# --------------------------------------------------------------------------------------------
# Copyright (c) Microsoft Corporation. All rights reserved.
# Licensed under the MIT License. See License.txt in the project root for license information.
#
# Code generated by aaz-dev-tools
# --------------------------------------------------------------------------------------------

# pylint: skip-file
# flake8: noqa

from azure.cli.core.aaz import *


@register_command(
    "sentinel alert-rule update",
    is_experimental=True,
)
class Update(AAZCommand):
    """Update the alert rule.
    """

    _aaz_info = {
        "version": "2022-06-01-preview",
        "resources": [
            ["mgmt-plane", "/subscriptions/{}/resourcegroups/{}/providers/microsoft.operationalinsights/workspaces/{}/providers/microsoft.securityinsights/alertrules/{}", "2022-06-01-preview"],
        ]
    }

    AZ_SUPPORT_GENERIC_UPDATE = True

    def _handler(self, command_args):
        super()._handler(command_args)
        self._execute_operations()
        return self._output()

    _args_schema = None

    @classmethod
    def _build_arguments_schema(cls, *args, **kwargs):
        if cls._args_schema is not None:
            return cls._args_schema
        cls._args_schema = super()._build_arguments_schema(*args, **kwargs)

        # define Arg Group ""

        _args_schema = cls._args_schema
        _args_schema.resource_group = AAZResourceGroupNameArg(
            required=True,
        )
        _args_schema.rule_name = AAZStrArg(
            options=["-n", "--name", "--rule-name"],
            help="Name of alert rule.",
            required=True,
            is_experimental=True,
            id_part="child_name_1",
        )
        _args_schema.workspace_name = AAZStrArg(
            options=["-w", "--workspace-name"],
            help="The name of the workspace.",
            required=True,
            is_experimental=True,
            id_part="name",
        )

        # define Arg Group "AlertRule"

        _args_schema = cls._args_schema
        _args_schema.fusion = AAZObjectArg(
            options=["--fusion"],
            arg_group="AlertRule",
        )
        _args_schema.ml_behavior_analytics = AAZObjectArg(
            options=["--ml-behavior-analytics"],
            arg_group="AlertRule",
        )
        _args_schema.ms_security_incident = AAZObjectArg(
            options=["--ms-security-incident"],
            arg_group="AlertRule",
            help="Microsoft security incident creation.",
            is_experimental=True,
        )
        _args_schema.nrt = AAZObjectArg(
            options=["--nrt"],
            arg_group="AlertRule",
        )
        _args_schema.scheduled = AAZObjectArg(
            options=["--scheduled"],
            arg_group="AlertRule",
        )
        _args_schema.threat_intelligence = AAZObjectArg(
            options=["--threat-intelligence"],
            arg_group="AlertRule",
        )
        _args_schema.etag = AAZStrArg(
            options=["--etag"],
            arg_group="AlertRule",
            help="Etag of the azure resource",
            nullable=True,
        )

        fusion = cls._args_schema.fusion
        fusion.alert_rule_template_name = AAZStrArg(
            options=["alert-rule-template-name"],
            help="The Name of the alert rule template used to create this rule.",
        )
        fusion.enabled = AAZBoolArg(
            options=["enabled"],
            help="Determines whether this alert rule is enabled or disabled.",
        )
        fusion.scenario_exclusion_patterns = AAZListArg(
            options=["scenario-exclusion-patterns"],
            help="Configuration to exclude scenarios in fusion detection.",
            nullable=True,
        )
        fusion.source_settings = AAZListArg(
            options=["source-settings"],
            help="Configuration for all supported source signals in fusion detection.",
            nullable=True,
        )

        scenario_exclusion_patterns = cls._args_schema.fusion.scenario_exclusion_patterns
        scenario_exclusion_patterns.Element = AAZObjectArg()

        _element = cls._args_schema.fusion.scenario_exclusion_patterns.Element
        _element.date_added_in_utc = AAZStrArg(
            options=["date-added-in-utc"],
            help="DateTime when scenario exclusion pattern is added in UTC.",
        )
        _element.exclusion_pattern = AAZStrArg(
            options=["exclusion-pattern"],
            help="Scenario exclusion pattern.",
        )

        source_settings = cls._args_schema.fusion.source_settings
        source_settings.Element = AAZObjectArg()

        _element = cls._args_schema.fusion.source_settings.Element
        _element.enabled = AAZBoolArg(
            options=["enabled"],
            help="Determines whether this source signal is enabled or disabled in Fusion detection.",
        )
        _element.source_name = AAZStrArg(
            options=["source-name"],
            help="Name of the Fusion source signal. Refer to Fusion alert rule template for supported values.",
        )
        _element.source_sub_types = AAZListArg(
            options=["source-sub-types"],
            help="Configuration for all source subtypes under this source signal consumed in fusion detection.",
            nullable=True,
        )

        source_sub_types = cls._args_schema.fusion.source_settings.Element.source_sub_types
        source_sub_types.Element = AAZObjectArg()

        _element = cls._args_schema.fusion.source_settings.Element.source_sub_types.Element
        _element.enabled = AAZBoolArg(
            options=["enabled"],
            help="Determines whether this source subtype under source signal is enabled or disabled in Fusion detection.",
        )
        _element.severity_filters = AAZObjectArg(
            options=["severity-filters"],
            help="Severity configuration for a source subtype consumed in fusion detection.",
        )
        _element.source_sub_type_name = AAZStrArg(
            options=["source-sub-type-name"],
            help="The Name of the source subtype under a given source signal in Fusion detection. Refer to Fusion alert rule template for supported values.",
        )

        severity_filters = cls._args_schema.fusion.source_settings.Element.source_sub_types.Element.severity_filters
        severity_filters.filters = AAZListArg(
            options=["filters"],
            help="Individual Severity configuration settings for a given source subtype consumed in Fusion detection.",
            nullable=True,
        )

        filters = cls._args_schema.fusion.source_settings.Element.source_sub_types.Element.severity_filters.filters
        filters.Element = AAZObjectArg()

        _element = cls._args_schema.fusion.source_settings.Element.source_sub_types.Element.severity_filters.filters.Element
        _element.enabled = AAZBoolArg(
            options=["enabled"],
            help="Determines whether this severity is enabled or disabled for this source subtype consumed in Fusion detection.",
        )
        _element.severity = AAZStrArg(
            options=["severity"],
            help="The Severity for a given source subtype consumed in Fusion detection.",
            enum={"High": "High", "Informational": "Informational", "Low": "Low", "Medium": "Medium"},
        )

        ml_behavior_analytics = cls._args_schema.ml_behavior_analytics
        ml_behavior_analytics.alert_rule_template_name = AAZStrArg(
            options=["alert-rule-template-name"],
            help="The Name of the alert rule template used to create this rule.",
        )
        ml_behavior_analytics.enabled = AAZBoolArg(
            options=["enabled"],
            help="Determines whether this alert rule is enabled or disabled.",
        )

        ms_security_incident = cls._args_schema.ms_security_incident
        ms_security_incident.alert_rule_template_name = AAZStrArg(
            options=["alert-rule-template-name"],
            help="The Name of the alert rule template used to create this rule.",
            nullable=True,
        )
        ms_security_incident.description = AAZStrArg(
            options=["description"],
            help="The description of the alert rule.",
            nullable=True,
        )
        ms_security_incident.display_name = AAZStrArg(
            options=["display-name"],
            help="The display name for alerts created by this alert rule.",
        )
        ms_security_incident.display_names_exclude_filter = AAZListArg(
            options=["display-names-exclude-filter"],
            help="the alerts' displayNames on which the cases will not be generated",
            nullable=True,
        )
        ms_security_incident.display_names_filter = AAZListArg(
            options=["display-names-filter"],
            help="the alerts' displayNames on which the cases will be generated",
            nullable=True,
        )
        ms_security_incident.enabled = AAZBoolArg(
            options=["enabled"],
            help="Determines whether this alert rule is enabled or disabled.",
        )
        ms_security_incident.product_filter = AAZStrArg(
            options=["product-filter"],
            help="The alerts' productName on which the cases will be generated",
            enum={"Azure Active Directory Identity Protection": "Azure Active Directory Identity Protection", "Azure Advanced Threat Protection": "Azure Advanced Threat Protection", "Azure Security Center": "Azure Security Center", "Azure Security Center for IoT": "Azure Security Center for IoT", "Microsoft Cloud App Security": "Microsoft Cloud App Security", "Microsoft Defender Advanced Threat Protection": "Microsoft Defender Advanced Threat Protection", "Office 365 Advanced Threat Protection": "Office 365 Advanced Threat Protection"},
        )
        ms_security_incident.severities_filter = AAZListArg(
            options=["severities-filter"],
            help="the alerts' severities on which the cases will be generated",
            nullable=True,
        )

