// <exception cref="ValidationException">
+        /// Thrown if validation fails
+        /// </exception>
+        public virtual void Validate()
+        {
+            if (DisplayName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "DisplayName");
+            }
+            if (Provider == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "Provider");
+            }
+            if (Source == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "Source");
+            }
+            if (ItemsSearchKey == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "ItemsSearchKey");
+            }
+        }
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/WatchlistItem.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/WatchlistItem.cs
new file mode 100644
index 0000000000000..91b67bf38c095
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Models/WatchlistItem.cs
@@ -0,0 +1,160 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights.Models
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Serialization;
+    using Newtonsoft.Json;
+    using System.Linq;
+
+    /// <summary>
+    /// Represents a Watchlist Item in Azure Security Insights.
+    /// </summary>
+    [Rest.Serialization.JsonTransformation]
+    public partial class WatchlistItem : ResourceWithEtag
+    {
+        /// <summary>
+        /// Initializes a new instance of the WatchlistItem class.
+        /// </summary>
+        public WatchlistItem()
+        {
+            CustomInit();
+        }
+
+        /// <summary>
+        /// Initializes a new instance of the WatchlistItem class.
+        /// </summary>
+        /// <param name="itemsKeyValue">key-value pairs for a watchlist
+        /// item</param>
+        /// <param name="id">Fully qualified resource ID for the resource. Ex -
+        /// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}</param>
+        /// <param name="name">The name of the resource</param>
+        /// <param name="type">The type of the resource. E.g.
+        /// "Microsoft.Compute/virtualMachines" or
+        /// "Microsoft.Storage/storageAccounts"</param>
+        /// <param name="systemData">Azure Resource Manager metadata containing
+        /// createdBy and modifiedBy information.</param>
+        /// <param name="etag">Etag of the azure resource</param>
+        /// <param name="watchlistItemType">The type of the watchlist
+        /// item</param>
+        /// <param name="watchlistItemId">The id (a Guid) of the watchlist
+        /// item</param>
+        /// <param name="tenantId">The tenantId to which the watchlist item
+        /// belongs to</param>
+        /// <param name="isDeleted">A flag that indicates if the watchlist item
+        /// is deleted or not</param>
+        /// <param name="created">The time the watchlist item was
+        /// created</param>
+        /// <param name="updated">The last time the watchlist item was
+        /// updated</param>
+        /// <param name="createdBy">Describes a user that created the watchlist
+        /// item</param>
+        /// <param name="updatedBy">Describes a user that updated the watchlist
+        /// item</param>
+        /// <param name="entityMapping">key-value pairs for a watchlist item
+        /// entity mapping</param>
+        public WatchlistItem(object itemsKeyValue, string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), string etag = default(string), string watchlistItemType = default(string), string watchlistItemId = default(string), string tenantId = default(string), bool? isDeleted = default(bool?), System.DateTime? created = default(System.DateTime?), System.DateTime? updated = default(System.DateTime?), UserInfo createdBy = default(UserInfo), UserInfo updatedBy = default(UserInfo), object entityMapping = default(object))
+            : base(id, name, type, systemData, etag)
+        {
+            WatchlistItemType = watchlistItemType;
+            WatchlistItemId = watchlistItemId;
+            TenantId = tenantId;
+            IsDeleted = isDeleted;
+            Created = created;
+            Updated = updated;
+            CreatedBy = createdBy;
+            UpdatedBy = updatedBy;
+            ItemsKeyValue = itemsKeyValue;
+            EntityMapping = entityMapping;
+            CustomInit();
+        }
+
+        /// <summary>
+        /// An initialization method that performs custom operations like setting defaults
+        /// </summary>
+        partial void CustomInit();
+
+        /// <summary>
+        /// Gets or sets the type of the watchlist item
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.watchlistItemType")]
+        public string WatchlistItemType { get; set; }
+
+        /// <summary>
+        /// Gets or sets the id (a Guid) of the watchlist item
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.watchlistItemId")]
+        public string WatchlistItemId { get; set; }
+
+        /// <summary>
+        /// Gets or sets the tenantId to which the watchlist item belongs to
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.tenantId")]
+        public string TenantId { get; set; }
+
+        /// <summary>
+        /// Gets or sets a flag that indicates if the watchlist item is deleted
+        /// or not
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.isDeleted")]
+        public bool? IsDeleted { get; set; }
+
+        /// <summary>
+        /// Gets or sets the time the watchlist item was created
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.created")]
+        public System.DateTime? Created { get; set; }
+
+        /// <summary>
+        /// Gets or sets the last time the watchlist item was updated
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.updated")]
+        public System.DateTime? Updated { get; set; }
+
+        /// <summary>
+        /// Gets or sets describes a user that created the watchlist item
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.createdBy")]
+        public UserInfo CreatedBy { get; set; }
+
+        /// <summary>
+        /// Gets or sets describes a user that updated the watchlist item
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.updatedBy")]
+        public UserInfo UpdatedBy { get; set; }
+
+        /// <summary>
+        /// Gets or sets key-value pairs for a watchlist item
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.itemsKeyValue")]
+        public object ItemsKeyValue { get; set; }
+
+        /// <summary>
+        /// Gets or sets key-value pairs for a watchlist item entity mapping
+        /// </summary>
+        [JsonProperty(PropertyName = "properties.entityMapping")]
+        public object EntityMapping { get; set; }
+
+        /// <summary>
+        /// Validate the object.
+        /// </summary>
+        /// <exception cref="ValidationException">
+        /// Thrown if validation fails
+        /// </exception>
+        public virtual void Validate()
+        {
+            if (ItemsKeyValue == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "ItemsKeyValue");
+            }
+        }
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Operations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Operations.cs
index 38e2e487d6dea..995c7fe742ea8 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Operations.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/Operations.cs
@@ -59,17 +59,34 @@ internal Operations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
         /// Thrown when unable to deserialize the response
         /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
         /// <return>
         /// A response object containing the response body and response headers.
         /// </return>
         public async Task<AzureOperationResponse<IPage<Operation>>> ListWithHttpMessagesAsync(Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             // Tracing
             bool _shouldTrace = ServiceClientTracing.IsEnabled;
             string _invocationId = null;
@@ -148,14 +165,13 @@ internal Operations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -165,10 +181,6 @@ internal Operations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -225,7 +237,7 @@ internal Operations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -321,14 +333,13 @@ internal Operations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -338,10 +349,6 @@ internal Operations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/SdkInfo_SecurityInsights.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/SdkInfo_SecurityInsights.cs
index 6a833696e11f7..96544676a40c1 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/SdkInfo_SecurityInsights.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/SdkInfo_SecurityInsights.cs
@@ -19,27 +19,20 @@ public static IEnumerable<Tuple<string, string, string>> ApiInfo_SecurityInsight
           {
               return new Tuple<string, string, string>[]
               {
-                new Tuple<string, string, string>("OperationalInsights", "Actions", "2020-01-01"),
-                new Tuple<string, string, string>("OperationalInsights", "AlertRuleTemplates", "2020-01-01"),
-                new Tuple<string, string, string>("OperationalInsights", "AlertRules", "2020-01-01"),
-                new Tuple<string, string, string>("OperationalInsights", "Bookmarks", "2020-01-01"),
-                new Tuple<string, string, string>("OperationalInsights", "DataConnectors", "2020-01-01"),
-                new Tuple<string, string, string>("OperationalInsights", "IncidentComments", "2020-01-01"),
-                new Tuple<string, string, string>("OperationalInsights", "Incidents", "2020-01-01"),
-                new Tuple<string, string, string>("SecurityInsights", "Operations", "2020-01-01"),
+                new Tuple<string, string, string>("OperationalInsights", "Actions", "2021-10-01"),
+                new Tuple<string, string, string>("OperationalInsights", "AlertRuleTemplates", "2021-10-01"),
+                new Tuple<string, string, string>("OperationalInsights", "AlertRules", "2021-10-01"),
+                new Tuple<string, string, string>("OperationalInsights", "IncidentComments", "2021-10-01"),
+                new Tuple<string, string, string>("OperationalInsights", "IncidentRelations", "2021-10-01"),
+                new Tuple<string, string, string>("OperationalInsights", "Incidents", "2021-10-01"),
+                new Tuple<string, string, string>("SecurityInsights", "Operations", "2021-10-01"),
+                new Tuple<string, string, string>("SecurityInsights", "ThreatIntelligenceIndicator", "2021-10-01"),
+                new Tuple<string, string, string>("SecurityInsights", "ThreatIntelligenceIndicatorMetrics", "2021-10-01"),
+                new Tuple<string, string, string>("SecurityInsights", "ThreatIntelligenceIndicators", "2021-10-01"),
+                new Tuple<string, string, string>("SecurityInsights", "WatchlistItems", "2021-10-01"),
+                new Tuple<string, string, string>("SecurityInsights", "Watchlists", "2021-10-01"),
               }.AsEnumerable();
           }
       }
-      // BEGIN: Code Generation Metadata Section
-      public static readonly String AutoRestVersion = "v2";
-      public static readonly String AutoRestBootStrapperVersion = "autorest@2.0.4413";
-      public static readonly String AutoRestCmdExecuted = "cmd.exe /c autorest.cmd https://github.com/Azure/azure-rest-api-specs/blob/master/specification/securityinsights/resource-manager/readme.md --csharp --version=v2 --reflect-api-versions --csharp-sdks-folder=E:\\azure-sdk-for-net\\sdk";
-      public static readonly String GithubForkName = "Azure";
-      public static readonly String GithubBranchName = "master";
-      public static readonly String GithubCommidId = "fb680afc380cccb44a59ed277232ad4224ac809b";
-      public static readonly String CodeGenerationErrors = "";
-      public static readonly String GithubRepoName = "azure-rest-api-specs";
-      // END: Code Generation Metadata Section
   }
 }
-
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/SecurityInsightsClient.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/SecurityInsightsClient.cs
index 1b02da754ef26..eca701e57fd91 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/SecurityInsightsClient.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/SecurityInsightsClient.cs
@@ -48,14 +48,14 @@ public partial class SecurityInsightsClient : ServiceClient<SecurityInsightsClie
         public ServiceClientCredentials Credentials { get; private set; }
 
         /// <summary>
-        /// API version for the operation
+        /// The ID of the target subscription.
         /// </summary>
-        public string ApiVersion { get; private set; }
+        public string SubscriptionId { get; set; }
 
         /// <summary>
-        /// Azure subscription ID
+        /// The API version to use for this operation.
         /// </summary>
-        public string SubscriptionId { get; set; }
+        public string ApiVersion { get; private set; }
 
         /// <summary>
         /// The preferred language for the response.
@@ -76,44 +76,64 @@ public partial class SecurityInsightsClient : ServiceClient<SecurityInsightsClie
         public bool? GenerateClientRequestId { get; set; }
 
         /// <summary>
-        /// Gets the IOperations.
+        /// Gets the IIncidentsOperations.
         /// </summary>
-        public virtual IOperations Operations { get; private set; }
+        public virtual IIncidentsOperations Incidents { get; private set; }
 
         /// <summary>
-        /// Gets the IAlertRulesOperations.
+        /// Gets the IIncidentCommentsOperations.
         /// </summary>
-        public virtual IAlertRulesOperations AlertRules { get; private set; }
+        public virtual IIncidentCommentsOperations IncidentComments { get; private set; }
 
         /// <summary>
-        /// Gets the IActionsOperations.
+        /// Gets the IIncidentRelationsOperations.
         /// </summary>
-        public virtual IActionsOperations Actions { get; private set; }
+        public virtual IIncidentRelationsOperations IncidentRelations { get; private set; }
 
         /// <summary>
-        /// Gets the IAlertRuleTemplatesOperations.
+        /// Gets the IThreatIntelligenceIndicatorOperations.
         /// </summary>
-        public virtual IAlertRuleTemplatesOperations AlertRuleTemplates { get; private set; }
+        public virtual IThreatIntelligenceIndicatorOperations ThreatIntelligenceIndicator { get; private set; }
 
         /// <summary>
-        /// Gets the IBookmarksOperations.
+        /// Gets the IThreatIntelligenceIndicatorsOperations.
         /// </summary>
-        public virtual IBookmarksOperations Bookmarks { get; private set; }
+        public virtual IThreatIntelligenceIndicatorsOperations ThreatIntelligenceIndicators { get; private set; }
 
         /// <summary>
-        /// Gets the IDataConnectorsOperations.
+        /// Gets the IThreatIntelligenceIndicatorMetricsOperations.
         /// </summary>
-        public virtual IDataConnectorsOperations DataConnectors { get; private set; }
+        public virtual IThreatIntelligenceIndicatorMetricsOperations ThreatIntelligenceIndicatorMetrics { get; private set; }
 
         /// <summary>
-        /// Gets the IIncidentsOperations.
+        /// Gets the IWatchlistsOperations.
         /// </summary>
-        public virtual IIncidentsOperations Incidents { get; private set; }
+        public virtual IWatchlistsOperations Watchlists { get; private set; }
 
