Microsoft.Azure.Management.Security.Models Namespace

Defines values for AadConnectivityState.

Describes an Azure resource with kind

Represents an AAD identity protection solution which sends logs to an OMS workspace.

The external security solution properties for AAD solutions

Defines values for ActionType.

Number of active connections is not in allowed range.

Represents a machines group and set of rules to be allowed running on a machine

Represents a list of VM/server groups and set of rules that are Recommended by Microsoft Defender for Cloud to be allowed

Represents a summary of the alerts of the machine group

The resource whose properties describes the Adaptive Network Hardening settings for some Azure resource

Adaptive Network Hardening resource properties

Details of the sub-assessment

Defines values for AdditionalWorkspaceDataType.

Properties of the additional workspaces.

Defines values for AdditionalWorkspaceType.

The Advanced Threat Protection settings.

The Advanced Threat Protection resource.

Security alert

Changing set of properties depending on the entity type.

describes security alert properties.

Changing set of properties depending on the supportingEvidence type.

Defines values for AlertSeverity.

Simulate alerts according to this bundles.

Alert Simulator request body.

Describes properties of an alert simulation request

Describes the suppression rule

describes AlertsSuppressionRule properties

Defines values for AlertStatus.

The alert sync setting properties

Represents an alert sync setting

The resource whose properties describes the allowed traffic between Azure resources

Describes the allowed traffic between Azure resources

A custom alert rule that checks if a value (depends on the custom alert type) is allowed.

Number of cloud to device messages (AMQP protocol) is not in allowed range.

Number of rejected cloud to device messages (AMQP protocol) is not in allowed range.

Number of device to cloud messages (AMQP protocol) is not in allowed range.

Security Application over a given scope

Application's condition

Defines values for ApplicationConditionOperator.

Describes properties of an application

Defines values for ApplicationSourceResourceType.

The ASC location of the subscription is in the "name" field

Defines values for AssessedResourceType.

Links relevant to the assessment

The result of the assessment

Defines values for AssessmentStatusCode.

The result of the assessment

Defines values for AssessmentType.

Represents an ATA security solution which sends logs to an OMS workspace

The external security solution properties for ATA solutions

Settings for cloud authentication management

Defines values for AuthenticationProvisioningState.

Defines values for AuthenticationType.

The security automation resource.

The action that should be triggered.

The target Event Hub to which event data will be exported. To learn more about Microsoft Defender for Cloud continuous export capabilities, visit https://aka.ms/ASCExportLearnMore

The logic app action that should be triggered. To learn more about Microsoft Defender for Cloud's Workflow Automation capabilities, visit https://aka.ms/ASCWorkflowAutomationLearnMore

The Log Analytics Workspace to which event data will be exported. Security alerts data will reside in the 'SecurityAlert' table and the assessments data will reside in the 'SecurityRecommendation' table (under the 'Security'/'SecurityCenterFree' solutions). Note that in order to view the data in the workspace, the Security Center Log Analytics free/standard solution needs to be enabled on that workspace. To learn more about Microsoft Defender for Cloud continuous export capabilities, visit https://aka.ms/ASCExportLearnMore

A set of properties that defines the behavior of the automation configuration. To learn more about the supported security events data models schemas - please visit https://aka.ms/ASCAutomationSchemas.

A rule set which evaluates all its rules upon an event interception. Only when all the included rules in the rule set will be evaluated as 'true', will the event trigger the defined actions.

A single automation scope.

The source event types which evaluate the security automation set of rules. For example - security alerts and security assessments. To learn more about the supported security events data models schemas - please visit https://aka.ms/ASCAutomationSchemas.

A rule which is evaluated upon event interception. The rule is configured by comparing a specific value from the event model to an expected value. This comparison is done by using one of the supported operators set.

The security automation model state property bag.

Defines values for AutoProvision.

Auto provisioning setting

describes properties of an auto provisioning setting

AWS cloud account connector based assume role, the role enables delegating access to your AWS resources. The role is composed of role Amazon Resource Name (ARN) and external ID. For more details, refer to <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html">Creating a Role to Delegate Permissions to an IAM User (write only)</a>

AWS cloud account connector based credentials, the credentials is composed of access key ID and secret key, for more details, refer to <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html">Creating an IAM User in Your AWS Account (write only)</a>

The aws connector environment data

The awsOrganization data

The awsOrganization data for the master account

The awsOrganization data for the member account

The AzureDevOps scope connector's environment data

Details of the Azure resource that was assessed

Azure resource identifier.