        display_names_exclude_filter = cls._args_schema.ms_security_incident.display_names_exclude_filter
        display_names_exclude_filter.Element = AAZStrArg()

        display_names_filter = cls._args_schema.ms_security_incident.display_names_filter
        display_names_filter.Element = AAZStrArg()

        severities_filter = cls._args_schema.ms_security_incident.severities_filter
        severities_filter.Element = AAZStrArg(
            enum={"High": "High", "Informational": "Informational", "Low": "Low", "Medium": "Medium"},
        )

        nrt = cls._args_schema.nrt
        nrt.alert_details_override = AAZObjectArg(
            options=["alert-details-override"],
            help="The alert details override settings",
            nullable=True,
        )
        cls._build_args_alert_details_override_update(nrt.alert_details_override)
        nrt.alert_rule_template_name = AAZStrArg(
            options=["alert-rule-template-name"],
            help="The Name of the alert rule template used to create this rule.",
            nullable=True,
        )
        nrt.custom_details = AAZDictArg(
            options=["custom-details"],
            help="Dictionary of string key-value pairs of columns to be attached to the alert",
            nullable=True,
        )
        nrt.description = AAZStrArg(
            options=["description"],
            help="The description of the alert rule.",
            nullable=True,
        )
        nrt.display_name = AAZStrArg(
            options=["display-name"],
            help="The display name for alerts created by this alert rule.",
        )
        nrt.enabled = AAZBoolArg(
            options=["enabled"],
            help="Determines whether this alert rule is enabled or disabled.",
        )
        nrt.entity_mappings = AAZListArg(
            options=["entity-mappings"],
            help="Array of the entity mappings of the alert rule",
            nullable=True,
        )
        cls._build_args_entity_mappings_update(nrt.entity_mappings)
        nrt.incident_configuration = AAZObjectArg(
            options=["incident-configuration"],
            help="The settings of the incidents that created from alerts triggered by this analytics rule",
            nullable=True,
        )
        cls._build_args_incident_configuration_update(nrt.incident_configuration)
        nrt.query = AAZStrArg(
            options=["query"],
            help="The query that creates alerts for this rule.",
        )
        nrt.severity = AAZStrArg(
            options=["severity"],
            help="The severity for alerts created by this alert rule.",
            enum={"High": "High", "Informational": "Informational", "Low": "Low", "Medium": "Medium"},
        )
        nrt.suppression_duration = AAZStrArg(
            options=["suppression-duration"],
            help="The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.",
        )
        nrt.suppression_enabled = AAZBoolArg(
            options=["suppression-enabled"],
            help="Determines whether the suppression for this alert rule is enabled or disabled.",
        )
        nrt.tactics = AAZListArg(
            options=["tactics"],
            help="The tactics of the alert rule",
            nullable=True,
        )
        nrt.techniques = AAZListArg(
            options=["techniques"],
            help="The techniques of the alert rule",
            nullable=True,
        )
        nrt.template_version = AAZStrArg(
            options=["template-version"],
            help="The version of the alert rule template used to create this rule - in format <a.b.c>, where all are numbers, for example 0 <1.0.2>",
            nullable=True,
        )

        custom_details = cls._args_schema.nrt.custom_details
        custom_details.Element = AAZStrArg()

        tactics = cls._args_schema.nrt.tactics
        tactics.Element = AAZStrArg(
            enum={"Collection": "Collection", "CommandAndControl": "CommandAndControl", "CredentialAccess": "CredentialAccess", "DefenseEvasion": "DefenseEvasion", "Discovery": "Discovery", "Execution": "Execution", "Exfiltration": "Exfiltration", "Impact": "Impact", "ImpairProcessControl": "ImpairProcessControl", "InhibitResponseFunction": "InhibitResponseFunction", "InitialAccess": "InitialAccess", "LateralMovement": "LateralMovement", "Persistence": "Persistence", "PreAttack": "PreAttack", "PrivilegeEscalation": "PrivilegeEscalation", "Reconnaissance": "Reconnaissance", "ResourceDevelopment": "ResourceDevelopment"},
        )

        techniques = cls._args_schema.nrt.techniques
        techniques.Element = AAZStrArg()

        scheduled = cls._args_schema.scheduled
        scheduled.alert_details_override = AAZObjectArg(
            options=["alert-details-override"],
            help="The alert details override settings",
            nullable=True,
        )
        cls._build_args_alert_details_override_update(scheduled.alert_details_override)
        scheduled.alert_rule_template_name = AAZStrArg(
            options=["alert-rule-template-name"],
            help="The Name of the alert rule template used to create this rule.",
            nullable=True,
        )
        scheduled.custom_details = AAZDictArg(
            options=["custom-details"],
            help="Dictionary of string key-value pairs of columns to be attached to the alert",
            nullable=True,
        )
        scheduled.description = AAZStrArg(
            options=["description"],
            help="The description of the alert rule.",
            nullable=True,
        )
        scheduled.display_name = AAZStrArg(
            options=["display-name"],
            help="The display name for alerts created by this alert rule.",
        )
        scheduled.enabled = AAZBoolArg(
            options=["enabled"],
            help="Determines whether this alert rule is enabled or disabled.",
        )
        scheduled.entity_mappings = AAZListArg(
            options=["entity-mappings"],
            help="Array of the entity mappings of the alert rule",
            nullable=True,
        )
        cls._build_args_entity_mappings_update(scheduled.entity_mappings)
        scheduled.event_grouping_settings = AAZObjectArg(
            options=["event-grouping-settings"],
            help="The event grouping settings.",
            nullable=True,
        )
        scheduled.incident_configuration = AAZObjectArg(
            options=["incident-configuration"],
            help="The settings of the incidents that created from alerts triggered by this analytics rule",
            nullable=True,
        )
        cls._build_args_incident_configuration_update(scheduled.incident_configuration)
        scheduled.query = AAZStrArg(
            options=["query"],
            help="The query that creates alerts for this rule.",
        )
        scheduled.query_frequency = AAZStrArg(
            options=["query-frequency"],
            help="The frequency (in ISO 8601 duration format) for this alert rule to run.",
        )
        scheduled.query_period = AAZStrArg(
            options=["query-period"],
            help="The period (in ISO 8601 duration format) that this alert rule looks at.",
        )
        scheduled.severity = AAZStrArg(
            options=["severity"],
            help="The severity for alerts created by this alert rule.",
            enum={"High": "High", "Informational": "Informational", "Low": "Low", "Medium": "Medium"},
        )
        scheduled.suppression_duration = AAZStrArg(
            options=["suppression-duration"],
            help="The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.",
        )
        scheduled.suppression_enabled = AAZBoolArg(
            options=["suppression-enabled"],
            help="Determines whether the suppression for this alert rule is enabled or disabled.",
        )
        scheduled.tactics = AAZListArg(
            options=["tactics"],
            help="The tactics of the alert rule",
            nullable=True,
        )
        scheduled.techniques = AAZListArg(
            options=["techniques"],
            help="The techniques of the alert rule",
            nullable=True,
        )
        scheduled.template_version = AAZStrArg(
            options=["template-version"],
            help="The version of the alert rule template used to create this rule - in format <a.b.c>, where all are numbers, for example 0 <1.0.2>",
            nullable=True,
        )
        scheduled.trigger_operator = AAZStrArg(
            options=["trigger-operator"],
            help="The operation against the threshold that triggers alert rule.",
            enum={"Equal": "Equal", "GreaterThan": "GreaterThan", "LessThan": "LessThan", "NotEqual": "NotEqual"},
        )
        scheduled.trigger_threshold = AAZIntArg(
            options=["trigger-threshold"],
            help="The threshold triggers this alert rule.",
        )

        custom_details = cls._args_schema.scheduled.custom_details
        custom_details.Element = AAZStrArg()

        event_grouping_settings = cls._args_schema.scheduled.event_grouping_settings
        event_grouping_settings.aggregation_kind = AAZStrArg(
            options=["aggregation-kind"],
            help="The event grouping aggregation kinds",
            nullable=True,
            enum={"AlertPerResult": "AlertPerResult", "SingleAlert": "SingleAlert"},
        )

        tactics = cls._args_schema.scheduled.tactics
        tactics.Element = AAZStrArg(
            enum={"Collection": "Collection", "CommandAndControl": "CommandAndControl", "CredentialAccess": "CredentialAccess", "DefenseEvasion": "DefenseEvasion", "Discovery": "Discovery", "Execution": "Execution", "Exfiltration": "Exfiltration", "Impact": "Impact", "ImpairProcessControl": "ImpairProcessControl", "InhibitResponseFunction": "InhibitResponseFunction", "InitialAccess": "InitialAccess", "LateralMovement": "LateralMovement", "Persistence": "Persistence", "PreAttack": "PreAttack", "PrivilegeEscalation": "PrivilegeEscalation", "Reconnaissance": "Reconnaissance", "ResourceDevelopment": "ResourceDevelopment"},
        )

        techniques = cls._args_schema.scheduled.techniques
        techniques.Element = AAZStrArg()

        threat_intelligence = cls._args_schema.threat_intelligence
        threat_intelligence.alert_rule_template_name = AAZStrArg(
            options=["alert-rule-template-name"],
            help="The Name of the alert rule template used to create this rule.",
        )
        threat_intelligence.enabled = AAZBoolArg(
            options=["enabled"],
            help="Determines whether this alert rule is enabled or disabled.",
        )
        return cls._args_schema

