//go:build go1.18
// +build go1.18

// Copyright (c) Microsoft Corporation. All rights reserved.
// Licensed under the MIT License. See License.txt in the project root for license information.
// Code generated by Microsoft (R) AutoRest Code Generator.
// Changes may cause incorrect behavior and will be lost if the code is regenerated.
// DO NOT EDIT.

package armsecurityinsights_test

import (
	"context"
	"log"

	"time"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/securityinsights/armsecurityinsights/v2"
)

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetEntities.json
func ExampleEntitiesClient_NewListPager() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	pager := clientFactory.NewEntitiesClient().NewListPager("myRg", "myWorkspace", nil)
	for pager.More() {
		page, err := pager.NextPage(ctx)
		if err != nil {
			log.Fatalf("failed to advance page: %v", err)
		}
		for _, v := range page.Value {
			// You could use page here. We use blank identifier for just demo purposes.
			_ = v
		}
		// If the HTTP response code is 200 as defined in example definition, your page structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
		// page.EntityList = armsecurityinsights.EntityList{
		// 	Value: []armsecurityinsights.EntityClassification{
		// 		&armsecurityinsights.AccountEntity{
		// 			Name: to.Ptr("e1d3d618-e11f-478b-98e3-bb381539a8e1"),
		// 			Type: to.Ptr("Microsoft.SecurityInsights/entities"),
		// 			ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1"),
		// 			Kind: to.Ptr(armsecurityinsights.EntityKindAccount),
		// 			Properties: &armsecurityinsights.AccountEntityProperties{
		// 				FriendlyName: to.Ptr("administrator"),
		// 				AADTenantID: to.Ptr("70fbdad0-7441-4564-b2b5-2b8862d0fee0"),
		// 				AADUserID: to.Ptr("f7033626-2572-46b1-bba0-06646f4f95b3"),
		// 				AccountName: to.Ptr("administrator"),
		// 				IsDomainJoined: to.Ptr(true),
		// 				NtDomain: to.Ptr("domain"),
		// 				ObjectGUID: to.Ptr("11227b78-3c6e-436e-a2a2-02fc7662eca0"),
		// 				Puid: to.Ptr("ee3cb2d8-14ba-45ef-8009-d6f1cacfa04d"),
		// 				Sid: to.Ptr("S-1-5-18"),
		// 				UpnSuffix: to.Ptr("contoso"),
		// 			},
		// 		},
		// 		&armsecurityinsights.HostEntity{
		// 			Name: to.Ptr("fed9fe89-dce8-40f2-bf44-70f23fe93b3c"),
		// 			Type: to.Ptr("Microsoft.SecurityInsights/entities"),
		// 			ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/fed9fe89-dce8-40f2-bf44-70f23fe93b3c"),
		// 			Kind: to.Ptr(armsecurityinsights.EntityKindHost),
		// 			Properties: &armsecurityinsights.HostEntityProperties{
		// 				FriendlyName: to.Ptr("vm1"),
		// 				AzureID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.Compute/virtualMachines/vm1"),
		// 				DNSDomain: to.Ptr("contoso"),
		// 				HostName: to.Ptr("vm1"),
		// 				IsDomainJoined: to.Ptr(true),
		// 				NetBiosName: to.Ptr("contoso"),
		// 				NtDomain: to.Ptr("domain"),
		// 				OmsAgentID: to.Ptr("70fbdad0-7441-4564-b2b5-2b8862d0fee0"),
		// 				OSFamily: to.Ptr(armsecurityinsights.OSFamilyWindows),
		// 				OSVersion: to.Ptr("1.0"),
		// 			},
		// 		},
		// 		&armsecurityinsights.FileEntity{
		// 			Name: to.Ptr("af378b21-b4aa-4fe7-bc70-13f8621a322f"),
		// 			Type: to.Ptr("Microsoft.SecurityInsights/entities"),
		// 			ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/af378b21-b4aa-4fe7-bc70-13f8621a322f"),
		// 			Kind: to.Ptr(armsecurityinsights.EntityKindFile),
		// 			Properties: &armsecurityinsights.FileEntityProperties{
		// 				FriendlyName: to.Ptr("cmd.exe"),
		// 				Directory: to.Ptr("C:\\Windows\\System32"),
		// 				FileName: to.Ptr("cmd.exe"),
		// 			},
		// 	}},
		// }
	}
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetCloudApplicationEntityById.json
func ExampleEntitiesClient_Get_getACloudApplicationEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "e1d3d618-e11f-478b-98e3-bb381539a8e1", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.CloudApplicationEntity{
	// 		Name: to.Ptr("e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindCloudApplication),
	// 		Properties: &armsecurityinsights.CloudApplicationEntityProperties{
	// 			FriendlyName: to.Ptr("AppName"),
	// 			AppID: to.Ptr[int32](1),
	// 			AppName: to.Ptr("AppName"),
	// 			InstanceName: to.Ptr("InstanceName"),
	// 		},
	// 	},
	// 	                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetDnsEntityById.json
func ExampleEntitiesClient_Get_getADnsEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "f4e74920-f2c0-4412-a45f-66d94fdf01f8", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.DNSEntity{
	// 		Name: to.Ptr("f4e74920-f2c0-4412-a45f-66d94fdf01f8"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/f4e74920-f2c0-4412-a45f-66d94fdf01f8"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindDNSResolution),
	// 		Properties: &armsecurityinsights.DNSEntityProperties{
	// 			FriendlyName: to.Ptr("domain"),
	// 			DomainName: to.Ptr("domain"),
	// 			IPAddressEntityIDs: []*string{
	// 				to.Ptr("475d3120-33e0-4841-9f1c-a8f15a801d19")},
	// 			},
	// 		},
	// 		                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetFileEntityById.json
func ExampleEntitiesClient_Get_getAFileEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "af378b21-b4aa-4fe7-bc70-13f8621a322f", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.FileEntity{
	// 		Name: to.Ptr("af378b21-b4aa-4fe7-bc70-13f8621a322f"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/af378b21-b4aa-4fe7-bc70-13f8621a322f"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindFile),
	// 		Properties: &armsecurityinsights.FileEntityProperties{
	// 			FriendlyName: to.Ptr("cmd.exe"),
	// 			Directory: to.Ptr("C:\\Windows\\System32"),
	// 			FileName: to.Ptr("cmd.exe"),
	// 		},
	// 	},
	// 	                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetFileHashEntityById.json
func ExampleEntitiesClient_Get_getAFileHashEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "ea359fa6-c1e5-f878-e105-6344f3e399a1", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.FileHashEntity{
	// 		Name: to.Ptr("ea359fa6-c1e5-f878-e105-6344f3e399a1"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/ea359fa6-c1e5-f878-e105-6344f3e399a1"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindFileHash),
	// 		Properties: &armsecurityinsights.FileHashEntityProperties{
	// 			FriendlyName: to.Ptr("E923636F1093C414AAB39F846E9D7A372BEEFA7B628B28179197E539C56AA0F0(SHA256)"),
	// 			Algorithm: to.Ptr(armsecurityinsights.FileHashAlgorithmSHA256),
	// 			HashValue: to.Ptr("E923636F1093C414AAB39F846E9D7A372BEEFA7B628B28179197E539C56AA0F0"),
	// 		},
	// 	},
	// 	                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetHostEntityById.json
func ExampleEntitiesClient_Get_getAHostEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "e1d3d618-e11f-478b-98e3-bb381539a8e1", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.HostEntity{
	// 		Name: to.Ptr("e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindHost),
	// 		Properties: &armsecurityinsights.HostEntityProperties{
	// 			FriendlyName: to.Ptr("vm1"),
	// 			AzureID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.Compute/virtualMachines/vm1"),
	// 			DNSDomain: to.Ptr("contoso"),
	// 			HostName: to.Ptr("vm1"),
	// 			IsDomainJoined: to.Ptr(true),
	// 			NetBiosName: to.Ptr("contoso"),
	// 			NtDomain: to.Ptr("domain"),
	// 			OmsAgentID: to.Ptr("70fbdad0-7441-4564-b2b5-2b8862d0fee0"),
	// 			OSFamily: to.Ptr(armsecurityinsights.OSFamilyWindows),
	// 			OSVersion: to.Ptr("1.0"),
	// 		},
	// 	},
	// 	                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetMailClusterEntityById.json
func ExampleEntitiesClient_Get_getAMailClusterEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "e1d3d618-e11f-478b-98e3-bb381539a8e1", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.MailClusterEntity{
	// 		Name: to.Ptr("e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindMailCluster),
