azure-resource-manager-schemas/schemas/2021-06-01/Microsoft.Security.json

890 строки
27 KiB
JSON

{
"id": "https://schema.management.azure.com/schemas/2021-06-01/Microsoft.Security.json#",
"title": "Microsoft.Security",
"description": "Microsoft Security Resource Types",
"$schema": "http://json-schema.org/draft-04/schema#",
"subscription_resourceDefinitions": {
"assessmentMetadata": {
"description": "Microsoft.Security/assessmentMetadata",
"properties": {
"apiVersion": {
"enum": [
"2021-06-01"
],
"type": "string"
},
"name": {
"description": "The Assessment Key - Unique key for the assessment type",
"type": "string"
},
"properties": {
"description": "Describes properties of an assessment metadata response.",
"oneOf": [
{
"$ref": "#/definitions/SecurityAssessmentMetadataPropertiesResponse"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"type": {
"enum": [
"Microsoft.Security/assessmentMetadata"
],
"type": "string"
}
},
"required": [
"name",
"properties",
"apiVersion",
"type"
],
"type": "object"
},
"settings": {
"description": "Microsoft.Security/settings",
"properties": {
"apiVersion": {
"enum": [
"2021-06-01"
],
"type": "string"
},
"name": {
"description": "The name of the setting",
"oneOf": [
{
"enum": [
"MCAS",
"WDATP",
"Sentinel"
],
"type": "string"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"type": {
"enum": [
"Microsoft.Security/settings"
],
"type": "string"
}
},
"required": [
"name",
"apiVersion",
"type"
],
"type": "object"
}
},
"tenant_resourceDefinitions": {
"assessmentMetadata": {
"description": "Microsoft.Security/assessmentMetadata",
"properties": {
"apiVersion": {
"enum": [
"2021-06-01"
],
"type": "string"
},
"name": {
"description": "The Assessment Key - Unique key for the assessment type",
"type": "string"
},
"properties": {
"description": "Describes properties of an assessment metadata response.",
"oneOf": [
{
"$ref": "#/definitions/SecurityAssessmentMetadataPropertiesResponse"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"type": {
"enum": [
"Microsoft.Security/assessmentMetadata"
],
"type": "string"
}
},
"required": [
"name",
"properties",
"apiVersion",
"type"
],
"type": "object"
}
},
"unknown_resourceDefinitions": {
"assessments": {
"description": "Microsoft.Security/assessments",
"properties": {
"apiVersion": {
"enum": [
"2021-06-01"
],
"type": "string"
},
"name": {
"description": "The Assessment Key - Unique key for the assessment type",
"type": "string"
},
"properties": {
"description": "Describes properties of an assessment.",
"oneOf": [
{
"$ref": "#/definitions/SecurityAssessmentProperties"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"type": {
"enum": [
"Microsoft.Security/assessments"
],
"type": "string"
}
},
"required": [
"name",
"properties",
"apiVersion",
"type"
],
"type": "object"
}
},
"definitions": {
"AssessmentStatus": {
"description": "The result of the assessment",
"properties": {
"cause": {
"description": "Programmatic code for the cause of the assessment status",
"type": "string"
},
"code": {
"description": "Programmatic code for the status of the assessment",
"oneOf": [
{
"enum": [
"Healthy",
"Unhealthy",
"NotApplicable"
],
"type": "string"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"description": {
"description": "Human readable description of the assessment status",
"type": "string"
}
},
"required": [
"code"
],
"type": "object"
},
"ResourceDetails": {
"description": "Details of the resource that was assessed",
"oneOf": [
{
"description": "Details of the Azure resource that was assessed",
"properties": {
"source": {
"enum": [
"Azure"
],
"type": "string"
}
},
"required": [
"source"
],
"type": "object"
},
{
"description": "Details of the On Premise Sql resource that was assessed",
"properties": {
"databaseName": {
"description": "The Sql database name installed on the machine",
"type": "string"
},
"machineName": {
"description": "The name of the machine",
"type": "string"
},
"serverName": {
"description": "The Sql server name installed on the machine",
"type": "string"
},
"source": {
"enum": [
"OnPremiseSql"
],
"type": "string"
},
"sourceComputerId": {
"description": "The oms agent Id installed on the machine",
"type": "string"
},
"vmuuid": {
"description": "The unique Id of the machine",
"type": "string"
},
"workspaceId": {
"description": "Azure resource Id of the workspace the machine is attached to",
"type": "string"
}
},
"required": [
"serverName",
"databaseName",
"workspaceId",
"vmuuid",
"sourceComputerId",
"machineName",
"source"
],
"type": "object"
}
],
"properties": {},
"type": "object"
},
"SecurityAssessmentMetadataPartnerData": {
"description": "Describes the partner that created the assessment",
"properties": {
"partnerName": {
"description": "Name of the company of the partner",
"type": "string"
},
"productName": {
"description": "Name of the product of the partner that created the assessment",
"type": "string"
},
"secret": {
"description": "Secret to authenticate the partner and verify it created the assessment - write only",
"type": "string"
}
},
"required": [
"partnerName",
"secret"
],
"type": "object"
},
"SecurityAssessmentMetadataProperties": {
"description": "Describes properties of an assessment metadata.",
"properties": {
