Adding all ASI RP APIs (#5173)

* Creating first and basic swagger for new RP of ASI (Azure Security Insight). This RP is an extension RP of "Microsoft.operationalinsights", and it is coupled to a Log analytics workspace. This is a first iteration in order to create a simple RP with single endpoint, after it wil work the API will be changed with the actual and full endpoints based on the learnings from this POC. * updating the operationalInsightsResourceProvider to be a global parameter and reuse it in the PUT same as in the GET * Fixing comments from PR * Fixing the Microsoft.OperationalInsight to the right form * Updating the location to be under- "resource-manager" * adding readme files for the swagger * Changing the path of the files to the correct path * Change the location of the readme files * Fixing inconsistency in the naming- changing everything to SecurityInsights * Missed the file when aligned the name to SecurityInsights * Fixing a redundant space in the examples * add alertRule to the CreateAlertRule.json and do some indentation fixes * Creates the "real" API for Scheduled Alert Rules * Update the name alertRule to alertScheduledtRule in the creation example * Fixing comments from PR- * Changing durations to fit standards * Changing operators to fit other RPs * Align naming to scheduledAlertRules * Adding 200 response to DeleteScheduledAlertRule * Changing naming- alertTriggerOperator => triggerOperator alertTriggerThreshold => triggerThreshold * Adding kind to AlertRule and making Scheduled as a specific kind * Fix some errors * Trying to solve the model validator issues * Fixing indentation * Adding data connectors endpoints * fixing nesting issues * Try to fix some checks issues * Try to fix issues once again * Fixing typos * Add actions for alerts * Updating the examples for actions * Move actions next to alert rules * Adding entities * Adding OfficeConsent & Settings * Adding cases APIs * Adding Bookmarks APIs * Fixing comments from review * Fixing path in examples Fixing array results * updating the settings examples * Update "assignedTo" in cases to be the same UserInfo as in Bookmarks * Update cases examples * fixed the CloseReason x-ms-enum name * Fixing comments from PR * Change in dataConnectors from contextId to the relevant ID * Fixing the code according to discussion. Actions will be only nested resource at the moment, so ruleId is not needed currently. Patterns will be removed so Guid will not be mandatory as parameter. ruleName will be cahanged to displayName in AlertRules * Fixing validation error * revert this file * Fixing examples json * updating the operationIds to be more precise
Azure · Feb 13, 2019 · 64f1e0e · 64f1e0e
1 parent ee6addc
commit 64f1e0e
Show file tree

Hide file tree

Showing 33 changed files with 3,188 additions and 538 deletions.
diff --git a/...ource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json b/...ource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json
diff --git a/...SecurityInsights/preview/2019-01-01-preview/examples/actions/CreateActionOfAlertRule.json b/...SecurityInsights/preview/2019-01-01-preview/examples/actions/CreateActionOfAlertRule.json
@@ -0,0 +1,44 @@
+{
+    "parameters": {
+        "api-version": "2019-01-01-preview",
+        "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+        "resourceGroupName": "myRg",
+        "workspaceName": "myWorkspace",
+        "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
+        "ruleId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+        "actionId": "912bec42-cb66-4c03-ac63-1761b6898c3e",
+        "action": {
+            "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5/actions/912bec42-cb66-4c03-ac63-1761b6898c3e",
+            "name": "912bec42-cb66-4c03-ac63-1761b6898c3e",
+            "type": "Microsoft.SecurityInsights/alertRules/actions",
+            "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+            "properties": {
+                "triggerUri": "https://prod-31.northcentralus.logic.azure.com:443/workflows/cd3765391efd48549fd7681ded1d48d7/triggers/manual/paths/invoke?api-version=2016-10-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=signature"
+            }
+        }
+    },
+    "responses": {
+        "200": {
+            "body": {
+                "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5/actions/912bec42-cb66-4c03-ac63-1761b6898c3e",
+                "name": "912bec42-cb66-4c03-ac63-1761b6898c3e",
+                "type": "Microsoft.SecurityInsights/alertRules/actions",
+                "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+                "properties": {
+                    "triggerUri": "https://prod-31.northcentralus.logic.azure.com:443/workflows/cd3765391efd48549fd7681ded1d48d7/triggers/manual/paths/invoke?api-version=2016-10-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=signature"
+                }
+            }
+        },
+        "201": {
+            "body": {
+                "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5/actions/912bec42-cb66-4c03-ac63-1761b6898c3e",
+                "name": "912bec42-cb66-4c03-ac63-1761b6898c3e",
+                "type": "Microsoft.SecurityInsights/alertRules/actions",
+                "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+                "properties": {
+                    "triggerUri": "https://prod-31.northcentralus.logic.azure.com:443/workflows/cd3765391efd48549fd7681ded1d48d7/triggers/manual/paths/invoke?api-version=2016-10-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=signature"
