category: Analytics & SIEM
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: Azure Sentinel
  version: -1
configuration:
- defaultvalue: Worldwide
  display: Azure Cloud
  name: azure_cloud
  type: 15
  options:
  - Worldwide
  - US GCC
  - US GCC-High
  - DoD
  - Germany
  - China
  - Custom
  section: Connect
  advanced: true
  additionalinfo: When selecting the Custom option, the Server URL parameter must be filled. More information about National clouds can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud
  required: false
- name: limit
  type: 0
  section: Collect
  required: false
  defaultvalue: '20'
  display: Maximum number of incidents per fetch.
  additionalinfo: The maximum number of incidents to fetch each time. The maximum allowed value is 50.
- name: creds_tenant_id
  type: 9
  section: Connect
  required: false
  displaypassword: Tenant ID
  hiddenusername: true
- display: Tenant ID
  name: tenant_id
  type: 4
  section: Connect
  required: false
  hidden: true
- displaypassword: Client ID
  name: creds_client_id
  hiddenusername: true
  type: 9
  section: Connect
  required: false
  additionalinfo: The Application (Client) ID of the Azure app registration.
- displaypassword: Client Secret
  name: credentials
  type: 9
  section: Connect
  required: false
  hiddenusername: true
- additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app.
  display: Certificate Thumbprint
  name: creds_certificate
  type: 9
  section: Connect
  advanced: true
  required: false
  displaypassword: Private Key
- additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app.
  display: Certificate Thumbprint
  name: certificate_thumbprint
  type: 4
  hidden: true
  section: Connect
  advanced: true
  required: false
- additionalinfo: Used for certificate authentication. The private key of the registered certificate.
  display: Private Key
  name: private_key
  type: 14
  section: Connect
  advanced: true
  required: false
  hidden: true
- additionalinfo: Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab.
  name: use_managed_identities
  type: 8
  section: Connect
  advanced: true
  required: false
  display: Use Azure Managed Identities
- name: managed_identities_client_id
  required: false
  additionalinfo: The Managed Identities client id for authentication - relevant only if the integration is running on Azure VM.
  type: 9
  section: Connect
  displaypassword: Azure Managed Identities Client ID
  hiddenusername: true
  advanced: true
- display: Default Subscription ID
  name: subscriptionID
  required: true
  additionalinfo: The parameter can be saved as 000-000 and added as an argument to each command, but Test button will fail.
  type: 0
  section: Connect
- display: Default Resource Group Name
  name: resourceGroupName
  required: true
  type: 0
  section: Connect
  additionalinfo: The parameter can be saved as 000-000 and added as an argument to each command, but the Test button will fail.
- display: Workspace Name
  name: workspaceName
  type: 0
  section: Connect
  required: true
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- defaultvalue: 3 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetch_time
  type: 0
  section: Collect
  required: false
- display: The minimum severity of incidents to fetch
  name: min_severity
  type: 15
  section: Collect
  required: false
  defaultvalue: Informational
  options:
  - Informational
  - Low
  - Medium
  - High
  advanced: true
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Server URL
  name: server_url
  type: 0
  section: Connect
  advanced: true
  required: false
  defaultvalue: https://management.azure.com
  additionalinfo: Use this option when required to customize the URL to the Azure management endpoint. More information can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Additional info to fetch
  name: fetch_additional_info
  type: 16
  section: Collect
  options:
  - Alerts
  - Entities
  - Comments
  - Relations
  required: false
  additionalinfo: |
    Choose what additional info to fetch for each incident.
    Note that this will increase the number of API calls.
  advanced: true
- defaultvalue: 'None'
  display: Mirroring Direction
  name: mirror_direction
  type: 15
  hidden:
  - marketplacev2
  - platform
  section: Collect
  required: false
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
- additionalinfo: When selected, closing the Microsoft Sentinel ticket is mirrored in Cortex XSOAR.
  defaultvalue: 'false'
  display: Close Mirrored XSOAR Incident
  name: close_incident
  type: 8
  hidden:
  - marketplacev2
  - platform
  section: Collect
  advanced: true
  required: false
- additionalinfo: When selected, closing the Cortex XSOAR incident is mirrored in Microsoft Sentinel.
  defaultvalue: 'false'
  display: Close Mirrored Microsoft Sentinel Ticket
  name: close_ticket
  type: 8
  hidden:
  - marketplacev2
  - platform
  section: Collect
  advanced: true
  required: false
- additionalinfo: 'The statuses of the incidents that will be fetched. If no status is provided then incidents of all the statuses will be fetched.'
  display: Incident Statuses to Fetch
  name: statuses_to_fetch
  options:
  - New
  - Active
  - Closed
  type: 16
  section: Collect
  advanced: true
  required: false
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  required: false
  type: 19
  section: Collect
  advanced: true
- defaultvalue: 0
  display: Minutes to look back when fetching
  additionalinfo: The lookback time window for incidents/issues created before the last run time that did not initially match the query. Small values (for example, 1-5 minutes) are recommended to avoid performance issues.
  name: look_back
  type: 0
  advanced: true
  required: false
  section: Collect
- display: Incident Titles to Not Fetch
  additionalinfo: A comma-separated list of case-sensitive titles of the incidents that will not be fetched. This will also match if the title provided is contained in the incident's title. If no title is provided then all incidents will be fetched.
  name: titles_to_not_fetch
  type: 0
  required: false
  section: Collect
  advanced: true
- display: Alert Product Names to Not Fetch
  additionalinfo: 'A comma-separated list of alert product names of the incidents that will not be fetched. For example: "Microsoft Entra ID Protection, Microsoft Sentinel". If no alert product name is provided then incidents will be fetched normally.'
  name: alert_product_names_to_not_fetch
  type: 0
  required: false
  section: Collect
  advanced: true
description: "Microsoft Sentinel is a scalable, cloud-native solution that provides: Security information and event management (SIEM) Security orchestration, automation, and response (SOAR)."
display: Microsoft Sentinel
name: Azure Sentinel
script:
  commands:
  - arguments:
    - description: The incident ID.
      name: incident_id
      required: true
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Gets a single incident from Azure Sentinel.
    name: azure-sentinel-get-incident-by-id
    outputs:
    - contextPath: AzureSentinel.Incident.ID
      description: The incident ID.
      type: String
    - contextPath: AzureSentinel.Incident.Title
      description: The incident title.
      type: String
    - contextPath: AzureSentinel.Incident.Description
      description: Description of the incident.
      type: String
    - contextPath: AzureSentinel.Incident.Severity
      description: The incident severity.
      type: String
    - contextPath: AzureSentinel.Incident.Status
      description: The incident status.
      type: String
    - contextPath: AzureSentinel.Incident.AssigneeName
      description: The name of the incident assignee.
      type: String
    - contextPath: AzureSentinel.Incident.AssigneeEmail
      description: The email address of the incident assignee.
      type: String
    - contextPath: AzureSentinel.Incident.AssigneeObjectID
      description: The object ID of the incident assignee.
      type: string
    - contextPath: AzureSentinel.Incident.AssigneeUPN
      description: The user principal name of incident assignee.
      type: string
    - contextPath: AzureSentinel.Incident.Label.Name
      description: The name of the incident label.
      type: String
    - contextPath: AzureSentinel.Incident.Label.Type
      description: The incident label type.
      type: String
    - contextPath: AzureSentinel.Incident.FirstActivityTimeUTC
      description: The date and time of the incident's first activity.
      type: Date
    - contextPath: AzureSentinel.Incident.LastActivityTimeUTC
      description: The date and time of the incident's last activity.
      type: Date
    - contextPath: AzureSentinel.Incident.LastModifiedTimeUTC
      description: The date and time the incident was last modified.
      type: Date
    - contextPath: AzureSentinel.Incident.CreatedTimeUTC
      description: The date and time the incident was created.
      type: Date
    - contextPath: AzureSentinel.Incident.IncidentNumber
      description: The incident number.
      type: Number
    - contextPath: AzureSentinel.Incident.AlertsCount
      description: The number of the alerts in the incident.
      type: Number
    - contextPath: AzureSentinel.Incident.BookmarkCount
      description: The number of bookmarks in the incident.
      type: Number
    - contextPath: AzureSentinel.Incident.CommentCount
      description: The number of comments in the incident.
      type: Number
    - contextPath: AzureSentinel.Incident.AlertProductNames
      description: The alert product names of the incident.
      type: String
    - contextPath: AzureSentinel.Incident.Tactics
      description: The incident's tactics.
      type: String
    - contextPath: AzureSentinel.Incident.FirstActivityTimeGenerated
      description: The incident's generated first activity time.
      type: Date
    - contextPath: AzureSentinel.Incident.LastActivityTimeGenerated
      description: The incident's generated last activity time.
      type: Date
    - contextPath: AzureSentinel.Incident.Etag
      description: The Etag of the incident.
      type: String
    - contextPath: AzureSentinel.Incident.IncidentUrl
      description: The deep-link URL to the incident in the Azure portal.
      type: String
  - arguments:
    - defaultValue: '50'
      description: The maximum number of incidents to return. The maximum value is 200.
      name: limit
    - description: 'Filter results using OData syntax. For example: properties/createdTimeUtc gt 2020-02-02T14:00:00Z`). For more information, see the Azure documentation: https://docs.microsoft.com/bs-latn-ba/azure/search/search-query-odata-filter.'