    _args_alert_details_override_update = None

    @classmethod
    def _build_args_alert_details_override_update(cls, _schema):
        if cls._args_alert_details_override_update is not None:
            _schema.alert_description_format = cls._args_alert_details_override_update.alert_description_format
            _schema.alert_display_name_format = cls._args_alert_details_override_update.alert_display_name_format
            _schema.alert_severity_column_name = cls._args_alert_details_override_update.alert_severity_column_name
            _schema.alert_tactics_column_name = cls._args_alert_details_override_update.alert_tactics_column_name
            return

        cls._args_alert_details_override_update = AAZObjectArg(
            nullable=True,
        )

        alert_details_override_update = cls._args_alert_details_override_update
        alert_details_override_update.alert_description_format = AAZStrArg(
            options=["alert-description-format"],
            help="the format containing columns name(s) to override the alert description",
            nullable=True,
        )
        alert_details_override_update.alert_display_name_format = AAZStrArg(
            options=["alert-display-name-format"],
            help="the format containing columns name(s) to override the alert name",
            nullable=True,
        )
        alert_details_override_update.alert_severity_column_name = AAZStrArg(
            options=["alert-severity-column-name"],
            help="the column name to take the alert severity from",
            nullable=True,
        )
        alert_details_override_update.alert_tactics_column_name = AAZStrArg(
            options=["alert-tactics-column-name"],
            help="the column name to take the alert tactics from",
            nullable=True,
        )

        _schema.alert_description_format = cls._args_alert_details_override_update.alert_description_format
        _schema.alert_display_name_format = cls._args_alert_details_override_update.alert_display_name_format
        _schema.alert_severity_column_name = cls._args_alert_details_override_update.alert_severity_column_name
        _schema.alert_tactics_column_name = cls._args_alert_details_override_update.alert_tactics_column_name

    _args_entity_mappings_update = None

    @classmethod
    def _build_args_entity_mappings_update(cls, _schema):
        if cls._args_entity_mappings_update is not None:
            _schema.Element = cls._args_entity_mappings_update.Element
            return

        cls._args_entity_mappings_update = AAZListArg(
            nullable=True,
        )

        entity_mappings_update = cls._args_entity_mappings_update
        entity_mappings_update.Element = AAZObjectArg()

        _element = cls._args_entity_mappings_update.Element
        _element.entity_type = AAZStrArg(
            options=["entity-type"],
            help="The V3 type of the mapped entity",
            nullable=True,
            enum={"Account": "Account", "AzureResource": "AzureResource", "CloudApplication": "CloudApplication", "DNS": "DNS", "File": "File", "FileHash": "FileHash", "Host": "Host", "IP": "IP", "MailCluster": "MailCluster", "MailMessage": "MailMessage", "Mailbox": "Mailbox", "Malware": "Malware", "Process": "Process", "RegistryKey": "RegistryKey", "RegistryValue": "RegistryValue", "SecurityGroup": "SecurityGroup", "SubmissionMail": "SubmissionMail", "URL": "URL"},
        )
        _element.field_mappings = AAZListArg(
            options=["field-mappings"],
            help="array of field mappings for the given entity mapping",
            nullable=True,
        )

        field_mappings = cls._args_entity_mappings_update.Element.field_mappings
        field_mappings.Element = AAZObjectArg()

        _element = cls._args_entity_mappings_update.Element.field_mappings.Element
        _element.column_name = AAZStrArg(
            options=["column-name"],
            help="the column name to be mapped to the identifier",
            nullable=True,
        )
        _element.identifier = AAZStrArg(
            options=["identifier"],
            help="the V3 identifier of the entity",
            nullable=True,
        )

        _schema.Element = cls._args_entity_mappings_update.Element

    _args_incident_configuration_update = None

    @classmethod
    def _build_args_incident_configuration_update(cls, _schema):
        if cls._args_incident_configuration_update is not None:
            _schema.create_incident = cls._args_incident_configuration_update.create_incident
            _schema.grouping_configuration = cls._args_incident_configuration_update.grouping_configuration
            return

        cls._args_incident_configuration_update = AAZObjectArg(
            nullable=True,
        )

        incident_configuration_update = cls._args_incident_configuration_update
        incident_configuration_update.create_incident = AAZBoolArg(
            options=["create-incident"],
            help="Create incidents from alerts triggered by this analytics rule",
        )
        incident_configuration_update.grouping_configuration = AAZObjectArg(
            options=["grouping-configuration"],
            help="Set how the alerts that are triggered by this analytics rule, are grouped into incidents",
            nullable=True,
        )

        grouping_configuration = cls._args_incident_configuration_update.grouping_configuration
        grouping_configuration.enabled = AAZBoolArg(
            options=["enabled"],
            help="Grouping enabled",
        )
        grouping_configuration.group_by_alert_details = AAZListArg(
            options=["group-by-alert-details"],
            help="A list of alert details to group by (when matchingMethod is Selected)",
            nullable=True,
        )
        grouping_configuration.group_by_custom_details = AAZListArg(
            options=["group-by-custom-details"],
            help="A list of custom details keys to group by (when matchingMethod is Selected). Only keys defined in the current alert rule may be used.",
            nullable=True,
        )
        grouping_configuration.group_by_entities = AAZListArg(
            options=["group-by-entities"],
            help="A list of entity types to group by (when matchingMethod is Selected). Only entities defined in the current alert rule may be used.",
            nullable=True,
        )
        grouping_configuration.lookback_duration = AAZStrArg(
            options=["lookback-duration"],
            help="Limit the group to alerts created within the lookback duration (in ISO 8601 duration format)",
        )
        grouping_configuration.matching_method = AAZStrArg(
            options=["matching-method"],
            help="Grouping matching method. When method is Selected at least one of groupByEntities, groupByAlertDetails, groupByCustomDetails must be provided and not empty.",
            enum={"AllEntities": "AllEntities", "AnyAlert": "AnyAlert", "Selected": "Selected"},
        )
        grouping_configuration.reopen_closed_incident = AAZBoolArg(
            options=["reopen-closed-incident"],
            help="Re-open closed matching incidents",
        )

        group_by_alert_details = cls._args_incident_configuration_update.grouping_configuration.group_by_alert_details
        group_by_alert_details.Element = AAZStrArg(
            enum={"DisplayName": "DisplayName", "Severity": "Severity"},
        )

        group_by_custom_details = cls._args_incident_configuration_update.grouping_configuration.group_by_custom_details
        group_by_custom_details.Element = AAZStrArg()

        group_by_entities = cls._args_incident_configuration_update.grouping_configuration.group_by_entities
        group_by_entities.Element = AAZStrArg(
            enum={"Account": "Account", "AzureResource": "AzureResource", "CloudApplication": "CloudApplication", "DNS": "DNS", "File": "File", "FileHash": "FileHash", "Host": "Host", "IP": "IP", "MailCluster": "MailCluster", "MailMessage": "MailMessage", "Mailbox": "Mailbox", "Malware": "Malware", "Process": "Process", "RegistryKey": "RegistryKey", "RegistryValue": "RegistryValue", "SecurityGroup": "SecurityGroup", "SubmissionMail": "SubmissionMail", "URL": "URL"},
        )

        _schema.create_incident = cls._args_incident_configuration_update.create_incident
        _schema.grouping_configuration = cls._args_incident_configuration_update.grouping_configuration

    def _execute_operations(self):
        self.AlertRulesGet(ctx=self.ctx)()
        self.InstanceUpdateByJson(ctx=self.ctx)()
        self.InstanceUpdateByGeneric(ctx=self.ctx)()
        self.AlertRulesCreateOrUpdate(ctx=self.ctx)()

    def _output(self, *args, **kwargs):
        result = self.deserialize_output(self.ctx.vars.instance, client_flatten=True)
        return result

    class AlertRulesGet(AAZHttpOperation):
        CLIENT_TYPE = "MgmtClient"

        def __call__(self, *args, **kwargs):
            request = self.make_request()
            session = self.client.send_request(request=request, stream=False, **kwargs)
            if session.http_response.status_code in [200]:
                return self.on_200(session)

            return self.on_error(session.http_response)

