Microsoft Sentinel Automation Rules API

openapi: 3.2.0
info:
  title: Microsoft Sentinel Automation Rules API
  version: '2025-09-01'
  x-typespec-generated:
  - emitter: '@azure-tools/typespec-autorest'
  description: 'Operations tagged automationRules across 2 of this provider''s published API definitions: microsoft-sentinel-securityinsights-2025-09-01.json, microsoft-sentinel-securityinsights-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://management.azure.com
security:
- azure_auth:
  - user_impersonation
tags:
- name: automationRules
paths:
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/automationRules
  : get:
      operationId: AutomationRules_List
      tags:
      - automationRules
      description: Gets all automation rules.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AutomationRulesList'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-examples:
        AutomationRules_List:
          $ref: ./examples/automationRules/AutomationRules_List.json
      x-ms-pageable:
        nextLinkName: nextLink
      summary: Automation rules list
      x-summary-source: derived
    servers:
    - url: https://management.azure.com
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/automationRules/{automationRuleId}
  : get:
      operationId: AutomationRules_Get
      tags:
      - automationRules
      description: Gets the automation rule.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: automationRuleId
        in: path
        description: Automation rule ID
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AutomationRule'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-examples:
        AutomationRules_Get:
          $ref: ./examples/automationRules/AutomationRules_Get.json
      summary: Automation rules get
      x-summary-source: derived
    put:
      operationId: AutomationRules_CreateOrUpdate
      tags:
      - automationRules
      description: Creates or updates the automation rule.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: workspaceName
        in: path
        description: The name of the workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: automationRuleId
        in: path
        description: The automation rule ID.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Resource 'AutomationRule' update operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AutomationRule'
        '201':
          description: Resource 'AutomationRule' create operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AutomationRule'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-examples:
        AutomationRules_CreateOrUpdate:
          $ref: ./examples/automationRules/AutomationRules_CreateOrUpdate.json
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AutomationRule'
        description: The automation rule
      summary: Automation rules create or update
      x-summary-source: derived
    delete:
      operationId: AutomationRules_Delete
      tags:
      - automationRules
      description: Delete the automation rule.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: automationRuleId
        in: path
        description: Automation rule ID
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema: {}
        '204':
          description: 'There is no content to send for this request, but the headers may be useful. '
          content:
            application/json:
              schema: {}
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-examples:
        AutomationRules_Delete:
          $ref: ./examples/automationRules/AutomationRules_Delete.json
      summary: Automation rules delete
      x-summary-source: derived
    servers:
    - url: https://management.azure.com
components:
  schemas:
    AutomationRuleAction:
      type: object
      description: Describes an automation rule action.
      properties:
        order:
          type: integer
          format: int32
        actionType:
          $ref: '#/components/schemas/ActionType'
          description: The type of the automation rule action.
      discriminator:
        propertyName: actionType
      required:
      - order
      - actionType
    Azure.Core.uuid:
      type: string
      format: uuid
      description: Universally Unique Identifier
    ConditionType:
      type: string
      enum:
      - Property
      - PropertyArray
      - PropertyChanged
      - PropertyArrayChanged
      - Boolean
      x-ms-enum:
        name: ConditionType
        modelAsString: true
        values:
        - name: Property
          value: Property
          description: Evaluate an object property value
        - name: PropertyArray
          value: PropertyArray
          description: Evaluate an object array property value
        - name: PropertyChanged
          value: PropertyChanged
          description: Evaluate an object property changed value
        - name: PropertyArrayChanged
          value: PropertyArrayChanged
          description: Evaluate an object array property changed value
        - name: Boolean
          value: Boolean
          description: Apply a boolean operator (e.g AND, OR) to conditions
    CloudErrorBody:
      type: object
      description: Error details.
      properties:
        code:
          type: string
          description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
          readOnly: true
        message:
          type: string
          description: A message describing the error, intended to be suitable for display in a user interface.
          readOnly: true
    AutomationRulesList:
      type: object
      properties:
        value:
          type: array
          description: List of automation rules.
          items:
            $ref: '#/components/schemas/AutomationRule'
        nextLink:
          type: string
          description: The link to the next page of items
    AutomationRuleTriggeringLogic:
      type: object
      description: Describes automation rule triggering logic.
      properties:
        isEnabled:
          type: boolean
          description: Determines whether the automation rule is enabled or disabled.
        expirationTimeUtc:
          type: string
          format: date-time
          description: Determines when the automation rule should automatically expire and be disabled.
