1package securityinsight 2 3// Copyright (c) Microsoft Corporation. All rights reserved. 4// Licensed under the MIT License. See License.txt in the project root for license information. 5// 6// Code generated by Microsoft (R) AutoRest Code Generator. 7// Changes may cause incorrect behavior and will be lost if the code is regenerated. 8 9import ( 10 "context" 11 "encoding/json" 12 "github.com/Azure/go-autorest/autorest" 13 "github.com/Azure/go-autorest/autorest/date" 14 "github.com/Azure/go-autorest/autorest/to" 15 "github.com/Azure/go-autorest/tracing" 16 "github.com/gofrs/uuid" 17 "net/http" 18) 19 20// The package's fully qualified name. 21const fqdn = "github.com/Azure/azure-sdk-for-go/services/securityinsight/mgmt/v1.0/securityinsight" 22 23// AADDataConnector represents AAD (Azure Active Directory) data connector. 24type AADDataConnector struct { 25 // AADDataConnectorProperties - AAD (Azure Active Directory) data connector properties. 26 *AADDataConnectorProperties `json:"properties,omitempty"` 27 // ID - READ-ONLY; Azure resource Id 28 ID *string `json:"id,omitempty"` 29 // Name - READ-ONLY; Azure resource name 30 Name *string `json:"name,omitempty"` 31 // Type - READ-ONLY; Azure resource type 32 Type *string `json:"type,omitempty"` 33 // Etag - Etag of the azure resource 34 Etag *string `json:"etag,omitempty"` 35 // Kind - Possible values include: 'KindDataConnector', 'KindAzureActiveDirectory', 'KindAzureAdvancedThreatProtection', 'KindAzureSecurityCenter', 'KindAmazonWebServicesCloudTrail', 'KindMicrosoftCloudAppSecurity', 'KindMicrosoftDefenderAdvancedThreatProtection', 'KindOffice365', 'KindThreatIntelligence' 36 Kind KindBasicDataConnector `json:"kind,omitempty"` 37} 38 39// MarshalJSON is the custom marshaler for AADDataConnector. 40func (adc AADDataConnector) MarshalJSON() ([]byte, error) { 41 adc.Kind = KindAzureActiveDirectory 42 objectMap := make(map[string]interface{}) 43 if adc.AADDataConnectorProperties != nil { 44 objectMap["properties"] = adc.AADDataConnectorProperties 45 } 46 if adc.Kind != "" { 47 objectMap["kind"] = adc.Kind 48 } 49 if adc.Etag != nil { 50 objectMap["etag"] = adc.Etag 51 } 52 return json.Marshal(objectMap) 53} 54 55// AsAADDataConnector is the BasicDataConnector implementation for AADDataConnector. 56func (adc AADDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 57 return &adc, true 58} 59 60// AsAATPDataConnector is the BasicDataConnector implementation for AADDataConnector. 61func (adc AADDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 62 return nil, false 63} 64 65// AsASCDataConnector is the BasicDataConnector implementation for AADDataConnector. 66func (adc AADDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 67 return nil, false 68} 69 70// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for AADDataConnector. 71func (adc AADDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 72 return nil, false 73} 74 75// AsMCASDataConnector is the BasicDataConnector implementation for AADDataConnector. 76func (adc AADDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 77 return nil, false 78} 79 80// AsMDATPDataConnector is the BasicDataConnector implementation for AADDataConnector. 81func (adc AADDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 82 return nil, false 83} 84 85// AsOfficeDataConnector is the BasicDataConnector implementation for AADDataConnector. 86func (adc AADDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 87 return nil, false 88} 89 90// AsTIDataConnector is the BasicDataConnector implementation for AADDataConnector. 91func (adc AADDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 92 return nil, false 93} 94 95// AsDataConnector is the BasicDataConnector implementation for AADDataConnector. 96func (adc AADDataConnector) AsDataConnector() (*DataConnector, bool) { 97 return nil, false 98} 99 100// AsBasicDataConnector is the BasicDataConnector implementation for AADDataConnector. 101func (adc AADDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 102 return &adc, true 103} 104 105// UnmarshalJSON is the custom unmarshaler for AADDataConnector struct. 106func (adc *AADDataConnector) UnmarshalJSON(body []byte) error { 107 var m map[string]*json.RawMessage 108 err := json.Unmarshal(body, &m) 109 if err != nil { 110 return err 111 } 112 for k, v := range m { 113 switch k { 114 case "properties": 115 if v != nil { 116 var aADDataConnectorProperties AADDataConnectorProperties 117 err = json.Unmarshal(*v, &aADDataConnectorProperties) 118 if err != nil { 119 return err 120 } 121 adc.AADDataConnectorProperties = &aADDataConnectorProperties 122 } 123 case "kind": 124 if v != nil { 125 var kind KindBasicDataConnector 126 err = json.Unmarshal(*v, &kind) 127 if err != nil { 128 return err 129 } 130 adc.Kind = kind 131 } 132 case "id": 133 if v != nil { 134 var ID string 135 err = json.Unmarshal(*v, &ID) 136 if err != nil { 137 return err 138 } 139 adc.ID = &ID 140 } 141 case "name": 142 if v != nil { 143 var name string 144 err = json.Unmarshal(*v, &name) 145 if err != nil { 146 return err 147 } 148 adc.Name = &name 149 } 150 case "type": 151 if v != nil { 152 var typeVar string 153 err = json.Unmarshal(*v, &typeVar) 154 if err != nil { 155 return err 156 } 157 adc.Type = &typeVar 158 } 159 case "etag": 160 if v != nil { 161 var etag string 162 err = json.Unmarshal(*v, &etag) 163 if err != nil { 164 return err 165 } 166 adc.Etag = &etag 167 } 168 } 169 } 170 171 return nil 172} 173 174// AADDataConnectorProperties AAD (Azure Active Directory) data connector properties. 175type AADDataConnectorProperties struct { 176 // TenantID - The tenant id to connect to, and get the data from. 177 TenantID *string `json:"tenantId,omitempty"` 178 // DataTypes - The available data types for the connector. 179 DataTypes *AlertsDataTypeOfDataConnector `json:"dataTypes,omitempty"` 180} 181 182// AATPDataConnector represents AATP (Azure Advanced Threat Protection) data connector. 183type AATPDataConnector struct { 184 // AATPDataConnectorProperties - AATP (Azure Advanced Threat Protection) data connector properties. 185 *AATPDataConnectorProperties `json:"properties,omitempty"` 186 // Kind - Possible values include: 'KindDataConnector', 'KindAzureActiveDirectory', 'KindAzureAdvancedThreatProtection', 'KindAzureSecurityCenter', 'KindAmazonWebServicesCloudTrail', 'KindMicrosoftCloudAppSecurity', 'KindMicrosoftDefenderAdvancedThreatProtection', 'KindOffice365', 'KindThreatIntelligence' 187 Kind KindBasicDataConnector `json:"kind,omitempty"` 188 // ID - READ-ONLY; Azure resource Id 189 ID *string `json:"id,omitempty"` 190 // Name - READ-ONLY; Azure resource name 191 Name *string `json:"name,omitempty"` 192 // Type - READ-ONLY; Azure resource type 193 Type *string `json:"type,omitempty"` 194 // Etag - Etag of the azure resource 195 Etag *string `json:"etag,omitempty"` 196} 197 198// MarshalJSON is the custom marshaler for AATPDataConnector. 199func (adc AATPDataConnector) MarshalJSON() ([]byte, error) { 200 adc.Kind = KindAzureAdvancedThreatProtection 201 objectMap := make(map[string]interface{}) 202 if adc.AATPDataConnectorProperties != nil { 203 objectMap["properties"] = adc.AATPDataConnectorProperties 204 } 205 if adc.Kind != "" { 206 objectMap["kind"] = adc.Kind 207 } 208 if adc.Etag != nil { 209 objectMap["etag"] = adc.Etag 210 } 211 return json.Marshal(objectMap) 212} 213 214// AsAADDataConnector is the BasicDataConnector implementation for AATPDataConnector. 215func (adc AATPDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 216 return nil, false 217} 218 219// AsAATPDataConnector is the BasicDataConnector implementation for AATPDataConnector. 220func (adc AATPDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 221 return &adc, true 222} 223 224// AsASCDataConnector is the BasicDataConnector implementation for AATPDataConnector. 225func (adc AATPDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 226 return nil, false 227} 228 229// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for AATPDataConnector. 230func (adc AATPDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 231 return nil, false 232} 233 234// AsMCASDataConnector is the BasicDataConnector implementation for AATPDataConnector. 235func (adc AATPDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 236 return nil, false 237} 238 239// AsMDATPDataConnector is the BasicDataConnector implementation for AATPDataConnector. 240func (adc AATPDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 241 return nil, false 242} 243 244// AsOfficeDataConnector is the BasicDataConnector implementation for AATPDataConnector. 245func (adc AATPDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 246 return nil, false 247} 248 249// AsTIDataConnector is the BasicDataConnector implementation for AATPDataConnector. 250func (adc AATPDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 251 return nil, false 252} 253 254// AsDataConnector is the BasicDataConnector implementation for AATPDataConnector. 255func (adc AATPDataConnector) AsDataConnector() (*DataConnector, bool) { 256 return nil, false 257} 258 259// AsBasicDataConnector is the BasicDataConnector implementation for AATPDataConnector. 260func (adc AATPDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 261 return &adc, true 262} 263 264// UnmarshalJSON is the custom unmarshaler for AATPDataConnector struct. 265func (adc *AATPDataConnector) UnmarshalJSON(body []byte) error { 266 var m map[string]*json.RawMessage 267 err := json.Unmarshal(body, &m) 268 if err != nil { 269 return err 270 } 271 for k, v := range m { 272 switch k { 273 case "properties": 274 if v != nil { 275 var aATPDataConnectorProperties AATPDataConnectorProperties 276 err = json.Unmarshal(*v, &aATPDataConnectorProperties) 277 if err != nil { 278 return err 279 } 280 adc.AATPDataConnectorProperties = &aATPDataConnectorProperties 281 } 282 case "kind": 283 if v != nil { 284 var kind KindBasicDataConnector 285 err = json.Unmarshal(*v, &kind) 286 if err != nil { 287 return err 288 } 289 adc.Kind = kind 290 } 291 case "id": 292 if v != nil { 293 var ID string 294 err = json.Unmarshal(*v, &ID) 295 if err != nil { 296 return err 297 } 298 adc.ID = &ID 299 } 300 case "name": 301 if v != nil { 302 var name string 303 err = json.Unmarshal(*v, &name) 304 if err != nil { 305 return err 306 } 307 adc.Name = &name 308 } 309 case "type": 310 if v != nil { 311 var typeVar string 312 err = json.Unmarshal(*v, &typeVar) 313 if err != nil { 314 return err 315 } 316 adc.Type = &typeVar 317 } 318 case "etag": 319 if v != nil { 320 var etag string 321 err = json.Unmarshal(*v, &etag) 322 if err != nil { 323 return err 324 } 325 adc.Etag = &etag 326 } 327 } 328 } 329 330 return nil 331} 332 333// AATPDataConnectorProperties AATP (Azure Advanced Threat Protection) data connector properties. 334type AATPDataConnectorProperties struct { 335 // TenantID - The tenant id to connect to, and get the data from. 336 TenantID *string `json:"tenantId,omitempty"` 337 // DataTypes - The available data types for the connector. 338 DataTypes *AlertsDataTypeOfDataConnector `json:"dataTypes,omitempty"` 339} 340 341// ActionPropertiesBase action property bag base. 342type ActionPropertiesBase struct { 343 // LogicAppResourceID - Logic App Resource Id, /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}. 344 LogicAppResourceID *string `json:"logicAppResourceId,omitempty"` 345} 346 347// ActionRequest action for alert rule. 348type ActionRequest struct { 349 // ActionRequestProperties - Action properties for put request 350 *ActionRequestProperties `json:"properties,omitempty"` 351 // ID - READ-ONLY; Azure resource Id 352 ID *string `json:"id,omitempty"` 353 // Name - READ-ONLY; Azure resource name 354 Name *string `json:"name,omitempty"` 355 // Type - READ-ONLY; Azure resource type 356 Type *string `json:"type,omitempty"` 357 // Etag - Etag of the azure resource 358 Etag *string `json:"etag,omitempty"` 359} 360 361// MarshalJSON is the custom marshaler for ActionRequest. 362func (ar ActionRequest) MarshalJSON() ([]byte, error) { 363 objectMap := make(map[string]interface{}) 364 if ar.ActionRequestProperties != nil { 365 objectMap["properties"] = ar.ActionRequestProperties 366 } 367 if ar.Etag != nil { 368 objectMap["etag"] = ar.Etag 369 } 370 return json.Marshal(objectMap) 371} 372 373// UnmarshalJSON is the custom unmarshaler for ActionRequest struct. 374func (ar *ActionRequest) UnmarshalJSON(body []byte) error { 375 var m map[string]*json.RawMessage 376 err := json.Unmarshal(body, &m) 377 if err != nil { 378 return err 379 } 380 for k, v := range m { 381 switch k { 382 case "properties": 383 if v != nil { 384 var actionRequestProperties ActionRequestProperties 385 err = json.Unmarshal(*v, &actionRequestProperties) 386 if err != nil { 387 return err 388 } 389 ar.ActionRequestProperties = &actionRequestProperties 390 } 391 case "id": 392 if v != nil { 393 var ID string 394 err = json.Unmarshal(*v, &ID) 395 if err != nil { 396 return err 397 } 398 ar.ID = &ID 399 } 400 case "name": 401 if v != nil { 402 var name string 403 err = json.Unmarshal(*v, &name) 404 if err != nil { 405 return err 406 } 407 ar.Name = &name 408 } 409 case "type": 410 if v != nil { 411 var typeVar string 412 err = json.Unmarshal(*v, &typeVar) 413 if err != nil { 414 return err 415 } 416 ar.Type = &typeVar 417 } 418 case "etag": 419 if v != nil { 420 var etag string 421 err = json.Unmarshal(*v, &etag) 422 if err != nil { 423 return err 424 } 425 ar.Etag = &etag 426 } 427 } 428 } 429 430 return nil 431} 432 433// ActionRequestProperties action property bag. 434type ActionRequestProperties struct { 435 // TriggerURI - Logic App Callback URL for this specific workflow. 436 TriggerURI *string `json:"triggerUri,omitempty"` 437 // LogicAppResourceID - Logic App Resource Id, /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}. 438 LogicAppResourceID *string `json:"logicAppResourceId,omitempty"` 439} 440 441// ActionResponse action for alert rule. 442type ActionResponse struct { 443 autorest.Response `json:"-"` 444 // Etag - Etag of the action. 445 Etag *string `json:"etag,omitempty"` 446 // ActionResponseProperties - Action properties for get request 447 *ActionResponseProperties `json:"properties,omitempty"` 448 // ID - READ-ONLY; Azure resource Id 449 ID *string `json:"id,omitempty"` 450 // Name - READ-ONLY; Azure resource name 451 Name *string `json:"name,omitempty"` 452 // Type - READ-ONLY; Azure resource type 453 Type *string `json:"type,omitempty"` 454} 455 456// MarshalJSON is the custom marshaler for ActionResponse. 457func (ar ActionResponse) MarshalJSON() ([]byte, error) { 458 objectMap := make(map[string]interface{}) 459 if ar.Etag != nil { 460 objectMap["etag"] = ar.Etag 461 } 462 if ar.ActionResponseProperties != nil { 463 objectMap["properties"] = ar.ActionResponseProperties 464 } 465 return json.Marshal(objectMap) 466} 467 468// UnmarshalJSON is the custom unmarshaler for ActionResponse struct. 469func (ar *ActionResponse) UnmarshalJSON(body []byte) error { 470 var m map[string]*json.RawMessage 471 err := json.Unmarshal(body, &m) 472 if err != nil { 473 return err 474 } 475 for k, v := range m { 476 switch k { 477 case "etag": 478 if v != nil { 479 var etag string 480 err = json.Unmarshal(*v, &etag) 481 if err != nil { 482 return err 483 } 484 ar.Etag = &etag 485 } 486 case "properties": 487 if v != nil { 488 var actionResponseProperties ActionResponseProperties 489 err = json.Unmarshal(*v, &actionResponseProperties) 490 if err != nil { 491 return err 492 } 493 ar.ActionResponseProperties = &actionResponseProperties 494 } 495 case "id": 496 if v != nil { 497 var ID string 498 err = json.Unmarshal(*v, &ID) 499 if err != nil { 500 return err 501 } 502 ar.ID = &ID 503 } 504 case "name": 505 if v != nil { 506 var name string 507 err = json.Unmarshal(*v, &name) 508 if err != nil { 509 return err 510 } 511 ar.Name = &name 512 } 513 case "type": 514 if v != nil { 515 var typeVar string 516 err = json.Unmarshal(*v, &typeVar) 517 if err != nil { 518 return err 519 } 520 ar.Type = &typeVar 521 } 522 } 523 } 524 525 return nil 526} 527 528// ActionResponseProperties action property bag. 529type ActionResponseProperties struct { 530 // WorkflowID - The name of the logic app's workflow. 531 WorkflowID *string `json:"workflowId,omitempty"` 532 // LogicAppResourceID - Logic App Resource Id, /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}. 533 LogicAppResourceID *string `json:"logicAppResourceId,omitempty"` 534} 535 536// ActionsList list all the actions. 537type ActionsList struct { 538 autorest.Response `json:"-"` 539 // NextLink - READ-ONLY; URL to fetch the next set of actions. 540 NextLink *string `json:"nextLink,omitempty"` 541 // Value - Array of actions. 542 Value *[]ActionResponse `json:"value,omitempty"` 543} 544 545// MarshalJSON is the custom marshaler for ActionsList. 546func (al ActionsList) MarshalJSON() ([]byte, error) { 547 objectMap := make(map[string]interface{}) 548 if al.Value != nil { 549 objectMap["value"] = al.Value 550 } 551 return json.Marshal(objectMap) 552} 553 554// ActionsListIterator provides access to a complete listing of ActionResponse values. 555type ActionsListIterator struct { 556 i int 557 page ActionsListPage 558} 559 560// NextWithContext advances to the next value. If there was an error making 561// the request the iterator does not advance and the error is returned. 562func (iter *ActionsListIterator) NextWithContext(ctx context.Context) (err error) { 563 if tracing.IsEnabled() { 564 ctx = tracing.StartSpan(ctx, fqdn+"/ActionsListIterator.NextWithContext") 565 defer func() { 566 sc := -1 567 if iter.Response().Response.Response != nil { 568 sc = iter.Response().Response.Response.StatusCode 569 } 570 tracing.EndSpan(ctx, sc, err) 571 }() 572 } 573 iter.i++ 574 if iter.i < len(iter.page.Values()) { 575 return nil 576 } 577 err = iter.page.NextWithContext(ctx) 578 if err != nil { 579 iter.i-- 580 return err 581 } 582 iter.i = 0 583 return nil 584} 585 586// Next advances to the next value. If there was an error making 587// the request the iterator does not advance and the error is returned. 588// Deprecated: Use NextWithContext() instead. 589func (iter *ActionsListIterator) Next() error { 590 return iter.NextWithContext(context.Background()) 591} 592 593// NotDone returns true if the enumeration should be started or is not yet complete. 594func (iter ActionsListIterator) NotDone() bool { 595 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 596} 597 598// Response returns the raw server response from the last page request. 599func (iter ActionsListIterator) Response() ActionsList { 600 return iter.page.Response() 601} 602 603// Value returns the current value or a zero-initialized value if the 604// iterator has advanced beyond the end of the collection. 605func (iter ActionsListIterator) Value() ActionResponse { 606 if !iter.page.NotDone() { 607 return ActionResponse{} 608 } 609 return iter.page.Values()[iter.i] 610} 611 612// Creates a new instance of the ActionsListIterator type. 613func NewActionsListIterator(page ActionsListPage) ActionsListIterator { 614 return ActionsListIterator{page: page} 615} 616 617// IsEmpty returns true if the ListResult contains no values. 618func (al ActionsList) IsEmpty() bool { 619 return al.Value == nil || len(*al.Value) == 0 620} 621 622// hasNextLink returns true if the NextLink is not empty. 623func (al ActionsList) hasNextLink() bool { 624 return al.NextLink != nil && len(*al.NextLink) != 0 625} 626 627// actionsListPreparer prepares a request to retrieve the next set of results. 628// It returns nil if no more results exist. 629func (al ActionsList) actionsListPreparer(ctx context.Context) (*http.Request, error) { 630 if !al.hasNextLink() { 631 return nil, nil 632 } 633 return autorest.Prepare((&http.Request{}).WithContext(ctx), 634 autorest.AsJSON(), 635 autorest.AsGet(), 636 autorest.WithBaseURL(to.String(al.NextLink))) 637} 638 639// ActionsListPage contains a page of ActionResponse values. 640type ActionsListPage struct { 641 fn func(context.Context, ActionsList) (ActionsList, error) 642 al ActionsList 643} 644 645// NextWithContext advances to the next page of values. If there was an error making 646// the request the page does not advance and the error is returned. 647func (page *ActionsListPage) NextWithContext(ctx context.Context) (err error) { 648 if tracing.IsEnabled() { 649 ctx = tracing.StartSpan(ctx, fqdn+"/ActionsListPage.NextWithContext") 650 defer func() { 651 sc := -1 652 if page.Response().Response.Response != nil { 653 sc = page.Response().Response.Response.StatusCode 654 } 655 tracing.EndSpan(ctx, sc, err) 656 }() 657 } 658 for { 659 next, err := page.fn(ctx, page.al) 660 if err != nil { 661 return err 662 } 663 page.al = next 664 if !next.hasNextLink() || !next.IsEmpty() { 665 break 666 } 667 } 668 return nil 669} 670 671// Next advances to the next page of values. If there was an error making 672// the request the page does not advance and the error is returned. 673// Deprecated: Use NextWithContext() instead. 674func (page *ActionsListPage) Next() error { 675 return page.NextWithContext(context.Background()) 676} 677 678// NotDone returns true if the page enumeration should be started or is not yet complete. 679func (page ActionsListPage) NotDone() bool { 680 return !page.al.IsEmpty() 681} 682 683// Response returns the raw server response from the last page request. 684func (page ActionsListPage) Response() ActionsList { 685 return page.al 686} 687 688// Values returns the slice of values for the current page or nil if there are no values. 689func (page ActionsListPage) Values() []ActionResponse { 690 if page.al.IsEmpty() { 691 return nil 692 } 693 return *page.al.Value 694} 695 696// Creates a new instance of the ActionsListPage type. 697func NewActionsListPage(cur ActionsList, getNextPage func(context.Context, ActionsList) (ActionsList, error)) ActionsListPage { 698 return ActionsListPage{ 699 fn: getNextPage, 700 al: cur, 701 } 702} 703 704// BasicAlertRule alert rule. 705type BasicAlertRule interface { 706 AsFusionAlertRule() (*FusionAlertRule, bool) 707 AsMicrosoftSecurityIncidentCreationAlertRule() (*MicrosoftSecurityIncidentCreationAlertRule, bool) 708 AsScheduledAlertRule() (*ScheduledAlertRule, bool) 709 AsAlertRule() (*AlertRule, bool) 710} 711 712// AlertRule alert rule. 713type AlertRule struct { 714 autorest.Response `json:"-"` 715 // Kind - Possible values include: 'KindAlertRule', 'KindFusion', 'KindMicrosoftSecurityIncidentCreation', 'KindScheduled' 716 Kind Kind `json:"kind,omitempty"` 717 // ID - READ-ONLY; Azure resource Id 718 ID *string `json:"id,omitempty"` 719 // Name - READ-ONLY; Azure resource name 720 Name *string `json:"name,omitempty"` 721 // Type - READ-ONLY; Azure resource type 722 Type *string `json:"type,omitempty"` 723 // Etag - Etag of the azure resource 724 Etag *string `json:"etag,omitempty"` 725} 726 727func unmarshalBasicAlertRule(body []byte) (BasicAlertRule, error) { 728 var m map[string]interface{} 729 err := json.Unmarshal(body, &m) 730 if err != nil { 731 return nil, err 732 } 733 734 switch m["kind"] { 735 case string(KindFusion): 736 var far FusionAlertRule 737 err := json.Unmarshal(body, &far) 738 return far, err 739 case string(KindMicrosoftSecurityIncidentCreation): 740 var msicar MicrosoftSecurityIncidentCreationAlertRule 741 err := json.Unmarshal(body, &msicar) 742 return msicar, err 743 case string(KindScheduled): 744 var sar ScheduledAlertRule 745 err := json.Unmarshal(body, &sar) 746 return sar, err 747 default: 748 var ar AlertRule 749 err := json.Unmarshal(body, &ar) 750 return ar, err 751 } 752} 753func unmarshalBasicAlertRuleArray(body []byte) ([]BasicAlertRule, error) { 754 var rawMessages []*json.RawMessage 755 err := json.Unmarshal(body, &rawMessages) 756 if err != nil { 757 return nil, err 758 } 759 760 arArray := make([]BasicAlertRule, len(rawMessages)) 761 762 for index, rawMessage := range rawMessages { 763 ar, err := unmarshalBasicAlertRule(*rawMessage) 764 if err != nil { 765 return nil, err 766 } 767 arArray[index] = ar 768 } 769 return arArray, nil 770} 771 772// MarshalJSON is the custom marshaler for AlertRule. 773func (ar AlertRule) MarshalJSON() ([]byte, error) { 774 ar.Kind = KindAlertRule 775 objectMap := make(map[string]interface{}) 776 if ar.Kind != "" { 777 objectMap["kind"] = ar.Kind 778 } 779 if ar.Etag != nil { 780 objectMap["etag"] = ar.Etag 781 } 782 return json.Marshal(objectMap) 783} 784 785// AsFusionAlertRule is the BasicAlertRule implementation for AlertRule. 