From f77cc680190fa38ac09b59d504b2dea12f452487 Mon Sep 17 00:00:00 2001
From: SDKAuto <sdkautomation@microsoft.com>
Date: Sat, 20 Feb 2021 05:50:07 +0000
Subject: [PATCH] CodeGen from PR 13043 in Azure/azure-rest-api-specs Merge
 20fcc88f11ae18c04f387614a93fbd20ad819c1c into
 e0f7aaf8d7003bb066c29cb970dca0e990b71e5c

---
 .../Microsoft.SecurityInsights.json           | 74 ++++++++++++++++++-
 .../Microsoft.SecurityInsights.json           |  2 +-
 2 files changed, 73 insertions(+), 3 deletions(-)

diff --git a/schemas/2019-01-01-preview/Microsoft.SecurityInsights.json b/schemas/2019-01-01-preview/Microsoft.SecurityInsights.json
index d28fef041c..40876e1e22 100644
--- a/schemas/2019-01-01-preview/Microsoft.SecurityInsights.json
+++ b/schemas/2019-01-01-preview/Microsoft.SecurityInsights.json
@@ -2880,6 +2880,43 @@
       ],
       "description": "Threat Intelligence alert rule base property bag."
     },
+    "ThreatIntelligenceExternalReference": {
+      "type": "object",
+      "properties": {
+        "description": {
+          "type": "string",
+          "description": "External reference description"
+        },
+        "externalId": {
+          "type": "string",
+          "description": "External reference ID"
+        },
+        "hashes": {
+          "oneOf": [
+            {
+              "type": "object",
+              "additionalProperties": {
+                "type": "string"
+              },
+              "properties": {}
+            },
+            {
+              "$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
+            }
+          ],
+          "description": "External reference hashes"
+        },
+        "sourceName": {
+          "type": "string",
+          "description": "External reference source name"
+        },
+        "url": {
+          "type": "string",
+          "description": "External reference URL"
+        }
+      },
+      "description": "Describes external reference"
+    },
     "ThreatIntelligenceGranularMarkingModel": {
       "type": "object",
       "properties": {
@@ -2937,6 +2974,17 @@
           "type": "string",
           "description": "Created by reference of threat intelligence entity"
         },
+        "defanged": {
+          "oneOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
+            }
+          ],
+          "description": "Is threat intelligence entity defanged"
+        },
         "description": {
           "type": "string",
           "description": "Description of a threat intelligence entity"
@@ -2965,12 +3013,16 @@
           "type": "string",
           "description": "External ID of threat intelligence entity"
         },
+        "externalLastUpdatedTimeUtc": {
+          "type": "string",
+          "description": "External last updated time in UTC"
+        },
         "externalReferences": {
           "oneOf": [
             {
               "type": "array",
               "items": {
-                "type": "string"
+                "$ref": "#/definitions/ThreatIntelligenceExternalReference"
               }
             },
             {
@@ -3047,6 +3099,20 @@
           "type": "string",
           "description": "Modified by"
         },
+        "objectMarkingRefs": {
+          "oneOf": [
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            {
+              "$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
+            }
+          ],
+          "description": "Threat intelligence entity object marking references"
+        },
         "parsedPattern": {
           "oneOf": [
             {
@@ -3069,6 +3135,10 @@
           "type": "string",
           "description": "Pattern type of a threat intelligence entity"
         },
+        "patternVersion": {
+          "type": "string",
+          "description": "Pattern version of a threat intelligence entity"
+        },
         "revoked": {
           "oneOf": [
             {
@@ -3707,4 +3777,4 @@
       "description": "Microsoft.SecurityInsights/watchlists/watchlistItems"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/schemas/2020-01-01/Microsoft.SecurityInsights.json b/schemas/2020-01-01/Microsoft.SecurityInsights.json
index c992ffa8f0..4f8ab45cb8 100644
--- a/schemas/2020-01-01/Microsoft.SecurityInsights.json
+++ b/schemas/2020-01-01/Microsoft.SecurityInsights.json
@@ -1691,4 +1691,4 @@
       "description": "User information that made some action"
     }
   }
-}
\ No newline at end of file
+}