      name: filter
    - description: A link that specifies a starting point to use for subsequent calls. This argument overrides all of the other command arguments.
      name: next_link
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Gets a list of incidents from Azure Sentinel.
    name: azure-sentinel-list-incidents
    outputs:
    - contextPath: AzureSentinel.Incident.ID
      description: The incident ID.
      type: String
    - contextPath: AzureSentinel.Incident.Title
      description: The incident title.
      type: String
    - contextPath: AzureSentinel.Incident.Description
      description: Description of the incident.
      type: String
    - contextPath: AzureSentinel.Incident.Severity
      description: The incident severity.
      type: String
    - contextPath: AzureSentinel.Incident.Status
      description: The incident status.
      type: String
    - contextPath: AzureSentinel.Incident.AssigneeName
      description: The name of the incident assignee.
      type: String
    - contextPath: AzureSentinel.Incident.AssigneeEmail
      description: The email address of the incident assignee.
      type: String
    - contextPath: AzureSentinel.Incident.Label.Name
      description: The name of the incident label.
      type: String
    - contextPath: AzureSentinel.Incident.Label.Type
      description: The incident label type.
      type: String
    - contextPath: AzureSentinel.Incident.FirstActivityTimeUTC
      description: The date and time of the incident's first activity.
      type: Date
    - contextPath: AzureSentinel.Incident.LastActivityTimeUTC
      description: The date and time of the incident's last activity.
      type: Date
    - contextPath: AzureSentinel.Incident.LastModifiedTimeUTC
      description: The date and time the incident was last modified.
      type: Date
    - contextPath: AzureSentinel.Incident.CreatedTimeUTC
      description: The date and time the incident was created.
      type: Date
    - contextPath: AzureSentinel.Incident.IncidentNumber
      description: The incident number.
      type: Number
    - contextPath: AzureSentinel.Incident.AlertsCount
      description: The number of the alerts in the incident.
      type: Number
    - contextPath: AzureSentinel.Incident.BookmarkCount
      description: The number of bookmarks in the incident.
      type: Number
    - contextPath: AzureSentinel.Incident.CommentCount
      description: The number of comments in the incident.
      type: Number
    - contextPath: AzureSentinel.Incident.AlertProductNames
      description: The alert product names of the incident.
      type: String
    - contextPath: AzureSentinel.Incident.Tactics
      description: The incident's tactics.
      type: String
    - contextPath: AzureSentinel.Incident.FirstActivityTimeGenerated
      description: The incident's generated first activity time.
      type: Date
    - contextPath: AzureSentinel.Incident.LastActivityTimeGenerated
      description: The incident's generated last activity time.
      type: Date
    - contextPath: AzureSentinel.NextLink.Description
      description: Description of NextLink.
      type: String
    - contextPath: AzureSentinel.NextLink.URL
      description: Used if an operation returns partial results. If a response contains a NextLink element, its value specifies a starting point to use for subsequent calls.
      type: String
    - contextPath: AzureSentinel.Incident.Etag
      description: The Etag of the incident.
      type: String
  - arguments:
    - description: Alias of the specific watchlist to get.
      name: watchlist_alias
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Gets a list of watchlists from Azure Sentinel.
    name: azure-sentinel-list-watchlists
    outputs:
    - contextPath: AzureSentinel.Watchlist.ID
      description: The watchlist ID.
      type: String
    - contextPath: AzureSentinel.Watchlist.Description
      description: A description of the watchlist.
      type: String
    - contextPath: AzureSentinel.Watchlist.DisplayName
      description: The display name of the watchlist.
      type: String
    - contextPath: AzureSentinel.Watchlist.Provider
      description: The provider of the watchlist.
      type: String
    - contextPath: AzureSentinel.Watchlist.Source
      description: The source of the watchlist.
      type: String
    - contextPath: AzureSentinel.Watchlist.Created
      description: The time the watchlist was created.
      type: Date
    - contextPath: AzureSentinel.Watchlist.Updated
      description: The last time the watchlist was updated.
      type: Date
    - contextPath: AzureSentinel.Watchlist.CreatedBy
      description: The name of the user who created the watchlist.
      type: String
    - contextPath: AzureSentinel.Watchlist.UpdatedBy
      description: The name of the user who updated the watchlist.
      type: String
    - contextPath: AzureSentinel.Watchlist.Alias
      description: The alias of the watchlist.
      type: String
    - contextPath: AzureSentinel.Watchlist.Label
      description: Label that will be used to tag and filter on.
      type: unknown
    - contextPath: AzureSentinel.Watchlist.ItemsSearchKey
      description: The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.
      type: String
    - contextPath: AzureSentinel.NextLink.Description
      description: Description of NextLink.
      type: String
    - contextPath: AzureSentinel.NextLink.URL
      description: Used if an operation returns partial results. If a response contains a NextLink element, its value specifies a starting point to use for subsequent calls.
      type: String
  - arguments:
    - description: Alias of the watchlist to be deleted.
      name: watchlist_alias
      required: true
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Delete a watchlist from Azure Sentinel.
    name: azure-sentinel-delete-watchlist
  - arguments:
    - description: The alias of the new watchlist or the watchlist to update.
      name: watchlist_alias
      required: true
    - description: The display name of the watchlist.
      name: watchlist_display_name
      required: true
    - description: The description of the watchlist.
      name: description
    - defaultValue: XSOAR
      description: The provider of the watchlist.
      name: provider
    - description: The labels of the watchlist.
      isArray: true
      name: labels
    - defaultValue: '0'
      description: The number of lines in the CSV content to skip before the header.
      name: lines_to_skip
    - description: A file entry with raw content that represents the watchlist items to create.
      name: file_entry_id
      required: true
    - description: The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.
      name: items_search_key
      required: true
    - defaultValue: Text/Csv
      description: The content type of the raw content. For now, only text/csv is valid.
      name: content_type
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Create or update a watchlist in Azure Sentinel.
    name: azure-sentinel-watchlist-create-update
    outputs:
    - contextPath: AzureSentinel.Watchlist.Name
      description: The name of the watchlist.
      type: String
    - contextPath: AzureSentinel.Watchlist.ID
      description: The ID (GUID) of the watchlist.
      type: String
    - contextPath: AzureSentinel.Watchlist.Description
      description: A description of the watchlist.
      type: String
    - contextPath: AzureSentinel.Watchlist.Provider
      description: The provider of the watchlist.
      type: String
    - contextPath: AzureSentinel.Watchlist.Source
      description: The source of the watchlist.
      type: String
    - contextPath: AzureSentinel.Watchlist.Created
      description: The time the watchlist was created.
      type: Date
    - contextPath: AzureSentinel.Watchlist.Updated
      description: The time the watchlist was updated.
      type: Date
    - contextPath: AzureSentinel.Watchlist.CreatedBy
      description: The user who created the watchlist.
      type: String
    - contextPath: AzureSentinel.Watchlist.UpdatedBy
      description: The user who updated the watchlist.
      type: String
    - contextPath: AzureSentinel.Watchlist.Alias
      description: The alias of the watchlist.
      type: String
    - contextPath: AzureSentinel.Watchlist.Label
      description: List of labels relevant to this watchlist.
      type: Unknown
    - contextPath: AzureSentinel.Watchlist.ItemsSearchKey
      description: The search key is used to optimize query performance when using watchlists for joins with other data.
      type: String
  - arguments:
    - description: The incident ID.
      name: incident_id
      required: true
    - description: The incident's title.
      name: title
    - description: Description of the incident.
      name: description
    - auto: PREDEFINED
      description: The incident severity.
      name: severity
      predefined:
      - High
      - Medium
      - Low
      - Informational
    - auto: PREDEFINED
      description: The incident status.
      name: status
      predefined:
      - New
      - Active
      - Closed
    - auto: PREDEFINED
      description: The reason the incident was closed. Required when updating the status to Closed.
      name: classification
      predefined:
      - BenignPositive
      - FalsePositive
      - TruePositive
      - Undetermined
    - description: Describes the reason the incident was closed.
      name: classification_comment
    - auto: PREDEFINED
      description: The classification reason the incident was closed with. Required when updating the status to Closed and the classification is determined.
      name: classification_reason
      predefined:
      - InaccurateData
      - IncorrectAlertLogic
      - SuspiciousActivity
      - SuspiciousButExpected
    - description: The email address of the incident assignee. It is recommended to update *user_principal_name* instead of this field. Note that the updated API field is `owner.email`.
      name: assignee_email
    - description: The user principal name of the client. Note that the updated API field is `owner.userPrincipalName`.
      name: user_principal_name
    - description: Object ID of assignee. This is the unique object ID of a user to update the assignee of the incident. Updated key is owner.objectId.
      name: assignee_objectid
    - description: Incident labels. Note that all labels will be set as labelType='User'.
      name: labels
      isArray: true
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    - auto: PREDEFINED
      description: If set to true, the assignee will be removed and the incident will remain unassigned. Overrides the other arguments related to the assignee.
      name: unassign
      predefined:
      - 'false'
      - 'true'
      type: unknown
    description: Updates a single incident in Azure Sentinel.
    name: azure-sentinel-update-incident
    outputs:
    - contextPath: AzureSentinel.Incident.ID
      description: The incident ID.
      type: String
    - contextPath: AzureSentinel.Incident.Title
      description: The incident's title.
      type: String
    - contextPath: AzureSentinel.Incident.Description
      description: Description of the incident.