         /// <summary>
-        /// Gets the IIncidentCommentsOperations.
+        /// Gets the IWatchlistItemsOperations.
         /// </summary>
-        public virtual IIncidentCommentsOperations IncidentComments { get; private set; }
+        public virtual IWatchlistItemsOperations WatchlistItems { get; private set; }
+
+        /// <summary>
+        /// Gets the IOperations.
+        /// </summary>
+        public virtual IOperations Operations { get; private set; }
+
+        /// <summary>
+        /// Gets the IAlertRulesOperations.
+        /// </summary>
+        public virtual IAlertRulesOperations AlertRules { get; private set; }
+
+        /// <summary>
+        /// Gets the IActionsOperations.
+        /// </summary>
+        public virtual IActionsOperations Actions { get; private set; }
+
+        /// <summary>
+        /// Gets the IAlertRuleTemplatesOperations.
+        /// </summary>
+        public virtual IAlertRuleTemplatesOperations AlertRuleTemplates { get; private set; }
 
         /// <summary>
         /// Initializes a new instance of the SecurityInsightsClient class.
@@ -356,16 +376,20 @@ public SecurityInsightsClient(System.Uri baseUri, ServiceClientCredentials crede
         /// </summary>
         private void Initialize()
         {
+            Incidents = new IncidentsOperations(this);
+            IncidentComments = new IncidentCommentsOperations(this);
+            IncidentRelations = new IncidentRelationsOperations(this);
+            ThreatIntelligenceIndicator = new ThreatIntelligenceIndicatorOperations(this);
+            ThreatIntelligenceIndicators = new ThreatIntelligenceIndicatorsOperations(this);
+            ThreatIntelligenceIndicatorMetrics = new ThreatIntelligenceIndicatorMetricsOperations(this);
+            Watchlists = new WatchlistsOperations(this);
+            WatchlistItems = new WatchlistItemsOperations(this);
             Operations = new Operations(this);
             AlertRules = new AlertRulesOperations(this);
             Actions = new ActionsOperations(this);
             AlertRuleTemplates = new AlertRuleTemplatesOperations(this);
-            Bookmarks = new BookmarksOperations(this);
-            DataConnectors = new DataConnectorsOperations(this);
-            Incidents = new IncidentsOperations(this);
-            IncidentComments = new IncidentCommentsOperations(this);
             BaseUri = new System.Uri("https://management.azure.com");
-            ApiVersion = "2020-01-01";
+            ApiVersion = "2021-10-01";
             AcceptLanguage = "en-US";
             LongRunningOperationRetryTimeout = 30;
             GenerateClientRequestId = true;
@@ -395,14 +419,14 @@ private void Initialize()
                         new Iso8601TimeSpanConverter()
                     }
             };
+            SerializationSettings.Converters.Add(new PolymorphicSerializeJsonConverter<Entity>("kind"));
+            DeserializationSettings.Converters.Add(new PolymorphicDeserializeJsonConverter<Entity>("kind"));
+            SerializationSettings.Converters.Add(new PolymorphicSerializeJsonConverter<ThreatIntelligenceInformation>("kind"));
+            DeserializationSettings.Converters.Add(new PolymorphicDeserializeJsonConverter<ThreatIntelligenceInformation>("kind"));
             SerializationSettings.Converters.Add(new PolymorphicSerializeJsonConverter<AlertRule>("kind"));
             DeserializationSettings.Converters.Add(new PolymorphicDeserializeJsonConverter<AlertRule>("kind"));
             SerializationSettings.Converters.Add(new PolymorphicSerializeJsonConverter<AlertRuleTemplate>("kind"));
             DeserializationSettings.Converters.Add(new PolymorphicDeserializeJsonConverter<AlertRuleTemplate>("kind"));
-            SerializationSettings.Converters.Add(new PolymorphicSerializeJsonConverter<DataConnector>("kind"));
-            DeserializationSettings.Converters.Add(new PolymorphicDeserializeJsonConverter<DataConnector>("kind"));
-            SerializationSettings.Converters.Add(new PolymorphicSerializeJsonConverter<Settings>("kind"));
-            DeserializationSettings.Converters.Add(new PolymorphicDeserializeJsonConverter<Settings>("kind"));
             CustomInitialize();
             DeserializationSettings.Converters.Add(new TransformationJsonConverter());
             DeserializationSettings.Converters.Add(new CloudErrorJsonConverter());
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ThreatIntelligenceIndicatorMetricsOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ThreatIntelligenceIndicatorMetricsOperations.cs
new file mode 100644
index 0000000000000..4f7edb267823d
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ThreatIntelligenceIndicatorMetricsOperations.cs
@@ -0,0 +1,292 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Azure;
+    using Models;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+    using System.Net;
+    using System.Net.Http;
+    using System.Threading;
+    using System.Threading.Tasks;
+
+    /// <summary>
+    /// ThreatIntelligenceIndicatorMetricsOperations operations.
+    /// </summary>
+    internal partial class ThreatIntelligenceIndicatorMetricsOperations : IServiceOperations<SecurityInsightsClient>, IThreatIntelligenceIndicatorMetricsOperations
+    {
+        /// <summary>
+        /// Initializes a new instance of the ThreatIntelligenceIndicatorMetricsOperations class.
+        /// </summary>
+        /// <param name='client'>
+        /// Reference to the service client.
+        /// </param>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        internal ThreatIntelligenceIndicatorMetricsOperations(SecurityInsightsClient client)
+        {
+            if (client == null)
+            {
+                throw new System.ArgumentNullException("client");
+            }
+            Client = client;
+        }
+
+        /// <summary>
+        /// Gets a reference to the SecurityInsightsClient
+        /// </summary>
+        public SecurityInsightsClient Client { get; private set; }
+
+        /// <summary>
+        /// Get threat intelligence indicators metrics (Indicators counts by Type,
+        /// Threat Type, Source).
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse<ThreatIntelligenceMetricsList>> ListWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
+            if (Client.SubscriptionId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
+            }
+            if (Client.SubscriptionId != null)
+            {
+                if (Client.SubscriptionId.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
+                }
+            }
+            if (resourceGroupName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName");
+            }
+            if (resourceGroupName != null)
+            {
+                if (resourceGroupName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90);
+                }
+                if (resourceGroupName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
+                }
+            }
+            if (operationalInsightsResourceProvider == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "operationalInsightsResourceProvider");
+            }
+            if (workspaceName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "workspaceName");
+            }
+            if (workspaceName != null)
+            {
+                if (workspaceName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "workspaceName", 90);
+                }
+                if (workspaceName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
+                }
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("operationalInsightsResourceProvider", operationalInsightsResourceProvider);
+                tracingParameters.Add("workspaceName", workspaceName);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "List", tracingParameters);
+            }
+            // Construct URL
+            var _baseUrl = Client.BaseUri.AbsoluteUri;
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/metrics").ToString();
+            _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
+            _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{operationalInsightsResourceProvider}", System.Uri.EscapeDataString(operationalInsightsResourceProvider));
+            _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
+            List<string> _queryParameters = new List<string>();
+            if (Client.ApiVersion != null)
+            {
+                _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(Client.ApiVersion)));
+            }
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("GET");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
+                {
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse<ThreatIntelligenceMetricsList>();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 200)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<ThreatIntelligenceMetricsList>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ThreatIntelligenceIndicatorMetricsOperationsExtensions.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ThreatIntelligenceIndicatorMetricsOperationsExtensions.cs
new file mode 100644
index 0000000000000..2c21ad4c8ebbc
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ThreatIntelligenceIndicatorMetricsOperationsExtensions.cs
@@ -0,0 +1,75 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Azure;
+    using Models;
+    using System.Threading;
+    using System.Threading.Tasks;
+
+    /// <summary>
+    /// Extension methods for ThreatIntelligenceIndicatorMetricsOperations.
+    /// </summary>
+    public static partial class ThreatIntelligenceIndicatorMetricsOperationsExtensions
+    {
+            /// <summary>
+            /// Get threat intelligence indicators metrics (Indicators counts by Type,
+            /// Threat Type, Source).
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            public static ThreatIntelligenceMetricsList List(this IThreatIntelligenceIndicatorMetricsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName)
+            {
+                return operations.ListAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Get threat intelligence indicators metrics (Indicators counts by Type,
+            /// Threat Type, Source).
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<ThreatIntelligenceMetricsList> ListAsync(this IThreatIntelligenceIndicatorMetricsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.ListWithHttpMessagesAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ThreatIntelligenceIndicatorOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ThreatIntelligenceIndicatorOperations.cs
new file mode 100644
index 0000000000000..daa8cbde10d42
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ThreatIntelligenceIndicatorOperations.cs
@@ -0,0 +1,1991 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Azure;
+    using Models;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+    using System.Net;
+    using System.Net.Http;
+    using System.Threading;
+    using System.Threading.Tasks;
+
+    /// <summary>
+    /// ThreatIntelligenceIndicatorOperations operations.
+    /// </summary>
+    internal partial class ThreatIntelligenceIndicatorOperations : IServiceOperations<SecurityInsightsClient>, IThreatIntelligenceIndicatorOperations
+    {
+        /// <summary>
+        /// Initializes a new instance of the ThreatIntelligenceIndicatorOperations class.
+        /// </summary>
+        /// <param name='client'>
+        /// Reference to the service client.
+        /// </param>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        internal ThreatIntelligenceIndicatorOperations(SecurityInsightsClient client)
+        {
+            if (client == null)
+            {
+                throw new System.ArgumentNullException("client");
+            }
+            Client = client;
+        }
+
+        /// <summary>
+        /// Gets a reference to the SecurityInsightsClient
+        /// </summary>
+        public SecurityInsightsClient Client { get; private set; }
+
+        /// <summary>
+        /// Create a new threat intelligence indicator.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='threatIntelligenceProperties'>
+        /// Properties of threat intelligence indicators to create and update.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse<ThreatIntelligenceInformation>> CreateIndicatorWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, ThreatIntelligenceIndicatorModelForRequestBody threatIntelligenceProperties, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
+            if (Client.SubscriptionId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
+            }
+            if (Client.SubscriptionId != null)
+            {
+                if (Client.SubscriptionId.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
+                }
+            }
+            if (resourceGroupName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName");
+            }
+            if (resourceGroupName != null)
+            {
+                if (resourceGroupName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90);
+                }
+                if (resourceGroupName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
+                }
+            }
+            if (operationalInsightsResourceProvider == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "operationalInsightsResourceProvider");
+            }
+            if (workspaceName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "workspaceName");
+            }
+            if (workspaceName != null)
+            {
+                if (workspaceName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "workspaceName", 90);
+                }
+                if (workspaceName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
+                }
+            }
+            if (threatIntelligenceProperties == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "threatIntelligenceProperties");
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("operationalInsightsResourceProvider", operationalInsightsResourceProvider);
+                tracingParameters.Add("workspaceName", workspaceName);
+                tracingParameters.Add("threatIntelligenceProperties", threatIntelligenceProperties);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "CreateIndicator", tracingParameters);
+            }
+            // Construct URL
+            var _baseUrl = Client.BaseUri.AbsoluteUri;
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/createIndicator").ToString();
+            _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
+            _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{operationalInsightsResourceProvider}", System.Uri.EscapeDataString(operationalInsightsResourceProvider));
+            _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
+            List<string> _queryParameters = new List<string>();
+            if (Client.ApiVersion != null)
+            {
+                _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(Client.ApiVersion)));
+            }
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("POST");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            if(threatIntelligenceProperties != null)
+            {
+                _requestContent = Rest.Serialization.SafeJsonConvert.SerializeObject(threatIntelligenceProperties, Client.SerializationSettings);
+                _httpRequest.Content = new StringContent(_requestContent, System.Text.Encoding.UTF8);
+                _httpRequest.Content.Headers.ContentType =System.Net.Http.Headers.MediaTypeHeaderValue.Parse("application/json; charset=utf-8");
+            }
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200 && (int)_statusCode != 201)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
+                {
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse<ThreatIntelligenceInformation>();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 200)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<ThreatIntelligenceInformation>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 201)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<ThreatIntelligenceInformation>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+        /// <summary>
+        /// View a threat intelligence indicator by name.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='name'>
+        /// Threat intelligence indicator name field.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse<ThreatIntelligenceInformation>> GetWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
+            if (Client.SubscriptionId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
+            }
+            if (Client.SubscriptionId != null)
+            {
+                if (Client.SubscriptionId.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
+                }
+            }
+            if (resourceGroupName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName");
+            }
+            if (resourceGroupName != null)
+            {
+                if (resourceGroupName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90);
+                }
+                if (resourceGroupName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
+                }
+            }
+            if (operationalInsightsResourceProvider == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "operationalInsightsResourceProvider");
+            }
+            if (workspaceName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "workspaceName");
+            }
+            if (workspaceName != null)
+            {
+                if (workspaceName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "workspaceName", 90);
+                }
+                if (workspaceName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
+                }
+            }
+            if (name == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "name");
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("operationalInsightsResourceProvider", operationalInsightsResourceProvider);
+                tracingParameters.Add("workspaceName", workspaceName);
+                tracingParameters.Add("name", name);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "Get", tracingParameters);
+            }
+            // Construct URL
+            var _baseUrl = Client.BaseUri.AbsoluteUri;
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators/{name}").ToString();
+            _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
+            _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{operationalInsightsResourceProvider}", System.Uri.EscapeDataString(operationalInsightsResourceProvider));
+            _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
+            _url = _url.Replace("{name}", System.Uri.EscapeDataString(name));
+            List<string> _queryParameters = new List<string>();
+            if (Client.ApiVersion != null)
+            {
+                _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(Client.ApiVersion)));
+            }
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("GET");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
+                {
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse<ThreatIntelligenceInformation>();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 200)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<ThreatIntelligenceInformation>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+        /// <summary>
+        /// Update a threat Intelligence indicator.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='name'>
+        /// Threat intelligence indicator name field.
+        /// </param>
+        /// <param name='threatIntelligenceProperties'>
+        /// Properties of threat intelligence indicators to create and update.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse<ThreatIntelligenceInformation>> CreateWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name, ThreatIntelligenceIndicatorModelForRequestBody threatIntelligenceProperties, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
+            if (Client.SubscriptionId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
+            }
+            if (Client.SubscriptionId != null)
+            {
+                if (Client.SubscriptionId.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
+                }
+            }
+            if (resourceGroupName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName");
+            }
+            if (resourceGroupName != null)
+            {
+                if (resourceGroupName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90);
+                }
+                if (resourceGroupName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
+                }
+            }
+            if (operationalInsightsResourceProvider == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "operationalInsightsResourceProvider");
+            }
+            if (workspaceName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "workspaceName");
+            }
+            if (workspaceName != null)
+            {
+                if (workspaceName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "workspaceName", 90);
+                }
+                if (workspaceName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
+                }
+            }
+            if (name == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "name");
+            }
+            if (threatIntelligenceProperties == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "threatIntelligenceProperties");
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("operationalInsightsResourceProvider", operationalInsightsResourceProvider);
+                tracingParameters.Add("workspaceName", workspaceName);
+                tracingParameters.Add("name", name);
+                tracingParameters.Add("threatIntelligenceProperties", threatIntelligenceProperties);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "Create", tracingParameters);
+            }
+            // Construct URL
+            var _baseUrl = Client.BaseUri.AbsoluteUri;
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators/{name}").ToString();
+            _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
+            _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{operationalInsightsResourceProvider}", System.Uri.EscapeDataString(operationalInsightsResourceProvider));
+            _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
+            _url = _url.Replace("{name}", System.Uri.EscapeDataString(name));
+            List<string> _queryParameters = new List<string>();
+            if (Client.ApiVersion != null)
+            {
+                _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(Client.ApiVersion)));
+            }
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("PUT");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            if(threatIntelligenceProperties != null)
+            {
+                _requestContent = Rest.Serialization.SafeJsonConvert.SerializeObject(threatIntelligenceProperties, Client.SerializationSettings);
+                _httpRequest.Content = new StringContent(_requestContent, System.Text.Encoding.UTF8);
+                _httpRequest.Content.Headers.ContentType =System.Net.Http.Headers.MediaTypeHeaderValue.Parse("application/json; charset=utf-8");
+            }
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200 && (int)_statusCode != 201)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
+                {
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse<ThreatIntelligenceInformation>();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 200)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<ThreatIntelligenceInformation>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 201)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<ThreatIntelligenceInformation>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+        /// <summary>
+        /// Delete a threat intelligence indicator.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='name'>
+        /// Threat intelligence indicator name field.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse> DeleteWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
+            if (Client.SubscriptionId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
+            }
+            if (Client.SubscriptionId != null)
+            {
+                if (Client.SubscriptionId.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
+                }
+            }
+            if (resourceGroupName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName");
+            }
+            if (resourceGroupName != null)
+            {
+                if (resourceGroupName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90);
+                }
+                if (resourceGroupName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
+                }
+            }
+            if (operationalInsightsResourceProvider == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "operationalInsightsResourceProvider");
+            }
+            if (workspaceName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "workspaceName");
+            }
+            if (workspaceName != null)
+            {
+                if (workspaceName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "workspaceName", 90);
+                }
+                if (workspaceName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
+                }
+            }
+            if (name == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "name");
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("operationalInsightsResourceProvider", operationalInsightsResourceProvider);
+                tracingParameters.Add("workspaceName", workspaceName);
+                tracingParameters.Add("name", name);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "Delete", tracingParameters);
+            }
+            // Construct URL
+            var _baseUrl = Client.BaseUri.AbsoluteUri;
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators/{name}").ToString();
+            _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
+            _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{operationalInsightsResourceProvider}", System.Uri.EscapeDataString(operationalInsightsResourceProvider));
+            _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
+            _url = _url.Replace("{name}", System.Uri.EscapeDataString(name));
+            List<string> _queryParameters = new List<string>();
+            if (Client.ApiVersion != null)
+            {
+                _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(Client.ApiVersion)));
+            }
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("DELETE");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200 && (int)_statusCode != 204)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
+                {
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+        /// <summary>
+        /// Query threat intelligence indicators as per filtering criteria.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='threatIntelligenceFilteringCriteria'>
+        /// Filtering criteria for querying threat intelligence indicators.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse<IPage<ThreatIntelligenceInformation>>> QueryIndicatorsWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, ThreatIntelligenceFilteringCriteria threatIntelligenceFilteringCriteria, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
+            if (Client.SubscriptionId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
+            }
+            if (Client.SubscriptionId != null)
+            {
+                if (Client.SubscriptionId.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
+                }
+            }
+            if (resourceGroupName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName");
+            }
+            if (resourceGroupName != null)
+            {
+                if (resourceGroupName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90);
+                }
+                if (resourceGroupName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
+                }
+            }
+            if (operationalInsightsResourceProvider == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "operationalInsightsResourceProvider");
+            }
+            if (workspaceName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "workspaceName");
+            }
+            if (workspaceName != null)
+            {
+                if (workspaceName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "workspaceName", 90);
+                }
+                if (workspaceName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
+                }
+            }
+            if (threatIntelligenceFilteringCriteria == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "threatIntelligenceFilteringCriteria");
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("operationalInsightsResourceProvider", operationalInsightsResourceProvider);
+                tracingParameters.Add("workspaceName", workspaceName);
+                tracingParameters.Add("threatIntelligenceFilteringCriteria", threatIntelligenceFilteringCriteria);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "QueryIndicators", tracingParameters);
+            }
+            // Construct URL
+            var _baseUrl = Client.BaseUri.AbsoluteUri;
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/queryIndicators").ToString();
+            _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
+            _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{operationalInsightsResourceProvider}", System.Uri.EscapeDataString(operationalInsightsResourceProvider));
+            _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
+            List<string> _queryParameters = new List<string>();
+            if (Client.ApiVersion != null)
+            {
+                _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(Client.ApiVersion)));
+            }
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("POST");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            if(threatIntelligenceFilteringCriteria != null)
+            {
+                _requestContent = Rest.Serialization.SafeJsonConvert.SerializeObject(threatIntelligenceFilteringCriteria, Client.SerializationSettings);
+                _httpRequest.Content = new StringContent(_requestContent, System.Text.Encoding.UTF8);
+                _httpRequest.Content.Headers.ContentType =System.Net.Http.Headers.MediaTypeHeaderValue.Parse("application/json; charset=utf-8");
+            }
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
+                {
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse<IPage<ThreatIntelligenceInformation>>();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 200)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Page<ThreatIntelligenceInformation>>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+        /// <summary>
+        /// Append tags to a threat intelligence indicator.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='name'>
+        /// Threat intelligence indicator name field.
+        /// </param>
+        /// <param name='threatIntelligenceTags'>
+        /// List of tags to be appended.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse> AppendTagsWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name, IList<string> threatIntelligenceTags = default(IList<string>), Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
+            if (Client.SubscriptionId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
+            }
+            if (Client.SubscriptionId != null)
+            {
+                if (Client.SubscriptionId.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
+                }
+            }
+            if (resourceGroupName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName");
+            }
+            if (resourceGroupName != null)
+            {
+                if (resourceGroupName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90);
+                }
