@azure/arm-securityinsight 1.0.0-beta.1 → 1.0.0-beta.2

package/types/arm-securityinsight.d.ts

@@ -303,6 +303,16 @@ export declare interface ActionsListByAlertRuleOptionalParams extends coreClient
 /** Contains response data for the listByAlertRule operation. */
 export declare type ActionsListByAlertRuleResponse = ActionsList;
 
+/**
+ * Defines values for ActionType. \
+ * {@link KnownActionType} can be used interchangeably with ActionType,
+ *  this enum contains the known values that the service supports.
+ * ### Known values supported by the service
+ * **ModifyProperties**: Modify an object's properties \
+ * **RunPlaybook**: Run a playbook on an object
+ */
+export declare type ActionType = string;
+
 /** Represents Activity entity query. */
 export declare type ActivityCustomEntityQuery = CustomEntityQuery & {
     /** The entity query title */
@@ -639,6 +649,14 @@ export declare type AlertRuleTemplatesListResponse = AlertRuleTemplatesList;
 
 export declare type AlertRuleTemplateUnion = AlertRuleTemplate | MLBehaviorAnalyticsAlertRuleTemplate | FusionAlertRuleTemplate | ThreatIntelligenceAlertRuleTemplate | MicrosoftSecurityIncidentCreationAlertRuleTemplate | ScheduledAlertRuleTemplate | NrtAlertRuleTemplate;
 
+/** Alert rule template with MITRE property bag. */
+export declare type AlertRuleTemplateWithMitreProperties = AlertRuleTemplatePropertiesBase & {
+    /** The tactics of the alert rule */
+    tactics?: AttackTactic[];
+    /** The techniques of the alert rule */
+    techniques?: string[];
+};
+
 export declare type AlertRuleUnion = AlertRule | MLBehaviorAnalyticsAlertRule | FusionAlertRule | ThreatIntelligenceAlertRule | MicrosoftSecurityIncidentCreationAlertRule | ScheduledAlertRule | NrtAlertRule;
 
 /** Alerts data type for data connectors. */
@@ -720,6 +738,8 @@ export declare type ASCDataConnectorProperties = DataConnectorWithAlertsProperti
  * {@link KnownAttackTactic} can be used interchangeably with AttackTactic,
  *  this enum contains the known values that the service supports.
  * ### Known values supported by the service
+ * **Reconnaissance** \
+ * **ResourceDevelopment** \
  * **InitialAccess** \
  * **Execution** \
  * **Persistence** \
@@ -732,61 +752,51 @@ export declare type ASCDataConnectorProperties = DataConnectorWithAlertsProperti
  * **Exfiltration** \
  * **CommandAndControl** \
  * **Impact** \
- * **PreAttack**
+ * **PreAttack** \
+ * **ImpairProcessControl** \
+ * **InhibitResponseFunction**
  */
 export declare type AttackTactic = string;
 
-/** Represents an automation rule. */
 export declare type AutomationRule = ResourceWithEtag & {
-    /** The display name of the automation  rule */
-    displayName?: string;
+    /** The display name of the automation rule */
+    displayName: string;
     /** The order of execution of the automation rule */
-    order?: number;
-    /** The triggering logic of the automation rule */
-    triggeringLogic?: AutomationRuleTriggeringLogic;
+    order: number;
+    /** Describes automation rule triggering logic */
+    triggeringLogic: AutomationRuleTriggeringLogic;
     /** The actions to execute when the automation rule is triggered */
-    actions?: AutomationRuleActionUnion[];
-    /**
-     * The time the automation rule was created
-     * NOTE: This property will not be serialized. It can only be populated by the server.
-     */
-    readonly createdTimeUtc?: Date;
+    actions: AutomationRuleActionUnion[];
     /**
      * The last time the automation rule was updated
      * NOTE: This property will not be serialized. It can only be populated by the server.
      */
     readonly lastModifiedTimeUtc?: Date;
     /**
-     * Describes the client that created the automation rule
+     * The time the automation rule was created
      * NOTE: This property will not be serialized. It can only be populated by the server.
      */
-    readonly createdBy?: ClientInfo;
+    readonly createdTimeUtc?: Date;
     /**
-     * Describes the client that last updated the automation rule
+     * Information on the client (user or application) that made some action
      * NOTE: This property will not be serialized. It can only be populated by the server.
      */
     readonly lastModifiedBy?: ClientInfo;
+    /**
+     * Information on the client (user or application) that made some action
+     * NOTE: This property will not be serialized. It can only be populated by the server.
+     */
+    readonly createdBy?: ClientInfo;
 };
 
 /** Describes an automation rule action */
 export declare interface AutomationRuleAction {
     /** Polymorphic discriminator, which specifies the different types this object can be */
-    actionType: "RunPlaybook" | "ModifyProperties";
-    /** The order of execution of the automation rule action */
+    actionType: "ModifyProperties" | "RunPlaybook";
     order: number;
 }
 
-/**
- * Defines values for AutomationRuleActionType. \
- * {@link KnownAutomationRuleActionType} can be used interchangeably with AutomationRuleActionType,
- *  this enum contains the known values that the service supports.
- * ### Known values supported by the service
- * **ModifyProperties**: Modify an object's properties \
- * **RunPlaybook**: Run a playbook on an object
- */
-export declare type AutomationRuleActionType = string;
-
-export declare type AutomationRuleActionUnion = AutomationRuleAction | AutomationRuleRunPlaybookAction | AutomationRuleModifyPropertiesAction;
+export declare type AutomationRuleActionUnion = AutomationRuleAction | AutomationRuleModifyPropertiesAction | AutomationRuleRunPlaybookAction;
 
 /** Describes an automation rule condition */
 export declare interface AutomationRuleCondition {
@@ -794,43 +804,15 @@ export declare interface AutomationRuleCondition {
     conditionType: "Property";
 }
 
-/**
- * Defines values for AutomationRuleConditionType. \
- * {@link KnownAutomationRuleConditionType} can be used interchangeably with AutomationRuleConditionType,
- *  this enum contains the known values that the service supports.
- * ### Known values supported by the service
- * **Property**: Evaluate an object property value
- */
-export declare type AutomationRuleConditionType = string;
-
-export declare type AutomationRuleConditionUnion = AutomationRuleCondition | AutomationRulePropertyValuesCondition;
+export declare type AutomationRuleConditionUnion = AutomationRuleCondition | PropertyConditionProperties;
 
 /** Describes an automation rule action to modify an object's properties */
 export declare type AutomationRuleModifyPropertiesAction = AutomationRuleAction & {
     /** Polymorphic discriminator, which specifies the different types this object can be */
     actionType: "ModifyProperties";
-    /** The configuration of the modify properties automation rule action */
-    actionConfiguration: AutomationRuleModifyPropertiesActionConfiguration;
+    actionConfiguration?: IncidentPropertiesAction;
 };
 
-/** The configuration of the modify properties automation rule action */
-export declare interface AutomationRuleModifyPropertiesActionConfiguration {
-    /** The reason the incident was closed */
-    classification?: IncidentClassification;
-    /** Describes the reason the incident was closed */
-    classificationComment?: string;
-    /** The classification reason the incident was closed with */
-    classificationReason?: IncidentClassificationReason;
-    /** List of labels to add to the incident */
-    labels?: IncidentLabel[];
-    /** Describes a user that the incident is assigned to */
-    owner?: IncidentOwnerInfo;
-    /** The severity of the incident */
-    severity?: IncidentSeverity;
-    /** The status of the incident */
-    status?: IncidentStatus;
-}
-
 /**
  * Defines values for AutomationRulePropertyConditionSupportedOperator. \
  * {@link KnownAutomationRulePropertyConditionSupportedOperator} can be used interchangeably with AutomationRulePropertyConditionSupportedOperator,
@@ -856,17 +838,19 @@ export declare type AutomationRulePropertyConditionSupportedOperator = string;
  * **IncidentDescription**: The description of the incident \
  * **IncidentSeverity**: The severity of the incident \
  * **IncidentStatus**: The status of the incident \
- * **IncidentTactics**: The tactics of the incident \
  * **IncidentRelatedAnalyticRuleIds**: The related Analytic rule ids of the incident \
+ * **IncidentTactics**: The tactics of the incident \
+ * **IncidentLabel**: The labels of the incident \
  * **IncidentProviderName**: The provider name of the incident \
  * **AccountAadTenantId**: The account Azure Active Directory tenant id \
- * **AccountAadUserId**: The account Azure Active Directory user id. \
+ * **AccountAadUserId**: The account Azure Active Directory user id \
  * **AccountName**: The account name \
  * **AccountNTDomain**: The account NetBIOS domain name \
  * **AccountPUID**: The account Azure Active Directory Passport User ID \
  * **AccountSid**: The account security identifier \
  * **AccountObjectGuid**: The account unique identifier \
  * **AccountUPNSuffix**: The account user principal name suffix \
+ * **AlertProductNames**: The name of the product of the alert \
  * **AzureResourceResourceId**: The Azure resource id \
  * **AzureResourceSubscriptionId**: The Azure resource subscription id \
  * **CloudApplicationAppId**: The cloud application identifier \
@@ -880,7 +864,7 @@ export declare type AutomationRulePropertyConditionSupportedOperator = string;
  * **HostNetBiosName**: The host NetBIOS name \
  * **HostNTDomain**: The host NT domain \
  * **HostOSVersion**: The host operating system \
- * **IoTDeviceId**: The IoT device id \
+ * **IoTDeviceId**: "The IoT device id \
  * **IoTDeviceName**: The IoT device name \
  * **IoTDeviceType**: The IoT device type \
  * **IoTDeviceVendor**: The IoT device vendor \
@@ -907,21 +891,10 @@ export declare type AutomationRulePropertyConditionSupportedOperator = string;
  */
 export declare type AutomationRulePropertyConditionSupportedProperty = string;
 
-/** Describes an automation rule condition that evaluates a property's value */
-export declare type AutomationRulePropertyValuesCondition = AutomationRuleCondition & {
-    /** Polymorphic discriminator, which specifies the different types this object can be */
-    conditionType: "Property";
-    /** The configuration of the automation rule condition */
-    conditionProperties: AutomationRulePropertyValuesConditionProperties;
-};
-
-/** The configuration of the automation rule condition */
-export declare interface AutomationRulePropertyValuesConditionProperties {
-    /** The property to evaluate */
+export declare interface AutomationRulePropertyValuesCondition {
+    /** The property to evaluate in an automation rule property condition */
     propertyName?: AutomationRulePropertyConditionSupportedProperty;
-    /** The operator to use for evaluation the condition */
     operator?: AutomationRulePropertyConditionSupportedOperator;
-    /** The values to use for evaluating the condition */
     propertyValues?: string[];
 }
 
@@ -929,18 +902,9 @@ export declare interface AutomationRulePropertyValuesConditionProperties {
 export declare type AutomationRuleRunPlaybookAction = AutomationRuleAction & {
     /** Polymorphic discriminator, which specifies the different types this object can be */
     actionType: "RunPlaybook";
-    /** The configuration of the run playbook automation rule action */
-    actionConfiguration: AutomationRuleRunPlaybookActionConfiguration;
+    actionConfiguration?: PlaybookActionProperties;
 };
 