        @property
        def url(self):
            return self.client.format_url(
                "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}",
                **self.url_parameters
            )

        @property
        def method(self):
            return "GET"

        @property
        def error_format(self):
            return "ODataV4Format"

        @property
        def url_parameters(self):
            parameters = {
                **self.serialize_url_param(
                    "resourceGroupName", self.ctx.args.resource_group,
                    required=True,
                ),
                **self.serialize_url_param(
                    "ruleId", self.ctx.args.rule_name,
                    required=True,
                ),
                **self.serialize_url_param(
                    "subscriptionId", self.ctx.subscription_id,
                    required=True,
                ),
                **self.serialize_url_param(
                    "workspaceName", self.ctx.args.workspace_name,
                    required=True,
                ),
            }
            return parameters

        @property
        def query_parameters(self):
            parameters = {
                **self.serialize_query_param(
                    "api-version", "2022-06-01-preview",
                    required=True,
                ),
            }
            return parameters

        @property
        def header_parameters(self):
            parameters = {
                **self.serialize_header_param(
                    "Accept", "application/json",
                ),
            }
            return parameters

        def on_200(self, session):
            data = self.deserialize_http_content(session)
            self.ctx.set_var(
                "instance",
                data,
                schema_builder=self._build_schema_on_200
            )

        _schema_on_200 = None

        @classmethod
        def _build_schema_on_200(cls):
            if cls._schema_on_200 is not None:
                return cls._schema_on_200

            cls._schema_on_200 = AAZObjectType()
            _build_schema_alert_rule_read(cls._schema_on_200)

            return cls._schema_on_200

    class AlertRulesCreateOrUpdate(AAZHttpOperation):
        CLIENT_TYPE = "MgmtClient"

        def __call__(self, *args, **kwargs):
            request = self.make_request()
            session = self.client.send_request(request=request, stream=False, **kwargs)
            if session.http_response.status_code in [200, 201]:
                return self.on_200_201(session)

            return self.on_error(session.http_response)

        @property
        def url(self):
            return self.client.format_url(
                "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}",
                **self.url_parameters
            )

        @property
        def method(self):
            return "PUT"

        @property
        def error_format(self):
            return "ODataV4Format"

        @property
        def url_parameters(self):
            parameters = {
                **self.serialize_url_param(
                    "resourceGroupName", self.ctx.args.resource_group,
                    required=True,
                ),
                **self.serialize_url_param(
                    "ruleId", self.ctx.args.rule_name,
                    required=True,
                ),
                **self.serialize_url_param(
                    "subscriptionId", self.ctx.subscription_id,
                    required=True,
                ),
                **self.serialize_url_param(
                    "workspaceName", self.ctx.args.workspace_name,
                    required=True,
                ),
            }
            return parameters

        @property
        def query_parameters(self):
            parameters = {
                **self.serialize_query_param(
                    "api-version", "2022-06-01-preview",
                    required=True,
                ),
            }
            return parameters

        @property
        def header_parameters(self):
            parameters = {
                **self.serialize_header_param(
                    "Content-Type", "application/json",
                ),
                **self.serialize_header_param(
                    "Accept", "application/json",
                ),
            }
            return parameters

        @property
        def content(self):
            _content_value, _builder = self.new_content_builder(
                self.ctx.args,
                value=self.ctx.vars.instance,
            )

            return self.serialize_content(_content_value)

        def on_200_201(self, session):
            data = self.deserialize_http_content(session)
            self.ctx.set_var(
                "instance",
                data,
                schema_builder=self._build_schema_on_200_201
            )

        _schema_on_200_201 = None

        @classmethod
        def _build_schema_on_200_201(cls):
            if cls._schema_on_200_201 is not None:
                return cls._schema_on_200_201

            cls._schema_on_200_201 = AAZObjectType()
            _build_schema_alert_rule_read(cls._schema_on_200_201)

            return cls._schema_on_200_201

    class InstanceUpdateByJson(AAZJsonInstanceUpdateOperation):

        def __call__(self, *args, **kwargs):
            self._update_instance(self.ctx.vars.instance)

        def _update_instance(self, instance):
            _instance_value, _builder = self.new_content_builder(
                self.ctx.args,
                value=instance,
                typ=AAZObjectType
            )
            _builder.set_prop("etag", AAZStrType, ".etag")
            _builder.set_const("kind", "Fusion", AAZStrType, ".fusion", typ_kwargs={"flags": {"required": True}})
            _builder.set_const("kind", "MLBehaviorAnalytics", AAZStrType, ".ml_behavior_analytics", typ_kwargs={"flags": {"required": True}})
            _builder.set_const("kind", "MicrosoftSecurityIncidentCreation", AAZStrType, ".ms_security_incident", typ_kwargs={"flags": {"required": True}})
            _builder.set_const("kind", "NRT", AAZStrType, ".nrt", typ_kwargs={"flags": {"required": True}})
            _builder.set_const("kind", "Scheduled", AAZStrType, ".scheduled", typ_kwargs={"flags": {"required": True}})
            _builder.set_const("kind", "ThreatIntelligence", AAZStrType, ".threat_intelligence", typ_kwargs={"flags": {"required": True}})
            _builder.discriminate_by("kind", "Fusion")
            _builder.discriminate_by("kind", "MLBehaviorAnalytics")
            _builder.discriminate_by("kind", "MicrosoftSecurityIncidentCreation")
            _builder.discriminate_by("kind", "NRT")
            _builder.discriminate_by("kind", "Scheduled")
            _builder.discriminate_by("kind", "ThreatIntelligence")

            disc_fusion = _builder.get("{kind:Fusion}")
            if disc_fusion is not None:
                disc_fusion.set_prop("properties", AAZObjectType, typ_kwargs={"flags": {"client_flatten": True}})

            properties = _builder.get("{kind:Fusion}.properties")
            if properties is not None:
                properties.set_prop("alertRuleTemplateName", AAZStrType, ".fusion.alert_rule_template_name", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("enabled", AAZBoolType, ".fusion.enabled", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("scenarioExclusionPatterns", AAZListType, ".fusion.scenario_exclusion_patterns")
                properties.set_prop("sourceSettings", AAZListType, ".fusion.source_settings")

            scenario_exclusion_patterns = _builder.get("{kind:Fusion}.properties.scenarioExclusionPatterns")
            if scenario_exclusion_patterns is not None:
                scenario_exclusion_patterns.set_elements(AAZObjectType)

            _elements = _builder.get("{kind:Fusion}.properties.scenarioExclusionPatterns[]")
            if _elements is not None:
                _elements.set_prop("dateAddedInUTC", AAZStrType, ".date_added_in_utc", typ_kwargs={"flags": {"required": True}})
                _elements.set_prop("exclusionPattern", AAZStrType, ".exclusion_pattern", typ_kwargs={"flags": {"required": True}})

            source_settings = _builder.get("{kind:Fusion}.properties.sourceSettings")
            if source_settings is not None:
                source_settings.set_elements(AAZObjectType)

            _elements = _builder.get("{kind:Fusion}.properties.sourceSettings[]")
            if _elements is not None:
                _elements.set_prop("enabled", AAZBoolType, ".enabled", typ_kwargs={"flags": {"required": True}})
                _elements.set_prop("sourceName", AAZStrType, ".source_name", typ_kwargs={"flags": {"required": True}})
                _elements.set_prop("sourceSubTypes", AAZListType, ".source_sub_types")

            source_sub_types = _builder.get("{kind:Fusion}.properties.sourceSettings[].sourceSubTypes")
            if source_sub_types is not None:
                source_sub_types.set_elements(AAZObjectType)

            _elements = _builder.get("{kind:Fusion}.properties.sourceSettings[].sourceSubTypes[]")
            if _elements is not None:
                _elements.set_prop("enabled", AAZBoolType, ".enabled", typ_kwargs={"flags": {"required": True}})
                _elements.set_prop("severityFilters", AAZObjectType, ".severity_filters", typ_kwargs={"flags": {"required": True}})
                _elements.set_prop("sourceSubTypeName", AAZStrType, ".source_sub_type_name", typ_kwargs={"flags": {"required": True}})

            severity_filters = _builder.get("{kind:Fusion}.properties.sourceSettings[].sourceSubTypes[].severityFilters")
            if severity_filters is not None:
                severity_filters.set_prop("filters", AAZListType, ".filters")

            filters = _builder.get("{kind:Fusion}.properties.sourceSettings[].sourceSubTypes[].severityFilters.filters")
            if filters is not None:
                filters.set_elements(AAZObjectType)