	// 		Properties: &armsecurityinsights.MailClusterEntityProperties{
	// 			FriendlyName: to.Ptr("ClusterSourceIdentifier"),
	// 			ClusterGroup: to.Ptr("cluster group"),
	// 			ClusterSourceIdentifier: to.Ptr("cluster source identifier"),
	// 			ClusterSourceType: to.Ptr("Similarity"),
	// 			CountByDeliveryStatus: map[string]any{
	// 				"deliveryStatus": float64(5),
	// 			},
	// 			CountByProtectionStatus: map[string]any{
	// 				"protectionStatus": float64(65),
	// 			},
	// 			CountByThreatType: map[string]any{
	// 				"threatType": float64(6),
	// 			},
	// 			NetworkMessageIDs: []*string{
	// 				to.Ptr("ccfce855-e02f-491b-a1cc-5bafb371ad0c")},
	// 				Query: to.Ptr("kqlFilter"),
	// 				QueryTime: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2021-09-01T01:42:01.602Z"); return t}()),
	// 				Source: to.Ptr("ClusterSourceIdentifier"),
	// 				Threats: []*string{
	// 					to.Ptr("thrreat1"),
	// 					to.Ptr("thread2")},
	// 				},
	// 			},
	// 			                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetMailMessageEntityById.json
func ExampleEntitiesClient_Get_getAMailMessageEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "e1d3d618-e11f-478b-98e3-bb381539a8e1", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.MailMessageEntity{
	// 		Name: to.Ptr("e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindMailMessage),
	// 		Properties: &armsecurityinsights.MailMessageEntityProperties{
	// 			FriendlyName: to.Ptr("cmd.exe"),
	// 			DeliveryAction: to.Ptr(armsecurityinsights.DeliveryActionBlocked),
	// 			FileEntityIDs: []*string{
	// 				to.Ptr("ccfce855-e02f-491b-a1cc-5bafb371ad0c")},
	// 				InternetMessageID: to.Ptr("message id"),
	// 				P1Sender: to.Ptr("email@fake.com"),
	// 				P1SenderDisplayName: to.Ptr("p1 sender display name"),
	// 				P1SenderDomain: to.Ptr("p1 sender domain"),
	// 				P2Sender: to.Ptr("the sender"),
	// 				P2SenderDisplayName: to.Ptr("p2 sender display name"),
	// 				P2SenderDomain: to.Ptr("p2 Sender Domain"),
	// 				Recipient: to.Ptr("recipient"),
	// 				SenderIP: to.Ptr("1.23.34.43"),
	// 				Subject: to.Ptr("subject"),
	// 				ThreatDetectionMethods: []*string{
	// 					to.Ptr("thrreat1"),
	// 					to.Ptr("thread2")},
	// 					Threats: []*string{
	// 						to.Ptr("thrreat1"),
	// 						to.Ptr("thread2")},
	// 						Urls: []*string{
	// 							to.Ptr("http://moqbrarcwmnk.banxhdcojlg.biz")},
	// 							Language: to.Ptr("language"),
	// 						},
	// 					},
	// 					                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetMailboxEntityById.json
func ExampleEntitiesClient_Get_getAMailboxEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "e1d3d618-e11f-478b-98e3-bb381539a8e1", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.MailboxEntity{
	// 		Name: to.Ptr("e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindMailbox),
	// 		Properties: &armsecurityinsights.MailboxEntityProperties{
	// 			FriendlyName: to.Ptr("emailAddress1"),
	// 			DisplayName: to.Ptr("display name"),
	// 			ExternalDirectoryObjectID: to.Ptr("18cc8fdc-e169-4451-983a-bd027db286eb"),
	// 			MailboxPrimaryAddress: to.Ptr("emailAddress1"),
	// 			Upn: to.Ptr("upn1"),
	// 		},
	// 	},
	// 	                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetMalwareEntityById.json
func ExampleEntitiesClient_Get_getAMalwareEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "af378b21-b4aa-4fe7-bc70-13f8621a322f", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.MalwareEntity{
	// 		Name: to.Ptr("af378b21-b4aa-4fe7-bc70-13f8621a322f"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/af378b21-b4aa-4fe7-bc70-13f8621a322f"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindMalware),
	// 		Properties: &armsecurityinsights.MalwareEntityProperties{
	// 			FriendlyName: to.Ptr("Win32/Toga!rfn"),
	// 			Category: to.Ptr("Trojan"),
	// 			MalwareName: to.Ptr("Win32/Toga!rfn"),
	// 		},
	// 	},
	// 	                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetProcessEntityById.json
func ExampleEntitiesClient_Get_getAProcessEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "7264685c-038c-42c6-948c-38e14ef1fb98", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.ProcessEntity{
	// 		Name: to.Ptr("7264685c-038c-42c6-948c-38e14ef1fb98"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/7264685c-038c-42c6-948c-38e14ef1fb98"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindProcess),
	// 		Properties: &armsecurityinsights.ProcessEntityProperties{
	// 			FriendlyName: to.Ptr("cmd.exe"),
	// 			CommandLine: to.Ptr("\"cmd\""),
	// 			ImageFileEntityID: to.Ptr("bba7b47b-c1c1-4021-b568-5b07b9292f5e"),
	// 			ProcessID: to.Ptr("0x2aa48"),
	// 		},
	// 	},
	// 	                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetRegistryKeyEntityById.json
func ExampleEntitiesClient_Get_getARegistryKeyEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "e1d3d618-e11f-478b-98e3-bb381539a8e1", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.RegistryKeyEntity{
	// 		Name: to.Ptr("e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindRegistryKey),
	// 		Properties: &armsecurityinsights.RegistryKeyEntityProperties{
	// 			FriendlyName: to.Ptr("SOFTWARE"),
	// 			Hive: to.Ptr(armsecurityinsights.RegistryHiveHKEYLOCALMACHINE),
	// 			Key: to.Ptr("SOFTWARE"),
	// 		},
	// 	},
	// 	                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetRegistryValueEntityById.json
func ExampleEntitiesClient_Get_getARegistryValueEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "dc44bd11-b348-4d76-ad29-37bf7aa41356", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.RegistryValueEntity{
	// 		Name: to.Ptr("dc44bd11-b348-4d76-ad29-37bf7aa41356"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/dc44bd11-b348-4d76-ad29-37bf7aa41356"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindRegistryValue),
	// 		Properties: &armsecurityinsights.RegistryValueEntityProperties{
	// 			FriendlyName: to.Ptr("Data"),
	// 			KeyEntityID: to.Ptr("e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 			ValueData: to.Ptr("Data"),
	// 			ValueName: to.Ptr("Name"),
	// 			ValueType: to.Ptr(armsecurityinsights.RegistryValueKindString),
	// 		},
	// 	},
	// 	                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetSecurityAlertEntityById.json
func ExampleEntitiesClient_Get_getASecurityAlertEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "4aa486e0-6f85-41af-99ea-7acdce7be6c8", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.SecurityAlert{
	// 		Name: to.Ptr("e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/4aa486e0-6f85-41af-99ea-7acdce7be6c8"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindSecurityAlert),
	// 		Properties: &armsecurityinsights.SecurityAlertProperties{
	// 			AdditionalData: map[string]any{
	// 				"Query": "Heartbeat \n| extend AccountCustomEntity = \"administrator\"",
	// 				"Query Period": "05:00:00",
	// 				"Search Query Results Overall Count": "203",
	// 				"Total Account Entities": "1",
	// 				"Trigger Operator": "GreaterThan",
	// 				"Trigger Threshold": "200",
	// 			},
	// 			FriendlyName: to.Ptr("Suspicious account detected"),
	// 			Description: to.Ptr(""),
	// 			AlertDisplayName: to.Ptr("Suspicious account detected"),
	// 			AlertLink: to.Ptr("https://portal.azure.com/#blade/Microsoft_Azure_Security/AlertBlade/alertId/2518119885989999999_4aa486e0-6f85-41af-99ea-7acdce7be6c8/subscriptionId/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/myRg/myWorkspace/referencedFrom/alertDeepLink/location/centralus"),
	// 			AlertType: to.Ptr("c8c99641-985d-4e4e-8e91-fb3466cd0e5b_46c7b6c0-ff43-44dd-8b4d-ceffff7aa7df"),
	// 			ConfidenceLevel: to.Ptr(armsecurityinsights.ConfidenceLevelUnknown),
	// 			EndTimeUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2021-09-01T13:21:45.926Z"); return t}()),
	// 			Intent: to.Ptr(armsecurityinsights.KillChainIntentUnknown),
	// 			ProcessingEndTime: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-07-06T13:56:53.539Z"); return t}()),
