Microsoft.SecurityInsights api-version 2019-01-01 - ThreatIntelligenceAlertRuleProperties - Severity/displayName is not ReadOnly

[kaovd]

While Implementing the securityinsight.ThreatIntelligenceAlertRule type, there appears to be a mismatch from the API Spec and the actual backend. Recieved below error when creating an alert rule from template

{"kind":"ThreatIntelligence","properties":{"alertRuleTemplateName":"0dd422ee-e6af-4204-b219-f59ac172e4c6","enabled":false}}
2021/05/02 10:27:22 [DEBUG] AzureRM Response for https://management.azure.com/subscriptions/[redacted]/resourceGroups/acctestRG-sentinel-210502102421773467/providers/Microsoft.OperationalInsights/workspaces/acctestLAW-210502102421773467/providers/Microsoft.SecurityInsights/alertRules/acctest-SentinelAlertRule-ThreatIntelligence-210502102421773467?api-version=2019-01-01-preview: 
HTTP/2.0 400 Bad Request
-- snipped --

{"error":{"code":"BadRequest","message":"Required property 'severity' not found in JSON. Path 'properties', line 3, position 17."}}

This appears to be implemented correctly as readonly in the Go SDK here - From this im guessing this must be a backend issue. severity and displayName should both be readonly although are required. See below of a succesful API Request:

azure-rest-api-specs/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json

Line 9021 in dceaa75

"readOnly": true

[ghost]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @amirkeren.

Issue Details

---

While Implementing the securityinsight.ThreatIntelligenceAlertRule type, there appears to be a mismatch from the API Spec and the actual backend. Recieved below error when creating an alert rule from template

{"kind":"ThreatIntelligence","properties":{"alertRuleTemplateName":"0dd422ee-e6af-4204-b219-f59ac172e4c6","enabled":false}}
2021/05/02 10:27:22 [DEBUG] AzureRM Response for https://management.azure.com/subscriptions/[redacted]/resourceGroups/acctestRG-sentinel-210502102421773467/providers/Microsoft.OperationalInsights/workspaces/acctestLAW-210502102421773467/providers/Microsoft.SecurityInsights/alertRules/acctest-SentinelAlertRule-ThreatIntelligence-210502102421773467?api-version=2019-01-01-preview: 
HTTP/2.0 400 Bad Request
-- snipped --

{"error":{"code":"BadRequest","message":"Required property 'severity' not found in JSON. Path 'properties', line 3, position 17."}}

This appears to be implemented correctly as readonly in the Go SDK here - From this im guessing this must be a backend issue. severity and displayName should both be readonly although are required. See below of a succesful API Request:

azure-rest-api-specs/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json

Line 9021 in dceaa75

"readOnly": true

Author:	kaovd
Assignees:	leni-msft
Labels:	SecurityInsights, Service Attention, needs-triage, question
Milestone:	-

[kaovd]

This is also broken in 2021-03-01-preview API Spec @anat-gilenson

#14753