Describes an Azure resource with kind

Describes an Azure resource with location

Baseline details.

The rule result adjusted with baseline.

The benchmark references.

Defines values for BundleType.

Defines values for Categories.

Represents a security solution which sends CEF logs to an OMS workspace

The external security solution properties for CEF solutions

Defines values for CloudName.

The security offering details

Defines values for Code.

Compliance of a scope

The Compliance score (percentage) of a Subscription is a sum of all Resources' Compliances under the given Subscription. A Resource Compliance is defined as the compliant ('healthy') Policy Definitions out of all Policy Definitions applicable to a given resource.

a compliance result

Compliance result data

A segment of a compliance assessment.

Governance rule's condition

Describes the allowed inbound and outbound traffic of an Azure resource

Describes properties of a connected resource

Represents an OMS workspace to which the solution is connected

Inbound connection from an ip that isn't allowed. Allow list consists of ipv4 or ipv6 range in CIDR notation.

Connection string for ingesting security data and logs

Outbound connection to an ip that isn't allowed. Allow list consists of ipv4 or ipv6 range in CIDR notation.

Defines values for ConnectionType.

The connector setting

Describes properties of a connector setting

Additional context fields for container registry Vulnerability assessment

Defines values for ControlType.

Defines values for CreatedByType.

The CSPM monitoring for AWS offering

The native cloud connection configuration

The CSPM monitoring for AzureDevOps offering

The CSPM monitoring for GCP offering

The native cloud connection configuration

The CSPM monitoring for github offering

A custom alert rule.

Custom Assessment Automation

describes the Custom Assessment Automation properties

Custom Assessment Automation request

describes the Custom Assessment Automation properties

Custom entity store assignment

describes the custom entity store assignment properties

describes the custom entity store assignment request

describes properties of custom entity store assignment request

CVE details

CVSS details

The data export setting properties

Represents a data export setting

Defines values for DataSource.

The CSPM P1 for Aws offering

The Microsoft Defender for Server VM scanning configuration

configuration for Microsoft Defender for Server VM scanning

The CSPM P1 for GCP offering

The Defender for Databases AWS offering

The ARC autoprovisioning configuration

The RDS configuration

The Defender for Containers AWS offering

The cloudwatch to kinesis connection configuration

The container vulnerability assessment configuration

The container vulnerability assessment task configuration

The kinesis to s3 connection configuration

The kubernetes to scuba connection configuration

The kubernetes service connection configuration

The containers GCP offering

The native cloud connection configuration

The native cloud connection configuration

The Defender for Databases GCP offering configurations

The ARC autoprovisioning configuration

The native cloud connection configuration

The Defender for DevOps for Azure DevOps offering

The Defender for DevOps for Github offering

The Defender for Servers AWS offering

The ARC autoprovisioning configuration

The Defender for servers connection configuration

The Microsoft Defender for Endpoint autoprovisioning configuration

configuration for the servers offering subPlan

The Vulnerability Assessment autoprovisioning configuration

configuration for Vulnerability Assessment autoprovisioning

The Microsoft Defender for Server VM scanning configuration

configuration for Microsoft Defender for Server VM scanning

The Defender for Servers GCP offering configurations

The ARC autoprovisioning configuration

The Defender for servers connection configuration

The Microsoft Defender for Endpoint autoprovisioning configuration

configuration for the servers offering subPlan

The Vulnerability Assessment autoprovisioning configuration

configuration for Vulnerability Assessment autoprovisioning

A custom alert rule that checks if a value (depends on the custom alert type) is denied.

The device security group resource

describes properties of a security group.

Defines values for Direction.

Number of direct method invokes is not in allowed range.

Describes the Network Security Groups effective on a network interface

Defines values for EndOfSupportStatus.

The security connector environment data.

Defines values for EnvironmentType.

The resource management error additional info.

Entity tag is used for comparing two or more entities from the same requested resource.

Defines values for EventSource.

Governance rule execution parameters

Defines values for ExpandControlsEnum.

Defines values for ExpandEnum.

Defines values for ExportData.

A plan's extension properties

Represents a security solution external to Microsoft Defender for Cloud which sends information to an OMS workspace and whose data is displayed by Microsoft Defender for Cloud.

Defines values for ExternalSecuritySolutionKind.

Describes an Azure resource with kind

The solution properties (correspond to the solution kind)

Number of failed local logins is not in allowed range.