	// 			ProductComponentName: to.Ptr("Scheduled Alerts"),
	// 			ProductName: to.Ptr("Azure Sentinel"),
	// 			ProviderAlertID: to.Ptr("c2bafff9-fb31-41d0-a177-ecbff7a02ffe"),
	// 			Severity: to.Ptr(armsecurityinsights.AlertSeverityMedium),
	// 			StartTimeUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2021-09-01T08:21:45.926Z"); return t}()),
	// 			Status: to.Ptr(armsecurityinsights.AlertStatusNew),
	// 			SystemAlertID: to.Ptr("4aa486e0-6f85-41af-99ea-7acdce7be6c8"),
	// 			Tactics: []*armsecurityinsights.AttackTactic{
	// 				to.Ptr(armsecurityinsights.AttackTacticPersistence),
	// 				to.Ptr(armsecurityinsights.AttackTacticLateralMovement)},
	// 				TimeGenerated: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2021-09-01T13:56:53.539Z"); return t}()),
	// 				VendorName: to.Ptr("Microsoft"),
	// 			},
	// 		},
	// 		                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetSecurityGroupEntityById.json
func ExampleEntitiesClient_Get_getASecurityGroupEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "e1d3d618-e11f-478b-98e3-bb381539a8e1", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.SecurityGroupEntity{
	// 		Name: to.Ptr("e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindSecurityGroup),
	// 		Properties: &armsecurityinsights.SecurityGroupEntityProperties{
	// 			FriendlyName: to.Ptr("Name"),
	// 			DistinguishedName: to.Ptr("Name"),
	// 			ObjectGUID: to.Ptr("fb1b8e04-d944-4986-b39a-1ce9adedcd98"),
	// 			Sid: to.Ptr("Sid"),
	// 		},
	// 	},
	// 	                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetSubmissionMailEntityById.json
func ExampleEntitiesClient_Get_getASubmissionMailEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "e1d3d618-e11f-478b-98e3-bb381539a8e1", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.SubmissionMailEntity{
	// 		Name: to.Ptr("e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindSubmissionMail),
	// 		Properties: &armsecurityinsights.SubmissionMailEntityProperties{
	// 			FriendlyName: to.Ptr("recipient"),
	// 			Recipient: to.Ptr("recipient"),
	// 			ReportType: to.Ptr("report type"),
	// 			Sender: to.Ptr("sender"),
	// 			SenderIP: to.Ptr("1.4.35.34"),
	// 			Subject: to.Ptr("subject"),
	// 			SubmissionID: to.Ptr("5bb3d8fe-54bc-499c-bc21-86fe8df2a184"),
	// 			Submitter: to.Ptr("submitter"),
	// 		},
	// 	},
	// 	                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetUrlEntityById.json
func ExampleEntitiesClient_Get_getAUrlEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "e1d3d618-e11f-478b-98e3-bb381539a8e1", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.URLEntity{
	// 		Name: to.Ptr("e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindURL),
	// 		Properties: &armsecurityinsights.URLEntityProperties{
	// 			FriendlyName: to.Ptr("https://bing.com"),
	// 			URL: to.Ptr("https://bing.com"),
	// 		},
	// 	},
	// 	                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetIoTDeviceEntityById.json
func ExampleEntitiesClient_Get_getAnIoTDeviceEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "e1d3d618-e11f-478b-98e3-bb381539a8e1", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.IoTDeviceEntity{
	// 		Name: to.Ptr("e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindIoTDevice),
	// 		Properties: &armsecurityinsights.IoTDeviceEntityProperties{
	// 			FriendlyName: to.Ptr("device1"),
	// 			DeviceID: to.Ptr("device1"),
	// 			DeviceName: to.Ptr("device1"),
	// 			DeviceType: to.Ptr("Industrial"),
	// 			FirmwareVersion: to.Ptr("20.11"),
	// 			Importance: to.Ptr(armsecurityinsights.DeviceImportanceNormal),
	// 			IotHubEntityID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/8b2d9401-f953-e89d-2583-be9b4975870c"),
	// 			IsAuthorized: to.Ptr(true),
	// 			IsProgramming: to.Ptr(false),
	// 			IsScanner: to.Ptr(false),
	// 			Model: to.Ptr("demo-model"),
	// 			NicEntityIDs: []*string{
	// 				to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/6ee379bd-ace8-44cf-ab10-ee669a1b71e2")},
	// 				OperatingSystem: to.Ptr("Windows"),
	// 				Protocols: []*string{
	// 					to.Ptr("CIP"),
	// 					to.Ptr("EtherNet/IP")},
	// 					PurdueLayer: to.Ptr("ProcessControl"),
	// 					Sensor: to.Ptr("demo-sensor"),
	// 					Site: to.Ptr("demo-site"),
	// 					Vendor: to.Ptr("demo-vendor"),
	// 					Zone: to.Ptr("zone"),
	// 				},
	// 			},
	// 			                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetAccountEntityById.json
func ExampleEntitiesClient_Get_getAnAccountEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "e1d3d618-e11f-478b-98e3-bb381539a8e1", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.AccountEntity{
	// 		Name: to.Ptr("e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindAccount),
	// 		Properties: &armsecurityinsights.AccountEntityProperties{
	// 			FriendlyName: to.Ptr("administrator"),
	// 			AADTenantID: to.Ptr("70fbdad0-7441-4564-b2b5-2b8862d0fee0"),
	// 			AADUserID: to.Ptr("f7033626-2572-46b1-bba0-06646f4f95b3"),
	// 			AccountName: to.Ptr("administrator"),
	// 			DNSDomain: to.Ptr("contoso.com"),
	// 			IsDomainJoined: to.Ptr(true),
	// 			NtDomain: to.Ptr("domain"),
	// 			ObjectGUID: to.Ptr("11227b78-3c6e-436e-a2a2-02fc7662eca0"),
	// 			Puid: to.Ptr("ee3cb2d8-14ba-45ef-8009-d6f1cacfa04d"),
	// 			Sid: to.Ptr("S-1-5-18"),
	// 			UpnSuffix: to.Ptr("contoso"),
	// 		},
	// 	},
	// 	                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetAzureResourceEntityById.json
func ExampleEntitiesClient_Get_getAnAzureResourceEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "e1d3d618-e11f-478b-98e3-bb381539a8e1", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.AzureResourceEntity{
	// 		Name: to.Ptr("e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindAzureResource),
	// 		Properties: &armsecurityinsights.AzureResourceEntityProperties{
	// 			FriendlyName: to.Ptr("vm1"),
	// 			ResourceID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.Compute/virtualMachines/vm1"),
	// 			SubscriptionID: to.Ptr("d0cfe6b2-9ac0-4464-9919-dccaee2e48c0"),
	// 		},
	// 	},
	// 	                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetIpEntityById.json
func ExampleEntitiesClient_Get_getAnIpEntity() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Get(ctx, "myRg", "myWorkspace", "e1d3d618-e11f-478b-98e3-bb381539a8e1", nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armsecurityinsights.EntitiesClientGetResponse{
	// 	                            EntityClassification: &armsecurityinsights.IPEntity{
	// 		Name: to.Ptr("e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 		ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 		Kind: to.Ptr(armsecurityinsights.EntityKindIP),
	// 		Properties: &armsecurityinsights.IPEntityProperties{
	// 			FriendlyName: to.Ptr("10.3.2.8"),
	// 			Address: to.Ptr("10.3.2.8"),
	// 		},
	// 	},
	// 	                        }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/expand/PostExpandEntity.json
func ExampleEntitiesClient_Expand() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Expand(ctx, "myRg", "myWorkspace", "e1d3d618-e11f-478b-98e3-bb381539a8e1", armsecurityinsights.EntityExpandParameters{
		EndTime:     to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-05-26T00:00:00.000Z"); return t }()),
		ExpansionID: to.Ptr("a77992f3-25e9-4d01-99a4-5ff606cc410a"),
		StartTime:   to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-04-25T00:00:00.000Z"); return t }()),
	}, nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res.EntityExpandResponse = armsecurityinsights.EntityExpandResponse{
	// 	MetaData: &armsecurityinsights.ExpansionResultsMetadata{
	// 		Aggregations: []*armsecurityinsights.ExpansionResultAggregation{
	// 			{
	// 				Count: to.Ptr[int32](1),
	// 				EntityKind: to.Ptr(armsecurityinsights.EntityKindAccount),
	// 		}},
	// 	},
	// 	Value: &armsecurityinsights.EntityExpandResponseValue{