+                if (resourceGroupName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
+                }
+            }
+            if (operationalInsightsResourceProvider == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "operationalInsightsResourceProvider");
+            }
+            if (workspaceName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "workspaceName");
+            }
+            if (workspaceName != null)
+            {
+                if (workspaceName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "workspaceName", 90);
+                }
+                if (workspaceName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
+                }
+            }
+            if (name == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "name");
+            }
+            ThreatIntelligenceAppendTags threatIntelligenceAppendTags = new ThreatIntelligenceAppendTags();
+            if (threatIntelligenceTags != null)
+            {
+                threatIntelligenceAppendTags.ThreatIntelligenceTags = threatIntelligenceTags;
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("operationalInsightsResourceProvider", operationalInsightsResourceProvider);
+                tracingParameters.Add("workspaceName", workspaceName);
+                tracingParameters.Add("name", name);
+                tracingParameters.Add("threatIntelligenceAppendTags", threatIntelligenceAppendTags);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "AppendTags", tracingParameters);
+            }
+            // Construct URL
+            var _baseUrl = Client.BaseUri.AbsoluteUri;
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators/{name}/appendTags").ToString();
+            _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
+            _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{operationalInsightsResourceProvider}", System.Uri.EscapeDataString(operationalInsightsResourceProvider));
+            _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
+            _url = _url.Replace("{name}", System.Uri.EscapeDataString(name));
+            List<string> _queryParameters = new List<string>();
+            if (Client.ApiVersion != null)
+            {
+                _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(Client.ApiVersion)));
+            }
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("POST");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            if(threatIntelligenceAppendTags != null)
+            {
+                _requestContent = Rest.Serialization.SafeJsonConvert.SerializeObject(threatIntelligenceAppendTags, Client.SerializationSettings);
+                _httpRequest.Content = new StringContent(_requestContent, System.Text.Encoding.UTF8);
+                _httpRequest.Content.Headers.ContentType =System.Net.Http.Headers.MediaTypeHeaderValue.Parse("application/json; charset=utf-8");
+            }
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
+                {
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+        /// <summary>
+        /// Replace tags added to a threat intelligence indicator.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='name'>
+        /// Threat intelligence indicator name field.
+        /// </param>
+        /// <param name='threatIntelligenceReplaceTags'>
+        /// Tags in the threat intelligence indicator to be replaced.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse<ThreatIntelligenceInformation>> ReplaceTagsWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name, ThreatIntelligenceIndicatorModelForRequestBody threatIntelligenceReplaceTags, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
+            if (Client.SubscriptionId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
+            }
+            if (Client.SubscriptionId != null)
+            {
+                if (Client.SubscriptionId.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
+                }
+            }
+            if (resourceGroupName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName");
+            }
+            if (resourceGroupName != null)
+            {
+                if (resourceGroupName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90);
+                }
+                if (resourceGroupName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
+                }
+            }
+            if (operationalInsightsResourceProvider == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "operationalInsightsResourceProvider");
+            }
+            if (workspaceName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "workspaceName");
+            }
+            if (workspaceName != null)
+            {
+                if (workspaceName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "workspaceName", 90);
+                }
+                if (workspaceName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
+                }
+            }
+            if (name == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "name");
+            }
+            if (threatIntelligenceReplaceTags == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "threatIntelligenceReplaceTags");
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("operationalInsightsResourceProvider", operationalInsightsResourceProvider);
+                tracingParameters.Add("workspaceName", workspaceName);
+                tracingParameters.Add("name", name);
+                tracingParameters.Add("threatIntelligenceReplaceTags", threatIntelligenceReplaceTags);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "ReplaceTags", tracingParameters);
+            }
+            // Construct URL
+            var _baseUrl = Client.BaseUri.AbsoluteUri;
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators/{name}/replaceTags").ToString();
+            _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
+            _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{operationalInsightsResourceProvider}", System.Uri.EscapeDataString(operationalInsightsResourceProvider));
+            _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
+            _url = _url.Replace("{name}", System.Uri.EscapeDataString(name));
+            List<string> _queryParameters = new List<string>();
+            if (Client.ApiVersion != null)
+            {
+                _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(Client.ApiVersion)));
+            }
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("POST");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            if(threatIntelligenceReplaceTags != null)
+            {
+                _requestContent = Rest.Serialization.SafeJsonConvert.SerializeObject(threatIntelligenceReplaceTags, Client.SerializationSettings);
+                _httpRequest.Content = new StringContent(_requestContent, System.Text.Encoding.UTF8);
+                _httpRequest.Content.Headers.ContentType =System.Net.Http.Headers.MediaTypeHeaderValue.Parse("application/json; charset=utf-8");
+            }
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
+                {
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse<ThreatIntelligenceInformation>();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 200)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<ThreatIntelligenceInformation>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+        /// <summary>
+        /// Query threat intelligence indicators as per filtering criteria.
+        /// </summary>
+        /// <param name='nextPageLink'>
+        /// The NextLink from the previous successful call to List operation.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse<IPage<ThreatIntelligenceInformation>>> QueryIndicatorsNextWithHttpMessagesAsync(string nextPageLink, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (nextPageLink == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "nextPageLink");
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("nextPageLink", nextPageLink);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "QueryIndicatorsNext", tracingParameters);
+            }
+            // Construct URL
+            string _url = "{nextLink}";
+            _url = _url.Replace("{nextLink}", nextPageLink);
+            List<string> _queryParameters = new List<string>();
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("POST");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
+                {
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse<IPage<ThreatIntelligenceInformation>>();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 200)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Page<ThreatIntelligenceInformation>>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ThreatIntelligenceIndicatorOperationsExtensions.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ThreatIntelligenceIndicatorOperationsExtensions.cs
new file mode 100644
index 0000000000000..dd71617e20018
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ThreatIntelligenceIndicatorOperationsExtensions.cs
@@ -0,0 +1,451 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Azure;
+    using Models;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Threading;
+    using System.Threading.Tasks;
+
+    /// <summary>
+    /// Extension methods for ThreatIntelligenceIndicatorOperations.
+    /// </summary>
+    public static partial class ThreatIntelligenceIndicatorOperationsExtensions
+    {
+            /// <summary>
+            /// Create a new threat intelligence indicator.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='threatIntelligenceProperties'>
+            /// Properties of threat intelligence indicators to create and update.
+            /// </param>
+            public static ThreatIntelligenceInformation CreateIndicator(this IThreatIntelligenceIndicatorOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, ThreatIntelligenceIndicatorModelForRequestBody threatIntelligenceProperties)
+            {
+                return operations.CreateIndicatorAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, threatIntelligenceProperties).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Create a new threat intelligence indicator.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='threatIntelligenceProperties'>
+            /// Properties of threat intelligence indicators to create and update.
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<ThreatIntelligenceInformation> CreateIndicatorAsync(this IThreatIntelligenceIndicatorOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, ThreatIntelligenceIndicatorModelForRequestBody threatIntelligenceProperties, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.CreateIndicatorWithHttpMessagesAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, threatIntelligenceProperties, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+            /// <summary>
+            /// View a threat intelligence indicator by name.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='name'>
+            /// Threat intelligence indicator name field.
+            /// </param>
+            public static ThreatIntelligenceInformation Get(this IThreatIntelligenceIndicatorOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name)
+            {
+                return operations.GetAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, name).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// View a threat intelligence indicator by name.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='name'>
+            /// Threat intelligence indicator name field.
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<ThreatIntelligenceInformation> GetAsync(this IThreatIntelligenceIndicatorOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, name, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+            /// <summary>
+            /// Update a threat Intelligence indicator.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='name'>
+            /// Threat intelligence indicator name field.
+            /// </param>
+            /// <param name='threatIntelligenceProperties'>
+            /// Properties of threat intelligence indicators to create and update.
+            /// </param>
+            public static ThreatIntelligenceInformation Create(this IThreatIntelligenceIndicatorOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name, ThreatIntelligenceIndicatorModelForRequestBody threatIntelligenceProperties)
+            {
+                return operations.CreateAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, name, threatIntelligenceProperties).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Update a threat Intelligence indicator.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='name'>
+            /// Threat intelligence indicator name field.
+            /// </param>
+            /// <param name='threatIntelligenceProperties'>
+            /// Properties of threat intelligence indicators to create and update.
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<ThreatIntelligenceInformation> CreateAsync(this IThreatIntelligenceIndicatorOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name, ThreatIntelligenceIndicatorModelForRequestBody threatIntelligenceProperties, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.CreateWithHttpMessagesAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, name, threatIntelligenceProperties, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+            /// <summary>
+            /// Delete a threat intelligence indicator.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='name'>
+            /// Threat intelligence indicator name field.
+            /// </param>
+            public static void Delete(this IThreatIntelligenceIndicatorOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name)
+            {
+                operations.DeleteAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, name).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Delete a threat intelligence indicator.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='name'>
+            /// Threat intelligence indicator name field.
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task DeleteAsync(this IThreatIntelligenceIndicatorOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                (await operations.DeleteWithHttpMessagesAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, name, null, cancellationToken).ConfigureAwait(false)).Dispose();
+            }
+
+            /// <summary>
+            /// Query threat intelligence indicators as per filtering criteria.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='threatIntelligenceFilteringCriteria'>
+            /// Filtering criteria for querying threat intelligence indicators.
+            /// </param>
+            public static IPage<ThreatIntelligenceInformation> QueryIndicators(this IThreatIntelligenceIndicatorOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, ThreatIntelligenceFilteringCriteria threatIntelligenceFilteringCriteria)
+            {
+                return operations.QueryIndicatorsAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, threatIntelligenceFilteringCriteria).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Query threat intelligence indicators as per filtering criteria.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='threatIntelligenceFilteringCriteria'>
+            /// Filtering criteria for querying threat intelligence indicators.
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<IPage<ThreatIntelligenceInformation>> QueryIndicatorsAsync(this IThreatIntelligenceIndicatorOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, ThreatIntelligenceFilteringCriteria threatIntelligenceFilteringCriteria, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.QueryIndicatorsWithHttpMessagesAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, threatIntelligenceFilteringCriteria, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+            /// <summary>
+            /// Append tags to a threat intelligence indicator.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='name'>
+            /// Threat intelligence indicator name field.
+            /// </param>
+            /// <param name='threatIntelligenceTags'>
+            /// List of tags to be appended.
+            /// </param>
+            public static void AppendTags(this IThreatIntelligenceIndicatorOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name, IList<string> threatIntelligenceTags = default(IList<string>))
+            {
+                operations.AppendTagsAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, name, threatIntelligenceTags).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Append tags to a threat intelligence indicator.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='name'>
+            /// Threat intelligence indicator name field.
+            /// </param>
+            /// <param name='threatIntelligenceTags'>
+            /// List of tags to be appended.
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task AppendTagsAsync(this IThreatIntelligenceIndicatorOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name, IList<string> threatIntelligenceTags = default(IList<string>), CancellationToken cancellationToken = default(CancellationToken))
+            {
+                (await operations.AppendTagsWithHttpMessagesAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, name, threatIntelligenceTags, null, cancellationToken).ConfigureAwait(false)).Dispose();
+            }
+
+            /// <summary>
+            /// Replace tags added to a threat intelligence indicator.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='name'>
+            /// Threat intelligence indicator name field.
+            /// </param>
+            /// <param name='threatIntelligenceReplaceTags'>
+            /// Tags in the threat intelligence indicator to be replaced.
+            /// </param>
+            public static ThreatIntelligenceInformation ReplaceTags(this IThreatIntelligenceIndicatorOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name, ThreatIntelligenceIndicatorModelForRequestBody threatIntelligenceReplaceTags)
+            {
+                return operations.ReplaceTagsAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, name, threatIntelligenceReplaceTags).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Replace tags added to a threat intelligence indicator.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='name'>
+            /// Threat intelligence indicator name field.
+            /// </param>
+            /// <param name='threatIntelligenceReplaceTags'>
+            /// Tags in the threat intelligence indicator to be replaced.
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<ThreatIntelligenceInformation> ReplaceTagsAsync(this IThreatIntelligenceIndicatorOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string name, ThreatIntelligenceIndicatorModelForRequestBody threatIntelligenceReplaceTags, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.ReplaceTagsWithHttpMessagesAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, name, threatIntelligenceReplaceTags, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+            /// <summary>
+            /// Query threat intelligence indicators as per filtering criteria.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='nextPageLink'>
+            /// The NextLink from the previous successful call to List operation.
+            /// </param>
+            public static IPage<ThreatIntelligenceInformation> QueryIndicatorsNext(this IThreatIntelligenceIndicatorOperations operations, string nextPageLink)
+            {
+                return operations.QueryIndicatorsNextAsync(nextPageLink).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Query threat intelligence indicators as per filtering criteria.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='nextPageLink'>
+            /// The NextLink from the previous successful call to List operation.
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<IPage<ThreatIntelligenceInformation>> QueryIndicatorsNextAsync(this IThreatIntelligenceIndicatorOperations operations, string nextPageLink, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.QueryIndicatorsNextWithHttpMessagesAsync(nextPageLink, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ThreatIntelligenceIndicatorsOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ThreatIntelligenceIndicatorsOperations.cs
new file mode 100644
index 0000000000000..14144ab07bc0c
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ThreatIntelligenceIndicatorsOperations.cs
@@ -0,0 +1,494 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Azure;
+    using Models;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+    using System.Net;
+    using System.Net.Http;
+    using System.Threading;
+    using System.Threading.Tasks;
+
+    /// <summary>
+    /// ThreatIntelligenceIndicatorsOperations operations.
+    /// </summary>
+    internal partial class ThreatIntelligenceIndicatorsOperations : IServiceOperations<SecurityInsightsClient>, IThreatIntelligenceIndicatorsOperations
+    {
+        /// <summary>
+        /// Initializes a new instance of the ThreatIntelligenceIndicatorsOperations class.
+        /// </summary>
+        /// <param name='client'>
+        /// Reference to the service client.
+        /// </param>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        internal ThreatIntelligenceIndicatorsOperations(SecurityInsightsClient client)
+        {
+            if (client == null)
+            {
+                throw new System.ArgumentNullException("client");
+            }
+            Client = client;
+        }
+
+        /// <summary>
+        /// Gets a reference to the SecurityInsightsClient
+        /// </summary>
+        public SecurityInsightsClient Client { get; private set; }
+
+        /// <summary>
+        /// Get all threat intelligence indicators.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='filter'>
+        /// Filters the results, based on a Boolean condition. Optional.
+        /// </param>
+        /// <param name='top'>
+        /// Returns only the first n results. Optional.
+        /// </param>
+        /// <param name='skipToken'>
+        /// Skiptoken is only used if a previous operation returned a partial result.
+        /// If a previous response contains a nextLink element, the value of the
+        /// nextLink element will include a skiptoken parameter that specifies a
+        /// starting point to use for subsequent calls. Optional.
+        /// </param>
+        /// <param name='orderby'>
+        /// Sorts the results. Optional.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse<IPage<ThreatIntelligenceInformation>>> ListWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string filter = default(string), int? top = default(int?), string skipToken = default(string), string orderby = default(string), Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
+            if (Client.SubscriptionId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
+            }
+            if (Client.SubscriptionId != null)
+            {
+                if (Client.SubscriptionId.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
+                }
+            }
+            if (resourceGroupName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName");
+            }
+            if (resourceGroupName != null)
+            {
+                if (resourceGroupName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90);
+                }
+                if (resourceGroupName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
+                }
+            }
+            if (operationalInsightsResourceProvider == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "operationalInsightsResourceProvider");
+            }
+            if (workspaceName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "workspaceName");
+            }
+            if (workspaceName != null)
+            {
+                if (workspaceName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "workspaceName", 90);
+                }
+                if (workspaceName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
+                }
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("operationalInsightsResourceProvider", operationalInsightsResourceProvider);
+                tracingParameters.Add("workspaceName", workspaceName);
+                tracingParameters.Add("filter", filter);
+                tracingParameters.Add("top", top);
+                tracingParameters.Add("skipToken", skipToken);
+                tracingParameters.Add("orderby", orderby);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "List", tracingParameters);
+            }
+            // Construct URL
+            var _baseUrl = Client.BaseUri.AbsoluteUri;
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators").ToString();
+            _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
+            _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{operationalInsightsResourceProvider}", System.Uri.EscapeDataString(operationalInsightsResourceProvider));
+            _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
+            List<string> _queryParameters = new List<string>();
+            if (Client.ApiVersion != null)
+            {
+                _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(Client.ApiVersion)));
+            }
+            if (filter != null)
+            {
+                _queryParameters.Add(string.Format("$filter={0}", System.Uri.EscapeDataString(filter)));
+            }
+            if (top != null)
+            {
+                _queryParameters.Add(string.Format("$top={0}", System.Uri.EscapeDataString(Rest.Serialization.SafeJsonConvert.SerializeObject(top, Client.SerializationSettings).Trim('"'))));
+            }
+            if (skipToken != null)
+            {
+                _queryParameters.Add(string.Format("$skipToken={0}", System.Uri.EscapeDataString(skipToken)));
+            }
+            if (orderby != null)
+            {
+                _queryParameters.Add(string.Format("$orderby={0}", System.Uri.EscapeDataString(orderby)));
+            }
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("GET");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
+                {
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse<IPage<ThreatIntelligenceInformation>>();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 200)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Page<ThreatIntelligenceInformation>>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+        /// <summary>
+        /// Get all threat intelligence indicators.
+        /// </summary>
+        /// <param name='nextPageLink'>
+        /// The NextLink from the previous successful call to List operation.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse<IPage<ThreatIntelligenceInformation>>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (nextPageLink == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "nextPageLink");
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("nextPageLink", nextPageLink);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "ListNext", tracingParameters);
+            }
+            // Construct URL
+            string _url = "{nextLink}";
+            _url = _url.Replace("{nextLink}", nextPageLink);
+            List<string> _queryParameters = new List<string>();
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("GET");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
+                {
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse<IPage<ThreatIntelligenceInformation>>();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 200)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Page<ThreatIntelligenceInformation>>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ThreatIntelligenceIndicatorsOperationsExtensions.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ThreatIntelligenceIndicatorsOperationsExtensions.cs
new file mode 100644
index 0000000000000..143c2884935b4
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/ThreatIntelligenceIndicatorsOperationsExtensions.cs
@@ -0,0 +1,137 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Azure;
+    using Models;
+    using System.Threading;
+    using System.Threading.Tasks;
+
+    /// <summary>
+    /// Extension methods for ThreatIntelligenceIndicatorsOperations.
+    /// </summary>
+    public static partial class ThreatIntelligenceIndicatorsOperationsExtensions
+    {
+            /// <summary>
+            /// Get all threat intelligence indicators.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='filter'>
+            /// Filters the results, based on a Boolean condition. Optional.
+            /// </param>
+            /// <param name='top'>
+            /// Returns only the first n results. Optional.
+            /// </param>
+            /// <param name='skipToken'>
+            /// Skiptoken is only used if a previous operation returned a partial result.
+            /// If a previous response contains a nextLink element, the value of the
+            /// nextLink element will include a skiptoken parameter that specifies a
+            /// starting point to use for subsequent calls. Optional.
+            /// </param>
+            /// <param name='orderby'>
+            /// Sorts the results. Optional.
+            /// </param>
+            public static IPage<ThreatIntelligenceInformation> List(this IThreatIntelligenceIndicatorsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string filter = default(string), int? top = default(int?), string skipToken = default(string), string orderby = default(string))
+            {
+                return operations.ListAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, filter, top, skipToken, orderby).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Get all threat intelligence indicators.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='filter'>
+            /// Filters the results, based on a Boolean condition. Optional.
+            /// </param>
+            /// <param name='top'>
+            /// Returns only the first n results. Optional.
+            /// </param>
+            /// <param name='skipToken'>
+            /// Skiptoken is only used if a previous operation returned a partial result.
+            /// If a previous response contains a nextLink element, the value of the
+            /// nextLink element will include a skiptoken parameter that specifies a
+            /// starting point to use for subsequent calls. Optional.
+            /// </param>
+            /// <param name='orderby'>
+            /// Sorts the results. Optional.
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<IPage<ThreatIntelligenceInformation>> ListAsync(this IThreatIntelligenceIndicatorsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string filter = default(string), int? top = default(int?), string skipToken = default(string), string orderby = default(string), CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.ListWithHttpMessagesAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, filter, top, skipToken, orderby, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+            /// <summary>
+            /// Get all threat intelligence indicators.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='nextPageLink'>
+            /// The NextLink from the previous successful call to List operation.
+            /// </param>
+            public static IPage<ThreatIntelligenceInformation> ListNext(this IThreatIntelligenceIndicatorsOperations operations, string nextPageLink)
+            {
+                return operations.ListNextAsync(nextPageLink).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Get all threat intelligence indicators.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='nextPageLink'>
+            /// The NextLink from the previous successful call to List operation.
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<IPage<ThreatIntelligenceInformation>> ListNextAsync(this IThreatIntelligenceIndicatorsOperations operations, string nextPageLink, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.ListNextWithHttpMessagesAsync(nextPageLink, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/WatchlistItemsOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/WatchlistItemsOperations.cs
