![JAR search and dependency download from the Maven repository](/logo.png)
com.pulumi.azure.sentinel.kotlin.AlertRuleAnomalyDuplicateArgs.kt Maven / Gradle / Ivy
Go to download
Show more of this group Show more artifacts with this name
Show all versions of pulumi-azure-kotlin Show documentation
Show all versions of pulumi-azure-kotlin Show documentation
Build cloud applications and infrastructure by combining the safety and reliability of infrastructure as code with the power of the Kotlin programming language.
@file:Suppress("NAME_SHADOWING", "DEPRECATION")
package com.pulumi.azure.sentinel.kotlin
import com.pulumi.azure.sentinel.AlertRuleAnomalyDuplicateArgs.builder
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleAnomalyDuplicateMultiSelectObservationArgs
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleAnomalyDuplicateMultiSelectObservationArgsBuilder
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleAnomalyDuplicatePrioritizedExcludeObservationArgs
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleAnomalyDuplicatePrioritizedExcludeObservationArgsBuilder
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleAnomalyDuplicateSingleSelectObservationArgs
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleAnomalyDuplicateSingleSelectObservationArgsBuilder
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleAnomalyDuplicateThresholdObservationArgs
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleAnomalyDuplicateThresholdObservationArgsBuilder
import com.pulumi.core.Output
import com.pulumi.core.Output.of
import com.pulumi.kotlin.ConvertibleToJava
import com.pulumi.kotlin.PulumiTagMarker
import com.pulumi.kotlin.applySuspend
import kotlin.Boolean
import kotlin.String
import kotlin.Suppress
import kotlin.Unit
import kotlin.collections.List
import kotlin.jvm.JvmName
/**
* Manages a Duplicated Anomaly Alert Rule.
* ## Example Usage
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as azure from "@pulumi/azure";
* const exampleResourceGroup = new azure.core.ResourceGroup("example", {
* name: "example-resources",
* location: "West Europe",
* });
* const exampleAnalyticsWorkspace = new azure.operationalinsights.AnalyticsWorkspace("example", {
* name: "example-law",
* location: exampleResourceGroup.location,
* resourceGroupName: exampleResourceGroup.name,
* sku: "PerGB2018",
* });
* const exampleLogAnalyticsWorkspaceOnboarding = new azure.sentinel.LogAnalyticsWorkspaceOnboarding("example", {
* workspaceId: exampleAnalyticsWorkspace.id,
* customerManagedKeyEnabled: false,
* });
* const example = azure.sentinel.getAlertRuleAnomalyOutput({
* logAnalyticsWorkspaceId: exampleLogAnalyticsWorkspaceOnboarding.workspaceId,
* displayName: "UEBA Anomalous Sign In",
* });
* const exampleAlertRuleAnomalyDuplicate = new azure.sentinel.AlertRuleAnomalyDuplicate("example", {
* displayName: "example duplicated UEBA Anomalous Sign In",
* logAnalyticsWorkspaceId: exampleAnalyticsWorkspace.id,
* builtInRuleId: example.apply(example => example.id),
* enabled: true,
* mode: "Flighting",
* thresholdObservations: [{
* name: "Anomaly score threshold",
* value: "0.6",
* }],
* });
* ```
* ```python
* import pulumi
* import pulumi_azure as azure
* example_resource_group = azure.core.ResourceGroup("example",
* name="example-resources",
* location="West Europe")
* example_analytics_workspace = azure.operationalinsights.AnalyticsWorkspace("example",