	// 		Edges: []*armsecurityinsights.EntityEdges{
	// 			{
	// 				AdditionalData: map[string]any{
	// 					"EpochTimestamp": "1608289949",
	// 					"FirstSeen": "2021-09-01T11:12:29.597Z",
	// 					"Source": "Heartbeat",
	// 				},
	// 				TargetEntityID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/c1d60d86-5988-11eb-ae93-0242ac130002"),
	// 		}},
	// 		Entities: []armsecurityinsights.EntityClassification{
	// 			&armsecurityinsights.IPEntity{
	// 				Name: to.Ptr("e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 				Type: to.Ptr("Microsoft.SecurityInsights/entities"),
	// 				ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1"),
	// 				Kind: to.Ptr(armsecurityinsights.EntityKindIP),
	// 				Properties: &armsecurityinsights.IPEntityProperties{
	// 					FriendlyName: to.Ptr("13.89.108.248"),
	// 					Address: to.Ptr("13.89.108.248"),
	// 				},
	// 		}},
	// 	},
	// }
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/GetQueries.json
func ExampleEntitiesClient_Queries() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().Queries(ctx, "myRg", "myWorkspace", "e1d3d618-e11f-478b-98e3-bb381539a8e1", armsecurityinsights.EntityItemQueryKindInsight, nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res.GetQueriesResponse = armsecurityinsights.GetQueriesResponse{
	// 	Value: []armsecurityinsights.EntityQueryItemClassification{
	// 		&armsecurityinsights.InsightQueryItem{
	// 			Name: to.Ptr("6db7f5d1-f41e-46c2-b935-230b36a569e6"),
	// 			Type: to.Ptr("Microsoft.SecurityInsights/entities/queries"),
	// 			ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1/queries/6db7f5d1-f41e-46c2-b935-230b36a569e6"),
	// 			Kind: to.Ptr(armsecurityinsights.EntityQueryKindInsight),
	// 			Properties: &armsecurityinsights.InsightQueryItemProperties{
	// 				DataTypes: []*armsecurityinsights.EntityQueryItemPropertiesDataTypesItem{
	// 					{
	// 						DataType: to.Ptr("AuditLogs"),
	// 					},
	// 					{
	// 						DataType: to.Ptr("SecurityEvent"),
	// 				}},
	// 				EntitiesFilter: map[string]any{
	// 				},
	// 				InputEntityType: to.Ptr(armsecurityinsights.EntityTypeAccount),
	// 				RequiredInputFieldsSets: [][]*string{
	// 					[]*string{
	// 						to.Ptr("Account_Name"),
	// 						to.Ptr("Account_NTDomain")},
	// 						[]*string{
	// 							to.Ptr("Account_Name"),
	// 							to.Ptr("Account_UPNSuffix")},
	// 							[]*string{
	// 								to.Ptr("Account_AADUserId")},
	// 								[]*string{
	// 									to.Ptr("Account_SID")}},
	// 									Description: to.Ptr("Summary of actions taken on the specified account, grouped by action: password resets and changes, account lockouts (policy or admin), account creation and deletion, account enabled and disabled\n"),
	// 									AdditionalQuery: &armsecurityinsights.InsightQueryItemPropertiesAdditionalQuery{
	// 										Query: to.Ptr("project TimeGenerated, UserPrincipalName, Account_Name, OperationName, Activity, DisableUser, TargetSid, AADUserId, InitiatedBy, AADTenantId, AccountType, Computer, SubjectAccount, SubjectUserSid, EventData"),
	// 										Text: to.Ptr("See all account activity"),
	// 									},
	// 									BaseQuery: to.Ptr("let GetAccountActions = (v_Account_Name:string, v_Account_NTDomain:string, v_Account_UPNSuffix:string, v_Account_AADUserId:string, v_Account_SID:string){\nAuditLogs\n| where OperationName in~ ('Delete user', 'Change user password', 'Reset user password', 'Change password (self-service)',  'Reset password (by admin)', 'Reset password (self-service)', 'Update user')\n| extend UserPrincipalName = tostring(TargetResources[0].userPrincipalName)\n| extend Account_Name = tostring(split(UserPrincipalName, '@')[0])\n| extend Account_UPNSuffix = tostring(split(UserPrincipalName, '@')[1])\n| extend Action = tostring(parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[0])))\n| extend ModifiedProperty = parse_json(Action).displayName\n| extend ModifiedValue = parse_json(Action).newValue\n| extend Account_AADUserId = tostring(TargetResources[0].id)\n| extend DisableUser = iif(ModifiedProperty =~ 'AccountEnabled' and ModifiedValue =~ '[false]', 'True', 'False')\n| union isfuzzy=true (\nSecurityEvent\n| where EventID in (4720, 4722, 4723, 4724, 4725, 4726, 4740)\n| extend OperationName = tostring(EventID)\n| where AccountType =~ \"user\" or isempty(AccountType)\n| extend Account_Name = TargetUserName, Account_NTDomain = TargetDomainName, Account_SID = TargetSid\n)\n| where (Account_Name =~ v_Account_Name and (Account_UPNSuffix =~ v_Account_UPNSuffix or Account_NTDomain =~ v_Account_NTDomain)) or Account_AADUserId =~ v_Account_AADUserId or Account_SID =~ v_Account_SID\n};\nGetAccountActions('CTFFUser4', '', 'seccxp.ninja', '', '')\n"),
	// 									ChartQuery: map[string]any{
	// 										"type": "BarChart",
	// 										"dataSets":[]any{
	// 											map[string]any{
	// 												"legendColumnName": "OperationName",
	// 												"query": "summarize Count = count() by bin(TimeGenerated, 1h), OperationName",
	// 												"xColumnName": "TimeGenerated",
	// 												"yColumnName": "Count",
	// 											},
	// 										},
	// 										"title": "Actions by type",
	// 									},
	// 									DefaultTimeRange: &armsecurityinsights.InsightQueryItemPropertiesDefaultTimeRange{
	// 										AfterRange: to.Ptr("12h"),
	// 										BeforeRange: to.Ptr("12h"),
	// 									},
	// 									DisplayName: to.Ptr("Actions on account"),
	// 									TableQuery: &armsecurityinsights.InsightQueryItemPropertiesTableQuery{
	// 										ColumnsDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryColumnsDefinitionsItem{
	// 											{
	// 												Header: to.Ptr("Action"),
	// 												OutputType: to.Ptr(armsecurityinsights.OutputTypeString),
	// 												SupportDeepLink: to.Ptr(false),
	// 											},
	// 											{
	// 												Header: to.Ptr("Most Recent"),
	// 												OutputType: to.Ptr(armsecurityinsights.OutputTypeDate),
	// 												SupportDeepLink: to.Ptr(false),
	// 											},
	// 											{
	// 												Header: to.Ptr("Count"),
	// 												OutputType: to.Ptr(armsecurityinsights.OutputTypeNumber),
	// 												SupportDeepLink: to.Ptr(true),
	// 										}},
	// 										QueriesDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryQueriesDefinitionsItem{
	// 											{
	// 												Filter: to.Ptr("where OperationName in~ ('Change user password', 'Reset user password', 'Change password (self-service)',  'Reset password (by admin)', 'Reset password (self-service)', '4724', '4723')"),
	// 												LinkColumnsDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryQueriesDefinitionsPropertiesItemsItem{
	// 													{
	// 														Query: to.Ptr("{{BaseQuery}} | "),
	// 														ProjectedName: to.Ptr("Count"),
	// 												}},
	// 												Project: to.Ptr("project Title = OperationName, MostRecent, Count"),
	// 												Summarize: to.Ptr("summarize MostRecent = max(TimeGenerated), Count = count() by OperationName"),
	// 											},
	// 											{
	// 												Filter: to.Ptr("where OperationName in~ ('Blocked from self-service password reset', '4740')"),
	// 												LinkColumnsDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryQueriesDefinitionsPropertiesItemsItem{
	// 													{
	// 														Query: to.Ptr("{{BaseQuery}} | "),
	// 														ProjectedName: to.Ptr("Count"),
	// 												}},
	// 												Project: to.Ptr("project Title = OperationName, MostRecent, Count"),
	// 												Summarize: to.Ptr("summarize MostRecent = max(TimeGenerated), Count = count() by OperationName"),
	// 											},
	// 											{
	// 												Filter: to.Ptr("where OperationName  == '4725' or (OperationName  =~ 'Update user' and DisableUser =~ 'True')"),
	// 												LinkColumnsDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryQueriesDefinitionsPropertiesItemsItem{
	// 													{
	// 														Query: to.Ptr("{{BaseQuery}} | "),