new file mode 100644
index 0000000000000..a5d39da78bc56
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/WatchlistItemsOperations.cs
@@ -0,0 +1,1259 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Azure;
+    using Models;
+    using Newtonsoft.Json;
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.Linq;
+    using System.Net;
+    using System.Net.Http;
+    using System.Threading;
+    using System.Threading.Tasks;
+
+    /// <summary>
+    /// WatchlistItemsOperations operations.
+    /// </summary>
+    internal partial class WatchlistItemsOperations : IServiceOperations<SecurityInsightsClient>, IWatchlistItemsOperations
+    {
+        /// <summary>
+        /// Initializes a new instance of the WatchlistItemsOperations class.
+        /// </summary>
+        /// <param name='client'>
+        /// Reference to the service client.
+        /// </param>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        internal WatchlistItemsOperations(SecurityInsightsClient client)
+        {
+            if (client == null)
+            {
+                throw new System.ArgumentNullException("client");
+            }
+            Client = client;
+        }
+
+        /// <summary>
+        /// Gets a reference to the SecurityInsightsClient
+        /// </summary>
+        public SecurityInsightsClient Client { get; private set; }
+
+        /// <summary>
+        /// Get all watchlist Items.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='watchlistAlias'>
+        /// The watchlist alias
+        /// </param>
+        /// <param name='skipToken'>
+        /// Skiptoken is only used if a previous operation returned a partial result.
+        /// If a previous response contains a nextLink element, the value of the
+        /// nextLink element will include a skiptoken parameter that specifies a
+        /// starting point to use for subsequent calls. Optional.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse<IPage<WatchlistItem>>> ListWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, string skipToken = default(string), Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
+            if (Client.SubscriptionId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
+            }
+            if (Client.SubscriptionId != null)
+            {
+                if (Client.SubscriptionId.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
+                }
+            }
+            if (resourceGroupName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName");
+            }
+            if (resourceGroupName != null)
+            {
+                if (resourceGroupName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90);
+                }
+                if (resourceGroupName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
+                }
+            }
+            if (operationalInsightsResourceProvider == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "operationalInsightsResourceProvider");
+            }
+            if (workspaceName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "workspaceName");
+            }
+            if (workspaceName != null)
+            {
+                if (workspaceName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "workspaceName", 90);
+                }
+                if (workspaceName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
+                }
+            }
+            if (watchlistAlias == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "watchlistAlias");
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("operationalInsightsResourceProvider", operationalInsightsResourceProvider);
+                tracingParameters.Add("workspaceName", workspaceName);
+                tracingParameters.Add("watchlistAlias", watchlistAlias);
+                tracingParameters.Add("skipToken", skipToken);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "List", tracingParameters);
+            }
+            // Construct URL
+            var _baseUrl = Client.BaseUri.AbsoluteUri;
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists/{watchlistAlias}/watchlistItems").ToString();
+            _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
+            _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{operationalInsightsResourceProvider}", System.Uri.EscapeDataString(operationalInsightsResourceProvider));
+            _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
+            _url = _url.Replace("{watchlistAlias}", System.Uri.EscapeDataString(watchlistAlias));
+            List<string> _queryParameters = new List<string>();
+            if (Client.ApiVersion != null)
+            {
+                _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(Client.ApiVersion)));
+            }
+            if (skipToken != null)
+            {
+                _queryParameters.Add(string.Format("$skipToken={0}", System.Uri.EscapeDataString(skipToken)));
+            }
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("GET");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
+                {
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse<IPage<WatchlistItem>>();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 200)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Page<WatchlistItem>>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+        /// <summary>
+        /// Get a watchlist item.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='watchlistAlias'>
+        /// The watchlist alias
+        /// </param>
+        /// <param name='watchlistItemId'>
+        /// The watchlist item id (GUID)
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse<WatchlistItem>> GetWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, string watchlistItemId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
+            if (Client.SubscriptionId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
+            }
+            if (Client.SubscriptionId != null)
+            {
+                if (Client.SubscriptionId.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
+                }
+            }
+            if (resourceGroupName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName");
+            }
+            if (resourceGroupName != null)
+            {
+                if (resourceGroupName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90);
+                }
+                if (resourceGroupName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
+                }
+            }
+            if (operationalInsightsResourceProvider == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "operationalInsightsResourceProvider");
+            }
+            if (workspaceName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "workspaceName");
+            }
+            if (workspaceName != null)
+            {
+                if (workspaceName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "workspaceName", 90);
+                }
+                if (workspaceName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
+                }
+            }
+            if (watchlistAlias == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "watchlistAlias");
+            }
+            if (watchlistItemId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "watchlistItemId");
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("operationalInsightsResourceProvider", operationalInsightsResourceProvider);
+                tracingParameters.Add("workspaceName", workspaceName);
+                tracingParameters.Add("watchlistAlias", watchlistAlias);
+                tracingParameters.Add("watchlistItemId", watchlistItemId);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "Get", tracingParameters);
+            }
+            // Construct URL
+            var _baseUrl = Client.BaseUri.AbsoluteUri;
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists/{watchlistAlias}/watchlistItems/{watchlistItemId}").ToString();
+            _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
+            _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{operationalInsightsResourceProvider}", System.Uri.EscapeDataString(operationalInsightsResourceProvider));
+            _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
+            _url = _url.Replace("{watchlistAlias}", System.Uri.EscapeDataString(watchlistAlias));
+            _url = _url.Replace("{watchlistItemId}", System.Uri.EscapeDataString(watchlistItemId));
+            List<string> _queryParameters = new List<string>();
+            if (Client.ApiVersion != null)
+            {
+                _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(Client.ApiVersion)));
+            }
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("GET");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
+                {
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse<WatchlistItem>();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 200)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<WatchlistItem>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+        /// <summary>
+        /// Delete a watchlist item.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='watchlistAlias'>
+        /// The watchlist alias
+        /// </param>
+        /// <param name='watchlistItemId'>
+        /// The watchlist item id (GUID)
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse> DeleteWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, string watchlistItemId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
+            if (Client.SubscriptionId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
+            }
+            if (Client.SubscriptionId != null)
+            {
+                if (Client.SubscriptionId.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
+                }
+            }
+            if (resourceGroupName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName");
+            }
+            if (resourceGroupName != null)
+            {
+                if (resourceGroupName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90);
+                }
+                if (resourceGroupName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
+                }
+            }
+            if (operationalInsightsResourceProvider == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "operationalInsightsResourceProvider");
+            }
+            if (workspaceName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "workspaceName");
+            }
+            if (workspaceName != null)
+            {
+                if (workspaceName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "workspaceName", 90);
+                }
+                if (workspaceName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
+                }
+            }
+            if (watchlistAlias == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "watchlistAlias");
+            }
+            if (watchlistItemId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "watchlistItemId");
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("operationalInsightsResourceProvider", operationalInsightsResourceProvider);
+                tracingParameters.Add("workspaceName", workspaceName);
+                tracingParameters.Add("watchlistAlias", watchlistAlias);
+                tracingParameters.Add("watchlistItemId", watchlistItemId);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "Delete", tracingParameters);
+            }
+            // Construct URL
+            var _baseUrl = Client.BaseUri.AbsoluteUri;
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists/{watchlistAlias}/watchlistItems/{watchlistItemId}").ToString();
+            _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
+            _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{operationalInsightsResourceProvider}", System.Uri.EscapeDataString(operationalInsightsResourceProvider));
+            _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
+            _url = _url.Replace("{watchlistAlias}", System.Uri.EscapeDataString(watchlistAlias));
+            _url = _url.Replace("{watchlistItemId}", System.Uri.EscapeDataString(watchlistItemId));
+            List<string> _queryParameters = new List<string>();
+            if (Client.ApiVersion != null)
+            {
+                _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(Client.ApiVersion)));
+            }
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("DELETE");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200 && (int)_statusCode != 204)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
+                {
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+        /// <summary>
+        /// Create or update a watchlist item.
+        /// </summary>
+        /// <param name='resourceGroupName'>
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
+        /// </param>
+        /// <param name='workspaceName'>
+        /// The name of the workspace.
+        /// </param>
+        /// <param name='watchlistAlias'>
+        /// The watchlist alias
+        /// </param>
+        /// <param name='watchlistItemId'>
+        /// The watchlist item id (GUID)
+        /// </param>
+        /// <param name='watchlistItem'>
+        /// The watchlist item
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse<WatchlistItem>> CreateOrUpdateWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, string watchlistItemId, WatchlistItem watchlistItem, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
+            if (Client.SubscriptionId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
+            }
+            if (Client.SubscriptionId != null)
+            {
+                if (Client.SubscriptionId.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
+                }
+            }
+            if (resourceGroupName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName");
+            }
+            if (resourceGroupName != null)
+            {
+                if (resourceGroupName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90);
+                }
+                if (resourceGroupName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
+                }
+            }
+            if (operationalInsightsResourceProvider == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "operationalInsightsResourceProvider");
+            }
+            if (workspaceName == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "workspaceName");
+            }
+            if (workspaceName != null)
+            {
+                if (workspaceName.Length > 90)
+                {
+                    throw new ValidationException(ValidationRules.MaxLength, "workspaceName", 90);
+                }
+                if (workspaceName.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
+                }
+            }
+            if (watchlistAlias == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "watchlistAlias");
+            }
+            if (watchlistItemId == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "watchlistItemId");
+            }
+            if (watchlistItem == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "watchlistItem");
+            }
+            if (watchlistItem != null)
+            {
+                watchlistItem.Validate();
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("operationalInsightsResourceProvider", operationalInsightsResourceProvider);
+                tracingParameters.Add("workspaceName", workspaceName);
+                tracingParameters.Add("watchlistAlias", watchlistAlias);
+                tracingParameters.Add("watchlistItemId", watchlistItemId);
+                tracingParameters.Add("watchlistItem", watchlistItem);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "CreateOrUpdate", tracingParameters);
+            }
+            // Construct URL
+            var _baseUrl = Client.BaseUri.AbsoluteUri;
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists/{watchlistAlias}/watchlistItems/{watchlistItemId}").ToString();
+            _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
+            _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{operationalInsightsResourceProvider}", System.Uri.EscapeDataString(operationalInsightsResourceProvider));
+            _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
+            _url = _url.Replace("{watchlistAlias}", System.Uri.EscapeDataString(watchlistAlias));
+            _url = _url.Replace("{watchlistItemId}", System.Uri.EscapeDataString(watchlistItemId));
+            List<string> _queryParameters = new List<string>();
+            if (Client.ApiVersion != null)
+            {
+                _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(Client.ApiVersion)));
+            }
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("PUT");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            if(watchlistItem != null)
+            {
+                _requestContent = Rest.Serialization.SafeJsonConvert.SerializeObject(watchlistItem, Client.SerializationSettings);
+                _httpRequest.Content = new StringContent(_requestContent, System.Text.Encoding.UTF8);
+                _httpRequest.Content.Headers.ContentType =System.Net.Http.Headers.MediaTypeHeaderValue.Parse("application/json; charset=utf-8");
+            }
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200 && (int)_statusCode != 201)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
+                {
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse<WatchlistItem>();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 200)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<WatchlistItem>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 201)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<WatchlistItem>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+        /// <summary>
+        /// Get all watchlist Items.
+        /// </summary>
+        /// <param name='nextPageLink'>
+        /// The NextLink from the previous successful call to List operation.
+        /// </param>
+        /// <param name='customHeaders'>
+        /// Headers that will be added to request.
+        /// </param>
+        /// <param name='cancellationToken'>
+        /// The cancellation token.
+        /// </param>
+        /// <exception cref="ErrorResponseException">
+        /// Thrown when the operation returned an invalid status code
+        /// </exception>
+        /// <exception cref="SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
+        /// <exception cref="ValidationException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <exception cref="System.ArgumentNullException">
+        /// Thrown when a required parameter is null
+        /// </exception>
+        /// <return>
+        /// A response object containing the response body and response headers.
+        /// </return>
+        public async Task<AzureOperationResponse<IPage<WatchlistItem>>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        {
+            if (nextPageLink == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "nextPageLink");
+            }
+            // Tracing
+            bool _shouldTrace = ServiceClientTracing.IsEnabled;
+            string _invocationId = null;
+            if (_shouldTrace)
+            {
+                _invocationId = ServiceClientTracing.NextInvocationId.ToString();
+                Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
+                tracingParameters.Add("nextPageLink", nextPageLink);
+                tracingParameters.Add("cancellationToken", cancellationToken);
+                ServiceClientTracing.Enter(_invocationId, this, "ListNext", tracingParameters);
+            }
+            // Construct URL
+            string _url = "{nextLink}";
+            _url = _url.Replace("{nextLink}", nextPageLink);
+            List<string> _queryParameters = new List<string>();
+            if (_queryParameters.Count > 0)
+            {
+                _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
+            }
+            // Create HTTP transport objects
+            var _httpRequest = new HttpRequestMessage();
+            HttpResponseMessage _httpResponse = null;
+            _httpRequest.Method = new HttpMethod("GET");
+            _httpRequest.RequestUri = new System.Uri(_url);
+            // Set Headers
+            if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
+            {
+                _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString());
+            }
+            if (Client.AcceptLanguage != null)
+            {
+                if (_httpRequest.Headers.Contains("accept-language"))
+                {
+                    _httpRequest.Headers.Remove("accept-language");
+                }
+                _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage);
+            }
+
+
+            if (customHeaders != null)
+            {
+                foreach(var _header in customHeaders)
+                {
+                    if (_httpRequest.Headers.Contains(_header.Key))
+                    {
+                        _httpRequest.Headers.Remove(_header.Key);
+                    }
+                    _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value);
+                }
+            }
+
+            // Serialize Request
+            string _requestContent = null;
+            // Set Credentials
+            if (Client.Credentials != null)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            }
+            // Send Request
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.SendRequest(_invocationId, _httpRequest);
+            }
+            cancellationToken.ThrowIfCancellationRequested();
+            _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false);
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse);
+            }
+            HttpStatusCode _statusCode = _httpResponse.StatusCode;
+            cancellationToken.ThrowIfCancellationRequested();
+            string _responseContent = null;
+            if ((int)_statusCode != 200)
+            {
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                try
+                {
+                    _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
+                    if (_errorBody != null)
+                    {
+                        ex.Body = _errorBody;
+                    }
+                }
+                catch (JsonException)
+                {
+                    // Ignore the exception
+                }
+                ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
+                ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
+                if (_shouldTrace)
+                {
+                    ServiceClientTracing.Error(_invocationId, ex);
+                }
+                _httpRequest.Dispose();
+                if (_httpResponse != null)
+                {
+                    _httpResponse.Dispose();
+                }
+                throw ex;
+            }
+            // Create Result
+            var _result = new AzureOperationResponse<IPage<WatchlistItem>>();
+            _result.Request = _httpRequest;
+            _result.Response = _httpResponse;
+            if (_httpResponse.Headers.Contains("x-ms-request-id"))
+            {
+                _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 200)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Page<WatchlistItem>>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            if (_shouldTrace)
+            {
+                ServiceClientTracing.Exit(_invocationId, _result);
+            }
+            return _result;
+        }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/WatchlistItemsOperationsExtensions.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/WatchlistItemsOperationsExtensions.cs
new file mode 100644
index 0000000000000..55f6121e25d80
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/WatchlistItemsOperationsExtensions.cs
@@ -0,0 +1,308 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Azure;
+    using Models;
+    using System.Threading;
+    using System.Threading.Tasks;
+
+    /// <summary>
+    /// Extension methods for WatchlistItemsOperations.
+    /// </summary>
+    public static partial class WatchlistItemsOperationsExtensions
+    {
+            /// <summary>
+            /// Get all watchlist Items.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='watchlistAlias'>
+            /// The watchlist alias
+            /// </param>
+            /// <param name='skipToken'>
+            /// Skiptoken is only used if a previous operation returned a partial result.
+            /// If a previous response contains a nextLink element, the value of the
+            /// nextLink element will include a skiptoken parameter that specifies a
+            /// starting point to use for subsequent calls. Optional.
+            /// </param>
+            public static IPage<WatchlistItem> List(this IWatchlistItemsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, string skipToken = default(string))
+            {
+                return operations.ListAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, watchlistAlias, skipToken).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Get all watchlist Items.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='watchlistAlias'>
+            /// The watchlist alias
+            /// </param>
+            /// <param name='skipToken'>
+            /// Skiptoken is only used if a previous operation returned a partial result.
+            /// If a previous response contains a nextLink element, the value of the
+            /// nextLink element will include a skiptoken parameter that specifies a
+            /// starting point to use for subsequent calls. Optional.
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<IPage<WatchlistItem>> ListAsync(this IWatchlistItemsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, string skipToken = default(string), CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.ListWithHttpMessagesAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, watchlistAlias, skipToken, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+            /// <summary>
+            /// Get a watchlist item.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='watchlistAlias'>
+            /// The watchlist alias
+            /// </param>
+            /// <param name='watchlistItemId'>
+            /// The watchlist item id (GUID)
+            /// </param>
+            public static WatchlistItem Get(this IWatchlistItemsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, string watchlistItemId)
+            {
+                return operations.GetAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, watchlistAlias, watchlistItemId).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Get a watchlist item.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='watchlistAlias'>
+            /// The watchlist alias
+            /// </param>
+            /// <param name='watchlistItemId'>
+            /// The watchlist item id (GUID)
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<WatchlistItem> GetAsync(this IWatchlistItemsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, string watchlistItemId, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, watchlistAlias, watchlistItemId, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+            /// <summary>
+            /// Delete a watchlist item.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='watchlistAlias'>
+            /// The watchlist alias
+            /// </param>
+            /// <param name='watchlistItemId'>
+            /// The watchlist item id (GUID)
+            /// </param>
+            public static void Delete(this IWatchlistItemsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, string watchlistItemId)
+            {
+                operations.DeleteAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, watchlistAlias, watchlistItemId).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Delete a watchlist item.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='watchlistAlias'>
+            /// The watchlist alias
+            /// </param>
+            /// <param name='watchlistItemId'>
+            /// The watchlist item id (GUID)
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task DeleteAsync(this IWatchlistItemsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, string watchlistItemId, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                (await operations.DeleteWithHttpMessagesAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, watchlistAlias, watchlistItemId, null, cancellationToken).ConfigureAwait(false)).Dispose();
+            }
+
+            /// <summary>
+            /// Create or update a watchlist item.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='watchlistAlias'>
+            /// The watchlist alias
+            /// </param>
+            /// <param name='watchlistItemId'>
+            /// The watchlist item id (GUID)
+            /// </param>
+            /// <param name='watchlistItem'>
+            /// The watchlist item
+            /// </param>
+            public static WatchlistItem CreateOrUpdate(this IWatchlistItemsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, string watchlistItemId, WatchlistItem watchlistItem)
+            {
+                return operations.CreateOrUpdateAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, watchlistAlias, watchlistItemId, watchlistItem).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Create or update a watchlist item.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='watchlistAlias'>
+            /// The watchlist alias
+            /// </param>
+            /// <param name='watchlistItemId'>
+            /// The watchlist item id (GUID)
+            /// </param>
+            /// <param name='watchlistItem'>
+            /// The watchlist item
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<WatchlistItem> CreateOrUpdateAsync(this IWatchlistItemsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, string watchlistItemId, WatchlistItem watchlistItem, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.CreateOrUpdateWithHttpMessagesAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, watchlistAlias, watchlistItemId, watchlistItem, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+            /// <summary>
+            /// Get all watchlist Items.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='nextPageLink'>
+            /// The NextLink from the previous successful call to List operation.
+            /// </param>
+            public static IPage<WatchlistItem> ListNext(this IWatchlistItemsOperations operations, string nextPageLink)
+            {
+                return operations.ListNextAsync(nextPageLink).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Get all watchlist Items.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='nextPageLink'>
+            /// The NextLink from the previous successful call to List operation.
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<IPage<WatchlistItem>> ListNextAsync(this IWatchlistItemsOperations operations, string nextPageLink, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.ListNextWithHttpMessagesAsync(nextPageLink, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+    }
+}
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/DataConnectorsOperations.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/WatchlistsOperations.cs
similarity index 78%
rename from sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/DataConnectorsOperations.cs
rename to sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/WatchlistsOperations.cs
index bd4235e711488..9b9dfc6a2f180 100644
--- a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/DataConnectorsOperations.cs
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/WatchlistsOperations.cs
@@ -23,12 +23,12 @@ namespace Microsoft.Azure.Management.SecurityInsights
     using System.Threading.Tasks;
 