-/** The configuration of the run playbook automation rule action */
-export declare interface AutomationRuleRunPlaybookActionConfiguration {
-    /** The resource id of the playbook resource */
-    logicAppResourceId?: string;
-    /** The tenant id of the playbook resource */
-    tenantId?: string;
-}
-
 /** Interface representing a AutomationRules. */
 export declare interface AutomationRules {
     /**
@@ -963,10 +927,9 @@ export declare interface AutomationRules {
      * @param resourceGroupName The name of the resource group. The name is case insensitive.
      * @param workspaceName The name of the workspace.
      * @param automationRuleId Automation rule ID
-     * @param automationRule The automation rule
      * @param options The options parameters.
      */
-    createOrUpdate(resourceGroupName: string, workspaceName: string, automationRuleId: string, automationRule: AutomationRule, options?: AutomationRulesCreateOrUpdateOptionalParams): Promise<AutomationRulesCreateOrUpdateResponse>;
+    createOrUpdate(resourceGroupName: string, workspaceName: string, automationRuleId: string, options?: AutomationRulesCreateOrUpdateOptionalParams): Promise<AutomationRulesCreateOrUpdateResponse>;
     /**
      * Delete the automation rule.
      * @param resourceGroupName The name of the resource group. The name is case insensitive.
@@ -974,11 +937,13 @@ export declare interface AutomationRules {
      * @param automationRuleId Automation rule ID
      * @param options The options parameters.
      */
-    delete(resourceGroupName: string, workspaceName: string, automationRuleId: string, options?: AutomationRulesDeleteOptionalParams): Promise<void>;
+    delete(resourceGroupName: string, workspaceName: string, automationRuleId: string, options?: AutomationRulesDeleteOptionalParams): Promise<AutomationRulesDeleteResponse>;
 }
 
 /** Optional parameters. */
 export declare interface AutomationRulesCreateOrUpdateOptionalParams extends coreClient.OperationOptions {
+    /** The automation rule */
+    automationRuleToUpsert?: AutomationRule;
 }
 
 /** Contains response data for the createOrUpdate operation. */
@@ -988,6 +953,9 @@ export declare type AutomationRulesCreateOrUpdateResponse = AutomationRule;
 export declare interface AutomationRulesDeleteOptionalParams extends coreClient.OperationOptions {
 }
 
+/** Contains response data for the delete operation. */
+export declare type AutomationRulesDeleteResponse = Record<string, unknown>;
+
 /** Optional parameters. */
 export declare interface AutomationRulesGetOptionalParams extends coreClient.OperationOptions {
 }
@@ -995,15 +963,9 @@ export declare interface AutomationRulesGetOptionalParams extends coreClient.Ope
 /** Contains response data for the get operation. */
 export declare type AutomationRulesGetResponse = AutomationRule;
 
-/** List all the automation rules. */
 export declare interface AutomationRulesList {
-    /**
-     * URL to fetch the next set of automation rules.
-     * NOTE: This property will not be serialized. It can only be populated by the server.
-     */
-    readonly nextLink?: string;
-    /** Array of automation rules. */
-    value: AutomationRule[];
+    value?: AutomationRule[];
+    nextLink?: string;
 }
 
 /** Optional parameters. */
@@ -1022,13 +984,11 @@ export declare type AutomationRulesListResponse = AutomationRulesList;
 
 /** Describes automation rule triggering logic */
 export declare interface AutomationRuleTriggeringLogic {
-    /** Determines whether the automation rule is enabled or disabled. */
+    /** Determines whether the automation rule is enabled or disabled */
     isEnabled: boolean;
     /** Determines when the automation rule should automatically expire and be disabled. */
     expirationTimeUtc?: Date;
-    /** The type of object the automation rule triggers on */
     triggersOn: TriggersOn;
-    /** The type of event the automation rule triggers on */
     triggersWhen: TriggersWhen;
     /** The conditions to evaluate to determine if the automation rule should be triggered on a given object */
     conditions?: AutomationRuleConditionUnion[];
@@ -1037,7 +997,7 @@ export declare interface AutomationRuleTriggeringLogic {
 /** Connector Availability Status */
 export declare interface Availability {
     /** The connector Availability Status */
-    status?: "1";
+    status?: 1;
     /** Set connector as preview */
     isPreview?: boolean;
 }
@@ -1092,6 +1052,14 @@ export declare interface AwsS3DataConnectorDataTypes {
 /** Logs data type. */
 export declare type AwsS3DataConnectorDataTypesLogs = DataConnectorDataTypeCommon & {};
 
+/** Resources created in Azure DevOps repository. */
+export declare interface AzureDevOpsResourceInfo {
+    /** Id of the pipeline created for the source-control. */
+    pipelineId?: string;
+    /** Id of the service-connection created for the source-control. */
+    serviceConnectionId?: string;
+}
+
 /** Represents an azure resource entity. */
 export declare type AzureResourceEntity = Entity & {
     /**
@@ -1160,8 +1128,22 @@ export declare type Bookmark = ResourceWithEtag & {
     queryEndTime?: Date;
     /** Describes an incident that relates to bookmark */
     incidentInfo?: IncidentInfo;
+    /** Describes the entity mappings of the bookmark */
+    entityMappings?: BookmarkEntityMappings[];
+    /** A list of relevant mitre attacks */
+    tactics?: AttackTactic[];
+    /** A list of relevant mitre techniques */
+    techniques?: string[];
 };
 
+/** Describes the entity mappings of a single entity */
+export declare interface BookmarkEntityMappings {
+    /** The entity type */
+    entityType?: string;
+    /** Array of fields mapping for that entity type */
+    fieldMappings?: EntityFieldMapping[];
+}
+
 /** Contains response data for the expand operation. */
 export declare type BookmarkExpandOperationResponse = BookmarkExpandResponse;
 
@@ -1198,7 +1180,7 @@ export declare interface BookmarkExpandResponseValue {
 /** List all the bookmarks. */
 export declare interface BookmarkList {
     /**
-     * URL to fetch the next set of cases.
+     * URL to fetch the next set of bookmarks.
      * NOTE: This property will not be serialized. It can only be populated by the server.
      */
     readonly nextLink?: string;
@@ -1637,6 +1619,15 @@ export declare type CodelessUiDataConnector = DataConnector & {
     connectorUiConfig?: CodelessUiConnectorConfigProperties;
 };
 
+/**
+ * Defines values for ConditionType. \
+ * {@link KnownConditionType} can be used interchangeably with ConditionType,
+ *  this enum contains the known values that the service supports.
+ * ### Known values supported by the service
+ * **Property**: Evaluate an object property value
+ */
+export declare type ConditionType = string;
+
 /**
  * Defines values for ConfidenceLevel. \
  * {@link KnownConfidenceLevel} can be used interchangeably with ConfidenceLevel,
@@ -1816,6 +1807,8 @@ export declare interface DataConnectorDataTypeCommon {
  * **Office365** \
  * **OfficeATP** \
  * **OfficeIRM** \
+ * **Office365Project** \
+ * **OfficePowerBI** \
  * **AmazonWebServicesCloudTrail** \
  * **AmazonWebServicesS3** \
  * **AzureAdvancedThreatProtection** \
@@ -1824,7 +1817,8 @@ export declare interface DataConnectorDataTypeCommon {
  * **MicrosoftThreatProtection** \
  * **MicrosoftThreatIntelligence** \
  * **GenericUI** \
- * **APIPolling**
+ * **APIPolling** \
+ * **IOT**
  */
 export declare type DataConnectorKind = string;
 
@@ -1914,7 +1908,7 @@ export declare interface DataConnectors {
 /** Data connector requirements properties. */
 export declare interface DataConnectorsCheckRequirements {
     /** Polymorphic discriminator, which specifies the different types this object can be */
-    kind: "AzureActiveDirectory" | "AzureAdvancedThreatProtection" | "AzureSecurityCenter" | "AmazonWebServicesCloudTrail" | "AmazonWebServicesS3" | "Dynamics365" | "MicrosoftCloudAppSecurity" | "MicrosoftDefenderAdvancedThreatProtection" | "MicrosoftThreatIntelligence" | "MicrosoftThreatProtection" | "OfficeATP" | "OfficeIRM" | "ThreatIntelligence" | "ThreatIntelligenceTaxii";
+    kind: "AzureActiveDirectory" | "AzureAdvancedThreatProtection" | "AzureSecurityCenter" | "AmazonWebServicesCloudTrail" | "AmazonWebServicesS3" | "Dynamics365" | "MicrosoftCloudAppSecurity" | "MicrosoftDefenderAdvancedThreatProtection" | "MicrosoftThreatIntelligence" | "MicrosoftThreatProtection" | "OfficeATP" | "OfficeIRM" | "Office365Project" | "OfficePowerBI" | "ThreatIntelligence" | "ThreatIntelligenceTaxii" | "IOT";
 }
 
 /** Interface representing a DataConnectorsCheckRequirementsOperations. */
@@ -1936,7 +1930,7 @@ export declare interface DataConnectorsCheckRequirementsPostOptionalParams exten
 /** Contains response data for the post operation. */
 export declare type DataConnectorsCheckRequirementsPostResponse = DataConnectorRequirementsState;
 
-export declare type DataConnectorsCheckRequirementsUnion = DataConnectorsCheckRequirements | AADCheckRequirements | AatpCheckRequirements | ASCCheckRequirements | AwsCloudTrailCheckRequirements | AwsS3CheckRequirements | Dynamics365CheckRequirements | McasCheckRequirements | MdatpCheckRequirements | MstiCheckRequirements | MtpCheckRequirements | OfficeATPCheckRequirements | OfficeIRMCheckRequirements | TICheckRequirements | TiTaxiiCheckRequirements;
+export declare type DataConnectorsCheckRequirementsUnion = DataConnectorsCheckRequirements | AADCheckRequirements | AatpCheckRequirements | ASCCheckRequirements | AwsCloudTrailCheckRequirements | AwsS3CheckRequirements | Dynamics365CheckRequirements | McasCheckRequirements | MdatpCheckRequirements | MstiCheckRequirements | MtpCheckRequirements | OfficeATPCheckRequirements | OfficeIRMCheckRequirements | Office365ProjectCheckRequirements | OfficePowerBICheckRequirements | TICheckRequirements | TiTaxiiCheckRequirements | IoTCheckRequirements;
 
 /** Optional parameters. */
 export declare interface DataConnectorsConnectOptionalParams extends coreClient.OperationOptions {
@@ -1984,7 +1978,7 @@ export declare interface DataConnectorTenantId {
     tenantId: string;
 }
 
-export declare type DataConnectorUnion = DataConnector | AADDataConnector | MstiDataConnector | MTPDataConnector | AatpDataConnector | ASCDataConnector | AwsCloudTrailDataConnector | AwsS3DataConnector | McasDataConnector | Dynamics365DataConnector | OfficeATPDataConnector | OfficeIRMDataConnector | MdatpDataConnector | OfficeDataConnector | TIDataConnector | TiTaxiiDataConnector | CodelessUiDataConnector | CodelessApiPollingDataConnector;
+export declare type DataConnectorUnion = DataConnector | AADDataConnector | MstiDataConnector | MTPDataConnector | AatpDataConnector | ASCDataConnector | AwsCloudTrailDataConnector | AwsS3DataConnector | McasDataConnector | Dynamics365DataConnector | OfficeATPDataConnector | Office365ProjectDataConnector | OfficePowerBIDataConnector | OfficeIRMDataConnector | MdatpDataConnector | OfficeDataConnector | TIDataConnector | TiTaxiiDataConnector | IoTDataConnector | CodelessUiDataConnector | CodelessApiPollingDataConnector;
 
