com.pulumi.azure.sentinel.kotlin.AlertRuleScheduled.kt Maven / Gradle / Ivy
Go to download
Show more of this group Show more artifacts with this name
Show all versions of pulumi-azure-kotlin Show documentation
Show all versions of pulumi-azure-kotlin Show documentation
Build cloud applications and infrastructure by combining the safety and reliability of infrastructure as code with the power of the Kotlin programming language.
@file:Suppress("NAME_SHADOWING", "DEPRECATION")
package com.pulumi.azure.sentinel.kotlin
import com.pulumi.azure.sentinel.kotlin.outputs.AlertRuleScheduledAlertDetailsOverride
import com.pulumi.azure.sentinel.kotlin.outputs.AlertRuleScheduledEntityMapping
import com.pulumi.azure.sentinel.kotlin.outputs.AlertRuleScheduledEventGrouping
import com.pulumi.azure.sentinel.kotlin.outputs.AlertRuleScheduledIncidentConfiguration
import com.pulumi.azure.sentinel.kotlin.outputs.AlertRuleScheduledSentinelEntityMapping
import com.pulumi.core.Output
import com.pulumi.kotlin.KotlinCustomResource
import com.pulumi.kotlin.PulumiTagMarker
import com.pulumi.kotlin.ResourceMapper
import com.pulumi.kotlin.options.CustomResourceOptions
import com.pulumi.kotlin.options.CustomResourceOptionsBuilder
import com.pulumi.resources.Resource
import kotlin.Boolean
import kotlin.Int
import kotlin.String
import kotlin.Suppress
import kotlin.Unit
import kotlin.collections.List
import kotlin.collections.Map
import com.pulumi.azure.sentinel.kotlin.outputs.AlertRuleScheduledAlertDetailsOverride.Companion.toKotlin as alertRuleScheduledAlertDetailsOverrideToKotlin
import com.pulumi.azure.sentinel.kotlin.outputs.AlertRuleScheduledEntityMapping.Companion.toKotlin as alertRuleScheduledEntityMappingToKotlin
import com.pulumi.azure.sentinel.kotlin.outputs.AlertRuleScheduledEventGrouping.Companion.toKotlin as alertRuleScheduledEventGroupingToKotlin
import com.pulumi.azure.sentinel.kotlin.outputs.AlertRuleScheduledIncidentConfiguration.Companion.toKotlin as alertRuleScheduledIncidentConfigurationToKotlin
import com.pulumi.azure.sentinel.kotlin.outputs.AlertRuleScheduledSentinelEntityMapping.Companion.toKotlin as alertRuleScheduledSentinelEntityMappingToKotlin
/**
* Builder for [AlertRuleScheduled].
*/
@PulumiTagMarker
public class AlertRuleScheduledResourceBuilder internal constructor() {
public var name: String? = null
public var args: AlertRuleScheduledArgs = AlertRuleScheduledArgs()
public var opts: CustomResourceOptions = CustomResourceOptions()
/**
* @param name The _unique_ name of the resulting resource.
*/
public fun name(`value`: String) {
this.name = value
}
/**
* @param block The arguments to use to populate this resource's properties.
*/
public suspend fun args(block: suspend AlertRuleScheduledArgsBuilder.() -> Unit) {
val builder = AlertRuleScheduledArgsBuilder()
block(builder)
this.args = builder.build()
}
/**
* @param block A bag of options that control this resource's behavior.
*/
public suspend fun opts(block: suspend CustomResourceOptionsBuilder.() -> Unit) {
this.opts = com.pulumi.kotlin.options.CustomResourceOptions.opts(block)
}
internal fun build(): AlertRuleScheduled {
val builtJavaResource = com.pulumi.azure.sentinel.AlertRuleScheduled(
this.name,
this.args.toJava(),
this.opts.toJava(),
)
return AlertRuleScheduled(builtJavaResource)
}
}
/**
* Manages a Sentinel Scheduled Alert Rule.