     /// <summary>
-    /// DataConnectorsOperations operations.
+    /// WatchlistsOperations operations.
     /// </summary>
-    internal partial class DataConnectorsOperations : IServiceOperations<SecurityInsightsClient>, IDataConnectorsOperations
+    internal partial class WatchlistsOperations : IServiceOperations<SecurityInsightsClient>, IWatchlistsOperations
     {
         /// <summary>
-        /// Initializes a new instance of the DataConnectorsOperations class.
+        /// Initializes a new instance of the WatchlistsOperations class.
         /// </summary>
         /// <param name='client'>
         /// Reference to the service client.
@@ -36,7 +36,7 @@ internal partial class DataConnectorsOperations : IServiceOperations<SecurityIns
         /// <exception cref="System.ArgumentNullException">
         /// Thrown when a required parameter is null
         /// </exception>
-        internal DataConnectorsOperations(SecurityInsightsClient client)
+        internal WatchlistsOperations(SecurityInsightsClient client)
         {
             if (client == null)
             {
@@ -51,22 +51,31 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
         public SecurityInsightsClient Client { get; private set; }
 
         /// <summary>
-        /// Gets all data connectors.
+        /// Get all watchlists, without watchlist items.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
         /// </param>
+        /// <param name='skipToken'>
+        /// Skiptoken is only used if a previous operation returned a partial result.
+        /// If a previous response contains a nextLink element, the value of the
+        /// nextLink element will include a skiptoken parameter that specifies a
+        /// starting point to use for subsequent calls. Optional.
+        /// </param>
         /// <param name='customHeaders'>
         /// Headers that will be added to request.
         /// </param>
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -81,17 +90,28 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
         /// <return>
         /// A response object containing the response body and response headers.
         /// </return>
-        public async Task<AzureOperationResponse<IPage<DataConnector>>> ListWithHttpMessagesAsync(string resourceGroupName, string workspaceName, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        public async Task<AzureOperationResponse<IPage<Watchlist>>> ListWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string skipToken = default(string), Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -108,10 +128,10 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
+            }
+            if (operationalInsightsResourceProvider == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "operationalInsightsResourceProvider");
             }
             if (workspaceName == null)
             {
@@ -136,21 +156,28 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 _invocationId = ServiceClientTracing.NextInvocationId.ToString();
                 Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
                 tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("operationalInsightsResourceProvider", operationalInsightsResourceProvider);
                 tracingParameters.Add("workspaceName", workspaceName);
+                tracingParameters.Add("skipToken", skipToken);
                 tracingParameters.Add("cancellationToken", cancellationToken);
                 ServiceClientTracing.Enter(_invocationId, this, "List", tracingParameters);
             }
             // Construct URL
             var _baseUrl = Client.BaseUri.AbsoluteUri;
-            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors").ToString();
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists").ToString();
             _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
             _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{operationalInsightsResourceProvider}", System.Uri.EscapeDataString(operationalInsightsResourceProvider));
             _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
             List<string> _queryParameters = new List<string>();
             if (Client.ApiVersion != null)
             {
                 _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(Client.ApiVersion)));
             }
+            if (skipToken != null)
+            {
+                _queryParameters.Add(string.Format("$skipToken={0}", System.Uri.EscapeDataString(skipToken)));
+            }
             if (_queryParameters.Count > 0)
             {
                 _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters);
@@ -211,14 +238,13 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -228,10 +254,6 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -244,7 +266,7 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 throw ex;
             }
             // Create Result
-            var _result = new AzureOperationResponse<IPage<DataConnector>>();
+            var _result = new AzureOperationResponse<IPage<Watchlist>>();
             _result.Request = _httpRequest;
             _result.Response = _httpResponse;
             if (_httpResponse.Headers.Contains("x-ms-request-id"))
@@ -257,7 +279,7 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
                 try
                 {
-                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Page<DataConnector>>(_responseContent, Client.DeserializationSettings);
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Page<Watchlist>>(_responseContent, Client.DeserializationSettings);
                 }
                 catch (JsonException ex)
                 {
@@ -277,17 +299,20 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
         }
 