* name="example-law",
* location=example_resource_group.location,
* resource_group_name=example_resource_group.name,
* sku="PerGB2018")
* example_log_analytics_workspace_onboarding = azure.sentinel.LogAnalyticsWorkspaceOnboarding("example",
* workspace_id=example_analytics_workspace.id,
* customer_managed_key_enabled=False)
* example = azure.sentinel.get_alert_rule_anomaly_output(log_analytics_workspace_id=example_log_analytics_workspace_onboarding.workspace_id,
* display_name="UEBA Anomalous Sign In")
* example_alert_rule_anomaly_duplicate = azure.sentinel.AlertRuleAnomalyDuplicate("example",
* display_name="example duplicated UEBA Anomalous Sign In",
* log_analytics_workspace_id=example_analytics_workspace.id,
* built_in_rule_id=example.id,
* enabled=True,
* mode="Flighting",
* threshold_observations=[{
* "name": "Anomaly score threshold",
* "value": "0.6",
* }])
* ```
* ```csharp
* using System.Collections.Generic;
* using System.Linq;
* using Pulumi;
* using Azure = Pulumi.Azure;
* return await Deployment.RunAsync(() =>
* {
* var exampleResourceGroup = new Azure.Core.ResourceGroup("example", new()
* {
* Name = "example-resources",
* Location = "West Europe",
* });
* var exampleAnalyticsWorkspace = new Azure.OperationalInsights.AnalyticsWorkspace("example", new()
* {
* Name = "example-law",
* Location = exampleResourceGroup.Location,
* ResourceGroupName = exampleResourceGroup.Name,
* Sku = "PerGB2018",
* });
* var exampleLogAnalyticsWorkspaceOnboarding = new Azure.Sentinel.LogAnalyticsWorkspaceOnboarding("example", new()
* {
* WorkspaceId = exampleAnalyticsWorkspace.Id,
* CustomerManagedKeyEnabled = false,
* });
* var example = Azure.Sentinel.GetAlertRuleAnomaly.Invoke(new()
* {
* LogAnalyticsWorkspaceId = exampleLogAnalyticsWorkspaceOnboarding.WorkspaceId,
* DisplayName = "UEBA Anomalous Sign In",
* });
* var exampleAlertRuleAnomalyDuplicate = new Azure.Sentinel.AlertRuleAnomalyDuplicate("example", new()
* {
* DisplayName = "example duplicated UEBA Anomalous Sign In",
* LogAnalyticsWorkspaceId = exampleAnalyticsWorkspace.Id,
* BuiltInRuleId = example.Apply(getAlertRuleAnomalyResult => getAlertRuleAnomalyResult.Id),
* Enabled = true,
* Mode = "Flighting",
* ThresholdObservations = new[]
* {
* new Azure.Sentinel.Inputs.AlertRuleAnomalyDuplicateThresholdObservationArgs
* {
* Name = "Anomaly score threshold",
* Value = "0.6",
* },
* },
* });
* });
* ```
* ```go
* package main
* import (
* "github.com/pulumi/pulumi-azure/sdk/v5/go/azure/core"
* "github.com/pulumi/pulumi-azure/sdk/v5/go/azure/operationalinsights"
* "github.com/pulumi/pulumi-azure/sdk/v5/go/azure/sentinel"
* "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
* )
* func main() {
* pulumi.Run(func(ctx *pulumi.Context) error {
* exampleResourceGroup, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
* Name: pulumi.String("example-resources"),
* Location: pulumi.String("West Europe"),
* })
* if err != nil {
* return err
* }
* exampleAnalyticsWorkspace, err := operationalinsights.NewAnalyticsWorkspace(ctx, "example", &operationalinsights.AnalyticsWorkspaceArgs{
* Name: pulumi.String("example-law"),
* Location: exampleResourceGroup.Location,
* ResourceGroupName: exampleResourceGroup.Name,
* Sku: pulumi.String("PerGB2018"),
* })
* if err != nil {
* return err
* }
