Microsoft Sentinel Content Product Templates API

openapi: 3.2.0
info:
  title: Microsoft Sentinel Content Product Templates API
  version: '2025-09-01'
  x-typespec-generated:
  - emitter: '@azure-tools/typespec-autorest'
  description: 'Operations tagged ContentProductTemplates across 2 of this provider''s published API definitions: microsoft-sentinel-securityinsights-2025-09-01.json, microsoft-sentinel-securityinsights-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://management.azure.com
security:
- azure_auth:
  - user_impersonation
tags:
- name: ContentProductTemplates
paths:
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/contentProductTemplates
  : get:
      operationId: ProductTemplates_List
      tags:
      - ContentProductTemplates
      description: Gets all templates in the catalog.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: $filter
        in: query
        description: Filters the results, based on a Boolean condition. Optional.
        required: false
        schema:
          type: string
      - name: $orderby
        in: query
        description: Sorts the results. Optional.
        required: false
        schema:
          type: string
      - name: $search
        in: query
        description: Searches for a substring in the response. Optional.
        required: false
        schema:
          type: string
      - name: $count
        in: query
        description: Instructs the server to return only object count without actual body. Optional.
        required: false
        schema:
          type: boolean
      - name: $top
        in: query
        description: Returns only the first n results. Optional.
        required: false
        schema:
          type: integer
          format: int32
      - name: $skip
        in: query
        description: Used to skip n elements in the OData query (offset). Returns a nextLink to the next page of results if there are any left.
        required: false
        schema:
          type: integer
          format: int32
      - name: $skipToken
        in: query
        description: Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/productTemplateList'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-examples:
        Get all installed templates.:
          $ref: ./examples/contentTemplates/GetProductTemplates.json
      x-ms-pageable:
        nextLinkName: nextLink
      summary: Product templates list
      x-summary-source: derived
    servers:
    - url: https://management.azure.com
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/contentproducttemplates/{templateId}
  : get:
      operationId: ProductTemplate_Get
      tags:
      - ContentProductTemplates
      description: Gets a template by its identifier.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: workspaceName
        in: path
        description: The name of the workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: templateId
        in: path
        description: template Id
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/productTemplateModel'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-examples:
        Get a template.:
          $ref: ./examples/contentTemplates/GetProductTemplateById.json
      summary: Product template get
      x-summary-source: derived
    servers:
    - url: https://management.azure.com
components:
  schemas:
    Kind:
      type: string
      description: The kind of content the metadata is for.
      enum:
      - DataConnector
      - DataType
      - Workbook
      - WorkbookTemplate
      - Playbook
      - PlaybookTemplate
      - AnalyticsRuleTemplate
      - AnalyticsRule
      - HuntingQuery
      - InvestigationQuery
      - Parser
      - Watchlist
      - WatchlistTemplate
      - Solution
      - AzureFunction
      - LogicAppsCustomConnector
      - AutomationRule
      - ResourcesDataConnector
      - Notebook
      - Standalone
      - SummaryRule
      x-ms-enum:
        name: Kind
        modelAsString: true
        values:
        - name: DataConnector
          value: DataConnector
          description: DataConnector
        - name: DataType
          value: DataType
          description: DataType
        - name: Workbook
          value: Workbook
          description: Workbook
        - name: WorkbookTemplate
          value: WorkbookTemplate
          description: WorkbookTemplate
        - name: Playbook
          value: Playbook
          description: Playbook
        - name: PlaybookTemplate
          value: PlaybookTemplate
          description: PlaybookTemplate
        - name: AnalyticsRuleTemplate
          value: AnalyticsRuleTemplate
          description: AnalyticsRuleTemplate
        - name: AnalyticsRule
          value: AnalyticsRule
          description: AnalyticsRule
        - name: HuntingQuery
          value: HuntingQuery
          description: HuntingQuery
        - name: InvestigationQuery
          value: InvestigationQuery
          description: InvestigationQuery
        - name: Parser
          value: Parser
          description: Parser
        - name: Watchlist
          value: Watchlist
          description: Watchlist
        - name: WatchlistTemplate
          value: WatchlistTemplate
          description: WatchlistTemplate
        - name: Solution
          value: Solution
          description: Solution
        - name: AzureFunction
          value: AzureFunction
          description: AzureFunction
        - name: LogicAppsCustomConnector
          value: LogicAppsCustomConnector
          description: LogicAppsCustomConnector
        - name: AutomationRule
          value: AutomationRule
          description: AutomationRule
        - name: ResourcesDataConnector
          value: ResourcesDataConnector
          description: ResourcesDataConnector
        - name: Notebook
          value: Notebook
          description: Notebook
        - name: Standalone
          value: Standalone
          description: Standalone
        - name: SummaryRule
          value: SummaryRule
          description: SummaryRule
    SourceKind:
      type: string
      description: Source type of the content
      enum:
      - LocalWorkspace
      - Community
      - Solution
      - SourceRepository
      x-ms-enum:
        name: SourceKind
        modelAsString: true
        values:
        - name: LocalWorkspace
          value: LocalWorkspace
          description: LocalWorkspace
        - name: Community
          value: Community
          description: Community
        - name: Solution
          value: Solution
          description: Solution
        - name: SourceRepository
          value: SourceRepository
          description: SourceRepository
    MetadataDependencyOperator:
      type: string
      description: Operator used for list of dependencies in criteria array.