Number of file uploads is not in allowed range.

GCP cloud account connector based service to service credentials, the credentials are composed of the organization ID and a JSON API key (write only)

The gcpOrganization data

The gcpOrganization data for the member account

The gcpOrganization data for the parent account

The details about the project represented by the security connector

The GCP project connector environment data

The github scope connector's environment data

Governance assignment over a given scope

Describe the additional data of governance assignment - optional

Describes properties of an governance assignment

The governance email weekly notification configuration.

Governance rule over a given scope

Defines values for GovernanceRuleConditionOperator.

The governance email weekly notification configuration

The governance rule metadata

Describe the owner source of governance rule

Defines values for GovernanceRuleOwnerSourceType.

Describes properties of an governance rule

Defines values for GovernanceRuleSourceResourceType.

Defines values for GovernanceRuleType.

Number of cloud to device messages (HTTP protocol) is not in allowed range.

Number of rejected cloud to device messages (HTTP protocol) is not in allowed range.

Number of device to cloud messages (HTTP protocol) is not in allowed range.

Defines values for HybridComputeProvisioningState.

Settings for hybrid compute management

Defines values for ImplementationEffort.

The information protection for AWS offering

The native cloud connection configuration

The information type keyword.

Information protection policy.

Defines values for InformationProtectionPolicyName.

describes properties of an information protection policy.

The information type.

Connection string for ingesting security data and logs

Configures how to correlate scan data and logs with resources associated with the subscription.

Configures how to correlate scan data and logs with resources associated with the subscription.

Defines values for Intent.

Security Solution Aggregated Alert information

IoT Security solution aggregated alert details.

IoT Security solution recommendation information.

IoT Security solution aggregated recommendation information

Statistical information about the number of alerts per device during last set number of days.

Statistical information about the number of alerts per alert type during last set number of days

Statistical information about the number of recommendations per device, per recommendation type.

Security analytics of your IoT Security solution

List of Security analytics of your IoT Security solution

Security analytics properties of your IoT Security solution

IoT Security solution configuration and resource information.

Security Solution setting data

IoT Security solution analytics severity metrics.

Defines values for IsEnabled.

Defines values for Kind.

Describes an Azure resource with kind

A List custom alert rule.

Login by a local user that isn't allowed. Allow list consists of login names to allow.

Describes an Azure resource with location

Represents a Log Analytics workspace scope identifier.

The resource of the configuration or data needed to onboard the machine to MDE

List of all MDE onboarding data resources

Properties of the MDE configuration or data parameter needed to onboard the machine to MDE

Defines values for MinimalSeverity.

Number of cloud to device messages (MQTT protocol) is not in allowed range.

Number of rejected cloud to device messages (MQTT protocol) is not in allowed range.

Number of device to cloud messages (MQTT protocol) is not in allowed range.

Defines values for OfferingType.

Details of the On Premise resource that was assessed

Details of the On Premise Sql resource that was assessed

Possible operation in the REST API of Microsoft.Security

Security operation display

Defines values for OperationResult.

Long run operation status of governance rule over a given scope

A status describing the success/failure of the extension's enablement/disablement operation.

Defines values for Operator.

Defines values for OrganizationMembershipType.

Defines a page in Azure responses.

Represents a path that is recommended to be allowed and its properties

Defines values for PermissionProperty.

Microsoft Defender for Cloud is provided in two pricing tiers: free and standard. The standard tier offers advanced security capabilities, while the free tier offers basic security features.

List of pricing configurations response.

Pricing properties for the relevant scope

Defines values for PricingTier.

Execution of a process that isn't allowed. Allow list consists of process names to allow.

Defines values for PropertyType.

The protection mode of the collection/file types. Exe/Msi/Script are used for Windows, Executable is used for Linux.

Defines values for Protocol.

Defines values for ProvisioningState.

For a non-Azure machine that is not connected directly to the internet, specify a proxy server that the non-Azure machine can use.

Represents the publisher information of a process/rule

The rule query details.

Number of device queue purges is not in allowed range.

Defines values for RecommendationConfigStatus.

The type of IoT Security recommendation.

Defines values for RecommendationType.

Regulatory compliance assessment details and state

Regulatory compliance assessment data

Regulatory compliance control details and state

Regulatory compliance control data

Regulatory compliance standard details and state

Regulatory compliance standard data

Remediation details.