 /** Data connector properties. */
 export declare interface DataConnectorWithAlertsProperties {
@@ -2014,6 +2008,64 @@ export declare type DeliveryAction = "Unknown" | "DeliveredAsSpam" | "Delivered"
 /** Defines values for DeliveryLocation. */
 export declare type DeliveryLocation = "Unknown" | "Inbox" | "JunkFolder" | "DeletedFolder" | "Quarantine" | "External" | "Failed" | "Dropped" | "Forwarded";
 
+/** Description about a deployment. */
+export declare interface Deployment {
+    /** Deployment identifier. */
+    deploymentId?: string;
+    /** Current status of the deployment. */
+    deploymentState?: DeploymentState;
+    /** The outcome of the deployment. */
+    deploymentResult?: DeploymentResult;
+    /** The time when the deployment finished. */
+    deploymentTime?: Date;
+    /** Url to access repository action logs. */
+    deploymentLogsUrl?: string;
+}
+
+/**
+ * Defines values for DeploymentFetchStatus. \
+ * {@link KnownDeploymentFetchStatus} can be used interchangeably with DeploymentFetchStatus,
+ *  this enum contains the known values that the service supports.
+ * ### Known values supported by the service
+ * **Success** \
+ * **Unauthorized** \
+ * **NotFound**
+ */
+export declare type DeploymentFetchStatus = string;
+
+/** Information regarding a deployment. */
+export declare interface DeploymentInfo {
+    /** Status while fetching the last deployment. */
+    deploymentFetchStatus?: DeploymentFetchStatus;
+    /** Deployment information. */
+    deployment?: Deployment;
+    /** Additional details about the deployment that can be shown to the user. */
+    message?: string;
+}
+
+/**
+ * Defines values for DeploymentResult. \
+ * {@link KnownDeploymentResult} can be used interchangeably with DeploymentResult,
+ *  this enum contains the known values that the service supports.
+ * ### Known values supported by the service
+ * **Success** \
+ * **Canceled** \
+ * **Failed**
+ */
+export declare type DeploymentResult = string;
+
+/**
+ * Defines values for DeploymentState. \
+ * {@link KnownDeploymentState} can be used interchangeably with DeploymentState,
+ *  this enum contains the known values that the service supports.
+ * ### Known values supported by the service
+ * **In_Progress** \
+ * **Completed** \
+ * **Queued** \
+ * **Canceling**
+ */
+export declare type DeploymentState = string;
+
 /** Represents a dns entity. */
 export declare type DnsEntity = Entity & {
     /**
@@ -2464,6 +2516,14 @@ export declare interface EntityExpandResponseValue {
     edges?: EntityEdges[];
 }
 
+/** Map identifiers of a single entity */
+export declare interface EntityFieldMapping {
+    /** Alert V3 identifier */
+    identifier?: string;
+    /** The value of the identifier */
+    value?: string;
+}
+
 /** The parameters required to execute insights operation on the given entity. */
 export declare interface EntityGetInsightsParameters {
     /** The start timeline date, so the results returned are after this date. */
@@ -2644,7 +2704,7 @@ export declare type EntityQueriesGetResponse = EntityQueryUnion;
 /** Optional parameters. */
 export declare interface EntityQueriesListNextOptionalParams extends coreClient.OperationOptions {
     /** The entity query kind we want to fetch */
-    kind?: Enum8;
+    kind?: Enum12;
 }
 
 /** Contains response data for the listNext operation. */
@@ -2653,7 +2713,7 @@ export declare type EntityQueriesListNextResponse = EntityQueryList;
 /** Optional parameters. */
 export declare interface EntityQueriesListOptionalParams extends coreClient.OperationOptions {
     /** The entity query kind we want to fetch */
-    kind?: Enum8;
+    kind?: Enum12;
 }
 
 /** Contains response data for the list operation. */
@@ -2882,63 +2942,14 @@ export declare type EntityType = string;
 export declare type EntityUnion = Entity | SecurityAlert | HuntingBookmark | AccountEntity | AzureResourceEntity | CloudApplicationEntity | DnsEntity | FileEntity | FileHashEntity | HostEntity | IoTDeviceEntity | IpEntity | MailboxEntity | MailClusterEntity | MailMessageEntity | MalwareEntity | ProcessEntity | RegistryKeyEntity | RegistryValueEntity | SecurityGroupEntity | SubmissionMailEntity | UrlEntity;
 
 /**
- * Defines values for Enum8. \
- * {@link KnownEnum8} can be used interchangeably with Enum8,
+ * Defines values for Enum12. \
+ * {@link KnownEnum12} can be used interchangeably with Enum12,
  *  this enum contains the known values that the service supports.
  * ### Known values supported by the service
  * **Expansion** \
  * **Activity**
  */
-export declare type Enum8 = string;
-
-/** The resource management error additional info. */
-export declare interface ErrorAdditionalInfo {
-    /**
-     * The additional info type.
-     * NOTE: This property will not be serialized. It can only be populated by the server.
-     */
-    readonly type?: string;
-    /**
-     * The additional info.
-     * NOTE: This property will not be serialized. It can only be populated by the server.
-     */
-    readonly info?: Record<string, unknown>;
-}
-
-/** The error detail. */
-export declare interface ErrorDetail {
-    /**
-     * The error code.
-     * NOTE: This property will not be serialized. It can only be populated by the server.
-     */
-    readonly code?: string;
-    /**
-     * The error message.
-     * NOTE: This property will not be serialized. It can only be populated by the server.
-     */
-    readonly message?: string;
-    /**
-     * The error target.
-     * NOTE: This property will not be serialized. It can only be populated by the server.
-     */
-    readonly target?: string;
-    /**
-     * The error details.
-     * NOTE: This property will not be serialized. It can only be populated by the server.
-     */
-    readonly details?: ErrorDetail[];
-    /**
-     * The error additional info.
-     * NOTE: This property will not be serialized. It can only be populated by the server.
-     */
-    readonly additionalInfo?: ErrorAdditionalInfo[];
-}
-
-/** Common error response for all Azure Resource Manager APIs to return error details for failed operations. (This also follows the OData error response format.). */
-export declare interface ErrorResponse {
-    /** The error object. */
-    error?: ErrorDetail;
-}
+export declare type Enum12 = string;
 
 /**
  * Defines values for EventGroupingAggregationKind. \
@@ -3136,6 +3147,10 @@ export declare type FusionAlertRule = AlertRule & {
     readonly displayName?: string;
     /** Determines whether this alert rule is enabled or disabled. */
     enabled?: boolean;
+    /** Configuration for all supported source signals in fusion detection. */
+    sourceSettings?: FusionSourceSettings[];
+    /** Configuration to exclude scenarios in fusion detection. */
+    scenarioExclusionPatterns?: FusionScenarioExclusionPattern[];
     /**
      * The last time that this alert has been modified.
      * NOTE: This property will not be serialized. It can only be populated by the server.
@@ -3151,6 +3166,11 @@ export declare type FusionAlertRule = AlertRule & {
      * NOTE: This property will not be serialized. It can only be populated by the server.
      */
     readonly tactics?: AttackTactic[];
+    /**
+     * The techniques of the alert rule
+     * NOTE: This property will not be serialized. It can only be populated by the server.
+     */
+    readonly techniques?: string[];
 };
 
 /** Represents Fusion alert rule template. */
@@ -3158,20 +3178,20 @@ export declare type FusionAlertRuleTemplate = AlertRuleTemplate & {
     /** the number of alert rules that were created by this template */
     alertRulesCreatedByTemplateCount?: number;
     /**
-     * The last time that this alert rule template has been updated.
+     * The time that this alert rule template has been added.
      * NOTE: This property will not be serialized. It can only be populated by the server.
      */
-    readonly lastUpdatedDateUTC?: Date;
+    readonly createdDateUTC?: Date;
     /**
-     * The time that this alert rule template has been added.
+     * The time that this alert rule template was last updated.
      * NOTE: This property will not be serialized. It can only be populated by the server.
      */
-    readonly createdDateUTC?: Date;
+    readonly lastUpdatedDateUTC?: Date;
     /** The description of the alert rule template. */
     description?: string;
     /** The display name for alert rule template. */
     displayName?: string;
-    /** The required data sources for this template */
+    /** The required data connectors for this template */
     requiredDataConnectors?: AlertRuleTemplateDataSource[];
     /** The alert rule template status. */
     status?: TemplateStatus;
@@ -3179,15 +3199,92 @@ export declare type FusionAlertRuleTemplate = AlertRuleTemplate & {
     severity?: AlertSeverity;
     /** The tactics of the alert rule template */
     tactics?: AttackTactic[];
+    /** The techniques of the alert rule */
+    techniques?: string[];
+    /** All supported source signal configurations consumed in fusion detection. */
+    sourceSettings?: FusionTemplateSourceSetting[];
 };
 
-/** Fusion alert rule template properties */
-export declare type FusionAlertRuleTemplateProperties = AlertRuleTemplatePropertiesBase & {
-    /** The severity for alerts created by this alert rule. */
+/** Represents a Fusion scenario exclusion patterns in Fusion detection. */
+export declare interface FusionScenarioExclusionPattern {
+    /** Scenario exclusion pattern. */
+    exclusionPattern: string;
+    /** DateTime when scenario exclusion pattern is added in UTC. */
+    dateAddedInUTC: string;
+}
+
+/** Represents a supported source signal configuration in Fusion detection. */
+export declare interface FusionSourceSettings {
+    /** Determines whether this source signal is enabled or disabled in Fusion detection. */
+    enabled: boolean;
+    /** Name of the Fusion source signal. Refer to Fusion alert rule template for supported values. */
+    sourceName: string;
+    /** Configuration for all source subtypes under this source signal consumed in fusion detection. */
+    sourceSubTypes?: FusionSourceSubTypeSetting[];
+}
+
+/** Represents a supported source subtype configuration under a source signal in Fusion detection. */
+export declare interface FusionSourceSubTypeSetting {
+    /** Determines whether this source subtype under source signal is enabled or disabled in Fusion detection. */
+    enabled: boolean;
+    /** The Name of the source subtype under a given source signal in Fusion detection. Refer to Fusion alert rule template for supported values. */
+    sourceSubTypeName: string;
+    /**
+     * The display name of source subtype under a source signal consumed in Fusion detection.
+     * NOTE: This property will not be serialized. It can only be populated by the server.
+     */
+    readonly sourceSubTypeDisplayName?: string;
+    /** Severity configuration for a source subtype consumed in fusion detection. */
+    severityFilters: FusionSubTypeSeverityFilter;
+}
+
+/** Represents severity configuration for a source subtype consumed in Fusion detection. */
+export declare interface FusionSubTypeSeverityFilter {
+    /**
+     * Determines whether this source subtype supports severity configuration or not.
+     * NOTE: This property will not be serialized. It can only be populated by the server.
+     */
+    readonly isSupported?: boolean;
+    /** Individual Severity configuration settings for a given source subtype consumed in Fusion detection. */
+    filters?: FusionSubTypeSeverityFiltersItem[];
+}
+
+/** Represents a Severity filter setting for a given source subtype consumed in Fusion detection. */
+export declare interface FusionSubTypeSeverityFiltersItem {
+    /** The Severity for a given source subtype consumed in Fusion detection. */
     severity: AlertSeverity;
-    /** The tactics of the alert rule template */
-    tactics?: AttackTactic[];
-};
+    /** Determines whether this severity is enabled or disabled for this source subtype consumed in Fusion detection. */
+    enabled: boolean;
+}
+
+/** Represents a source signal consumed in Fusion detection. */
+export declare interface FusionTemplateSourceSetting {
+    /** The name of a source signal consumed in Fusion detection. */
+    sourceName: string;
+    /** All supported source subtypes under this source signal consumed in fusion detection. */
+    sourceSubTypes?: FusionTemplateSourceSubType[];
+}
+
+/** Represents a source subtype under a source signal consumed in Fusion detection. */
+export declare interface FusionTemplateSourceSubType {
+    /** The name of source subtype under a source signal consumed in Fusion detection. */
+    sourceSubTypeName: string;
+    /**
+     * The display name of source subtype under a source signal consumed in Fusion detection.
+     * NOTE: This property will not be serialized. It can only be populated by the server.
+     */
+    readonly sourceSubTypeDisplayName?: string;
+    /** Severity configuration available for a source subtype consumed in fusion detection. */
+    severityFilter: FusionTemplateSubTypeSeverityFilter;
+}
+
+/** Represents severity configurations available for a source subtype consumed in Fusion detection. */
+export declare interface FusionTemplateSubTypeSeverityFilter {
+    /** Determines whether severity configuration is supported for this source subtype consumed in Fusion detection. */
+    isSupported: boolean;
+    /** List of all supported severities for this source subtype consumed in Fusion detection. */
+    severityFilters?: AlertSeverity[];
+}
 