+                }
+            }
+        }
+    }
+}
diff --git a/...SecurityInsights/preview/2019-01-01-preview/examples/actions/DeleteActionOfAlertRule.json b/...SecurityInsights/preview/2019-01-01-preview/examples/actions/DeleteActionOfAlertRule.json
@@ -0,0 +1,17 @@
+{
+    "parameters": {
+        "api-version": "2019-01-01-preview",
+        "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+        "resourceGroupName": "myRg",
+        "workspaceName": "myWorkspace",
+        "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
+        "ruleId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+        "actionId": "912bec42-cb66-4c03-ac63-1761b6898c3e"
+    },
+    "responses": {
+        "200": {
+        },
+        "204":{
+        }
+    }
+}
diff --git a/...ecurityInsights/preview/2019-01-01-preview/examples/actions/GetActionOfAlertRuleById.json b/...ecurityInsights/preview/2019-01-01-preview/examples/actions/GetActionOfAlertRuleById.json
@@ -0,0 +1,24 @@
+{
+    "parameters": {
+        "api-version": "2019-01-01-preview",
+        "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+        "resourceGroupName": "myRg",
+        "workspaceName": "myWorkspace",
+        "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
+        "ruleId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+        "actionId": "912bec42-cb66-4c03-ac63-1761b6898c3e"
+    },
+    "responses": {
+        "200": {
+            "body": {
+                "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5/actions/912bec42-cb66-4c03-ac63-1761b6898c3e",
+                "name": "912bec42-cb66-4c03-ac63-1761b6898c3e",
+                "type": "Microsoft.SecurityInsights/alertRules/actions",
+                "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+                "properties": {
+                    "triggerUri": "https://prod-31.northcentralus.logic.azure.com:443/workflows/cd3765391efd48549fd7681ded1d48d7/triggers/manual/paths/invoke?api-version=2016-10-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=signature"
+                }
+            }
+        }
+    }
+}
diff --git a/...ecurityInsights/preview/2019-01-01-preview/examples/actions/GetAllActionsByAlertRule.json b/...ecurityInsights/preview/2019-01-01-preview/examples/actions/GetAllActionsByAlertRule.json
@@ -0,0 +1,27 @@
+{
+    "parameters": {
+        "api-version": "2019-01-01-preview",
+        "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+        "resourceGroupName": "myRg",
+        "workspaceName": "myWorkspace",
+        "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
+        "ruleId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5"
+    },
+    "responses": {
+        "200": {
+            "body": {
+                "value": [
+                    {
+                        "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5/actions/912bec42-cb66-4c03-ac63-1761b6898c3e",
+                        "name": "912bec42-cb66-4c03-ac63-1761b6898c3e",
+                        "type": "Microsoft.SecurityInsights/alertRules/actions",
+                        "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+                        "properties": {
+                            "triggerUri": "https://prod-31.northcentralus.logic.azure.com:443/workflows/cd3765391efd48549fd7681ded1d48d7/triggers/manual/paths/invoke?api-version=2016-10-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=signature"
+                        }
+                    }
+                ]
+            }
+        }
+    }
+}
diff --git a/...rityInsights/preview/2019-01-01-preview/examples/alertRules/CreateScheduledAlertRule.json b/...rityInsights/preview/2019-01-01-preview/examples/alertRules/CreateScheduledAlertRule.json
@@ -7,13 +7,13 @@
         "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
         "ruleId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
         "alertRule": {
-            "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationsManagement/workspaces/myWorkspace/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+            "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
             "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
             "type": "Microsoft.SecurityInsights/alertRules",
             "kind": "Scheduled",
             "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
             "properties": {
-                "ruleName": "Rule2",
+                "displayName": "Rule2",
                 "description": "",
                 "severity": "High",
                 "enabled": true,
@@ -30,13 +30,13 @@
     "responses": {
         "200": {
             "body": {
-                "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationsManagement/workspaces/myWorkspace/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+                "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                 "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                 "type": "Microsoft.SecurityInsights/alertRules",
                 "kind": "Scheduled",
                 "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                 "properties": {
-                    "ruleName": "Rule2",
+                    "displayName": "Rule2",
                     "description": "",
                     "severity": "High",
                     "enabled": true,
@@ -53,13 +53,13 @@
         },
         "201": {
             "body": {