      type: String
    - contextPath: AzureSentinel.Incident.Severity
      description: The incident severity.
      type: String
    - contextPath: AzureSentinel.Incident.Status
      description: The incident status.
      type: String
    - contextPath: AzureSentinel.Incident.AssigneeName
      description: The name of the incident assignee.
      type: String
    - contextPath: AzureSentinel.Incident.AssigneeEmail
      description: The email address of the incident assignee.
      type: String
    - contextPath: AzureSentinel.Incident.AssigneeObjectID
      description: The object ID of the incident assignee.
      type: string
    - contextPath: AzureSentinel.Incident.AssigneeUPN
      description: The user principal name of the incident assignee.
      type: string
    - contextPath: AzureSentinel.Incident.Label.Name
      description: The name of the incident label.
      type: String
    - contextPath: AzureSentinel.Incident.Label.Type
      description: The incident label type.
      type: String
    - contextPath: AzureSentinel.Incident.FirstActivityTimeUTC
      description: The date and time of the incident's first activity.
      type: Date
    - contextPath: AzureSentinel.Incident.LastActivityTimeUTC
      description: The date and time of the incident's last activity.
      type: Date
    - contextPath: AzureSentinel.Incident.LastModifiedTimeUTC
      description: The date and time the incident was last modified.
      type: Date
    - contextPath: AzureSentinel.Incident.CreatedTimeUTC
      description: The date and time the incident was created.
      type: Date
    - contextPath: AzureSentinel.Incident.IncidentNumber
      description: The incident number.
      type: Number
    - contextPath: AzureSentinel.Incident.AlertsCount
      description: The number of the alerts in the incident.
      type: Number
    - contextPath: AzureSentinel.Incident.BookmarkCount
      description: The number of bookmarks in the incident.
      type: Number
    - contextPath: AzureSentinel.Incident.CommentCount
      description: The number of comments in the incident.
      type: Number
    - contextPath: AzureSentinel.Incident.AlertProductNames
      description: The alert product names of the incident.
      type: String
    - contextPath: AzureSentinel.Incident.Tactics
      description: The incident's tactics.
      type: String
    - contextPath: AzureSentinel.Incident.FirstActivityTimeGenerated
      description: The incident's generated first activity time.
      type: Date
    - contextPath: AzureSentinel.Incident.LastActivityTimeGenerated
      description: The incident's generated last activity time.
      type: Date
    - contextPath: AzureSentinel.Incident.Etag
      description: The Etag of the incident.
      type: String
  - arguments:
    - description: The incident ID.
      name: incident_id
      required: true
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Deletes a single incident in Azure Sentinel.
    name: azure-sentinel-delete-incident
  - arguments:
    - description: The incident ID.
      name: incident_id
      required: true
    - defaultValue: '50'
      description: The maximum number of incident comments to return. The maximum value is 50.
      name: limit
    - description: A link that specifies a starting point to use for subsequent calls. Using this argument overrides all of the other command arguments.
      name: next_link
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Gets the comments of an incident from Azure Sentinel.
    name: azure-sentinel-list-incident-comments
    outputs:
    - contextPath: AzureSentinel.IncidentComment.ID
      description: The ID of the incident comment.
      type: String
    - contextPath: AzureSentinel.IncidentComment.IncidentID
      description: The incident ID.
      type: String
    - contextPath: AzureSentinel.IncidentComment.Message
      description: The incident comment.
      type: String
    - contextPath: AzureSentinel.IncidentComment.AuthorName
      description: The name of the author of the incident's comment.
      type: String
    - contextPath: AzureSentinel.IncidentComment.AuthorEmail
      description: The email address of the author of the incident comment.
      type: String
    - contextPath: AzureSentinel.IncidentComment.CreatedTimeUTC
      description: The date and time that the incident comment was created.
      type: Date
    - contextPath: AzureSentinel.NextLink.Description
      description: Description of NextLink.
      type: String
    - contextPath: AzureSentinel.NextLink.URL
      description: Used if an operation returns a partial result. If a response contains a NextLink element, its value specifies a starting point to use for subsequent calls.
      type: String
  - arguments:
    - description: The incident ID.
      name: incident_id
      required: true
    - description: The comment message.
      name: message
      required: true
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Adds a comment to an incident in Azure Sentinel.
    name: azure-sentinel-incident-add-comment
    outputs:
    - contextPath: AzureSentinel.IncidentComment.ID
      description: The ID of the incident comment.
      type: String
    - contextPath: AzureSentinel.IncidentComment.IncidentID
      description: The incident ID.
      type: String
    - contextPath: AzureSentinel.IncidentComment.Message
      description: The incident's comment.
      type: String
    - contextPath: AzureSentinel.IncidentComment.AuthorName
      description: The name of the author of the incident's comment.
      type: String
    - contextPath: AzureSentinel.IncidentComment.AuthorEmail
      description: The email address of the author of the incident comment.
      type: String
    - contextPath: AzureSentinel.IncidentComment.CreatedTimeUTC
      description: The date and time that the incident comment was created.
      type: Date
  - arguments:
    - description: The incident ID.
      name: incident_id
      required: true
    - description: The comment ID.
      name: comment_id
      required: true
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Deletes a comment from incident in Azure Sentinel.
    name: azure-sentinel-incident-delete-comment
  - arguments:
    - description: The incident ID.
      name: incident_id
      required: true
    - defaultValue: '50'
      description: The maximum number of related entities to return.
      name: limit
    - description: A link that specifies a starting point to use for subsequent calls. Using this argument overrides all of the other command arguments.
      name: next_link
    - description: |-
        A comma-separated list of entity kinds to filter by. By default, the results won't be filtered by kind.
        The optional kinds are: Account, Host, File, AzureResource, CloudApplication, DnsResolution, FileHash, Ip, Malware, Process, RegistryKey, RegistryValue, SecurityGroup, Url, IoTDevice, SecurityAlert, Bookmark.
      isArray: true
      name: entity_kinds
      predefined:
      - ''
    - description: 'Filter results using OData syntax. For example: properties/createdTimeUtc gt 2020-02-02T14:00:00Z`). For more information see the Azure documentation: https://docs.microsoft.com/bs-latn-ba/azure/search/search-query-odata-filter.'
      name: filter
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Gets a list of an incident's related entities from Azure Sentinel.
    name: azure-sentinel-list-incident-relations
    outputs:
    - contextPath: AzureSentinel.IncidentRelatedResource.ID
      description: The ID of the incident's related resource.
      type: String
    - contextPath: AzureSentinel.IncidentRelatedResource.Kind
      description: The kind of the incident's related resource.
      type: String
    - contextPath: AzureSentinel.NextLink.Description
      description: The description about NextLink.
      type: String
    - contextPath: AzureSentinel.NextLink.URL
      description: Used if an operation returns a partial result. If a response contains a NextLink element, its value specifies a starting point to use for subsequent calls.
      type: String
    - contextPath: AzureSentinel.IncidentRelatedResource.IncidentID
      description: The incident ID.
      type: String
  - arguments:
    - description: The incident ID.
      name: incident_id
      required: true
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Gets a list of an incident's entities from Azure Sentinel.
    name: azure-sentinel-list-incident-entities
    outputs:
    - contextPath: AzureSentinel.IncidentEntity.ID
      description: The ID of the entity.
      type: String
    - contextPath: AzureSentinel.IncidentEntity.IncidentId
      description: The ID of the incident.
      type: String
    - contextPath: AzureSentinel.IncidentEntity.Kind
      description: The kind of the entity.
      type: String
    - contextPath: AzureSentinel.IncidentEntity.Properties
      description: The properties of the entity.
      type: Unknown
  - arguments:
    - description: The incident ID.
      name: incident_id
      required: true
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Gets a list of an incident's alerts from Azure Sentinel.
    name: azure-sentinel-list-incident-alerts
    outputs:
    - contextPath: AzureSentinel.IncidentAlert.ID
      description: The ID of the alert.
      type: String
    - contextPath: AzureSentinel.IncidentAlert.IncidentId
      description: The ID of the incident.
      type: String
    - contextPath: AzureSentinel.IncidentAlert.Kind
      description: The kind of the alert.
      type: String
    - contextPath: AzureSentinel.IncidentAlert.Tactic
      description: The tactics of the alert.
      type: Unknown
    - contextPath: AzureSentinel.IncidentAlert.Techniques
      description: The techniques of the alert.
      type: Unknown
    - contextPath: AzureSentinel.IncidentAlert.DisplayName
      description: The display name of the alert.
      type: String
    - contextPath: AzureSentinel.IncidentAlert.Description
      description: The description of the alert.
      type: String
    - contextPath: AzureSentinel.IncidentAlert.ConfidenceLevel
      description: The confidence level of this alert.
      type: String
    - contextPath: AzureSentinel.IncidentAlert.Severity
      description: The severity of the alert.
      type: String
    - contextPath: AzureSentinel.IncidentAlert.VendorName
      description: The name of the vendor that raised the alert.
      type: String
    - contextPath: AzureSentinel.IncidentAlert.ProductName
      description: The name of the product that published this alert.
      type: String
    - contextPath: AzureSentinel.IncidentAlert.ProductComponentName
      description: The name of a component inside the product which generated the alert.
      type: String
  - arguments:
    - description: The alias of the watchlist.
      name: watchlist_alias
      required: true
    - description: The ID of the single watchlist item.
      name: watchlist_item_id
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Get a single watchlist item or list of watchlist items.