* exampleLogAnalyticsWorkspaceOnboarding, err := sentinel.NewLogAnalyticsWorkspaceOnboarding(ctx, "example", &sentinel.LogAnalyticsWorkspaceOnboardingArgs{
* WorkspaceId: exampleAnalyticsWorkspace.ID(),
* CustomerManagedKeyEnabled: pulumi.Bool(false),
* })
* if err != nil {
* return err
* }
* example := sentinel.GetAlertRuleAnomalyOutput(ctx, sentinel.GetAlertRuleAnomalyOutputArgs{
* LogAnalyticsWorkspaceId: exampleLogAnalyticsWorkspaceOnboarding.WorkspaceId,
* DisplayName: pulumi.String("UEBA Anomalous Sign In"),
* }, nil)
* _, err = sentinel.NewAlertRuleAnomalyDuplicate(ctx, "example", &sentinel.AlertRuleAnomalyDuplicateArgs{
* DisplayName: pulumi.String("example duplicated UEBA Anomalous Sign In"),
* LogAnalyticsWorkspaceId: exampleAnalyticsWorkspace.ID(),
* BuiltInRuleId: pulumi.String(example.ApplyT(func(example sentinel.GetAlertRuleAnomalyResult) (*string, error) {
* return &example.Id, nil
* }).(pulumi.StringPtrOutput)),
* Enabled: pulumi.Bool(true),
* Mode: pulumi.String("Flighting"),
* ThresholdObservations: sentinel.AlertRuleAnomalyDuplicateThresholdObservationArray{
* &sentinel.AlertRuleAnomalyDuplicateThresholdObservationArgs{
* Name: pulumi.String("Anomaly score threshold"),
* Value: pulumi.String("0.6"),
* },
* },
* })
* if err != nil {
* return err
* }
* return nil
* })
* }
* ```
* ```java
* package generated_program;
* import com.pulumi.Context;
* import com.pulumi.Pulumi;
* import com.pulumi.core.Output;
* import com.pulumi.azure.core.ResourceGroup;
* import com.pulumi.azure.core.ResourceGroupArgs;
* import com.pulumi.azure.operationalinsights.AnalyticsWorkspace;
* import com.pulumi.azure.operationalinsights.AnalyticsWorkspaceArgs;
* import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboarding;
* import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboardingArgs;
* import com.pulumi.azure.sentinel.SentinelFunctions;
* import com.pulumi.azure.sentinel.inputs.GetAlertRuleAnomalyArgs;
* import com.pulumi.azure.sentinel.AlertRuleAnomalyDuplicate;
* import com.pulumi.azure.sentinel.AlertRuleAnomalyDuplicateArgs;
* import com.pulumi.azure.sentinel.inputs.AlertRuleAnomalyDuplicateThresholdObservationArgs;
* import java.util.List;
* import java.util.ArrayList;
* import java.util.Map;
* import java.io.File;
* import java.nio.file.Files;
* import java.nio.file.Paths;
* public class App {
* public static void main(String[] args) {
* Pulumi.run(App::stack);
* }
* public static void stack(Context ctx) {
* var exampleResourceGroup = new ResourceGroup("exampleResourceGroup", ResourceGroupArgs.builder()
* .name("example-resources")
* .location("West Europe")
* .build());
* var exampleAnalyticsWorkspace = new AnalyticsWorkspace("exampleAnalyticsWorkspace", AnalyticsWorkspaceArgs.builder()
* .name("example-law")
* .location(exampleResourceGroup.location())
* .resourceGroupName(exampleResourceGroup.name())
* .sku("PerGB2018")
* .build());
* var exampleLogAnalyticsWorkspaceOnboarding = new LogAnalyticsWorkspaceOnboarding("exampleLogAnalyticsWorkspaceOnboarding", LogAnalyticsWorkspaceOnboardingArgs.builder()
* .workspaceId(exampleAnalyticsWorkspace.id())
* .customerManagedKeyEnabled(false)
* .build());
* final var example = SentinelFunctions.getAlertRuleAnomaly(GetAlertRuleAnomalyArgs.builder()
* .logAnalyticsWorkspaceId(exampleLogAnalyticsWorkspaceOnboarding.workspaceId())
* .displayName("UEBA Anomalous Sign In")
* .build());