786func (ar AlertRule) AsFusionAlertRule() (*FusionAlertRule, bool) { 787 return nil, false 788} 789 790// AsMicrosoftSecurityIncidentCreationAlertRule is the BasicAlertRule implementation for AlertRule. 791func (ar AlertRule) AsMicrosoftSecurityIncidentCreationAlertRule() (*MicrosoftSecurityIncidentCreationAlertRule, bool) { 792 return nil, false 793} 794 795// AsScheduledAlertRule is the BasicAlertRule implementation for AlertRule. 796func (ar AlertRule) AsScheduledAlertRule() (*ScheduledAlertRule, bool) { 797 return nil, false 798} 799 800// AsAlertRule is the BasicAlertRule implementation for AlertRule. 801func (ar AlertRule) AsAlertRule() (*AlertRule, bool) { 802 return &ar, true 803} 804 805// AsBasicAlertRule is the BasicAlertRule implementation for AlertRule. 806func (ar AlertRule) AsBasicAlertRule() (BasicAlertRule, bool) { 807 return &ar, true 808} 809 810// AlertRuleModel ... 811type AlertRuleModel struct { 812 autorest.Response `json:"-"` 813 Value BasicAlertRule `json:"value,omitempty"` 814} 815 816// UnmarshalJSON is the custom unmarshaler for AlertRuleModel struct. 817func (arm *AlertRuleModel) UnmarshalJSON(body []byte) error { 818 ar, err := unmarshalBasicAlertRule(body) 819 if err != nil { 820 return err 821 } 822 arm.Value = ar 823 824 return nil 825} 826 827// AlertRulesList list all the alert rules. 828type AlertRulesList struct { 829 autorest.Response `json:"-"` 830 // NextLink - READ-ONLY; URL to fetch the next set of alert rules. 831 NextLink *string `json:"nextLink,omitempty"` 832 // Value - Array of alert rules. 833 Value *[]BasicAlertRule `json:"value,omitempty"` 834} 835 836// MarshalJSON is the custom marshaler for AlertRulesList. 837func (arl AlertRulesList) MarshalJSON() ([]byte, error) { 838 objectMap := make(map[string]interface{}) 839 if arl.Value != nil { 840 objectMap["value"] = arl.Value 841 } 842 return json.Marshal(objectMap) 843} 844 845// UnmarshalJSON is the custom unmarshaler for AlertRulesList struct. 846func (arl *AlertRulesList) UnmarshalJSON(body []byte) error { 847 var m map[string]*json.RawMessage 848 err := json.Unmarshal(body, &m) 849 if err != nil { 850 return err 851 } 852 for k, v := range m { 853 switch k { 854 case "nextLink": 855 if v != nil { 856 var nextLink string 857 err = json.Unmarshal(*v, &nextLink) 858 if err != nil { 859 return err 860 } 861 arl.NextLink = &nextLink 862 } 863 case "value": 864 if v != nil { 865 value, err := unmarshalBasicAlertRuleArray(*v) 866 if err != nil { 867 return err 868 } 869 arl.Value = &value 870 } 871 } 872 } 873 874 return nil 875} 876 877// AlertRulesListIterator provides access to a complete listing of AlertRule values. 878type AlertRulesListIterator struct { 879 i int 880 page AlertRulesListPage 881} 882 883// NextWithContext advances to the next value. If there was an error making 884// the request the iterator does not advance and the error is returned. 885func (iter *AlertRulesListIterator) NextWithContext(ctx context.Context) (err error) { 886 if tracing.IsEnabled() { 887 ctx = tracing.StartSpan(ctx, fqdn+"/AlertRulesListIterator.NextWithContext") 888 defer func() { 889 sc := -1 890 if iter.Response().Response.Response != nil { 891 sc = iter.Response().Response.Response.StatusCode 892 } 893 tracing.EndSpan(ctx, sc, err) 894 }() 895 } 896 iter.i++ 897 if iter.i < len(iter.page.Values()) { 898 return nil 899 } 900 err = iter.page.NextWithContext(ctx) 901 if err != nil { 902 iter.i-- 903 return err 904 } 905 iter.i = 0 906 return nil 907} 908 909// Next advances to the next value. If there was an error making 910// the request the iterator does not advance and the error is returned. 911// Deprecated: Use NextWithContext() instead. 912func (iter *AlertRulesListIterator) Next() error { 913 return iter.NextWithContext(context.Background()) 914} 915 916// NotDone returns true if the enumeration should be started or is not yet complete. 917func (iter AlertRulesListIterator) NotDone() bool { 918 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 919} 920 921// Response returns the raw server response from the last page request. 922func (iter AlertRulesListIterator) Response() AlertRulesList { 923 return iter.page.Response() 924} 925 926// Value returns the current value or a zero-initialized value if the 927// iterator has advanced beyond the end of the collection. 928func (iter AlertRulesListIterator) Value() BasicAlertRule { 929 if !iter.page.NotDone() { 930 return AlertRule{} 931 } 932 return iter.page.Values()[iter.i] 933} 934 935// Creates a new instance of the AlertRulesListIterator type. 936func NewAlertRulesListIterator(page AlertRulesListPage) AlertRulesListIterator { 937 return AlertRulesListIterator{page: page} 938} 939 940// IsEmpty returns true if the ListResult contains no values. 941func (arl AlertRulesList) IsEmpty() bool { 942 return arl.Value == nil || len(*arl.Value) == 0 943} 944 945// hasNextLink returns true if the NextLink is not empty. 946func (arl AlertRulesList) hasNextLink() bool { 947 return arl.NextLink != nil && len(*arl.NextLink) != 0 948} 949 950// alertRulesListPreparer prepares a request to retrieve the next set of results. 951// It returns nil if no more results exist. 952func (arl AlertRulesList) alertRulesListPreparer(ctx context.Context) (*http.Request, error) { 953 if !arl.hasNextLink() { 954 return nil, nil 955 } 956 return autorest.Prepare((&http.Request{}).WithContext(ctx), 957 autorest.AsJSON(), 958 autorest.AsGet(), 959 autorest.WithBaseURL(to.String(arl.NextLink))) 960} 961 962// AlertRulesListPage contains a page of BasicAlertRule values. 963type AlertRulesListPage struct { 964 fn func(context.Context, AlertRulesList) (AlertRulesList, error) 965 arl AlertRulesList 966} 967 968// NextWithContext advances to the next page of values. If there was an error making 969// the request the page does not advance and the error is returned. 970func (page *AlertRulesListPage) NextWithContext(ctx context.Context) (err error) { 971 if tracing.IsEnabled() { 972 ctx = tracing.StartSpan(ctx, fqdn+"/AlertRulesListPage.NextWithContext") 973 defer func() { 974 sc := -1 975 if page.Response().Response.Response != nil { 976 sc = page.Response().Response.Response.StatusCode 977 } 978 tracing.EndSpan(ctx, sc, err) 979 }() 980 } 981 for { 982 next, err := page.fn(ctx, page.arl) 983 if err != nil { 984 return err 985 } 986 page.arl = next 987 if !next.hasNextLink() || !next.IsEmpty() { 988 break 989 } 990 } 991 return nil 992} 993 994// Next advances to the next page of values. If there was an error making 995// the request the page does not advance and the error is returned. 996// Deprecated: Use NextWithContext() instead. 997func (page *AlertRulesListPage) Next() error { 998 return page.NextWithContext(context.Background()) 999} 1000 1001// NotDone returns true if the page enumeration should be started or is not yet complete. 1002func (page AlertRulesListPage) NotDone() bool { 1003 return !page.arl.IsEmpty() 1004} 1005 1006// Response returns the raw server response from the last page request. 1007func (page AlertRulesListPage) Response() AlertRulesList { 1008 return page.arl 1009} 1010 1011// Values returns the slice of values for the current page or nil if there are no values. 1012func (page AlertRulesListPage) Values() []BasicAlertRule { 1013 if page.arl.IsEmpty() { 1014 return nil 1015 } 1016 return *page.arl.Value 1017} 1018 1019// Creates a new instance of the AlertRulesListPage type. 1020func NewAlertRulesListPage(cur AlertRulesList, getNextPage func(context.Context, AlertRulesList) (AlertRulesList, error)) AlertRulesListPage { 1021 return AlertRulesListPage{ 1022 fn: getNextPage, 1023 arl: cur, 1024 } 1025} 1026 1027// BasicAlertRuleTemplate alert rule template. 1028type BasicAlertRuleTemplate interface { 1029 AsFusionAlertRuleTemplate() (*FusionAlertRuleTemplate, bool) 1030 AsMicrosoftSecurityIncidentCreationAlertRuleTemplate() (*MicrosoftSecurityIncidentCreationAlertRuleTemplate, bool) 1031 AsScheduledAlertRuleTemplate() (*ScheduledAlertRuleTemplate, bool) 1032 AsAlertRuleTemplate() (*AlertRuleTemplate, bool) 1033} 1034 1035// AlertRuleTemplate alert rule template. 1036type AlertRuleTemplate struct { 1037 autorest.Response `json:"-"` 1038 // Kind - Possible values include: 'KindBasicAlertRuleTemplateKindAlertRuleTemplate', 'KindBasicAlertRuleTemplateKindFusion', 'KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleTemplateKindScheduled' 1039 Kind KindBasicAlertRuleTemplate `json:"kind,omitempty"` 1040 // ID - READ-ONLY; Azure resource Id 1041 ID *string `json:"id,omitempty"` 1042 // Name - READ-ONLY; Azure resource name 1043 Name *string `json:"name,omitempty"` 1044 // Type - READ-ONLY; Azure resource type 1045 Type *string `json:"type,omitempty"` 1046} 1047 1048func unmarshalBasicAlertRuleTemplate(body []byte) (BasicAlertRuleTemplate, error) { 1049 var m map[string]interface{} 1050 err := json.Unmarshal(body, &m) 1051 if err != nil { 1052 return nil, err 1053 } 1054 1055 switch m["kind"] { 1056 case string(KindBasicAlertRuleTemplateKindFusion): 1057 var fart FusionAlertRuleTemplate 1058 err := json.Unmarshal(body, &fart) 1059 return fart, err 1060 case string(KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation): 1061 var msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate 1062 err := json.Unmarshal(body, &msicart) 1063 return msicart, err 1064 case string(KindBasicAlertRuleTemplateKindScheduled): 1065 var sart ScheduledAlertRuleTemplate 1066 err := json.Unmarshal(body, &sart) 1067 return sart, err 1068 default: 1069 var art AlertRuleTemplate 1070 err := json.Unmarshal(body, &art) 1071 return art, err 1072 } 1073} 1074func unmarshalBasicAlertRuleTemplateArray(body []byte) ([]BasicAlertRuleTemplate, error) { 1075 var rawMessages []*json.RawMessage 1076 err := json.Unmarshal(body, &rawMessages) 1077 if err != nil { 1078 return nil, err 1079 } 1080 1081 artArray := make([]BasicAlertRuleTemplate, len(rawMessages)) 1082 1083 for index, rawMessage := range rawMessages { 1084 art, err := unmarshalBasicAlertRuleTemplate(*rawMessage) 1085 if err != nil { 1086 return nil, err 1087 } 1088 artArray[index] = art 1089 } 1090 return artArray, nil 1091} 1092 1093// MarshalJSON is the custom marshaler for AlertRuleTemplate. 1094func (art AlertRuleTemplate) MarshalJSON() ([]byte, error) { 1095 art.Kind = KindBasicAlertRuleTemplateKindAlertRuleTemplate 1096 objectMap := make(map[string]interface{}) 1097 if art.Kind != "" { 1098 objectMap["kind"] = art.Kind 1099 } 1100 return json.Marshal(objectMap) 1101} 1102 1103// AsFusionAlertRuleTemplate is the BasicAlertRuleTemplate implementation for AlertRuleTemplate. 1104func (art AlertRuleTemplate) AsFusionAlertRuleTemplate() (*FusionAlertRuleTemplate, bool) { 1105 return nil, false 1106} 1107 1108// AsMicrosoftSecurityIncidentCreationAlertRuleTemplate is the BasicAlertRuleTemplate implementation for AlertRuleTemplate. 1109func (art AlertRuleTemplate) AsMicrosoftSecurityIncidentCreationAlertRuleTemplate() (*MicrosoftSecurityIncidentCreationAlertRuleTemplate, bool) { 1110 return nil, false 1111} 1112 1113// AsScheduledAlertRuleTemplate is the BasicAlertRuleTemplate implementation for AlertRuleTemplate. 1114func (art AlertRuleTemplate) AsScheduledAlertRuleTemplate() (*ScheduledAlertRuleTemplate, bool) { 1115 return nil, false 1116} 1117 1118// AsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for AlertRuleTemplate. 1119func (art AlertRuleTemplate) AsAlertRuleTemplate() (*AlertRuleTemplate, bool) { 1120 return &art, true 1121} 1122 1123// AsBasicAlertRuleTemplate is the BasicAlertRuleTemplate implementation for AlertRuleTemplate. 1124func (art AlertRuleTemplate) AsBasicAlertRuleTemplate() (BasicAlertRuleTemplate, bool) { 1125 return &art, true 1126} 1127 1128// AlertRuleTemplateDataSource alert rule template data sources 1129type AlertRuleTemplateDataSource struct { 1130 // ConnectorID - The connector id that provides the following data types 1131 ConnectorID *string `json:"connectorId,omitempty"` 1132 // DataTypes - The data types used by the alert rule template 1133 DataTypes *[]string `json:"dataTypes,omitempty"` 1134} 1135 1136// AlertRuleTemplateModel ... 1137type AlertRuleTemplateModel struct { 1138 autorest.Response `json:"-"` 1139 Value BasicAlertRuleTemplate `json:"value,omitempty"` 1140} 1141 1142// UnmarshalJSON is the custom unmarshaler for AlertRuleTemplateModel struct. 1143func (artm *AlertRuleTemplateModel) UnmarshalJSON(body []byte) error { 1144 art, err := unmarshalBasicAlertRuleTemplate(body) 1145 if err != nil { 1146 return err 1147 } 1148 artm.Value = art 1149 1150 return nil 1151} 1152 1153// AlertRuleTemplatesList list all the alert rule templates. 1154type AlertRuleTemplatesList struct { 1155 autorest.Response `json:"-"` 1156 // NextLink - READ-ONLY; URL to fetch the next set of alert rule templates. 1157 NextLink *string `json:"nextLink,omitempty"` 1158 // Value - Array of alert rule templates. 1159 Value *[]BasicAlertRuleTemplate `json:"value,omitempty"` 1160} 1161 1162// MarshalJSON is the custom marshaler for AlertRuleTemplatesList. 1163func (artl AlertRuleTemplatesList) MarshalJSON() ([]byte, error) { 1164 objectMap := make(map[string]interface{}) 1165 if artl.Value != nil { 1166 objectMap["value"] = artl.Value 1167 } 1168 return json.Marshal(objectMap) 1169} 1170 1171// UnmarshalJSON is the custom unmarshaler for AlertRuleTemplatesList struct. 1172func (artl *AlertRuleTemplatesList) UnmarshalJSON(body []byte) error { 1173 var m map[string]*json.RawMessage 1174 err := json.Unmarshal(body, &m) 1175 if err != nil { 1176 return err 1177 } 1178 for k, v := range m { 1179 switch k { 1180 case "nextLink": 1181 if v != nil { 1182 var nextLink string 1183 err = json.Unmarshal(*v, &nextLink) 1184 if err != nil { 1185 return err 1186 } 1187 artl.NextLink = &nextLink 1188 } 1189 case "value": 1190 if v != nil { 1191 value, err := unmarshalBasicAlertRuleTemplateArray(*v) 1192 if err != nil { 1193 return err 1194 } 1195 artl.Value = &value 1196 } 1197 } 1198 } 1199 1200 return nil 1201} 1202 1203// AlertRuleTemplatesListIterator provides access to a complete listing of AlertRuleTemplate values. 1204type AlertRuleTemplatesListIterator struct { 1205 i int 1206 page AlertRuleTemplatesListPage 1207} 1208 1209// NextWithContext advances to the next value. If there was an error making 1210// the request the iterator does not advance and the error is returned. 1211func (iter *AlertRuleTemplatesListIterator) NextWithContext(ctx context.Context) (err error) { 1212 if tracing.IsEnabled() { 1213 ctx = tracing.StartSpan(ctx, fqdn+"/AlertRuleTemplatesListIterator.NextWithContext") 1214 defer func() { 1215 sc := -1 1216 if iter.Response().Response.Response != nil { 1217 sc = iter.Response().Response.Response.StatusCode 1218 } 1219 tracing.EndSpan(ctx, sc, err) 1220 }() 1221 } 1222 iter.i++ 1223 if iter.i < len(iter.page.Values()) { 1224 return nil 1225 } 1226 err = iter.page.NextWithContext(ctx) 1227 if err != nil { 1228 iter.i-- 1229 return err 1230 } 1231 iter.i = 0 1232 return nil 1233} 1234 1235// Next advances to the next value. If there was an error making 1236// the request the iterator does not advance and the error is returned. 1237// Deprecated: Use NextWithContext() instead. 1238func (iter *AlertRuleTemplatesListIterator) Next() error { 1239 return iter.NextWithContext(context.Background()) 1240} 1241 1242// NotDone returns true if the enumeration should be started or is not yet complete. 1243func (iter AlertRuleTemplatesListIterator) NotDone() bool { 1244 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 1245} 1246 1247// Response returns the raw server response from the last page request. 1248func (iter AlertRuleTemplatesListIterator) Response() AlertRuleTemplatesList { 1249 return iter.page.Response() 1250} 1251 1252// Value returns the current value or a zero-initialized value if the 1253// iterator has advanced beyond the end of the collection. 1254func (iter AlertRuleTemplatesListIterator) Value() BasicAlertRuleTemplate { 1255 if !iter.page.NotDone() { 1256 return AlertRuleTemplate{} 1257 } 1258 return iter.page.Values()[iter.i] 1259} 1260 1261// Creates a new instance of the AlertRuleTemplatesListIterator type. 1262func NewAlertRuleTemplatesListIterator(page AlertRuleTemplatesListPage) AlertRuleTemplatesListIterator { 1263 return AlertRuleTemplatesListIterator{page: page} 1264} 1265 1266// IsEmpty returns true if the ListResult contains no values. 1267func (artl AlertRuleTemplatesList) IsEmpty() bool { 1268 return artl.Value == nil || len(*artl.Value) == 0 1269} 1270 1271// hasNextLink returns true if the NextLink is not empty. 1272func (artl AlertRuleTemplatesList) hasNextLink() bool { 1273 return artl.NextLink != nil && len(*artl.NextLink) != 0 1274} 1275 1276// alertRuleTemplatesListPreparer prepares a request to retrieve the next set of results. 1277// It returns nil if no more results exist. 1278func (artl AlertRuleTemplatesList) alertRuleTemplatesListPreparer(ctx context.Context) (*http.Request, error) { 1279 if !artl.hasNextLink() { 1280 return nil, nil 1281 } 1282 return autorest.Prepare((&http.Request{}).WithContext(ctx), 1283 autorest.AsJSON(), 1284 autorest.AsGet(), 1285 autorest.WithBaseURL(to.String(artl.NextLink))) 1286} 1287 1288// AlertRuleTemplatesListPage contains a page of BasicAlertRuleTemplate values. 1289type AlertRuleTemplatesListPage struct { 1290 fn func(context.Context, AlertRuleTemplatesList) (AlertRuleTemplatesList, error) 1291 artl AlertRuleTemplatesList 1292} 1293 1294// NextWithContext advances to the next page of values. If there was an error making 1295// the request the page does not advance and the error is returned. 1296func (page *AlertRuleTemplatesListPage) NextWithContext(ctx context.Context) (err error) { 1297 if tracing.IsEnabled() { 1298 ctx = tracing.StartSpan(ctx, fqdn+"/AlertRuleTemplatesListPage.NextWithContext") 1299 defer func() { 1300 sc := -1 1301 if page.Response().Response.Response != nil { 1302 sc = page.Response().Response.Response.StatusCode 1303 } 1304 tracing.EndSpan(ctx, sc, err) 1305 }() 1306 } 1307 for { 1308 next, err := page.fn(ctx, page.artl) 1309 if err != nil { 1310 return err 1311 } 1312 page.artl = next 1313 if !next.hasNextLink() || !next.IsEmpty() { 1314 break 1315 } 1316 } 1317 return nil 1318} 1319 1320// Next advances to the next page of values. If there was an error making 1321// the request the page does not advance and the error is returned. 1322// Deprecated: Use NextWithContext() instead. 1323func (page *AlertRuleTemplatesListPage) Next() error { 1324 return page.NextWithContext(context.Background()) 1325} 1326 1327// NotDone returns true if the page enumeration should be started or is not yet complete. 1328func (page AlertRuleTemplatesListPage) NotDone() bool { 1329 return !page.artl.IsEmpty() 1330} 1331 1332// Response returns the raw server response from the last page request. 1333func (page AlertRuleTemplatesListPage) Response() AlertRuleTemplatesList { 1334 return page.artl 1335} 1336 1337// Values returns the slice of values for the current page or nil if there are no values. 1338func (page AlertRuleTemplatesListPage) Values() []BasicAlertRuleTemplate { 1339 if page.artl.IsEmpty() { 1340 return nil 1341 } 1342 return *page.artl.Value 1343} 1344 1345// Creates a new instance of the AlertRuleTemplatesListPage type. 1346func NewAlertRuleTemplatesListPage(cur AlertRuleTemplatesList, getNextPage func(context.Context, AlertRuleTemplatesList) (AlertRuleTemplatesList, error)) AlertRuleTemplatesListPage { 1347 return AlertRuleTemplatesListPage{ 1348 fn: getNextPage, 1349 artl: cur, 1350 } 1351} 1352 1353// AlertsDataTypeOfDataConnector alerts data type for data connectors. 1354type AlertsDataTypeOfDataConnector struct { 1355 // Alerts - Alerts data type connection. 1356 Alerts *DataConnectorDataTypeCommon `json:"alerts,omitempty"` 1357} 1358 1359// ASCDataConnector represents ASC (Azure Security Center) data connector. 1360type ASCDataConnector struct { 1361 // ASCDataConnectorProperties - ASC (Azure Security Center) data connector properties. 1362 *ASCDataConnectorProperties `json:"properties,omitempty"` 1363 // Kind - Possible values include: 'KindDataConnector', 'KindAzureActiveDirectory', 'KindAzureAdvancedThreatProtection', 'KindAzureSecurityCenter', 'KindAmazonWebServicesCloudTrail', 'KindMicrosoftCloudAppSecurity', 'KindMicrosoftDefenderAdvancedThreatProtection', 'KindOffice365', 'KindThreatIntelligence' 1364 Kind KindBasicDataConnector `json:"kind,omitempty"` 1365 // ID - READ-ONLY; Azure resource Id 1366 ID *string `json:"id,omitempty"` 1367 // Name - READ-ONLY; Azure resource name 1368 Name *string `json:"name,omitempty"` 1369 // Type - READ-ONLY; Azure resource type 1370 Type *string `json:"type,omitempty"` 1371 // Etag - Etag of the azure resource 1372 Etag *string `json:"etag,omitempty"` 1373} 1374 1375// MarshalJSON is the custom marshaler for ASCDataConnector. 1376func (adc ASCDataConnector) MarshalJSON() ([]byte, error) { 1377 adc.Kind = KindAzureSecurityCenter 1378 objectMap := make(map[string]interface{}) 1379 if adc.ASCDataConnectorProperties != nil { 1380 objectMap["properties"] = adc.ASCDataConnectorProperties 1381 } 1382 if adc.Kind != "" { 1383 objectMap["kind"] = adc.Kind 1384 } 1385 if adc.Etag != nil { 1386 objectMap["etag"] = adc.Etag 1387 } 1388 return json.Marshal(objectMap) 1389} 1390 1391// AsAADDataConnector is the BasicDataConnector implementation for ASCDataConnector. 1392func (adc ASCDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 1393 return nil, false 1394} 1395 1396// AsAATPDataConnector is the BasicDataConnector implementation for ASCDataConnector. 1397func (adc ASCDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 1398 return nil, false 1399} 1400 1401// AsASCDataConnector is the BasicDataConnector implementation for ASCDataConnector. 1402func (adc ASCDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 1403 return &adc, true 1404} 1405 1406// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for ASCDataConnector. 1407func (adc ASCDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 1408 return nil, false 1409} 1410 1411// AsMCASDataConnector is the BasicDataConnector implementation for ASCDataConnector. 1412func (adc ASCDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 1413 return nil, false 1414} 1415 1416// AsMDATPDataConnector is the BasicDataConnector implementation for ASCDataConnector. 1417func (adc ASCDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 1418 return nil, false 1419} 1420 1421// AsOfficeDataConnector is the BasicDataConnector implementation for ASCDataConnector. 1422func (adc ASCDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 1423 return nil, false 1424} 1425 1426// AsTIDataConnector is the BasicDataConnector implementation for ASCDataConnector. 1427func (adc ASCDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 1428 return nil, false 1429} 1430 1431// AsDataConnector is the BasicDataConnector implementation for ASCDataConnector. 1432func (adc ASCDataConnector) AsDataConnector() (*DataConnector, bool) { 1433 return nil, false 1434} 1435 1436// AsBasicDataConnector is the BasicDataConnector implementation for ASCDataConnector. 1437func (adc ASCDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 1438 return &adc, true 1439} 1440 1441// UnmarshalJSON is the custom unmarshaler for ASCDataConnector struct. 1442func (adc *ASCDataConnector) UnmarshalJSON(body []byte) error { 1443 var m map[string]*json.RawMessage 1444 err := json.Unmarshal(body, &m) 1445 if err != nil { 1446 return err 1447 } 1448 for k, v := range m { 1449 switch k { 1450 case "properties": 1451 if v != nil { 1452 var aSCDataConnectorProperties ASCDataConnectorProperties 1453 err = json.Unmarshal(*v, &aSCDataConnectorProperties) 1454 if err != nil { 1455 return err 1456 } 1457 adc.ASCDataConnectorProperties = &aSCDataConnectorProperties 1458 } 1459 case "kind": 1460 if v != nil { 1461 var kind KindBasicDataConnector 1462 err = json.Unmarshal(*v, &kind) 1463 if err != nil { 1464 return err 1465 } 1466 adc.Kind = kind 1467 } 1468 case "id": 1469 if v != nil { 1470 var ID string 1471 err = json.Unmarshal(*v, &ID) 1472 if err != nil { 1473 return err 1474 } 1475 adc.ID = &ID 1476 } 1477 case "name": 1478 if v != nil { 1479 var name string 1480 err = json.Unmarshal(*v, &name) 1481 if err != nil { 1482 return err 1483 } 1484 adc.Name = &name 1485 } 1486 case "type": 1487 if v != nil { 1488 var typeVar string 1489 err = json.Unmarshal(*v, &typeVar) 1490 if err != nil { 1491 return err 1492 } 1493 adc.Type = &typeVar 1494 } 1495 case "etag": 1496 if v != nil { 1497 var etag string 1498 err = json.Unmarshal(*v, &etag) 1499 if err != nil { 1500 return err 1501 } 1502 adc.Etag = &etag 1503 } 1504 } 1505 } 1506 1507 return nil 1508} 1509 1510// ASCDataConnectorProperties ASC (Azure Security Center) data connector properties. 