    name: azure-sentinel-list-watchlist-items
    outputs:
    - contextPath: AzureSentinel.WatchlistItem.WatchlistAlias
      description: The alias of the watchlist.
      type: String
    - contextPath: AzureSentinel.WatchlistItem.ID
      description: The ID (GUID) of the watchlist item.
      type: String
    - contextPath: AzureSentinel.WatchlistItem.Created
      description: The time the watchlist item was created.
      type: Date
    - contextPath: AzureSentinel.WatchlistItem.Updated
      description: The last time the watchlist item was updated.
      type: Date
    - contextPath: AzureSentinel.WatchlistItem.CreatedBy
      description: The name of the user.
      type: String
    - contextPath: AzureSentinel.WatchlistItem.UpdatedBy
      description: The user who updated this item.
      type: String
    - contextPath: AzureSentinel.WatchlistItem.ItemsKeyValue
      description: Key-value pairs for a watchlist item.
      type: Unknown
  - arguments:
    - description: The watchlist alias.
      name: watchlist_alias
      required: true
    - description: The watchlist item ID to be deleted.
      name: watchlist_item_id
      required: true
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Delete a watchlist item.
    name: azure-sentinel-delete-watchlist-item
  - arguments:
    - description: The watchlist alias.
      name: watchlist_alias
      required: true
    - description: The watchlist item ID (GUID) to update.
      name: watchlist_item_id
    - description: The JSON for the itemsKeyValue of the item (the key value is different from watchlist to watchlist).
      name: item_key_value
      required: true
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Create or update a watchlist item.
    name: azure-sentinel-create-update-watchlist-item
    outputs:
    - contextPath: AzureSentinel.WatchlistItem.WatchlistAlias
      description: The alias of the watchlist.
      type: String
    - contextPath: AzureSentinel.WatchlistItem.ID
      description: The ID (GUID) of the watchlist item.
      type: String
    - contextPath: AzureSentinel.WatchlistItem.Created
      description: The time the watchlist item was created.
      type: Date
    - contextPath: AzureSentinel.WatchlistItem.Updated
      description: The last time the watchlist item was updated.
      type: Date
    - contextPath: AzureSentinel.WatchlistItem.CreatedBy
      description: The name of the user who created this watchlist item.
      type: String
    - contextPath: AzureSentinel.WatchlistItem.UpdatedBy
      description: The user who updated this watchlist item.
      type: String
    - contextPath: AzureSentinel.WatchlistItem.ItemsKeyValue
      description: Key-value pairs for a watchlist item.
      type: Unknown
  - arguments:
    - description: The name of the indicator.
      name: indicator_name
    - defaultValue: '50'
      description: The maximum number of indicators to return.
      name: limit
    - description: |-
        A link that specifies a starting point to use for subsequent calls.
        This argument overrides all of the other command arguments.
        There may be no support for pagination.
      name: next_link
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Returns a list of threat indicators.
    name: azure-sentinel-threat-indicator-list
    outputs:
    - contextPath: AzureSentinel.ThreatIndicator.ID
      description: The ID of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Name
      description: The name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ETag
      description: The ETag of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Type
      description: The type of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Kind
      description: The kind of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicators.Confidence
      description: The confidence of the threat indicator. This is a number between 0-100.
      type: Number
    - contextPath: AzureSentinel.ThreatIndicator.Created
      description: When the threat indicator was created.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.CreatedByRef
      description: The creator of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ExternalID
      description: The external ID of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Revoked
      description: Whether the threat indicator was revoked.
      type: Boolean
    - contextPath: AzureSentinel.ThreatIndicator.Source
      description: The source of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ETags
      description: The Etags of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.DisplayName
      description: The display name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Description
      description: The description of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ThreatTypes
      description: The threat types of the indicator.
      type: Unknown
    - contextPath: AzureSentinel.ThreatIndicator.KillChainPhases.KillChainName
      description: The kill chain's name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ParsedPattern.PatternTypeKey
      description: The pattern type key of the indicator.
      type: Unknown
    - contextPath: AzureSentinel.ThreatIndicator.Pattern
      description: The pattern of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.PatternType
      description: The pattern type of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ValidFrom
      description: The date from which the indicator is valid.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.ValidUntil
      description: The date until which the indicator is valid.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.KillChainPhases.PhaseName
      description: The phase name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ParsedPattern.PatternTypeValues.Value
      description: The value of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ParsedPattern.PatternTypeValues.ValueType
      description: The value type of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.LastUpdatedTimeUtc
      description: The last updated time of the indicator.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.Tags
      description: The tags of the indicator.
      type: Unknown
    - contextPath: AzureSentinel.ThreatIndicator.Types
      description: The threat types of the indicator.
      type: Unknown
  - arguments:
    - defaultValue: '50'
      description: The maximum number of indicators to return.
      name: limit
    - description: |-
        A link that specifies a starting point to use for subsequent calls.
        This argument overrides all of the other command arguments.
        There may be no support for pagination.
      name: next_link
    - description: The minimum confidence number for a threat indicator.
      name: min_confidence
    - description: The maximum confidence number for a threat indicator.
      name: max_confidence
    - description: Minimum valid until value of indicators to query.
      name: min_valid_until
    - description: Maximum valid until value of indicators to query.
      name: max_valid_until
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, the query also returns disabled indicators.
      name: include_disabled
      predefined:
      - 'true'
      - 'false'
    - description: The sources of the threat indicator.
      isArray: true
      name: sources
    - auto: PREDEFINED
      description: The indicator types of the threat indicator.
      isArray: true
      name: indicator_types
      predefined:
      - ipv4
      - ipv6
      - file
      - url
      - domain
    - auto: PREDEFINED
      description: A comma-separated list of threat types of the threat indicator.
      isArray: true
      name: threat_types
      predefined:
      - anomalous-activity
      - attribution
      - anonymization
      - benign
      - malicious-activity
      - compromised
      - unknown
    - description: A comma-separated list of keywords.
      isArray: true
      name: keywords
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Returns a list of threat indicators with specific entities.
    name: azure-sentinel-threat-indicator-query
    outputs:
    - contextPath: AzureSentinel.ThreatIndicator.ID
      description: The ID of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Name
      description: The name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ETag
      description: The ETag of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Type
      description: The type of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Kind
      description: The kind of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicators.Confidence
      description: The confidence of the threat indicator. This is a number between 0-100.
      type: Number
    - contextPath: AzureSentinel.ThreatIndicator.Created
      description: When the threat indicator was created.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.CreatedByRef
      description: The creator of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ExternalID
      description: The external ID of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Revoked
      description: Whether the threat indicator was revoked.
      type: Boolean
    - contextPath: AzureSentinel.ThreatIndicator.Source
      description: The source of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ETags
      description: The Etags of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.DisplayName
      description: The display name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Description
      description: The description of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ThreatTypes
      description: The threat types of the indicator.
      type: Unknown
    - contextPath: AzureSentinel.ThreatIndicator.KillChainPhases.KillChainName
      description: The kill chain's name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ParsedPattern.PatternTypeKey
      description: The pattern type key of the indicator.
      type: Unknown
    - contextPath: AzureSentinel.ThreatIndicator.Pattern
      description: The pattern of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.PatternType
      description: The pattern type of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ValidFrom
      description: The date from which the indicator is valid.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.ValidUntil
      description: The date until which the indicator is valid.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.KillChainPhases.PhaseName
      description: The phase name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ParsedPattern.PatternTypeValues.Value
      description: The value of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ParsedPattern.PatternTypeValues.ValueType
      description: The value type of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.LastUpdatedTimeUtc
      description: The last updated time of the indicator.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.Tags
      description: The tags of the indicator.
      type: Unknown
    - contextPath: AzureSentinel.ThreatIndicator.Types
      description: The threat types of the indicator.
      type: Unknown
  - arguments:
    - description: The value of the threat indicator.
      name: value
      required: true
    - description: The display name of the new indicator.
      name: display_name
      required: true
    - description: The description of the new indicator.
      name: description
    - auto: PREDEFINED
      description: The type of the new indicator.
      name: indicator_type
      predefined:
      - ipv4
      - ipv6
      - file
      - url
      - domain
      required: true
    - auto: PREDEFINED
      description: The hash type of the new indicator. This argument is mandatory if the indicator type is file.
      name: hash_type
      predefined:
      - MD5
      - SHA-1
      - SHA-256
      - SHA-512
    - description: The confidence of the new threat indicator. Should be a number between 0-100.
      name: confidence
    - auto: PREDEFINED
      description: A comma-separated list of threat types of the threat indicator.
      isArray: true
      name: threat_types
      predefined:
      - anomalous-activity
      - attribution
      - anonymization
      - benign
      - malicious-activity
      - compromised
      - unknown
      required: true
    - description: The kill chains phases of the indicator.
      isArray: true
      name: kill_chains
    - description: A comma-separated list of tags of the new threat indicator.
      isArray: true
      name: tags
    - description: The date from which the indicator is valid.
      name: valid_from
    - description: The date until which the indicator is valid.
      name: valid_until
    - description: The creator of the new indicator.
      name: created_by
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, the indicator is revoked.
      name: revoked
      predefined:
      - 'true'
      - 'false'
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Creates a new threat indicator.
    name: azure-sentinel-threat-indicator-create
    outputs:
    - contextPath: AzureSentinel.ThreatIndicator.ID
      description: The ID of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Name
      description: The name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ETag
      description: The ETag of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Type
      description: The type of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Kind
      description: The kind of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicators.Confidence
      description: The confidence of the threat indicator. This is a number between 0-100.