	// 														ProjectedName: to.Ptr("Count"),
	// 												}},
	// 												Project: to.Ptr("project Title = OperationName, MostRecent, Count"),
	// 												Summarize: to.Ptr("summarize MostRecent = max(TimeGenerated), Count = count() by OperationName"),
	// 											},
	// 											{
	// 												Filter: to.Ptr("where OperationName in~ ('Add user', '4720')"),
	// 												LinkColumnsDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryQueriesDefinitionsPropertiesItemsItem{
	// 													{
	// 														Query: to.Ptr("{{BaseQuery}} | "),
	// 														ProjectedName: to.Ptr("Count"),
	// 												}},
	// 												Project: to.Ptr("project Title = OperationName, MostRecent, Count"),
	// 												Summarize: to.Ptr("summarize MostRecent = max(TimeGenerated), Count = count() by OperationName"),
	// 											},
	// 											{
	// 												Filter: to.Ptr("where OperationName in~ ('Delete user', '4726')"),
	// 												LinkColumnsDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryQueriesDefinitionsPropertiesItemsItem{
	// 													{
	// 														Query: to.Ptr("{{BaseQuery}} | "),
	// 														ProjectedName: to.Ptr("Count"),
	// 												}},
	// 												Project: to.Ptr("project Title = OperationName, MostRecent, Count"),
	// 												Summarize: to.Ptr("summarize MostRecent = max(TimeGenerated), Count = count() by OperationName"),
	// 											},
	// 											{
	// 												Filter: to.Ptr("where OperationName in~ ('4725', 'Blocked from self-service password reset', '4740') or (OperationName  =~ 'Update user' and DisableUser =~ 'True')"),
	// 												LinkColumnsDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryQueriesDefinitionsPropertiesItemsItem{
	// 													{
	// 														Query: to.Ptr("{{BaseQuery}} | "),
	// 														ProjectedName: to.Ptr("Count"),
	// 												}},
	// 												Project: to.Ptr("project Title = OperationName, MostRecent, Count"),
	// 												Summarize: to.Ptr("summarize MostRecent = max(TimeGenerated), Count = count() by OperationName"),
	// 											},
	// 											{
	// 												Filter: to.Ptr("where OperationName in~ ('4722', '4767') or (OperationName  =~ 'Update user' and DisableUser =~ 'False')"),
	// 												LinkColumnsDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryQueriesDefinitionsPropertiesItemsItem{
	// 													{
	// 														Query: to.Ptr("{{BaseQuery}} | "),
	// 														ProjectedName: to.Ptr("Count"),
	// 												}},
	// 												Project: to.Ptr("project Title = OperationName, MostRecent, Count"),
	// 												Summarize: to.Ptr("summarize MostRecent = max(TimeGenerated), Count = count() by OperationName"),
	// 											},
	// 											{
	// 												Filter: to.Ptr("where OperationName in~ ('Update user','4738')"),
	// 												LinkColumnsDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryQueriesDefinitionsPropertiesItemsItem{
	// 													{
	// 														Query: to.Ptr("{{BaseQuery}} | "),
	// 														ProjectedName: to.Ptr("Count"),
	// 												}},
	// 												Project: to.Ptr("project Title = OperationName, MostRecent, Count"),
	// 												Summarize: to.Ptr("summarize MostRecent = max(TimeGenerated), Count = count() by OperationName"),
	// 										}},
	// 									},
	// 								},
	// 							},
	// 							&armsecurityinsights.InsightQueryItem{
	// 								Name: to.Ptr("0a5d7b14-b485-450a-a0ac-4100c860ac32"),
	// 								Type: to.Ptr("Microsoft.SecurityInsights/entities/queries"),
	// 								ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1/queries/0a5d7b14-b485-450a-a0ac-4100c860ac32"),
	// 								Kind: to.Ptr(armsecurityinsights.EntityQueryKindInsight),
	// 								Properties: &armsecurityinsights.InsightQueryItemProperties{
	// 									DataTypes: []*armsecurityinsights.EntityQueryItemPropertiesDataTypesItem{
	// 										{
	// 											DataType: to.Ptr("OfficeActivity"),
	// 									}},
	// 									EntitiesFilter: map[string]any{
	// 									},
	// 									InputEntityType: to.Ptr(armsecurityinsights.EntityTypeAccount),
	// 									RequiredInputFieldsSets: [][]*string{
	// 										[]*string{
	// 											to.Ptr("Account_Name"),
	// 											to.Ptr("Account_UPNSuffix")}},
	// 											Description: to.Ptr("Highlight office operations of the user with anomalously high count compared to those observed in the preceding 14 days."),
	// 											AdditionalQuery: &armsecurityinsights.InsightQueryItemPropertiesAdditionalQuery{
	// 												Query: to.Ptr("make-series count() default=0 on TimeGenerated from (StartTime - BeforeRange) to EndTime step 1d by Operation \n| extend (anomalies,anomalyScore, expectedCount)=series_decompose_anomalies(count_,AScoreThresh,7,'linefit',numDays, 'ctukey') \n| extend count1=count_, TimeGenerated1=TimeGenerated, anomalyScore1=anomalyScore\n| mv-apply count1 to typeof(long), TimeGenerated1 to typeof(datetime), anomalyScore1 to typeof(double), anomalies to typeof(long) on (summarize totAnomalies=sumif(abs(anomalies), TimeGenerated1 < StartTime), baseStd=stdevif(count1, TimeGenerated1 < StartTime), baseAvg=avgif(count1, TimeGenerated1 < StartTime), maxCountPost=maxif(count1,TimeGenerated1 >= StartTime), maxAnomalyScorePost = maxif(anomalyScore1, TimeGenerated1 >= StartTime)) \n| extend count1=count_\n| mv-apply  count1 to typeof(long), anomalyScore to typeof(double), expectedCount to typeof(double) on ( summarize (dummy, postExpectedCount, postActualCount)=arg_min(abs(anomalyScore - maxAnomalyScorePost), expectedCount, count1) ) \n| where totAnomalies < maxAnomalies\n| extend postAnomalyScore=iff(baseStd == 0 and maxCountPost > tolong(count_[0]),1000.0,maxAnomalyScorePost), postExpectedCount=iff(postExpectedCount < 0,0.0,postExpectedCount) \n| where maxAnomalyScorePost > AScoreThresh | order by maxAnomalyScorePost desc \n| project Operation, expectedCount=round(postExpectedCount,2), actualCount=postActualCount, anomalyScore=round(postAnomalyScore,2)\n"),
	// 												Text: to.Ptr("Query all anomalous operations"),
	// 											},
	// 											BaseQuery: to.Ptr("let AScoreThresh = 3; \nlet maxAnomalies = 3;\nlet BeforeRange = 12d; \nlet EndTime = todatetime('{{EndTimeUTC}}'); \nlet StartTime = todatetime('{{StartTimeUTC}}');\nlet numDays = tolong((EndTime-StartTime)/1d); \nlet userData = (v_Account_Name:string, v_Account_UPNSuffix:string) { \n  OfficeActivity \n  | extend splitUserId=split(UserId, '@')\n  | extend Account_Name = tostring(splitUserId[0]), Account_UPNSuffix = tostring(splitUserId[1])\n  | where Account_Name =~ v_Account_Name and Account_UPNSuffix =~ v_Account_UPNSuffix }; \nuserData('CTFFUser4', 'seccxp.ninja')\n"),
	// 											ChartQuery: map[string]any{
	// 												"type": "LineChart",
	// 												"dataSets":[]any{
	// 													map[string]any{
	// 														"legendColumnName": "Operation",
	// 														"query": "make-series count() default=0 on TimeGenerated from (StartTime - BeforeRange) to EndTime step 1d by Operation \n| extend (anomalies,anomalyScore, expectedCount)=series_decompose_anomalies(count_,AScoreThresh,7,'linefit',numDays, 'ctukey') \n| extend count1=count_, TimeGenerated1=TimeGenerated, anomalyScore1=anomalyScore\n| mv-apply count1 to typeof(long), TimeGenerated1 to typeof(datetime), anomalyScore1 to typeof(double), anomalies to typeof(long) on (summarize totAnomalies=sumif(abs(anomalies), TimeGenerated1 < StartTime), baseStd=stdevif(count1, TimeGenerated1 < StartTime), baseAvg=avgif(count1, TimeGenerated1 < StartTime), maxCountPost=maxif(count1,TimeGenerated1 >= StartTime), maxAnomalyScorePost=maxif(anomalyScore1, TimeGenerated1 >= StartTime)) \n| extend count1=count_ \n| mv-apply count1 to typeof(long), anomalyScore to typeof(double), expectedCount to typeof(double) on ( summarize (dummy, postExpectedCount, postActualCount)=arg_min(abs(anomalyScore-maxAnomalyScorePost), expectedCount, count1) ) \n| where totAnomalies < maxAnomalies \n| extend postAnomalyScore=iff(baseStd == 0 and maxCountPost > tolong(count_[0]),1000.0,maxAnomalyScorePost), postExpectedCount=iff(postExpectedCount < 0,0.0,round(postExpectedCount,2)) \n| where maxAnomalyScorePost > AScoreThresh \n| order by maxAnomalyScorePost desc \n| take 1 \n| project Operation, TimeGenerated, count_\n| mvexpand TimeGenerated, count_ | project todatetime(TimeGenerated), toint(count_), Operation\n",