            _elements = _builder.get("{kind:Fusion}.properties.sourceSettings[].sourceSubTypes[].severityFilters.filters[]")
            if _elements is not None:
                _elements.set_prop("enabled", AAZBoolType, ".enabled", typ_kwargs={"flags": {"required": True}})
                _elements.set_prop("severity", AAZStrType, ".severity", typ_kwargs={"flags": {"required": True}})

            disc_ml_behavior_analytics = _builder.get("{kind:MLBehaviorAnalytics}")
            if disc_ml_behavior_analytics is not None:
                disc_ml_behavior_analytics.set_prop("properties", AAZObjectType, typ_kwargs={"flags": {"client_flatten": True}})

            properties = _builder.get("{kind:MLBehaviorAnalytics}.properties")
            if properties is not None:
                properties.set_prop("alertRuleTemplateName", AAZStrType, ".ml_behavior_analytics.alert_rule_template_name", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("enabled", AAZBoolType, ".ml_behavior_analytics.enabled", typ_kwargs={"flags": {"required": True}})

            disc_microsoft_security_incident_creation = _builder.get("{kind:MicrosoftSecurityIncidentCreation}")
            if disc_microsoft_security_incident_creation is not None:
                disc_microsoft_security_incident_creation.set_prop("properties", AAZObjectType, typ_kwargs={"flags": {"client_flatten": True}})

            properties = _builder.get("{kind:MicrosoftSecurityIncidentCreation}.properties")
            if properties is not None:
                properties.set_prop("alertRuleTemplateName", AAZStrType, ".ms_security_incident.alert_rule_template_name")
                properties.set_prop("description", AAZStrType, ".ms_security_incident.description")
                properties.set_prop("displayName", AAZStrType, ".ms_security_incident.display_name", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("displayNamesExcludeFilter", AAZListType, ".ms_security_incident.display_names_exclude_filter")
                properties.set_prop("displayNamesFilter", AAZListType, ".ms_security_incident.display_names_filter")
                properties.set_prop("enabled", AAZBoolType, ".ms_security_incident.enabled", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("productFilter", AAZStrType, ".ms_security_incident.product_filter", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("severitiesFilter", AAZListType, ".ms_security_incident.severities_filter")

            display_names_exclude_filter = _builder.get("{kind:MicrosoftSecurityIncidentCreation}.properties.displayNamesExcludeFilter")
            if display_names_exclude_filter is not None:
                display_names_exclude_filter.set_elements(AAZStrType, ".")

            display_names_filter = _builder.get("{kind:MicrosoftSecurityIncidentCreation}.properties.displayNamesFilter")
            if display_names_filter is not None:
                display_names_filter.set_elements(AAZStrType, ".")

            severities_filter = _builder.get("{kind:MicrosoftSecurityIncidentCreation}.properties.severitiesFilter")
            if severities_filter is not None:
                severities_filter.set_elements(AAZStrType, ".")

            disc_nrt = _builder.get("{kind:NRT}")
            if disc_nrt is not None:
                disc_nrt.set_prop("properties", AAZObjectType, typ_kwargs={"flags": {"client_flatten": True}})

            properties = _builder.get("{kind:NRT}.properties")
            if properties is not None:
                _build_schema_alert_details_override_update(properties.set_prop("alertDetailsOverride", AAZObjectType, ".nrt.alert_details_override"))
                properties.set_prop("alertRuleTemplateName", AAZStrType, ".nrt.alert_rule_template_name")
                properties.set_prop("customDetails", AAZDictType, ".nrt.custom_details")
                properties.set_prop("description", AAZStrType, ".nrt.description")
                properties.set_prop("displayName", AAZStrType, ".nrt.display_name", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("enabled", AAZBoolType, ".nrt.enabled", typ_kwargs={"flags": {"required": True}})
                _build_schema_entity_mappings_update(properties.set_prop("entityMappings", AAZListType, ".nrt.entity_mappings"))
                _build_schema_incident_configuration_update(properties.set_prop("incidentConfiguration", AAZObjectType, ".nrt.incident_configuration"))
                properties.set_prop("query", AAZStrType, ".nrt.query", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("severity", AAZStrType, ".nrt.severity", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("suppressionDuration", AAZStrType, ".nrt.suppression_duration", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("suppressionEnabled", AAZBoolType, ".nrt.suppression_enabled", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("tactics", AAZListType, ".nrt.tactics")
                properties.set_prop("techniques", AAZListType, ".nrt.techniques")
                properties.set_prop("templateVersion", AAZStrType, ".nrt.template_version")

            custom_details = _builder.get("{kind:NRT}.properties.customDetails")
            if custom_details is not None:
                custom_details.set_elements(AAZStrType, ".")

            tactics = _builder.get("{kind:NRT}.properties.tactics")
            if tactics is not None:
                tactics.set_elements(AAZStrType, ".")

            techniques = _builder.get("{kind:NRT}.properties.techniques")
            if techniques is not None:
                techniques.set_elements(AAZStrType, ".")

            disc_scheduled = _builder.get("{kind:Scheduled}")
            if disc_scheduled is not None:
                disc_scheduled.set_prop("properties", AAZObjectType, typ_kwargs={"flags": {"client_flatten": True}})

            properties = _builder.get("{kind:Scheduled}.properties")
            if properties is not None:
                _build_schema_alert_details_override_update(properties.set_prop("alertDetailsOverride", AAZObjectType, ".scheduled.alert_details_override"))
                properties.set_prop("alertRuleTemplateName", AAZStrType, ".scheduled.alert_rule_template_name")
                properties.set_prop("customDetails", AAZDictType, ".scheduled.custom_details")
                properties.set_prop("description", AAZStrType, ".scheduled.description")
                properties.set_prop("displayName", AAZStrType, ".scheduled.display_name", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("enabled", AAZBoolType, ".scheduled.enabled", typ_kwargs={"flags": {"required": True}})
                _build_schema_entity_mappings_update(properties.set_prop("entityMappings", AAZListType, ".scheduled.entity_mappings"))
                properties.set_prop("eventGroupingSettings", AAZObjectType, ".scheduled.event_grouping_settings")
                _build_schema_incident_configuration_update(properties.set_prop("incidentConfiguration", AAZObjectType, ".scheduled.incident_configuration"))
                properties.set_prop("query", AAZStrType, ".scheduled.query", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("queryFrequency", AAZStrType, ".scheduled.query_frequency", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("queryPeriod", AAZStrType, ".scheduled.query_period", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("severity", AAZStrType, ".scheduled.severity", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("suppressionDuration", AAZStrType, ".scheduled.suppression_duration", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("suppressionEnabled", AAZBoolType, ".scheduled.suppression_enabled", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("tactics", AAZListType, ".scheduled.tactics")
                properties.set_prop("techniques", AAZListType, ".scheduled.techniques")
                properties.set_prop("templateVersion", AAZStrType, ".scheduled.template_version")
                properties.set_prop("triggerOperator", AAZStrType, ".scheduled.trigger_operator", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("triggerThreshold", AAZIntType, ".scheduled.trigger_threshold", typ_kwargs={"flags": {"required": True}})

            custom_details = _builder.get("{kind:Scheduled}.properties.customDetails")
            if custom_details is not None:
                custom_details.set_elements(AAZStrType, ".")

            event_grouping_settings = _builder.get("{kind:Scheduled}.properties.eventGroupingSettings")
            if event_grouping_settings is not None:
                event_grouping_settings.set_prop("aggregationKind", AAZStrType, ".aggregation_kind")

            tactics = _builder.get("{kind:Scheduled}.properties.tactics")
            if tactics is not None:
                tactics.set_elements(AAZStrType, ".")

            techniques = _builder.get("{kind:Scheduled}.properties.techniques")
            if techniques is not None:
                techniques.set_elements(AAZStrType, ".")

            disc_threat_intelligence = _builder.get("{kind:ThreatIntelligence}")
            if disc_threat_intelligence is not None:
                disc_threat_intelligence.set_prop("properties", AAZObjectType, typ_kwargs={"flags": {"client_flatten": True}})

            properties = _builder.get("{kind:ThreatIntelligence}.properties")
            if properties is not None:
                properties.set_prop("alertRuleTemplateName", AAZStrType, ".threat_intelligence.alert_rule_template_name", typ_kwargs={"flags": {"required": True}})
                properties.set_prop("enabled", AAZBoolType, ".threat_intelligence.enabled", typ_kwargs={"flags": {"required": True}})

            return _instance_value

    class InstanceUpdateByGeneric(AAZGenericInstanceUpdateOperation):

        def __call__(self, *args, **kwargs):
            self._update_instance_by_generic(
                self.ctx.vars.instance,
                self.ctx.generic_update_args
            )


def _build_schema_alert_details_override_update(_builder):
    if _builder is None:
        return
    _builder.set_prop("alertDescriptionFormat", AAZStrType, ".alert_description_format")
    _builder.set_prop("alertDisplayNameFormat", AAZStrType, ".alert_display_name_format")
    _builder.set_prop("alertSeverityColumnName", AAZStrType, ".alert_severity_column_name")
    _builder.set_prop("alertTacticsColumnName", AAZStrType, ".alert_tactics_column_name")


def _build_schema_entity_mappings_update(_builder):
    if _builder is None:
        return
    _builder.set_elements(AAZObjectType)