1511type ASCDataConnectorProperties struct { 1512 // SubscriptionID - The subscription id to connect to, and get the data from. 1513 SubscriptionID *string `json:"subscriptionId,omitempty"` 1514 // DataTypes - The available data types for the connector. 1515 DataTypes *AlertsDataTypeOfDataConnector `json:"dataTypes,omitempty"` 1516} 1517 1518// AwsCloudTrailDataConnector represents Amazon Web Services CloudTrail data connector. 1519type AwsCloudTrailDataConnector struct { 1520 // AwsCloudTrailDataConnectorProperties - Amazon Web Services CloudTrail data connector properties. 1521 *AwsCloudTrailDataConnectorProperties `json:"properties,omitempty"` 1522 // Kind - Possible values include: 'KindDataConnector', 'KindAzureActiveDirectory', 'KindAzureAdvancedThreatProtection', 'KindAzureSecurityCenter', 'KindAmazonWebServicesCloudTrail', 'KindMicrosoftCloudAppSecurity', 'KindMicrosoftDefenderAdvancedThreatProtection', 'KindOffice365', 'KindThreatIntelligence' 1523 Kind KindBasicDataConnector `json:"kind,omitempty"` 1524 // ID - READ-ONLY; Azure resource Id 1525 ID *string `json:"id,omitempty"` 1526 // Name - READ-ONLY; Azure resource name 1527 Name *string `json:"name,omitempty"` 1528 // Type - READ-ONLY; Azure resource type 1529 Type *string `json:"type,omitempty"` 1530 // Etag - Etag of the azure resource 1531 Etag *string `json:"etag,omitempty"` 1532} 1533 1534// MarshalJSON is the custom marshaler for AwsCloudTrailDataConnector. 1535func (actdc AwsCloudTrailDataConnector) MarshalJSON() ([]byte, error) { 1536 actdc.Kind = KindAmazonWebServicesCloudTrail 1537 objectMap := make(map[string]interface{}) 1538 if actdc.AwsCloudTrailDataConnectorProperties != nil { 1539 objectMap["properties"] = actdc.AwsCloudTrailDataConnectorProperties 1540 } 1541 if actdc.Kind != "" { 1542 objectMap["kind"] = actdc.Kind 1543 } 1544 if actdc.Etag != nil { 1545 objectMap["etag"] = actdc.Etag 1546 } 1547 return json.Marshal(objectMap) 1548} 1549 1550// AsAADDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 1551func (actdc AwsCloudTrailDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 1552 return nil, false 1553} 1554 1555// AsAATPDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 1556func (actdc AwsCloudTrailDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 1557 return nil, false 1558} 1559 1560// AsASCDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 1561func (actdc AwsCloudTrailDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 1562 return nil, false 1563} 1564 1565// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 1566func (actdc AwsCloudTrailDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 1567 return &actdc, true 1568} 1569 1570// AsMCASDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 1571func (actdc AwsCloudTrailDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 1572 return nil, false 1573} 1574 1575// AsMDATPDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 1576func (actdc AwsCloudTrailDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 1577 return nil, false 1578} 1579 1580// AsOfficeDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 1581func (actdc AwsCloudTrailDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 1582 return nil, false 1583} 1584 1585// AsTIDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 1586func (actdc AwsCloudTrailDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 1587 return nil, false 1588} 1589 1590// AsDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 1591func (actdc AwsCloudTrailDataConnector) AsDataConnector() (*DataConnector, bool) { 1592 return nil, false 1593} 1594 1595// AsBasicDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 1596func (actdc AwsCloudTrailDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 1597 return &actdc, true 1598} 1599 1600// UnmarshalJSON is the custom unmarshaler for AwsCloudTrailDataConnector struct. 1601func (actdc *AwsCloudTrailDataConnector) UnmarshalJSON(body []byte) error { 1602 var m map[string]*json.RawMessage 1603 err := json.Unmarshal(body, &m) 1604 if err != nil { 1605 return err 1606 } 1607 for k, v := range m { 1608 switch k { 1609 case "properties": 1610 if v != nil { 1611 var awsCloudTrailDataConnectorProperties AwsCloudTrailDataConnectorProperties 1612 err = json.Unmarshal(*v, &awsCloudTrailDataConnectorProperties) 1613 if err != nil { 1614 return err 1615 } 1616 actdc.AwsCloudTrailDataConnectorProperties = &awsCloudTrailDataConnectorProperties 1617 } 1618 case "kind": 1619 if v != nil { 1620 var kind KindBasicDataConnector 1621 err = json.Unmarshal(*v, &kind) 1622 if err != nil { 1623 return err 1624 } 1625 actdc.Kind = kind 1626 } 1627 case "id": 1628 if v != nil { 1629 var ID string 1630 err = json.Unmarshal(*v, &ID) 1631 if err != nil { 1632 return err 1633 } 1634 actdc.ID = &ID 1635 } 1636 case "name": 1637 if v != nil { 1638 var name string 1639 err = json.Unmarshal(*v, &name) 1640 if err != nil { 1641 return err 1642 } 1643 actdc.Name = &name 1644 } 1645 case "type": 1646 if v != nil { 1647 var typeVar string 1648 err = json.Unmarshal(*v, &typeVar) 1649 if err != nil { 1650 return err 1651 } 1652 actdc.Type = &typeVar 1653 } 1654 case "etag": 1655 if v != nil { 1656 var etag string 1657 err = json.Unmarshal(*v, &etag) 1658 if err != nil { 1659 return err 1660 } 1661 actdc.Etag = &etag 1662 } 1663 } 1664 } 1665 1666 return nil 1667} 1668 1669// AwsCloudTrailDataConnectorDataTypes the available data types for Amazon Web Services CloudTrail data 1670// connector. 1671type AwsCloudTrailDataConnectorDataTypes struct { 1672 // Logs - Logs data type. 1673 Logs *AwsCloudTrailDataConnectorDataTypesLogs `json:"logs,omitempty"` 1674} 1675 1676// AwsCloudTrailDataConnectorDataTypesLogs logs data type. 1677type AwsCloudTrailDataConnectorDataTypesLogs struct { 1678 // State - Describe whether this data type connection is enabled or not. Possible values include: 'Enabled', 'Disabled' 1679 State DataTypeState `json:"state,omitempty"` 1680} 1681 1682// AwsCloudTrailDataConnectorProperties amazon Web Services CloudTrail data connector properties. 1683type AwsCloudTrailDataConnectorProperties struct { 1684 // AwsRoleArn - The Aws Role Arn (with CloudTrailReadOnly policy) that is used to access the Aws account. 1685 AwsRoleArn *string `json:"awsRoleArn,omitempty"` 1686 // DataTypes - The available data types for the connector. 1687 DataTypes *AwsCloudTrailDataConnectorDataTypes `json:"dataTypes,omitempty"` 1688} 1689 1690// Bookmark represents a bookmark in Azure Security Insights. 1691type Bookmark struct { 1692 autorest.Response `json:"-"` 1693 // BookmarkProperties - Bookmark properties 1694 *BookmarkProperties `json:"properties,omitempty"` 1695 // ID - READ-ONLY; Azure resource Id 1696 ID *string `json:"id,omitempty"` 1697 // Name - READ-ONLY; Azure resource name 1698 Name *string `json:"name,omitempty"` 1699 // Type - READ-ONLY; Azure resource type 1700 Type *string `json:"type,omitempty"` 1701 // Etag - Etag of the azure resource 1702 Etag *string `json:"etag,omitempty"` 1703} 1704 1705// MarshalJSON is the custom marshaler for Bookmark. 1706func (b Bookmark) MarshalJSON() ([]byte, error) { 1707 objectMap := make(map[string]interface{}) 1708 if b.BookmarkProperties != nil { 1709 objectMap["properties"] = b.BookmarkProperties 1710 } 1711 if b.Etag != nil { 1712 objectMap["etag"] = b.Etag 1713 } 1714 return json.Marshal(objectMap) 1715} 1716 1717// UnmarshalJSON is the custom unmarshaler for Bookmark struct. 1718func (b *Bookmark) UnmarshalJSON(body []byte) error { 1719 var m map[string]*json.RawMessage 1720 err := json.Unmarshal(body, &m) 1721 if err != nil { 1722 return err 1723 } 1724 for k, v := range m { 1725 switch k { 1726 case "properties": 1727 if v != nil { 1728 var bookmarkProperties BookmarkProperties 1729 err = json.Unmarshal(*v, &bookmarkProperties) 1730 if err != nil { 1731 return err 1732 } 1733 b.BookmarkProperties = &bookmarkProperties 1734 } 1735 case "id": 1736 if v != nil { 1737 var ID string 1738 err = json.Unmarshal(*v, &ID) 1739 if err != nil { 1740 return err 1741 } 1742 b.ID = &ID 1743 } 1744 case "name": 1745 if v != nil { 1746 var name string 1747 err = json.Unmarshal(*v, &name) 1748 if err != nil { 1749 return err 1750 } 1751 b.Name = &name 1752 } 1753 case "type": 1754 if v != nil { 1755 var typeVar string 1756 err = json.Unmarshal(*v, &typeVar) 1757 if err != nil { 1758 return err 1759 } 1760 b.Type = &typeVar 1761 } 1762 case "etag": 1763 if v != nil { 1764 var etag string 1765 err = json.Unmarshal(*v, &etag) 1766 if err != nil { 1767 return err 1768 } 1769 b.Etag = &etag 1770 } 1771 } 1772 } 1773 1774 return nil 1775} 1776 1777// BookmarkList list all the bookmarks. 1778type BookmarkList struct { 1779 autorest.Response `json:"-"` 1780 // NextLink - READ-ONLY; URL to fetch the next set of cases. 1781 NextLink *string `json:"nextLink,omitempty"` 1782 // Value - Array of bookmarks. 1783 Value *[]Bookmark `json:"value,omitempty"` 1784} 1785 1786// MarshalJSON is the custom marshaler for BookmarkList. 1787func (bl BookmarkList) MarshalJSON() ([]byte, error) { 1788 objectMap := make(map[string]interface{}) 1789 if bl.Value != nil { 1790 objectMap["value"] = bl.Value 1791 } 1792 return json.Marshal(objectMap) 1793} 1794 1795// BookmarkListIterator provides access to a complete listing of Bookmark values. 1796type BookmarkListIterator struct { 1797 i int 1798 page BookmarkListPage 1799} 1800 1801// NextWithContext advances to the next value. If there was an error making 1802// the request the iterator does not advance and the error is returned. 1803func (iter *BookmarkListIterator) NextWithContext(ctx context.Context) (err error) { 1804 if tracing.IsEnabled() { 1805 ctx = tracing.StartSpan(ctx, fqdn+"/BookmarkListIterator.NextWithContext") 1806 defer func() { 1807 sc := -1 1808 if iter.Response().Response.Response != nil { 1809 sc = iter.Response().Response.Response.StatusCode 1810 } 1811 tracing.EndSpan(ctx, sc, err) 1812 }() 1813 } 1814 iter.i++ 1815 if iter.i < len(iter.page.Values()) { 1816 return nil 1817 } 1818 err = iter.page.NextWithContext(ctx) 1819 if err != nil { 1820 iter.i-- 1821 return err 1822 } 1823 iter.i = 0 1824 return nil 1825} 1826 1827// Next advances to the next value. If there was an error making 1828// the request the iterator does not advance and the error is returned. 1829// Deprecated: Use NextWithContext() instead. 1830func (iter *BookmarkListIterator) Next() error { 1831 return iter.NextWithContext(context.Background()) 1832} 1833 1834// NotDone returns true if the enumeration should be started or is not yet complete. 1835func (iter BookmarkListIterator) NotDone() bool { 1836 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 1837} 1838 1839// Response returns the raw server response from the last page request. 1840func (iter BookmarkListIterator) Response() BookmarkList { 1841 return iter.page.Response() 1842} 1843 1844// Value returns the current value or a zero-initialized value if the 1845// iterator has advanced beyond the end of the collection. 1846func (iter BookmarkListIterator) Value() Bookmark { 1847 if !iter.page.NotDone() { 1848 return Bookmark{} 1849 } 1850 return iter.page.Values()[iter.i] 1851} 1852 1853// Creates a new instance of the BookmarkListIterator type. 1854func NewBookmarkListIterator(page BookmarkListPage) BookmarkListIterator { 1855 return BookmarkListIterator{page: page} 1856} 1857 1858// IsEmpty returns true if the ListResult contains no values. 1859func (bl BookmarkList) IsEmpty() bool { 1860 return bl.Value == nil || len(*bl.Value) == 0 1861} 1862 1863// hasNextLink returns true if the NextLink is not empty. 1864func (bl BookmarkList) hasNextLink() bool { 1865 return bl.NextLink != nil && len(*bl.NextLink) != 0 1866} 1867 1868// bookmarkListPreparer prepares a request to retrieve the next set of results. 1869// It returns nil if no more results exist. 1870func (bl BookmarkList) bookmarkListPreparer(ctx context.Context) (*http.Request, error) { 1871 if !bl.hasNextLink() { 1872 return nil, nil 1873 } 1874 return autorest.Prepare((&http.Request{}).WithContext(ctx), 1875 autorest.AsJSON(), 1876 autorest.AsGet(), 1877 autorest.WithBaseURL(to.String(bl.NextLink))) 1878} 1879 1880// BookmarkListPage contains a page of Bookmark values. 1881type BookmarkListPage struct { 1882 fn func(context.Context, BookmarkList) (BookmarkList, error) 1883 bl BookmarkList 1884} 1885 1886// NextWithContext advances to the next page of values. If there was an error making 1887// the request the page does not advance and the error is returned. 1888func (page *BookmarkListPage) NextWithContext(ctx context.Context) (err error) { 1889 if tracing.IsEnabled() { 1890 ctx = tracing.StartSpan(ctx, fqdn+"/BookmarkListPage.NextWithContext") 1891 defer func() { 1892 sc := -1 1893 if page.Response().Response.Response != nil { 1894 sc = page.Response().Response.Response.StatusCode 1895 } 1896 tracing.EndSpan(ctx, sc, err) 1897 }() 1898 } 1899 for { 1900 next, err := page.fn(ctx, page.bl) 1901 if err != nil { 1902 return err 1903 } 1904 page.bl = next 1905 if !next.hasNextLink() || !next.IsEmpty() { 1906 break 1907 } 1908 } 1909 return nil 1910} 1911 1912// Next advances to the next page of values. If there was an error making 1913// the request the page does not advance and the error is returned. 1914// Deprecated: Use NextWithContext() instead. 1915func (page *BookmarkListPage) Next() error { 1916 return page.NextWithContext(context.Background()) 1917} 1918 1919// NotDone returns true if the page enumeration should be started or is not yet complete. 1920func (page BookmarkListPage) NotDone() bool { 1921 return !page.bl.IsEmpty() 1922} 1923 1924// Response returns the raw server response from the last page request. 1925func (page BookmarkListPage) Response() BookmarkList { 1926 return page.bl 1927} 1928 1929// Values returns the slice of values for the current page or nil if there are no values. 1930func (page BookmarkListPage) Values() []Bookmark { 1931 if page.bl.IsEmpty() { 1932 return nil 1933 } 1934 return *page.bl.Value 1935} 1936 1937// Creates a new instance of the BookmarkListPage type. 1938func NewBookmarkListPage(cur BookmarkList, getNextPage func(context.Context, BookmarkList) (BookmarkList, error)) BookmarkListPage { 1939 return BookmarkListPage{ 1940 fn: getNextPage, 1941 bl: cur, 1942 } 1943} 1944 1945// BookmarkProperties describes bookmark properties 1946type BookmarkProperties struct { 1947 // Created - The time the bookmark was created 1948 Created *date.Time `json:"created,omitempty"` 1949 // CreatedBy - Describes a user that created the bookmark 1950 CreatedBy *UserInfo `json:"createdBy,omitempty"` 1951 // DisplayName - The display name of the bookmark 1952 DisplayName *string `json:"displayName,omitempty"` 1953 // Labels - List of labels relevant to this bookmark 1954 Labels *[]string `json:"labels,omitempty"` 1955 // Notes - The notes of the bookmark 1956 Notes *string `json:"notes,omitempty"` 1957 // Query - The query of the bookmark. 1958 Query *string `json:"query,omitempty"` 1959 // QueryResult - The query result of the bookmark. 1960 QueryResult *string `json:"queryResult,omitempty"` 1961 // Updated - The last time the bookmark was updated 1962 Updated *date.Time `json:"updated,omitempty"` 1963 // UpdatedBy - Describes a user that updated the bookmark 1964 UpdatedBy *UserInfo `json:"updatedBy,omitempty"` 1965 // IncidentInfo - Describes an incident that relates to bookmark 1966 IncidentInfo *IncidentInfo `json:"incidentInfo,omitempty"` 1967} 1968 1969// ClientInfo information on the client (user or application) that made some action 1970type ClientInfo struct { 1971 // Email - The email of the client. 1972 Email *string `json:"email,omitempty"` 1973 // Name - The name of the client. 1974 Name *string `json:"name,omitempty"` 1975 // ObjectID - The object id of the client. 1976 ObjectID *uuid.UUID `json:"objectId,omitempty"` 1977 // UserPrincipalName - The user principal name of the client. 1978 UserPrincipalName *string `json:"userPrincipalName,omitempty"` 1979} 1980 1981// CloudError an error response for a resource management request. 1982type CloudError struct { 1983 // Error - The error object of the CloudError response 1984 Error *ErrorResponse `json:"error,omitempty"` 1985} 1986 1987// BasicDataConnector data connector. 1988type BasicDataConnector interface { 1989 AsAADDataConnector() (*AADDataConnector, bool) 1990 AsAATPDataConnector() (*AATPDataConnector, bool) 1991 AsASCDataConnector() (*ASCDataConnector, bool) 1992 AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) 1993 AsMCASDataConnector() (*MCASDataConnector, bool) 1994 AsMDATPDataConnector() (*MDATPDataConnector, bool) 1995 AsOfficeDataConnector() (*OfficeDataConnector, bool) 1996 AsTIDataConnector() (*TIDataConnector, bool) 1997 AsDataConnector() (*DataConnector, bool) 1998} 1999 2000// DataConnector data connector. 2001type DataConnector struct { 2002 autorest.Response `json:"-"` 2003 // Kind - Possible values include: 'KindDataConnector', 'KindAzureActiveDirectory', 'KindAzureAdvancedThreatProtection', 'KindAzureSecurityCenter', 'KindAmazonWebServicesCloudTrail', 'KindMicrosoftCloudAppSecurity', 'KindMicrosoftDefenderAdvancedThreatProtection', 'KindOffice365', 'KindThreatIntelligence' 2004 Kind KindBasicDataConnector `json:"kind,omitempty"` 2005 // ID - READ-ONLY; Azure resource Id 2006 ID *string `json:"id,omitempty"` 2007 // Name - READ-ONLY; Azure resource name 2008 Name *string `json:"name,omitempty"` 2009 // Type - READ-ONLY; Azure resource type 2010 Type *string `json:"type,omitempty"` 2011 // Etag - Etag of the azure resource 2012 Etag *string `json:"etag,omitempty"` 2013} 2014 2015func unmarshalBasicDataConnector(body []byte) (BasicDataConnector, error) { 2016 var m map[string]interface{} 2017 err := json.Unmarshal(body, &m) 2018 if err != nil { 2019 return nil, err 2020 } 2021 2022 switch m["kind"] { 2023 case string(KindAzureActiveDirectory): 2024 var adc AADDataConnector 2025 err := json.Unmarshal(body, &adc) 2026 return adc, err 2027 case string(KindAzureAdvancedThreatProtection): 2028 var adc AATPDataConnector 2029 err := json.Unmarshal(body, &adc) 2030 return adc, err 2031 case string(KindAzureSecurityCenter): 2032 var adc ASCDataConnector 2033 err := json.Unmarshal(body, &adc) 2034 return adc, err 2035 case string(KindAmazonWebServicesCloudTrail): 2036 var actdc AwsCloudTrailDataConnector 2037 err := json.Unmarshal(body, &actdc) 2038 return actdc, err 2039 case string(KindMicrosoftCloudAppSecurity): 2040 var mdc MCASDataConnector 2041 err := json.Unmarshal(body, &mdc) 2042 return mdc, err 2043 case string(KindMicrosoftDefenderAdvancedThreatProtection): 2044 var mdc MDATPDataConnector 2045 err := json.Unmarshal(body, &mdc) 2046 return mdc, err 2047 case string(KindOffice365): 2048 var odc OfficeDataConnector 2049 err := json.Unmarshal(body, &odc) 2050 return odc, err 2051 case string(KindThreatIntelligence): 2052 var tdc TIDataConnector 2053 err := json.Unmarshal(body, &tdc) 2054 return tdc, err 2055 default: 2056 var dc DataConnector 2057 err := json.Unmarshal(body, &dc) 2058 return dc, err 2059 } 2060} 2061func unmarshalBasicDataConnectorArray(body []byte) ([]BasicDataConnector, error) { 2062 var rawMessages []*json.RawMessage 2063 err := json.Unmarshal(body, &rawMessages) 2064 if err != nil { 2065 return nil, err 2066 } 2067 2068 dcArray := make([]BasicDataConnector, len(rawMessages)) 2069 2070 for index, rawMessage := range rawMessages { 2071 dc, err := unmarshalBasicDataConnector(*rawMessage) 2072 if err != nil { 2073 return nil, err 2074 } 2075 dcArray[index] = dc 2076 } 2077 return dcArray, nil 2078} 2079 2080// MarshalJSON is the custom marshaler for DataConnector. 2081func (dc DataConnector) MarshalJSON() ([]byte, error) { 2082 dc.Kind = KindDataConnector 2083 objectMap := make(map[string]interface{}) 2084 if dc.Kind != "" { 2085 objectMap["kind"] = dc.Kind 2086 } 2087 if dc.Etag != nil { 2088 objectMap["etag"] = dc.Etag 2089 } 2090 return json.Marshal(objectMap) 2091} 2092 2093// AsAADDataConnector is the BasicDataConnector implementation for DataConnector. 2094func (dc DataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 2095 return nil, false 2096} 2097 2098// AsAATPDataConnector is the BasicDataConnector implementation for DataConnector. 2099func (dc DataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 2100 return nil, false 2101} 2102 2103// AsASCDataConnector is the BasicDataConnector implementation for DataConnector. 2104func (dc DataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 2105 return nil, false 2106} 2107 2108// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for DataConnector. 2109func (dc DataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 2110 return nil, false 2111} 2112 2113// AsMCASDataConnector is the BasicDataConnector implementation for DataConnector. 2114func (dc DataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 2115 return nil, false 2116} 2117 2118// AsMDATPDataConnector is the BasicDataConnector implementation for DataConnector. 2119func (dc DataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 2120 return nil, false 2121} 2122 2123// AsOfficeDataConnector is the BasicDataConnector implementation for DataConnector. 2124func (dc DataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 2125 return nil, false 2126} 2127 2128// AsTIDataConnector is the BasicDataConnector implementation for DataConnector. 2129func (dc DataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 2130 return nil, false 2131} 2132 2133// AsDataConnector is the BasicDataConnector implementation for DataConnector. 2134func (dc DataConnector) AsDataConnector() (*DataConnector, bool) { 2135 return &dc, true 2136} 2137 2138// AsBasicDataConnector is the BasicDataConnector implementation for DataConnector. 2139func (dc DataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 2140 return &dc, true 2141} 2142 2143// DataConnectorDataTypeCommon common field for data type in data connectors. 2144type DataConnectorDataTypeCommon struct { 2145 // State - Describe whether this data type connection is enabled or not. Possible values include: 'Enabled', 'Disabled' 2146 State DataTypeState `json:"state,omitempty"` 2147} 2148 2149// DataConnectorList list all the data connectors. 2150type DataConnectorList struct { 2151 autorest.Response `json:"-"` 2152 // NextLink - READ-ONLY; URL to fetch the next set of data connectors. 2153 NextLink *string `json:"nextLink,omitempty"` 2154 // Value - Array of data connectors. 2155 Value *[]BasicDataConnector `json:"value,omitempty"` 2156} 2157 2158// MarshalJSON is the custom marshaler for DataConnectorList. 2159func (dcl DataConnectorList) MarshalJSON() ([]byte, error) { 2160 objectMap := make(map[string]interface{}) 2161 if dcl.Value != nil { 2162 objectMap["value"] = dcl.Value 2163 } 2164 return json.Marshal(objectMap) 2165} 2166 2167// UnmarshalJSON is the custom unmarshaler for DataConnectorList struct. 2168func (dcl *DataConnectorList) UnmarshalJSON(body []byte) error { 2169 var m map[string]*json.RawMessage 2170 err := json.Unmarshal(body, &m) 2171 if err != nil { 2172 return err 2173 } 2174 for k, v := range m { 2175 switch k { 2176 case "nextLink": 2177 if v != nil { 2178 var nextLink string 2179 err = json.Unmarshal(*v, &nextLink) 2180 if err != nil { 2181 return err 2182 } 2183 dcl.NextLink = &nextLink 2184 } 2185 case "value": 2186 if v != nil { 2187 value, err := unmarshalBasicDataConnectorArray(*v) 2188 if err != nil { 2189 return err 2190 } 2191 dcl.Value = &value 2192 } 2193 } 2194 } 2195 2196 return nil 2197} 2198 2199// DataConnectorListIterator provides access to a complete listing of DataConnector values. 2200type DataConnectorListIterator struct { 2201 i int 2202 page DataConnectorListPage 2203} 2204 2205// NextWithContext advances to the next value. If there was an error making 2206// the request the iterator does not advance and the error is returned. 