"assessmentType": {
"description": "BuiltIn if the assessment based on built-in Azure Policy definition, Custom if the assessment based on custom Azure Policy definition",
"oneOf": [
{
"enum": [
"BuiltIn",
"CustomPolicy",
"CustomerManaged",
"VerifiedPartner"
],
"type": "string"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"categories": {
"description": "Array of categories",
"oneOf": [
{
"items": {
"enum": [
"Compute",
"Networking",
"Data",
"IdentityAndAccess",
"IoT"
],
"type": "string"
},
"type": "array"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"description": {
"description": "Human readable description of the assessment",
"type": "string"
},
"displayName": {
"description": "User friendly display name of the assessment",
"type": "string"
},
"implementationEffort": {
"description": "The implementation effort required to remediate this assessment",
"oneOf": [
{
"enum": [
"Low",
"Moderate",
"High"
],
"type": "string"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"partnerData": {
"description": "Describes the partner that created the assessment",
"oneOf": [
{
"$ref": "#/definitions/SecurityAssessmentMetadataPartnerData"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"preview": {
"description": "True if this assessment is in preview release status",
"oneOf": [
{
"type": "boolean"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"remediationDescription": {
"description": "Human readable description of what you should do to mitigate this security issue",
"type": "string"
},
"severity": {
"description": "The severity level of the assessment",
"oneOf": [
{
"enum": [
"Low",
"Medium",
"High"
],
"type": "string"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"threats": {
"description": "Array of threats",
"oneOf": [
{
"items": {
"enum": [
"accountBreach",
"dataExfiltration",
"dataSpillage",
"maliciousInsider",
"elevationOfPrivilege",
"threatResistance",
"missingCoverage",
"denialOfService"
],
"type": "string"
},
"type": "array"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"userImpact": {
"description": "The user impact of the assessment",
"oneOf": [
{
"enum": [
"Low",
"Moderate",
"High"
],
"type": "string"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
}
},
"required": [
"displayName",
"severity",
"assessmentType"
],
"type": "object"
},
"SecurityAssessmentMetadataPropertiesResponse": {
"description": "Describes properties of an assessment metadata response.",
"properties": {
"assessmentType": {
"description": "BuiltIn if the assessment based on built-in Azure Policy definition, Custom if the assessment based on custom Azure Policy definition",
"oneOf": [
{
"enum": [
"BuiltIn",
"CustomPolicy",
"CustomerManaged",
"VerifiedPartner"
],
"type": "string"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"categories": {
"description": "Array of categories",
"oneOf": [
{
"items": {
"enum": [
"Compute",
"Networking",
"Data",
"IdentityAndAccess",
"IoT"
],
"type": "string"
},
"type": "array"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"description": {
"description": "Human readable description of the assessment",
"type": "string"
},
"displayName": {
"description": "User friendly display name of the assessment",
"type": "string"
},
"implementationEffort": {
"description": "The implementation effort required to remediate this assessment",
"oneOf": [
{
"enum": [
"Low",
"Moderate",
"High"
],
"type": "string"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"partnerData": {
"description": "Describes the partner that created the assessment",
"oneOf": [
{
"$ref": "#/definitions/SecurityAssessmentMetadataPartnerData"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"plannedDeprecationDate": {
"oneOf": [
{
"pattern": "^[0-9]{2}/[0-9]{4}$",
"type": "string"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"preview": {
"description": "True if this assessment is in preview release status",
"oneOf": [
{
"type": "boolean"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"publishDates": {
"oneOf": [
{
"$ref": "#/definitions/SecurityAssessmentMetadataPropertiesResponsePublishDates"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"remediationDescription": {
"description": "Human readable description of what you should do to mitigate this security issue",
"type": "string"
},
"severity": {
"description": "The severity level of the assessment",
"oneOf": [
{
"enum": [
"Low",
"Medium",
"High"
],
"type": "string"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"tactics": {
"description": "Array of tactics",
"oneOf": [
{
"items": {
"enum": [
"Reconnaissance",
"Resource Development",
"Initial Access",
"Execution",
"Persistence",
"Privilege Escalation",
"Defense Evasion",
"Credential Access",
"Discovery",
"Lateral Movement",
"Collection",
"Command and Control",
"Exfiltration",
"Impact"
],
"type": "string"
},
"type": "array"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"techniques": {
"description": "Array of techniques",
"oneOf": [
{
"items": {
"enum": [
"Abuse Elevation Control Mechanism",
"Access Token Manipulation",
"Account Discovery",
"Account Manipulation",
"Active Scanning",
"Application Layer Protocol",
"Audio Capture",
"Boot or Logon Autostart Execution",
"Boot or Logon Initialization Scripts",
