# Azure Security Insights management API

> Azure Security Insights management API on Apizie: 95 endpoints (Lists all operations available Azure Security Insights Resource Provider., Gets all alert rule templates., Gets the alert rule template., Gets all alert rules., …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `cloud:azure-arm-securityinsights`
- Category: Cloud
- Status: byok
- Source: https://learn.microsoft.com/rest/api/azure/
- Page: https://zieapi.vercel.app/api/cloud/azure-arm-securityinsights
- OpenAPI: https://zieapi.vercel.app/api/cloud/azure-arm-securityinsights/openapi.json

Azure Resource Manager API for Security Insights: manage these Azure resources in your subscription with a Microsoft Entra access token.

## Endpoints

### Lists all operations available Azure Security Insights Resource Provider.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/operations-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |

### Gets all alert rule templates.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/alert-rule-templates-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |

### Gets the alert rule template.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/alert-rule-templates-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| alertRuleTemplateId | string | yes | Alert rule template ID |

### Gets all alert rules.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/alert-rules-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |

### Gets the alert rule.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/alert-rules-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| ruleId | string | yes | Alert rule ID |

### Creates or updates the alert rule.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/alert-rules-create-or-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| ruleId | string | yes | Alert rule ID |
| body | object | yes | JSON request body |

### Delete the alert rule.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/alert-rules-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| ruleId | string | yes | Alert rule ID |

### Gets all actions of alert rule.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/actions-list-by-alert-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| ruleId | string | yes | Alert rule ID |

### Gets the action of alert rule.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/actions-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| ruleId | string | yes | Alert rule ID |
| actionId | string | yes | Action ID |

### Creates or updates the action of alert rule.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/actions-create-or-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| ruleId | string | yes | Alert rule ID |
| actionId | string | yes | Action ID |
| body | object | yes | JSON request body |

### Delete the action of alert rule.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/actions-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| ruleId | string | yes | Alert rule ID |
| actionId | string | yes | Action ID |

### Gets all automation rules.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/automation-rules-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |

### Gets the automation rule.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/automation-rules-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| automationRuleId | string | yes | Automation rule ID |

### Creates or updates the automation rule.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/automation-rules-create-or-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the workspace. |
| automationRuleId | string | yes | The automation rule ID. |
| body | object | no | JSON request body |

### Delete the automation rule.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/automation-rules-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| automationRuleId | string | yes | Automation rule ID |

### Gets all bookmarks.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/bookmarks-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |

### Gets a bookmark.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/bookmarks-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| bookmarkId | string | yes | Bookmark ID |

### Creates or updates the bookmark.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/bookmarks-create-or-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| bookmarkId | string | yes | Bookmark ID |
| body | object | yes | JSON request body |

### Delete the bookmark.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/bookmarks-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| bookmarkId | string | yes | Bookmark ID |

### Gets all installed packages.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/content-packages-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| $filter | string | no | Filters the results, based on a Boolean condition. Optional. |
| $orderby | string | no | Sorts the results. Optional. |
| $search | string | no | Searches for a substring in the response. Optional. |
| $count | boolean | no | Instructs the server to return only object count without actual body. Optional. |
| $top | integer | no | Returns only the first n results. Optional. |
| $skip | integer | no | Used to skip n elements in the OData query (offset). Returns a nextLink to the next page of results if there are any left. |
| $skipToken | string | no | Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of… |

### Gets an installed packages by its id.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/content-packages-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| packageId | string | yes | package Id |

### Install a package to the workspace.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/content-package-install` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| packageId | string | yes | package Id |
| body | object | yes | JSON request body |

### Uninstall a package from the workspace.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/content-package-uninstall` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| packageId | string | yes | package Id |

### Gets all packages from the catalog. Expandable properties: - properties/installed - properties/packagedContent
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/product-packages-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| $filter | string | no | Filters the results, based on a Boolean condition. Optional. |
| $orderby | string | no | Sorts the results. Optional. |
| $top | integer | no | Returns only the first n results. Optional. |
| $skipToken | string | no | Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of… |
| $search | string | no | Searches for a substring in the response. Optional. |