* var exampleAlertRuleAnomalyDuplicate = new AlertRuleAnomalyDuplicate("exampleAlertRuleAnomalyDuplicate", AlertRuleAnomalyDuplicateArgs.builder()
* .displayName("example duplicated UEBA Anomalous Sign In")
* .logAnalyticsWorkspaceId(exampleAnalyticsWorkspace.id())
* .builtInRuleId(example.applyValue(getAlertRuleAnomalyResult -> getAlertRuleAnomalyResult).applyValue(example -> example.applyValue(getAlertRuleAnomalyResult -> getAlertRuleAnomalyResult.id())))
* .enabled(true)
* .mode("Flighting")
* .thresholdObservations(AlertRuleAnomalyDuplicateThresholdObservationArgs.builder()
* .name("Anomaly score threshold")
* .value("0.6")
* .build())
* .build());
* }
* }
* ```
* ```yaml
* resources:
* exampleResourceGroup:
* type: azure:core:ResourceGroup
* name: example
* properties:
* name: example-resources
* location: West Europe
* exampleAnalyticsWorkspace:
* type: azure:operationalinsights:AnalyticsWorkspace
* name: example
* properties:
* name: example-law
* location: ${exampleResourceGroup.location}
* resourceGroupName: ${exampleResourceGroup.name}
* sku: PerGB2018
* exampleLogAnalyticsWorkspaceOnboarding:
* type: azure:sentinel:LogAnalyticsWorkspaceOnboarding
* name: example
* properties:
* workspaceId: ${exampleAnalyticsWorkspace.id}
* customerManagedKeyEnabled: false
* exampleAlertRuleAnomalyDuplicate:
* type: azure:sentinel:AlertRuleAnomalyDuplicate
* name: example
* properties:
* displayName: example duplicated UEBA Anomalous Sign In
* logAnalyticsWorkspaceId: ${exampleAnalyticsWorkspace.id}
* builtInRuleId: ${example.id}
* enabled: true
* mode: Flighting
* thresholdObservations:
* - name: Anomaly score threshold
* value: '0.6'
* variables:
* example:
* fn::invoke:
* Function: azure:sentinel:getAlertRuleAnomaly
* Arguments:
* logAnalyticsWorkspaceId: ${exampleLogAnalyticsWorkspaceOnboarding.workspaceId}
* displayName: UEBA Anomalous Sign In
* ```
*
* ## Import
* Built In Anomaly Alert Rules can be imported using the `resource id`, e.g.
* ```sh
* $ pulumi import azure:sentinel/alertRuleAnomalyDuplicate:AlertRuleAnomalyDuplicate example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.OperationalInsights/workspaces/workspace1/providers/Microsoft.SecurityInsights/securityMLAnalyticsSettings/setting1
* ```
* @property builtInRuleId The ID of the built-in Anomaly Alert Rule. Changing this forces a new Duplicated Anomaly Alert Rule to be created.
* @property displayName The Display Name of the built-in Anomaly Alert Rule.
* @property enabled Should the Duplicated Anomaly Alert Rule be enabled?
* @property logAnalyticsWorkspaceId The ID of the Log Analytics Workspace. Changing this forces a new Duplicated Anomaly Alert Rule to be created.
* @property mode mode of the Duplicated Anomaly Alert Rule. Possible Values are `Production` and `Flighting`.
* @property multiSelectObservations A list of `multi_select_observation` blocks as defined below.
* @property prioritizedExcludeObservations A list of `prioritized_exclude_observation` blocks as defined below.
* @property singleSelectObservations A list of `single_select_observation` blocks as defined below.
* @property thresholdObservations A list of `threshold_observation` blocks as defined below.
* > **NOTE:** un-specified `multi_select_observation`, `single_select_observation`, `prioritized_exclude_observation` and `threshold_observation` will be inherited from the built-in Anomaly Alert Rule.