"Brute Force",
"Cloud Infrastructure Discovery",
"Cloud Service Dashboard",
"Cloud Service Discovery",
"Command and Scripting Interpreter",
"Compromise Client Software Binary",
"Compromise Infrastructure",
"Container and Resource Discovery",
"Create Account",
"Create or Modify System Process",
"Credentials from Password Stores",
"Data Destruction",
"Data Encrypted for Impact",
"Data from Cloud Storage Object",
"Data from Configuration Repository",
"Data from Information Repositories",
"Data from Local System",
"Data Manipulation",
"Data Staged",
"Defacement",
"Deobfuscate/Decode Files or Information",
"Disk Wipe",
"Domain Trust Discovery",
"Drive-by Compromise",
"Dynamic Resolution",
"Endpoint Denial of Service",
"Event Triggered Execution",
"Exfiltration Over Alternative Protocol",
"Exploit Public-Facing Application",
"Exploitation for Client Execution",
"Exploitation for Credential Access",
"Exploitation for Defense Evasion",
"Exploitation for Privilege Escalation",
"Exploitation of Remote Services",
"External Remote Services",
"Fallback Channels",
"File and Directory Discovery",
"Gather Victim Network Information",
"Hide Artifacts",
"Hijack Execution Flow",
"Impair Defenses",
"Implant Container Image",
"Indicator Removal on Host",
"Indirect Command Execution",
"Ingress Tool Transfer",
"Input Capture",
"Inter-Process Communication",
"Lateral Tool Transfer",
"Man-in-the-Middle",
"Masquerading",
"Modify Authentication Process",
"Modify Registry",
"Network Denial of Service",
"Network Service Scanning",
"Network Sniffing",
"Non-Application Layer Protocol",
"Non-Standard Port",
"Obtain Capabilities",
"Obfuscated Files or Information",
"Office Application Startup",
"OS Credential Dumping",
"Permission Groups Discovery",
"Phishing",
"Pre-OS Boot",
"Process Discovery",
"Process Injection",
"Protocol Tunneling",
"Proxy",
"Query Registry",
"Remote Access Software",
"Remote Service Session Hijacking",
"Remote Services",
"Remote System Discovery",
"Resource Hijacking",
"Scheduled Task/Job",
"Screen Capture",
"Search Victim-Owned Websites",
"Server Software Component",
"Service Stop",
"Signed Binary Proxy Execution",
"Software Deployment Tools",
"SQL Stored Procedures",
"Steal or Forge Kerberos Tickets",
"Subvert Trust Controls",
"Supply Chain Compromise",
"System Information Discovery",
"Taint Shared Content",
"Traffic Signaling",
"Transfer Data to Cloud Account",
"Trusted Relationship",
"Unsecured Credentials",
"User Execution",
"Valid Accounts",
"Windows Management Instrumentation",
"File and Directory Permissions Modification"
],
"type": "string"
},
"type": "array"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"threats": {
"description": "Array of threats",
"oneOf": [
{
"items": {
"enum": [
"accountBreach",
"dataExfiltration",
"dataSpillage",
"maliciousInsider",
"elevationOfPrivilege",
"threatResistance",
"missingCoverage",
"denialOfService"
],
"type": "string"
},
"type": "array"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"userImpact": {
"description": "The user impact of the assessment",
"oneOf": [
{
"enum": [
"Low",
"Moderate",
"High"
],
"type": "string"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
}
},
"required": [
"displayName",
"severity",
"assessmentType"
],
"type": "object"
},
"SecurityAssessmentMetadataPropertiesResponsePublishDates": {
"properties": {
"GA": {
"oneOf": [
{
"pattern": "^([0-9]{2}/){2}[0-9]{4}$",
"type": "string"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"public": {
"oneOf": [
{
"pattern": "^([0-9]{2}/){2}[0-9]{4}$",
"type": "string"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
}
},
"required": [
"public"
],
"type": "object"
},
"SecurityAssessmentPartnerData": {
"description": "Data regarding 3rd party partner integration",
"properties": {
"partnerName": {
"description": "Name of the company of the partner",
"type": "string"
},
"secret": {
"description": "secret to authenticate the partner - write only",
"type": "string"
}
},
"required": [
"partnerName",
"secret"
],
"type": "object"
},
"SecurityAssessmentProperties": {
"description": "Describes properties of an assessment.",
"properties": {
"additionalData": {
"description": "Additional data regarding the assessment",
"oneOf": [
{
"additionalProperties": {
"type": "string"
},
"properties": {},
"type": "object"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"metadata": {
"description": "Describes properties of an assessment metadata.",
"oneOf": [
{
"$ref": "#/definitions/SecurityAssessmentMetadataProperties"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"partnersData": {
"description": "Data regarding 3rd party partner integration",
"oneOf": [
{
"$ref": "#/definitions/SecurityAssessmentPartnerData"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"resourceDetails": {
"description": "Details of the resource that was assessed",
"oneOf": [
{
"$ref": "#/definitions/ResourceDetails"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
},
"status": {
"description": "The result of the assessment",
"oneOf": [
{
"$ref": "#/definitions/AssessmentStatus"
},
{
"$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
}
]
}
},
"required": [
"status",
"resourceDetails"
],
"type": "object"
}
}
}