         /// <summary>
-        /// Gets a data connector.
+        /// Get a watchlist, without its watchlist items.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
         /// </param>
-        /// <param name='dataConnectorId'>
-        /// Connector ID
+        /// <param name='watchlistAlias'>
+        /// The watchlist alias
         /// </param>
         /// <param name='customHeaders'>
         /// Headers that will be added to request.
@@ -295,7 +320,7 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -310,17 +335,28 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
         /// <return>
         /// A response object containing the response body and response headers.
         /// </return>
-        public async Task<AzureOperationResponse<DataConnector>> GetWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string dataConnectorId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        public async Task<AzureOperationResponse<Watchlist>> GetWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -337,10 +373,10 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
+            }
+            if (operationalInsightsResourceProvider == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "operationalInsightsResourceProvider");
             }
             if (workspaceName == null)
             {
@@ -357,9 +393,9 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                     throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
                 }
             }
-            if (dataConnectorId == null)
+            if (watchlistAlias == null)
             {
-                throw new ValidationException(ValidationRules.CannotBeNull, "dataConnectorId");
+                throw new ValidationException(ValidationRules.CannotBeNull, "watchlistAlias");
             }
             // Tracing
             bool _shouldTrace = ServiceClientTracing.IsEnabled;
@@ -369,18 +405,20 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 _invocationId = ServiceClientTracing.NextInvocationId.ToString();
                 Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
                 tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("operationalInsightsResourceProvider", operationalInsightsResourceProvider);
                 tracingParameters.Add("workspaceName", workspaceName);
-                tracingParameters.Add("dataConnectorId", dataConnectorId);
+                tracingParameters.Add("watchlistAlias", watchlistAlias);
                 tracingParameters.Add("cancellationToken", cancellationToken);
                 ServiceClientTracing.Enter(_invocationId, this, "Get", tracingParameters);
             }
             // Construct URL
             var _baseUrl = Client.BaseUri.AbsoluteUri;
-            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}").ToString();
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists/{watchlistAlias}").ToString();
             _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
             _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{operationalInsightsResourceProvider}", System.Uri.EscapeDataString(operationalInsightsResourceProvider));
             _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
-            _url = _url.Replace("{dataConnectorId}", System.Uri.EscapeDataString(dataConnectorId));
+            _url = _url.Replace("{watchlistAlias}", System.Uri.EscapeDataString(watchlistAlias));
             List<string> _queryParameters = new List<string>();
             if (Client.ApiVersion != null)
             {
@@ -446,14 +484,13 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -463,10 +500,6 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -479,7 +512,7 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 throw ex;
             }
             // Create Result
-            var _result = new AzureOperationResponse<DataConnector>();
+            var _result = new AzureOperationResponse<Watchlist>();
             _result.Request = _httpRequest;
             _result.Response = _httpResponse;
             if (_httpResponse.Headers.Contains("x-ms-request-id"))
@@ -492,7 +525,7 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
                 try
                 {
-                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<DataConnector>(_responseContent, Client.DeserializationSettings);
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Watchlist>(_responseContent, Client.DeserializationSettings);
                 }
                 catch (JsonException ex)
                 {
@@ -512,20 +545,20 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
         }
 
