Microsoft Sentinel Content Packages API

openapi: 3.2.0
info:
  title: Microsoft Sentinel Content Packages API
  version: '2025-09-01'
  x-typespec-generated:
  - emitter: '@azure-tools/typespec-autorest'
  description: 'Operations tagged ContentPackages across 2 of this provider''s published API definitions: microsoft-sentinel-securityinsights-2025-09-01.json, microsoft-sentinel-securityinsights-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://management.azure.com
security:
- azure_auth:
  - user_impersonation
tags:
- name: ContentPackages
paths:
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/contentPackages
  : get:
      operationId: ContentPackages_List
      tags:
      - ContentPackages
      description: Gets all installed packages.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: $filter
        in: query
        description: Filters the results, based on a Boolean condition. Optional.
        required: false
        schema:
          type: string
      - name: $orderby
        in: query
        description: Sorts the results. Optional.
        required: false
        schema:
          type: string
      - name: $search
        in: query
        description: Searches for a substring in the response. Optional.
        required: false
        schema:
          type: string
      - name: $count
        in: query
        description: Instructs the server to return only object count without actual body. Optional.
        required: false
        schema:
          type: boolean
      - name: $top
        in: query
        description: Returns only the first n results. Optional.
        required: false
        schema:
          type: integer
          format: int32
      - name: $skip
        in: query
        description: Used to skip n elements in the OData query (offset). Returns a nextLink to the next page of results if there are any left.
        required: false
        schema:
          type: integer
          format: int32
      - name: $skipToken
        in: query
        description: Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/packageList'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-examples:
        Get all available packages.:
          $ref: ./examples/contentPackages/GetPackages.json
      x-ms-pageable:
        nextLinkName: nextLink
      summary: Content packages list
      x-summary-source: derived
    servers:
    - url: https://management.azure.com
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/contentPackages/{packageId}
  : get:
      operationId: ContentPackages_Get
      tags:
      - ContentPackages
      description: Gets an installed packages by its id.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: packageId
        in: path
        description: package Id
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/packageModel'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-examples:
        Get installed packages by id.:
          $ref: ./examples/contentPackages/GetPackageById.json
      summary: Content packages get
      x-summary-source: derived
    put:
      operationId: ContentPackage_Install
      tags:
      - ContentPackages
      description: Install a package to the workspace.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: packageId
        in: path
        description: package Id
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Resource 'PackageModel' update operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/packageModel'
        '201':
          description: Resource 'PackageModel' create operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/packageModel'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-examples:
        Install a package to the workspace.:
          $ref: ./examples/contentPackages/InstallPackage.json
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/packageModel'
        description: Package installation properties
        required: true
      summary: Content package install
      x-summary-source: derived
    delete:
      operationId: ContentPackage_Uninstall
      tags:
      - ContentPackages
      description: Uninstall a package from the workspace.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: packageId
        in: path
        description: package Id
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Resource deleted successfully.
        '204':
          description: Resource does not exist.
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-examples:
        Uninstall a package from the workspace.:
          $ref: ./examples/contentPackages/UninstallPackage.json
      summary: Content package uninstall
      x-summary-source: derived
    servers:
    - url: https://management.azure.com
components:
  schemas:
    packageProperties:
      type: object
      description: Describes package properties
      allOf:
      - $ref: '#/components/schemas/packageBaseProperties'
    Kind:
      type: string
      description: The kind of content the metadata is for.