    _elements = _builder.get("[]")
    if _elements is not None:
        _elements.set_prop("entityType", AAZStrType, "@EntityMappings_update.[].entity_type")
        _elements.set_prop("fieldMappings", AAZListType, "@EntityMappings_update.[].field_mappings")

    field_mappings = _builder.get("[].fieldMappings")
    if field_mappings is not None:
        field_mappings.set_elements(AAZObjectType)

    _elements = _builder.get("[].fieldMappings[]")
    if _elements is not None:
        _elements.set_prop("columnName", AAZStrType, "@EntityMappings_update.[].field_mappings.[].column_name")
        _elements.set_prop("identifier", AAZStrType, "@EntityMappings_update.[].field_mappings.[].identifier")


def _build_schema_incident_configuration_update(_builder):
    if _builder is None:
        return
    _builder.set_prop("createIncident", AAZBoolType, ".create_incident", typ_kwargs={"flags": {"required": True}})
    _builder.set_prop("groupingConfiguration", AAZObjectType, ".grouping_configuration")

    grouping_configuration = _builder.get(".groupingConfiguration")
    if grouping_configuration is not None:
        grouping_configuration.set_prop("enabled", AAZBoolType, ".enabled", typ_kwargs={"flags": {"required": True}})
        grouping_configuration.set_prop("groupByAlertDetails", AAZListType, ".group_by_alert_details")
        grouping_configuration.set_prop("groupByCustomDetails", AAZListType, ".group_by_custom_details")
        grouping_configuration.set_prop("groupByEntities", AAZListType, ".group_by_entities")
        grouping_configuration.set_prop("lookbackDuration", AAZStrType, ".lookback_duration", typ_kwargs={"flags": {"required": True}})
        grouping_configuration.set_prop("matchingMethod", AAZStrType, ".matching_method", typ_kwargs={"flags": {"required": True}})
        grouping_configuration.set_prop("reopenClosedIncident", AAZBoolType, ".reopen_closed_incident", typ_kwargs={"flags": {"required": True}})

    group_by_alert_details = _builder.get(".groupingConfiguration.groupByAlertDetails")
    if group_by_alert_details is not None:
        group_by_alert_details.set_elements(AAZStrType, ".")

    group_by_custom_details = _builder.get(".groupingConfiguration.groupByCustomDetails")
    if group_by_custom_details is not None:
        group_by_custom_details.set_elements(AAZStrType, ".")

    group_by_entities = _builder.get(".groupingConfiguration.groupByEntities")
    if group_by_entities is not None:
        group_by_entities.set_elements(AAZStrType, ".")


_schema_alert_details_override_read = None


def _build_schema_alert_details_override_read(_schema):
    global _schema_alert_details_override_read
    if _schema_alert_details_override_read is not None:
        _schema.alert_description_format = _schema_alert_details_override_read.alert_description_format
        _schema.alert_display_name_format = _schema_alert_details_override_read.alert_display_name_format
        _schema.alert_severity_column_name = _schema_alert_details_override_read.alert_severity_column_name
        _schema.alert_tactics_column_name = _schema_alert_details_override_read.alert_tactics_column_name
        return

    _schema_alert_details_override_read = AAZObjectType()

    alert_details_override_read = _schema_alert_details_override_read
    alert_details_override_read.alert_description_format = AAZStrType(
        serialized_name="alertDescriptionFormat",
    )
    alert_details_override_read.alert_display_name_format = AAZStrType(
        serialized_name="alertDisplayNameFormat",
    )
    alert_details_override_read.alert_severity_column_name = AAZStrType(
        serialized_name="alertSeverityColumnName",
    )
    alert_details_override_read.alert_tactics_column_name = AAZStrType(
        serialized_name="alertTacticsColumnName",
    )

    _schema.alert_description_format = _schema_alert_details_override_read.alert_description_format
    _schema.alert_display_name_format = _schema_alert_details_override_read.alert_display_name_format
    _schema.alert_severity_column_name = _schema_alert_details_override_read.alert_severity_column_name
    _schema.alert_tactics_column_name = _schema_alert_details_override_read.alert_tactics_column_name


_schema_alert_rule_read = None


def _build_schema_alert_rule_read(_schema):
    global _schema_alert_rule_read
    if _schema_alert_rule_read is not None:
        _schema.etag = _schema_alert_rule_read.etag
        _schema.id = _schema_alert_rule_read.id
        _schema.kind = _schema_alert_rule_read.kind
        _schema.name = _schema_alert_rule_read.name
        _schema.system_data = _schema_alert_rule_read.system_data
        _schema.type = _schema_alert_rule_read.type
        _schema.discriminate_by(
            "kind",
            "Fusion",
            _schema_alert_rule_read.discriminate_by(
                "kind",
                "Fusion",
            )
        )
        _schema.discriminate_by(
            "kind",
            "MLBehaviorAnalytics",
            _schema_alert_rule_read.discriminate_by(
                "kind",
                "MLBehaviorAnalytics",
            )
        )
        _schema.discriminate_by(
            "kind",
            "MicrosoftSecurityIncidentCreation",
            _schema_alert_rule_read.discriminate_by(
                "kind",
                "MicrosoftSecurityIncidentCreation",
            )
        )
        _schema.discriminate_by(
            "kind",
            "NRT",
            _schema_alert_rule_read.discriminate_by(
                "kind",
                "NRT",
            )
        )
        _schema.discriminate_by(
            "kind",
            "Scheduled",
            _schema_alert_rule_read.discriminate_by(
                "kind",
                "Scheduled",
            )
        )
        _schema.discriminate_by(
            "kind",
            "ThreatIntelligence",
            _schema_alert_rule_read.discriminate_by(
                "kind",
                "ThreatIntelligence",
            )
        )
        return

    _schema_alert_rule_read = AAZObjectType()

    alert_rule_read = _schema_alert_rule_read
    alert_rule_read.etag = AAZStrType()
    alert_rule_read.id = AAZStrType(
        flags={"read_only": True},
    )
    alert_rule_read.kind = AAZStrType(
        flags={"required": True},
    )
    alert_rule_read.name = AAZStrType(
        flags={"read_only": True},
    )
    alert_rule_read.system_data = AAZObjectType(
        serialized_name="systemData",
        flags={"read_only": True},
    )
    alert_rule_read.type = AAZStrType(
        flags={"read_only": True},
    )

    system_data = _schema_alert_rule_read.system_data
    system_data.created_at = AAZStrType(
        serialized_name="createdAt",
        flags={"read_only": True},
    )
    system_data.created_by = AAZStrType(
        serialized_name="createdBy",
        flags={"read_only": True},
    )
    system_data.created_by_type = AAZStrType(
        serialized_name="createdByType",
        flags={"read_only": True},
    )
    system_data.last_modified_at = AAZStrType(
        serialized_name="lastModifiedAt",
        flags={"read_only": True},
    )
    system_data.last_modified_by = AAZStrType(
        serialized_name="lastModifiedBy",
        flags={"read_only": True},
    )
    system_data.last_modified_by_type = AAZStrType(
        serialized_name="lastModifiedByType",
        flags={"read_only": True},
    )

    disc_fusion = _schema_alert_rule_read.discriminate_by("kind", "Fusion")
    disc_fusion.properties = AAZObjectType(
        flags={"client_flatten": True},
    )

    properties = _schema_alert_rule_read.discriminate_by("kind", "Fusion").properties
    properties.alert_rule_template_name = AAZStrType(
        serialized_name="alertRuleTemplateName",
        flags={"required": True},
    )
    properties.description = AAZStrType(
        flags={"read_only": True},
    )
    properties.display_name = AAZStrType(
        serialized_name="displayName",
        flags={"read_only": True},
    )
    properties.enabled = AAZBoolType(
        flags={"required": True},
    )
    properties.last_modified_utc = AAZStrType(
        serialized_name="lastModifiedUtc",
        flags={"read_only": True},
    )
    properties.scenario_exclusion_patterns = AAZListType(
        serialized_name="scenarioExclusionPatterns",
    )
    properties.severity = AAZStrType(
        flags={"read_only": True},
    )
    properties.source_settings = AAZListType(
        serialized_name="sourceSettings",
    )
    properties.tactics = AAZListType(
        flags={"read_only": True},
    )
    properties.techniques = AAZListType(
        flags={"read_only": True},
    )

    scenario_exclusion_patterns = _schema_alert_rule_read.discriminate_by("kind", "Fusion").properties.scenario_exclusion_patterns
    scenario_exclusion_patterns.Element = AAZObjectType()