 /** The geo-location context attached to the ip entity */
 export declare interface GeoLocation {
@@ -3252,6 +3349,12 @@ export declare interface GetQueriesResponse {
     value?: EntityQueryItemUnion[];
 }
 
+/** Resources created in GitHub repository. */
+export declare interface GitHubResourceInfo {
+    /** GitHub application installation id. */
+    appInstallationId?: string;
+}
+
 /** The graph query to show the current data status */
 export declare interface GraphQueries {
     /** the metric that the query is checking */
@@ -3532,11 +3635,21 @@ export declare interface IncidentAdditionalData {
      * NOTE: This property will not be serialized. It can only be populated by the server.
      */
     readonly alertProductNames?: string[];
+    /**
+     * The provider incident url to the incident in Microsoft 365 Defender portal
+     * NOTE: This property will not be serialized. It can only be populated by the server.
+     */
+    readonly providerIncidentUrl?: string;
     /**
      * The tactics associated with incident
      * NOTE: This property will not be serialized. It can only be populated by the server.
      */
     readonly tactics?: AttackTactic[];
+    /**
+     * The techniques associated with incident's tactics'
+     * NOTE: This property will not be serialized. It can only be populated by the server.
+     */
+    readonly techniques?: string[];
 }
 
 /** List of incident alerts. */
@@ -3748,7 +3861,7 @@ export declare interface IncidentLabel {
  *  this enum contains the known values that the service supports.
  * ### Known values supported by the service
  * **User**: Label manually created by a user \
- * **System**: Label automatically created by the system
+ * **AutoAssigned**: Label automatically created by the system
  */
 export declare type IncidentLabelType = string;
 
@@ -3780,6 +3893,23 @@ export declare interface IncidentOwnerInfo {
     readonly ownerType?: OwnerType;
 }
 
+export declare interface IncidentPropertiesAction {
+    /** The severity of the incident */
+    severity?: IncidentSeverity;
+    /** The status of the incident */
+    status?: IncidentStatus;
+    /** The reason the incident was closed */
+    classification?: IncidentClassification;
+    /** The classification reason the incident was closed with */
+    classificationReason?: IncidentClassificationReason;
+    /** Describes the reason the incident was closed */
+    classificationComment?: string;
+    /** Information on the user an incident is assigned to */
+    owner?: IncidentOwnerInfo;
+    /** List of labels to add to the incident */
+    labels?: IncidentLabel[];
+}
+
 /** Interface representing a IncidentRelations. */
 export declare interface IncidentRelations {
     /**
@@ -3877,6 +4007,14 @@ export declare interface Incidents {
      * @param options The options parameters.
      */
     list(resourceGroupName: string, workspaceName: string, options?: IncidentsListOptionalParams): PagedAsyncIterableIterator<Incident>;
+    /**
+     * Triggers playbook on a specific incident
+     * @param resourceGroupName The name of the resource group. The name is case insensitive.
+     * @param workspaceName The name of the workspace.
+     * @param incidentIdentifier
+     * @param options The options parameters.
+     */
+    runPlaybook(resourceGroupName: string, workspaceName: string, incidentIdentifier: string, options?: IncidentsRunPlaybookOptionalParams): Promise<IncidentsRunPlaybookResponse>;
     /**
      * Gets an incident.
      * @param resourceGroupName The name of the resource group. The name is case insensitive.
@@ -4026,6 +4164,14 @@ export declare interface IncidentsListOptionalParams extends coreClient.Operatio
 /** Contains response data for the list operation. */
 export declare type IncidentsListResponse = IncidentList;
 
+/** Optional parameters. */
+export declare interface IncidentsRunPlaybookOptionalParams extends coreClient.OperationOptions {
+    requestBody?: ManualTriggerRequestBody;
+}
+
+/** Contains response data for the runPlaybook operation. */
+export declare type IncidentsRunPlaybookResponse = Record<string, unknown>;
+
 /**
  * Defines values for IncidentStatus. \
  * {@link KnownIncidentStatus} can be used interchangeably with IncidentStatus,
@@ -4149,6 +4295,28 @@ export declare interface InstructionSteps {
 
 export declare type InstructionStepsInstructionsItem = ConnectorInstructionModelBase & {};
 
+/** Represents IoT requirements check request. */
+export declare type IoTCheckRequirements = DataConnectorsCheckRequirements & {
+    /** Polymorphic discriminator, which specifies the different types this object can be */
+    kind: "IOT";
+    /** The subscription id to connect to, and get the data from. */
+    subscriptionId?: string;
+};
+
+/** Represents IoT data connector. */
+export declare type IoTDataConnector = DataConnector & {
+    /** The available data types for the connector. */
+    dataTypes?: AlertsDataTypeOfDataConnector;
+    /** The subscription id to connect to, and get the data from. */
+    subscriptionId?: string;
+};
+
+/** IoT data connector properties. */
+export declare type IoTDataConnectorProperties = DataConnectorWithAlertsProperties & {
+    /** The subscription id to connect to, and get the data from. */
+    subscriptionId?: string;
+};
+
 /** Represents an IoT device entity. */
 export declare type IoTDeviceEntity = Entity & {
     /**
@@ -4447,10 +4615,21 @@ export declare type KillChainIntent = string;
  * **Parser** \
  * **Watchlist** \
  * **WatchlistTemplate** \
- * **Solution**
+ * **Solution** \
+ * **AzureFunction** \
+ * **LogicAppsCustomConnector** \
+ * **AutomationRule**
  */
 export declare type Kind = string;
 
+/** Known values of {@link ActionType} that the service accepts. */
+export declare enum KnownActionType {
+    /** Modify an object's properties */
+    ModifyProperties = "ModifyProperties",
+    /** Run a playbook on an object */
+    RunPlaybook = "RunPlaybook"
+}
+
 /** Known values of {@link AlertDetail} that the service accepts. */
 export declare enum KnownAlertDetail {
     /** Alert display name */
@@ -4509,6 +4688,8 @@ export declare enum KnownAntispamMailDirection {
 
 /** Known values of {@link AttackTactic} that the service accepts. */
 export declare enum KnownAttackTactic {
+    Reconnaissance = "Reconnaissance",
+    ResourceDevelopment = "ResourceDevelopment",
     InitialAccess = "InitialAccess",
     Execution = "Execution",
     Persistence = "Persistence",
@@ -4521,21 +4702,9 @@ export declare enum KnownAttackTactic {
     Exfiltration = "Exfiltration",
     CommandAndControl = "CommandAndControl",
     Impact = "Impact",
-    PreAttack = "PreAttack"
-}
-
-/** Known values of {@link AutomationRuleActionType} that the service accepts. */
-export declare enum KnownAutomationRuleActionType {
-    /** Modify an object's properties */
-    ModifyProperties = "ModifyProperties",
-    /** Run a playbook on an object */
-    RunPlaybook = "RunPlaybook"
-}
-
-/** Known values of {@link AutomationRuleConditionType} that the service accepts. */
-export declare enum KnownAutomationRuleConditionType {
-    /** Evaluate an object property value */
-    Property = "Property"
+    PreAttack = "PreAttack",
+    ImpairProcessControl = "ImpairProcessControl",
+    InhibitResponseFunction = "InhibitResponseFunction"
 }
 
 /** Known values of {@link AutomationRulePropertyConditionSupportedOperator} that the service accepts. */
@@ -4568,15 +4737,17 @@ export declare enum KnownAutomationRulePropertyConditionSupportedProperty {
     IncidentSeverity = "IncidentSeverity",
     /** The status of the incident */
     IncidentStatus = "IncidentStatus",
-    /** The tactics of the incident */
-    IncidentTactics = "IncidentTactics",
     /** The related Analytic rule ids of the incident */
     IncidentRelatedAnalyticRuleIds = "IncidentRelatedAnalyticRuleIds",
+    /** The tactics of the incident */
+    IncidentTactics = "IncidentTactics",
+    /** The labels of the incident */
+    IncidentLabel = "IncidentLabel",
     /** The provider name of the incident */
     IncidentProviderName = "IncidentProviderName",
     /** The account Azure Active Directory tenant id */
     AccountAadTenantId = "AccountAadTenantId",
-    /** The account Azure Active Directory user id. */
+    /** The account Azure Active Directory user id */
     AccountAadUserId = "AccountAadUserId",
     /** The account name */
     AccountName = "AccountName",
@@ -4590,6 +4761,8 @@ export declare enum KnownAutomationRulePropertyConditionSupportedProperty {
     AccountObjectGuid = "AccountObjectGuid",
     /** The account user principal name suffix */
     AccountUPNSuffix = "AccountUPNSuffix",
+    /** The name of the product of the alert */
+    AlertProductNames = "AlertProductNames",
     /** The Azure resource id */
     AzureResourceResourceId = "AzureResourceResourceId",
     /** The Azure resource subscription id */
@@ -4616,7 +4789,7 @@ export declare enum KnownAutomationRulePropertyConditionSupportedProperty {
     HostNTDomain = "HostNTDomain",
     /** The host operating system */
     HostOSVersion = "HostOSVersion",
-    /** The IoT device id */
+    /** "The IoT device id */
     IoTDeviceId = "IoTDeviceId",
     /** The IoT device name */
     IoTDeviceName = "IoTDeviceName",
@@ -4666,6 +4839,12 @@ export declare enum KnownAutomationRulePropertyConditionSupportedProperty {
     Url = "Url"
 }
 
+/** Known values of {@link ConditionType} that the service accepts. */
+export declare enum KnownConditionType {
+    /** Evaluate an object property value */
+    Property = "Property"
+}
+
 /** Known values of {@link ConfidenceLevel} that the service accepts. */
 export declare enum KnownConfidenceLevel {
     /** Unknown confidence, the is the default value */
@@ -4735,6 +4914,8 @@ export declare enum KnownDataConnectorKind {
     Office365 = "Office365",
     OfficeATP = "OfficeATP",
     OfficeIRM = "OfficeIRM",
+    Office365Project = "Office365Project",
+    OfficePowerBI = "OfficePowerBI",
     AmazonWebServicesCloudTrail = "AmazonWebServicesCloudTrail",
     AmazonWebServicesS3 = "AmazonWebServicesS3",
     AzureAdvancedThreatProtection = "AzureAdvancedThreatProtection",
@@ -4743,7 +4924,8 @@ export declare enum KnownDataConnectorKind {
     MicrosoftThreatProtection = "MicrosoftThreatProtection",
     MicrosoftThreatIntelligence = "MicrosoftThreatIntelligence",
     GenericUI = "GenericUI",
-    APIPolling = "APIPolling"
+    APIPolling = "APIPolling",
+    IOT = "IOT"
 }
 