* ## Example Usage
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as azure from "@pulumi/azure";
* const example = new azure.core.ResourceGroup("example", {
* name: "example-resources",
* location: "West Europe",
* });
* const exampleAnalyticsWorkspace = new azure.operationalinsights.AnalyticsWorkspace("example", {
* name: "example-workspace",
* location: example.location,
* resourceGroupName: example.name,
* sku: "PerGB2018",
* });
* const exampleLogAnalyticsWorkspaceOnboarding = new azure.sentinel.LogAnalyticsWorkspaceOnboarding("example", {workspaceId: exampleAnalyticsWorkspace.id});
* const exampleAlertRuleScheduled = new azure.sentinel.AlertRuleScheduled("example", {
* name: "example",
* logAnalyticsWorkspaceId: exampleLogAnalyticsWorkspaceOnboarding.workspaceId,
* displayName: "example",
* severity: "High",
* query: `AzureActivity |
* where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
* where ActivityStatus == "Succeeded" |
* make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
* `,
* });
* ```
* ```python
* import pulumi
* import pulumi_azure as azure
* example = azure.core.ResourceGroup("example",
* name="example-resources",
* location="West Europe")
* example_analytics_workspace = azure.operationalinsights.AnalyticsWorkspace("example",
* name="example-workspace",
* location=example.location,
* resource_group_name=example.name,
* sku="PerGB2018")
* example_log_analytics_workspace_onboarding = azure.sentinel.LogAnalyticsWorkspaceOnboarding("example", workspace_id=example_analytics_workspace.id)
* example_alert_rule_scheduled = azure.sentinel.AlertRuleScheduled("example",
* name="example",
* log_analytics_workspace_id=example_log_analytics_workspace_onboarding.workspace_id,
* display_name="example",
* severity="High",
* query="""AzureActivity |
* where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
* where ActivityStatus == "Succeeded" |
* make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
* """)
* ```
* ```csharp
* using System.Collections.Generic;
* using System.Linq;
* using Pulumi;
* using Azure = Pulumi.Azure;
* return await Deployment.RunAsync(() =>
* {
* var example = new Azure.Core.ResourceGroup("example", new()
* {
* Name = "example-resources",
* Location = "West Europe",
* });
* var exampleAnalyticsWorkspace = new Azure.OperationalInsights.AnalyticsWorkspace("example", new()
* {
* Name = "example-workspace",
* Location = example.Location,
* ResourceGroupName = example.Name,
* Sku = "PerGB2018",
* });
* var exampleLogAnalyticsWorkspaceOnboarding = new Azure.Sentinel.LogAnalyticsWorkspaceOnboarding("example", new()
* {
* WorkspaceId = exampleAnalyticsWorkspace.Id,
* });
* var exampleAlertRuleScheduled = new Azure.Sentinel.AlertRuleScheduled("example", new()
* {
* Name = "example",
* LogAnalyticsWorkspaceId = exampleLogAnalyticsWorkspaceOnboarding.WorkspaceId,
* DisplayName = "example",
* Severity = "High",
* Query = @"AzureActivity |
* where OperationName == ""Create or Update Virtual Machine"" or OperationName ==""Create Deployment"" |
* where ActivityStatus == ""Succeeded"" |
* make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
* ",
* });
* });
* ```
* ```go
* package main
* import (
* "github.com/pulumi/pulumi-azure/sdk/v5/go/azure/core"
* "github.com/pulumi/pulumi-azure/sdk/v5/go/azure/operationalinsights"
* "github.com/pulumi/pulumi-azure/sdk/v5/go/azure/sentinel"
* "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
* )
* func main() {
* pulumi.Run(func(ctx *pulumi.Context) error {
* example, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
* Name: pulumi.String("example-resources"),
* Location: pulumi.String("West Europe"),
* })
* if err != nil {
* return err
* }
* exampleAnalyticsWorkspace, err := operationalinsights.NewAnalyticsWorkspace(ctx, "example", &operationalinsights.AnalyticsWorkspaceArgs{
* Name: pulumi.String("example-workspace"),
* Location: example.Location,
* ResourceGroupName: example.Name,
* Sku: pulumi.String("PerGB2018"),