    _element = _schema_alert_rule_read.discriminate_by("kind", "Fusion").properties.scenario_exclusion_patterns.Element
    _element.date_added_in_utc = AAZStrType(
        serialized_name="dateAddedInUTC",
        flags={"required": True},
    )
    _element.exclusion_pattern = AAZStrType(
        serialized_name="exclusionPattern",
        flags={"required": True},
    )

    source_settings = _schema_alert_rule_read.discriminate_by("kind", "Fusion").properties.source_settings
    source_settings.Element = AAZObjectType()

    _element = _schema_alert_rule_read.discriminate_by("kind", "Fusion").properties.source_settings.Element
    _element.enabled = AAZBoolType(
        flags={"required": True},
    )
    _element.source_name = AAZStrType(
        serialized_name="sourceName",
        flags={"required": True},
    )
    _element.source_sub_types = AAZListType(
        serialized_name="sourceSubTypes",
    )

    source_sub_types = _schema_alert_rule_read.discriminate_by("kind", "Fusion").properties.source_settings.Element.source_sub_types
    source_sub_types.Element = AAZObjectType()

    _element = _schema_alert_rule_read.discriminate_by("kind", "Fusion").properties.source_settings.Element.source_sub_types.Element
    _element.enabled = AAZBoolType(
        flags={"required": True},
    )
    _element.severity_filters = AAZObjectType(
        serialized_name="severityFilters",
        flags={"required": True},
    )
    _element.source_sub_type_display_name = AAZStrType(
        serialized_name="sourceSubTypeDisplayName",
        flags={"read_only": True},
    )
    _element.source_sub_type_name = AAZStrType(
        serialized_name="sourceSubTypeName",
        flags={"required": True},
    )

    severity_filters = _schema_alert_rule_read.discriminate_by("kind", "Fusion").properties.source_settings.Element.source_sub_types.Element.severity_filters
    severity_filters.filters = AAZListType()
    severity_filters.is_supported = AAZBoolType(
        serialized_name="isSupported",
        flags={"read_only": True},
    )

    filters = _schema_alert_rule_read.discriminate_by("kind", "Fusion").properties.source_settings.Element.source_sub_types.Element.severity_filters.filters
    filters.Element = AAZObjectType()

    _element = _schema_alert_rule_read.discriminate_by("kind", "Fusion").properties.source_settings.Element.source_sub_types.Element.severity_filters.filters.Element
    _element.enabled = AAZBoolType(
        flags={"required": True},
    )
    _element.severity = AAZStrType(
        flags={"required": True},
    )

    tactics = _schema_alert_rule_read.discriminate_by("kind", "Fusion").properties.tactics
    tactics.Element = AAZStrType(
        flags={"read_only": True},
    )

    techniques = _schema_alert_rule_read.discriminate_by("kind", "Fusion").properties.techniques
    techniques.Element = AAZStrType(
        flags={"read_only": True},
    )

    disc_ml_behavior_analytics = _schema_alert_rule_read.discriminate_by("kind", "MLBehaviorAnalytics")
    disc_ml_behavior_analytics.properties = AAZObjectType(
        flags={"client_flatten": True},
    )

    properties = _schema_alert_rule_read.discriminate_by("kind", "MLBehaviorAnalytics").properties
    properties.alert_rule_template_name = AAZStrType(
        serialized_name="alertRuleTemplateName",
        flags={"required": True},
    )
    properties.description = AAZStrType(
        flags={"read_only": True},
    )
    properties.display_name = AAZStrType(
        serialized_name="displayName",
        flags={"read_only": True},
    )
    properties.enabled = AAZBoolType(
        flags={"required": True},
    )
    properties.last_modified_utc = AAZStrType(
        serialized_name="lastModifiedUtc",
        flags={"read_only": True},
    )
    properties.severity = AAZStrType(
        flags={"read_only": True},
    )
    properties.tactics = AAZListType(
        flags={"read_only": True},
    )
    properties.techniques = AAZListType(
        flags={"read_only": True},
    )

    tactics = _schema_alert_rule_read.discriminate_by("kind", "MLBehaviorAnalytics").properties.tactics
    tactics.Element = AAZStrType(
        flags={"read_only": True},
    )

    techniques = _schema_alert_rule_read.discriminate_by("kind", "MLBehaviorAnalytics").properties.techniques
    techniques.Element = AAZStrType(
        flags={"read_only": True},
    )

    disc_microsoft_security_incident_creation = _schema_alert_rule_read.discriminate_by("kind", "MicrosoftSecurityIncidentCreation")
    disc_microsoft_security_incident_creation.properties = AAZObjectType(
        flags={"client_flatten": True},
    )

    properties = _schema_alert_rule_read.discriminate_by("kind", "MicrosoftSecurityIncidentCreation").properties
    properties.alert_rule_template_name = AAZStrType(
        serialized_name="alertRuleTemplateName",
    )
    properties.description = AAZStrType()
    properties.display_name = AAZStrType(
        serialized_name="displayName",
        flags={"required": True},
    )
    properties.display_names_exclude_filter = AAZListType(
        serialized_name="displayNamesExcludeFilter",
    )
    properties.display_names_filter = AAZListType(
        serialized_name="displayNamesFilter",
    )
    properties.enabled = AAZBoolType(
        flags={"required": True},
    )
    properties.last_modified_utc = AAZStrType(
        serialized_name="lastModifiedUtc",
        flags={"read_only": True},
    )
    properties.product_filter = AAZStrType(
        serialized_name="productFilter",
        flags={"required": True},
    )
    properties.severities_filter = AAZListType(
        serialized_name="severitiesFilter",
    )

    display_names_exclude_filter = _schema_alert_rule_read.discriminate_by("kind", "MicrosoftSecurityIncidentCreation").properties.display_names_exclude_filter
    display_names_exclude_filter.Element = AAZStrType()

    display_names_filter = _schema_alert_rule_read.discriminate_by("kind", "MicrosoftSecurityIncidentCreation").properties.display_names_filter
    display_names_filter.Element = AAZStrType()

    severities_filter = _schema_alert_rule_read.discriminate_by("kind", "MicrosoftSecurityIncidentCreation").properties.severities_filter
    severities_filter.Element = AAZStrType()

    disc_nrt = _schema_alert_rule_read.discriminate_by("kind", "NRT")
    disc_nrt.properties = AAZObjectType(
        flags={"client_flatten": True},
    )

    properties = _schema_alert_rule_read.discriminate_by("kind", "NRT").properties
    properties.alert_details_override = AAZObjectType(
        serialized_name="alertDetailsOverride",
    )
    _build_schema_alert_details_override_read(properties.alert_details_override)
    properties.alert_rule_template_name = AAZStrType(
        serialized_name="alertRuleTemplateName",
    )
    properties.custom_details = AAZDictType(
        serialized_name="customDetails",
    )
    properties.description = AAZStrType()
    properties.display_name = AAZStrType(
        serialized_name="displayName",
        flags={"required": True},
    )
    properties.enabled = AAZBoolType(
        flags={"required": True},
    )
    properties.entity_mappings = AAZListType(
        serialized_name="entityMappings",
    )
    _build_schema_entity_mappings_read(properties.entity_mappings)
    properties.incident_configuration = AAZObjectType(
        serialized_name="incidentConfiguration",
    )
    _build_schema_incident_configuration_read(properties.incident_configuration)
    properties.last_modified_utc = AAZStrType(
        serialized_name="lastModifiedUtc",
        flags={"read_only": True},
    )
    properties.query = AAZStrType(
        flags={"required": True},
    )
    properties.severity = AAZStrType(
        flags={"required": True},
    )
    properties.suppression_duration = AAZStrType(
        serialized_name="suppressionDuration",
        flags={"required": True},
    )
    properties.suppression_enabled = AAZBoolType(
        serialized_name="suppressionEnabled",
        flags={"required": True},
    )
    properties.tactics = AAZListType()
    properties.techniques = AAZListType()
    properties.template_version = AAZStrType(
        serialized_name="templateVersion",
    )

    custom_details = _schema_alert_rule_read.discriminate_by("kind", "NRT").properties.custom_details
    custom_details.Element = AAZStrType()

    tactics = _schema_alert_rule_read.discriminate_by("kind", "NRT").properties.tactics
    tactics.Element = AAZStrType()

    techniques = _schema_alert_rule_read.discriminate_by("kind", "NRT").properties.techniques
    techniques.Element = AAZStrType()

    disc_scheduled = _schema_alert_rule_read.discriminate_by("kind", "Scheduled")
    disc_scheduled.properties = AAZObjectType(
        flags={"client_flatten": True},
    )