      type: Number
    - contextPath: AzureSentinel.ThreatIndicator.Created
      description: When the threat indicator was created.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.CreatedByRef
      description: The creator of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ExternalID
      description: The external ID of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Revoked
      description: Whether the threat indicator was revoked.
      type: Boolean
    - contextPath: AzureSentinel.ThreatIndicator.Source
      description: The source of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ETags
      description: The Etags of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.DisplayName
      description: The display name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Description
      description: The description of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ThreatTypes
      description: The threat types of the indicator.
      type: Unknown
    - contextPath: AzureSentinel.ThreatIndicator.KillChainPhases.KillChainName
      description: The kill chain's name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ParsedPattern.PatternTypeKey
      description: The pattern type key of the indicator.
      type: Unknown
    - contextPath: AzureSentinel.ThreatIndicator.Pattern
      description: The pattern of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.PatternType
      description: The pattern type of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ValidFrom
      description: The date from which the indicator is valid.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.ValidUntil
      description: The date until which the indicator is valid.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.KillChainPhases.PhaseName
      description: The phase name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ParsedPattern.PatternTypeValues.Value
      description: The value of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ParsedPattern.PatternTypeValues.ValueType
      description: The value type of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.LastUpdatedTimeUtc
      description: The last updated time of the indicator.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.Tags
      description: The tags of the indicator.
      type: Unknown
    - contextPath: AzureSentinel.ThreatIndicator.Types
      description: The threat types of the indicator.
      type: Unknown
  - arguments:
    - description: The name of the indicator.
      name: indicator_name
      required: true
    - description: The value of the indicator.
      name: value
      required: true
    - description: Deprecated. This argument is no longer supported by the Microsoft API and will be ignored. The display name of the indicator.
      name: display_name
      hidden: true
      deprecated: true
    - description: The description of the threat indicator.
      name: description
    - auto: PREDEFINED
      description: The type of the indicator.
      name: indicator_type
      predefined:
      - ipv4
      - ipv6
      - file
      - url
      - domain
      required: true
    - description: If indicator_type is a file, this entry is mandatory.
      name: hash_type
    - description: Whether the indicator is revoked.
      name: revoked
    - description: The confidence of the threat indicator. This is a number between 0-100.
      name: confidence
    - auto: PREDEFINED
      description: A comma-separated list of threat types of the threat indicator.
      isArray: true
      name: threat_types
      predefined:
      - anomalous-activity
      - attribution
      - anonymization
      - benign
      - malicious-activity
      - compromised
      - unknown
    - description: A comma-separated list of  kill chains phases of the indicator.
      isArray: true
      name: kill_chains
    - description: A comma-separated list of tags of the threat indicator.
      isArray: true
      name: tags
    - description: The date from which the indicator is valid.
      name: valid_from
    - description: The date until which the indicator is valid.
      name: valid_until
    - description: The creator of the indicator.
      name: created_by
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Updates an existing threat indicator.
    name: azure-sentinel-threat-indicator-update
    outputs:
    - contextPath: AzureSentinel.ThreatIndicator.ID
      description: The ID of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Name
      description: The name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ETag
      description: The ETag of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Type
      description: The type of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Kind
      description: The kind of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicators.Confidence
      description: The confidence of the threat indicator. This is a number between 0-100.
      type: Number
    - contextPath: AzureSentinel.ThreatIndicator.Created
      description: When the threat indicator was created.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.CreatedByRef
      description: The creator of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ExternalID
      description: The external ID of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Revoked
      description: Was the threat indicator revoked or not.
      type: Boolean
    - contextPath: AzureSentinel.ThreatIndicator.Source
      description: The source of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ETags
      description: The Etags of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.DisplayName
      description: The display name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Description
      description: The description of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ThreatTypes
      description: The threat types of the indicator.
      type: Unknown
    - contextPath: AzureSentinel.ThreatIndicator.KillChainPhases.KillChainName
      description: The kill chain's name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ParsedPattern.PatternTypeKey
      description: The pattern type key of the indicator.
      type: Unknown
    - contextPath: AzureSentinel.ThreatIndicator.Pattern
      description: The pattern of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.PatternType
      description: The pattern type of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ValidFrom
      description: The date from which the indicator is valid.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.ValidUntil
      description: The date until which the indicator is valid.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.KillChainPhases.PhaseName
      description: The phase name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ParsedPattern.PatternTypeValues.Value
      description: The value of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ParsedPattern.PatternTypeValues.ValueType
      description: The value type of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.LastUpdatedTimeUtc
      description: The last updated time of the indicator.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.Tags
      description: The tags of the indicator.
      type: Unknown
    - contextPath: AzureSentinel.ThreatIndicator.Types
      description: The threat types of the indicator.
      type: Unknown
  - arguments:
    - description: A comma-separated list of indicators to delete.
      isArray: true
      name: indicator_names
      required: true
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Deletes an existing threat indicator.
    name: azure-sentinel-threat-indicator-delete
  - arguments:
    - description: The name of the indicator.
      name: indicator_name
      required: true
    - description: A comma-separated list of tags to append.
      isArray: true
      name: tags
      required: true
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Appends new tags to an existing indicator.
    name: azure-sentinel-threat-indicator-tags-append
    outputs:
    - contextPath: AzureSentinel.ThreatIndicator.ID
      description: The ID of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Name
      description: The name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ETag
      description: The ETag of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Type
      description: The type of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Kind
      description: The kind of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicators.Confidence
      description: The confidence of the threat indicator. This is a number between 0-100.
      type: Number
    - contextPath: AzureSentinel.ThreatIndicator.Created
      description: When the threat indicator was created.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.CreatedByRef
      description: The creator of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ExternalID
      description: The external ID of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Revoked
      description: Was the threat indicator revoked or not.
      type: Boolean
    - contextPath: AzureSentinel.ThreatIndicator.Source
      description: The source of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ETags
      description: The Etags of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.DisplayName
      description: The display name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Description
      description: The description of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ThreatTypes
      description: The threat types of the indicator.
      type: Unknown
    - contextPath: AzureSentinel.ThreatIndicator.KillChainPhases.KillChainName
      description: The kill chain's name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ParsedPattern.PatternTypeKey
      description: The pattern type key of the indicator.
      type: Unknown
    - contextPath: AzureSentinel.ThreatIndicator.Pattern
      description: The pattern of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.PatternType
      description: The pattern type of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ValidFrom
      description: The date from which the indicator is valid.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.ValidUntil
      description: The date until which the indicator is valid.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.KillChainPhases.PhaseName
      description: The phase name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ParsedPattern.PatternTypeValues.Value
      description: The value of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ParsedPattern.PatternTypeValues.ValueType
      description: The value type of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.LastUpdatedTimeUtc
      description: The last updated time of the indicator.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.Tags
      description: The tags of the indicator.
      type: Unknown
    - contextPath: AzureSentinel.ThreatIndicator.Types
      description: The threat types of the indicator.
      type: Unknown
  - arguments:
    - description: The name of the indicator.
      name: indicator_name
      required: true
    - description: A comma-separated list of tags to replace.
      isArray: true
      name: tags
      required: true
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Replaces the tags of a given indicator.
    name: azure-sentinel-threat-indicator-tags-replace
    outputs:
    - contextPath: AzureSentinel.ThreatIndicator.ID
      description: The ID of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Name
      description: The name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ETag
      description: The ETag of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Type
      description: The type of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Kind
      description: The kind of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicators.Confidence
      description: The confidence of the threat indicator. This is a number between 0-100.
      type: Number
    - contextPath: AzureSentinel.ThreatIndicator.Created
      description: When the threat indicator was created.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.CreatedByRef
      description: The creator of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ExternalID
      description: The external ID of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Revoked
      description: Whether the threat indicator was revoked.
      type: Boolean
    - contextPath: AzureSentinel.ThreatIndicator.Source
      description: The source of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ETags
      description: The Etags of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.DisplayName
      description: The display name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.Description
      description: The description of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ThreatTypes
      description: The threat types of the indicator.
      type: Unknown
    - contextPath: AzureSentinel.ThreatIndicator.KillChainPhases.KillChainName
      description: The kill chain's name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ParsedPattern.PatternTypeKey
      description: The pattern type key of the indicator.
      type: Unknown
    - contextPath: AzureSentinel.ThreatIndicator.Pattern
      description: The pattern of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.PatternType
      description: The pattern type of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ValidFrom
      description: The date from which the indicator is valid.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.ValidUntil
      description: The date until which the indicator is valid.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.KillChainPhases.PhaseName
      description: The phase name of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ParsedPattern.PatternTypeValues.Value
      description: The value of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.ParsedPattern.PatternTypeValues.ValueType
      description: The value type of the indicator.
      type: String
    - contextPath: AzureSentinel.ThreatIndicator.LastUpdatedTimeUtc
      description: The last updated time of the indicator.
      type: Date
    - contextPath: AzureSentinel.ThreatIndicator.Tags
      description: The tags of the indicator.
      type: Unknown
    - contextPath: AzureSentinel.ThreatIndicator.Types
      description: The threat types of the indicator.
      type: Unknown
  - arguments:
    - description: Date string representing the local time. The incident is only returned if it was modified after the last update time.
