MTP data connector- filter alerts by provider

specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2023-02-01-preview/dataConnectors.json

@@ -211,6 +211,9 @@
           },
           "Creates or updates a APIPolling data connector": {
             "$ref": "./examples/dataConnectors/CreateAPIPolling.json"
+          },
+          "Creates or updates a MicrosoftThreatProtection data connector": {
+            "$ref": "./examples/dataConnectors/CreateMicrosoftThreatProtectionDataConnetor.json"
           }
         },
         "tags": [
@@ -1165,7 +1168,16 @@
               "$ref": "#/definitions/DataConnectorDataTypeCommon"
             }
           ],
-          "description": "Data type for Microsoft Threat Protection Platforms data connector.",
+          "description": "Incidents data type for Microsoft Threat Protection Platforms data connector.",
+          "type": "object"
+        },
+        "alerts": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/DataConnectorDataTypeCommon"
+            }
+          ],
+          "description": "Alerts data type for Microsoft Threat Protection Platforms data connector.",
           "type": "object"
         }
       },
@@ -1174,6 +1186,34 @@
         "incidents"
       ]
     },
+    "MtpProvider": {
+      "description": "The available data providers.",
+      "enum": [
+        "microsoftDefenderForCloudApps",
+        "microsoftDefenderForIdentity"
+      ],
+      "type": "string",
+      "x-ms-enum": {
+        "modelAsString": true,
+        "name": "MtpProvider"
+      }
+    },
+    "MtpFilteredProviders": {
+      "description": "Represents the connector's Filtered providers",
+      "properties": {
+        "alerts": {
+          "description": "Alerts filtered providers. When filters are not applied, all alerts will stream through the MTP pipeline, still in private preview for all products EXCEPT MDA and MDI, which are in GA state.",
+          "items": {
+            "$ref": "#/definitions/MtpProvider"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object",
+      "required": [
+        "alerts"
+      ]
+    },
     "MTPDataConnectorProperties": {
       "allOf": [
         {
@@ -1185,6 +1225,10 @@
         "dataTypes": {
           "$ref": "#/definitions/MTPDataConnectorDataTypes",
           "description": "The available data types for the connector."
+        },
+        "filteredProviders": {
+          "$ref": "#/definitions/MtpFilteredProviders",
+          "description": "The available filtered providers for the connector."
         }
       },
       "required": [

specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2023-02-01-preview/examples/dataConnectors/CreateMicrosoftThreatProtectionDataConnetor.json

@@ -0,0 +1,81 @@
+{
+  "parameters": {
+    "api-version": "2023-02-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "dataConnectorId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+    "dataConnector": {
+      "kind": "MicrosoftThreatProtection",
+      "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+      "properties": {
+        "tenantId": "178265c4-3136-4ff6-8ed1-b5b62b4cb5f5",
+        "dataTypes": {
+          "incidents": {
+            "state": "Disabled"
+          },
+          "alerts": {
+            "state": "Enabled"
+          }
+        },
+        "filteredProviders": {
+          "alerts": [
+            "microsoftDefenderForCloudApps"
+          ]
+        }
+      }
+    }
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/595c870a-5b74-4a23-984c-9ddba29cefe3",
+        "name": "595c870a-5b74-4a23-984c-9ddba29cefe3",
+        "type": "Microsoft.SecurityInsights/dataConnectors",
+        "kind": "MicrosoftThreatProtection",
+        "etag": "2b61bd0c-62b4-4968-8f9a-71b91be61127",
+        "properties": {
+          "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
+          "dataTypes": {
+            "incidents": {
+              "state": "Disabled55"
+            },
+            "alerts": {
+              "state": "Enabled"
+            }
+          },
+          "filteredProviders": {
+            "alerts": [
+              "microsoftDefenderForCloudApps"
+            ]
+          }
+        }
+      }
+    },
+    "201": {
+      "body": {
+        "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/595c870a-5b74-4a23-984c-9ddba29cefe3",
+        "name": "595c870a-5b74-4a23-984c-9ddba29cefe3",
+        "type": "Microsoft.SecurityInsights/dataConnectors",
+        "kind": "MicrosoftThreatProtection",
+        "etag": "2b61bd0c-62b4-4968-8f9a-71b91be61127",
+        "properties": {
+          "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
+          "dataTypes": {
+            "incidents": {
+              "state": "Disabled"
+            },
+            "alerts": {
+              "state": "Enabled"
+            }
+          },
+          "filteredProviders": {
+            "alerts": [
+              "microsoftDefenderForCloudApps"
+            ]
+          }
+        }
+      }
+    }
+  }
+}

specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2023-02-01-preview/examples/dataConnectors/GetMicrosoftThreatProtectionById.json

@@ -19,7 +19,15 @@
           "dataTypes": {
             "incidents": {
               "state": "Enabled"
+            },
+            "alerts": {
+              "state": "Enabled"
             }
+          },
+          "filteredProviders": {
+            "alerts": [
+              "microsoftDefenderForCloudApps"
+            ]
           }
         }
       }