         /// <summary>
-        /// Creates or updates the data connector.
+        /// Delete a watchlist.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
         /// </param>
-        /// <param name='dataConnectorId'>
-        /// Connector ID
-        /// </param>
-        /// <param name='dataConnector'>
-        /// The data connector
+        /// <param name='watchlistAlias'>
+        /// The watchlist alias
         /// </param>
         /// <param name='customHeaders'>
         /// Headers that will be added to request.
@@ -533,12 +566,9 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
-        /// <exception cref="SerializationException">
-        /// Thrown when unable to deserialize the response
-        /// </exception>
         /// <exception cref="ValidationException">
         /// Thrown when a required parameter is null
         /// </exception>
@@ -548,17 +578,28 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
         /// <return>
         /// A response object containing the response body and response headers.
         /// </return>
-        public async Task<AzureOperationResponse<DataConnector>> CreateOrUpdateWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string dataConnectorId, DataConnector dataConnector, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        public async Task<AzureOperationResponse> DeleteWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -575,10 +616,10 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
+            }
+            if (operationalInsightsResourceProvider == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "operationalInsightsResourceProvider");
             }
             if (workspaceName == null)
             {
@@ -595,13 +636,9 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                     throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
                 }
             }
-            if (dataConnectorId == null)
+            if (watchlistAlias == null)
             {
-                throw new ValidationException(ValidationRules.CannotBeNull, "dataConnectorId");
-            }
-            if (dataConnector == null)
-            {
-                throw new ValidationException(ValidationRules.CannotBeNull, "dataConnector");
+                throw new ValidationException(ValidationRules.CannotBeNull, "watchlistAlias");
             }
             // Tracing
             bool _shouldTrace = ServiceClientTracing.IsEnabled;
@@ -611,19 +648,20 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 _invocationId = ServiceClientTracing.NextInvocationId.ToString();
                 Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
                 tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("operationalInsightsResourceProvider", operationalInsightsResourceProvider);
                 tracingParameters.Add("workspaceName", workspaceName);
-                tracingParameters.Add("dataConnectorId", dataConnectorId);
-                tracingParameters.Add("dataConnector", dataConnector);
+                tracingParameters.Add("watchlistAlias", watchlistAlias);
                 tracingParameters.Add("cancellationToken", cancellationToken);
-                ServiceClientTracing.Enter(_invocationId, this, "CreateOrUpdate", tracingParameters);
+                ServiceClientTracing.Enter(_invocationId, this, "Delete", tracingParameters);
             }
             // Construct URL
             var _baseUrl = Client.BaseUri.AbsoluteUri;
-            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}").ToString();
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists/{watchlistAlias}").ToString();
             _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
             _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{operationalInsightsResourceProvider}", System.Uri.EscapeDataString(operationalInsightsResourceProvider));
             _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
-            _url = _url.Replace("{dataConnectorId}", System.Uri.EscapeDataString(dataConnectorId));
+            _url = _url.Replace("{watchlistAlias}", System.Uri.EscapeDataString(watchlistAlias));
             List<string> _queryParameters = new List<string>();
             if (Client.ApiVersion != null)
             {
@@ -636,7 +674,7 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
             // Create HTTP transport objects
             var _httpRequest = new HttpRequestMessage();
             HttpResponseMessage _httpResponse = null;
-            _httpRequest.Method = new HttpMethod("PUT");
+            _httpRequest.Method = new HttpMethod("DELETE");
             _httpRequest.RequestUri = new System.Uri(_url);
             // Set Headers
             if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
@@ -667,12 +705,6 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
 
             // Serialize Request
             string _requestContent = null;
-            if(dataConnector != null)
-            {
-                _requestContent = Rest.Serialization.SafeJsonConvert.SerializeObject(dataConnector, Client.SerializationSettings);
-                _httpRequest.Content = new StringContent(_requestContent, System.Text.Encoding.UTF8);
-                _httpRequest.Content.Headers.ContentType =System.Net.Http.Headers.MediaTypeHeaderValue.Parse("application/json; charset=utf-8");
-            }
             // Set Credentials
             if (Client.Credentials != null)
             {
@@ -693,16 +725,15 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
             HttpStatusCode _statusCode = _httpResponse.StatusCode;
             cancellationToken.ThrowIfCancellationRequested();
             string _responseContent = null;
-            if ((int)_statusCode != 200 && (int)_statusCode != 201)
+            if ((int)_statusCode != 200 && (int)_statusCode != 204)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -712,10 +743,6 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -728,49 +755,13 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 throw ex;
             }
             // Create Result
-            var _result = new AzureOperationResponse<DataConnector>();
+            var _result = new AzureOperationResponse();
             _result.Request = _httpRequest;
             _result.Response = _httpResponse;
             if (_httpResponse.Headers.Contains("x-ms-request-id"))
             {
                 _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
             }
-            // Deserialize Response
-            if ((int)_statusCode == 200)
-            {
-                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                try
-                {
-                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<DataConnector>(_responseContent, Client.DeserializationSettings);
-                }
-                catch (JsonException ex)
-                {
-                    _httpRequest.Dispose();
-                    if (_httpResponse != null)
-                    {
-                        _httpResponse.Dispose();
-                    }
-                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
-                }
-            }
-            // Deserialize Response
-            if ((int)_statusCode == 201)
-            {
-                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                try
-                {
-                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<DataConnector>(_responseContent, Client.DeserializationSettings);
-                }
-                catch (JsonException ex)
-                {
-                    _httpRequest.Dispose();
-                    if (_httpResponse != null)
-                    {
-                        _httpResponse.Dispose();
-                    }
-                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
-                }
-            }
             if (_shouldTrace)
             {
                 ServiceClientTracing.Exit(_invocationId, _result);
@@ -779,17 +770,25 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
         }
 