      name: lastUpdate
      required: true
    description: Gets the list of incidents and detections that were modified since the last update time. This method is used for debugging purposes.
    name: get-modified-remote-data
  - arguments:
    - description: The remote incident ID.
      name: id
      required: true
    - defaultValue: '0'
      description: The UTC timestamp in seconds of the last update. The incident is only updated if it was modified after the last update time.
      name: lastUpdate
    description: Gets data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.
    name: get-remote-data
  - description: Returns the list of fields to map in outgoing mirroring. This command is only used for debugging purposes.
    name: get-mapping-fields
  - description: Updates the remote incident with local incident changes. This method is only used for debugging purposes and will not update the current incident.
    name: update-remote-system
  - arguments:
    - description: The rule ID. If not given, will return all rules.
      name: rule_id
    - defaultValue: '50'
      description: The maximum number of rules to return.
      name: limit
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Gets a list of all alert rules.
    name: azure-sentinel-list-alert-rule
    outputs:
    - contextPath: AzureSentinel.AlertRule.id
      description: Fully qualified resource ID for the resource.
      type: String
    - contextPath: AzureSentinel.AlertRule.name
      description: The name of the resource.
      type: String
    - contextPath: AzureSentinel.AlertRule.type
      description: The type of the resource.
      type: String
    - contextPath: AzureSentinel.AlertRule.kind
      description: The alert rule kind.
      type: String
    - contextPath: AzureSentinel.AlertRule.etag
      description: ETag of the Azure resource.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.alertRuleTemplateName
      description: The name of the alert rule template used to create this rule.
      type: Unknown
    - contextPath: AzureSentinel.AlertRule.properties.displayName
      description: The display name for alerts created by this alert rule.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.description
      description: The description of the alert rule.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.severity
      description: The severity for alerts created by this alert rule.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.enabled
      description: Determines whether this alert rule is enabled or disabled.
      type: Boolean
    - contextPath: AzureSentinel.AlertRule.properties.tactics
      description: The tactics of the alert rule.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.query
      description: The query that creates alerts for this rule.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.queryFrequency
      description: The frequency (in ISO 8601 duration format) for this alert rule to run.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.queryPeriod
      description: The period (in ISO 8601 duration format) that this alert rule looks at.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.triggerOperator
      description: The operation against the threshold that triggers the alert rule.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.triggerThreshold
      description: The threshold that triggers this alert rule.
      type: Number
    - contextPath: AzureSentinel.AlertRule.properties.suppressionDuration
      description: The suppression (in ISO 8601 duration format) to wait since the last time this alert rule was triggered.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.suppressionEnabled
      description: Determines whether the suppression for this alert rule is enabled or disabled.
      type: Boolean
    - contextPath: AzureSentinel.AlertRule.properties.lastModifiedUtc
      description: The last time this alert rule was modified.
      type: Date
    - contextPath: AzureSentinel.AlertRule.properties.eventGroupingSettings.aggregationKind
      description: The event grouping aggregation kinds.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.entityMappings.entityType
      description: The V3 type of the mapped entity.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.entityMappings.fieldMappings.identifier
      description: The V3 identifier of the entity.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.entityMappings.fieldMappings.columnName
      description: The column name to be mapped to the identifier.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.alertDetailsOverride.alertDisplayNameFormat
      description: The format containing the columns' name(s) used to override the alert name.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.alertDetailsOverride.alertDescriptionFormat
      description: The format containing columns' name(s) used to override the alert description.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.alertDetailsOverride.alertTacticsColumnName
      description: The column name to take the alert tactics from.
      type: Unknown
    - contextPath: AzureSentinel.AlertRule.properties.alertDetailsOverride.alertSeverityColumnName
      description: The column name to take the alert severity from.
      type: Unknown
    - contextPath: AzureSentinel.AlertRule.properties.incidentConfiguration.createIncident
      description: Create incidents from alerts triggered by this analytics rule.
      type: Boolean
    - contextPath: AzureSentinel.AlertRule.properties.incidentConfiguration.groupingConfiguration.enabled
      description: Whether grouping is enabled.
      type: Boolean
    - contextPath: AzureSentinel.AlertRule.properties.incidentConfiguration.groupingConfiguration.reopenClosedIncident
      description: Re-open closed matching incidents.
      type: Boolean
    - contextPath: AzureSentinel.AlertRule.properties.incidentConfiguration.groupingConfiguration.lookbackDuration
      description: Limit the group to alerts created within the lookback duration (in ISO 8601 duration format).
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.incidentConfiguration.groupingConfiguration.matchingMethod
      description: Grouping matching method. When method is Selected at least one of groupByEntities, groupByAlertDetails, groupByCustomDetails must be provided and not empty.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.incidentConfiguration.groupingConfiguration.groupByEntities
      description: A list of entity types to group by (when matchingMethod is Selected). Only entities defined in the current alert rule may be used.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.incidentConfiguration.groupingConfiguration.groupByAlertDetails
      description: A list of alert details to group by (when matchingMethod is Selected).
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.incidentConfiguration.groupingConfiguration.groupByCustomDetails
      description: A list of custom details keys to group by (when matchingMethod is Selected). Only keys defined in the current alert rule may be used.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.productFilter
      description: The alerts' productName on which the cases will be generated.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.severitiesFilter
      description: The alerts' severities on which the cases will be generated.
      type: Unknown
    - contextPath: AzureSentinel.AlertRule.properties.displayNamesFilter
      description: The alerts' displayNames on which the cases will be generated.
      type: Unknown
  - arguments:
    - description: The alert rule template ID. If not given, will return all alert rule templates.
      name: template_id
    - defaultValue: '50'
      description: The maximum number of templates to return.
      name: limit
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Gets a list of all alert rule templates.
    name: azure-sentinel-list-alert-rule-template
    outputs:
    - contextPath: AzureSentinel.AlertRuleTemplate.id
      description: Fully qualified resource ID for the resource.
      type: String
    - contextPath: AzureSentinel.AlertRuleTemplate.name
      description: The name of the resource.
      type: String
    - contextPath: AzureSentinel.AlertRuleTemplate.type
      description: The type of the resource.
      type: String
    - contextPath: AzureSentinel.AlertRuleTemplate.kind
      description: The alert rule kind.
      type: String
    - contextPath: AzureSentinel.AlertRuleTemplate.properties.severity
      description: The severity for alerts created by this alert rule.
      type: String
    - contextPath: AzureSentinel.AlertRuleTemplate.properties.query
      description: The query that creates alerts for this rule.
      type: String
    - contextPath: AzureSentinel.AlertRuleTemplate.properties.queryFrequency
      description: The frequency (in ISO 8601 duration format) for this alert rule to run.
      type: String
    - contextPath: AzureSentinel.AlertRuleTemplate.properties.queryPeriod
      description: The period (in ISO 8601 duration format) that this alert rule looks at.
      type: String
    - contextPath: AzureSentinel.AlertRuleTemplate.properties.triggerOperator
      description: The operation against the threshold that triggers alert rule.
      type: String
    - contextPath: AzureSentinel.AlertRuleTemplate.properties.triggerThreshold
      description: The threshold that triggers this alert rule.
      type: Number
    - contextPath: AzureSentinel.AlertRuleTemplate.properties.displayName
      description: The display name for the alert rule template.
      type: String
    - contextPath: AzureSentinel.AlertRuleTemplate.properties.description
      description: The description of the alert rule template.
      type: String
    - contextPath: AzureSentinel.AlertRuleTemplate.properties.tactics
      description: The tactics of the alert rule template.
      type: String
    - contextPath: AzureSentinel.AlertRuleTemplate.properties.lastUpdatedDateUTC
      description: The time this alert rule template was last updated.
      type: Date
    - contextPath: AzureSentinel.AlertRuleTemplate.properties.createdDateUTC
      description: The time this alert rule template was added.
      type: Date
    - contextPath: AzureSentinel.AlertRuleTemplate.properties.status
      description: The alert rule template status.
      type: String
    - contextPath: AzureSentinel.AlertRuleTemplate.properties.version
      description: The version of this template in the format <a.b.c>, where all are numbers. For example <1.0.2>.
      type: String
    - contextPath: AzureSentinel.AlertRuleTemplate.properties.requiredDataConnectors.connectorId
      description: The connector ID that provides the following data types.
      type: String
    - contextPath: AzureSentinel.AlertRuleTemplate.properties.requiredDataConnectors.dataTypes
      description: The data types used by the alert rule template.
      type: String
    - contextPath: AzureSentinel.AlertRuleTemplate.properties.alertRulesCreatedByTemplateCount
      description: The number of alert rules that were created by this template.
      type: Number
    - contextPath: AzureSentinel.AlertRuleTemplate.properties.productFilter
      description: The alerts' productName on which the cases will be generated.
      type: String
  - arguments:
    - description: The alert rule ID to delete.
      name: rule_id
      required: true
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Deletes the specified alert rule.
    name: azure-sentinel-delete-alert-rule
    outputs:
    - contextPath: AzureSentinel.AlertRule.ID
      description: The alert rule ID.
      type: String
    - contextPath: AzureSentinel.AlertRule.Deleted
      description: Whether the alert rule was deleted.
      type: Boolean
  - arguments:
    - description: The alert rule name to create.
      name: rule_name
      required: true
    - auto: PREDEFINED
      description: |
        The alert rule kind to create.
        Required for all types.
      name: kind
      predefined:
      - fusion
      - microsoft_security_incident_creation
      - scheduled
    - description: |
        The name of the alert rule template used to create this rule.