### Gets a package by its identifier from the catalog.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/product-package-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| packageId | string | yes | package Id |

### Gets all templates in the catalog.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/product-templates-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| $filter | string | no | Filters the results, based on a Boolean condition. Optional. |
| $orderby | string | no | Sorts the results. Optional. |
| $search | string | no | Searches for a substring in the response. Optional. |
| $count | boolean | no | Instructs the server to return only object count without actual body. Optional. |
| $top | integer | no | Returns only the first n results. Optional. |
| $skip | integer | no | Used to skip n elements in the OData query (offset). Returns a nextLink to the next page of results if there are any left. |
| $skipToken | string | no | Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of… |

### Gets all installed templates. Expandable properties: - properties/mainTemplate - properties/dependantTemplates
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/content-templates-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| $filter | string | no | Filters the results, based on a Boolean condition. Optional. |
| $orderby | string | no | Sorts the results. Optional. |
| $expand | string | no | Expands the object with optional fiends that are not included by default. Optional. |
| $search | string | no | Searches for a substring in the response. Optional. |
| $count | boolean | no | Instructs the server to return only object count without actual body. Optional. |
| $top | integer | no | Returns only the first n results. Optional. |
| $skip | integer | no | Used to skip n elements in the OData query (offset). Returns a nextLink to the next page of results if there are any left. |
| $skipToken | string | no | Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of… |

### Gets a template byt its identifier. Expandable properties: - properties/mainTemplate -…
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/content-template-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| templateId | string | yes | template Id |

### Install a template.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/content-template-install` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| templateId | string | yes | template Id |
| body | object | yes | JSON request body |

### Delete an installed template.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/content-template-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| templateId | string | yes | template Id |

### Gets a template by its identifier.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/product-template-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the workspace. |
| templateId | string | yes | template Id |

### Gets all data connector definitions.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/data-connector-definitions-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |

### Gets a data connector definition.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/data-connector-definitions-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| dataConnectorDefinitionName | string | yes | The data connector definition name. |

### Creates or updates the data connector definition.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/data-connector-definitions-create-or-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| dataConnectorDefinitionName | string | yes | The data connector definition name. |
| body | object | yes | JSON request body |

### Delete the data connector definition.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/data-connector-definitions-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| dataConnectorDefinitionName | string | yes | The data connector definition name. |

### Gets all data connectors.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/data-connectors-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |

### Gets a data connector.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/data-connectors-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| dataConnectorId | string | yes | Connector ID |

### Creates or updates the data connector.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/data-connectors-create-or-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| dataConnectorId | string | yes | Connector ID |
| body | object | yes | JSON request body |

### Delete the data connector.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/data-connectors-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| dataConnectorId | string | yes | Connector ID |

### Triggers playbook on a specific entity.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/entities-run-playbook` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the workspace. |
| entityIdentifier | string | yes | entity ID |
| body | object | no | JSON request body |

### Gets all incidents.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incidents-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| $filter | string | no | Filters the results, based on a Boolean condition. Optional. |
| $orderby | string | no | Sorts the results. Optional. |
| $top | integer | no | Returns only the first n results. Optional. |
| $skipToken | string | no | Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of… |

### Gets a given incident.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incidents-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| incidentId | string | yes | Incident ID |

### Creates or updates an incident.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incidents-create-or-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| incidentId | string | yes | Incident ID |
| body | object | yes | JSON request body |

### Deletes a given incident.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incidents-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| incidentId | string | yes | Incident ID |

### Gets all alerts for an incident.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incidents-list-alerts` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| incidentId | string | yes | Incident ID |

### Gets all bookmarks for an incident.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incidents-list-bookmarks` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| incidentId | string | yes | Incident ID |

### Gets all comments for a given incident.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incident-comments-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| incidentId | string | yes | Incident ID |
| $filter | string | no | Filters the results, based on a Boolean condition. Optional. |
| $orderby | string | no | Sorts the results. Optional. |
| $top | integer | no | Returns only the first n results. Optional. |
| $skipToken | string | no | Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of… |