The ETA (estimated time of arrival) for remediation

Defines values for ReportedSeverity.

Describes an Azure resource.

Details of the resource that was assessed

A resource identifier for an alert which can be used to direct the alert to the right product exposure group (tenant, workspace, subscription etc.).

Defines values for ResourceIdentifierType.

Defines values for ResourceStatus.

Defines values for Roles.

Describes remote addresses that is recommended to communicate with the Azure resource on some (Protocol, Port, Direction). All other remote addresses are recommended to be blocked

Rule results.

Rule results input.

Rule results properties.

Defines values for RuleSeverity.

A list of rules results.

Rules results input.

Defines values for RuleStatus.

Defines values for RuleType.

A vulnerability assessment scan record.

Defines values for ScanningMode.

A vulnerability assessment scan record properties.

A vulnerability assessment scan result for a single rule.

A vulnerability assessment scan result properties for a single rule.

A list of vulnerability assessment scan results.

A list of vulnerability assessment scan records.

Defines values for ScanState.

Defines values for ScanTriggerType.

A more specific scope used to identify the alerts to suppress.

Calculation result data

Information about the security control.

Security Control Definition Properties.

The type of the security control (For example, BuiltIn)

Details of the security control, its score, and the health status of the relevant resources.

Calculation result data

Calculation result data in control level

Secure score item data model

Describes properties of a calculated secure score.

Defines values for SecurityAlertNotificationByRoleState.

Defines values for SecurityAlertNotificationState.

Security assessment on a resource

Security assessment metadata

Describes the partner that created the assessment

Describes properties of an assessment metadata.

Describes properties of an assessment metadata response.

Security assessment metadata response

Data regarding 3rd party partner integration

Describes properties of an assessment.

Describes properties of an assessment.

Describes properties of an assessment.

Security assessment on a resource - response format

The security connector resource.

A set of properties that defines the security connector configuration.

Contact details and configurations for notifications coming from Microsoft Defender for Cloud.

Describes security contact properties

Defines whether to send email notifications about new security alerts

Defines whether to send email notifications from Microsoft Defender for Cloud to persons with specific RBAC roles on the subscription.

Defines values for SecurityFamily.

Defines values for SecuritySolutionStatus.

Security sub-assessment on a resource

Describes properties of an sub-assessment.

Security task that we recommend to do in order to strengthen security

Changing set of properties, depending on the task type that is derived from the name field

Describes properties of a task.

The sensitivity label.

Describes the server vulnerability assessment details on a resource

describes ServerVulnerabilityAssessment properties.

List of server vulnerability assessments

Additional context fields for server vulnerability assessment

Details of the service principal.

The kind of the security setting

Defines values for SettingKind.

Defines values for SettingName.

Defines values for Severity.

Defines values for SeverityEnum.

Represents a software data

Software Inventory resource properties

Defines values for Source.

Details of the resource that was assessed

Defines values for State.

Defines values for Status.

Defines values for StatusReason.

Status of the sub-assessment

Defines values for SubAssessmentStatusCode.

Defines values for SubPlan.

Defines values for SupportedCloudEnum.

Metadata pertaining to creation and last modification of the resource.

Defines values for Tactics.

A list of key value pairs that describe the resource.

A container holding only the Tags for a resource, allowing the user to update the tags.

Defines values for TaskUpdateActionType.

Defines values for Techniques.

Defines values for Threats.

A custom alert rule that checks if a value (depends on the custom alert type) is within the given range.

A custom alert rule that checks if the number of activities (depends on the custom alert type) in a time window is within the given range.

Describes an Azure tracked resource.

Defines values for TransportProtocol.

Number of twin updates is not in allowed range.

Defines values for Type.

Number of unauthorized operations is not in allowed range.

Defines values for UnmaskedIpLoggingStatus.

Update Security Solution setting data

Properties of the IoT Security solution's user defined resources.

Defines values for UserImpact.

Represents a user that is recommended to be allowed for a certain rule

Defines values for ValueType.

vulnerability assessment rule metadata details.

Vendor reference

Represents a machine that is part of a machine group

Configures where to store the OMS agent data for workspaces under a scope

Workspace setting data

Defines values for AdaptiveNetworkHardeningEnforceAction.

Defines values for AdvancedThreatProtectionSettingName.

Defines values for JitNetworkAccessPolicyInitiateType.

Defines values for Rank.

Defines values for RuleState.

Defines values for ServerVulnerabilityAssessmentName.