2207func (iter *DataConnectorListIterator) NextWithContext(ctx context.Context) (err error) { 2208 if tracing.IsEnabled() { 2209 ctx = tracing.StartSpan(ctx, fqdn+"/DataConnectorListIterator.NextWithContext") 2210 defer func() { 2211 sc := -1 2212 if iter.Response().Response.Response != nil { 2213 sc = iter.Response().Response.Response.StatusCode 2214 } 2215 tracing.EndSpan(ctx, sc, err) 2216 }() 2217 } 2218 iter.i++ 2219 if iter.i < len(iter.page.Values()) { 2220 return nil 2221 } 2222 err = iter.page.NextWithContext(ctx) 2223 if err != nil { 2224 iter.i-- 2225 return err 2226 } 2227 iter.i = 0 2228 return nil 2229} 2230 2231// Next advances to the next value. If there was an error making 2232// the request the iterator does not advance and the error is returned. 2233// Deprecated: Use NextWithContext() instead. 2234func (iter *DataConnectorListIterator) Next() error { 2235 return iter.NextWithContext(context.Background()) 2236} 2237 2238// NotDone returns true if the enumeration should be started or is not yet complete. 2239func (iter DataConnectorListIterator) NotDone() bool { 2240 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 2241} 2242 2243// Response returns the raw server response from the last page request. 2244func (iter DataConnectorListIterator) Response() DataConnectorList { 2245 return iter.page.Response() 2246} 2247 2248// Value returns the current value or a zero-initialized value if the 2249// iterator has advanced beyond the end of the collection. 2250func (iter DataConnectorListIterator) Value() BasicDataConnector { 2251 if !iter.page.NotDone() { 2252 return DataConnector{} 2253 } 2254 return iter.page.Values()[iter.i] 2255} 2256 2257// Creates a new instance of the DataConnectorListIterator type. 2258func NewDataConnectorListIterator(page DataConnectorListPage) DataConnectorListIterator { 2259 return DataConnectorListIterator{page: page} 2260} 2261 2262// IsEmpty returns true if the ListResult contains no values. 2263func (dcl DataConnectorList) IsEmpty() bool { 2264 return dcl.Value == nil || len(*dcl.Value) == 0 2265} 2266 2267// hasNextLink returns true if the NextLink is not empty. 2268func (dcl DataConnectorList) hasNextLink() bool { 2269 return dcl.NextLink != nil && len(*dcl.NextLink) != 0 2270} 2271 2272// dataConnectorListPreparer prepares a request to retrieve the next set of results. 2273// It returns nil if no more results exist. 2274func (dcl DataConnectorList) dataConnectorListPreparer(ctx context.Context) (*http.Request, error) { 2275 if !dcl.hasNextLink() { 2276 return nil, nil 2277 } 2278 return autorest.Prepare((&http.Request{}).WithContext(ctx), 2279 autorest.AsJSON(), 2280 autorest.AsGet(), 2281 autorest.WithBaseURL(to.String(dcl.NextLink))) 2282} 2283 2284// DataConnectorListPage contains a page of BasicDataConnector values. 2285type DataConnectorListPage struct { 2286 fn func(context.Context, DataConnectorList) (DataConnectorList, error) 2287 dcl DataConnectorList 2288} 2289 2290// NextWithContext advances to the next page of values. If there was an error making 2291// the request the page does not advance and the error is returned. 2292func (page *DataConnectorListPage) NextWithContext(ctx context.Context) (err error) { 2293 if tracing.IsEnabled() { 2294 ctx = tracing.StartSpan(ctx, fqdn+"/DataConnectorListPage.NextWithContext") 2295 defer func() { 2296 sc := -1 2297 if page.Response().Response.Response != nil { 2298 sc = page.Response().Response.Response.StatusCode 2299 } 2300 tracing.EndSpan(ctx, sc, err) 2301 }() 2302 } 2303 for { 2304 next, err := page.fn(ctx, page.dcl) 2305 if err != nil { 2306 return err 2307 } 2308 page.dcl = next 2309 if !next.hasNextLink() || !next.IsEmpty() { 2310 break 2311 } 2312 } 2313 return nil 2314} 2315 2316// Next advances to the next page of values. If there was an error making 2317// the request the page does not advance and the error is returned. 2318// Deprecated: Use NextWithContext() instead. 2319func (page *DataConnectorListPage) Next() error { 2320 return page.NextWithContext(context.Background()) 2321} 2322 2323// NotDone returns true if the page enumeration should be started or is not yet complete. 2324func (page DataConnectorListPage) NotDone() bool { 2325 return !page.dcl.IsEmpty() 2326} 2327 2328// Response returns the raw server response from the last page request. 2329func (page DataConnectorListPage) Response() DataConnectorList { 2330 return page.dcl 2331} 2332 2333// Values returns the slice of values for the current page or nil if there are no values. 2334func (page DataConnectorListPage) Values() []BasicDataConnector { 2335 if page.dcl.IsEmpty() { 2336 return nil 2337 } 2338 return *page.dcl.Value 2339} 2340 2341// Creates a new instance of the DataConnectorListPage type. 2342func NewDataConnectorListPage(cur DataConnectorList, getNextPage func(context.Context, DataConnectorList) (DataConnectorList, error)) DataConnectorListPage { 2343 return DataConnectorListPage{ 2344 fn: getNextPage, 2345 dcl: cur, 2346 } 2347} 2348 2349// DataConnectorModel ... 2350type DataConnectorModel struct { 2351 autorest.Response `json:"-"` 2352 Value BasicDataConnector `json:"value,omitempty"` 2353} 2354 2355// UnmarshalJSON is the custom unmarshaler for DataConnectorModel struct. 2356func (dcm *DataConnectorModel) UnmarshalJSON(body []byte) error { 2357 dc, err := unmarshalBasicDataConnector(body) 2358 if err != nil { 2359 return err 2360 } 2361 dcm.Value = dc 2362 2363 return nil 2364} 2365 2366// DataConnectorTenantID properties data connector on tenant level. 2367type DataConnectorTenantID struct { 2368 // TenantID - The tenant id to connect to, and get the data from. 2369 TenantID *string `json:"tenantId,omitempty"` 2370} 2371 2372// DataConnectorWithAlertsProperties data connector properties. 2373type DataConnectorWithAlertsProperties struct { 2374 // DataTypes - The available data types for the connector. 2375 DataTypes *AlertsDataTypeOfDataConnector `json:"dataTypes,omitempty"` 2376} 2377 2378// ErrorAdditionalInfo the resource management error additional info. 2379type ErrorAdditionalInfo struct { 2380 // Type - READ-ONLY; The additional info type. 2381 Type *string `json:"type,omitempty"` 2382 // Info - READ-ONLY; The additional info. 2383 Info interface{} `json:"info,omitempty"` 2384} 2385 2386// MarshalJSON is the custom marshaler for ErrorAdditionalInfo. 2387func (eai ErrorAdditionalInfo) MarshalJSON() ([]byte, error) { 2388 objectMap := make(map[string]interface{}) 2389 return json.Marshal(objectMap) 2390} 2391 2392// ErrorResponse common error response for all Azure Resource Manager APIs to return error details for 2393// failed operations. (This also follows the OData error response format.) 2394type ErrorResponse struct { 2395 // Code - READ-ONLY; The error code. 2396 Code *string `json:"code,omitempty"` 2397 // Message - READ-ONLY; The error message. 2398 Message *string `json:"message,omitempty"` 2399 // Target - READ-ONLY; The error target. 2400 Target *string `json:"target,omitempty"` 2401 // Details - READ-ONLY; The error details. 2402 Details *[]ErrorResponse `json:"details,omitempty"` 2403 // AdditionalInfo - READ-ONLY; The error additional info. 2404 AdditionalInfo *[]ErrorAdditionalInfo `json:"additionalInfo,omitempty"` 2405} 2406 2407// MarshalJSON is the custom marshaler for ErrorResponse. 2408func (er ErrorResponse) MarshalJSON() ([]byte, error) { 2409 objectMap := make(map[string]interface{}) 2410 return json.Marshal(objectMap) 2411} 2412 2413// FusionAlertRule represents Fusion alert rule. 2414type FusionAlertRule struct { 2415 // FusionAlertRuleProperties - Fusion alert rule properties 2416 *FusionAlertRuleProperties `json:"properties,omitempty"` 2417 // Kind - Possible values include: 'KindAlertRule', 'KindFusion', 'KindMicrosoftSecurityIncidentCreation', 'KindScheduled' 2418 Kind Kind `json:"kind,omitempty"` 2419 // ID - READ-ONLY; Azure resource Id 2420 ID *string `json:"id,omitempty"` 2421 // Name - READ-ONLY; Azure resource name 2422 Name *string `json:"name,omitempty"` 2423 // Type - READ-ONLY; Azure resource type 2424 Type *string `json:"type,omitempty"` 2425 // Etag - Etag of the azure resource 2426 Etag *string `json:"etag,omitempty"` 2427} 2428 2429// MarshalJSON is the custom marshaler for FusionAlertRule. 2430func (far FusionAlertRule) MarshalJSON() ([]byte, error) { 2431 far.Kind = KindFusion 2432 objectMap := make(map[string]interface{}) 2433 if far.FusionAlertRuleProperties != nil { 2434 objectMap["properties"] = far.FusionAlertRuleProperties 2435 } 2436 if far.Kind != "" { 2437 objectMap["kind"] = far.Kind 2438 } 2439 if far.Etag != nil { 2440 objectMap["etag"] = far.Etag 2441 } 2442 return json.Marshal(objectMap) 2443} 2444 2445// AsFusionAlertRule is the BasicAlertRule implementation for FusionAlertRule. 2446func (far FusionAlertRule) AsFusionAlertRule() (*FusionAlertRule, bool) { 2447 return &far, true 2448} 2449 2450// AsMicrosoftSecurityIncidentCreationAlertRule is the BasicAlertRule implementation for FusionAlertRule. 2451func (far FusionAlertRule) AsMicrosoftSecurityIncidentCreationAlertRule() (*MicrosoftSecurityIncidentCreationAlertRule, bool) { 2452 return nil, false 2453} 2454 2455// AsScheduledAlertRule is the BasicAlertRule implementation for FusionAlertRule. 2456func (far FusionAlertRule) AsScheduledAlertRule() (*ScheduledAlertRule, bool) { 2457 return nil, false 2458} 2459 2460// AsAlertRule is the BasicAlertRule implementation for FusionAlertRule. 2461func (far FusionAlertRule) AsAlertRule() (*AlertRule, bool) { 2462 return nil, false 2463} 2464 2465// AsBasicAlertRule is the BasicAlertRule implementation for FusionAlertRule. 2466func (far FusionAlertRule) AsBasicAlertRule() (BasicAlertRule, bool) { 2467 return &far, true 2468} 2469 2470// UnmarshalJSON is the custom unmarshaler for FusionAlertRule struct. 2471func (far *FusionAlertRule) UnmarshalJSON(body []byte) error { 2472 var m map[string]*json.RawMessage 2473 err := json.Unmarshal(body, &m) 2474 if err != nil { 2475 return err 2476 } 2477 for k, v := range m { 2478 switch k { 2479 case "properties": 2480 if v != nil { 2481 var fusionAlertRuleProperties FusionAlertRuleProperties 2482 err = json.Unmarshal(*v, &fusionAlertRuleProperties) 2483 if err != nil { 2484 return err 2485 } 2486 far.FusionAlertRuleProperties = &fusionAlertRuleProperties 2487 } 2488 case "kind": 2489 if v != nil { 2490 var kind Kind 2491 err = json.Unmarshal(*v, &kind) 2492 if err != nil { 2493 return err 2494 } 2495 far.Kind = kind 2496 } 2497 case "id": 2498 if v != nil { 2499 var ID string 2500 err = json.Unmarshal(*v, &ID) 2501 if err != nil { 2502 return err 2503 } 2504 far.ID = &ID 2505 } 2506 case "name": 2507 if v != nil { 2508 var name string 2509 err = json.Unmarshal(*v, &name) 2510 if err != nil { 2511 return err 2512 } 2513 far.Name = &name 2514 } 2515 case "type": 2516 if v != nil { 2517 var typeVar string 2518 err = json.Unmarshal(*v, &typeVar) 2519 if err != nil { 2520 return err 2521 } 2522 far.Type = &typeVar 2523 } 2524 case "etag": 2525 if v != nil { 2526 var etag string 2527 err = json.Unmarshal(*v, &etag) 2528 if err != nil { 2529 return err 2530 } 2531 far.Etag = &etag 2532 } 2533 } 2534 } 2535 2536 return nil 2537} 2538 2539// FusionAlertRuleProperties fusion alert rule base property bag. 2540type FusionAlertRuleProperties struct { 2541 // AlertRuleTemplateName - The Name of the alert rule template used to create this rule. 2542 AlertRuleTemplateName *string `json:"alertRuleTemplateName,omitempty"` 2543 // Description - READ-ONLY; The description of the alert rule. 2544 Description *string `json:"description,omitempty"` 2545 // DisplayName - READ-ONLY; The display name for alerts created by this alert rule. 2546 DisplayName *string `json:"displayName,omitempty"` 2547 // Enabled - Determines whether this alert rule is enabled or disabled. 2548 Enabled *bool `json:"enabled,omitempty"` 2549 // LastModifiedUtc - READ-ONLY; The last time that this alert has been modified. 2550 LastModifiedUtc *date.Time `json:"lastModifiedUtc,omitempty"` 2551 // Severity - READ-ONLY; The severity for alerts created by this alert rule. Possible values include: 'High', 'Medium', 'Low', 'Informational' 2552 Severity AlertSeverity `json:"severity,omitempty"` 2553 // Tactics - READ-ONLY; The tactics of the alert rule 2554 Tactics *[]AttackTactic `json:"tactics,omitempty"` 2555} 2556 2557// MarshalJSON is the custom marshaler for FusionAlertRuleProperties. 2558func (farp FusionAlertRuleProperties) MarshalJSON() ([]byte, error) { 2559 objectMap := make(map[string]interface{}) 2560 if farp.AlertRuleTemplateName != nil { 2561 objectMap["alertRuleTemplateName"] = farp.AlertRuleTemplateName 2562 } 2563 if farp.Enabled != nil { 2564 objectMap["enabled"] = farp.Enabled 2565 } 2566 return json.Marshal(objectMap) 2567} 2568 2569// FusionAlertRuleTemplate represents Fusion alert rule template. 2570type FusionAlertRuleTemplate struct { 2571 // FusionAlertRuleTemplateProperties - Fusion alert rule template properties 2572 *FusionAlertRuleTemplateProperties `json:"properties,omitempty"` 2573 // Kind - Possible values include: 'KindBasicAlertRuleTemplateKindAlertRuleTemplate', 'KindBasicAlertRuleTemplateKindFusion', 'KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleTemplateKindScheduled' 2574 Kind KindBasicAlertRuleTemplate `json:"kind,omitempty"` 2575 // ID - READ-ONLY; Azure resource Id 2576 ID *string `json:"id,omitempty"` 2577 // Name - READ-ONLY; Azure resource name 2578 Name *string `json:"name,omitempty"` 2579 // Type - READ-ONLY; Azure resource type 2580 Type *string `json:"type,omitempty"` 2581} 2582 2583// MarshalJSON is the custom marshaler for FusionAlertRuleTemplate. 2584func (fart FusionAlertRuleTemplate) MarshalJSON() ([]byte, error) { 2585 fart.Kind = KindBasicAlertRuleTemplateKindFusion 2586 objectMap := make(map[string]interface{}) 2587 if fart.FusionAlertRuleTemplateProperties != nil { 2588 objectMap["properties"] = fart.FusionAlertRuleTemplateProperties 2589 } 2590 if fart.Kind != "" { 2591 objectMap["kind"] = fart.Kind 2592 } 2593 return json.Marshal(objectMap) 2594} 2595 2596// AsFusionAlertRuleTemplate is the BasicAlertRuleTemplate implementation for FusionAlertRuleTemplate. 2597func (fart FusionAlertRuleTemplate) AsFusionAlertRuleTemplate() (*FusionAlertRuleTemplate, bool) { 2598 return &fart, true 2599} 2600 2601// AsMicrosoftSecurityIncidentCreationAlertRuleTemplate is the BasicAlertRuleTemplate implementation for FusionAlertRuleTemplate. 2602func (fart FusionAlertRuleTemplate) AsMicrosoftSecurityIncidentCreationAlertRuleTemplate() (*MicrosoftSecurityIncidentCreationAlertRuleTemplate, bool) { 2603 return nil, false 2604} 2605 2606// AsScheduledAlertRuleTemplate is the BasicAlertRuleTemplate implementation for FusionAlertRuleTemplate. 2607func (fart FusionAlertRuleTemplate) AsScheduledAlertRuleTemplate() (*ScheduledAlertRuleTemplate, bool) { 2608 return nil, false 2609} 2610 2611// AsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for FusionAlertRuleTemplate. 2612func (fart FusionAlertRuleTemplate) AsAlertRuleTemplate() (*AlertRuleTemplate, bool) { 2613 return nil, false 2614} 2615 2616// AsBasicAlertRuleTemplate is the BasicAlertRuleTemplate implementation for FusionAlertRuleTemplate. 2617func (fart FusionAlertRuleTemplate) AsBasicAlertRuleTemplate() (BasicAlertRuleTemplate, bool) { 2618 return &fart, true 2619} 2620 2621// UnmarshalJSON is the custom unmarshaler for FusionAlertRuleTemplate struct. 2622func (fart *FusionAlertRuleTemplate) UnmarshalJSON(body []byte) error { 2623 var m map[string]*json.RawMessage 2624 err := json.Unmarshal(body, &m) 2625 if err != nil { 2626 return err 2627 } 2628 for k, v := range m { 2629 switch k { 2630 case "properties": 2631 if v != nil { 2632 var fusionAlertRuleTemplateProperties FusionAlertRuleTemplateProperties 2633 err = json.Unmarshal(*v, &fusionAlertRuleTemplateProperties) 2634 if err != nil { 2635 return err 2636 } 2637 fart.FusionAlertRuleTemplateProperties = &fusionAlertRuleTemplateProperties 2638 } 2639 case "kind": 2640 if v != nil { 2641 var kind KindBasicAlertRuleTemplate 2642 err = json.Unmarshal(*v, &kind) 2643 if err != nil { 2644 return err 2645 } 2646 fart.Kind = kind 2647 } 2648 case "id": 2649 if v != nil { 2650 var ID string 2651 err = json.Unmarshal(*v, &ID) 2652 if err != nil { 2653 return err 2654 } 2655 fart.ID = &ID 2656 } 2657 case "name": 2658 if v != nil { 2659 var name string 2660 err = json.Unmarshal(*v, &name) 2661 if err != nil { 2662 return err 2663 } 2664 fart.Name = &name 2665 } 2666 case "type": 2667 if v != nil { 2668 var typeVar string 2669 err = json.Unmarshal(*v, &typeVar) 2670 if err != nil { 2671 return err 2672 } 2673 fart.Type = &typeVar 2674 } 2675 } 2676 } 2677 2678 return nil 2679} 2680 2681// FusionAlertRuleTemplateProperties represents Fusion alert rule template properties 2682type FusionAlertRuleTemplateProperties struct { 2683 // AlertRulesCreatedByTemplateCount - the number of alert rules that were created by this template 2684 AlertRulesCreatedByTemplateCount *int32 `json:"alertRulesCreatedByTemplateCount,omitempty"` 2685 // CreatedDateUTC - READ-ONLY; The time that this alert rule template has been added. 2686 CreatedDateUTC *date.Time `json:"createdDateUTC,omitempty"` 2687 // Description - The description of the alert rule template. 2688 Description *string `json:"description,omitempty"` 2689 // DisplayName - The display name for alert rule template. 2690 DisplayName *string `json:"displayName,omitempty"` 2691 // RequiredDataConnectors - The required data connectors for this template 2692 RequiredDataConnectors *[]AlertRuleTemplateDataSource `json:"requiredDataConnectors,omitempty"` 2693 // Status - The alert rule template status. Possible values include: 'Installed', 'Available', 'NotAvailable' 2694 Status TemplateStatus `json:"status,omitempty"` 2695 // Severity - The severity for alerts created by this alert rule. Possible values include: 'High', 'Medium', 'Low', 'Informational' 2696 Severity AlertSeverity `json:"severity,omitempty"` 2697 // Tactics - The tactics of the alert rule template 2698 Tactics *[]AttackTactic `json:"tactics,omitempty"` 2699} 2700 2701// MarshalJSON is the custom marshaler for FusionAlertRuleTemplateProperties. 2702func (fartp FusionAlertRuleTemplateProperties) MarshalJSON() ([]byte, error) { 2703 objectMap := make(map[string]interface{}) 2704 if fartp.AlertRulesCreatedByTemplateCount != nil { 2705 objectMap["alertRulesCreatedByTemplateCount"] = fartp.AlertRulesCreatedByTemplateCount 2706 } 2707 if fartp.Description != nil { 2708 objectMap["description"] = fartp.Description 2709 } 2710 if fartp.DisplayName != nil { 2711 objectMap["displayName"] = fartp.DisplayName 2712 } 2713 if fartp.RequiredDataConnectors != nil { 2714 objectMap["requiredDataConnectors"] = fartp.RequiredDataConnectors 2715 } 2716 if fartp.Status != "" { 2717 objectMap["status"] = fartp.Status 2718 } 2719 if fartp.Severity != "" { 2720 objectMap["severity"] = fartp.Severity 2721 } 2722 if fartp.Tactics != nil { 2723 objectMap["tactics"] = fartp.Tactics 2724 } 2725 return json.Marshal(objectMap) 2726} 2727 2728// Incident represents an incident in Azure Security Insights. 2729type Incident struct { 2730 autorest.Response `json:"-"` 2731 // IncidentProperties - Incident properties 2732 *IncidentProperties `json:"properties,omitempty"` 2733 // ID - READ-ONLY; Azure resource Id 2734 ID *string `json:"id,omitempty"` 2735 // Name - READ-ONLY; Azure resource name 2736 Name *string `json:"name,omitempty"` 2737 // Type - READ-ONLY; Azure resource type 2738 Type *string `json:"type,omitempty"` 2739 // Etag - Etag of the azure resource 2740 Etag *string `json:"etag,omitempty"` 2741} 2742 2743// MarshalJSON is the custom marshaler for Incident. 2744func (i Incident) MarshalJSON() ([]byte, error) { 2745 objectMap := make(map[string]interface{}) 2746 if i.IncidentProperties != nil { 2747 objectMap["properties"] = i.IncidentProperties 2748 } 2749 if i.Etag != nil { 2750 objectMap["etag"] = i.Etag 2751 } 2752 return json.Marshal(objectMap) 2753} 2754 2755// UnmarshalJSON is the custom unmarshaler for Incident struct. 2756func (i *Incident) UnmarshalJSON(body []byte) error { 2757 var m map[string]*json.RawMessage 2758 err := json.Unmarshal(body, &m) 2759 if err != nil { 2760 return err 2761 } 2762 for k, v := range m { 2763 switch k { 2764 case "properties": 2765 if v != nil { 2766 var incidentProperties IncidentProperties 2767 err = json.Unmarshal(*v, &incidentProperties) 2768 if err != nil { 2769 return err 2770 } 2771 i.IncidentProperties = &incidentProperties 2772 } 2773 case "id": 2774 if v != nil { 2775 var ID string 2776 err = json.Unmarshal(*v, &ID) 2777 if err != nil { 2778 return err 2779 } 2780 i.ID = &ID 2781 } 2782 case "name": 2783 if v != nil { 2784 var name string 2785 err = json.Unmarshal(*v, &name) 2786 if err != nil { 2787 return err 2788 } 2789 i.Name = &name 2790 } 2791 case "type": 2792 if v != nil { 2793 var typeVar string 2794 err = json.Unmarshal(*v, &typeVar) 2795 if err != nil { 2796 return err 2797 } 2798 i.Type = &typeVar 2799 } 2800 case "etag": 2801 if v != nil { 2802 var etag string 2803 err = json.Unmarshal(*v, &etag) 2804 if err != nil { 2805 return err 2806 } 2807 i.Etag = &etag 2808 } 2809 } 2810 } 2811 2812 return nil 2813} 2814 2815// IncidentAdditionalData incident additional data property bag. 2816type IncidentAdditionalData struct { 2817 // AlertsCount - READ-ONLY; The number of alerts in the incident 2818 AlertsCount *int32 `json:"alertsCount,omitempty"` 2819 // BookmarksCount - READ-ONLY; The number of bookmarks in the incident 2820 BookmarksCount *int32 `json:"bookmarksCount,omitempty"` 2821 // CommentsCount - READ-ONLY; The number of comments in the incident 2822 CommentsCount *int32 `json:"commentsCount,omitempty"` 2823 // AlertProductNames - READ-ONLY; List of product names of alerts in the incident 2824 AlertProductNames *[]string `json:"alertProductNames,omitempty"` 2825 // Tactics - READ-ONLY; The tactics associated with incident 2826 Tactics *[]AttackTactic `json:"tactics,omitempty"` 2827} 2828 2829// MarshalJSON is the custom marshaler for IncidentAdditionalData. 2830func (iad IncidentAdditionalData) MarshalJSON() ([]byte, error) { 2831 objectMap := make(map[string]interface{}) 2832 return json.Marshal(objectMap) 2833} 2834 2835// IncidentComment represents an incident comment 2836type IncidentComment struct { 2837 autorest.Response `json:"-"` 2838 // IncidentCommentProperties - Incident comment properties 2839 *IncidentCommentProperties `json:"properties,omitempty"` 2840 // ID - READ-ONLY; Azure resource Id 2841 ID *string `json:"id,omitempty"` 2842 // Name - READ-ONLY; Azure resource name 2843 Name *string `json:"name,omitempty"` 2844 // Type - READ-ONLY; Azure resource type 2845 Type *string `json:"type,omitempty"` 2846} 2847 2848// MarshalJSON is the custom marshaler for IncidentComment. 2849func (ic IncidentComment) MarshalJSON() ([]byte, error) { 2850 objectMap := make(map[string]interface{}) 2851 if ic.IncidentCommentProperties != nil { 2852 objectMap["properties"] = ic.IncidentCommentProperties 2853 } 2854 return json.Marshal(objectMap) 2855} 2856 2857// UnmarshalJSON is the custom unmarshaler for IncidentComment struct. 2858func (ic *IncidentComment) UnmarshalJSON(body []byte) error { 2859 var m map[string]*json.RawMessage 2860 err := json.Unmarshal(body, &m) 2861 if err != nil { 2862 return err 2863 } 2864 for k, v := range m { 2865 switch k { 2866 case "properties": 2867 if v != nil { 2868 var incidentCommentProperties IncidentCommentProperties 2869 err = json.Unmarshal(*v, &incidentCommentProperties) 2870 if err != nil { 2871 return err 2872 } 2873 ic.IncidentCommentProperties = &incidentCommentProperties 2874 } 2875 case "id": 2876 if v != nil { 2877 var ID string 2878 err = json.Unmarshal(*v, &ID) 2879 if err != nil { 2880 return err 2881 } 2882 ic.ID = &ID 2883 } 2884 case "name": 2885 if v != nil { 2886 var name string 2887 err = json.Unmarshal(*v, &name) 2888 if err != nil { 2889 return err 2890 } 2891 ic.Name = &name 2892 } 2893 case "type": 2894 if v != nil { 2895 var typeVar string 2896 err = json.Unmarshal(*v, &typeVar) 2897 if err != nil { 2898 return err 2899 } 2900 ic.Type = &typeVar 2901 } 2902 } 2903 } 2904 2905 return nil 2906} 2907 2908// IncidentCommentList list of incident comments. 2909type IncidentCommentList struct { 2910 autorest.Response `json:"-"` 2911 // NextLink - READ-ONLY; URL to fetch the next set of comments. 