-                "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationsManagement/workspaces/myWorkspace/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+                "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                 "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                 "type": "Microsoft.SecurityInsights/alertRules",
                 "kind": "Scheduled",
                 "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                 "properties": {
-                    "ruleName": "Rule2",
+                    "displayName": "Rule2",
                     "description": "",
                     "severity": "High",
                     "enabled": true,

diff --git a/...ityInsights/preview/2019-01-01-preview/examples/alertRules/GetScheduledAlertRuleById.json b/...ityInsights/preview/2019-01-01-preview/examples/alertRules/GetScheduledAlertRuleById.json
@@ -10,13 +10,13 @@
     "responses": {
         "200": {
             "body": {
-                "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationsManagement/workspaces/myWorkspace/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+                "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                 "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                 "type": "Microsoft.SecurityInsights/alertRules",
                 "kind": "Scheduled",
                 "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                 "properties": {
-                    "ruleName": "Rule2",
+                    "displayName": "Rule2",
                     "description": "",
                     "severity": "High",
                     "enabled": true,

diff --git a/...curityInsights/preview/2019-01-01-preview/examples/alertRules/GetScheduledAlertRules.json b/...curityInsights/preview/2019-01-01-preview/examples/alertRules/GetScheduledAlertRules.json
@@ -8,29 +8,31 @@
     },
     "responses": {
         "200": {
-            "body": [
-                {
-                    "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationsManagement/workspaces/myWorkspace/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
-                    "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
-                    "type": "Microsoft.SecurityInsights/alertRules",
-                    "kind": "Scheduled",
-                    "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
-                    "properties": {
-                        "ruleName": "Rule2",
-                        "description": "",
-                        "severity": "High",
-                        "enabled": true,
-                        "query": "ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden",
-                        "queryFrequency": "PT1H",
-                        "queryPeriod": "P2DT1H30M",
-                        "triggerOperator": "GreaterThan",
-                        "triggerThreshold": 0,
-                        "suppressionDuration": "PT1H",
-                        "suppressionEnabled": false,
-                        "lastModifiedUtc": "2019-01-01T13:15:30Z"
+            "body": {
+                "value": [
+                    {
+                        "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+                        "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+                        "type": "Microsoft.SecurityInsights/alertRules",
+                        "kind": "Scheduled",
+                        "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+                        "properties": {
+                            "displayName": "Rule2",
+                            "description": "",
+                            "severity": "High",
+                            "enabled": true,
+                            "query": "ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden",
+                            "queryFrequency": "PT1H",
+                            "queryPeriod": "P2DT1H30M",
+                            "triggerOperator": "GreaterThan",
+                            "triggerThreshold": 0,
+                            "suppressionDuration": "PT1H",
+                            "suppressionEnabled": false,
+                            "lastModifiedUtc": "2019-01-01T13:15:30Z"
+                        }
                     }
-                }
-            ]
+                ]
+            }
         }
     }
 }
diff --git a/...rosoft.SecurityInsights/preview/2019-01-01-preview/examples/bookmarks/CreateBookmark.json b/...rosoft.SecurityInsights/preview/2019-01-01-preview/examples/bookmarks/CreateBookmark.json
@@ -0,0 +1,88 @@
+{
+    "parameters": {
+        "api-version": "2019-01-01-preview",
+        "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+        "resourceGroupName": "myRg",
+        "workspaceName": "myWorkspace",
+        "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
+        "bookmarkId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+        "bookmark": {
+            "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+            "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+            "type": "Microsoft.SecurityInsights/bookmarks",
+            "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+            "properties": {
+                "displayName": "My bookmark",
+                "createdBy": {
+                    "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+                    "email": "john@contoso.com",
+                    "name": "john doe"
+                },
+				"updatedBy": {