 /** Known values of {@link DataConnectorLicenseState} that the service accepts. */
@@ -4759,9 +4941,31 @@ export declare enum KnownDataTypeState {
     Disabled = "Disabled"
 }
 
-/** Known values of {@link EntityItemQueryKind} that the service accepts. */
-export declare enum KnownEntityItemQueryKind {
-    /** insight */
+/** Known values of {@link DeploymentFetchStatus} that the service accepts. */
+export declare enum KnownDeploymentFetchStatus {
+    Success = "Success",
+    Unauthorized = "Unauthorized",
+    NotFound = "NotFound"
+}
+
+/** Known values of {@link DeploymentResult} that the service accepts. */
+export declare enum KnownDeploymentResult {
+    Success = "Success",
+    Canceled = "Canceled",
+    Failed = "Failed"
+}
+
+/** Known values of {@link DeploymentState} that the service accepts. */
+export declare enum KnownDeploymentState {
+    InProgress = "In_Progress",
+    Completed = "Completed",
+    Queued = "Queued",
+    Canceling = "Canceling"
+}
+
+/** Known values of {@link EntityItemQueryKind} that the service accepts. */
+export declare enum KnownEntityItemQueryKind {
+    /** insight */
     Insight = "Insight"
 }
 
@@ -4919,8 +5123,8 @@ export declare enum KnownEntityType {
     SubmissionMail = "SubmissionMail"
 }
 
-/** Known values of {@link Enum8} that the service accepts. */
-export declare enum KnownEnum8 {
+/** Known values of {@link Enum12} that the service accepts. */
+export declare enum KnownEnum12 {
     Expansion = "Expansion",
     Activity = "Activity"
 }
@@ -4974,7 +5178,7 @@ export declare enum KnownIncidentLabelType {
     /** Label manually created by a user */
     User = "User",
     /** Label automatically created by the system */
-    System = "System"
+    AutoAssigned = "AutoAssigned"
 }
 
 /** Known values of {@link IncidentSeverity} that the service accepts. */
@@ -5046,7 +5250,10 @@ export declare enum KnownKind {
     Parser = "Parser",
     Watchlist = "Watchlist",
     WatchlistTemplate = "WatchlistTemplate",
-    Solution = "Solution"
+    Solution = "Solution",
+    AzureFunction = "AzureFunction",
+    LogicAppsCustomConnector = "LogicAppsCustomConnector",
+    AutomationRule = "AutomationRule"
 }
 
 /** Known values of {@link MatchingMethod} that the service accepts. */
@@ -5192,12 +5399,6 @@ export declare enum KnownSkuKind {
     CapacityReservation = "CapacityReservation"
 }
 
-/** Known values of {@link Source} that the service accepts. */
-export declare enum KnownSource {
-    LocalFile = "Local file",
-    RemoteStorage = "Remote storage"
-}
-
 /** Known values of {@link SourceKind} that the service accepts. */
 export declare enum KnownSourceKind {
     LocalWorkspace = "LocalWorkspace",
@@ -5206,6 +5407,12 @@ export declare enum KnownSourceKind {
     SourceRepository = "SourceRepository"
 }
 
+/** Known values of {@link SourceType} that the service accepts. */
+export declare enum KnownSourceType {
+    LocalFile = "Local file",
+    RemoteStorage = "Remote storage"
+}
+
 /** Known values of {@link SupportTier} that the service accepts. */
 export declare enum KnownSupportTier {
     Microsoft = "Microsoft",
@@ -5256,6 +5463,12 @@ export declare enum KnownUebaDataSources {
     SigninLogs = "SigninLogs"
 }
 
+/** Known values of {@link Version} that the service accepts. */
+export declare enum KnownVersion {
+    V1 = "V1",
+    V2 = "V2"
+}
+
 /** Data type for last data received */
 export declare interface LastDataReceivedDataType {
     /** Name of the data type to show in the graph. can be use with {{graphQueriesTableName}} placeholder */
@@ -5776,6 +5989,11 @@ export declare type MalwareEntityProperties = EntityCommonProperties & {
     readonly processEntityIds?: string[];
 };
 
+export declare interface ManualTriggerRequestBody {
+    tenantId?: string;
+    logicAppsResourceId?: string;
+}
+
 /**
  * Defines values for MatchingMethod. \
  * {@link KnownMatchingMethod} can be used interchangeably with MatchingMethod,
@@ -6004,6 +6222,20 @@ export declare type MetadataModel = ResourceWithEtag & {
     firstPublishDate?: Date;
     /** last publish date for the solution content item */
     lastPublishDate?: Date;
+    /** The custom version of the content. A optional free text */
+    customVersion?: string;
+    /** Schema version of the content. Can be used to distinguish between different flow based on the schema version */
+    contentSchemaVersion?: string;
+    /** the icon identifier. this id can later be fetched from the solution template */
+    icon?: string;
+    /** the tactics the resource covers */
+    threatAnalysisTactics?: string[];
+    /** the techniques the resource covers, these have to be aligned with the tactics being used */
+    threatAnalysisTechniques?: string[];
+    /** preview image file names. These will be taken from the solution artifacts */
+    previewImages?: string[];
+    /** preview image file names. These will be taken from the solution artifacts. used for dark theme support */
+    previewImagesDark?: string[];
 };
 
 /** Metadata patch request body. */
@@ -6032,6 +6264,20 @@ export declare type MetadataPatch = ResourceWithEtag & {
     firstPublishDate?: Date;
     /** last publish date for the solution content item */
     lastPublishDate?: Date;
+    /** The custom version of the content. A optional free text */
+    customVersion?: string;
+    /** Schema version of the content. Can be used to distinguish between different flow based on the schema version */
+    contentSchemaVersion?: string;
+    /** the icon identifier. this id can later be fetched from the solution template */
+    icon?: string;
+    /** the tactics the resource covers */
+    threatAnalysisTactics?: string[];
+    /** the techniques the resource covers, these have to be aligned with the tactics being used */
+    threatAnalysisTechniques?: string[];
+    /** preview image file names. These will be taken from the solution artifacts */
+    previewImages?: string[];
+    /** preview image file names. These will be taken from the solution artifacts. used for dark theme support */
+    previewImagesDark?: string[];
 };
 
 /** The original source of the content item, where it comes from. */
@@ -6150,7 +6396,16 @@ export declare type MicrosoftSecurityIncidentCreationAlertRuleTemplate = AlertRu
 };
 
 /** MicrosoftSecurityIncidentCreation rule template properties */
-export declare type MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties = AlertRuleTemplatePropertiesBase & MicrosoftSecurityIncidentCreationAlertRuleCommonProperties & {};
+export declare type MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties = AlertRuleTemplatePropertiesBase & {
+    /** the alerts' displayNames on which the cases will be generated */
+    displayNamesFilter?: string[];
+    /** the alerts' displayNames on which the cases will not be generated */
+    displayNamesExcludeFilter?: string[];
+    /** The alerts' productName on which the cases will be generated */
+    productFilter?: MicrosoftSecurityProductName;
+    /** the alerts' severities on which the cases will be generated */
+    severitiesFilter?: AlertSeverity[];
+};
 
 /**
  * Defines values for MicrosoftSecurityProductName. \
@@ -6198,6 +6453,11 @@ export declare type MLBehaviorAnalyticsAlertRule = AlertRule & {
      * NOTE: This property will not be serialized. It can only be populated by the server.
      */
     readonly tactics?: AttackTactic[];
+    /**
+     * The techniques of the alert rule
+     * NOTE: This property will not be serialized. It can only be populated by the server.
+     */
+    readonly techniques?: string[];
 };
 
 /** Represents MLBehaviorAnalytics alert rule template. */
@@ -6222,18 +6482,18 @@ export declare type MLBehaviorAnalyticsAlertRuleTemplate = AlertRuleTemplate & {
     requiredDataConnectors?: AlertRuleTemplateDataSource[];
     /** The alert rule template status. */
     status?: TemplateStatus;
+    /** The tactics of the alert rule */
+    tactics?: AttackTactic[];
+    /** The techniques of the alert rule */
+    techniques?: string[];
     /** The severity for alerts created by this alert rule. */
     severity?: AlertSeverity;
-    /** The tactics of the alert rule template. */
-    tactics?: AttackTactic[];
 };
 
 /** MLBehaviorAnalytics alert rule template properties. */
-export declare type MLBehaviorAnalyticsAlertRuleTemplateProperties = AlertRuleTemplatePropertiesBase & {
+export declare type MLBehaviorAnalyticsAlertRuleTemplateProperties = AlertRuleTemplateWithMitreProperties & {
     /** The severity for alerts created by this alert rule. */
     severity: AlertSeverity;
-    /** The tactics of the alert rule template. */
-    tactics?: AttackTactic[];
 };
 
 /** Represents Microsoft Threat Intelligence requirements check request. */
@@ -6325,6 +6585,10 @@ export declare type NrtAlertRule = AlertRule & {
     description?: string;
     /** The query that creates alerts for this rule. */
     query?: string;
+    /** The tactics of the alert rule */
+    tactics?: AttackTactic[];
+    /** The techniques of the alert rule */
+    techniques?: string[];
     /** The display name for alerts created by this alert rule. */
     displayName?: string;
     /** Determines whether this alert rule is enabled or disabled. */
@@ -6340,8 +6604,6 @@ export declare type NrtAlertRule = AlertRule & {
     suppressionEnabled?: boolean;
     /** The severity for alerts created by this alert rule. */
     severity?: AlertSeverity;
-    /** The tactics of the alert rule */
-    tactics?: AttackTactic[];
     /** The settings of the incidents that created from alerts triggered by this analytics rule */
     incidentConfiguration?: IncidentConfiguration;
     /** Dictionary of string key-value pairs of columns to be attached to the alert */
@@ -6354,9 +6616,6 @@ export declare type NrtAlertRule = AlertRule & {
     alertDetailsOverride?: AlertDetailsOverride;
 };
 
-/** Nrt alert rule base property bag. */
-export declare type NrtAlertRuleProperties = QueryBasedAlertRuleProperties & {};
-
 /** Represents NRT alert rule template. */
 export declare type NrtAlertRuleTemplate = AlertRuleTemplate & {
     /** the number of alert rules that were created by this template */
@@ -6379,12 +6638,14 @@ export declare type NrtAlertRuleTemplate = AlertRuleTemplate & {
     requiredDataConnectors?: AlertRuleTemplateDataSource[];
     /** The alert rule template status. */
     status?: TemplateStatus;
+    /** The tactics of the alert rule */
+    tactics?: AttackTactic[];
+    /** The techniques of the alert rule */
+    techniques?: string[];
     /** The query that creates alerts for this rule. */
     query?: string;
     /** The severity for alerts created by this alert rule. */
     severity?: AlertSeverity;
-    /** The tactics of the alert rule */
-    tactics?: AttackTactic[];
     /** The version of this template - in format <a.b.c>, where all are numbers. For example <1.0.2>. */
     version?: string;
     /** Dictionary of string key-value pairs of columns to be attached to the alert */
@@ -6398,7 +6659,41 @@ export declare type NrtAlertRuleTemplate = AlertRuleTemplate & {
 };
 