      enum:
      - DataConnector
      - DataType
      - Workbook
      - WorkbookTemplate
      - Playbook
      - PlaybookTemplate
      - AnalyticsRuleTemplate
      - AnalyticsRule
      - HuntingQuery
      - InvestigationQuery
      - Parser
      - Watchlist
      - WatchlistTemplate
      - Solution
      - AzureFunction
      - LogicAppsCustomConnector
      - AutomationRule
      - ResourcesDataConnector
      - Notebook
      - Standalone
      - SummaryRule
      x-ms-enum:
        name: Kind
        modelAsString: true
        values:
        - name: DataConnector
          value: DataConnector
          description: DataConnector
        - name: DataType
          value: DataType
          description: DataType
        - name: Workbook
          value: Workbook
          description: Workbook
        - name: WorkbookTemplate
          value: WorkbookTemplate
          description: WorkbookTemplate
        - name: Playbook
          value: Playbook
          description: Playbook
        - name: PlaybookTemplate
          value: PlaybookTemplate
          description: PlaybookTemplate
        - name: AnalyticsRuleTemplate
          value: AnalyticsRuleTemplate
          description: AnalyticsRuleTemplate
        - name: AnalyticsRule
          value: AnalyticsRule
          description: AnalyticsRule
        - name: HuntingQuery
          value: HuntingQuery
          description: HuntingQuery
        - name: InvestigationQuery
          value: InvestigationQuery
          description: InvestigationQuery
        - name: Parser
          value: Parser
          description: Parser
        - name: Watchlist
          value: Watchlist
          description: Watchlist
        - name: WatchlistTemplate
          value: WatchlistTemplate
          description: WatchlistTemplate
        - name: Solution
          value: Solution
          description: Solution
        - name: AzureFunction
          value: AzureFunction
          description: AzureFunction
        - name: LogicAppsCustomConnector
          value: LogicAppsCustomConnector
          description: LogicAppsCustomConnector
        - name: AutomationRule
          value: AutomationRule
          description: AutomationRule
        - name: ResourcesDataConnector
          value: ResourcesDataConnector
          description: ResourcesDataConnector
        - name: Notebook
          value: Notebook
          description: Notebook
        - name: Standalone
          value: Standalone
          description: Standalone
        - name: SummaryRule
          value: SummaryRule
          description: SummaryRule
    packageList:
      type: object
      description: List available packages.
      properties:
        value:
          type: array
          description: The PackageModel items on this page
          items:
            $ref: '#/components/schemas/packageModel'
        nextLink:
          type: string
          format: uri
          description: The link to the next page of items
          readOnly: true
      required:
      - value
    packageModel:
      type: object
      description: Represents a Package in Azure Security Insights.
      properties:
        properties:
          $ref: '#/components/schemas/packageProperties'
          description: package properties
          x-ms-client-flatten: true
        etag:
          type: string
          description: Etag of the azure resource
      allOf:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/definitions/ProxyResource
    SourceKind:
      type: string
      description: Source type of the content
      enum:
      - LocalWorkspace
      - Community
      - Solution
      - SourceRepository
      x-ms-enum:
        name: SourceKind
        modelAsString: true
        values:
        - name: LocalWorkspace
          value: LocalWorkspace
          description: LocalWorkspace
        - name: Community
          value: Community
          description: Community
        - name: Solution
          value: Solution
          description: Solution
        - name: SourceRepository
          value: SourceRepository
          description: SourceRepository
    MetadataDependencyOperator:
      type: string
      description: Operator used for list of dependencies in criteria array.
      enum:
      - AND
      - OR
      x-ms-enum:
        name: MetadataDependencyOperator
        modelAsString: true
        values:
        - name: AND
          value: AND
          description: AND
        - name: OR
          value: OR
          description: OR
    CloudErrorBody:
      type: object
      description: Error details.
      properties:
        code:
          type: string
          description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
          readOnly: true
        message:
          type: string
          description: A message describing the error, intended to be suitable for display in a user interface.
          readOnly: true
    metadataCategories:
      type: object
      description: ies for the solution content item
      properties:
        domains:
          type: array
          description: domain for the solution content item
          items:
            type: string
        verticals:
          type: array
          description: Industry verticals for the solution content item
          items:
            type: string
    packageBaseProperties:
      type: object
      description: Describes package properties
      properties:
        contentId:
          type: string
          description: The content id of the package
        contentProductId:
          type: string
          description: Unique ID for the content. It should be generated based on the contentId, contentKind and the contentVersion of the package
        contentKind:
          $ref: '#/components/schemas/PackageKind'
          description: The package kind
        contentSchemaVersion:
          type: string
          description: The version of the content schema.
        isNew:
          $ref: '#/components/schemas/Flag'
          description: Flag indicates if this is a newly published package.
        isPreview:
          $ref: '#/components/schemas/Flag'
          description: Flag indicates if this package is in preview.
        isFeatured:
          $ref: '#/components/schemas/Flag'
          description: Flag indicates if this package is among the featured list.