	// 														"xColumnName": "TimeGenerated",
	// 														"yColumnName": "count_",
	// 													},
	// 												},
	// 												"title": "Anomalous operation timeline",
	// 											},
	// 											DefaultTimeRange: &armsecurityinsights.InsightQueryItemPropertiesDefaultTimeRange{
	// 												AfterRange: to.Ptr("0d"),
	// 												BeforeRange: to.Ptr("1d"),
	// 											},
	// 											DisplayName: to.Ptr("Anomalously high office operation count"),
	// 											ReferenceTimeRange: &armsecurityinsights.InsightQueryItemPropertiesReferenceTimeRange{
	// 												BeforeRange: to.Ptr("12d"),
	// 											},
	// 											TableQuery: &armsecurityinsights.InsightQueryItemPropertiesTableQuery{
	// 												ColumnsDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryColumnsDefinitionsItem{
	// 													{
	// 														Header: to.Ptr("Operation"),
	// 														OutputType: to.Ptr(armsecurityinsights.OutputTypeString),
	// 														SupportDeepLink: to.Ptr(true),
	// 													},
	// 													{
	// 														Header: to.Ptr("Expected Count"),
	// 														OutputType: to.Ptr(armsecurityinsights.OutputTypeNumber),
	// 														SupportDeepLink: to.Ptr(false),
	// 													},
	// 													{
	// 														Header: to.Ptr("Actual Count"),
	// 														OutputType: to.Ptr(armsecurityinsights.OutputTypeNumber),
	// 														SupportDeepLink: to.Ptr(false),
	// 												}},
	// 												QueriesDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryQueriesDefinitionsItem{
	// 													{
	// 														Filter: to.Ptr("make-series count() default=0 on TimeGenerated from (StartTime - BeforeRange) to EndTime step 1d by Operation \n| extend (anomalies,anomalyScore, expectedCount)=series_decompose_anomalies(count_,AScoreThresh,7,'linefit',numDays, 'ctukey') \n| extend count1=count_, TimeGenerated1=TimeGenerated, anomalyScore1=anomalyScore\n| mv-apply count1 to typeof(long), TimeGenerated1 to typeof(datetime), anomalyScore1 to typeof(double), anomalies to typeof(long) on (summarize totAnomalies=sumif(abs(anomalies), TimeGenerated1 < StartTime), baseStd=stdevif(count1, TimeGenerated1 < StartTime), baseAvg=avgif(count1, TimeGenerated1 < StartTime), maxCountPost=maxif(count1,TimeGenerated1 >= StartTime), maxAnomalyScorePost=maxif(anomalyScore1, TimeGenerated1 >= StartTime)) \n| extend count1=count_ \n| mv-apply count1 to typeof(long), anomalyScore to typeof(double), expectedCount to typeof(double) on ( summarize (dummy, postExpectedCount, postActualCount)=arg_min(abs(anomalyScore-maxAnomalyScorePost), expectedCount, count1) ) \n| where totAnomalies < maxAnomalies \n| extend postAnomalyScore=iff(baseStd == 0 and maxCountPost > tolong(count_[0]),1000.0,maxAnomalyScorePost), postExpectedCount=iff(postExpectedCount < 0,0.0,postExpectedCount) \n| where maxAnomalyScorePost > AScoreThresh \n| order by maxAnomalyScorePost desc\n"),
	// 														LinkColumnsDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryQueriesDefinitionsPropertiesItemsItem{
	// 															{
	// 																Query: to.Ptr("{{BaseQuery}} \n| where TimeGenerated between (StartTime .. EndTime) \n| where Operation == ''\n"),
	// 																ProjectedName: to.Ptr("Operation"),
	// 														}},
	// 														Project: to.Ptr("project Operation, expectedCount=round(postExpectedCount,2), actualCount=postActualCount, anomalyScore=round(postAnomalyScore,2)"),
	// 														Summarize: to.Ptr("take 1"),
	// 												}},
	// 											},
	// 										},
	// 									},
	// 									&armsecurityinsights.InsightQueryItem{
	// 										Name: to.Ptr("e6cf68e6-1eca-4fbb-9fad-6280f2a9476e"),
	// 										Type: to.Ptr("Microsoft.SecurityInsights/entities/queries"),
	// 										ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1/queries/e6cf68e6-1eca-4fbb-9fad-6280f2a9476e"),
	// 										Kind: to.Ptr(armsecurityinsights.EntityQueryKindInsight),
	// 										Properties: &armsecurityinsights.InsightQueryItemProperties{
	// 											DataTypes: []*armsecurityinsights.EntityQueryItemPropertiesDataTypesItem{
	// 												{
	// 													DataType: to.Ptr("OfficeActivity"),
	// 											}},
	// 											EntitiesFilter: map[string]any{
	// 											},
	// 											InputEntityType: to.Ptr(armsecurityinsights.EntityTypeAccount),
	// 											RequiredInputFieldsSets: [][]*string{
	// 												[]*string{
	// 													to.Ptr("Account_Name"),
	// 													to.Ptr("Account_UPNSuffix")},
	// 													[]*string{
	// 														to.Ptr("Account_AADUserId")}},
	// 														Description: to.Ptr("Provides the count and distinct resource accesses by a given user account\n"),
	// 														AdditionalQuery: &armsecurityinsights.InsightQueryItemPropertiesAdditionalQuery{
	// 															Query: to.Ptr("where Operation in~ (Operations)"),
	// 															Text: to.Ptr("See all resource activity"),
	// 														},
	// 														BaseQuery: to.Ptr("let Operations = dynamic([\"FileDownloaded\", \"FileUploaded\"]);\nlet UserOperationToSharePoint =  (v_Account_Name:string, v_Account_UPNSuffix:string) {\nOfficeActivity\n// Select sharepoint activity that is relevant\n| where RecordType in~ ('SharePointFileOperation')\n| where Operation in~ (Operations)\n| extend Account_Name = tostring(split(UserId, '@')[0])\n| extend Account_UPNSuffix = tostring(split(UserId, '@')[1])\n| where Account_Name =~ v_Account_Name and Account_UPNSuffix =~ v_Account_UPNSuffix\n| project TimeGenerated, Account_Name, Account_UPNSuffix, UserId, OfficeId, RecordType, Operation, OrganizationId, UserType, UserKey, OfficeWorkload, OfficeObjectId, ClientIP, ItemType, UserAgent, Site_Url, SourceRelativeUrl, SourceFileName, SourceFileExtension , Start_Time , ElevationTime , TenantId, SourceSystem , Type\n};\nUserOperationToSharePoint ('CTFFUser4','seccxp.ninja')\n"),
	// 														ChartQuery: map[string]any{
	// 															"type": "LineChart",
	// 															"dataSets":[]any{
	// 																map[string]any{
	// 																	"legendColumnName": "Legend",
	// 																	"query": "summarize DistinctResources = dcountif(Operation, Operation =~ 'FileUploaded'), TotalResources = countif(Operation =~ 'FileUploaded') by bin(TimeGenerated, 1h) | extend Legend = 'File Uploads'",
	// 																	"xColumnName": "TimeGenerated",
	// 																	"yColumnName": "TotalResources",
	// 																},
	// 																map[string]any{
	// 																	"legendColumnName": "Legend",
	// 																	"query": "summarize DistinctResources = dcountif(Operation, Operation =~ 'FileDownloaded'), TotalResources = countif(Operation =~ 'FileDownloaded') by bin(TimeGenerated, 1h) | extend Legend = 'File Downloads'",
	// 																	"xColumnName": "TimeGenerated",
	// 																	"yColumnName": "TotalResources",
	// 																},
	// 															},
	// 															"title": "Resource access over time",
	// 														},
	// 														DefaultTimeRange: &armsecurityinsights.InsightQueryItemPropertiesDefaultTimeRange{
	// 															AfterRange: to.Ptr("12h"),
	// 															BeforeRange: to.Ptr("12h"),
	// 														},
	// 														DisplayName: to.Ptr("Resource access"),
	// 														TableQuery: &armsecurityinsights.InsightQueryItemPropertiesTableQuery{
	// 															ColumnsDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryColumnsDefinitionsItem{
