Metadatos de Microsoft.SecurityInsights

Definición de recursos de Bicep

El tipo de recurso de metadatos se puede implementar con operaciones destinadas a:

Para obtener una lista de las propiedades modificadas en cada versión de API, consulte registro de cambios.

Formato de recurso

Para crear un recurso Microsoft.SecurityInsights/metadata, agregue lo siguiente a la plantilla de Bicep.

resource symbolicname 'Microsoft.SecurityInsights/metadata@2025-09-01' = {
  scope: resourceSymbolicName or scope
  etag: 'string'
  name: 'string'
  properties: {
    author: {
      email: 'string'
      link: 'string'
      name: 'string'
    }
    categories: {
      domains: [
        'string'
      ]
      verticals: [
        'string'
      ]
    }
    contentId: 'string'
    contentSchemaVersion: 'string'
    customVersion: 'string'
    dependencies: {
      contentId: 'string'
      criteria: [
        ...
      ]
      kind: 'string'
      name: 'string'
      operator: 'string'
      version: 'string'
    }
    firstPublishDate: 'string'
    icon: 'string'
    kind: 'string'
    lastPublishDate: 'string'
    parentId: 'string'
    previewImages: [
      'string'
    ]
    previewImagesDark: [
      'string'
    ]
    providers: [
      'string'
    ]
    source: {
      kind: 'string'
      name: 'string'
      sourceId: 'string'
    }
    support: {
      email: 'string'
      link: 'string'
      name: 'string'
      tier: 'string'
    }
    threatAnalysisTactics: [
      'string'
    ]
    threatAnalysisTechniques: [
      'string'
    ]
    version: 'string'
  }
}

Valores de propiedad

Microsoft.SecurityInsights/metadata

MetadataAuthor

MetadataCategorías

MetadataDependencies

MetadataProperties

MetadataSource

Soporte de metadatos

Ejemplos de uso

Ejemplos de Bicep

Un ejemplo básico de implementación de metadatos de Sentinel.

param resourceName string = 'acctest0001'
param location string = 'westeurope'

resource alertRule 'Microsoft.SecurityInsights/alertRules@2022-10-01-preview' = {
  scope: workspace
  name: resourceName
  kind: 'NRT'
  properties: {
    description: ''
    displayName: 'Some Rule'
    enabled: true
    query: '''AzureActivity |
  where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
  where ActivityStatus == "Succeeded" |
  make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
'''
    severity: 'High'
    suppressionDuration: 'PT5H'
    suppressionEnabled: false
    tactics: []
    techniques: []
  }
  dependsOn: [
    onboardingState
  ]
}

resource metadata 'Microsoft.SecurityInsights/metadata@2022-10-01-preview' = {
  scope: workspace
  name: resourceName
  properties: {
    contentId: 'acctest0001'
    contentSchemaVersion: '2.0'
    kind: 'AnalyticsRule'
    parentId: alertRule.id
  }
}

resource onboardingState 'Microsoft.SecurityInsights/onboardingStates@2023-06-01-preview' = {
  scope: workspace
  name: 'default'
  properties: {
    customerManagedKey: false
  }
}

resource workspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
  name: resourceName
  location: location
  properties: {
    features: {
      disableLocalAuth: false
      enableLogAccessUsingOnlyResourcePermissions: true
    }
    publicNetworkAccessForIngestion: 'Enabled'
    publicNetworkAccessForQuery: 'Enabled'
    retentionInDays: 30
    sku: {
      name: 'PerGB2018'
    }
    workspaceCapping: {
      dailyQuotaGb: -1
    }
  }
}

Definición de recursos de plantilla de ARM

El tipo de recurso de metadatos se puede implementar con operaciones destinadas a:

Para obtener una lista de las propiedades modificadas en cada versión de API, consulte registro de cambios.

Formato de recurso

Para crear un recurso Microsoft.SecurityInsights/metadata, agregue el siguiente JSON a la plantilla.