### Gets an incident comment.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incident-comments-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| incidentId | string | yes | Incident ID |
| incidentCommentId | string | yes | Incident comment ID |

### Creates or updates a comment for a given incident.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incident-comments-create-or-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| incidentId | string | yes | Incident ID |
| incidentCommentId | string | yes | Incident comment ID |
| body | object | yes | JSON request body |

### Deletes a comment for a given incident.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incident-comments-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| incidentId | string | yes | Incident ID |
| incidentCommentId | string | yes | Incident comment ID |

### Gets all entities for an incident.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incidents-list-entities` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| incidentId | string | yes | Incident ID |

### Gets all relations for a given incident.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incident-relations-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| incidentId | string | yes | Incident ID |
| $filter | string | no | Filters the results, based on a Boolean condition. Optional. |
| $orderby | string | no | Sorts the results. Optional. |
| $top | integer | no | Returns only the first n results. Optional. |
| $skipToken | string | no | Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of… |

### Gets a relation for a given incident.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incident-relations-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| incidentId | string | yes | Incident ID |
| relationName | string | yes | Relation Name |

### Creates or updates the incident relation.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incident-relations-create-or-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| incidentId | string | yes | Incident ID |
| relationName | string | yes | Relation Name |
| body | object | yes | JSON request body |

### Deletes a relation for a given incident.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incident-relations-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| incidentId | string | yes | Incident ID |
| relationName | string | yes | Relation Name |

### Triggers playbook on a specific incident
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incidents-run-playbook` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the workspace. |
| incidentIdentifier | string | yes | The incident identifier. |
| body | object | no | JSON request body |

### Gets all incident tasks.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incident-tasks-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| incidentId | string | yes | Incident ID |

### Gets an incident task.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incident-tasks-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| incidentId | string | yes | Incident ID |
| incidentTaskId | string | yes | Incident task ID |

### Creates or updates the incident task.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incident-tasks-create-or-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| incidentId | string | yes | Incident ID |
| incidentTaskId | string | yes | Incident task ID |
| body | object | yes | JSON request body |

### Delete the incident task.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/incident-tasks-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| incidentId | string | yes | Incident ID |
| incidentTaskId | string | yes | Incident task ID |

### Gets a list of repositories metadata.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/source-control-list-repositories` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the workspace. |
| body | object | yes | JSON request body |

### List of all metadata
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/metadata-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| $filter | string | no | Filters the results, based on a Boolean condition. Optional. |
| $orderby | string | no | Sorts the results. Optional. |
| $top | integer | no | Returns only the first n results. Optional. |
| $skip | integer | no | Used to skip n elements in the OData query (offset). Returns a nextLink to the next page of results if there are any left. |

### Get a Metadata.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/metadata-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| metadataName | string | yes | The Metadata name. |

### Create a Metadata.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/metadata-create` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| metadataName | string | yes | The Metadata name. |
| body | object | yes | JSON request body |

### Update an existing Metadata.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/metadata-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| metadataName | string | yes | The Metadata name. |
| body | object | yes | JSON request body |

### Delete a Metadata.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/metadata-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| metadataName | string | yes | The Metadata name. |

### Gets all Sentinel onboarding states
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/sentinel-onboarding-states-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the workspace. |

### Get Sentinel onboarding state
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/sentinel-onboarding-states-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| sentinelOnboardingStateName | string | yes | The Sentinel onboarding state name. Supports - default |

### Create Sentinel onboarding state
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/sentinel-onboarding-states-create` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the workspace. |
| sentinelOnboardingStateName | string | yes | The Sentinel onboarding state name. Supports - default |
| body | object | no | JSON request body |

### Delete Sentinel onboarding state
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/sentinel-onboarding-states-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| sentinelOnboardingStateName | string | yes | The Sentinel onboarding state name. Supports - default |

### Gets all Security ML Analytics Settings.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/security-mlanalytics-settings-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |

### Gets the Security ML Analytics Settings.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/security-mlanalytics-settings-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| settingsResourceName | string | yes | Security ML Analytics Settings resource name |

### Creates or updates the Security ML Analytics Settings.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/security-mlanalytics-settings-create-or-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| settingsResourceName | string | yes | Security ML Analytics Settings resource name |
| body | object | yes | JSON request body |