	// 																{
	// 																	Header: to.Ptr("Resource Type"),
	// 																	OutputType: to.Ptr(armsecurityinsights.OutputTypeString),
	// 																	SupportDeepLink: to.Ptr(false),
	// 																},
	// 																{
	// 																	Header: to.Ptr("Distinct Resources"),
	// 																	OutputType: to.Ptr(armsecurityinsights.OutputTypeNumber),
	// 																	SupportDeepLink: to.Ptr(true),
	// 																},
	// 																{
	// 																	Header: to.Ptr("Total Resources"),
	// 																	OutputType: to.Ptr(armsecurityinsights.OutputTypeNumber),
	// 																	SupportDeepLink: to.Ptr(true),
	// 																},
	// 																{
	// 																	Header: to.Ptr("IPAddress(es)"),
	// 																	OutputType: to.Ptr(armsecurityinsights.OutputTypeString),
	// 																	SupportDeepLink: to.Ptr(false),
	// 															}},
	// 															QueriesDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryQueriesDefinitionsItem{
	// 																{
	// 																	Filter: to.Ptr("where Operation =~ 'FileUploaded'"),
	// 																	LinkColumnsDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryQueriesDefinitionsPropertiesItemsItem{
	// 																		{
	// 																			Query: to.Ptr("{{BaseQuery}} | "),
	// 																			ProjectedName: to.Ptr("DistinctResources"),
	// 																		},
	// 																		{
	// 																			Query: to.Ptr("{{BaseQuery}} | "),
	// 																			ProjectedName: to.Ptr("TotalResources"),
	// 																	}},
	// 																	Project: to.Ptr("project Title = Operation, DistinctResources, TotalResources, IPAddresses = case(array_length(IPAddresses) == 1, tostring(IPAddresses[0]), array_length(IPAddresses) > 1, 'Many', 'None')"),
	// 																	Summarize: to.Ptr("summarize DistinctResources = dcount(SourceFileName), TotalResources = count(SourceFileName), IPAddresses = make_set(ClientIP) by Operation"),
	// 																},
	// 																{
	// 																	Filter: to.Ptr("where Operation =~ 'FileDownloaded'"),
	// 																	LinkColumnsDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryQueriesDefinitionsPropertiesItemsItem{
	// 																		{
	// 																			Query: to.Ptr("{{BaseQuery}} | "),
	// 																			ProjectedName: to.Ptr("DistinctResources"),
	// 																		},
	// 																		{
	// 																			Query: to.Ptr("{{BaseQuery}} | "),
	// 																			ProjectedName: to.Ptr("TotalResources"),
	// 																	}},
	// 																	Project: to.Ptr("project Title = Operation, DistinctResources, TotalResources, IPAddresses = case(array_length(IPAddresses) == 1, tostring(IPAddresses[0]), array_length(IPAddresses) > 1, 'Many', 'None')"),
	// 																	Summarize: to.Ptr("summarize DistinctResources = dcount(SourceFileName), TotalResources = count(SourceFileName), IPAddresses = make_set(ClientIP) by Operation"),
	// 															}},
	// 														},
	// 													},
	// 												},
	// 												&armsecurityinsights.InsightQueryItem{
	// 													Name: to.Ptr("cae8d0aa-aa45-4d53-8d88-17dd64ffd4e4"),
	// 													Type: to.Ptr("Microsoft.SecurityInsights/entities/queries"),
	// 													ID: to.Ptr("/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1/queries/cae8d0aa-aa45-4d53-8d88-17dd64ffd4e4"),
	// 													Kind: to.Ptr(armsecurityinsights.EntityQueryKindInsight),
	// 													Properties: &armsecurityinsights.InsightQueryItemProperties{
	// 														DataTypes: []*armsecurityinsights.EntityQueryItemPropertiesDataTypesItem{
	// 															{
	// 																DataType: to.Ptr("SigninLogs"),
	// 														}},
	// 														EntitiesFilter: map[string]any{
	// 														},
	// 														InputEntityType: to.Ptr(armsecurityinsights.EntityTypeAccount),
	// 														RequiredInputFieldsSets: [][]*string{
	// 															[]*string{
	// 																to.Ptr("Account_Name"),
	// 																to.Ptr("Account_UPNSuffix")},
	// 																[]*string{
	// 																	to.Ptr("Account_AADUserId")}},
	// 																	Description: to.Ptr("Highlight Azure sign-in results by the user principal with anomalously high count compared to those observed in the preceding 14 days."),
	// 																	AdditionalQuery: &armsecurityinsights.InsightQueryItemPropertiesAdditionalQuery{
	// 																		Query: to.Ptr("make-series count() default=0 on TimeGenerated from (StartTime - BeforeRange) to EndTime step 1d by ResultDescription \n| extend (anomalies,anomalyScore, expectedCount)=series_decompose_anomalies(count_,AScoreThresh,7,'linefit',numDays, 'ctukey') \n| extend count1=count_, TimeGenerated1=TimeGenerated, anomalyScore1=anomalyScore\n| mv-apply count1 to typeof(long), TimeGenerated1 to typeof(datetime), anomalyScore1 to typeof(double), anomalies to typeof(long) on (summarize totAnomalies=sumif(abs(anomalies), TimeGenerated1 < StartTime), baseStd=stdevif(count1, TimeGenerated1 < StartTime), baseAvg=avgif(count1, TimeGenerated1 < StartTime), maxCountPost=maxif(count1,TimeGenerated1 >= StartTime), maxAnomalyScorePost = maxif(anomalyScore1, TimeGenerated1 >= StartTime)) \n| extend count1=count_\n| mv-apply  count1 to typeof(long), anomalyScore to typeof(double), expectedCount to typeof(double) on ( summarize (dummy, postExpectedCount, postActualCount)=arg_min(abs(anomalyScore - maxAnomalyScorePost), expectedCount, count1) ) \n| where totAnomalies < maxAnomalies\n| extend postAnomalyScore=iff(baseStd == 0 and maxCountPost > tolong(count_[0]),1000.0,maxAnomalyScorePost), postExpectedCount=iff(postExpectedCount < 0,0.0,postExpectedCount) \n| where maxAnomalyScorePost > AScoreThresh \n| order by maxAnomalyScorePost desc \n| project ResultDescription, expectedCount=round(postExpectedCount,2), actualCount=postActualCount, anomalyScore=round(postAnomalyScore,2)\n"),
	// 																		Text: to.Ptr("Query all anomalous sign-in results"),
	// 																	},
	// 																	BaseQuery: to.Ptr("let AScoreThresh=3; \nlet maxAnomalies=3; \nlet BeforeRange = 12d; \nlet EndTime=todatetime('{{EndTimeUTC}}');\nlet StartTime = todatetime('{{StartTimeUTC}}'); \nlet numDays = tolong((EndTime-StartTime)/1d); \nlet userData = (v_Account_Name:string, v_Account_UPNSuffix:string, v_Account_AADUserId:string) { \n   SigninLogs \n   | where TimeGenerated between ((StartTime-BeforeRange) .. EndTime)\n   | extend splitUserId=split(UserPrincipalName, '@')\n   | extend Account_Name = tostring(splitUserId[0]), Account_UPNSuffix = tostring(splitUserId[1])\n   | where (Account_Name =~ v_Account_Name and Account_UPNSuffix =~ v_Account_UPNSuffix) or UserId =~ v_Account_AADUserId };\nuserData('CTFFUser4', 'seccxp.ninja', '')\n"),
	// 																	ChartQuery: map[string]any{
	// 																		"type": "LineChart",
	// 																		"dataSets":[]any{
	// 																			map[string]any{
	// 																				"legendColumnName": "ResultDescription",
	// 																				"query": "make-series count() default=0 on TimeGenerated from (StartTime - BeforeRange) to EndTime step 1d by ResultDescription \n| extend (anomalies,anomalyScore, expectedCount)=series_decompose_anomalies(count_,AScoreThresh,7,'linefit',numDays, 'ctukey') \n| extend count1=count_, TimeGenerated1=TimeGenerated, anomalyScore1=anomalyScore\n| mv-apply count1 to typeof(long), TimeGenerated1 to typeof(datetime), anomalyScore1 to typeof(double), anomalies to typeof(long) on (summarize totAnomalies=sumif(abs(anomalies), TimeGenerated1 < StartTime), baseStd=stdevif(count1, TimeGenerated1 < StartTime), baseAvg=avgif(count1, TimeGenerated1 < StartTime), maxCountPost=maxif(count1,TimeGenerated1 >= StartTime), maxAnomalyScorePost = maxif(anomalyScore1, TimeGenerated1 >= StartTime)) \n| extend count1=count_ \n| mv-apply  count1 to typeof(long), anomalyScore to typeof(double), expectedCount to typeof(double) on ( summarize (dummy, postExpectedCount, postActualCount)=arg_min(abs(anomalyScore - maxAnomalyScorePost), expectedCount, count1) ) \n| where totAnomalies < maxAnomalies \n| extend postAnomalyScore=iff(baseStd == 0 and maxCountPost > tolong(count_[0]),1000.0,maxAnomalyScorePost), postExpectedCount=iff(postExpectedCount < 0,0.0,round(postExpectedCount,2)) \n| where maxAnomalyScorePost > AScoreThresh \n| order by maxAnomalyScorePost desc \n| take 1 \n| project ResultDescription, TimeGenerated, count_ \n| mvexpand TimeGenerated, count_ \n| project todatetime(TimeGenerated), toint(count_), ResultDescription \n",