        isDeprecated:
          $ref: '#/components/schemas/Flag'
          description: Flag indicates if this template is deprecated
        version:
          type: string
          description: the latest version number of the package
        displayName:
          type: string
          description: The display name of the package
        description:
          type: string
          description: The description of the package
        publisherDisplayName:
          type: string
          description: The publisher display name of the package
        source:
          $ref: '#/components/schemas/metadataSource'
          description: The source of the package
        author:
          $ref: '#/components/schemas/metadataAuthor'
          description: The author of the package
        support:
          $ref: '#/components/schemas/metadataSupport'
          description: The support tier of the package
        dependencies:
          $ref: '#/components/schemas/metadataDependencies'
          description: The support tier of the package
        providers:
          type: array
          description: Providers for the package item
          items:
            type: string
        firstPublishDate:
          type: string
          format: date
          description: first publish date package item
        lastPublishDate:
          type: string
          format: date
          description: last publish date for the package item
        categories:
          $ref: '#/components/schemas/metadataCategories'
          description: The categories of the package
        threatAnalysisTactics:
          type: array
          description: the tactics the resource covers
          items:
            type: string
        threatAnalysisTechniques:
          type: array
          description: the techniques the resource covers, these have to be aligned with the tactics being used
          items:
            type: string
        icon:
          type: string
          description: the icon identifier. this id can later be fetched from the content metadata
    metadataSupport:
      type: object
      description: Support information for the content item.
      properties:
        tier:
          $ref: '#/components/schemas/SupportTier'
          description: Type of support for content item
        name:
          type: string
          description: Name of the support contact. Company or person.
        email:
          type: string
          description: Email of support contact
        link:
          type: string
          description: Link for support help, like to support page to open a ticket etc.
      required:
      - tier
    SupportTier:
      type: string
      description: Type of support for content item
      enum:
      - Microsoft
      - Partner
      - Community
      x-ms-enum:
        name: SupportTier
        modelAsString: true
        values:
        - name: Microsoft
          value: Microsoft
          description: Microsoft
        - name: Partner
          value: Partner
          description: Partner
        - name: Community
          value: Community
          description: Community
    metadataAuthor:
      type: object
      description: Publisher or creator of the content item.
      properties:
        name:
          type: string
          description: Name of the author. Company or person.
        email:
          type: string
          description: Email of author contact
        link:
          type: string
          description: Link for author/vendor page
    metadataDependencies:
      type: object
      description: Dependencies for the content item, what other content items it requires to work.  Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex dependencies.
      properties:
        contentId:
          type: string
          description: Id of the content item we depend on
        kind:
          $ref: '#/components/schemas/Kind'
          description: Type of the content item we depend on
        version:
          type: string
          description: Version of the the content item we depend on.  Can be blank, * or missing to indicate any version fulfills the dependency.  If version does not match our defined numeric format then an exact match is required.
        name:
          type: string
          description: Name of the content item
        operator:
          $ref: '#/components/schemas/MetadataDependencyOperator'
          description: Operator used for list of dependencies in criteria array.
        criteria:
          type: array
          description: This is the list of dependencies we must fulfill, according to the AND/OR operator
          items:
            $ref: '#/components/schemas/metadataDependencies'
          x-ms-identifiers:
          - contentId
    PackageKind:
      type: string
      description: The package kind
      enum:
      - Solution
      - Standalone
      x-ms-enum:
        name: PackageKind
        modelAsString: true
        values:
        - name: Solution
          value: Solution
          description: Solution
        - name: Standalone
          value: Standalone
          description: Standalone
    CloudError:
      type: object
      description: Error response structure.
      properties:
        error:
          $ref: '#/components/schemas/CloudErrorBody'
          description: Error data
    metadataSource:
      type: object
      description: The original source of the content item, where it comes from.
      properties:
        kind:
          $ref: '#/components/schemas/SourceKind'
          description: Source type of the content
        name:
          type: string
          description: Name of the content source.  The repo name, solution name, LA workspace name etc.
        sourceId:
          type: string
          description: ID of the content source.  The solution ID, workspace ID, etc
      required:
      - kind
    Flag:
      type: string
      description: The boolean value the metadata is for.
      enum:
      - 'true'
      - 'false'
      x-ms-enum:
        name: Flag
        modelAsString: true
        values:
        - name: 'true'
          value: 'true'
          description: 'true'
        - name: 'false'
          value: 'false'
          description: 'false'
  securitySchemes:
    azure_auth:
      type: oauth2
      flows:
        implicit:
          scopes:
            user_impersonation: impersonate your user account
          authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
      description: Azure Active Directory OAuth2 Flow.
x-refined-from:
- microsoft-sentinel-securityinsights-2025-09-01.json
- microsoft-sentinel-securityinsights-openapi.yml