 /** NRT alert rule template properties */
-export declare type NrtAlertRuleTemplateProperties = AlertRuleTemplatePropertiesBase & QueryBasedAlertRuleTemplateProperties & {};
+export declare type NrtAlertRuleTemplateProperties = AlertRuleTemplateWithMitreProperties & QueryBasedAlertRuleTemplateProperties & {};
+
+/** Represents Office365 Project requirements check request. */
+export declare type Office365ProjectCheckRequirements = DataConnectorsCheckRequirements & {
+    /** Polymorphic discriminator, which specifies the different types this object can be */
+    kind: "Office365Project";
+    /** The tenant id to connect to, and get the data from. */
+    tenantId?: string;
+};
+
+/** Office365 Project requirements check properties. */
+export declare type Office365ProjectCheckRequirementsProperties = DataConnectorTenantId & {};
+
+/** The available data types for Office Microsoft Project data connector. */
+export declare interface Office365ProjectConnectorDataTypes {
+    /** Logs data type. */
+    logs: Office365ProjectConnectorDataTypesLogs;
+}
+
+/** Logs data type. */
+export declare type Office365ProjectConnectorDataTypesLogs = DataConnectorDataTypeCommon & {};
+
+/** Represents Office Microsoft Project data connector. */
+export declare type Office365ProjectDataConnector = DataConnector & {
+    /** The tenant id to connect to, and get the data from. */
+    tenantId?: string;
+    /** The available data types for the connector. */
+    dataTypes?: Office365ProjectConnectorDataTypes;
+};
+
+/** Office Microsoft Project data connector properties. */
+export declare type Office365ProjectDataConnectorProperties = DataConnectorTenantId & {
+    /** The available data types for the connector. */
+    dataTypes: Office365ProjectConnectorDataTypes;
+};
 
 /** Represents OfficeATP (Office 365 Advanced Threat Protection) requirements check request. */
 export declare type OfficeATPCheckRequirements = DataConnectorsCheckRequirements & {
@@ -6548,6 +6843,40 @@ export declare type OfficeIRMDataConnector = DataConnector & {
 /** OfficeIRM (Microsoft Insider Risk Management) data connector properties. */
 export declare type OfficeIRMDataConnectorProperties = DataConnectorTenantId & DataConnectorWithAlertsProperties & {};
 
+/** Represents Office PowerBI requirements check request. */
+export declare type OfficePowerBICheckRequirements = DataConnectorsCheckRequirements & {
+    /** Polymorphic discriminator, which specifies the different types this object can be */
+    kind: "OfficePowerBI";
+    /** The tenant id to connect to, and get the data from. */
+    tenantId?: string;
+};
+
+/** Office PowerBI requirements check properties. */
+export declare type OfficePowerBICheckRequirementsProperties = DataConnectorTenantId & {};
+
+/** The available data types for Office Microsoft PowerBI data connector. */
+export declare interface OfficePowerBIConnectorDataTypes {
+    /** Logs data type. */
+    logs: OfficePowerBIConnectorDataTypesLogs;
+}
+
+/** Logs data type. */
+export declare type OfficePowerBIConnectorDataTypesLogs = DataConnectorDataTypeCommon & {};
+
+/** Represents Office Microsoft PowerBI data connector. */
+export declare type OfficePowerBIDataConnector = DataConnector & {
+    /** The tenant id to connect to, and get the data from. */
+    tenantId?: string;
+    /** The available data types for the connector. */
+    dataTypes?: OfficePowerBIConnectorDataTypes;
+};
+
+/** Office Microsoft PowerBI data connector properties. */
+export declare type OfficePowerBIDataConnectorProperties = DataConnectorTenantId & {
+    /** The available data types for the connector. */
+    dataTypes: OfficePowerBIConnectorDataTypes;
+};
+
 /** Operation provided by provider */
 export declare interface Operation {
     /** Properties of the operation */
@@ -6666,6 +6995,13 @@ export declare type PermissionsCustomsItem = Customs & {};
 
 export declare type PermissionsResourceProviderItem = ResourceProvider & {};
 
+export declare interface PlaybookActionProperties {
+    /** The resource id of the playbook resource */
+    logicAppResourceId?: string;
+    /** The tenant id of the playbook resource */
+    tenantId?: string;
+}
+
 /**
  * Defines values for PollingFrequency. \
  * {@link KnownPollingFrequency} can be used interchangeably with PollingFrequency,
@@ -6842,6 +7178,13 @@ export declare interface ProductSettingsUpdateOptionalParams extends coreClient.
 /** Contains response data for the update operation. */
 export declare type ProductSettingsUpdateResponse = SettingsUnion;
 
+/** Describes an automation rule condition that evaluates a property's value */
+export declare type PropertyConditionProperties = AutomationRuleCondition & {
+    /** Polymorphic discriminator, which specifies the different types this object can be */
+    conditionType: "Property";
+    conditionProperties?: AutomationRulePropertyValuesCondition;
+};
+
 /**
  * Defines values for ProviderName. \
  * {@link KnownProviderName} can be used interchangeably with ProviderName,
@@ -6856,53 +7199,12 @@ export declare type ProductSettingsUpdateResponse = SettingsUnion;
  */
 export declare type ProviderName = string;
 
-/** Query based alert rule base property bag. */
-export declare interface QueryBasedAlertRuleProperties {
-    /** The Name of the alert rule template used to create this rule. */
-    alertRuleTemplateName?: string;
-    /** The version of the alert rule template used to create this rule - in format <a.b.c>, where all are numbers, for example 0 <1.0.2> */
-    templateVersion?: string;
-    /** The description of the alert rule. */
-    description?: string;
-    /** The query that creates alerts for this rule. */
-    query?: string;
-    /** The display name for alerts created by this alert rule. */
-    displayName: string;
-    /** Determines whether this alert rule is enabled or disabled. */
-    enabled: boolean;
-    /**
-     * The last time that this alert rule has been modified.
-     * NOTE: This property will not be serialized. It can only be populated by the server.
-     */
-    readonly lastModifiedUtc?: Date;
-    /** The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered. */
-    suppressionDuration: string;
-    /** Determines whether the suppression for this alert rule is enabled or disabled. */
-    suppressionEnabled: boolean;
-    /** The severity for alerts created by this alert rule. */
-    severity?: AlertSeverity;
-    /** The tactics of the alert rule */
-    tactics?: AttackTactic[];
-    /** The settings of the incidents that created from alerts triggered by this analytics rule */
-    incidentConfiguration?: IncidentConfiguration;
-    /** Dictionary of string key-value pairs of columns to be attached to the alert */
-    customDetails?: {
-        [propertyName: string]: string;
-    };
-    /** Array of the entity mappings of the alert rule */
-    entityMappings?: EntityMapping[];
-    /** The alert details override settings */
-    alertDetailsOverride?: AlertDetailsOverride;
-}
-
 /** Query based alert rule template base property bag. */
 export declare interface QueryBasedAlertRuleTemplateProperties {
     /** The query that creates alerts for this rule. */
     query?: string;
     /** The severity for alerts created by this alert rule. */
     severity?: AlertSeverity;
-    /** The tactics of the alert rule */
-    tactics?: AttackTactic[];
     /** The version of this template - in format <a.b.c>, where all are numbers. For example <1.0.2>. */
     version?: string;
     /** Dictionary of string key-value pairs of columns to be attached to the alert */
@@ -7116,6 +7418,16 @@ export declare interface Repository {
     pathMapping?: ContentPathMap[];
 }
 
+/** Resources created in user's repository for the source-control. */
+export declare interface RepositoryResourceInfo {
+    /** The webhook object created for the source-control. */
+    webhook?: Webhook;
+    /** Resources created in GitHub for this source-control. */
+    gitHubResourceInfo?: GitHubResourceInfo;
+    /** Resources created in Azure DevOps for this source-control. */
+    azureDevOpsResourceInfo?: AzureDevOpsResourceInfo;
+}
+
 /**
  * Defines values for RepoType. \
  * {@link KnownRepoType} can be used interchangeably with RepoType,
@@ -7192,24 +7504,34 @@ export declare interface SampleQueries {
 
 /** Represents scheduled alert rule. */
 export declare type ScheduledAlertRule = AlertRule & {
+    /** The query that creates alerts for this rule. */
+    query?: string;
     /** The frequency (in ISO 8601 duration format) for this alert rule to run. */
     queryFrequency?: string;
     /** The period (in ISO 8601 duration format) that this alert rule looks at. */
     queryPeriod?: string;
+    /** The severity for alerts created by this alert rule. */
+    severity?: AlertSeverity;
     /** The operation against the threshold that triggers alert rule. */
     triggerOperator?: TriggerOperator;
     /** The threshold triggers this alert rule. */
     triggerThreshold?: number;
     /** The event grouping settings. */
     eventGroupingSettings?: EventGroupingSettings;
+    /** Dictionary of string key-value pairs of columns to be attached to the alert */
+    customDetails?: {
+        [propertyName: string]: string;
+    };
+    /** Array of the entity mappings of the alert rule */
+    entityMappings?: EntityMapping[];
+    /** The alert details override settings */
+    alertDetailsOverride?: AlertDetailsOverride;
     /** The Name of the alert rule template used to create this rule. */
     alertRuleTemplateName?: string;
     /** The version of the alert rule template used to create this rule - in format <a.b.c>, where all are numbers, for example 0 <1.0.2> */
     templateVersion?: string;
     /** The description of the alert rule. */
     description?: string;
-    /** The query that creates alerts for this rule. */
-    query?: string;
     /** The display name for alerts created by this alert rule. */
     displayName?: string;
     /** Determines whether this alert rule is enabled or disabled. */
@@ -7223,69 +7545,111 @@ export declare type ScheduledAlertRule = AlertRule & {
     suppressionDuration?: string;
     /** Determines whether the suppression for this alert rule is enabled or disabled. */
     suppressionEnabled?: boolean;
-    /** The severity for alerts created by this alert rule. */
-    severity?: AlertSeverity;
     /** The tactics of the alert rule */
     tactics?: AttackTactic[];
+    /** The techniques of the alert rule */
+    techniques?: string[];
     /** The settings of the incidents that created from alerts triggered by this analytics rule */
     incidentConfiguration?: IncidentConfiguration;
-    /** Dictionary of string key-value pairs of columns to be attached to the alert */
-    customDetails?: {
-        [propertyName: string]: string;
-    };
-    /** Array of the entity mappings of the alert rule */
-    entityMappings?: EntityMapping[];
-    /** The alert details override settings */
-    alertDetailsOverride?: AlertDetailsOverride;
 };
 
 /** Scheduled alert rule template property bag. */
 export declare interface ScheduledAlertRuleCommonProperties {
+    /** The query that creates alerts for this rule. */
+    query?: string;
     /** The frequency (in ISO 8601 duration format) for this alert rule to run. */
     queryFrequency?: string;
     /** The period (in ISO 8601 duration format) that this alert rule looks at. */
     queryPeriod?: string;
+    /** The severity for alerts created by this alert rule. */
+    severity?: AlertSeverity;
     /** The operation against the threshold that triggers alert rule. */
     triggerOperator?: TriggerOperator;
     /** The threshold triggers this alert rule. */
     triggerThreshold?: number;
     /** The event grouping settings. */
     eventGroupingSettings?: EventGroupingSettings;
+    /** Dictionary of string key-value pairs of columns to be attached to the alert */
+    customDetails?: {
+        [propertyName: string]: string;
+    };
+    /** Array of the entity mappings of the alert rule */
+    entityMappings?: EntityMapping[];
+    /** The alert details override settings */
+    alertDetailsOverride?: AlertDetailsOverride;
 }
 