	// 																				"xColumnName": "TimeGenerated",
	// 																				"yColumnName": "count_",
	// 																			},
	// 																		},
	// 																		"title": "Anomalous sign-in result timeline",
	// 																	},
	// 																	DefaultTimeRange: &armsecurityinsights.InsightQueryItemPropertiesDefaultTimeRange{
	// 																		AfterRange: to.Ptr("0d"),
	// 																		BeforeRange: to.Ptr("1d"),
	// 																	},
	// 																	DisplayName: to.Ptr("Anomalously high Azure sign-in result count"),
	// 																	ReferenceTimeRange: &armsecurityinsights.InsightQueryItemPropertiesReferenceTimeRange{
	// 																		BeforeRange: to.Ptr("12d"),
	// 																	},
	// 																	TableQuery: &armsecurityinsights.InsightQueryItemPropertiesTableQuery{
	// 																		ColumnsDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryColumnsDefinitionsItem{
	// 																			{
	// 																				Header: to.Ptr("Result Description"),
	// 																				OutputType: to.Ptr(armsecurityinsights.OutputTypeString),
	// 																				SupportDeepLink: to.Ptr(true),
	// 																			},
	// 																			{
	// 																				Header: to.Ptr("Expected Count"),
	// 																				OutputType: to.Ptr(armsecurityinsights.OutputTypeNumber),
	// 																				SupportDeepLink: to.Ptr(false),
	// 																			},
	// 																			{
	// 																				Header: to.Ptr("Actual Count"),
	// 																				OutputType: to.Ptr(armsecurityinsights.OutputTypeNumber),
	// 																				SupportDeepLink: to.Ptr(false),
	// 																		}},
	// 																		QueriesDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryQueriesDefinitionsItem{
	// 																			{
	// 																				Filter: to.Ptr("make-series count() default=0 on TimeGenerated from (StartTime - BeforeRange) to EndTime step 1d by ResultDescription \n| extend (anomalies,anomalyScore, expectedCount)=series_decompose_anomalies(count_,AScoreThresh,7,'linefit',numDays, 'ctukey') \n| extend count1=count_, TimeGenerated1=TimeGenerated, anomalyScore1=anomalyScore\n| mv-apply count1 to typeof(long), TimeGenerated1 to typeof(datetime), anomalyScore1 to typeof(double), anomalies to typeof(long) on (summarize totAnomalies=sumif(abs(anomalies), TimeGenerated1 < StartTime), baseStd=stdevif(count1, TimeGenerated1 < StartTime), baseAvg=avgif(count1, TimeGenerated1 < StartTime), maxCountPost=maxif(count1,TimeGenerated1 >= StartTime), maxAnomalyScorePost = maxif(anomalyScore1, TimeGenerated1 >= StartTime)) \n| extend count1=count_ \n| mv-apply  count1 to typeof(long), anomalyScore to typeof(double), expectedCount to typeof(double) on ( summarize (dummy, postExpectedCount, postActualCount)=arg_min(abs(anomalyScore - maxAnomalyScorePost), expectedCount, count1) ) \n| where totAnomalies < maxAnomalies \n| extend postAnomalyScore=iff(baseStd == 0 and maxCountPost > tolong(count_[0]),1000.0,maxAnomalyScorePost), postExpectedCount=iff(postExpectedCount < 0,0.0,postExpectedCount) \n| where maxAnomalyScorePost > AScoreThresh \n| order by maxAnomalyScorePost desc\n"),
	// 																				LinkColumnsDefinitions: []*armsecurityinsights.InsightQueryItemPropertiesTableQueryQueriesDefinitionsPropertiesItemsItem{
	// 																					{
	// 																						Query: to.Ptr("{{BaseQuery}} \n| where TimeGenerated between (StartTime .. EndTime) \n| where ResultDescription == ''\n"),
	// 																						ProjectedName: to.Ptr("ResultDescription"),
	// 																				}},
	// 																				Project: to.Ptr("project ResultDescription, expectedCount=round(postExpectedCount,2), actualCount=postActualCount, anomalyScore=round(postAnomalyScore,2)"),
	// 																				Summarize: to.Ptr("take 1"),
	// 																		}},
	// 																	},
	// 																},
	// 														}},
	// 													}
}

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/6c4f3c695f0250dcb261598a62004f0aef10b9db/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-09-01-preview/examples/entities/insights/PostGetInsights.json
func ExampleEntitiesClient_GetInsights() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurityinsights.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewEntitiesClient().GetInsights(ctx, "myRg", "myWorkspace", "e1d3d618-e11f-478b-98e3-bb381539a8e1", armsecurityinsights.EntityGetInsightsParameters{
		AddDefaultExtendedTimeRange: to.Ptr(false),
		EndTime:                     to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2021-10-01T00:00:00.000Z"); return t }()),
		InsightQueryIDs: []*string{
			to.Ptr("cae8d0aa-aa45-4d53-8d88-17dd64ffd4e4")},
		StartTime: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2021-09-01T00:00:00.000Z"); return t }()),
	}, nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res.EntityGetInsightsResponse = armsecurityinsights.EntityGetInsightsResponse{
	// 	MetaData: &armsecurityinsights.GetInsightsResultsMetadata{
	// 		Errors: []*armsecurityinsights.GetInsightsErrorKind{
	// 			{
	// 				ErrorMessage: to.Ptr("Internal server error"),
	// 				Kind: to.Ptr(armsecurityinsights.GetInsightsErrorInsight),
	// 				QueryID: to.Ptr("4a70a63d-25c4-6312-b73e-4f302a90c06a"),
	// 		}},
	// 		TotalCount: to.Ptr[int32](7),
	// 	},
	// 	Value: []*armsecurityinsights.EntityInsightItem{
	// 		{
	// 			ChartQueryResults: []*armsecurityinsights.InsightsTableResult{
	// 				{
	// 					Columns: []*armsecurityinsights.InsightsTableResultColumnsItem{
	// 						{
	// 							Name: to.Ptr("TimeGenerated"),
	// 							Type: to.Ptr("datetime"),
	// 						},
	// 						{
	// 							Name: to.Ptr("Count"),
	// 							Type: to.Ptr("long"),
	// 						},
	// 						{
	// 							Name: to.Ptr("Legend"),
	// 							Type: to.Ptr("string"),
	// 					}},
	// 					Rows: [][]*string{
	// 						[]*string{
	// 							to.Ptr("2021-09-01T00:00:00.000Z"),
	// 							to.Ptr("55"),
	// 							to.Ptr("SomeLegend")}},
	// 					}},
	// 					QueryID: to.Ptr("e29ee1ef-7445-455e-85f1-269f2d536d61"),
	// 					QueryTimeInterval: &armsecurityinsights.EntityInsightItemQueryTimeInterval{
	// 						EndTime: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2021-09-01T23:35:20.000Z"); return t}()),
	// 						StartTime: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2021-09-01T23:35:20.000Z"); return t}()),
	// 					},
	// 					TableQueryResults: &armsecurityinsights.InsightsTableResult{
	// 						Columns: []*armsecurityinsights.InsightsTableResultColumnsItem{
	// 							{
	// 								Name: to.Ptr("Title"),
	// 								Type: to.Ptr("string"),
	// 							},
	// 							{
	// 								Name: to.Ptr("NameCount"),
	// 								Type: to.Ptr("long"),
	// 							},
	// 							{
	// 								Name: to.Ptr("SIDCount"),
	// 								Type: to.Ptr("long"),
	// 							},
	// 							{
	// 								Name: to.Ptr("InternalOrder"),
	// 								Type: to.Ptr("long"),
	// 							},
	// 							{
	// 								Name: to.Ptr("Index"),
	// 								Type: to.Ptr("long"),
	// 						}},
	// 						Rows: [][]*string{
	// 							[]*string{
	// 								to.Ptr("MyTitle"),
	// 								to.Ptr("15"),
	// 								to.Ptr("SID"),
	// 								to.Ptr("1"),
	// 								to.Ptr("1")}},
	// 							},
	// 					}},
	// 				}
}