        triggersOn:
          $ref: '#/components/schemas/TriggersOn'
        triggersWhen:
          $ref: '#/components/schemas/TriggersWhen'
        conditions:
          type: array
          description: The conditions to evaluate to determine if the automation rule should be triggered on a given object.
          maxItems: 50
          items:
            $ref: '#/components/schemas/AutomationRuleCondition'
          x-ms-identifiers:
          - conditionType
      required:
      - isEnabled
      - triggersOn
      - triggersWhen
    ClientInfo:
      type: object
      description: Information on the client (user or application) that made some action
      properties:
        email:
          type: string
          description: The email of the client.
        name:
          type: string
          description: The name of the client.
        objectId:
          $ref: '#/components/schemas/Azure.Core.uuid'
          description: The object id of the client.
        userPrincipalName:
          type: string
          description: The user principal name of the client.
    TriggersOn:
      type: string
      enum:
      - Incidents
      - Alerts
      x-ms-enum:
        name: TriggersOn
        modelAsString: true
        values:
        - name: Incidents
          value: Incidents
          description: Trigger on Incidents
        - name: Alerts
          value: Alerts
          description: Trigger on Alerts
    TriggersWhen:
      type: string
      enum:
      - Created
      - Updated
      x-ms-enum:
        name: TriggersWhen
        modelAsString: true
        values:
        - name: Created
          value: Created
          description: Trigger on created objects
        - name: Updated
          value: Updated
          description: Trigger on updated objects
    AutomationRuleCondition:
      type: object
      description: Describes an automation rule condition.
      properties:
        conditionType:
          $ref: '#/components/schemas/ConditionType'
      discriminator:
        propertyName: conditionType
      required:
      - conditionType
    ActionType:
      type: string
      description: The type of the automation rule action.
      enum:
      - ModifyProperties
      - RunPlaybook
      - AddIncidentTask
      x-ms-enum:
        name: ActionType
        modelAsString: true
        values:
        - name: ModifyProperties
          value: ModifyProperties
          description: Modify an object's properties
        - name: RunPlaybook
          value: RunPlaybook
          description: Run a playbook on an object
        - name: AddIncidentTask
          value: AddIncidentTask
          description: Add a task to an incident object
    AutomationRule:
      type: object
      description: Concrete proxy resource types can be created by aliasing this type using a specific property type.
      properties:
        properties:
          $ref: '#/components/schemas/AutomationRuleProperties'
          description: Automation rule properties
          x-ms-client-flatten: true
        etag:
          type: string
          description: Etag of the azure resource
      required:
      - properties
      allOf:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/definitions/ProxyResource
    CloudError:
      type: object
      description: Error response structure.
      properties:
        error:
          $ref: '#/components/schemas/CloudErrorBody'
          description: Error data
    AutomationRuleProperties:
      type: object
      description: Automation rule properties
      properties:
        displayName:
          type: string
          description: The display name of the automation rule.
          maxLength: 500
        order:
          type: integer
          format: int32
          description: The order of execution of the automation rule.
          minimum: 1
          maximum: 1000
        triggeringLogic:
          $ref: '#/components/schemas/AutomationRuleTriggeringLogic'
          description: Describes automation rule triggering logic.
        actions:
          type: array
          description: The actions to execute when the automation rule is triggered.
          maxItems: 20
          items:
            $ref: '#/components/schemas/AutomationRuleAction'
          x-ms-identifiers: []
        lastModifiedTimeUtc:
          type: string
          format: date-time
          description: The last time the automation rule was updated.
          readOnly: true
        createdTimeUtc:
          type: string
          format: date-time
          description: The time the automation rule was created.
          readOnly: true
        lastModifiedBy:
          $ref: '#/components/schemas/ClientInfo'
          description: Information on the client (user or application) that made some action
          readOnly: true
        createdBy:
          $ref: '#/components/schemas/ClientInfo'
          description: Information on the client (user or application) that made some action
          readOnly: true
      required:
      - displayName
      - order
      - triggeringLogic
      - actions
  securitySchemes:
    azure_auth:
      type: oauth2
      flows:
        implicit:
          scopes:
            user_impersonation: impersonate your user account
          authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
      description: Azure Active Directory OAuth2 Flow.
x-refined-from:
- microsoft-sentinel-securityinsights-2025-09-01.json
- microsoft-sentinel-securityinsights-openapi.yml