        Required for Fusion, optional for Scheduled rules.
      name: template_name
    - auto: PREDEFINED
      description: |
        Determines whether this alert rule is enabled or disabled.
        Required for all types.
      name: enabled
      predefined:
      - yes
      - no
    - description: ETag of the Azure resource.
      name: etag
    - description: |
        The display name for alerts created by this alert rule.
        Required for MicrosoftSecurityIncidentCreation and scheduled rules.
      name: displayName
    - auto: PREDEFINED
      description: |
        The alerts' productName on which the cases will be generated.
        Required for MicrosoftSecurityIncidentCreation rules.
      name: product_filter
      predefined:
      - azure_active_directory_identity_protection
      - azure_advanced_threat_protection
      - azure_security_center
      - azure_security_center_for_iot
      - microsoft_cloud_app_security
    - description: |
        The description of the alert rule.
        Relevant for MicrosoftSecurityIncidentCreation and scheduled rules.
      name: description
    - description: |
        Alerts' displayNames on which the cases will not be generated.
        Relevant for MicrosoftSecurityIncidentCreation rules.
      isArray: true
      name: name_exclude_filter
    - description: |
        Alerts' displayNames on which the cases will be generated.
        Relevant for MicrosoftSecurityIncidentCreation rules.
      isArray: true
      name: name_include_filter
    - description: |
        Alerts' severities on which the cases will be generated.
        Relevant for MicrosoftSecurityIncidentCreation rules.
      isArray: true
      name: severity_filter
    - description: |
        The query that creates alerts for this rule.
        Required for scheduled rules.
      name: query
    - description: |
        The frequency (in ISO 8601 duration format: PnYnMnDTnHnMnS or PnW) for this alert rule to run.
        Required for scheduled rules.
      name: query_frequency
    - description: |
        The period (in ISO 8601 duration format: PnYnMnDTnHnMnS or PnW) that this alert rule looks at.
        Required for scheduled rules.
      name: query_period
    - auto: PREDEFINED
      description: |
        The severity for alerts created by this alert rule.
        Required for scheduled rules.
      name: severity
      predefined:
      - informational
      - low
      - medium
      - high
    - description: |
        The suppression (in ISO 8601 duration format: PnYnMnDTnHnMnS or PnW) to wait since the last time this alert rule was triggered.
        Required for scheduled rules.
      name: suppression_duration
    - auto: PREDEFINED
      description: |
        Determines whether the suppression for this alert rule is enabled or disabled.
        Required for scheduled rules.
      name: suppression_enabled
      predefined:
      - yes
      - no
    - auto: PREDEFINED
      description: |
        The operation against the threshold that triggers the alert rule.
        Required for scheduled rules.
      name: trigger_operator
      predefined:
      - equal
      - greater_than
      - less_than
      - not_equal
    - description: |
        The threshold that triggers this alert rule.
        Required for scheduled rules.
      name: trigger_threshold
    - description: |
        The tactics of the alert rule.
        Relevant for scheduled rules.
      isArray: true
      name: tactics
    - description: |
        The techniques of the alert rule.
        Relevant for scheduled rules.
      isArray: true
      name: techniques
    - description: |
        Option to insert a configured rule JSON instead of using the arguments.
      name: rule_json
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Creates a new alert rule.
    name: azure-sentinel-create-alert-rule
    outputs:
    - contextPath: AzureSentinel.AlertRule.id
      description: Fully qualified resource ID for the resource.
      type: String
    - contextPath: AzureSentinel.AlertRule.name
      description: The name of the resource.
      type: String
    - contextPath: AzureSentinel.AlertRule.etag
      description: ETag of the Azure resource.
      type: String
    - contextPath: AzureSentinel.AlertRule.type
      description: The type of the resource, e.g., "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
      type: String
    - contextPath: AzureSentinel.AlertRule.kind
      description: The alert rule kind.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.displayName
      description: The display name for alerts created by this alert rule.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.description
      description: The description of the alert rule.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.alertRuleTemplateName
      description: The name of the alert rule template used to create this rule.
      type: Unknown
    - contextPath: AzureSentinel.AlertRule.properties.tactics
      description: The tactics of the alert rule.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.severity
      description: The severity for alerts created by this alert rule.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.enabled
      description: Determines whether this alert rule is enabled or disabled.
      type: Boolean
    - contextPath: AzureSentinel.AlertRule.properties.lastModifiedUtc
      description: The last time that this alert was modified.
      type: Date
    - contextPath: AzureSentinel.AlertRule.properties.productFilter
      description: The alerts' productName on which the cases will be generated.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.severitiesFilter
      description: The alerts' severities on which the cases will be generated.
      type: Unknown
    - contextPath: AzureSentinel.AlertRule.properties.displayNamesFilter
      description: The alerts' displayNames on which the cases will be generated.
      type: Unknown
    - contextPath: AzureSentinel.AlertRule.properties.query
      description: The query that creates alerts for this rule.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.queryFrequency
      description: The frequency (in ISO 8601 duration format) for this alert rule to run.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.queryPeriod
      description: The period (in ISO 8601 duration format) that this alert rule looks at.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.triggerOperator
      description: The operation against the threshold that triggers the alert rule.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.triggerThreshold
      description: The threshold that triggers this alert rule.
      type: Number
    - contextPath: AzureSentinel.AlertRule.properties.suppressionDuration
      description: The suppression (in ISO 8601 duration format) to wait since the last time this alert rule was triggered.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.suppressionEnabled
      description: Determines whether the suppression for this alert rule is enabled or disabled.
      type: Boolean
    - contextPath: AzureSentinel.AlertRule.properties.eventGroupingSettings
      description: The event grouping settings.
      type: Unknown
    - contextPath: AzureSentinel.AlertRule.properties.customDetails
      description: Dictionary of string key-value pairs of columns to be attached to the alert.
      type: Unknown
    - contextPath: AzureSentinel.AlertRule.properties.entityMappings
      description: Array of the entity mappings of the alert rule.
      type: Unknown
    - contextPath: AzureSentinel.AlertRule.properties.alertDetailsOverride
      description: The alert details override settings.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.incidentConfiguration
      description: The settings of the incidents that were created from alerts triggered by this analytics rule.
      type: Unknown
  - arguments:
    - description: The alert rule name to update.
      name: rule_name
      required: true
    - auto: PREDEFINED
      description: |
        The alert rule kind to update.
        Required for all types.
      name: kind
      predefined:
      - fusion
      - microsoft_security_incident_creation
      - scheduled
    - description: |
        The name of the alert rule template used to update this rule.
        Required for Fusion, optional for Scheduled rules.
      name: template_name
    - auto: PREDEFINED
      description: |
        Determines whether this alert rule is enabled or disabled.
        Required for all types.
      name: enabled
      predefined:
      - yes
      - no
    - description: ETag of the Azure resource.
      name: etag
    - description: |
        The display name for alerts created by this alert rule.
        Required for MicrosoftSecurityIncidentCreation and scheduled rules.
      name: displayName
    - auto: PREDEFINED
      description: |
        The alerts' productName on which the cases will be generated.
        Required for MicrosoftSecurityIncidentCreation rules.
      name: product_filter
      predefined:
      - azure_active_directory_identity_protection
      - azure_advanced_threat_protection
      - azure_security_center
      - azure_security_center_for_iot
      - microsoft_cloud_app_security
    - description: |
        The description of the alert rule.
        Relevant for MicrosoftSecurityIncidentCreation and scheduled rules.
      name: description
    - description: |
        Alerts' displayNames on which the cases will not be generated.
        Relevant for MicrosoftSecurityIncidentCreation rules.
      isArray: true
      name: name_exclude_filter
    - description: |
        Alerts' displayNames on which the cases will be generated.
        Relevant for MicrosoftSecurityIncidentCreation rules.
      isArray: true
      name: name_include_filter
    - description: |
        Alerts' severities on which the cases will be generated.
        Relevant for MicrosoftSecurityIncidentCreation rules.
      isArray: true
      name: severity_filter
    - description: |
        The query that creates alerts for this rule.
        Required for scheduled rules.
      name: query
    - description: |
        The frequency (in ISO 8601 duration format: PnYnMnDTnHnMnS or PnW) for this alert rule to run.
        Required for scheduled rules.
      name: query_frequency
    - description: |
        The period (in ISO 8601 duration format: PnYnMnDTnHnMnS or PnW) that this alert rule looks at.
        Required for scheduled rules.
      name: query_period
    - auto: PREDEFINED
      description: |
        The severity for alerts created by this alert rule.
        Required for scheduled rules.
      name: severity
      predefined:
      - informational
      - low
      - medium
      - high
    - description: |
        The suppression (in ISO 8601 duration format: PnYnMnDTnHnMnS or PnW) to wait since the last time this alert rule was triggered.
        Required for scheduled rules.
      name: suppression_duration
    - auto: PREDEFINED
      description: |
        Determines whether the suppression for this alert rule is enabled or disabled.
        Required for scheduled rules.
      name: suppression_enabled
      predefined:
      - yes
      - no
    - auto: PREDEFINED
      description: |
        The operation against the threshold that triggers the alert rule.
        Required for scheduled rules.
      name: trigger_operator
      predefined:
      - equal
      - greater_than
      - less_than
      - not_equal
    - description: |
        The threshold that triggers this alert rule.