      enum:
      - AND
      - OR
      x-ms-enum:
        name: MetadataDependencyOperator
        modelAsString: true
        values:
        - name: AND
          value: AND
          description: AND
        - name: OR
          value: OR
          description: OR
    CloudErrorBody:
      type: object
      description: Error details.
      properties:
        code:
          type: string
          description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
          readOnly: true
        message:
          type: string
          description: A message describing the error, intended to be suitable for display in a user interface.
          readOnly: true
    productTemplateModel:
      type: object
      description: Template resource definition.
      properties:
        properties:
          $ref: '#/components/schemas/productTemplateProperties'
          description: template properties
          x-ms-client-flatten: true
        etag:
          type: string
          description: Etag of the azure resource
      allOf:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/definitions/ProxyResource
    metadataCategories:
      type: object
      description: ies for the solution content item
      properties:
        domains:
          type: array
          description: domain for the solution content item
          items:
            type: string
        verticals:
          type: array
          description: Industry verticals for the solution content item
          items:
            type: string
    metadataSupport:
      type: object
      description: Support information for the content item.
      properties:
        tier:
          $ref: '#/components/schemas/SupportTier'
          description: Type of support for content item
        name:
          type: string
          description: Name of the support contact. Company or person.
        email:
          type: string
          description: Email of support contact
        link:
          type: string
          description: Link for support help, like to support page to open a ticket etc.
      required:
      - tier
    productTemplateProperties:
      type: object
      description: Template property bag.
      properties:
        contentId:
          type: string
          description: Static ID for the content.  Used to identify dependencies and content from solutions or community.  Hard-coded/static for out of the box content and solutions. Dynamic for user-created.  This is the resource name
        contentProductId:
          type: string
          description: Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template
        packageVersion:
          type: string
          description: Version of the package.  Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices.  Can also be any string, but then we cannot guarantee any version checks
        version:
          type: string
          description: Version of the content.  Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices.  Can also be any string, but then we cannot guarantee any version checks
        displayName:
          type: string
          description: The display name of the template
        contentKind:
          $ref: '#/components/schemas/Kind'
          description: The kind of content the template is for.
        source:
          $ref: '#/components/schemas/metadataSource'
          description: Source of the content.  This is where/how it was created.
        author:
          $ref: '#/components/schemas/metadataAuthor'
          description: The creator of the content item.