 /** Scheduled alert rule base property bag. */
-export declare type ScheduledAlertRuleProperties = ScheduledAlertRuleCommonProperties & QueryBasedAlertRuleProperties & {};
+export declare type ScheduledAlertRuleProperties = ScheduledAlertRuleCommonProperties & {
+    /** The Name of the alert rule template used to create this rule. */
+    alertRuleTemplateName?: string;
+    /** The version of the alert rule template used to create this rule - in format <a.b.c>, where all are numbers, for example 0 <1.0.2> */
+    templateVersion?: string;
+    /** The description of the alert rule. */
+    description?: string;
+    /** The display name for alerts created by this alert rule. */
+    displayName: string;
+    /** Determines whether this alert rule is enabled or disabled. */
+    enabled: boolean;
+    /**
+     * The last time that this alert rule has been modified.
+     * NOTE: This property will not be serialized. It can only be populated by the server.
+     */
+    readonly lastModifiedUtc?: Date;
+    /** The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered. */
+    suppressionDuration: string;
+    /** Determines whether the suppression for this alert rule is enabled or disabled. */
+    suppressionEnabled: boolean;
+    /** The tactics of the alert rule */
+    tactics?: AttackTactic[];
+    /** The techniques of the alert rule */
+    techniques?: string[];
+    /** The settings of the incidents that created from alerts triggered by this analytics rule */
+    incidentConfiguration?: IncidentConfiguration;
+};
 
 /** Represents scheduled alert rule template. */
 export declare type ScheduledAlertRuleTemplate = AlertRuleTemplate & {
     /** the number of alert rules that were created by this template */
     alertRulesCreatedByTemplateCount?: number;
     /**
-     * The last time that this alert rule template has been updated.
+     * The time that this alert rule template has been added.
      * NOTE: This property will not be serialized. It can only be populated by the server.
      */
-    readonly lastUpdatedDateUTC?: Date;
+    readonly createdDateUTC?: Date;
     /**
-     * The time that this alert rule template has been added.
+     * The time that this alert rule template was last updated.
      * NOTE: This property will not be serialized. It can only be populated by the server.
      */
-    readonly createdDateUTC?: Date;
+    readonly lastUpdatedDateUTC?: Date;
     /** The description of the alert rule template. */
     description?: string;
     /** The display name for alert rule template. */
     displayName?: string;
-    /** The required data sources for this template */
+    /** The required data connectors for this template */
     requiredDataConnectors?: AlertRuleTemplateDataSource[];
     /** The alert rule template status. */
     status?: TemplateStatus;
     /** The query that creates alerts for this rule. */
     query?: string;
+    /** The frequency (in ISO 8601 duration format) for this alert rule to run. */
+    queryFrequency?: string;
+    /** The period (in ISO 8601 duration format) that this alert rule looks at. */
+    queryPeriod?: string;
     /** The severity for alerts created by this alert rule. */
     severity?: AlertSeverity;
-    /** The tactics of the alert rule */
+    /** The operation against the threshold that triggers alert rule. */
+    triggerOperator?: TriggerOperator;
+    /** The threshold triggers this alert rule. */
+    triggerThreshold?: number;
+    /** The tactics of the alert rule template */
     tactics?: AttackTactic[];
+    /** The techniques of the alert rule */
+    techniques?: string[];
     /** The version of this template - in format <a.b.c>, where all are numbers. For example <1.0.2>. */
     version?: string;
+    /** The event grouping settings. */
+    eventGroupingSettings?: EventGroupingSettings;
     /** Dictionary of string key-value pairs of columns to be attached to the alert */
     customDetails?: {
         [propertyName: string]: string;
@@ -7294,21 +7658,8 @@ export declare type ScheduledAlertRuleTemplate = AlertRuleTemplate & {
     entityMappings?: EntityMapping[];
     /** The alert details override settings */
     alertDetailsOverride?: AlertDetailsOverride;
-    /** The frequency (in ISO 8601 duration format) for this alert rule to run. */
-    queryFrequency?: string;
-    /** The period (in ISO 8601 duration format) that this alert rule looks at. */
-    queryPeriod?: string;
-    /** The operation against the threshold that triggers alert rule. */
-    triggerOperator?: TriggerOperator;
-    /** The threshold triggers this alert rule. */
-    triggerThreshold?: number;
-    /** The event grouping settings. */
-    eventGroupingSettings?: EventGroupingSettings;
 };
 
-/** Scheduled alert rule template properties */
-export declare type ScheduledAlertRuleTemplateProperties = AlertRuleTemplatePropertiesBase & QueryBasedAlertRuleTemplateProperties & ScheduledAlertRuleCommonProperties & {};
-
 /** Represents a security alert entity. */
 export declare type SecurityAlert = Entity & {
     /**
@@ -7676,34 +8027,34 @@ export declare class SecurityInsights extends coreClient.ServiceClient {
     actions: Actions;
     alertRuleTemplates: AlertRuleTemplates;
     automationRules: AutomationRules;
+    incidents: Incidents;
     bookmarks: Bookmarks;
     bookmarkRelations: BookmarkRelations;
     bookmarkOperations: BookmarkOperations;
     iPGeodata: IPGeodata;
     domainWhois: DomainWhois;
-    entityQueries: EntityQueries;
     entities: Entities;
     entitiesGetTimeline: EntitiesGetTimeline;
     entitiesRelations: EntitiesRelations;
     entityRelations: EntityRelations;
-    incidents: Incidents;
+    entityQueries: EntityQueries;
+    entityQueryTemplates: EntityQueryTemplates;
     incidentComments: IncidentComments;
     incidentRelations: IncidentRelations;
     metadata: Metadata;
+    officeConsents: OfficeConsents;
     sentinelOnboardingStates: SentinelOnboardingStates;
     productSettings: ProductSettings;
     sourceControlOperations: SourceControlOperations;
     sourceControls: SourceControls;
+    threatIntelligenceIndicator: ThreatIntelligenceIndicator;
+    threatIntelligenceIndicators: ThreatIntelligenceIndicators;
+    threatIntelligenceIndicatorMetrics: ThreatIntelligenceIndicatorMetrics;
     watchlists: Watchlists;
     watchlistItems: WatchlistItems;
     dataConnectors: DataConnectors;
     dataConnectorsCheckRequirementsOperations: DataConnectorsCheckRequirementsOperations;
-    threatIntelligenceIndicator: ThreatIntelligenceIndicator;
-    threatIntelligenceIndicators: ThreatIntelligenceIndicators;
-    threatIntelligenceIndicatorMetrics: ThreatIntelligenceIndicatorMetrics;
     operations: Operations;
-    officeConsents: OfficeConsents;
-    entityQueryTemplates: EntityQueryTemplates;
 }
 
 /** Optional parameters. */
@@ -7845,20 +8196,12 @@ export declare interface Sku {
  */
 export declare type SkuKind = string;
 
-/**
- * Defines values for Source. \
- * {@link KnownSource} can be used interchangeably with Source,
- *  this enum contains the known values that the service supports.
- * ### Known values supported by the service
- * **Local file** \
- * **Remote storage**
- */
-export declare type Source = string;
-
 /** Represents a SourceControl in Azure Security Insights. */
 export declare type SourceControl = ResourceWithEtag & {
     /** The id (a Guid) of the source control */
     idPropertiesId?: string;
+    /** The version number associated with the source control */
+    version?: Version;
     /** The display name of the source control */
     displayName?: string;
     /** A description of the source control */
@@ -7869,6 +8212,10 @@ export declare type SourceControl = ResourceWithEtag & {
     contentTypes?: ContentType[];
     /** Repository metadata. */
     repository?: Repository;
+    /** Information regarding the resources created in user's repository. */
+    repositoryResourceInfo?: RepositoryResourceInfo;
+    /** Information regarding the latest deployment for the source control. */
+    lastDeploymentInfo?: DeploymentInfo;
 };
 
 /** List all the source controls. */
@@ -7988,6 +8335,16 @@ export declare type SourceControlsListResponse = SourceControlList;
  */
 export declare type SourceKind = string;
 
+/**
+ * Defines values for SourceType. \
+ * {@link KnownSourceType} can be used interchangeably with SourceType,
+ *  this enum contains the known values that the service supports.
+ * ### Known values supported by the service
+ * **Local file** \
+ * **Remote storage**
+ */
+export declare type SourceType = string;
+
 /** Represents a submission mail entity. */
 export declare type SubmissionMailEntity = Entity & {
     /**
@@ -8252,6 +8609,11 @@ export declare type ThreatIntelligenceAlertRule = AlertRule & {
      * NOTE: This property will not be serialized. It can only be populated by the server.
      */
     readonly tactics?: AttackTactic[];
+    /**
+     * The techniques of the alert rule
+     * NOTE: This property will not be serialized. It can only be populated by the server.
+     */
+    readonly techniques?: string[];
 };
 
 /** Represents Threat Intelligence alert rule template. */
@@ -8276,18 +8638,18 @@ export declare type ThreatIntelligenceAlertRuleTemplate = AlertRuleTemplate & {
     requiredDataConnectors?: AlertRuleTemplateDataSource[];
     /** The alert rule template status. */
     status?: TemplateStatus;
+    /** The tactics of the alert rule */
+    tactics?: AttackTactic[];
+    /** The techniques of the alert rule */
+    techniques?: string[];
     /** The severity for alerts created by this alert rule. */
     severity?: AlertSeverity;
-    /** The tactics of the alert rule template */
-    tactics?: AttackTactic[];
 };
 
 /** Threat Intelligence alert rule template properties */
-export declare type ThreatIntelligenceAlertRuleTemplateProperties = AlertRuleTemplatePropertiesBase & {
+export declare type ThreatIntelligenceAlertRuleTemplateProperties = AlertRuleTemplateWithMitreProperties & {
     /** The severity for alerts created by this alert rule. */
     severity: AlertSeverity;
-    /** The tactics of the alert rule template */
-    tactics?: AttackTactic[];
 };
 
 /** Array of tags to be appended to the threat intelligence indicator. */
@@ -8371,7 +8733,7 @@ export declare interface ThreatIntelligenceIndicator {
      *                                     update.
      * @param options The options parameters.
      */
-    createIndicator(resourceGroupName: string, workspaceName: string, threatIntelligenceProperties: ThreatIntelligenceIndicatorModelForRequestBody, options?: ThreatIntelligenceIndicatorCreateIndicatorOptionalParams): Promise<ThreatIntelligenceIndicatorCreateIndicatorResponse>;
+    createIndicator(resourceGroupName: string, workspaceName: string, threatIntelligenceProperties: ThreatIntelligenceIndicatorModel, options?: ThreatIntelligenceIndicatorCreateIndicatorOptionalParams): Promise<ThreatIntelligenceIndicatorCreateIndicatorResponse>;
     /**
      * View a threat intelligence indicator by name.
      * @param resourceGroupName The name of the resource group. The name is case insensitive.
@@ -8389,7 +8751,7 @@ export declare interface ThreatIntelligenceIndicator {
      *                                     update.
      * @param options The options parameters.
      */
-    create(resourceGroupName: string, workspaceName: string, name: string, threatIntelligenceProperties: ThreatIntelligenceIndicatorModelForRequestBody, options?: ThreatIntelligenceIndicatorCreateOptionalParams): Promise<ThreatIntelligenceIndicatorCreateResponse>;
+    create(resourceGroupName: string, workspaceName: string, name: string, threatIntelligenceProperties: ThreatIntelligenceIndicatorModel, options?: ThreatIntelligenceIndicatorCreateOptionalParams): Promise<ThreatIntelligenceIndicatorCreateResponse>;
     /**
      * Delete a threat intelligence indicator.
      * @param resourceGroupName The name of the resource group. The name is case insensitive.
@@ -8415,7 +8777,7 @@ export declare interface ThreatIntelligenceIndicator {
      * @param threatIntelligenceReplaceTags Tags in the threat intelligence indicator to be replaced.
      * @param options The options parameters.
      */
-    replaceTags(resourceGroupName: string, workspaceName: string, name: string, threatIntelligenceReplaceTags: ThreatIntelligenceIndicatorModelForRequestBody, options?: ThreatIntelligenceIndicatorReplaceTagsOptionalParams): Promise<ThreatIntelligenceIndicatorReplaceTagsResponse>;
+    replaceTags(resourceGroupName: string, workspaceName: string, name: string, threatIntelligenceReplaceTags: ThreatIntelligenceIndicatorModel, options?: ThreatIntelligenceIndicatorReplaceTagsOptionalParams): Promise<ThreatIntelligenceIndicatorReplaceTagsResponse>;
 }
 