+                    "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+                    "email": "john@contoso.com",
+                    "name": "john doe"
+                },
+				"lastUpdatedTimeUtc": "2019-01-01T13:15:30Z",
+				"createdTimeUtc": "2019-01-01T13:15:30Z",
+                "notes": "Found a suspicious activity",
+				"labels": "['Tag1', 'Tag2']",
+                "query": "SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)"
+            }
+        }
+    },
+    "responses": {
+        "200": {
+            "body": {
+                "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+                "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+                "type": "Microsoft.SecurityInsights/bookmarks",
+                "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+                "properties": {
+                    "displayName": "My bookmark",
+                    "createdBy": {
+                        "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+                        "email": "john@contoso.com",
+                        "name": "john doe"
+                    },
+                    "updatedBy": {
+                        "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+                        "email": "john@contoso.com",
+                        "name": "john doe"
+                    },
+                    "lastUpdatedTimeUtc": "2019-01-01T13:15:30Z",
+                    "createdTimeUtc": "2019-01-01T13:15:30Z",
+                    "notes": "Found a suspicious activity",
+                    "labels": "['Tag1', 'Tag2']",
+                    "query": "SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)"
+                }
+            }
+        },
+        "201": {
+            "body": {
+                "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+                "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+                "type": "Microsoft.SecurityInsights/bookmarks",
+                "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+                "properties": {
+                    "displayName": "My bookmark",
+                    "createdBy": {
+                        "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+                        "email": "john@contoso.com",
+                        "name": "john doe"
+                    },
+                    "updatedBy": {
+                        "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+                        "email": "john@contoso.com",
+                        "name": "john doe"
+                    },
+                    "lastUpdatedTimeUtc": "2019-01-01T13:15:30Z",
+                    "createdTimeUtc": "2019-01-01T13:15:30Z",
+                    "notes": "Found a suspicious activity",
+                    "labels": "['Tag1', 'Tag2']",
+                    "query": "SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)"
+                }
+            }
+        }
+    }
+}
diff --git a/...rosoft.SecurityInsights/preview/2019-01-01-preview/examples/bookmarks/DeleteBookmark.json b/...rosoft.SecurityInsights/preview/2019-01-01-preview/examples/bookmarks/DeleteBookmark.json
@@ -0,0 +1,16 @@
+{
+    "parameters": {
+        "api-version": "2019-01-01-preview",
+        "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+        "resourceGroupName": "myRg",
+        "workspaceName": "myWorkspace",
+        "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
+        "bookmarkId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5"
+    },
+    "responses": {
+        "200": {
+        },
+        "204":{
+        }
+    }
+}
diff --git a/...osoft.SecurityInsights/preview/2019-01-01-preview/examples/bookmarks/GetBookmarkById.json b/...osoft.SecurityInsights/preview/2019-01-01-preview/examples/bookmarks/GetBookmarkById.json
@@ -0,0 +1,39 @@
+{
+    "parameters": {
+        "api-version": "2019-01-01-preview",
+        "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+        "resourceGroupName": "myRg",
+        "workspaceName": "myWorkspace",
+        "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
+        "bookmarkId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5"
+    },
+    "responses": {
+        "200": {
+            "body": {
+                "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+                "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+                "type": "Microsoft.SecurityInsights/bookmarks",
+                "kind": "Scheduled",
+                "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+                "properties": {
+                    "displayName": "My bookmark",
+                    "createdBy": {
+                        "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+                        "email": "john@contoso.com",
+                        "name": "john doe"
+                    },
+                    "updatedBy": {
+                        "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+                        "email": "john@contoso.com",
+                        "name": "john doe"
+                    },
+                    "lastUpdatedTimeUtc": "2019-01-01T13:15:30Z",
+                    "createdTimeUtc": "2019-01-01T13:15:30Z",
+                    "notes": "Found a suspicious activity",
+                    "labels": "['Tag1', 'Tag2']",
+                    "query": "SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)"
+                }
+            }
+        }
+    }
+}