* })
* if err != nil {
* return err
* }
* exampleLogAnalyticsWorkspaceOnboarding, err := sentinel.NewLogAnalyticsWorkspaceOnboarding(ctx, "example", &sentinel.LogAnalyticsWorkspaceOnboardingArgs{
* WorkspaceId: exampleAnalyticsWorkspace.ID(),
* })
* if err != nil {
* return err
* }
* _, err = sentinel.NewAlertRuleScheduled(ctx, "example", &sentinel.AlertRuleScheduledArgs{
* Name: pulumi.String("example"),
* LogAnalyticsWorkspaceId: exampleLogAnalyticsWorkspaceOnboarding.WorkspaceId,
* DisplayName: pulumi.String("example"),
* Severity: pulumi.String("High"),
* Query: pulumi.String("AzureActivity |\n where OperationName == \"Create or Update Virtual Machine\" or OperationName ==\"Create Deployment\" |\n where ActivityStatus == \"Succeeded\" |\n make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller\n"),
* })
* if err != nil {
* return err
* }
* return nil
* })
* }
* ```
* ```java
* package generated_program;
* import com.pulumi.Context;
* import com.pulumi.Pulumi;
* import com.pulumi.core.Output;
* import com.pulumi.azure.core.ResourceGroup;
* import com.pulumi.azure.core.ResourceGroupArgs;
* import com.pulumi.azure.operationalinsights.AnalyticsWorkspace;
* import com.pulumi.azure.operationalinsights.AnalyticsWorkspaceArgs;
* import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboarding;
* import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboardingArgs;
* import com.pulumi.azure.sentinel.AlertRuleScheduled;
* import com.pulumi.azure.sentinel.AlertRuleScheduledArgs;
* import java.util.List;
* import java.util.ArrayList;
* import java.util.Map;
* import java.io.File;
* import java.nio.file.Files;
* import java.nio.file.Paths;
* public class App {
* public static void main(String[] args) {
* Pulumi.run(App::stack);
* }
* public static void stack(Context ctx) {
* var example = new ResourceGroup("example", ResourceGroupArgs.builder()
* .name("example-resources")
* .location("West Europe")
* .build());
* var exampleAnalyticsWorkspace = new AnalyticsWorkspace("exampleAnalyticsWorkspace", AnalyticsWorkspaceArgs.builder()
* .name("example-workspace")
* .location(example.location())
* .resourceGroupName(example.name())
* .sku("PerGB2018")
* .build());
* var exampleLogAnalyticsWorkspaceOnboarding = new LogAnalyticsWorkspaceOnboarding("exampleLogAnalyticsWorkspaceOnboarding", LogAnalyticsWorkspaceOnboardingArgs.builder()
* .workspaceId(exampleAnalyticsWorkspace.id())
* .build());
* var exampleAlertRuleScheduled = new AlertRuleScheduled("exampleAlertRuleScheduled", AlertRuleScheduledArgs.builder()
* .name("example")
* .logAnalyticsWorkspaceId(exampleLogAnalyticsWorkspaceOnboarding.workspaceId())
* .displayName("example")
* .severity("High")
* .query("""
* AzureActivity |
* where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
* where ActivityStatus == "Succeeded" |
* make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
* """)
* .build());
* }
* }
* ```
* ```yaml
* resources:
* example:
* type: azure:core:ResourceGroup
* properties:
* name: example-resources
* location: West Europe
* exampleAnalyticsWorkspace:
* type: azure:operationalinsights:AnalyticsWorkspace
* name: example
* properties:
* name: example-workspace
* location: ${example.location}
* resourceGroupName: ${example.name}
* sku: PerGB2018
* exampleLogAnalyticsWorkspaceOnboarding:
* type: azure:sentinel:LogAnalyticsWorkspaceOnboarding
* name: example
* properties:
* workspaceId: ${exampleAnalyticsWorkspace.id}
* exampleAlertRuleScheduled:
* type: azure:sentinel:AlertRuleScheduled
* name: example
* properties:
* name: example
* logAnalyticsWorkspaceId: ${exampleLogAnalyticsWorkspaceOnboarding.workspaceId}
* displayName: example
* severity: High
* query: |
* AzureActivity |
* where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
* where ActivityStatus == "Succeeded" |
* make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
* ```
*
* ## Import
* Sentinel Scheduled Alert Rules can be imported using the `resource id`, e.g.