        Required for scheduled rules.
      name: trigger_threshold
    - description: |
        The tactics of the alert rule.
        Relevant for scheduled rules.
      isArray: true
      name: tactics
    - description: |
        The techniques of the alert rule.
        Relevant for scheduled rules.
      isArray: true
      name: techniques
    - description: |
        Option to insert a configured rule JSON instead of using the arguments.
      name: rule_json
    - description: The subscription ID.
      name: subscription_id
    - description: The resource group name.
      name: resource_group_name
    description: Updates an alert rule.
    name: azure-sentinel-update-alert-rule
    outputs:
    - contextPath: AzureSentinel.AlertRule.id
      description: Fully qualified resource ID for the resource.
      type: String
    - contextPath: AzureSentinel.AlertRule.name
      description: The name of the resource.
      type: String
    - contextPath: AzureSentinel.AlertRule.etag
      description: ETag of the Azure resource.
      type: String
    - contextPath: AzureSentinel.AlertRule.type
      description: The type of the resource, e.g., "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
      type: String
    - contextPath: AzureSentinel.AlertRule.kind
      description: The alert rule kind.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.displayName
      description: The display name for alerts created by this alert rule.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.description
      description: The description of the alert rule.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.alertRuleTemplateName
      description: The name of the alert rule template used to update this rule.
      type: Unknown
    - contextPath: AzureSentinel.AlertRule.properties.tactics
      description: The tactics of the alert rule.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.severity
      description: The severity for alerts created by this alert rule.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.enabled
      description: Determines whether this alert rule is enabled or disabled.
      type: Boolean
    - contextPath: AzureSentinel.AlertRule.properties.lastModifiedUtc
      description: The last time this alert was modified.
      type: Date
    - contextPath: AzureSentinel.AlertRule.properties.productFilter
      description: The alerts' productName on which the cases will be generated.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.severitiesFilter
      description: The alerts' severities on which the cases will be generated.
      type: Unknown
    - contextPath: AzureSentinel.AlertRule.properties.displayNamesFilter
      description: The alerts' displayNames on which the cases will be generated.
      type: Unknown
    - contextPath: AzureSentinel.AlertRule.properties.query
      description: The query that creates alerts for this rule.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.queryFrequency
      description: The frequency (in ISO 8601 duration format) for this alert rule to run.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.queryPeriod
      description: The period (in ISO 8601 duration format) that this alert rule looks at.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.triggerOperator
      description: The operation against the threshold that triggers alert rule.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.triggerThreshold
      description: The threshold triggers this alert rule.
      type: Number
    - contextPath: AzureSentinel.AlertRule.properties.suppressionDuration
      description: The suppression (in ISO 8601 duration format) to wait since the last time this alert rule been triggered.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.suppressionEnabled
      description: Determines whether the suppression for this alert rule is enabled or disabled.
      type: Boolean
    - contextPath: AzureSentinel.AlertRule.properties.eventGroupingSettings
      description: The event grouping settings.
      type: Unknown
    - contextPath: AzureSentinel.AlertRule.properties.customDetails
      description: Dictionary of string key-value pairs of columns to be attached to the alert.
      type: Unknown
    - contextPath: AzureSentinel.AlertRule.properties.entityMappings
      description: Array of the entity mappings of the alert rule.
      type: Unknown
    - contextPath: AzureSentinel.AlertRule.properties.alertDetailsOverride
      description: The alert details override settings.
      type: String
    - contextPath: AzureSentinel.AlertRule.properties.incidentConfiguration
      description: The settings of the incidents that were created from alerts triggered by this analytics rule.
      type: Unknown
  - name: azure-sentinel-subscriptions-list
    description: Lists all subscriptions.
    outputs:
    - contextPath: AzureSentinel.SubscriptionId
      description: Fully qualified resource ID for the resource.
      type: String
    - contextPath: AzureSentinel.Subscription.displayName
      description: The name of the resource.
      type: String
    - contextPath: AzureSentinel.Subscription.authorizationSource
      description: The authorization source of the resource.
      type: String
    - contextPath: AzureSentinel.Subscription.managedByTenants
      description: The subscriptions that are managed by tenants of the resource.
      type: String
    - contextPath: AzureSentinel.Subscription.tenetId
      description: The tenet ID of the resource.
      type: String
    - contextPath: AzureSentinel.Subscription.state
      description: The state of the resource.
      type: String
    - contextPath: AzureSentinel.Subscription.subscriptionPolicies
      description: The subscription policies of the resource.
      type: String
  - name: azure-sentinel-resource-group-list
    description: List all resource groups for a subscription.
    arguments:
    - name: subscription_id
      description: "The subscription ID. Note: The integration default Subscription ID will be used unless this argument is provided."
      type: String
    - name: tag
      description: A single tag in the form of '{"Tag Name":"Tag Value"}' to filter the list by.
      type: String
    - name: limit
      description: The maximum number of resource groups to return.
      defaultValue: 50
      type: Number
    outputs:
    - contextPath: AzureSentinel.ResourceGroup.id
      description: Fully qualified resource ID for the resource.
      type: String
    - contextPath: AzureSentinel.ResourceGroup.name
      description: The name of the resource.
      type: String
    - contextPath: AzureSentinel.ResourceGroup.type
      description: The type of the resource. E.g., "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
      type: String
    - contextPath: AzureSentinel.ResourceGroup.location
      description: The location of the resource group.
      type: String
    - contextPath: AzureSentinel.ResourceGroup.tags
      description: The tags of the resource group.
      type: Dictionary
    - contextPath: AzureSentinel.ResourceGroup.properties
      description: The properties of the resource group.
      type: dictionary
  - description: Run this command if for some reason you need to rerun the authentication process.
    execution: false
    name: azure-sentinel-auth-reset
    arguments: []
  - arguments:
    - name: title
      description: The incident's title.
      required: true
    - auto: PREDEFINED
      description: The incident severity.
      name: severity
      predefined:
      - High
      - Medium
      - Low
      - Informational
    - auto: PREDEFINED
      description: The incident status.
      name: status
      predefined:
      - New
      - Active
      - Closed
      required: true
    - description: The incident description.
      name: description
    - description: Incident labels. Note that all labels will be set as labelType='User'.
      isArray: true
      name: labels
    description: Create a sentinel incident.
    name: azure-sentinel-create-incident
    outputs:
    - contextPath: AzureSentinel.Incident.ID
      description: The incident ID.
      type: String
    - contextPath: AzureSentinel.Incident.Title
      description: The incident's title.
      type: String
    - contextPath: AzureSentinel.Incident.Description
      description: Description of the incident.
      type: String
    - contextPath: AzureSentinel.Incident.Severity
      description: The incident severity.
      type: String
    - contextPath: AzureSentinel.Incident.Status
      description: The incident status.
      type: String
    - contextPath: AzureSentinel.Incident.AssigneeName
      description: The name of the incident assignee.
      type: String
    - contextPath: AzureSentinel.Incident.AssigneeEmail
      description: The email address of the incident assignee.
      type: String
    - contextPath: AzureSentinel.Incident.AssigneeObjectID
      description: The object ID of the incident assignee.
      type: string
    - contextPath: AzureSentinel.Incident.AssigneeUPN
      description: The user principal name of the incident assignee.
      type: string
    - contextPath: AzureSentinel.Incident.Label.Name
      description: The name of the incident label.
      type: String
    - contextPath: AzureSentinel.Incident.Label.Type
      description: The incident label type.
      type: String
    - contextPath: AzureSentinel.Incident.FirstActivityTimeUTC
      description: The date and time of the incident's first activity.
      type: Date
    - contextPath: AzureSentinel.Incident.LastActivityTimeUTC
      description: The date and time of the incident's last activity.
      type: Date
    - contextPath: AzureSentinel.Incident.LastModifiedTimeUTC
      description: The date and time the incident was last modified.
      type: Date
    - contextPath: AzureSentinel.Incident.CreatedTimeUTC
      description: The date and time the incident was created.
      type: Date
    - contextPath: AzureSentinel.Incident.IncidentNumber
      description: The incident number.
      type: Number
    - contextPath: AzureSentinel.Incident.AlertsCount
      description: The number of the alerts in the incident.
      type: Number
    - contextPath: AzureSentinel.Incident.BookmarkCount
      description: The number of bookmarks in the incident.
      type: Number
    - contextPath: AzureSentinel.Incident.CommentCount
      description: The number of comments in the incident.
      type: Number
    - contextPath: AzureSentinel.Incident.AlertProductNames
      description: The alert product names of the incident.
      type: String
    - contextPath: AzureSentinel.Incident.Tactics
      description: The incident's tactics.
      type: String
    - contextPath: AzureSentinel.Incident.FirstActivityTimeGenerated
      description: The incident's generated first activity time.
      type: Date
    - contextPath: AzureSentinel.Incident.LastActivityTimeGenerated
      description: The incident's generated last activity time.
      type: Date
    - contextPath: AzureSentinel.Incident.Etag
      description: The Etag of the incident.
      type: String
  dockerimage: demisto/crypto:1.0.0.10120494
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
tests:
- TestAzureSentinelPlaybookV2
- No test - Manual test playbook-TestAzureSentinelPlaybook is available in NonCircleTests folder
fromversion: 5.0.0
defaultclassifier: Microsoft Sentinel - Classifier
defaultmapperin: Microsoft Sentinel - Incoming Mapper
defaultmapperout: Microsoft Sentinel - Outgoing Mapper