2912 NextLink *string `json:"nextLink,omitempty"` 2913 // Value - Array of comments. 2914 Value *[]IncidentComment `json:"value,omitempty"` 2915} 2916 2917// MarshalJSON is the custom marshaler for IncidentCommentList. 2918func (icl IncidentCommentList) MarshalJSON() ([]byte, error) { 2919 objectMap := make(map[string]interface{}) 2920 if icl.Value != nil { 2921 objectMap["value"] = icl.Value 2922 } 2923 return json.Marshal(objectMap) 2924} 2925 2926// IncidentCommentListIterator provides access to a complete listing of IncidentComment values. 2927type IncidentCommentListIterator struct { 2928 i int 2929 page IncidentCommentListPage 2930} 2931 2932// NextWithContext advances to the next value. If there was an error making 2933// the request the iterator does not advance and the error is returned. 2934func (iter *IncidentCommentListIterator) NextWithContext(ctx context.Context) (err error) { 2935 if tracing.IsEnabled() { 2936 ctx = tracing.StartSpan(ctx, fqdn+"/IncidentCommentListIterator.NextWithContext") 2937 defer func() { 2938 sc := -1 2939 if iter.Response().Response.Response != nil { 2940 sc = iter.Response().Response.Response.StatusCode 2941 } 2942 tracing.EndSpan(ctx, sc, err) 2943 }() 2944 } 2945 iter.i++ 2946 if iter.i < len(iter.page.Values()) { 2947 return nil 2948 } 2949 err = iter.page.NextWithContext(ctx) 2950 if err != nil { 2951 iter.i-- 2952 return err 2953 } 2954 iter.i = 0 2955 return nil 2956} 2957 2958// Next advances to the next value. If there was an error making 2959// the request the iterator does not advance and the error is returned. 2960// Deprecated: Use NextWithContext() instead. 2961func (iter *IncidentCommentListIterator) Next() error { 2962 return iter.NextWithContext(context.Background()) 2963} 2964 2965// NotDone returns true if the enumeration should be started or is not yet complete. 2966func (iter IncidentCommentListIterator) NotDone() bool { 2967 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 2968} 2969 2970// Response returns the raw server response from the last page request. 2971func (iter IncidentCommentListIterator) Response() IncidentCommentList { 2972 return iter.page.Response() 2973} 2974 2975// Value returns the current value or a zero-initialized value if the 2976// iterator has advanced beyond the end of the collection. 2977func (iter IncidentCommentListIterator) Value() IncidentComment { 2978 if !iter.page.NotDone() { 2979 return IncidentComment{} 2980 } 2981 return iter.page.Values()[iter.i] 2982} 2983 2984// Creates a new instance of the IncidentCommentListIterator type. 2985func NewIncidentCommentListIterator(page IncidentCommentListPage) IncidentCommentListIterator { 2986 return IncidentCommentListIterator{page: page} 2987} 2988 2989// IsEmpty returns true if the ListResult contains no values. 2990func (icl IncidentCommentList) IsEmpty() bool { 2991 return icl.Value == nil || len(*icl.Value) == 0 2992} 2993 2994// hasNextLink returns true if the NextLink is not empty. 2995func (icl IncidentCommentList) hasNextLink() bool { 2996 return icl.NextLink != nil && len(*icl.NextLink) != 0 2997} 2998 2999// incidentCommentListPreparer prepares a request to retrieve the next set of results. 3000// It returns nil if no more results exist. 3001func (icl IncidentCommentList) incidentCommentListPreparer(ctx context.Context) (*http.Request, error) { 3002 if !icl.hasNextLink() { 3003 return nil, nil 3004 } 3005 return autorest.Prepare((&http.Request{}).WithContext(ctx), 3006 autorest.AsJSON(), 3007 autorest.AsGet(), 3008 autorest.WithBaseURL(to.String(icl.NextLink))) 3009} 3010 3011// IncidentCommentListPage contains a page of IncidentComment values. 3012type IncidentCommentListPage struct { 3013 fn func(context.Context, IncidentCommentList) (IncidentCommentList, error) 3014 icl IncidentCommentList 3015} 3016 3017// NextWithContext advances to the next page of values. If there was an error making 3018// the request the page does not advance and the error is returned. 3019func (page *IncidentCommentListPage) NextWithContext(ctx context.Context) (err error) { 3020 if tracing.IsEnabled() { 3021 ctx = tracing.StartSpan(ctx, fqdn+"/IncidentCommentListPage.NextWithContext") 3022 defer func() { 3023 sc := -1 3024 if page.Response().Response.Response != nil { 3025 sc = page.Response().Response.Response.StatusCode 3026 } 3027 tracing.EndSpan(ctx, sc, err) 3028 }() 3029 } 3030 for { 3031 next, err := page.fn(ctx, page.icl) 3032 if err != nil { 3033 return err 3034 } 3035 page.icl = next 3036 if !next.hasNextLink() || !next.IsEmpty() { 3037 break 3038 } 3039 } 3040 return nil 3041} 3042 3043// Next advances to the next page of values. If there was an error making 3044// the request the page does not advance and the error is returned. 3045// Deprecated: Use NextWithContext() instead. 3046func (page *IncidentCommentListPage) Next() error { 3047 return page.NextWithContext(context.Background()) 3048} 3049 3050// NotDone returns true if the page enumeration should be started or is not yet complete. 3051func (page IncidentCommentListPage) NotDone() bool { 3052 return !page.icl.IsEmpty() 3053} 3054 3055// Response returns the raw server response from the last page request. 3056func (page IncidentCommentListPage) Response() IncidentCommentList { 3057 return page.icl 3058} 3059 3060// Values returns the slice of values for the current page or nil if there are no values. 3061func (page IncidentCommentListPage) Values() []IncidentComment { 3062 if page.icl.IsEmpty() { 3063 return nil 3064 } 3065 return *page.icl.Value 3066} 3067 3068// Creates a new instance of the IncidentCommentListPage type. 3069func NewIncidentCommentListPage(cur IncidentCommentList, getNextPage func(context.Context, IncidentCommentList) (IncidentCommentList, error)) IncidentCommentListPage { 3070 return IncidentCommentListPage{ 3071 fn: getNextPage, 3072 icl: cur, 3073 } 3074} 3075 3076// IncidentCommentProperties incident comment property bag. 3077type IncidentCommentProperties struct { 3078 // CreatedTimeUtc - READ-ONLY; The time the comment was created 3079 CreatedTimeUtc *date.Time `json:"createdTimeUtc,omitempty"` 3080 // Message - The comment message 3081 Message *string `json:"message,omitempty"` 3082 // Author - READ-ONLY; Describes the client that created the comment 3083 Author *ClientInfo `json:"author,omitempty"` 3084} 3085 3086// MarshalJSON is the custom marshaler for IncidentCommentProperties. 3087func (icp IncidentCommentProperties) MarshalJSON() ([]byte, error) { 3088 objectMap := make(map[string]interface{}) 3089 if icp.Message != nil { 3090 objectMap["message"] = icp.Message 3091 } 3092 return json.Marshal(objectMap) 3093} 3094 3095// IncidentInfo describes related incident information for the bookmark 3096type IncidentInfo struct { 3097 // IncidentID - Incident Id 3098 IncidentID *string `json:"incidentId,omitempty"` 3099 // Severity - The severity of the incident. Possible values include: 'CaseSeverityCritical', 'CaseSeverityHigh', 'CaseSeverityMedium', 'CaseSeverityLow', 'CaseSeverityInformational' 3100 Severity CaseSeverity `json:"severity,omitempty"` 3101 // Title - The title of the incident 3102 Title *string `json:"title,omitempty"` 3103 // RelationName - Relation Name 3104 RelationName *string `json:"relationName,omitempty"` 3105} 3106 3107// IncidentLabel represents an incident label 3108type IncidentLabel struct { 3109 // LabelName - The name of the label 3110 LabelName *string `json:"labelName,omitempty"` 3111 // LabelType - READ-ONLY; The type of the label. Possible values include: 'User', 'System' 3112 LabelType IncidentLabelType `json:"labelType,omitempty"` 3113} 3114 3115// MarshalJSON is the custom marshaler for IncidentLabel. 3116func (il IncidentLabel) MarshalJSON() ([]byte, error) { 3117 objectMap := make(map[string]interface{}) 3118 if il.LabelName != nil { 3119 objectMap["labelName"] = il.LabelName 3120 } 3121 return json.Marshal(objectMap) 3122} 3123 3124// IncidentList list all the incidents. 3125type IncidentList struct { 3126 autorest.Response `json:"-"` 3127 // NextLink - READ-ONLY; URL to fetch the next set of incidents. 3128 NextLink *string `json:"nextLink,omitempty"` 3129 // Value - Array of incidents. 3130 Value *[]Incident `json:"value,omitempty"` 3131} 3132 3133// MarshalJSON is the custom marshaler for IncidentList. 3134func (il IncidentList) MarshalJSON() ([]byte, error) { 3135 objectMap := make(map[string]interface{}) 3136 if il.Value != nil { 3137 objectMap["value"] = il.Value 3138 } 3139 return json.Marshal(objectMap) 3140} 3141 3142// IncidentListIterator provides access to a complete listing of Incident values. 3143type IncidentListIterator struct { 3144 i int 3145 page IncidentListPage 3146} 3147 3148// NextWithContext advances to the next value. If there was an error making 3149// the request the iterator does not advance and the error is returned. 3150func (iter *IncidentListIterator) NextWithContext(ctx context.Context) (err error) { 3151 if tracing.IsEnabled() { 3152 ctx = tracing.StartSpan(ctx, fqdn+"/IncidentListIterator.NextWithContext") 3153 defer func() { 3154 sc := -1 3155 if iter.Response().Response.Response != nil { 3156 sc = iter.Response().Response.Response.StatusCode 3157 } 3158 tracing.EndSpan(ctx, sc, err) 3159 }() 3160 } 3161 iter.i++ 3162 if iter.i < len(iter.page.Values()) { 3163 return nil 3164 } 3165 err = iter.page.NextWithContext(ctx) 3166 if err != nil { 3167 iter.i-- 3168 return err 3169 } 3170 iter.i = 0 3171 return nil 3172} 3173 3174// Next advances to the next value. If there was an error making 3175// the request the iterator does not advance and the error is returned. 3176// Deprecated: Use NextWithContext() instead. 3177func (iter *IncidentListIterator) Next() error { 3178 return iter.NextWithContext(context.Background()) 3179} 3180 3181// NotDone returns true if the enumeration should be started or is not yet complete. 3182func (iter IncidentListIterator) NotDone() bool { 3183 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 3184} 3185 3186// Response returns the raw server response from the last page request. 3187func (iter IncidentListIterator) Response() IncidentList { 3188 return iter.page.Response() 3189} 3190 3191// Value returns the current value or a zero-initialized value if the 3192// iterator has advanced beyond the end of the collection. 3193func (iter IncidentListIterator) Value() Incident { 3194 if !iter.page.NotDone() { 3195 return Incident{} 3196 } 3197 return iter.page.Values()[iter.i] 3198} 3199 3200// Creates a new instance of the IncidentListIterator type. 3201func NewIncidentListIterator(page IncidentListPage) IncidentListIterator { 3202 return IncidentListIterator{page: page} 3203} 3204 3205// IsEmpty returns true if the ListResult contains no values. 3206func (il IncidentList) IsEmpty() bool { 3207 return il.Value == nil || len(*il.Value) == 0 3208} 3209 3210// hasNextLink returns true if the NextLink is not empty. 3211func (il IncidentList) hasNextLink() bool { 3212 return il.NextLink != nil && len(*il.NextLink) != 0 3213} 3214 3215// incidentListPreparer prepares a request to retrieve the next set of results. 3216// It returns nil if no more results exist. 3217func (il IncidentList) incidentListPreparer(ctx context.Context) (*http.Request, error) { 3218 if !il.hasNextLink() { 3219 return nil, nil 3220 } 3221 return autorest.Prepare((&http.Request{}).WithContext(ctx), 3222 autorest.AsJSON(), 3223 autorest.AsGet(), 3224 autorest.WithBaseURL(to.String(il.NextLink))) 3225} 3226 3227// IncidentListPage contains a page of Incident values. 3228type IncidentListPage struct { 3229 fn func(context.Context, IncidentList) (IncidentList, error) 3230 il IncidentList 3231} 3232 3233// NextWithContext advances to the next page of values. If there was an error making 3234// the request the page does not advance and the error is returned. 3235func (page *IncidentListPage) NextWithContext(ctx context.Context) (err error) { 3236 if tracing.IsEnabled() { 3237 ctx = tracing.StartSpan(ctx, fqdn+"/IncidentListPage.NextWithContext") 3238 defer func() { 3239 sc := -1 3240 if page.Response().Response.Response != nil { 3241 sc = page.Response().Response.Response.StatusCode 3242 } 3243 tracing.EndSpan(ctx, sc, err) 3244 }() 3245 } 3246 for { 3247 next, err := page.fn(ctx, page.il) 3248 if err != nil { 3249 return err 3250 } 3251 page.il = next 3252 if !next.hasNextLink() || !next.IsEmpty() { 3253 break 3254 } 3255 } 3256 return nil 3257} 3258 3259// Next advances to the next page of values. If there was an error making 3260// the request the page does not advance and the error is returned. 3261// Deprecated: Use NextWithContext() instead. 3262func (page *IncidentListPage) Next() error { 3263 return page.NextWithContext(context.Background()) 3264} 3265 3266// NotDone returns true if the page enumeration should be started or is not yet complete. 3267func (page IncidentListPage) NotDone() bool { 3268 return !page.il.IsEmpty() 3269} 3270 3271// Response returns the raw server response from the last page request. 3272func (page IncidentListPage) Response() IncidentList { 3273 return page.il 3274} 3275 3276// Values returns the slice of values for the current page or nil if there are no values. 3277func (page IncidentListPage) Values() []Incident { 3278 if page.il.IsEmpty() { 3279 return nil 3280 } 3281 return *page.il.Value 3282} 3283 3284// Creates a new instance of the IncidentListPage type. 3285func NewIncidentListPage(cur IncidentList, getNextPage func(context.Context, IncidentList) (IncidentList, error)) IncidentListPage { 3286 return IncidentListPage{ 3287 fn: getNextPage, 3288 il: cur, 3289 } 3290} 3291 3292// IncidentOwnerInfo information on the user an incident is assigned to 3293type IncidentOwnerInfo struct { 3294 // Email - The email of the user the incident is assigned to. 3295 Email *string `json:"email,omitempty"` 3296 // AssignedTo - The name of the user the incident is assigned to. 3297 AssignedTo *string `json:"assignedTo,omitempty"` 3298 // ObjectID - The object id of the user the incident is assigned to. 3299 ObjectID *uuid.UUID `json:"objectId,omitempty"` 3300 // UserPrincipalName - The user principal name of the user the incident is assigned to. 3301 UserPrincipalName *string `json:"userPrincipalName,omitempty"` 3302} 3303 3304// IncidentProperties describes incident properties 3305type IncidentProperties struct { 3306 // AdditionalData - READ-ONLY; Additional data on the incident 3307 AdditionalData *IncidentAdditionalData `json:"additionalData,omitempty"` 3308 // Classification - The reason the incident was closed. Possible values include: 'Undetermined', 'TruePositive', 'BenignPositive', 'FalsePositive' 3309 Classification IncidentClassification `json:"classification,omitempty"` 3310 // ClassificationComment - Describes the reason the incident was closed 3311 ClassificationComment *string `json:"classificationComment,omitempty"` 3312 // ClassificationReason - The classification reason the incident was closed with. Possible values include: 'SuspiciousActivity', 'SuspiciousButExpected', 'IncorrectAlertLogic', 'InaccurateData' 3313 ClassificationReason IncidentClassificationReason `json:"classificationReason,omitempty"` 3314 // CreatedTimeUtc - READ-ONLY; The time the incident was created 3315 CreatedTimeUtc *date.Time `json:"createdTimeUtc,omitempty"` 3316 // Description - The description of the incident 3317 Description *string `json:"description,omitempty"` 3318 // FirstActivityTimeUtc - The time of the first activity in the incident 3319 FirstActivityTimeUtc *date.Time `json:"firstActivityTimeUtc,omitempty"` 3320 // IncidentURL - READ-ONLY; The deep-link url to the incident in Azure portal 3321 IncidentURL *string `json:"incidentUrl,omitempty"` 3322 // IncidentNumber - READ-ONLY; A sequential number 3323 IncidentNumber *int32 `json:"incidentNumber,omitempty"` 3324 // Labels - List of labels relevant to this incident 3325 Labels *[]IncidentLabel `json:"labels,omitempty"` 3326 // LastActivityTimeUtc - The time of the last activity in the incident 3327 LastActivityTimeUtc *date.Time `json:"lastActivityTimeUtc,omitempty"` 3328 // LastModifiedTimeUtc - READ-ONLY; The last time the incident was updated 3329 LastModifiedTimeUtc *date.Time `json:"lastModifiedTimeUtc,omitempty"` 3330 // Owner - Describes a user that the incident is assigned to 3331 Owner *IncidentOwnerInfo `json:"owner,omitempty"` 3332 // RelatedAnalyticRuleIds - READ-ONLY; List of resource ids of Analytic rules related to the incident 3333 RelatedAnalyticRuleIds *[]string `json:"relatedAnalyticRuleIds,omitempty"` 3334 // Severity - The severity of the incident. Possible values include: 'IncidentSeverityHigh', 'IncidentSeverityMedium', 'IncidentSeverityLow', 'IncidentSeverityInformational' 3335 Severity IncidentSeverity `json:"severity,omitempty"` 3336 // Status - The status of the incident. Possible values include: 'IncidentStatusNew', 'IncidentStatusActive', 'IncidentStatusClosed' 3337 Status IncidentStatus `json:"status,omitempty"` 3338 // Title - The title of the incident 3339 Title *string `json:"title,omitempty"` 3340} 3341 3342// MarshalJSON is the custom marshaler for IncidentProperties. 3343func (IP IncidentProperties) MarshalJSON() ([]byte, error) { 3344 objectMap := make(map[string]interface{}) 3345 if IP.Classification != "" { 3346 objectMap["classification"] = IP.Classification 3347 } 3348 if IP.ClassificationComment != nil { 3349 objectMap["classificationComment"] = IP.ClassificationComment 3350 } 3351 if IP.ClassificationReason != "" { 3352 objectMap["classificationReason"] = IP.ClassificationReason 3353 } 3354 if IP.Description != nil { 3355 objectMap["description"] = IP.Description 3356 } 3357 if IP.FirstActivityTimeUtc != nil { 3358 objectMap["firstActivityTimeUtc"] = IP.FirstActivityTimeUtc 3359 } 3360 if IP.Labels != nil { 3361 objectMap["labels"] = IP.Labels 3362 } 3363 if IP.LastActivityTimeUtc != nil { 3364 objectMap["lastActivityTimeUtc"] = IP.LastActivityTimeUtc 3365 } 3366 if IP.Owner != nil { 3367 objectMap["owner"] = IP.Owner 3368 } 3369 if IP.Severity != "" { 3370 objectMap["severity"] = IP.Severity 3371 } 3372 if IP.Status != "" { 3373 objectMap["status"] = IP.Status 3374 } 3375 if IP.Title != nil { 3376 objectMap["title"] = IP.Title 3377 } 3378 return json.Marshal(objectMap) 3379} 3380 3381// MCASDataConnector represents MCAS (Microsoft Cloud App Security) data connector. 3382type MCASDataConnector struct { 3383 // MCASDataConnectorProperties - MCAS (Microsoft Cloud App Security) data connector properties. 3384 *MCASDataConnectorProperties `json:"properties,omitempty"` 3385 // Kind - Possible values include: 'KindDataConnector', 'KindAzureActiveDirectory', 'KindAzureAdvancedThreatProtection', 'KindAzureSecurityCenter', 'KindAmazonWebServicesCloudTrail', 'KindMicrosoftCloudAppSecurity', 'KindMicrosoftDefenderAdvancedThreatProtection', 'KindOffice365', 'KindThreatIntelligence' 3386 Kind KindBasicDataConnector `json:"kind,omitempty"` 3387 // ID - READ-ONLY; Azure resource Id 3388 ID *string `json:"id,omitempty"` 3389 // Name - READ-ONLY; Azure resource name 3390 Name *string `json:"name,omitempty"` 3391 // Type - READ-ONLY; Azure resource type 3392 Type *string `json:"type,omitempty"` 3393 // Etag - Etag of the azure resource 3394 Etag *string `json:"etag,omitempty"` 3395} 3396 3397// MarshalJSON is the custom marshaler for MCASDataConnector. 3398func (mdc MCASDataConnector) MarshalJSON() ([]byte, error) { 3399 mdc.Kind = KindMicrosoftCloudAppSecurity 3400 objectMap := make(map[string]interface{}) 3401 if mdc.MCASDataConnectorProperties != nil { 3402 objectMap["properties"] = mdc.MCASDataConnectorProperties 3403 } 3404 if mdc.Kind != "" { 3405 objectMap["kind"] = mdc.Kind 3406 } 3407 if mdc.Etag != nil { 3408 objectMap["etag"] = mdc.Etag 3409 } 3410 return json.Marshal(objectMap) 3411} 3412 3413// AsAADDataConnector is the BasicDataConnector implementation for MCASDataConnector. 3414func (mdc MCASDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 3415 return nil, false 3416} 3417 3418// AsAATPDataConnector is the BasicDataConnector implementation for MCASDataConnector. 3419func (mdc MCASDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 3420 return nil, false 3421} 3422 3423// AsASCDataConnector is the BasicDataConnector implementation for MCASDataConnector. 3424func (mdc MCASDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 3425 return nil, false 3426} 3427 3428// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for MCASDataConnector. 3429func (mdc MCASDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 3430 return nil, false 3431} 3432 3433// AsMCASDataConnector is the BasicDataConnector implementation for MCASDataConnector. 3434func (mdc MCASDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 3435 return &mdc, true 3436} 3437 3438// AsMDATPDataConnector is the BasicDataConnector implementation for MCASDataConnector. 3439func (mdc MCASDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 3440 return nil, false 3441} 3442 3443// AsOfficeDataConnector is the BasicDataConnector implementation for MCASDataConnector. 3444func (mdc MCASDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 3445 return nil, false 3446} 3447 3448// AsTIDataConnector is the BasicDataConnector implementation for MCASDataConnector. 3449func (mdc MCASDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 3450 return nil, false 3451} 3452 3453// AsDataConnector is the BasicDataConnector implementation for MCASDataConnector. 3454func (mdc MCASDataConnector) AsDataConnector() (*DataConnector, bool) { 3455 return nil, false 3456} 3457 3458// AsBasicDataConnector is the BasicDataConnector implementation for MCASDataConnector. 3459func (mdc MCASDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 3460 return &mdc, true 3461} 3462 3463// UnmarshalJSON is the custom unmarshaler for MCASDataConnector struct. 3464func (mdc *MCASDataConnector) UnmarshalJSON(body []byte) error { 3465 var m map[string]*json.RawMessage 3466 err := json.Unmarshal(body, &m) 3467 if err != nil { 3468 return err 3469 } 3470 for k, v := range m { 3471 switch k { 3472 case "properties": 3473 if v != nil { 3474 var mCASDataConnectorProperties MCASDataConnectorProperties 3475 err = json.Unmarshal(*v, &mCASDataConnectorProperties) 3476 if err != nil { 3477 return err 3478 } 3479 mdc.MCASDataConnectorProperties = &mCASDataConnectorProperties 3480 } 3481 case "kind": 3482 if v != nil { 3483 var kind KindBasicDataConnector 3484 err = json.Unmarshal(*v, &kind) 3485 if err != nil { 3486 return err 3487 } 3488 mdc.Kind = kind 3489 } 3490 case "id": 3491 if v != nil { 3492 var ID string 3493 err = json.Unmarshal(*v, &ID) 3494 if err != nil { 3495 return err 3496 } 3497 mdc.ID = &ID 3498 } 3499 case "name": 3500 if v != nil { 3501 var name string 3502 err = json.Unmarshal(*v, &name) 3503 if err != nil { 3504 return err 3505 } 3506 mdc.Name = &name 3507 } 3508 case "type": 3509 if v != nil { 3510 var typeVar string 3511 err = json.Unmarshal(*v, &typeVar) 3512 if err != nil { 3513 return err 3514 } 3515 mdc.Type = &typeVar 3516 } 3517 case "etag": 3518 if v != nil { 3519 var etag string 3520 err = json.Unmarshal(*v, &etag) 3521 if err != nil { 3522 return err 3523 } 3524 mdc.Etag = &etag 3525 } 3526 } 3527 } 3528 3529 return nil 3530} 3531 3532// MCASDataConnectorDataTypes the available data types for MCAS (Microsoft Cloud App Security) data 3533// connector. 3534type MCASDataConnectorDataTypes struct { 3535 // DiscoveryLogs - Discovery log data type connection. 3536 DiscoveryLogs *DataConnectorDataTypeCommon `json:"discoveryLogs,omitempty"` 3537 // Alerts - Alerts data type connection. 3538 Alerts *DataConnectorDataTypeCommon `json:"alerts,omitempty"` 3539} 3540 3541// MCASDataConnectorProperties MCAS (Microsoft Cloud App Security) data connector properties. 3542type MCASDataConnectorProperties struct { 3543 // TenantID - The tenant id to connect to, and get the data from. 3544 TenantID *string `json:"tenantId,omitempty"` 3545 // DataTypes - The available data types for the connector. 3546 DataTypes *MCASDataConnectorDataTypes `json:"dataTypes,omitempty"` 3547} 3548 3549// MDATPDataConnector represents MDATP (Microsoft Defender Advanced Threat Protection) data connector. 3550type MDATPDataConnector struct { 3551 // MDATPDataConnectorProperties - MDATP (Microsoft Defender Advanced Threat Protection) data connector properties. 