{
  "type": "Microsoft.SecurityInsights/metadata",
  "apiVersion": "2025-09-01",
  "name": "string",
  "etag": "string",
  "properties": {
    "author": {
      "email": "string",
      "link": "string",
      "name": "string"
    },
    "categories": {
      "domains": [ "string" ],
      "verticals": [ "string" ]
    },
    "contentId": "string",
    "contentSchemaVersion": "string",
    "customVersion": "string",
    "dependencies": {
      "contentId": "string",
      "criteria": [
        ...
      ],
      "kind": "string",
      "name": "string",
      "operator": "string",
      "version": "string"
    },
    "firstPublishDate": "string",
    "icon": "string",
    "kind": "string",
    "lastPublishDate": "string",
    "parentId": "string",
    "previewImages": [ "string" ],
    "previewImagesDark": [ "string" ],
    "providers": [ "string" ],
    "source": {
      "kind": "string",
      "name": "string",
      "sourceId": "string"
    },
    "support": {
      "email": "string",
      "link": "string",
      "name": "string",
      "tier": "string"
    },
    "threatAnalysisTactics": [ "string" ],
    "threatAnalysisTechniques": [ "string" ],
    "version": "string"
  }
}

Valores de propiedad

Microsoft.SecurityInsights/metadata

MetadataAuthor

MetadataCategorías

MetadataDependencies

MetadataProperties

MetadataSource

Soporte de metadatos

Ejemplos de uso

Definición de recursos de Terraform (proveedor AzAPI)

El tipo de recurso de metadatos se puede implementar con operaciones destinadas a:

Para obtener una lista de las propiedades modificadas en cada versión de API, consulte registro de cambios.

Formato de recurso

Para crear un recurso Microsoft.SecurityInsights/metadata, agregue el siguiente terraform a la plantilla.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.SecurityInsights/metadata@2025-09-01"
  name = "string"
  parent_id = "string"
  body = {
    etag = "string"
    properties = {
      author = {
        email = "string"
        link = "string"
        name = "string"
      }
      categories = {
        domains = [
          "string"
        ]
        verticals = [
          "string"
        ]
      }
      contentId = "string"
      contentSchemaVersion = "string"
      customVersion = "string"
      dependencies = {
        contentId = "string"
        criteria = [
          ...
        ]
        kind = "string"
        name = "string"
        operator = "string"
        version = "string"
      }
      firstPublishDate = "string"
      icon = "string"
      kind = "string"
      lastPublishDate = "string"
      parentId = "string"
      previewImages = [
        "string"
      ]
      previewImagesDark = [
        "string"
      ]
      providers = [
        "string"
      ]
      source = {
        kind = "string"
        name = "string"
        sourceId = "string"
      }
      support = {
        email = "string"
        link = "string"
        name = "string"
        tier = "string"
      }
      threatAnalysisTactics = [
        "string"
      ]
      threatAnalysisTechniques = [
        "string"
      ]
      version = "string"
    }
  }
}

Valores de propiedad

Microsoft.SecurityInsights/metadata

MetadataAuthor

MetadataCategorías

MetadataDependencies

MetadataProperties

MetadataSource

Soporte de metadatos

Ejemplos de uso

Ejemplos de Terraform

Un ejemplo básico de implementación de metadatos de Sentinel.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "workspace" {
  type      = "Microsoft.OperationalInsights/workspaces@2022-10-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    properties = {
      features = {
        disableLocalAuth                            = false
        enableLogAccessUsingOnlyResourcePermissions = true
      }
      publicNetworkAccessForIngestion = "Enabled"
      publicNetworkAccessForQuery     = "Enabled"
      retentionInDays                 = 30
      sku = {
        name = "PerGB2018"
      }
      workspaceCapping = {
        dailyQuotaGb = -1
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "onboardingState" {
  type      = "Microsoft.SecurityInsights/onboardingStates@2023-06-01-preview"
  parent_id = azapi_resource.workspace.id
  name      = "default"
  body = {
    properties = {
      customerManagedKey = false
    }
  }
}

resource "azapi_resource" "alertRule" {
  type      = "Microsoft.SecurityInsights/alertRules@2022-10-01-preview"
  parent_id = azapi_resource.workspace.id
  name      = var.resource_name
  body = {
    kind = "NRT"
    properties = {
      description         = ""
      displayName         = "Some Rule"
      enabled             = true
      query               = "AzureActivity |\n  where OperationName == \"Create or Update Virtual Machine\" or OperationName ==\"Create Deployment\" |\n  where ActivityStatus == \"Succeeded\" |\n  make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller\n"
      severity            = "High"
      suppressionDuration = "PT5H"
      suppressionEnabled  = false
      tactics = [
      ]
      techniques = [
      ]
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
  depends_on                = [azapi_resource.onboardingState]
}

resource "azapi_resource" "metadata" {
  type      = "Microsoft.SecurityInsights/metadata@2022-10-01-preview"
  parent_id = azapi_resource.workspace.id
  name      = var.resource_name
  body = {
    properties = {
      contentId            = var.resource_name
      contentSchemaVersion = "2.0"
      kind                 = "AnalyticsRule"
      parentId             = azapi_resource.alertRule.id
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}