 /** Optional parameters. */
@@ -8539,82 +8901,6 @@ export declare type ThreatIntelligenceIndicatorModel = ThreatIntelligenceInforma
     };
 };
 
-/** Threat intelligence indicator entity used in request body. */
-export declare type ThreatIntelligenceIndicatorModelForRequestBody = ThreatIntelligenceResourceKind & {
-    /** Etag of the azure resource */
-    etag?: string;
-    /**
-     * A bag of custom fields that should be part of the entity and will be presented to the user.
-     * NOTE: This property will not be serialized. It can only be populated by the server.
-     */
-    readonly additionalData?: {
-        [propertyName: string]: Record<string, unknown>;
-    };
-    /**
-     * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.
-     * NOTE: This property will not be serialized. It can only be populated by the server.
-     */
-    readonly friendlyName?: string;
-    /** List of tags */
-    threatIntelligenceTags?: string[];
-    /** Last updated time in UTC */
-    lastUpdatedTimeUtc?: string;
-    /** Source of a threat intelligence entity */
-    source?: string;
-    /** Display name of a threat intelligence entity */
-    displayName?: string;
-    /** Description of a threat intelligence entity */
-    description?: string;
-    /** Indicator types of threat intelligence entities */
-    indicatorTypes?: string[];
-    /** Pattern of a threat intelligence entity */
-    pattern?: string;
-    /** Pattern type of a threat intelligence entity */
-    patternType?: string;
-    /** Pattern version of a threat intelligence entity */
-    patternVersion?: string;
-    /** Kill chain phases */
-    killChainPhases?: ThreatIntelligenceKillChainPhase[];
-    /** Parsed patterns */
-    parsedPattern?: ThreatIntelligenceParsedPattern[];
-    /** External ID of threat intelligence entity */
-    externalId?: string;
-    /** Created by reference of threat intelligence entity */
-    createdByRef?: string;
-    /** Is threat intelligence entity defanged */
-    defanged?: boolean;
-    /** External last updated time in UTC */
-    externalLastUpdatedTimeUtc?: string;
-    /** External References */
-    externalReferences?: ThreatIntelligenceExternalReference[];
-    /** Granular Markings */
-    granularMarkings?: ThreatIntelligenceGranularMarkingModel[];
-    /** Labels  of threat intelligence entity */
-    labels?: string[];
-    /** Is threat intelligence entity revoked */
-    revoked?: boolean;
-    /** Confidence of threat intelligence entity */
-    confidence?: number;
-    /** Threat intelligence entity object marking references */
-    objectMarkingRefs?: string[];
-    /** Language of threat intelligence entity */
-    language?: string;
-    /** Threat types */
-    threatTypes?: string[];
-    /** Valid from */
-    validFrom?: string;
-    /** Valid until */
-    validUntil?: string;
-    /** Created by */
-    created?: string;
-    /** Modified by */
-    modified?: string;
-    /** Extensions map */
-    extensions?: {
-        [propertyName: string]: any;
-    };
-};
-
 /** Describes threat intelligence entity properties */
 export declare type ThreatIntelligenceIndicatorProperties = EntityCommonProperties & {
     /** List of tags */
@@ -8740,7 +9026,10 @@ export declare interface ThreatIntelligenceIndicatorsListOptionalParams extends
 export declare type ThreatIntelligenceIndicatorsListResponse = ThreatIntelligenceInformationList;
 
 /** Threat intelligence information object. */
-export declare type ThreatIntelligenceInformation = ResourceWithEtag & ThreatIntelligenceResourceKind & {};
+export declare type ThreatIntelligenceInformation = ResourceWithEtag & {
+    /** The kind of the entity. */
+    kind: ThreatIntelligenceResourceKindEnum;
+};
 
 /** List of all the threat intelligence information objects. */
 export declare interface ThreatIntelligenceInformationList {
@@ -8811,12 +9100,6 @@ export declare interface ThreatIntelligenceParsedPatternTypeValue {
     value?: string;
 }
 
-/** Describes an entity with kind. */
-export declare interface ThreatIntelligenceResourceKind {
-    /** The kind of the entity. */
-    kind: ThreatIntelligenceResourceKindEnum;
-}
-
 /**
  * Defines values for ThreatIntelligenceResourceKindEnum. \
  * {@link KnownThreatIntelligenceResourceKindEnum} can be used interchangeably with ThreatIntelligenceResourceKindEnum,
@@ -9062,6 +9345,16 @@ export declare interface UserInfo {
     objectId?: string;
 }
 
+/**
+ * Defines values for Version. \
+ * {@link KnownVersion} can be used interchangeably with Version,
+ *  this enum contains the known values that the service supports.
+ * ### Known values supported by the service
+ * **V1** \
+ * **V2**
+ */
+export declare type Version = string;
+
 /** Represents a Watchlist in Azure Security Insights. */
 export declare type Watchlist = ResourceWithEtag & {
     /** The id (a Guid) of the watchlist */
@@ -9070,8 +9363,10 @@ export declare type Watchlist = ResourceWithEtag & {
     displayName?: string;
     /** The provider of the watchlist */
     provider?: string;
-    /** The source of the watchlist */
-    source?: Source;
+    /** The filename of the watchlist, called 'source' */
+    source?: string;
+    /** The sourceType of the watchlist */
+    sourceType?: SourceType;
     /** The time the watchlist was created */
     created?: Date;
     /** The last time the watchlist was updated */
@@ -9104,8 +9399,6 @@ export declare type Watchlist = ResourceWithEtag & {
     contentType?: string;
     /** The status of the Watchlist upload : New, InProgress or Complete. Pls note : When a Watchlist upload status is equal to InProgress, the Watchlist cannot be deleted */
     uploadStatus?: string;
-    /** The number of Watchlist Items in the Watchlist */
-    watchlistItemsCount?: number;
 };
 
 /** Represents a Watchlist item in Azure Security Insights. */
@@ -9203,6 +9496,8 @@ export declare type WatchlistItemsGetResponse = WatchlistItem;
 
 /** Optional parameters. */
 export declare interface WatchlistItemsListNextOptionalParams extends coreClient.OperationOptions {
+    /** Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. */
+    skipToken?: string;
 }
 
 /** Contains response data for the listNext operation. */
@@ -9210,6 +9505,8 @@ export declare type WatchlistItemsListNextResponse = WatchlistItemList;
 
 /** Optional parameters. */
 export declare interface WatchlistItemsListOptionalParams extends coreClient.OperationOptions {
+    /** Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. */
+    skipToken?: string;
 }
 
 /** Contains response data for the list operation. */
@@ -9250,11 +9547,14 @@ export declare interface Watchlists {
      * @param watchlistAlias Watchlist Alias
      * @param options The options parameters.
      */
-    delete(resourceGroupName: string, workspaceName: string, watchlistAlias: string, options?: WatchlistsDeleteOptionalParams): Promise<void>;
+    delete(resourceGroupName: string, workspaceName: string, watchlistAlias: string, options?: WatchlistsDeleteOptionalParams): Promise<WatchlistsDeleteResponse>;
     /**
-     * Creates or updates a watchlist and its watchlist items (bulk creation, e.g. through text/csv content
-     * type). To create a Watchlist and its items, we should call this endpoint with rawContent and
-     * contentType properties.
+     * Create or update a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv content
+     * type). To create a Watchlist and its Items, we should call this endpoint with either rawContent or a
+     * valid SAR URI and contentType properties. The rawContent is mainly used for small watchlist (content
+     * size below 3.8 MB). The SAS URI enables the creation of large watchlist, where the content size can
+     * go up to 500 MB. The status of processing such large file can be polled through the URL returned in
+     * Azure-AsyncOperation header.
      * @param resourceGroupName The name of the resource group. The name is case insensitive.
      * @param workspaceName The name of the workspace.
      * @param watchlistAlias Watchlist Alias
@@ -9264,6 +9564,12 @@ export declare interface Watchlists {
     createOrUpdate(resourceGroupName: string, workspaceName: string, watchlistAlias: string, watchlist: Watchlist, options?: WatchlistsCreateOrUpdateOptionalParams): Promise<WatchlistsCreateOrUpdateResponse>;
 }
 
+/** Defines headers for Watchlists_createOrUpdate operation. */
+export declare interface WatchlistsCreateOrUpdateHeaders {
+    /** Contains the status URL on which clients are expected to poll the status of the operation. */
+    azureAsyncOperation?: string;
+}
+
 /** Optional parameters. */
 export declare interface WatchlistsCreateOrUpdateOptionalParams extends coreClient.OperationOptions {
 }
@@ -9271,10 +9577,19 @@ export declare interface WatchlistsCreateOrUpdateOptionalParams extends coreClie
 /** Contains response data for the createOrUpdate operation. */
 export declare type WatchlistsCreateOrUpdateResponse = Watchlist;
 
+/** Defines headers for Watchlists_delete operation. */
+export declare interface WatchlistsDeleteHeaders {
+    /** Contains the status URL on which clients are expected to poll the status of the delete operation. */
+    azureAsyncOperation?: string;
+}
+
 /** Optional parameters. */
 export declare interface WatchlistsDeleteOptionalParams extends coreClient.OperationOptions {
 }
 
+/** Contains response data for the delete operation. */
+export declare type WatchlistsDeleteResponse = WatchlistsDeleteHeaders;
+
 /** Optional parameters. */
 export declare interface WatchlistsGetOptionalParams extends coreClient.OperationOptions {
 }
@@ -9284,6 +9599,8 @@ export declare type WatchlistsGetResponse = Watchlist;
 
 /** Optional parameters. */
 export declare interface WatchlistsListNextOptionalParams extends coreClient.OperationOptions {
+    /** Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. */
+    skipToken?: string;
 }
 
 /** Contains response data for the listNext operation. */
@@ -9291,9 +9608,23 @@ export declare type WatchlistsListNextResponse = WatchlistList;
 
 /** Optional parameters. */
 export declare interface WatchlistsListOptionalParams extends coreClient.OperationOptions {
+    /** Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. */
+    skipToken?: string;
 }
 
 /** Contains response data for the list operation. */
 export declare type WatchlistsListResponse = WatchlistList;
 
+/** Detail about the webhook object. */
+export declare interface Webhook {
+    /** Unique identifier for the webhook. */
+    webhookId?: string;
+    /** URL that gets invoked by the webhook. */
+    webhookUrl?: string;
+    /** Time when the webhook secret was updated. */
+    webhookSecretUpdateTime?: string;
+    /** A flag to instruct the backend service to rotate webhook secret. */
+    rotateWebhookSecret?: boolean;
+}
+
 export { }