3552 *MDATPDataConnectorProperties `json:"properties,omitempty"` 3553 // Kind - Possible values include: 'KindDataConnector', 'KindAzureActiveDirectory', 'KindAzureAdvancedThreatProtection', 'KindAzureSecurityCenter', 'KindAmazonWebServicesCloudTrail', 'KindMicrosoftCloudAppSecurity', 'KindMicrosoftDefenderAdvancedThreatProtection', 'KindOffice365', 'KindThreatIntelligence' 3554 Kind KindBasicDataConnector `json:"kind,omitempty"` 3555 // ID - READ-ONLY; Azure resource Id 3556 ID *string `json:"id,omitempty"` 3557 // Name - READ-ONLY; Azure resource name 3558 Name *string `json:"name,omitempty"` 3559 // Type - READ-ONLY; Azure resource type 3560 Type *string `json:"type,omitempty"` 3561 // Etag - Etag of the azure resource 3562 Etag *string `json:"etag,omitempty"` 3563} 3564 3565// MarshalJSON is the custom marshaler for MDATPDataConnector. 3566func (mdc MDATPDataConnector) MarshalJSON() ([]byte, error) { 3567 mdc.Kind = KindMicrosoftDefenderAdvancedThreatProtection 3568 objectMap := make(map[string]interface{}) 3569 if mdc.MDATPDataConnectorProperties != nil { 3570 objectMap["properties"] = mdc.MDATPDataConnectorProperties 3571 } 3572 if mdc.Kind != "" { 3573 objectMap["kind"] = mdc.Kind 3574 } 3575 if mdc.Etag != nil { 3576 objectMap["etag"] = mdc.Etag 3577 } 3578 return json.Marshal(objectMap) 3579} 3580 3581// AsAADDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 3582func (mdc MDATPDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 3583 return nil, false 3584} 3585 3586// AsAATPDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 3587func (mdc MDATPDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 3588 return nil, false 3589} 3590 3591// AsASCDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 3592func (mdc MDATPDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 3593 return nil, false 3594} 3595 3596// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 3597func (mdc MDATPDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 3598 return nil, false 3599} 3600 3601// AsMCASDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 3602func (mdc MDATPDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 3603 return nil, false 3604} 3605 3606// AsMDATPDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 3607func (mdc MDATPDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 3608 return &mdc, true 3609} 3610 3611// AsOfficeDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 3612func (mdc MDATPDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 3613 return nil, false 3614} 3615 3616// AsTIDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 3617func (mdc MDATPDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 3618 return nil, false 3619} 3620 3621// AsDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 3622func (mdc MDATPDataConnector) AsDataConnector() (*DataConnector, bool) { 3623 return nil, false 3624} 3625 3626// AsBasicDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 3627func (mdc MDATPDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 3628 return &mdc, true 3629} 3630 3631// UnmarshalJSON is the custom unmarshaler for MDATPDataConnector struct. 3632func (mdc *MDATPDataConnector) UnmarshalJSON(body []byte) error { 3633 var m map[string]*json.RawMessage 3634 err := json.Unmarshal(body, &m) 3635 if err != nil { 3636 return err 3637 } 3638 for k, v := range m { 3639 switch k { 3640 case "properties": 3641 if v != nil { 3642 var mDATPDataConnectorProperties MDATPDataConnectorProperties 3643 err = json.Unmarshal(*v, &mDATPDataConnectorProperties) 3644 if err != nil { 3645 return err 3646 } 3647 mdc.MDATPDataConnectorProperties = &mDATPDataConnectorProperties 3648 } 3649 case "kind": 3650 if v != nil { 3651 var kind KindBasicDataConnector 3652 err = json.Unmarshal(*v, &kind) 3653 if err != nil { 3654 return err 3655 } 3656 mdc.Kind = kind 3657 } 3658 case "id": 3659 if v != nil { 3660 var ID string 3661 err = json.Unmarshal(*v, &ID) 3662 if err != nil { 3663 return err 3664 } 3665 mdc.ID = &ID 3666 } 3667 case "name": 3668 if v != nil { 3669 var name string 3670 err = json.Unmarshal(*v, &name) 3671 if err != nil { 3672 return err 3673 } 3674 mdc.Name = &name 3675 } 3676 case "type": 3677 if v != nil { 3678 var typeVar string 3679 err = json.Unmarshal(*v, &typeVar) 3680 if err != nil { 3681 return err 3682 } 3683 mdc.Type = &typeVar 3684 } 3685 case "etag": 3686 if v != nil { 3687 var etag string 3688 err = json.Unmarshal(*v, &etag) 3689 if err != nil { 3690 return err 3691 } 3692 mdc.Etag = &etag 3693 } 3694 } 3695 } 3696 3697 return nil 3698} 3699 3700// MDATPDataConnectorProperties MDATP (Microsoft Defender Advanced Threat Protection) data connector 3701// properties. 3702type MDATPDataConnectorProperties struct { 3703 // TenantID - The tenant id to connect to, and get the data from. 3704 TenantID *string `json:"tenantId,omitempty"` 3705 // DataTypes - The available data types for the connector. 3706 DataTypes *AlertsDataTypeOfDataConnector `json:"dataTypes,omitempty"` 3707} 3708 3709// MicrosoftSecurityIncidentCreationAlertRule represents MicrosoftSecurityIncidentCreation rule. 3710type MicrosoftSecurityIncidentCreationAlertRule struct { 3711 // MicrosoftSecurityIncidentCreationAlertRuleProperties - MicrosoftSecurityIncidentCreation rule properties 3712 *MicrosoftSecurityIncidentCreationAlertRuleProperties `json:"properties,omitempty"` 3713 // Kind - Possible values include: 'KindAlertRule', 'KindFusion', 'KindMicrosoftSecurityIncidentCreation', 'KindScheduled' 3714 Kind Kind `json:"kind,omitempty"` 3715 // ID - READ-ONLY; Azure resource Id 3716 ID *string `json:"id,omitempty"` 3717 // Name - READ-ONLY; Azure resource name 3718 Name *string `json:"name,omitempty"` 3719 // Type - READ-ONLY; Azure resource type 3720 Type *string `json:"type,omitempty"` 3721 // Etag - Etag of the azure resource 3722 Etag *string `json:"etag,omitempty"` 3723} 3724 3725// MarshalJSON is the custom marshaler for MicrosoftSecurityIncidentCreationAlertRule. 3726func (msicar MicrosoftSecurityIncidentCreationAlertRule) MarshalJSON() ([]byte, error) { 3727 msicar.Kind = KindMicrosoftSecurityIncidentCreation 3728 objectMap := make(map[string]interface{}) 3729 if msicar.MicrosoftSecurityIncidentCreationAlertRuleProperties != nil { 3730 objectMap["properties"] = msicar.MicrosoftSecurityIncidentCreationAlertRuleProperties 3731 } 3732 if msicar.Kind != "" { 3733 objectMap["kind"] = msicar.Kind 3734 } 3735 if msicar.Etag != nil { 3736 objectMap["etag"] = msicar.Etag 3737 } 3738 return json.Marshal(objectMap) 3739} 3740 3741// AsFusionAlertRule is the BasicAlertRule implementation for MicrosoftSecurityIncidentCreationAlertRule. 3742func (msicar MicrosoftSecurityIncidentCreationAlertRule) AsFusionAlertRule() (*FusionAlertRule, bool) { 3743 return nil, false 3744} 3745 3746// AsMicrosoftSecurityIncidentCreationAlertRule is the BasicAlertRule implementation for MicrosoftSecurityIncidentCreationAlertRule. 3747func (msicar MicrosoftSecurityIncidentCreationAlertRule) AsMicrosoftSecurityIncidentCreationAlertRule() (*MicrosoftSecurityIncidentCreationAlertRule, bool) { 3748 return &msicar, true 3749} 3750 3751// AsScheduledAlertRule is the BasicAlertRule implementation for MicrosoftSecurityIncidentCreationAlertRule. 3752func (msicar MicrosoftSecurityIncidentCreationAlertRule) AsScheduledAlertRule() (*ScheduledAlertRule, bool) { 3753 return nil, false 3754} 3755 3756// AsAlertRule is the BasicAlertRule implementation for MicrosoftSecurityIncidentCreationAlertRule. 3757func (msicar MicrosoftSecurityIncidentCreationAlertRule) AsAlertRule() (*AlertRule, bool) { 3758 return nil, false 3759} 3760 3761// AsBasicAlertRule is the BasicAlertRule implementation for MicrosoftSecurityIncidentCreationAlertRule. 3762func (msicar MicrosoftSecurityIncidentCreationAlertRule) AsBasicAlertRule() (BasicAlertRule, bool) { 3763 return &msicar, true 3764} 3765 3766// UnmarshalJSON is the custom unmarshaler for MicrosoftSecurityIncidentCreationAlertRule struct. 3767func (msicar *MicrosoftSecurityIncidentCreationAlertRule) UnmarshalJSON(body []byte) error { 3768 var m map[string]*json.RawMessage 3769 err := json.Unmarshal(body, &m) 3770 if err != nil { 3771 return err 3772 } 3773 for k, v := range m { 3774 switch k { 3775 case "properties": 3776 if v != nil { 3777 var microsoftSecurityIncidentCreationAlertRuleProperties MicrosoftSecurityIncidentCreationAlertRuleProperties 3778 err = json.Unmarshal(*v, µsoftSecurityIncidentCreationAlertRuleProperties) 3779 if err != nil { 3780 return err 3781 } 3782 msicar.MicrosoftSecurityIncidentCreationAlertRuleProperties = µsoftSecurityIncidentCreationAlertRuleProperties 3783 } 3784 case "kind": 3785 if v != nil { 3786 var kind Kind 3787 err = json.Unmarshal(*v, &kind) 3788 if err != nil { 3789 return err 3790 } 3791 msicar.Kind = kind 3792 } 3793 case "id": 3794 if v != nil { 3795 var ID string 3796 err = json.Unmarshal(*v, &ID) 3797 if err != nil { 3798 return err 3799 } 3800 msicar.ID = &ID 3801 } 3802 case "name": 3803 if v != nil { 3804 var name string 3805 err = json.Unmarshal(*v, &name) 3806 if err != nil { 3807 return err 3808 } 3809 msicar.Name = &name 3810 } 3811 case "type": 3812 if v != nil { 3813 var typeVar string 3814 err = json.Unmarshal(*v, &typeVar) 3815 if err != nil { 3816 return err 3817 } 3818 msicar.Type = &typeVar 3819 } 3820 case "etag": 3821 if v != nil { 3822 var etag string 3823 err = json.Unmarshal(*v, &etag) 3824 if err != nil { 3825 return err 3826 } 3827 msicar.Etag = &etag 3828 } 3829 } 3830 } 3831 3832 return nil 3833} 3834 3835// MicrosoftSecurityIncidentCreationAlertRuleCommonProperties microsoftSecurityIncidentCreation rule common 3836// property bag. 3837type MicrosoftSecurityIncidentCreationAlertRuleCommonProperties struct { 3838 // DisplayNamesFilter - the alerts' displayNames on which the cases will be generated 3839 DisplayNamesFilter *[]string `json:"displayNamesFilter,omitempty"` 3840 // DisplayNamesExcludeFilter - the alerts' displayNames on which the cases will not be generated 3841 DisplayNamesExcludeFilter *[]string `json:"displayNamesExcludeFilter,omitempty"` 3842 // ProductFilter - The alerts' productName on which the cases will be generated. Possible values include: 'MicrosoftCloudAppSecurity', 'AzureSecurityCenter', 'AzureAdvancedThreatProtection', 'AzureActiveDirectoryIdentityProtection', 'AzureSecurityCenterforIoT' 3843 ProductFilter MicrosoftSecurityProductName `json:"productFilter,omitempty"` 3844 // SeveritiesFilter - the alerts' severities on which the cases will be generated 3845 SeveritiesFilter *[]AlertSeverity `json:"severitiesFilter,omitempty"` 3846} 3847 3848// MicrosoftSecurityIncidentCreationAlertRuleProperties microsoftSecurityIncidentCreation rule property 3849// bag. 3850type MicrosoftSecurityIncidentCreationAlertRuleProperties struct { 3851 // AlertRuleTemplateName - The Name of the alert rule template used to create this rule. 3852 AlertRuleTemplateName *string `json:"alertRuleTemplateName,omitempty"` 3853 // Description - The description of the alert rule. 3854 Description *string `json:"description,omitempty"` 3855 // DisplayName - The display name for alerts created by this alert rule. 3856 DisplayName *string `json:"displayName,omitempty"` 3857 // Enabled - Determines whether this alert rule is enabled or disabled. 3858 Enabled *bool `json:"enabled,omitempty"` 3859 // LastModifiedUtc - READ-ONLY; The last time that this alert has been modified. 3860 LastModifiedUtc *date.Time `json:"lastModifiedUtc,omitempty"` 3861 // DisplayNamesFilter - the alerts' displayNames on which the cases will be generated 3862 DisplayNamesFilter *[]string `json:"displayNamesFilter,omitempty"` 3863 // DisplayNamesExcludeFilter - the alerts' displayNames on which the cases will not be generated 3864 DisplayNamesExcludeFilter *[]string `json:"displayNamesExcludeFilter,omitempty"` 3865 // ProductFilter - The alerts' productName on which the cases will be generated. Possible values include: 'MicrosoftCloudAppSecurity', 'AzureSecurityCenter', 'AzureAdvancedThreatProtection', 'AzureActiveDirectoryIdentityProtection', 'AzureSecurityCenterforIoT' 3866 ProductFilter MicrosoftSecurityProductName `json:"productFilter,omitempty"` 3867 // SeveritiesFilter - the alerts' severities on which the cases will be generated 3868 SeveritiesFilter *[]AlertSeverity `json:"severitiesFilter,omitempty"` 3869} 3870 3871// MarshalJSON is the custom marshaler for MicrosoftSecurityIncidentCreationAlertRuleProperties. 3872func (msicarp MicrosoftSecurityIncidentCreationAlertRuleProperties) MarshalJSON() ([]byte, error) { 3873 objectMap := make(map[string]interface{}) 3874 if msicarp.AlertRuleTemplateName != nil { 3875 objectMap["alertRuleTemplateName"] = msicarp.AlertRuleTemplateName 3876 } 3877 if msicarp.Description != nil { 3878 objectMap["description"] = msicarp.Description 3879 } 3880 if msicarp.DisplayName != nil { 3881 objectMap["displayName"] = msicarp.DisplayName 3882 } 3883 if msicarp.Enabled != nil { 3884 objectMap["enabled"] = msicarp.Enabled 3885 } 3886 if msicarp.DisplayNamesFilter != nil { 3887 objectMap["displayNamesFilter"] = msicarp.DisplayNamesFilter 3888 } 3889 if msicarp.DisplayNamesExcludeFilter != nil { 3890 objectMap["displayNamesExcludeFilter"] = msicarp.DisplayNamesExcludeFilter 3891 } 3892 if msicarp.ProductFilter != "" { 3893 objectMap["productFilter"] = msicarp.ProductFilter 3894 } 3895 if msicarp.SeveritiesFilter != nil { 3896 objectMap["severitiesFilter"] = msicarp.SeveritiesFilter 3897 } 3898 return json.Marshal(objectMap) 3899} 3900 3901// MicrosoftSecurityIncidentCreationAlertRuleTemplate represents MicrosoftSecurityIncidentCreation rule 3902// template. 3903type MicrosoftSecurityIncidentCreationAlertRuleTemplate struct { 3904 // MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties - MicrosoftSecurityIncidentCreation rule template properties 3905 *MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties `json:"properties,omitempty"` 3906 // Kind - Possible values include: 'KindBasicAlertRuleTemplateKindAlertRuleTemplate', 'KindBasicAlertRuleTemplateKindFusion', 'KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleTemplateKindScheduled' 3907 Kind KindBasicAlertRuleTemplate `json:"kind,omitempty"` 3908 // ID - READ-ONLY; Azure resource Id 3909 ID *string `json:"id,omitempty"` 3910 // Name - READ-ONLY; Azure resource name 3911 Name *string `json:"name,omitempty"` 3912 // Type - READ-ONLY; Azure resource type 3913 Type *string `json:"type,omitempty"` 3914} 3915 3916// MarshalJSON is the custom marshaler for MicrosoftSecurityIncidentCreationAlertRuleTemplate. 3917func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) MarshalJSON() ([]byte, error) { 3918 msicart.Kind = KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation 3919 objectMap := make(map[string]interface{}) 3920 if msicart.MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties != nil { 3921 objectMap["properties"] = msicart.MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties 3922 } 3923 if msicart.Kind != "" { 3924 objectMap["kind"] = msicart.Kind 3925 } 3926 return json.Marshal(objectMap) 3927} 3928 3929// AsFusionAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MicrosoftSecurityIncidentCreationAlertRuleTemplate. 3930func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsFusionAlertRuleTemplate() (*FusionAlertRuleTemplate, bool) { 3931 return nil, false 3932} 3933 3934// AsMicrosoftSecurityIncidentCreationAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MicrosoftSecurityIncidentCreationAlertRuleTemplate. 3935func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsMicrosoftSecurityIncidentCreationAlertRuleTemplate() (*MicrosoftSecurityIncidentCreationAlertRuleTemplate, bool) { 3936 return &msicart, true 3937} 3938 3939// AsScheduledAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MicrosoftSecurityIncidentCreationAlertRuleTemplate. 3940func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsScheduledAlertRuleTemplate() (*ScheduledAlertRuleTemplate, bool) { 3941 return nil, false 3942} 3943 3944// AsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MicrosoftSecurityIncidentCreationAlertRuleTemplate. 3945func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsAlertRuleTemplate() (*AlertRuleTemplate, bool) { 3946 return nil, false 3947} 3948 3949// AsBasicAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MicrosoftSecurityIncidentCreationAlertRuleTemplate. 3950func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsBasicAlertRuleTemplate() (BasicAlertRuleTemplate, bool) { 3951 return &msicart, true 3952} 3953 3954// UnmarshalJSON is the custom unmarshaler for MicrosoftSecurityIncidentCreationAlertRuleTemplate struct. 3955func (msicart *MicrosoftSecurityIncidentCreationAlertRuleTemplate) UnmarshalJSON(body []byte) error { 3956 var m map[string]*json.RawMessage 3957 err := json.Unmarshal(body, &m) 3958 if err != nil { 3959 return err 3960 } 3961 for k, v := range m { 3962 switch k { 3963 case "properties": 3964 if v != nil { 3965 var microsoftSecurityIncidentCreationAlertRuleTemplateProperties MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties 3966 err = json.Unmarshal(*v, µsoftSecurityIncidentCreationAlertRuleTemplateProperties) 3967 if err != nil { 3968 return err 3969 } 3970 msicart.MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties = µsoftSecurityIncidentCreationAlertRuleTemplateProperties 3971 } 3972 case "kind": 3973 if v != nil { 3974 var kind KindBasicAlertRuleTemplate 3975 err = json.Unmarshal(*v, &kind) 3976 if err != nil { 3977 return err 3978 } 3979 msicart.Kind = kind 3980 } 3981 case "id": 3982 if v != nil { 3983 var ID string 3984 err = json.Unmarshal(*v, &ID) 3985 if err != nil { 3986 return err 3987 } 3988 msicart.ID = &ID 3989 } 3990 case "name": 3991 if v != nil { 3992 var name string 3993 err = json.Unmarshal(*v, &name) 3994 if err != nil { 3995 return err 3996 } 3997 msicart.Name = &name 3998 } 3999 case "type": 4000 if v != nil { 4001 var typeVar string 4002 err = json.Unmarshal(*v, &typeVar) 4003 if err != nil { 4004 return err 4005 } 4006 msicart.Type = &typeVar 4007 } 4008 } 4009 } 4010 4011 return nil 4012} 4013 4014// MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties microsoftSecurityIncidentCreation rule 4015// template properties 4016type MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties struct { 4017 // AlertRulesCreatedByTemplateCount - the number of alert rules that were created by this template 4018 AlertRulesCreatedByTemplateCount *int32 `json:"alertRulesCreatedByTemplateCount,omitempty"` 4019 // CreatedDateUTC - READ-ONLY; The time that this alert rule template has been added. 4020 CreatedDateUTC *date.Time `json:"createdDateUTC,omitempty"` 4021 // Description - The description of the alert rule template. 4022 Description *string `json:"description,omitempty"` 4023 // DisplayName - The display name for alert rule template. 4024 DisplayName *string `json:"displayName,omitempty"` 4025 // RequiredDataConnectors - The required data connectors for this template 4026 RequiredDataConnectors *[]AlertRuleTemplateDataSource `json:"requiredDataConnectors,omitempty"` 4027 // Status - The alert rule template status. Possible values include: 'Installed', 'Available', 'NotAvailable' 4028 Status TemplateStatus `json:"status,omitempty"` 4029 // DisplayNamesFilter - the alerts' displayNames on which the cases will be generated 4030 DisplayNamesFilter *[]string `json:"displayNamesFilter,omitempty"` 4031 // DisplayNamesExcludeFilter - the alerts' displayNames on which the cases will not be generated 4032 DisplayNamesExcludeFilter *[]string `json:"displayNamesExcludeFilter,omitempty"` 4033 // ProductFilter - The alerts' productName on which the cases will be generated. Possible values include: 'MicrosoftCloudAppSecurity', 'AzureSecurityCenter', 'AzureAdvancedThreatProtection', 'AzureActiveDirectoryIdentityProtection', 'AzureSecurityCenterforIoT' 4034 ProductFilter MicrosoftSecurityProductName `json:"productFilter,omitempty"` 4035 // SeveritiesFilter - the alerts' severities on which the cases will be generated 4036 SeveritiesFilter *[]AlertSeverity `json:"severitiesFilter,omitempty"` 4037} 4038 4039// MarshalJSON is the custom marshaler for MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties. 4040func (msicartp MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties) MarshalJSON() ([]byte, error) { 4041 objectMap := make(map[string]interface{}) 4042 if msicartp.AlertRulesCreatedByTemplateCount != nil { 4043 objectMap["alertRulesCreatedByTemplateCount"] = msicartp.AlertRulesCreatedByTemplateCount 4044 } 4045 if msicartp.Description != nil { 4046 objectMap["description"] = msicartp.Description 4047 } 4048 if msicartp.DisplayName != nil { 4049 objectMap["displayName"] = msicartp.DisplayName 4050 } 4051 if msicartp.RequiredDataConnectors != nil { 4052 objectMap["requiredDataConnectors"] = msicartp.RequiredDataConnectors 4053 } 4054 if msicartp.Status != "" { 4055 objectMap["status"] = msicartp.Status 4056 } 4057 if msicartp.DisplayNamesFilter != nil { 4058 objectMap["displayNamesFilter"] = msicartp.DisplayNamesFilter 4059 } 4060 if msicartp.DisplayNamesExcludeFilter != nil { 4061 objectMap["displayNamesExcludeFilter"] = msicartp.DisplayNamesExcludeFilter 4062 } 4063 if msicartp.ProductFilter != "" { 4064 objectMap["productFilter"] = msicartp.ProductFilter 4065 } 4066 if msicartp.SeveritiesFilter != nil { 4067 objectMap["severitiesFilter"] = msicartp.SeveritiesFilter 4068 } 4069 return json.Marshal(objectMap) 4070} 4071 4072// OfficeConsent consent for Office365 tenant that already made. 4073type OfficeConsent struct { 4074 // OfficeConsentProperties - Office consent properties 4075 *OfficeConsentProperties `json:"properties,omitempty"` 4076 // ID - READ-ONLY; Azure resource Id 4077 ID *string `json:"id,omitempty"` 4078 // Name - READ-ONLY; Azure resource name 4079 Name *string `json:"name,omitempty"` 4080 // Type - READ-ONLY; Azure resource type 4081 Type *string `json:"type,omitempty"` 4082} 4083 4084// MarshalJSON is the custom marshaler for OfficeConsent. 4085func (oc OfficeConsent) MarshalJSON() ([]byte, error) { 4086 objectMap := make(map[string]interface{}) 4087 if oc.OfficeConsentProperties != nil { 4088 objectMap["properties"] = oc.OfficeConsentProperties 4089 } 4090 return json.Marshal(objectMap) 4091} 4092 4093// UnmarshalJSON is the custom unmarshaler for OfficeConsent struct. 4094func (oc *OfficeConsent) UnmarshalJSON(body []byte) error { 4095 var m map[string]*json.RawMessage 4096 err := json.Unmarshal(body, &m) 4097 if err != nil { 4098 return err 4099 } 4100 for k, v := range m { 4101 switch k { 4102 case "properties": 4103 if v != nil { 4104 var officeConsentProperties OfficeConsentProperties 4105 err = json.Unmarshal(*v, &officeConsentProperties) 4106 if err != nil { 4107 return err 4108 } 4109 oc.OfficeConsentProperties = &officeConsentProperties 4110 } 4111 case "id": 4112 if v != nil { 4113 var ID string 4114 err = json.Unmarshal(*v, &ID) 4115 if err != nil { 4116 return err 4117 } 4118 oc.ID = &ID 4119 } 4120 case "name": 4121 if v != nil { 4122 var name string 4123 err = json.Unmarshal(*v, &name) 4124 if err != nil { 4125 return err 4126 } 4127 oc.Name = &name 4128 } 4129 case "type": 4130 if v != nil { 4131 var typeVar string 4132 err = json.Unmarshal(*v, &typeVar) 4133 if err != nil { 4134 return err 4135 } 4136 oc.Type = &typeVar 4137 } 4138 } 4139 } 4140 4141 return nil 4142} 4143 4144// OfficeConsentList list of all the office365 consents. 4145type OfficeConsentList struct { 4146 // NextLink - READ-ONLY; URL to fetch the next set of office consents. 4147 NextLink *string `json:"nextLink,omitempty"` 4148 // Value - Array of the consents. 4149 Value *[]OfficeConsent `json:"value,omitempty"` 4150} 4151 4152// MarshalJSON is the custom marshaler for OfficeConsentList. 4153func (ocl OfficeConsentList) MarshalJSON() ([]byte, error) { 4154 objectMap := make(map[string]interface{}) 4155 if ocl.Value != nil { 4156 objectMap["value"] = ocl.Value 4157 } 4158 return json.Marshal(objectMap) 4159} 4160 4161// OfficeConsentProperties consent property bag. 4162type OfficeConsentProperties struct { 4163 // TenantID - The tenantId of the Office365 with the consent. 4164 TenantID *string `json:"tenantId,omitempty"` 4165 // TenantName - READ-ONLY; The tenant name of the Office365 with the consent. 4166 TenantName *string `json:"tenantName,omitempty"` 4167} 4168 4169// MarshalJSON is the custom marshaler for OfficeConsentProperties. 