* ```sh
* $ pulumi import azure:sentinel/alertRuleScheduled:AlertRuleScheduled example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.OperationalInsights/workspaces/workspace1/providers/Microsoft.SecurityInsights/alertRules/rule1
* ```
*/
public class AlertRuleScheduled internal constructor(
override val javaResource: com.pulumi.azure.sentinel.AlertRuleScheduled,
) : KotlinCustomResource(javaResource, AlertRuleScheduledMapper) {
/**
* An `alert_details_override` block as defined below.
*/
public val alertDetailsOverrides: Output>?
get() = javaResource.alertDetailsOverrides().applyValue({ args0 ->
args0.map({ args0 ->
args0.map({ args0 ->
args0.let({ args0 ->
alertRuleScheduledAlertDetailsOverrideToKotlin(args0)
})
})
}).orElse(null)
})
/**
* The GUID of the alert rule template which is used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
*/
public val alertRuleTemplateGuid: Output?
get() = javaResource.alertRuleTemplateGuid().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* The version of the alert rule template which is used for this Sentinel Scheduled Alert Rule.
*/
public val alertRuleTemplateVersion: Output?
get() = javaResource.alertRuleTemplateVersion().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* A map of string key-value pairs of columns to be attached to this Sentinel Scheduled Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
*/
public val customDetails: Output>?
get() = javaResource.customDetails().applyValue({ args0 ->
args0.map({ args0 ->
args0.map({ args0 -> args0.key.to(args0.value) }).toMap()
}).orElse(null)
})
/**
* The description of this Sentinel Scheduled Alert Rule.
*/
public val description: Output?
get() = javaResource.description().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* The friendly name of this Sentinel Scheduled Alert Rule.
*/
public val displayName: Output
get() = javaResource.displayName().applyValue({ args0 -> args0 })
/**
* Should the Sentinel Scheduled Alert Rule be enabled? Defaults to `true`.
*/
public val enabled: Output?
get() = javaResource.enabled().applyValue({ args0 -> args0.map({ args0 -> args0 }).orElse(null) })
/**
* A list of `entity_mapping` blocks as defined below.
*/
public val entityMappings: Output>?
get() = javaResource.entityMappings().applyValue({ args0 ->
args0.map({ args0 ->
args0.map({ args0 ->
args0.let({ args0 ->
alertRuleScheduledEntityMappingToKotlin(args0)
})
})
}).orElse(null)
})
/**
* A `event_grouping` block as defined below.
*/
public val eventGrouping: Output?
get() = javaResource.eventGrouping().applyValue({ args0 ->
args0.map({ args0 ->
args0.let({ args0 -> alertRuleScheduledEventGroupingToKotlin(args0) })
}).orElse(null)
})
/**
* A `incident_configuration` block as defined below.
*/
public val incidentConfiguration: Output
get() = javaResource.incidentConfiguration().applyValue({ args0 ->
args0.let({ args0 ->
alertRuleScheduledIncidentConfigurationToKotlin(args0)
})
})
/**
* The ID of the Log Analytics Workspace this Sentinel Scheduled Alert Rule belongs to. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
*/
public val logAnalyticsWorkspaceId: Output
get() = javaResource.logAnalyticsWorkspaceId().applyValue({ args0 -> args0 })
/**
* The name which should be used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
*/
public val name: Output
get() = javaResource.name().applyValue({ args0 -> args0 })
/**
* The query of this Sentinel Scheduled Alert Rule.
*/
public val query: Output
get() = javaResource.query().applyValue({ args0 -> args0 })
/**
* The ISO 8601 timespan duration between two consecutive queries. Defaults to `PT5H`.
*/
public val queryFrequency: Output?
get() = javaResource.queryFrequency().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* The ISO 8601 timespan duration, which determine the time period of the data covered by the query. For example, it can query the past 10 minutes of data, or the past 6 hours of data. Defaults to `PT5H`.