    properties = _schema_alert_rule_read.discriminate_by("kind", "Scheduled").properties
    properties.alert_details_override = AAZObjectType(
        serialized_name="alertDetailsOverride",
    )
    _build_schema_alert_details_override_read(properties.alert_details_override)
    properties.alert_rule_template_name = AAZStrType(
        serialized_name="alertRuleTemplateName",
    )
    properties.custom_details = AAZDictType(
        serialized_name="customDetails",
    )
    properties.description = AAZStrType()
    properties.display_name = AAZStrType(
        serialized_name="displayName",
        flags={"required": True},
    )
    properties.enabled = AAZBoolType(
        flags={"required": True},
    )
    properties.entity_mappings = AAZListType(
        serialized_name="entityMappings",
    )
    _build_schema_entity_mappings_read(properties.entity_mappings)
    properties.event_grouping_settings = AAZObjectType(
        serialized_name="eventGroupingSettings",
    )
    properties.incident_configuration = AAZObjectType(
        serialized_name="incidentConfiguration",
    )
    _build_schema_incident_configuration_read(properties.incident_configuration)
    properties.last_modified_utc = AAZStrType(
        serialized_name="lastModifiedUtc",
        flags={"read_only": True},
    )
    properties.query = AAZStrType(
        flags={"required": True},
    )
    properties.query_frequency = AAZStrType(
        serialized_name="queryFrequency",
        flags={"required": True},
    )
    properties.query_period = AAZStrType(
        serialized_name="queryPeriod",
        flags={"required": True},
    )
    properties.severity = AAZStrType(
        flags={"required": True},
    )
    properties.suppression_duration = AAZStrType(
        serialized_name="suppressionDuration",
        flags={"required": True},
    )
    properties.suppression_enabled = AAZBoolType(
        serialized_name="suppressionEnabled",
        flags={"required": True},
    )
    properties.tactics = AAZListType()
    properties.techniques = AAZListType()
    properties.template_version = AAZStrType(
        serialized_name="templateVersion",
    )
    properties.trigger_operator = AAZStrType(
        serialized_name="triggerOperator",
        flags={"required": True},
    )
    properties.trigger_threshold = AAZIntType(
        serialized_name="triggerThreshold",
        flags={"required": True},
    )

    custom_details = _schema_alert_rule_read.discriminate_by("kind", "Scheduled").properties.custom_details
    custom_details.Element = AAZStrType()

    event_grouping_settings = _schema_alert_rule_read.discriminate_by("kind", "Scheduled").properties.event_grouping_settings
    event_grouping_settings.aggregation_kind = AAZStrType(
        serialized_name="aggregationKind",
    )

    tactics = _schema_alert_rule_read.discriminate_by("kind", "Scheduled").properties.tactics
    tactics.Element = AAZStrType()

    techniques = _schema_alert_rule_read.discriminate_by("kind", "Scheduled").properties.techniques
    techniques.Element = AAZStrType()

    disc_threat_intelligence = _schema_alert_rule_read.discriminate_by("kind", "ThreatIntelligence")
    disc_threat_intelligence.properties = AAZObjectType(
        flags={"client_flatten": True},
    )

    properties = _schema_alert_rule_read.discriminate_by("kind", "ThreatIntelligence").properties
    properties.alert_rule_template_name = AAZStrType(
        serialized_name="alertRuleTemplateName",
        flags={"required": True},
    )
    properties.description = AAZStrType(
        flags={"read_only": True},
    )
    properties.display_name = AAZStrType(
        serialized_name="displayName",
        flags={"read_only": True},
    )
    properties.enabled = AAZBoolType(
        flags={"required": True},
    )
    properties.last_modified_utc = AAZStrType(
        serialized_name="lastModifiedUtc",
        flags={"read_only": True},
    )
    properties.severity = AAZStrType(
        flags={"read_only": True},
    )
    properties.tactics = AAZListType(
        flags={"read_only": True},
    )
    properties.techniques = AAZListType(
        flags={"read_only": True},
    )

    tactics = _schema_alert_rule_read.discriminate_by("kind", "ThreatIntelligence").properties.tactics
    tactics.Element = AAZStrType(
        flags={"read_only": True},
    )

    techniques = _schema_alert_rule_read.discriminate_by("kind", "ThreatIntelligence").properties.techniques
    techniques.Element = AAZStrType(
        flags={"read_only": True},
    )

    _schema.etag = _schema_alert_rule_read.etag
    _schema.id = _schema_alert_rule_read.id
    _schema.kind = _schema_alert_rule_read.kind
    _schema.name = _schema_alert_rule_read.name
    _schema.system_data = _schema_alert_rule_read.system_data
    _schema.type = _schema_alert_rule_read.type
    _schema.discriminate_by(
            "kind",
            "Fusion",
            _schema_alert_rule_read.discriminate_by(
                "kind",
                "Fusion",
            )
        )
    _schema.discriminate_by(
            "kind",
            "MLBehaviorAnalytics",
            _schema_alert_rule_read.discriminate_by(
                "kind",
                "MLBehaviorAnalytics",
            )
        )
    _schema.discriminate_by(
            "kind",
            "MicrosoftSecurityIncidentCreation",
            _schema_alert_rule_read.discriminate_by(
                "kind",
                "MicrosoftSecurityIncidentCreation",
            )
        )
    _schema.discriminate_by(
            "kind",
            "NRT",
            _schema_alert_rule_read.discriminate_by(
                "kind",
                "NRT",
            )
        )
    _schema.discriminate_by(
            "kind",
            "Scheduled",
            _schema_alert_rule_read.discriminate_by(
                "kind",
                "Scheduled",
            )
        )
    _schema.discriminate_by(
            "kind",
            "ThreatIntelligence",
            _schema_alert_rule_read.discriminate_by(
                "kind",
                "ThreatIntelligence",
            )
        )


_schema_entity_mappings_read = None


def _build_schema_entity_mappings_read(_schema):
    global _schema_entity_mappings_read
    if _schema_entity_mappings_read is not None:
        _schema.Element = _schema_entity_mappings_read.Element
        return

    _schema_entity_mappings_read = AAZListType()

    entity_mappings_read = _schema_entity_mappings_read
    entity_mappings_read.Element = AAZObjectType()

    _element = _schema_entity_mappings_read.Element
    _element.entity_type = AAZStrType(
        serialized_name="entityType",
    )
    _element.field_mappings = AAZListType(
        serialized_name="fieldMappings",
    )

    field_mappings = _schema_entity_mappings_read.Element.field_mappings
    field_mappings.Element = AAZObjectType()

    _element = _schema_entity_mappings_read.Element.field_mappings.Element
    _element.column_name = AAZStrType(
        serialized_name="columnName",
    )
    _element.identifier = AAZStrType()

    _schema.Element = _schema_entity_mappings_read.Element


_schema_incident_configuration_read = None


def _build_schema_incident_configuration_read(_schema):
    global _schema_incident_configuration_read
    if _schema_incident_configuration_read is not None:
        _schema.create_incident = _schema_incident_configuration_read.create_incident
        _schema.grouping_configuration = _schema_incident_configuration_read.grouping_configuration
        return

    _schema_incident_configuration_read = AAZObjectType()

    incident_configuration_read = _schema_incident_configuration_read
    incident_configuration_read.create_incident = AAZBoolType(
        serialized_name="createIncident",
        flags={"required": True},
    )
    incident_configuration_read.grouping_configuration = AAZObjectType(
        serialized_name="groupingConfiguration",
    )

    grouping_configuration = _schema_incident_configuration_read.grouping_configuration
    grouping_configuration.enabled = AAZBoolType(
        flags={"required": True},
    )
    grouping_configuration.group_by_alert_details = AAZListType(
        serialized_name="groupByAlertDetails",
    )
    grouping_configuration.group_by_custom_details = AAZListType(
        serialized_name="groupByCustomDetails",
    )
    grouping_configuration.group_by_entities = AAZListType(
        serialized_name="groupByEntities",
    )
    grouping_configuration.lookback_duration = AAZStrType(
        serialized_name="lookbackDuration",
        flags={"required": True},
    )
    grouping_configuration.matching_method = AAZStrType(
        serialized_name="matchingMethod",
        flags={"required": True},
    )
    grouping_configuration.reopen_closed_incident = AAZBoolType(
        serialized_name="reopenClosedIncident",
        flags={"required": True},
    )

    group_by_alert_details = _schema_incident_configuration_read.grouping_configuration.group_by_alert_details
    group_by_alert_details.Element = AAZStrType()

    group_by_custom_details = _schema_incident_configuration_read.grouping_configuration.group_by_custom_details
    group_by_custom_details.Element = AAZStrType()

    group_by_entities = _schema_incident_configuration_read.grouping_configuration.group_by_entities
    group_by_entities.Element = AAZStrType()

    _schema.create_incident = _schema_incident_configuration_read.create_incident
    _schema.grouping_configuration = _schema_incident_configuration_read.grouping_configuration


__all__ = ["Update"]