4170func (ocp OfficeConsentProperties) MarshalJSON() ([]byte, error) { 4171 objectMap := make(map[string]interface{}) 4172 if ocp.TenantID != nil { 4173 objectMap["tenantId"] = ocp.TenantID 4174 } 4175 return json.Marshal(objectMap) 4176} 4177 4178// OfficeDataConnector represents office data connector. 4179type OfficeDataConnector struct { 4180 // OfficeDataConnectorProperties - Office data connector properties. 4181 *OfficeDataConnectorProperties `json:"properties,omitempty"` 4182 // Kind - Possible values include: 'KindDataConnector', 'KindAzureActiveDirectory', 'KindAzureAdvancedThreatProtection', 'KindAzureSecurityCenter', 'KindAmazonWebServicesCloudTrail', 'KindMicrosoftCloudAppSecurity', 'KindMicrosoftDefenderAdvancedThreatProtection', 'KindOffice365', 'KindThreatIntelligence' 4183 Kind KindBasicDataConnector `json:"kind,omitempty"` 4184 // ID - READ-ONLY; Azure resource Id 4185 ID *string `json:"id,omitempty"` 4186 // Name - READ-ONLY; Azure resource name 4187 Name *string `json:"name,omitempty"` 4188 // Type - READ-ONLY; Azure resource type 4189 Type *string `json:"type,omitempty"` 4190 // Etag - Etag of the azure resource 4191 Etag *string `json:"etag,omitempty"` 4192} 4193 4194// MarshalJSON is the custom marshaler for OfficeDataConnector. 4195func (odc OfficeDataConnector) MarshalJSON() ([]byte, error) { 4196 odc.Kind = KindOffice365 4197 objectMap := make(map[string]interface{}) 4198 if odc.OfficeDataConnectorProperties != nil { 4199 objectMap["properties"] = odc.OfficeDataConnectorProperties 4200 } 4201 if odc.Kind != "" { 4202 objectMap["kind"] = odc.Kind 4203 } 4204 if odc.Etag != nil { 4205 objectMap["etag"] = odc.Etag 4206 } 4207 return json.Marshal(objectMap) 4208} 4209 4210// AsAADDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 4211func (odc OfficeDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 4212 return nil, false 4213} 4214 4215// AsAATPDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 4216func (odc OfficeDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 4217 return nil, false 4218} 4219 4220// AsASCDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 4221func (odc OfficeDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 4222 return nil, false 4223} 4224 4225// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 4226func (odc OfficeDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 4227 return nil, false 4228} 4229 4230// AsMCASDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 4231func (odc OfficeDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 4232 return nil, false 4233} 4234 4235// AsMDATPDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 4236func (odc OfficeDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 4237 return nil, false 4238} 4239 4240// AsOfficeDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 4241func (odc OfficeDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 4242 return &odc, true 4243} 4244 4245// AsTIDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 4246func (odc OfficeDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 4247 return nil, false 4248} 4249 4250// AsDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 4251func (odc OfficeDataConnector) AsDataConnector() (*DataConnector, bool) { 4252 return nil, false 4253} 4254 4255// AsBasicDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 4256func (odc OfficeDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 4257 return &odc, true 4258} 4259 4260// UnmarshalJSON is the custom unmarshaler for OfficeDataConnector struct. 4261func (odc *OfficeDataConnector) UnmarshalJSON(body []byte) error { 4262 var m map[string]*json.RawMessage 4263 err := json.Unmarshal(body, &m) 4264 if err != nil { 4265 return err 4266 } 4267 for k, v := range m { 4268 switch k { 4269 case "properties": 4270 if v != nil { 4271 var officeDataConnectorProperties OfficeDataConnectorProperties 4272 err = json.Unmarshal(*v, &officeDataConnectorProperties) 4273 if err != nil { 4274 return err 4275 } 4276 odc.OfficeDataConnectorProperties = &officeDataConnectorProperties 4277 } 4278 case "kind": 4279 if v != nil { 4280 var kind KindBasicDataConnector 4281 err = json.Unmarshal(*v, &kind) 4282 if err != nil { 4283 return err 4284 } 4285 odc.Kind = kind 4286 } 4287 case "id": 4288 if v != nil { 4289 var ID string 4290 err = json.Unmarshal(*v, &ID) 4291 if err != nil { 4292 return err 4293 } 4294 odc.ID = &ID 4295 } 4296 case "name": 4297 if v != nil { 4298 var name string 4299 err = json.Unmarshal(*v, &name) 4300 if err != nil { 4301 return err 4302 } 4303 odc.Name = &name 4304 } 4305 case "type": 4306 if v != nil { 4307 var typeVar string 4308 err = json.Unmarshal(*v, &typeVar) 4309 if err != nil { 4310 return err 4311 } 4312 odc.Type = &typeVar 4313 } 4314 case "etag": 4315 if v != nil { 4316 var etag string 4317 err = json.Unmarshal(*v, &etag) 4318 if err != nil { 4319 return err 4320 } 4321 odc.Etag = &etag 4322 } 4323 } 4324 } 4325 4326 return nil 4327} 4328 4329// OfficeDataConnectorDataTypes the available data types for office data connector. 4330type OfficeDataConnectorDataTypes struct { 4331 // Exchange - Exchange data type connection. 4332 Exchange *OfficeDataConnectorDataTypesExchange `json:"exchange,omitempty"` 4333 // SharePoint - SharePoint data type connection. 4334 SharePoint *OfficeDataConnectorDataTypesSharePoint `json:"sharePoint,omitempty"` 4335} 4336 4337// OfficeDataConnectorDataTypesExchange exchange data type connection. 4338type OfficeDataConnectorDataTypesExchange struct { 4339 // State - Describe whether this data type connection is enabled or not. Possible values include: 'Enabled', 'Disabled' 4340 State DataTypeState `json:"state,omitempty"` 4341} 4342 4343// OfficeDataConnectorDataTypesSharePoint sharePoint data type connection. 4344type OfficeDataConnectorDataTypesSharePoint struct { 4345 // State - Describe whether this data type connection is enabled or not. Possible values include: 'Enabled', 'Disabled' 4346 State DataTypeState `json:"state,omitempty"` 4347} 4348 4349// OfficeDataConnectorProperties office data connector properties. 4350type OfficeDataConnectorProperties struct { 4351 // TenantID - The tenant id to connect to, and get the data from. 4352 TenantID *string `json:"tenantId,omitempty"` 4353 // DataTypes - The available data types for the connector. 4354 DataTypes *OfficeDataConnectorDataTypes `json:"dataTypes,omitempty"` 4355} 4356 4357// Operation operation provided by provider 4358type Operation struct { 4359 // Display - Properties of the operation 4360 Display *OperationDisplay `json:"display,omitempty"` 4361 // Name - Name of the operation 4362 Name *string `json:"name,omitempty"` 4363} 4364 4365// OperationDisplay properties of the operation 4366type OperationDisplay struct { 4367 // Description - Description of the operation 4368 Description *string `json:"description,omitempty"` 4369 // Operation - Operation name 4370 Operation *string `json:"operation,omitempty"` 4371 // Provider - Provider name 4372 Provider *string `json:"provider,omitempty"` 4373 // Resource - Resource name 4374 Resource *string `json:"resource,omitempty"` 4375} 4376 4377// OperationsList lists the operations available in the SecurityInsights RP. 4378type OperationsList struct { 4379 autorest.Response `json:"-"` 4380 // NextLink - URL to fetch the next set of operations. 4381 NextLink *string `json:"nextLink,omitempty"` 4382 // Value - Array of operations 4383 Value *[]Operation `json:"value,omitempty"` 4384} 4385 4386// OperationsListIterator provides access to a complete listing of Operation values. 4387type OperationsListIterator struct { 4388 i int 4389 page OperationsListPage 4390} 4391 4392// NextWithContext advances to the next value. If there was an error making 4393// the request the iterator does not advance and the error is returned. 4394func (iter *OperationsListIterator) NextWithContext(ctx context.Context) (err error) { 4395 if tracing.IsEnabled() { 4396 ctx = tracing.StartSpan(ctx, fqdn+"/OperationsListIterator.NextWithContext") 4397 defer func() { 4398 sc := -1 4399 if iter.Response().Response.Response != nil { 4400 sc = iter.Response().Response.Response.StatusCode 4401 } 4402 tracing.EndSpan(ctx, sc, err) 4403 }() 4404 } 4405 iter.i++ 4406 if iter.i < len(iter.page.Values()) { 4407 return nil 4408 } 4409 err = iter.page.NextWithContext(ctx) 4410 if err != nil { 4411 iter.i-- 4412 return err 4413 } 4414 iter.i = 0 4415 return nil 4416} 4417 4418// Next advances to the next value. If there was an error making 4419// the request the iterator does not advance and the error is returned. 4420// Deprecated: Use NextWithContext() instead. 4421func (iter *OperationsListIterator) Next() error { 4422 return iter.NextWithContext(context.Background()) 4423} 4424 4425// NotDone returns true if the enumeration should be started or is not yet complete. 4426func (iter OperationsListIterator) NotDone() bool { 4427 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 4428} 4429 4430// Response returns the raw server response from the last page request. 4431func (iter OperationsListIterator) Response() OperationsList { 4432 return iter.page.Response() 4433} 4434 4435// Value returns the current value or a zero-initialized value if the 4436// iterator has advanced beyond the end of the collection. 4437func (iter OperationsListIterator) Value() Operation { 4438 if !iter.page.NotDone() { 4439 return Operation{} 4440 } 4441 return iter.page.Values()[iter.i] 4442} 4443 4444// Creates a new instance of the OperationsListIterator type. 4445func NewOperationsListIterator(page OperationsListPage) OperationsListIterator { 4446 return OperationsListIterator{page: page} 4447} 4448 4449// IsEmpty returns true if the ListResult contains no values. 4450func (ol OperationsList) IsEmpty() bool { 4451 return ol.Value == nil || len(*ol.Value) == 0 4452} 4453 4454// hasNextLink returns true if the NextLink is not empty. 4455func (ol OperationsList) hasNextLink() bool { 4456 return ol.NextLink != nil && len(*ol.NextLink) != 0 4457} 4458 4459// operationsListPreparer prepares a request to retrieve the next set of results. 4460// It returns nil if no more results exist. 4461func (ol OperationsList) operationsListPreparer(ctx context.Context) (*http.Request, error) { 4462 if !ol.hasNextLink() { 4463 return nil, nil 4464 } 4465 return autorest.Prepare((&http.Request{}).WithContext(ctx), 4466 autorest.AsJSON(), 4467 autorest.AsGet(), 4468 autorest.WithBaseURL(to.String(ol.NextLink))) 4469} 4470 4471// OperationsListPage contains a page of Operation values. 4472type OperationsListPage struct { 4473 fn func(context.Context, OperationsList) (OperationsList, error) 4474 ol OperationsList 4475} 4476 4477// NextWithContext advances to the next page of values. If there was an error making 4478// the request the page does not advance and the error is returned. 4479func (page *OperationsListPage) NextWithContext(ctx context.Context) (err error) { 4480 if tracing.IsEnabled() { 4481 ctx = tracing.StartSpan(ctx, fqdn+"/OperationsListPage.NextWithContext") 4482 defer func() { 4483 sc := -1 4484 if page.Response().Response.Response != nil { 4485 sc = page.Response().Response.Response.StatusCode 4486 } 4487 tracing.EndSpan(ctx, sc, err) 4488 }() 4489 } 4490 for { 4491 next, err := page.fn(ctx, page.ol) 4492 if err != nil { 4493 return err 4494 } 4495 page.ol = next 4496 if !next.hasNextLink() || !next.IsEmpty() { 4497 break 4498 } 4499 } 4500 return nil 4501} 4502 4503// Next advances to the next page of values. If there was an error making 4504// the request the page does not advance and the error is returned. 4505// Deprecated: Use NextWithContext() instead. 4506func (page *OperationsListPage) Next() error { 4507 return page.NextWithContext(context.Background()) 4508} 4509 4510// NotDone returns true if the page enumeration should be started or is not yet complete. 4511func (page OperationsListPage) NotDone() bool { 4512 return !page.ol.IsEmpty() 4513} 4514 4515// Response returns the raw server response from the last page request. 4516func (page OperationsListPage) Response() OperationsList { 4517 return page.ol 4518} 4519 4520// Values returns the slice of values for the current page or nil if there are no values. 4521func (page OperationsListPage) Values() []Operation { 4522 if page.ol.IsEmpty() { 4523 return nil 4524 } 4525 return *page.ol.Value 4526} 4527 4528// Creates a new instance of the OperationsListPage type. 4529func NewOperationsListPage(cur OperationsList, getNextPage func(context.Context, OperationsList) (OperationsList, error)) OperationsListPage { 4530 return OperationsListPage{ 4531 fn: getNextPage, 4532 ol: cur, 4533 } 4534} 4535 4536// Resource an azure resource object 4537type Resource struct { 4538 // ID - READ-ONLY; Azure resource Id 4539 ID *string `json:"id,omitempty"` 4540 // Name - READ-ONLY; Azure resource name 4541 Name *string `json:"name,omitempty"` 4542 // Type - READ-ONLY; Azure resource type 4543 Type *string `json:"type,omitempty"` 4544} 4545 4546// MarshalJSON is the custom marshaler for Resource. 4547func (r Resource) MarshalJSON() ([]byte, error) { 4548 objectMap := make(map[string]interface{}) 4549 return json.Marshal(objectMap) 4550} 4551 4552// ResourceWithEtag an azure resource object with an Etag property 4553type ResourceWithEtag struct { 4554 // ID - READ-ONLY; Azure resource Id 4555 ID *string `json:"id,omitempty"` 4556 // Name - READ-ONLY; Azure resource name 4557 Name *string `json:"name,omitempty"` 4558 // Type - READ-ONLY; Azure resource type 4559 Type *string `json:"type,omitempty"` 4560 // Etag - Etag of the azure resource 4561 Etag *string `json:"etag,omitempty"` 4562} 4563 4564// MarshalJSON is the custom marshaler for ResourceWithEtag. 4565func (rwe ResourceWithEtag) MarshalJSON() ([]byte, error) { 4566 objectMap := make(map[string]interface{}) 4567 if rwe.Etag != nil { 4568 objectMap["etag"] = rwe.Etag 4569 } 4570 return json.Marshal(objectMap) 4571} 4572 4573// ScheduledAlertRule represents scheduled alert rule. 4574type ScheduledAlertRule struct { 4575 // ScheduledAlertRuleProperties - Scheduled alert rule properties 4576 *ScheduledAlertRuleProperties `json:"properties,omitempty"` 4577 // Kind - Possible values include: 'KindAlertRule', 'KindFusion', 'KindMicrosoftSecurityIncidentCreation', 'KindScheduled' 4578 Kind Kind `json:"kind,omitempty"` 4579 // ID - READ-ONLY; Azure resource Id 4580 ID *string `json:"id,omitempty"` 4581 // Name - READ-ONLY; Azure resource name 4582 Name *string `json:"name,omitempty"` 4583 // Type - READ-ONLY; Azure resource type 4584 Type *string `json:"type,omitempty"` 4585 // Etag - Etag of the azure resource 4586 Etag *string `json:"etag,omitempty"` 4587} 4588 4589// MarshalJSON is the custom marshaler for ScheduledAlertRule. 4590func (sar ScheduledAlertRule) MarshalJSON() ([]byte, error) { 4591 sar.Kind = KindScheduled 4592 objectMap := make(map[string]interface{}) 4593 if sar.ScheduledAlertRuleProperties != nil { 4594 objectMap["properties"] = sar.ScheduledAlertRuleProperties 4595 } 4596 if sar.Kind != "" { 4597 objectMap["kind"] = sar.Kind 4598 } 4599 if sar.Etag != nil { 4600 objectMap["etag"] = sar.Etag 4601 } 4602 return json.Marshal(objectMap) 4603} 4604 4605// AsFusionAlertRule is the BasicAlertRule implementation for ScheduledAlertRule. 4606func (sar ScheduledAlertRule) AsFusionAlertRule() (*FusionAlertRule, bool) { 4607 return nil, false 4608} 4609 4610// AsMicrosoftSecurityIncidentCreationAlertRule is the BasicAlertRule implementation for ScheduledAlertRule. 4611func (sar ScheduledAlertRule) AsMicrosoftSecurityIncidentCreationAlertRule() (*MicrosoftSecurityIncidentCreationAlertRule, bool) { 4612 return nil, false 4613} 4614 4615// AsScheduledAlertRule is the BasicAlertRule implementation for ScheduledAlertRule. 4616func (sar ScheduledAlertRule) AsScheduledAlertRule() (*ScheduledAlertRule, bool) { 4617 return &sar, true 4618} 4619 4620// AsAlertRule is the BasicAlertRule implementation for ScheduledAlertRule. 4621func (sar ScheduledAlertRule) AsAlertRule() (*AlertRule, bool) { 4622 return nil, false 4623} 4624 4625// AsBasicAlertRule is the BasicAlertRule implementation for ScheduledAlertRule. 4626func (sar ScheduledAlertRule) AsBasicAlertRule() (BasicAlertRule, bool) { 4627 return &sar, true 4628} 4629 4630// UnmarshalJSON is the custom unmarshaler for ScheduledAlertRule struct. 4631func (sar *ScheduledAlertRule) UnmarshalJSON(body []byte) error { 4632 var m map[string]*json.RawMessage 4633 err := json.Unmarshal(body, &m) 4634 if err != nil { 4635 return err 4636 } 4637 for k, v := range m { 4638 switch k { 4639 case "properties": 4640 if v != nil { 4641 var scheduledAlertRuleProperties ScheduledAlertRuleProperties 4642 err = json.Unmarshal(*v, &scheduledAlertRuleProperties) 4643 if err != nil { 4644 return err 4645 } 4646 sar.ScheduledAlertRuleProperties = &scheduledAlertRuleProperties 4647 } 4648 case "kind": 4649 if v != nil { 4650 var kind Kind 4651 err = json.Unmarshal(*v, &kind) 4652 if err != nil { 4653 return err 4654 } 4655 sar.Kind = kind 4656 } 4657 case "id": 4658 if v != nil { 4659 var ID string 4660 err = json.Unmarshal(*v, &ID) 4661 if err != nil { 4662 return err 4663 } 4664 sar.ID = &ID 4665 } 4666 case "name": 4667 if v != nil { 4668 var name string 4669 err = json.Unmarshal(*v, &name) 4670 if err != nil { 4671 return err 4672 } 4673 sar.Name = &name 4674 } 4675 case "type": 4676 if v != nil { 4677 var typeVar string 4678 err = json.Unmarshal(*v, &typeVar) 4679 if err != nil { 4680 return err 4681 } 4682 sar.Type = &typeVar 4683 } 4684 case "etag": 4685 if v != nil { 4686 var etag string 4687 err = json.Unmarshal(*v, &etag) 4688 if err != nil { 4689 return err 4690 } 4691 sar.Etag = &etag 4692 } 4693 } 4694 } 4695 4696 return nil 4697} 4698 4699// ScheduledAlertRuleCommonProperties schedule alert rule template property bag. 4700type ScheduledAlertRuleCommonProperties struct { 4701 // Query - The query that creates alerts for this rule. 4702 Query *string `json:"query,omitempty"` 4703 // QueryFrequency - The frequency (in ISO 8601 duration format) for this alert rule to run. 4704 QueryFrequency *string `json:"queryFrequency,omitempty"` 4705 // QueryPeriod - The period (in ISO 8601 duration format) that this alert rule looks at. 4706 QueryPeriod *string `json:"queryPeriod,omitempty"` 4707 // Severity - The severity for alerts created by this alert rule. Possible values include: 'High', 'Medium', 'Low', 'Informational' 4708 Severity AlertSeverity `json:"severity,omitempty"` 4709 // TriggerOperator - The operation against the threshold that triggers alert rule. Possible values include: 'GreaterThan', 'LessThan', 'Equal', 'NotEqual' 4710 TriggerOperator TriggerOperator `json:"triggerOperator,omitempty"` 4711 // TriggerThreshold - The threshold triggers this alert rule. 4712 TriggerThreshold *int32 `json:"triggerThreshold,omitempty"` 4713} 4714 4715// ScheduledAlertRuleProperties scheduled alert rule base property bag. 4716type ScheduledAlertRuleProperties struct { 4717 // AlertRuleTemplateName - The Name of the alert rule template used to create this rule. 4718 AlertRuleTemplateName *string `json:"alertRuleTemplateName,omitempty"` 4719 // Description - The description of the alert rule. 4720 Description *string `json:"description,omitempty"` 4721 // DisplayName - The display name for alerts created by this alert rule. 4722 DisplayName *string `json:"displayName,omitempty"` 4723 // Enabled - Determines whether this alert rule is enabled or disabled. 4724 Enabled *bool `json:"enabled,omitempty"` 4725 // LastModifiedUtc - READ-ONLY; The last time that this alert rule has been modified. 4726 LastModifiedUtc *date.Time `json:"lastModifiedUtc,omitempty"` 4727 // SuppressionDuration - The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered. 4728 SuppressionDuration *string `json:"suppressionDuration,omitempty"` 4729 // SuppressionEnabled - Determines whether the suppression for this alert rule is enabled or disabled. 4730 SuppressionEnabled *bool `json:"suppressionEnabled,omitempty"` 4731 // Tactics - The tactics of the alert rule 4732 Tactics *[]AttackTactic `json:"tactics,omitempty"` 4733 // Query - The query that creates alerts for this rule. 4734 Query *string `json:"query,omitempty"` 4735 // QueryFrequency - The frequency (in ISO 8601 duration format) for this alert rule to run. 4736 QueryFrequency *string `json:"queryFrequency,omitempty"` 4737 // QueryPeriod - The period (in ISO 8601 duration format) that this alert rule looks at. 4738 QueryPeriod *string `json:"queryPeriod,omitempty"` 4739 // Severity - The severity for alerts created by this alert rule. Possible values include: 'High', 'Medium', 'Low', 'Informational' 4740 Severity AlertSeverity `json:"severity,omitempty"` 4741 // TriggerOperator - The operation against the threshold that triggers alert rule. Possible values include: 'GreaterThan', 'LessThan', 'Equal', 'NotEqual' 4742 TriggerOperator TriggerOperator `json:"triggerOperator,omitempty"` 4743 // TriggerThreshold - The threshold triggers this alert rule. 4744 TriggerThreshold *int32 `json:"triggerThreshold,omitempty"` 4745} 4746 4747// MarshalJSON is the custom marshaler for ScheduledAlertRuleProperties. 4748func (sarp ScheduledAlertRuleProperties) MarshalJSON() ([]byte, error) { 4749 objectMap := make(map[string]interface{}) 4750 if sarp.AlertRuleTemplateName != nil { 4751 objectMap["alertRuleTemplateName"] = sarp.AlertRuleTemplateName 4752 } 4753 if sarp.Description != nil { 4754 objectMap["description"] = sarp.Description 4755 } 4756 if sarp.DisplayName != nil { 4757 objectMap["displayName"] = sarp.DisplayName 4758 } 4759 if sarp.Enabled != nil { 4760 objectMap["enabled"] = sarp.Enabled 4761 } 4762 if sarp.SuppressionDuration != nil { 4763 objectMap["suppressionDuration"] = sarp.SuppressionDuration 4764 } 4765 if sarp.SuppressionEnabled != nil { 4766 objectMap["suppressionEnabled"] = sarp.SuppressionEnabled 4767 } 4768 if sarp.Tactics != nil { 4769 objectMap["tactics"] = sarp.Tactics 4770 } 4771 if sarp.Query != nil { 4772 objectMap["query"] = sarp.Query 4773 } 4774 if sarp.QueryFrequency != nil { 4775 objectMap["queryFrequency"] = sarp.QueryFrequency 4776 } 4777 if sarp.QueryPeriod != nil { 4778 objectMap["queryPeriod"] = sarp.QueryPeriod 4779 } 4780 if sarp.Severity != "" { 4781 objectMap["severity"] = sarp.Severity 4782 } 4783 if sarp.TriggerOperator != "" { 4784 objectMap["triggerOperator"] = sarp.TriggerOperator 4785 } 4786 if sarp.TriggerThreshold != nil { 4787 objectMap["triggerThreshold"] = sarp.TriggerThreshold 4788 } 4789 return json.Marshal(objectMap) 4790} 4791 4792// ScheduledAlertRuleTemplate represents scheduled alert rule template. 4793type ScheduledAlertRuleTemplate struct { 4794 // ScheduledAlertRuleTemplateProperties - Scheduled alert rule template properties 4795 *ScheduledAlertRuleTemplateProperties `json:"properties,omitempty"` 4796 // Kind - Possible values include: 'KindBasicAlertRuleTemplateKindAlertRuleTemplate', 'KindBasicAlertRuleTemplateKindFusion', 'KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleTemplateKindScheduled' 4797 Kind KindBasicAlertRuleTemplate `json:"kind,omitempty"` 4798 // ID - READ-ONLY; Azure resource Id 4799 ID *string `json:"id,omitempty"` 4800 // Name - READ-ONLY; Azure resource name 4801 Name *string `json:"name,omitempty"` 4802 // Type - READ-ONLY; Azure resource type 4803 Type *string `json:"type,omitempty"` 4804} 4805 4806// MarshalJSON is the custom marshaler for ScheduledAlertRuleTemplate. 4807func (sart ScheduledAlertRuleTemplate) MarshalJSON() ([]byte, error) { 4808 sart.Kind = KindBasicAlertRuleTemplateKindScheduled 4809 objectMap := make(map[string]interface{}) 4810 if sart.ScheduledAlertRuleTemplateProperties != nil { 4811 objectMap["properties"] = sart.ScheduledAlertRuleTemplateProperties 4812 } 4813 if sart.Kind != "" { 4814 objectMap["kind"] = sart.Kind 4815 } 4816 return json.Marshal(objectMap) 4817} 4818 4819// AsFusionAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ScheduledAlertRuleTemplate. 4820func (sart ScheduledAlertRuleTemplate) AsFusionAlertRuleTemplate() (*FusionAlertRuleTemplate, bool) { 4821 return nil, false 4822} 4823 4824// AsMicrosoftSecurityIncidentCreationAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ScheduledAlertRuleTemplate. 