        support:
          $ref: '#/components/schemas/metadataSupport'
          description: Support information for the template - type, name, contact information
        dependencies:
          $ref: '#/components/schemas/metadataDependencies'
          description: Dependencies for the content item, what other content items it requires to work.  Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
        categories:
          $ref: '#/components/schemas/metadataCategories'
          description: Categories for the item
        providers:
          type: array
          description: Providers for the content item
          items:
            type: string
        firstPublishDate:
          type: string
          format: date
          description: first publish date content item
        lastPublishDate:
          type: string
          format: date
          description: last publish date for the content item
        customVersion:
          type: string
          description: The custom version of the content. A optional free text
        contentSchemaVersion:
          type: string
          description: Schema version of the content. Can be used to distinguish between different flow based on the schema version
        icon:
          type: string
          description: the icon identifier. this id can later be fetched from the content metadata
        threatAnalysisTactics:
          type: array
          description: the tactics the resource covers
          items:
            type: string
        threatAnalysisTechniques:
          type: array
          description: the techniques the resource covers, these have to be aligned with the tactics being used
          items:
            type: string
        previewImages:
          type: array
          description: preview image file names. These will be taken from the solution artifacts
          items:
            type: string
        previewImagesDark:
          type: array
          description: preview image file names. These will be taken from the solution artifacts. used for dark theme support
          items:
            type: string
        packageId:
          type: string
          description: the package Id contains this template
        packageKind:
          $ref: '#/components/schemas/PackageKind'
          description: the packageKind of the package contains this template
        packageName:
          type: string
          description: the name of the package contains this template
        isDeprecated:
          $ref: '#/components/schemas/Flag'
          description: Flag indicates if this template is deprecated
          readOnly: true
        packagedContent:
          description: The json of the ARM template to deploy
    SupportTier:
      type: string
      description: Type of support for content item
      enum:
      - Microsoft
      - Partner
      - Community
      x-ms-enum:
        name: SupportTier
        modelAsString: true
        values:
        - name: Microsoft
          value: Microsoft
          description: Microsoft
        - name: Partner
          value: Partner
          description: Partner
        - name: Community
          value: Community
          description: Community
    CloudError:
      type: object
      description: Error response structure.
      properties:
        error:
          $ref: '#/components/schemas/CloudErrorBody'
          description: Error data
    metadataAuthor:
      type: object
      description: Publisher or creator of the content item.
      properties:
        name:
          type: string
          description: Name of the author. Company or person.
        email:
          type: string
          description: Email of author contact
        link:
          type: string
          description: Link for author/vendor page
    metadataDependencies:
      type: object
      description: Dependencies for the content item, what other content items it requires to work.  Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex dependencies.
      properties:
        contentId:
          type: string
          description: Id of the content item we depend on
        kind:
          $ref: '#/components/schemas/Kind'
          description: Type of the content item we depend on
        version:
          type: string
          description: Version of the the content item we depend on.  Can be blank, * or missing to indicate any version fulfills the dependency.  If version does not match our defined numeric format then an exact match is required.
        name:
          type: string
          description: Name of the content item
        operator:
          $ref: '#/components/schemas/MetadataDependencyOperator'
          description: Operator used for list of dependencies in criteria array.
        criteria:
          type: array
          description: This is the list of dependencies we must fulfill, according to the AND/OR operator
          items:
            $ref: '#/components/schemas/metadataDependencies'
          x-ms-identifiers:
          - contentId
    PackageKind:
      type: string
      description: The package kind
      enum:
      - Solution
      - Standalone
      x-ms-enum:
        name: PackageKind
        modelAsString: true
        values:
        - name: Solution
          value: Solution
          description: Solution
        - name: Standalone
          value: Standalone
          description: Standalone
    productTemplateList:
      type: object
      description: List of all the template.
      properties:
        value:
          type: array
          description: The ProductTemplateModel items on this page
          items:
            $ref: '#/components/schemas/productTemplateModel'
        nextLink:
          type: string
          format: uri
          description: The link to the next page of items
          readOnly: true
      required:
      - value
    metadataSource:
      type: object
      description: The original source of the content item, where it comes from.
      properties:
        kind:
          $ref: '#/components/schemas/SourceKind'
          description: Source type of the content
        name:
          type: string
          description: Name of the content source.  The repo name, solution name, LA workspace name etc.
        sourceId:
          type: string
          description: ID of the content source.  The solution ID, workspace ID, etc
      required:
      - kind
    Flag:
      type: string
      description: The boolean value the metadata is for.
      enum:
      - 'true'
      - 'false'
      x-ms-enum:
        name: Flag
        modelAsString: true
        values:
        - name: 'true'
          value: 'true'
          description: 'true'
        - name: 'false'
          value: 'false'
          description: 'false'
  securitySchemes:
    azure_auth:
      type: oauth2
      flows:
        implicit:
          scopes:
            user_impersonation: impersonate your user account
          authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
      description: Azure Active Directory OAuth2 Flow.
x-refined-from:
- microsoft-sentinel-securityinsights-2025-09-01.json
- microsoft-sentinel-securityinsights-openapi.yml