* > **NOTE** `query_period` must larger than or equal to `query_frequency`, which ensures there is no gaps in the overall query coverage.
*/
public val queryPeriod: Output?
get() = javaResource.queryPeriod().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* A list of `sentinel_entity_mapping` blocks as defined below.
* > **NOTE:** `entity_mapping` and `sentinel_entity_mapping` together can't exceed 5.
*/
public val sentinelEntityMappings: Output>?
get() = javaResource.sentinelEntityMappings().applyValue({ args0 ->
args0.map({ args0 ->
args0.map({ args0 ->
args0.let({ args0 ->
alertRuleScheduledSentinelEntityMappingToKotlin(args0)
})
})
}).orElse(null)
})
/**
* The alert severity of this Sentinel Scheduled Alert Rule. Possible values are `High`, `Medium`, `Low` and `Informational`.
*/
public val severity: Output
get() = javaResource.severity().applyValue({ args0 -> args0 })
/**
* If `suppression_enabled` is `true`, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to `PT5H`.
* > **NOTE** `suppression_duration` must larger than or equal to `query_frequency`, otherwise the suppression has no actual effect since no query will happen during the suppression duration.
*/
public val suppressionDuration: Output?
get() = javaResource.suppressionDuration().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* Should the Sentinel Scheduled Alert Rulea stop running query after alert is generated? Defaults to `false`.
*/
public val suppressionEnabled: Output?
get() = javaResource.suppressionEnabled().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `ImpairProcessControl`, `InhibitResponseFunction`, `Impact`, `InitialAccess`, `LateralMovement`, `Persistence`, `PrivilegeEscalation`, `PreAttack`, `Reconnaissance` and `ResourceDevelopment`.
*/
public val tactics: Output>?
get() = javaResource.tactics().applyValue({ args0 ->
args0.map({ args0 ->
args0.map({ args0 ->
args0
})
}).orElse(null)
})
/**
* A list of techniques of attacks by which to classify the rule.
*/
public val techniques: Output>?
get() = javaResource.techniques().applyValue({ args0 ->
args0.map({ args0 ->
args0.map({ args0 ->
args0
})
}).orElse(null)
})
/**
* The alert trigger operator, combined with `trigger_threshold`, setting alert threshold of this Sentinel Scheduled Alert Rule. Possible values are `Equal`, `GreaterThan`, `LessThan`, `NotEqual`. Defaults to `GreaterThan`.
*/
public val triggerOperator: Output?
get() = javaResource.triggerOperator().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* The baseline number of query results generated, combined with `trigger_operator`, setting alert threshold of this Sentinel Scheduled Alert Rule. Defaults to `0`.
*/
public val triggerThreshold: Output?
get() = javaResource.triggerThreshold().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
}
public object AlertRuleScheduledMapper : ResourceMapper {
override fun supportsMappingOfType(javaResource: Resource): Boolean =
com.pulumi.azure.sentinel.AlertRuleScheduled::class == javaResource::class
override fun map(javaResource: Resource): AlertRuleScheduled = AlertRuleScheduled(
javaResource as
com.pulumi.azure.sentinel.AlertRuleScheduled,
)
}
/**
* @see [AlertRuleScheduled].
* @param name The _unique_ name of the resulting resource.
* @param block Builder for [AlertRuleScheduled].
*/
public suspend fun alertRuleScheduled(
name: String,
block: suspend AlertRuleScheduledResourceBuilder.() -> Unit,
): AlertRuleScheduled {
val builder = AlertRuleScheduledResourceBuilder()
builder.name(name)
block(builder)
return builder.build()
}
/**
* @see [AlertRuleScheduled].
* @param name The _unique_ name of the resulting resource.
*/
public fun alertRuleScheduled(name: String): AlertRuleScheduled {
val builder = AlertRuleScheduledResourceBuilder()
builder.name(name)
return builder.build()
}
© 2015 - 2025 Weber Informatics LLC | Privacy Policy