         /// <summary>
-        /// Delete the data connector.
+        /// Create or update a Watchlist and its Watchlist Items (bulk creation, e.g.
+        /// through text/csv content type). To create a Watchlist and its Items, we
+        /// should call this endpoint with rawContent and contentType properties.
         /// </summary>
         /// <param name='resourceGroupName'>
-        /// The name of the resource group within the user's subscription. The name is
-        /// case insensitive.
+        /// The name of the resource group. The name is case insensitive.
+        /// </param>
+        /// <param name='operationalInsightsResourceProvider'>
+        /// The namespace of workspaces resource provider-
+        /// Microsoft.OperationalInsights.
         /// </param>
         /// <param name='workspaceName'>
         /// The name of the workspace.
         /// </param>
-        /// <param name='dataConnectorId'>
-        /// Connector ID
+        /// <param name='watchlistAlias'>
+        /// The watchlist alias
+        /// </param>
+        /// <param name='watchlist'>
+        /// The watchlist
         /// </param>
         /// <param name='customHeaders'>
         /// Headers that will be added to request.
@@ -797,9 +796,12 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
+        /// <exception cref="SerializationException">
+        /// Thrown when unable to deserialize the response
+        /// </exception>
         /// <exception cref="ValidationException">
         /// Thrown when a required parameter is null
         /// </exception>
@@ -809,17 +811,28 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
         /// <return>
         /// A response object containing the response body and response headers.
         /// </return>
-        public async Task<AzureOperationResponse> DeleteWithHttpMessagesAsync(string resourceGroupName, string workspaceName, string dataConnectorId, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        public async Task<AzureOperationResponse<Watchlist>> CreateOrUpdateWithHttpMessagesAsync(string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, Watchlist watchlist, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
+            if (Client.ApiVersion == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.ApiVersion");
+            }
+            if (Client.ApiVersion != null)
+            {
+                if (Client.ApiVersion.Length < 1)
+                {
+                    throw new ValidationException(ValidationRules.MinLength, "Client.ApiVersion", 1);
+                }
+            }
             if (Client.SubscriptionId == null)
             {
                 throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId");
             }
             if (Client.SubscriptionId != null)
             {
-                if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"))
+                if (Client.SubscriptionId.Length < 1)
                 {
-                    throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+                    throw new ValidationException(ValidationRules.MinLength, "Client.SubscriptionId", 1);
                 }
             }
             if (resourceGroupName == null)
@@ -836,10 +849,10 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 {
                     throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1);
                 }
-                if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$"))
-                {
-                    throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$");
-                }
+            }
+            if (operationalInsightsResourceProvider == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "operationalInsightsResourceProvider");
             }
             if (workspaceName == null)
             {
@@ -856,9 +869,17 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                     throw new ValidationException(ValidationRules.MinLength, "workspaceName", 1);
                 }
             }
-            if (dataConnectorId == null)
+            if (watchlistAlias == null)
+            {
+                throw new ValidationException(ValidationRules.CannotBeNull, "watchlistAlias");
+            }
+            if (watchlist == null)
             {
-                throw new ValidationException(ValidationRules.CannotBeNull, "dataConnectorId");
+                throw new ValidationException(ValidationRules.CannotBeNull, "watchlist");
+            }
+            if (watchlist != null)
+            {
+                watchlist.Validate();
             }
             // Tracing
             bool _shouldTrace = ServiceClientTracing.IsEnabled;
@@ -868,18 +889,21 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 _invocationId = ServiceClientTracing.NextInvocationId.ToString();
                 Dictionary<string, object> tracingParameters = new Dictionary<string, object>();
                 tracingParameters.Add("resourceGroupName", resourceGroupName);
+                tracingParameters.Add("operationalInsightsResourceProvider", operationalInsightsResourceProvider);
                 tracingParameters.Add("workspaceName", workspaceName);
-                tracingParameters.Add("dataConnectorId", dataConnectorId);
+                tracingParameters.Add("watchlistAlias", watchlistAlias);
+                tracingParameters.Add("watchlist", watchlist);
                 tracingParameters.Add("cancellationToken", cancellationToken);
-                ServiceClientTracing.Enter(_invocationId, this, "Delete", tracingParameters);
+                ServiceClientTracing.Enter(_invocationId, this, "CreateOrUpdate", tracingParameters);
             }
             // Construct URL
             var _baseUrl = Client.BaseUri.AbsoluteUri;
-            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}").ToString();
+            var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists/{watchlistAlias}").ToString();
             _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId));
             _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName));
+            _url = _url.Replace("{operationalInsightsResourceProvider}", System.Uri.EscapeDataString(operationalInsightsResourceProvider));
             _url = _url.Replace("{workspaceName}", System.Uri.EscapeDataString(workspaceName));
-            _url = _url.Replace("{dataConnectorId}", System.Uri.EscapeDataString(dataConnectorId));
+            _url = _url.Replace("{watchlistAlias}", System.Uri.EscapeDataString(watchlistAlias));
             List<string> _queryParameters = new List<string>();
             if (Client.ApiVersion != null)
             {
@@ -892,7 +916,7 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
             // Create HTTP transport objects
             var _httpRequest = new HttpRequestMessage();
             HttpResponseMessage _httpResponse = null;
-            _httpRequest.Method = new HttpMethod("DELETE");
+            _httpRequest.Method = new HttpMethod("PUT");
             _httpRequest.RequestUri = new System.Uri(_url);
             // Set Headers
             if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value)
@@ -923,6 +947,12 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
 
             // Serialize Request
             string _requestContent = null;
+            if(watchlist != null)
+            {
+                _requestContent = Rest.Serialization.SafeJsonConvert.SerializeObject(watchlist, Client.SerializationSettings);
+                _httpRequest.Content = new StringContent(_requestContent, System.Text.Encoding.UTF8);
+                _httpRequest.Content.Headers.ContentType =System.Net.Http.Headers.MediaTypeHeaderValue.Parse("application/json; charset=utf-8");
+            }
             // Set Credentials
             if (Client.Credentials != null)
             {
@@ -943,16 +973,15 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
             HttpStatusCode _statusCode = _httpResponse.StatusCode;
             cancellationToken.ThrowIfCancellationRequested();
             string _responseContent = null;
-            if ((int)_statusCode != 200 && (int)_statusCode != 204)
+            if ((int)_statusCode != 200 && (int)_statusCode != 201)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -962,10 +991,6 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -978,13 +1003,49 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 throw ex;
             }
             // Create Result
-            var _result = new AzureOperationResponse();
+            var _result = new AzureOperationResponse<Watchlist>();
             _result.Request = _httpRequest;
             _result.Response = _httpResponse;
             if (_httpResponse.Headers.Contains("x-ms-request-id"))
             {
                 _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
             }
+            // Deserialize Response
+            if ((int)_statusCode == 200)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Watchlist>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
+            // Deserialize Response
+            if ((int)_statusCode == 201)
+            {
+                _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
+                try
+                {
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Watchlist>(_responseContent, Client.DeserializationSettings);
+                }
+                catch (JsonException ex)
+                {
+                    _httpRequest.Dispose();
+                    if (_httpResponse != null)
+                    {
+                        _httpResponse.Dispose();
+                    }
+                    throw new SerializationException("Unable to deserialize the response.", _responseContent, ex);
+                }
+            }
             if (_shouldTrace)
             {
                 ServiceClientTracing.Exit(_invocationId, _result);
@@ -993,7 +1054,7 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
         }
 
         /// <summary>
-        /// Gets all data connectors.
+        /// Get all watchlists, without watchlist items.
         /// </summary>
         /// <param name='nextPageLink'>
         /// The NextLink from the previous successful call to List operation.
@@ -1004,7 +1065,7 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
         /// <param name='cancellationToken'>
         /// The cancellation token.
         /// </param>
-        /// <exception cref="CloudException">
+        /// <exception cref="ErrorResponseException">
         /// Thrown when the operation returned an invalid status code
         /// </exception>
         /// <exception cref="SerializationException">
@@ -1019,7 +1080,7 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
         /// <return>
         /// A response object containing the response body and response headers.
         /// </return>
-        public async Task<AzureOperationResponse<IPage<DataConnector>>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
+        public async Task<AzureOperationResponse<IPage<Watchlist>>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary<string, List<string>> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken))
         {
             if (nextPageLink == null)
             {
@@ -1100,14 +1161,13 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
             string _responseContent = null;
             if ((int)_statusCode != 200)
             {
-                var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
+                var ex = new ErrorResponseException(string.Format("Operation returned an invalid status code '{0}'", _statusCode));
                 try
                 {
                     _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
-                    CloudError _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<CloudError>(_responseContent, Client.DeserializationSettings);
+                    ErrorResponse _errorBody =  Rest.Serialization.SafeJsonConvert.DeserializeObject<ErrorResponse>(_responseContent, Client.DeserializationSettings);
                     if (_errorBody != null)
                     {
-                        ex = new CloudException(_errorBody.Message);
                         ex.Body = _errorBody;
                     }
                 }
@@ -1117,10 +1177,6 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 }
                 ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent);
                 ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent);
-                if (_httpResponse.Headers.Contains("x-ms-request-id"))
-                {
-                    ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault();
-                }
                 if (_shouldTrace)
                 {
                     ServiceClientTracing.Error(_invocationId, ex);
@@ -1133,7 +1189,7 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 throw ex;
             }
             // Create Result
-            var _result = new AzureOperationResponse<IPage<DataConnector>>();
+            var _result = new AzureOperationResponse<IPage<Watchlist>>();
             _result.Request = _httpRequest;
             _result.Response = _httpResponse;
             if (_httpResponse.Headers.Contains("x-ms-request-id"))
@@ -1146,7 +1202,7 @@ internal DataConnectorsOperations(SecurityInsightsClient client)
                 _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
                 try
                 {
-                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Page<DataConnector>>(_responseContent, Client.DeserializationSettings);
+                    _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject<Page<Watchlist>>(_responseContent, Client.DeserializationSettings);
                 }
                 catch (JsonException ex)
                 {
diff --git a/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/WatchlistsOperationsExtensions.cs b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/WatchlistsOperationsExtensions.cs
new file mode 100644
index 0000000000000..27d3f70eaa474
--- /dev/null
+++ b/sdk/securityinsights/Microsoft.Azure.Management.SecurityInsights/src/Generated/WatchlistsOperationsExtensions.cs
@@ -0,0 +1,288 @@
+// <auto-generated>
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for
+// license information.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is
+// regenerated.
+// </auto-generated>
+
+namespace Microsoft.Azure.Management.SecurityInsights
+{
+    using Microsoft.Rest;
+    using Microsoft.Rest.Azure;
+    using Models;
+    using System.Threading;
+    using System.Threading.Tasks;
+
+    /// <summary>
+    /// Extension methods for WatchlistsOperations.
+    /// </summary>
+    public static partial class WatchlistsOperationsExtensions
+    {
+            /// <summary>
+            /// Get all watchlists, without watchlist items.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='skipToken'>
+            /// Skiptoken is only used if a previous operation returned a partial result.
+            /// If a previous response contains a nextLink element, the value of the
+            /// nextLink element will include a skiptoken parameter that specifies a
+            /// starting point to use for subsequent calls. Optional.
+            /// </param>
+            public static IPage<Watchlist> List(this IWatchlistsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string skipToken = default(string))
+            {
+                return operations.ListAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, skipToken).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Get all watchlists, without watchlist items.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='skipToken'>
+            /// Skiptoken is only used if a previous operation returned a partial result.
+            /// If a previous response contains a nextLink element, the value of the
+            /// nextLink element will include a skiptoken parameter that specifies a
+            /// starting point to use for subsequent calls. Optional.
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<IPage<Watchlist>> ListAsync(this IWatchlistsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string skipToken = default(string), CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.ListWithHttpMessagesAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, skipToken, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+            /// <summary>
+            /// Get a watchlist, without its watchlist items.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='watchlistAlias'>
+            /// The watchlist alias
+            /// </param>
+            public static Watchlist Get(this IWatchlistsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias)
+            {
+                return operations.GetAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, watchlistAlias).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Get a watchlist, without its watchlist items.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='watchlistAlias'>
+            /// The watchlist alias
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<Watchlist> GetAsync(this IWatchlistsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, watchlistAlias, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+            /// <summary>
+            /// Delete a watchlist.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='watchlistAlias'>
+            /// The watchlist alias
+            /// </param>
+            public static void Delete(this IWatchlistsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias)
+            {
+                operations.DeleteAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, watchlistAlias).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Delete a watchlist.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='watchlistAlias'>
+            /// The watchlist alias
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task DeleteAsync(this IWatchlistsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                (await operations.DeleteWithHttpMessagesAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, watchlistAlias, null, cancellationToken).ConfigureAwait(false)).Dispose();
+            }
+
+            /// <summary>
+            /// Create or update a Watchlist and its Watchlist Items (bulk creation, e.g.
+            /// through text/csv content type). To create a Watchlist and its Items, we
+            /// should call this endpoint with rawContent and contentType properties.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='watchlistAlias'>
+            /// The watchlist alias
+            /// </param>
+            /// <param name='watchlist'>
+            /// The watchlist
+            /// </param>
+            public static Watchlist CreateOrUpdate(this IWatchlistsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, Watchlist watchlist)
+            {
+                return operations.CreateOrUpdateAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, watchlistAlias, watchlist).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Create or update a Watchlist and its Watchlist Items (bulk creation, e.g.
+            /// through text/csv content type). To create a Watchlist and its Items, we
+            /// should call this endpoint with rawContent and contentType properties.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='resourceGroupName'>
+            /// The name of the resource group. The name is case insensitive.
+            /// </param>
+            /// <param name='operationalInsightsResourceProvider'>
+            /// The namespace of workspaces resource provider-
+            /// Microsoft.OperationalInsights.
+            /// </param>
+            /// <param name='workspaceName'>
+            /// The name of the workspace.
+            /// </param>
+            /// <param name='watchlistAlias'>
+            /// The watchlist alias
+            /// </param>
+            /// <param name='watchlist'>
+            /// The watchlist
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<Watchlist> CreateOrUpdateAsync(this IWatchlistsOperations operations, string resourceGroupName, string operationalInsightsResourceProvider, string workspaceName, string watchlistAlias, Watchlist watchlist, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.CreateOrUpdateWithHttpMessagesAsync(resourceGroupName, operationalInsightsResourceProvider, workspaceName, watchlistAlias, watchlist, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+            /// <summary>
+            /// Get all watchlists, without watchlist items.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='nextPageLink'>
+            /// The NextLink from the previous successful call to List operation.
+            /// </param>
+            public static IPage<Watchlist> ListNext(this IWatchlistsOperations operations, string nextPageLink)
+            {
+                return operations.ListNextAsync(nextPageLink).GetAwaiter().GetResult();
+            }
+
+            /// <summary>
+            /// Get all watchlists, without watchlist items.
+            /// </summary>
+            /// <param name='operations'>
+            /// The operations group for this extension method.
+            /// </param>
+            /// <param name='nextPageLink'>
+            /// The NextLink from the previous successful call to List operation.
+            /// </param>
+            /// <param name='cancellationToken'>
+            /// The cancellation token.
+            /// </param>
+            public static async Task<IPage<Watchlist>> ListNextAsync(this IWatchlistsOperations operations, string nextPageLink, CancellationToken cancellationToken = default(CancellationToken))
+            {
+                using (var _result = await operations.ListNextWithHttpMessagesAsync(nextPageLink, null, cancellationToken).ConfigureAwait(false))
+                {
+                    return _result.Body;
+                }
+            }
+
+    }
+}