4825func (sart ScheduledAlertRuleTemplate) AsMicrosoftSecurityIncidentCreationAlertRuleTemplate() (*MicrosoftSecurityIncidentCreationAlertRuleTemplate, bool) { 4826 return nil, false 4827} 4828 4829// AsScheduledAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ScheduledAlertRuleTemplate. 4830func (sart ScheduledAlertRuleTemplate) AsScheduledAlertRuleTemplate() (*ScheduledAlertRuleTemplate, bool) { 4831 return &sart, true 4832} 4833 4834// AsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ScheduledAlertRuleTemplate. 4835func (sart ScheduledAlertRuleTemplate) AsAlertRuleTemplate() (*AlertRuleTemplate, bool) { 4836 return nil, false 4837} 4838 4839// AsBasicAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ScheduledAlertRuleTemplate. 4840func (sart ScheduledAlertRuleTemplate) AsBasicAlertRuleTemplate() (BasicAlertRuleTemplate, bool) { 4841 return &sart, true 4842} 4843 4844// UnmarshalJSON is the custom unmarshaler for ScheduledAlertRuleTemplate struct. 4845func (sart *ScheduledAlertRuleTemplate) UnmarshalJSON(body []byte) error { 4846 var m map[string]*json.RawMessage 4847 err := json.Unmarshal(body, &m) 4848 if err != nil { 4849 return err 4850 } 4851 for k, v := range m { 4852 switch k { 4853 case "properties": 4854 if v != nil { 4855 var scheduledAlertRuleTemplateProperties ScheduledAlertRuleTemplateProperties 4856 err = json.Unmarshal(*v, &scheduledAlertRuleTemplateProperties) 4857 if err != nil { 4858 return err 4859 } 4860 sart.ScheduledAlertRuleTemplateProperties = &scheduledAlertRuleTemplateProperties 4861 } 4862 case "kind": 4863 if v != nil { 4864 var kind KindBasicAlertRuleTemplate 4865 err = json.Unmarshal(*v, &kind) 4866 if err != nil { 4867 return err 4868 } 4869 sart.Kind = kind 4870 } 4871 case "id": 4872 if v != nil { 4873 var ID string 4874 err = json.Unmarshal(*v, &ID) 4875 if err != nil { 4876 return err 4877 } 4878 sart.ID = &ID 4879 } 4880 case "name": 4881 if v != nil { 4882 var name string 4883 err = json.Unmarshal(*v, &name) 4884 if err != nil { 4885 return err 4886 } 4887 sart.Name = &name 4888 } 4889 case "type": 4890 if v != nil { 4891 var typeVar string 4892 err = json.Unmarshal(*v, &typeVar) 4893 if err != nil { 4894 return err 4895 } 4896 sart.Type = &typeVar 4897 } 4898 } 4899 } 4900 4901 return nil 4902} 4903 4904// ScheduledAlertRuleTemplateProperties scheduled alert rule template properties 4905type ScheduledAlertRuleTemplateProperties struct { 4906 // AlertRulesCreatedByTemplateCount - the number of alert rules that were created by this template 4907 AlertRulesCreatedByTemplateCount *int32 `json:"alertRulesCreatedByTemplateCount,omitempty"` 4908 // CreatedDateUTC - READ-ONLY; The time that this alert rule template has been added. 4909 CreatedDateUTC *date.Time `json:"createdDateUTC,omitempty"` 4910 // Description - The description of the alert rule template. 4911 Description *string `json:"description,omitempty"` 4912 // DisplayName - The display name for alert rule template. 4913 DisplayName *string `json:"displayName,omitempty"` 4914 // RequiredDataConnectors - The required data connectors for this template 4915 RequiredDataConnectors *[]AlertRuleTemplateDataSource `json:"requiredDataConnectors,omitempty"` 4916 // Status - The alert rule template status. Possible values include: 'Installed', 'Available', 'NotAvailable' 4917 Status TemplateStatus `json:"status,omitempty"` 4918 // Query - The query that creates alerts for this rule. 4919 Query *string `json:"query,omitempty"` 4920 // QueryFrequency - The frequency (in ISO 8601 duration format) for this alert rule to run. 4921 QueryFrequency *string `json:"queryFrequency,omitempty"` 4922 // QueryPeriod - The period (in ISO 8601 duration format) that this alert rule looks at. 4923 QueryPeriod *string `json:"queryPeriod,omitempty"` 4924 // Severity - The severity for alerts created by this alert rule. Possible values include: 'High', 'Medium', 'Low', 'Informational' 4925 Severity AlertSeverity `json:"severity,omitempty"` 4926 // TriggerOperator - The operation against the threshold that triggers alert rule. Possible values include: 'GreaterThan', 'LessThan', 'Equal', 'NotEqual' 4927 TriggerOperator TriggerOperator `json:"triggerOperator,omitempty"` 4928 // TriggerThreshold - The threshold triggers this alert rule. 4929 TriggerThreshold *int32 `json:"triggerThreshold,omitempty"` 4930 // Tactics - The tactics of the alert rule template 4931 Tactics *[]AttackTactic `json:"tactics,omitempty"` 4932} 4933 4934// MarshalJSON is the custom marshaler for ScheduledAlertRuleTemplateProperties. 4935func (sartp ScheduledAlertRuleTemplateProperties) MarshalJSON() ([]byte, error) { 4936 objectMap := make(map[string]interface{}) 4937 if sartp.AlertRulesCreatedByTemplateCount != nil { 4938 objectMap["alertRulesCreatedByTemplateCount"] = sartp.AlertRulesCreatedByTemplateCount 4939 } 4940 if sartp.Description != nil { 4941 objectMap["description"] = sartp.Description 4942 } 4943 if sartp.DisplayName != nil { 4944 objectMap["displayName"] = sartp.DisplayName 4945 } 4946 if sartp.RequiredDataConnectors != nil { 4947 objectMap["requiredDataConnectors"] = sartp.RequiredDataConnectors 4948 } 4949 if sartp.Status != "" { 4950 objectMap["status"] = sartp.Status 4951 } 4952 if sartp.Query != nil { 4953 objectMap["query"] = sartp.Query 4954 } 4955 if sartp.QueryFrequency != nil { 4956 objectMap["queryFrequency"] = sartp.QueryFrequency 4957 } 4958 if sartp.QueryPeriod != nil { 4959 objectMap["queryPeriod"] = sartp.QueryPeriod 4960 } 4961 if sartp.Severity != "" { 4962 objectMap["severity"] = sartp.Severity 4963 } 4964 if sartp.TriggerOperator != "" { 4965 objectMap["triggerOperator"] = sartp.TriggerOperator 4966 } 4967 if sartp.TriggerThreshold != nil { 4968 objectMap["triggerThreshold"] = sartp.TriggerThreshold 4969 } 4970 if sartp.Tactics != nil { 4971 objectMap["tactics"] = sartp.Tactics 4972 } 4973 return json.Marshal(objectMap) 4974} 4975 4976// BasicSettings the Settings. 4977type BasicSettings interface { 4978 AsToggleSettings() (*ToggleSettings, bool) 4979 AsUebaSettings() (*UebaSettings, bool) 4980 AsSettings() (*Settings, bool) 4981} 4982 4983// Settings the Settings. 4984type Settings struct { 4985 // Kind - Possible values include: 'KindSettings', 'KindToggleSettings', 'KindUebaSettings' 4986 Kind KindBasicSettings `json:"kind,omitempty"` 4987 // ID - READ-ONLY; Azure resource Id 4988 ID *string `json:"id,omitempty"` 4989 // Name - READ-ONLY; Azure resource name 4990 Name *string `json:"name,omitempty"` 4991 // Type - READ-ONLY; Azure resource type 4992 Type *string `json:"type,omitempty"` 4993 // Etag - Etag of the azure resource 4994 Etag *string `json:"etag,omitempty"` 4995} 4996 4997func unmarshalBasicSettings(body []byte) (BasicSettings, error) { 4998 var m map[string]interface{} 4999 err := json.Unmarshal(body, &m) 5000 if err != nil { 5001 return nil, err 5002 } 5003 5004 switch m["kind"] { 5005 case string(KindToggleSettings): 5006 var ts ToggleSettings 5007 err := json.Unmarshal(body, &ts) 5008 return ts, err 5009 case string(KindUebaSettings): 5010 var us UebaSettings 5011 err := json.Unmarshal(body, &us) 5012 return us, err 5013 default: 5014 var s Settings 5015 err := json.Unmarshal(body, &s) 5016 return s, err 5017 } 5018} 5019func unmarshalBasicSettingsArray(body []byte) ([]BasicSettings, error) { 5020 var rawMessages []*json.RawMessage 5021 err := json.Unmarshal(body, &rawMessages) 5022 if err != nil { 5023 return nil, err 5024 } 5025 5026 sArray := make([]BasicSettings, len(rawMessages)) 5027 5028 for index, rawMessage := range rawMessages { 5029 s, err := unmarshalBasicSettings(*rawMessage) 5030 if err != nil { 5031 return nil, err 5032 } 5033 sArray[index] = s 5034 } 5035 return sArray, nil 5036} 5037 5038// MarshalJSON is the custom marshaler for Settings. 5039func (s Settings) MarshalJSON() ([]byte, error) { 5040 s.Kind = KindSettings 5041 objectMap := make(map[string]interface{}) 5042 if s.Kind != "" { 5043 objectMap["kind"] = s.Kind 5044 } 5045 if s.Etag != nil { 5046 objectMap["etag"] = s.Etag 5047 } 5048 return json.Marshal(objectMap) 5049} 5050 5051// AsToggleSettings is the BasicSettings implementation for Settings. 5052func (s Settings) AsToggleSettings() (*ToggleSettings, bool) { 5053 return nil, false 5054} 5055 5056// AsUebaSettings is the BasicSettings implementation for Settings. 5057func (s Settings) AsUebaSettings() (*UebaSettings, bool) { 5058 return nil, false 5059} 5060 5061// AsSettings is the BasicSettings implementation for Settings. 5062func (s Settings) AsSettings() (*Settings, bool) { 5063 return &s, true 5064} 5065 5066// AsBasicSettings is the BasicSettings implementation for Settings. 5067func (s Settings) AsBasicSettings() (BasicSettings, bool) { 5068 return &s, true 5069} 5070 5071// ThreatIntelligence threatIntelligence property bag. 5072type ThreatIntelligence struct { 5073 // Confidence - READ-ONLY; Confidence (must be between 0 and 1) 5074 Confidence *float64 `json:"confidence,omitempty"` 5075 // ProviderName - READ-ONLY; Name of the provider from whom this Threat Intelligence information was received 5076 ProviderName *string `json:"providerName,omitempty"` 5077 // ReportLink - READ-ONLY; Report link 5078 ReportLink *string `json:"reportLink,omitempty"` 5079 // ThreatDescription - READ-ONLY; Threat description (free text) 5080 ThreatDescription *string `json:"threatDescription,omitempty"` 5081 // ThreatName - READ-ONLY; Threat name (e.g. "Jedobot malware") 5082 ThreatName *string `json:"threatName,omitempty"` 5083 // ThreatType - READ-ONLY; Threat type (e.g. "Botnet") 5084 ThreatType *string `json:"threatType,omitempty"` 5085} 5086 5087// MarshalJSON is the custom marshaler for ThreatIntelligence. 5088func (ti ThreatIntelligence) MarshalJSON() ([]byte, error) { 5089 objectMap := make(map[string]interface{}) 5090 return json.Marshal(objectMap) 5091} 5092 5093// TIDataConnector represents threat intelligence data connector. 5094type TIDataConnector struct { 5095 // TIDataConnectorProperties - TI (Threat Intelligence) data connector properties. 5096 *TIDataConnectorProperties `json:"properties,omitempty"` 5097 // Kind - Possible values include: 'KindDataConnector', 'KindAzureActiveDirectory', 'KindAzureAdvancedThreatProtection', 'KindAzureSecurityCenter', 'KindAmazonWebServicesCloudTrail', 'KindMicrosoftCloudAppSecurity', 'KindMicrosoftDefenderAdvancedThreatProtection', 'KindOffice365', 'KindThreatIntelligence' 5098 Kind KindBasicDataConnector `json:"kind,omitempty"` 5099 // ID - READ-ONLY; Azure resource Id 5100 ID *string `json:"id,omitempty"` 5101 // Name - READ-ONLY; Azure resource name 5102 Name *string `json:"name,omitempty"` 5103 // Type - READ-ONLY; Azure resource type 5104 Type *string `json:"type,omitempty"` 5105 // Etag - Etag of the azure resource 5106 Etag *string `json:"etag,omitempty"` 5107} 5108 5109// MarshalJSON is the custom marshaler for TIDataConnector. 5110func (tdc TIDataConnector) MarshalJSON() ([]byte, error) { 5111 tdc.Kind = KindThreatIntelligence 5112 objectMap := make(map[string]interface{}) 5113 if tdc.TIDataConnectorProperties != nil { 5114 objectMap["properties"] = tdc.TIDataConnectorProperties 5115 } 5116 if tdc.Kind != "" { 5117 objectMap["kind"] = tdc.Kind 5118 } 5119 if tdc.Etag != nil { 5120 objectMap["etag"] = tdc.Etag 5121 } 5122 return json.Marshal(objectMap) 5123} 5124 5125// AsAADDataConnector is the BasicDataConnector implementation for TIDataConnector. 5126func (tdc TIDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 5127 return nil, false 5128} 5129 5130// AsAATPDataConnector is the BasicDataConnector implementation for TIDataConnector. 5131func (tdc TIDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 5132 return nil, false 5133} 5134 5135// AsASCDataConnector is the BasicDataConnector implementation for TIDataConnector. 5136func (tdc TIDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 5137 return nil, false 5138} 5139 5140// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for TIDataConnector. 5141func (tdc TIDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 5142 return nil, false 5143} 5144 5145// AsMCASDataConnector is the BasicDataConnector implementation for TIDataConnector. 5146func (tdc TIDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 5147 return nil, false 5148} 5149 5150// AsMDATPDataConnector is the BasicDataConnector implementation for TIDataConnector. 5151func (tdc TIDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 5152 return nil, false 5153} 5154 5155// AsOfficeDataConnector is the BasicDataConnector implementation for TIDataConnector. 5156func (tdc TIDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 5157 return nil, false 5158} 5159 5160// AsTIDataConnector is the BasicDataConnector implementation for TIDataConnector. 5161func (tdc TIDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 5162 return &tdc, true 5163} 5164 5165// AsDataConnector is the BasicDataConnector implementation for TIDataConnector. 5166func (tdc TIDataConnector) AsDataConnector() (*DataConnector, bool) { 5167 return nil, false 5168} 5169 5170// AsBasicDataConnector is the BasicDataConnector implementation for TIDataConnector. 5171func (tdc TIDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 5172 return &tdc, true 5173} 5174 5175// UnmarshalJSON is the custom unmarshaler for TIDataConnector struct. 5176func (tdc *TIDataConnector) UnmarshalJSON(body []byte) error { 5177 var m map[string]*json.RawMessage 5178 err := json.Unmarshal(body, &m) 5179 if err != nil { 5180 return err 5181 } 5182 for k, v := range m { 5183 switch k { 5184 case "properties": 5185 if v != nil { 5186 var tIDataConnectorProperties TIDataConnectorProperties 5187 err = json.Unmarshal(*v, &tIDataConnectorProperties) 5188 if err != nil { 5189 return err 5190 } 5191 tdc.TIDataConnectorProperties = &tIDataConnectorProperties 5192 } 5193 case "kind": 5194 if v != nil { 5195 var kind KindBasicDataConnector 5196 err = json.Unmarshal(*v, &kind) 5197 if err != nil { 5198 return err 5199 } 5200 tdc.Kind = kind 5201 } 5202 case "id": 5203 if v != nil { 5204 var ID string 5205 err = json.Unmarshal(*v, &ID) 5206 if err != nil { 5207 return err 5208 } 5209 tdc.ID = &ID 5210 } 5211 case "name": 5212 if v != nil { 5213 var name string 5214 err = json.Unmarshal(*v, &name) 5215 if err != nil { 5216 return err 5217 } 5218 tdc.Name = &name 5219 } 5220 case "type": 5221 if v != nil { 5222 var typeVar string 5223 err = json.Unmarshal(*v, &typeVar) 5224 if err != nil { 5225 return err 5226 } 5227 tdc.Type = &typeVar 5228 } 5229 case "etag": 5230 if v != nil { 5231 var etag string 5232 err = json.Unmarshal(*v, &etag) 5233 if err != nil { 5234 return err 5235 } 5236 tdc.Etag = &etag 5237 } 5238 } 5239 } 5240 5241 return nil 5242} 5243 5244// TIDataConnectorDataTypes the available data types for TI (Threat Intelligence) data connector. 5245type TIDataConnectorDataTypes struct { 5246 // Indicators - Data type for indicators connection. 5247 Indicators *TIDataConnectorDataTypesIndicators `json:"indicators,omitempty"` 5248} 5249 5250// TIDataConnectorDataTypesIndicators data type for indicators connection. 5251type TIDataConnectorDataTypesIndicators struct { 5252 // State - Describe whether this data type connection is enabled or not. Possible values include: 'Enabled', 'Disabled' 5253 State DataTypeState `json:"state,omitempty"` 5254} 5255 5256// TIDataConnectorProperties TI (Threat Intelligence) data connector properties. 5257type TIDataConnectorProperties struct { 5258 // TenantID - The tenant id to connect to, and get the data from. 5259 TenantID *string `json:"tenantId,omitempty"` 5260 // DataTypes - The available data types for the connector. 5261 DataTypes *TIDataConnectorDataTypes `json:"dataTypes,omitempty"` 5262} 5263 5264// ToggleSettings settings with single toggle. 5265type ToggleSettings struct { 5266 // ToggleSettingsProperties - toggle properties 5267 *ToggleSettingsProperties `json:"properties,omitempty"` 5268 // Kind - Possible values include: 'KindSettings', 'KindToggleSettings', 'KindUebaSettings' 5269 Kind KindBasicSettings `json:"kind,omitempty"` 5270 // ID - READ-ONLY; Azure resource Id 5271 ID *string `json:"id,omitempty"` 5272 // Name - READ-ONLY; Azure resource name 5273 Name *string `json:"name,omitempty"` 5274 // Type - READ-ONLY; Azure resource type 5275 Type *string `json:"type,omitempty"` 5276 // Etag - Etag of the azure resource 5277 Etag *string `json:"etag,omitempty"` 5278} 5279 5280// MarshalJSON is the custom marshaler for ToggleSettings. 5281func (ts ToggleSettings) MarshalJSON() ([]byte, error) { 5282 ts.Kind = KindToggleSettings 5283 objectMap := make(map[string]interface{}) 5284 if ts.ToggleSettingsProperties != nil { 5285 objectMap["properties"] = ts.ToggleSettingsProperties 5286 } 5287 if ts.Kind != "" { 5288 objectMap["kind"] = ts.Kind 5289 } 5290 if ts.Etag != nil { 5291 objectMap["etag"] = ts.Etag 5292 } 5293 return json.Marshal(objectMap) 5294} 5295 5296// AsToggleSettings is the BasicSettings implementation for ToggleSettings. 5297func (ts ToggleSettings) AsToggleSettings() (*ToggleSettings, bool) { 5298 return &ts, true 5299} 5300 5301// AsUebaSettings is the BasicSettings implementation for ToggleSettings. 5302func (ts ToggleSettings) AsUebaSettings() (*UebaSettings, bool) { 5303 return nil, false 5304} 5305 5306// AsSettings is the BasicSettings implementation for ToggleSettings. 5307func (ts ToggleSettings) AsSettings() (*Settings, bool) { 5308 return nil, false 5309} 5310 5311// AsBasicSettings is the BasicSettings implementation for ToggleSettings. 5312func (ts ToggleSettings) AsBasicSettings() (BasicSettings, bool) { 5313 return &ts, true 5314} 5315 5316// UnmarshalJSON is the custom unmarshaler for ToggleSettings struct. 5317func (ts *ToggleSettings) UnmarshalJSON(body []byte) error { 5318 var m map[string]*json.RawMessage 5319 err := json.Unmarshal(body, &m) 5320 if err != nil { 5321 return err 5322 } 5323 for k, v := range m { 5324 switch k { 5325 case "properties": 5326 if v != nil { 5327 var toggleSettingsProperties ToggleSettingsProperties 5328 err = json.Unmarshal(*v, &toggleSettingsProperties) 5329 if err != nil { 5330 return err 5331 } 5332 ts.ToggleSettingsProperties = &toggleSettingsProperties 5333 } 5334 case "kind": 5335 if v != nil { 5336 var kind KindBasicSettings 5337 err = json.Unmarshal(*v, &kind) 5338 if err != nil { 5339 return err 5340 } 5341 ts.Kind = kind 5342 } 5343 case "id": 5344 if v != nil { 5345 var ID string 5346 err = json.Unmarshal(*v, &ID) 5347 if err != nil { 5348 return err 5349 } 5350 ts.ID = &ID 5351 } 5352 case "name": 5353 if v != nil { 5354 var name string 5355 err = json.Unmarshal(*v, &name) 5356 if err != nil { 5357 return err 5358 } 5359 ts.Name = &name 5360 } 5361 case "type": 5362 if v != nil { 5363 var typeVar string 5364 err = json.Unmarshal(*v, &typeVar) 5365 if err != nil { 5366 return err 5367 } 5368 ts.Type = &typeVar 5369 } 5370 case "etag": 5371 if v != nil { 5372 var etag string 5373 err = json.Unmarshal(*v, &etag) 5374 if err != nil { 5375 return err 5376 } 5377 ts.Etag = &etag 5378 } 5379 } 5380 } 5381 5382 return nil 5383} 5384 5385// ToggleSettingsProperties toggle property bag. 5386type ToggleSettingsProperties struct { 5387 // IsEnabled - Determines whether the setting is enable or disabled. 5388 IsEnabled *bool `json:"isEnabled,omitempty"` 5389} 5390 5391// UebaSettings represents settings for User and Entity Behavior Analytics enablement. 5392type UebaSettings struct { 5393 // UebaSettingsProperties - User and Entity Behavior Analytics settings properties 5394 *UebaSettingsProperties `json:"properties,omitempty"` 5395 // Kind - Possible values include: 'KindSettings', 'KindToggleSettings', 'KindUebaSettings' 5396 Kind KindBasicSettings `json:"kind,omitempty"` 5397 // ID - READ-ONLY; Azure resource Id 5398 ID *string `json:"id,omitempty"` 5399 // Name - READ-ONLY; Azure resource name 5400 Name *string `json:"name,omitempty"` 5401 // Type - READ-ONLY; Azure resource type 5402 Type *string `json:"type,omitempty"` 5403 // Etag - Etag of the azure resource 5404 Etag *string `json:"etag,omitempty"` 5405} 5406 5407// MarshalJSON is the custom marshaler for UebaSettings. 5408func (us UebaSettings) MarshalJSON() ([]byte, error) { 5409 us.Kind = KindUebaSettings 5410 objectMap := make(map[string]interface{}) 5411 if us.UebaSettingsProperties != nil { 5412 objectMap["properties"] = us.UebaSettingsProperties 5413 } 5414 if us.Kind != "" { 5415 objectMap["kind"] = us.Kind 5416 } 5417 if us.Etag != nil { 5418 objectMap["etag"] = us.Etag 5419 } 5420 return json.Marshal(objectMap) 5421} 5422 5423// AsToggleSettings is the BasicSettings implementation for UebaSettings. 5424func (us UebaSettings) AsToggleSettings() (*ToggleSettings, bool) { 5425 return nil, false 5426} 5427 5428// AsUebaSettings is the BasicSettings implementation for UebaSettings. 5429func (us UebaSettings) AsUebaSettings() (*UebaSettings, bool) { 5430 return &us, true 5431} 5432 5433// AsSettings is the BasicSettings implementation for UebaSettings. 5434func (us UebaSettings) AsSettings() (*Settings, bool) { 5435 return nil, false 5436} 5437 5438// AsBasicSettings is the BasicSettings implementation for UebaSettings. 5439func (us UebaSettings) AsBasicSettings() (BasicSettings, bool) { 5440 return &us, true 5441} 5442 5443// UnmarshalJSON is the custom unmarshaler for UebaSettings struct. 5444func (us *UebaSettings) UnmarshalJSON(body []byte) error { 5445 var m map[string]*json.RawMessage 5446 err := json.Unmarshal(body, &m) 5447 if err != nil { 5448 return err 5449 } 5450 for k, v := range m { 5451 switch k { 5452 case "properties": 5453 if v != nil { 5454 var uebaSettingsProperties UebaSettingsProperties 5455 err = json.Unmarshal(*v, &uebaSettingsProperties) 5456 if err != nil { 5457 return err 5458 } 5459 us.UebaSettingsProperties = &uebaSettingsProperties 5460 } 5461 case "kind": 5462 if v != nil { 5463 var kind KindBasicSettings 5464 err = json.Unmarshal(*v, &kind) 5465 if err != nil { 5466 return err 5467 } 5468 us.Kind = kind 5469 } 5470 case "id": 5471 if v != nil { 5472 var ID string 5473 err = json.Unmarshal(*v, &ID) 5474 if err != nil { 5475 return err 5476 } 5477 us.ID = &ID 5478 } 5479 case "name": 5480 if v != nil { 5481 var name string 5482 err = json.Unmarshal(*v, &name) 5483 if err != nil { 5484 return err 5485 } 5486 us.Name = &name 5487 } 5488 case "type": 5489 if v != nil { 5490 var typeVar string 5491 err = json.Unmarshal(*v, &typeVar) 5492 if err != nil { 5493 return err 5494 } 5495 us.Type = &typeVar 5496 } 5497 case "etag": 5498 if v != nil { 5499 var etag string 5500 err = json.Unmarshal(*v, &etag) 5501 if err != nil { 5502 return err 5503 } 5504 us.Etag = &etag 5505 } 5506 } 5507 } 5508 5509 return nil 5510} 5511 5512// UebaSettingsProperties user and Entity Behavior Analytics settings property bag. 5513type UebaSettingsProperties struct { 5514 // AtpLicenseStatus - READ-ONLY; Determines whether the tenant has ATP (Advanced Threat Protection) license. Possible values include: 'LicenseStatusEnabled', 'LicenseStatusDisabled' 5515 AtpLicenseStatus LicenseStatus `json:"atpLicenseStatus,omitempty"` 5516 // IsEnabled - Determines whether User and Entity Behavior Analytics is enabled for this workspace. 5517 IsEnabled *bool `json:"isEnabled,omitempty"` 5518 // StatusInMcas - READ-ONLY; Determines whether User and Entity Behavior Analytics is enabled from MCAS (Microsoft Cloud App Security). Possible values include: 'StatusInMcasEnabled', 'StatusInMcasDisabled' 5519 StatusInMcas StatusInMcas `json:"statusInMcas,omitempty"` 5520} 5521 5522// MarshalJSON is the custom marshaler for UebaSettingsProperties. 5523func (usp UebaSettingsProperties) MarshalJSON() ([]byte, error) { 5524 objectMap := make(map[string]interface{}) 5525 if usp.IsEnabled != nil { 5526 objectMap["isEnabled"] = usp.IsEnabled 5527 } 5528 return json.Marshal(objectMap) 5529} 5530 5531// UserInfo user information that made some action 5532type UserInfo struct { 5533 // Email - READ-ONLY; The email of the user. 5534 Email *string `json:"email,omitempty"` 5535 // Name - READ-ONLY; The name of the user. 5536 Name *string `json:"name,omitempty"` 5537 // ObjectID - The object id of the user. 5538 ObjectID *uuid.UUID `json:"objectId,omitempty"` 5539} 5540 5541// MarshalJSON is the custom marshaler for UserInfo. 5542func (UI UserInfo) MarshalJSON() ([]byte, error) { 5543 objectMap := make(map[string]interface{}) 5544 if UI.ObjectID != nil { 5545 objectMap["objectId"] = UI.ObjectID 5546 } 5547 return json.Marshal(objectMap) 5548} 5549