### Delete the Security ML Analytics Settings.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/security-mlanalytics-settings-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| settingsResourceName | string | yes | Security ML Analytics Settings resource name |

### Gets all source controls, without source control items.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/source-controls-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |

### Gets a source control byt its identifier.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/source-controls-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| sourceControlId | string | yes | Source control Id |

### Creates a source control.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/source-controls-create` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| sourceControlId | string | yes | Source control Id |
| body | object | yes | JSON request body |

### Delete a source control.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/source-controls-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| sourceControlId | string | yes | Source control Id |
| body | object | yes | JSON request body |

### Create a new threat intelligence indicator.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/threat-intelligence-indicator-create-indicator` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| body | object | yes | JSON request body |

### Get all threat intelligence indicators.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/threat-intelligence-indicators-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| $filter | string | no | Filters the results, based on a Boolean condition. Optional. |
| $top | integer | no | Returns only the first n results. Optional. |
| $skipToken | string | no | Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of… |
| $orderby | string | no | Sorts the results. Optional. |

### View a threat intelligence indicator by name.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/threat-intelligence-indicator-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| name | string | yes | Threat intelligence indicator name field. |

### Update a threat Intelligence indicator.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/threat-intelligence-indicator-create` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| name | string | yes | Threat intelligence indicator name field. |
| body | object | yes | JSON request body |

### Delete a threat intelligence indicator.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/threat-intelligence-indicator-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| name | string | yes | Threat intelligence indicator name field. |

### Append tags to a threat intelligence indicator.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/threat-intelligence-indicator-append-tags` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| name | string | yes | Threat intelligence indicator name field. |
| body | object | yes | JSON request body |

### Replace tags added to a threat intelligence indicator.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/threat-intelligence-indicator-replace-tags` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| name | string | yes | Threat intelligence indicator name field. |
| body | object | yes | JSON request body |

### Get threat intelligence indicators metrics (Indicators counts by Type, Threat Type, Source).
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/threat-intelligence-indicator-metrics-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |

### Query threat intelligence indicators as per filtering criteria.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/threat-intelligence-indicator-query-indicators` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| body | object | yes | JSON request body |

### Get all watchlists, without watchlist items.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/watchlists-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| $skipToken | string | no | Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of… |

### Get a watchlist, without its watchlist items.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/watchlists-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| watchlistAlias | string | yes | The watchlist alias |

### Create or update a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv content type). To…
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/watchlists-create-or-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| watchlistAlias | string | yes | The watchlist alias |
| body | object | yes | JSON request body |

### Delete a watchlist.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/watchlists-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| watchlistAlias | string | yes | The watchlist alias |

### Get all watchlist Items.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/watchlist-items-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| watchlistAlias | string | yes | The watchlist alias |
| $skipToken | string | no | Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of… |

### Get a watchlist item.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/watchlist-items-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| watchlistAlias | string | yes | The watchlist alias |
| watchlistItemId | string | yes | The watchlist item id (GUID) |

### Create or update a watchlist item.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/watchlist-items-create-or-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| watchlistAlias | string | yes | The watchlist alias |
| watchlistItemId | string | yes | The watchlist item id (GUID) |
| body | object | yes | JSON request body |

### Delete a watchlist item.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/watchlist-items-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| workspaceName | string | yes | The name of the monitor workspace. |
| watchlistAlias | string | yes | The watchlist alias |
| watchlistItemId | string | yes | The watchlist item id (GUID) |

## Example
```
curl "https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/operations-list" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the Azure Security Insights management API?
Create a free Apizie key, then send GET https://zieapi.vercel.app/v1/cloud:azure-arm-securityinsights/operations-list with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the Azure Security Insights management API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. Azure Security Insights management itself also needs your own key from azure.com.

### Can AI agents use the Azure Security Insights management API?
Yes. Add the Apizie MCP server (https://zieapi.vercel.app/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key cloud:azure-arm-securityinsights.

### What is the status of the Azure Security Insights management API?
Needs your own provider key (bring your own key)