*/
public data class AlertRuleAnomalyDuplicateArgs(
public val builtInRuleId: Output? = null,
public val displayName: Output? = null,
public val enabled: Output? = null,
public val logAnalyticsWorkspaceId: Output? = null,
public val mode: Output? = null,
public val multiSelectObservations: Output>? = null,
public val prioritizedExcludeObservations: Output>? = null,
public val singleSelectObservations: Output>? = null,
public val thresholdObservations: Output>? =
null,
) : ConvertibleToJava {
override fun toJava(): com.pulumi.azure.sentinel.AlertRuleAnomalyDuplicateArgs =
com.pulumi.azure.sentinel.AlertRuleAnomalyDuplicateArgs.builder()
.builtInRuleId(builtInRuleId?.applyValue({ args0 -> args0 }))
.displayName(displayName?.applyValue({ args0 -> args0 }))
.enabled(enabled?.applyValue({ args0 -> args0 }))
.logAnalyticsWorkspaceId(logAnalyticsWorkspaceId?.applyValue({ args0 -> args0 }))
.mode(mode?.applyValue({ args0 -> args0 }))
.multiSelectObservations(
multiSelectObservations?.applyValue({ args0 ->
args0.map({ args0 ->
args0.let({ args0 -> args0.toJava() })
})
}),
)
.prioritizedExcludeObservations(
prioritizedExcludeObservations?.applyValue({ args0 ->
args0.map({ args0 -> args0.let({ args0 -> args0.toJava() }) })
}),
)
.singleSelectObservations(
singleSelectObservations?.applyValue({ args0 ->
args0.map({ args0 ->
args0.let({ args0 -> args0.toJava() })
})
}),
)
.thresholdObservations(
thresholdObservations?.applyValue({ args0 ->
args0.map({ args0 ->
args0.let({ args0 -> args0.toJava() })
})
}),
).build()
}
/**
* Builder for [AlertRuleAnomalyDuplicateArgs].
*/
@PulumiTagMarker
public class AlertRuleAnomalyDuplicateArgsBuilder internal constructor() {
private var builtInRuleId: Output? = null
private var displayName: Output? = null
private var enabled: Output? = null
private var logAnalyticsWorkspaceId: Output? = null
private var mode: Output? = null
private var multiSelectObservations:
Output>? = null
private var prioritizedExcludeObservations:
Output>? = null
private var singleSelectObservations:
Output>? = null
private var thresholdObservations:
Output>? = null
/**
* @param value The ID of the built-in Anomaly Alert Rule. Changing this forces a new Duplicated Anomaly Alert Rule to be created.
*/
@JvmName("swybvftqbjojgwpr")
public suspend fun builtInRuleId(`value`: Output) {
this.builtInRuleId = value
}
/**
* @param value The Display Name of the built-in Anomaly Alert Rule.
*/
@JvmName("abxbxgdktdvjjces")
public suspend fun displayName(`value`: Output) {
this.displayName = value
}
/**
* @param value Should the Duplicated Anomaly Alert Rule be enabled?
*/
@JvmName("srjhwpbmqgkadtwd")
public suspend fun enabled(`value`: Output) {
this.enabled = value
}
/**
* @param value The ID of the Log Analytics Workspace. Changing this forces a new Duplicated Anomaly Alert Rule to be created.
*/
@JvmName("jquwixyusnuejfxw")
public suspend fun logAnalyticsWorkspaceId(`value`: Output) {
this.logAnalyticsWorkspaceId = value
}
/**
* @param value mode of the Duplicated Anomaly Alert Rule. Possible Values are `Production` and `Flighting`.
*/
@JvmName("iuuyqokmiisfguec")
public suspend fun mode(`value`: Output) {
this.mode = value
}
/**
* @param value A list of `multi_select_observation` blocks as defined below.
*/
@JvmName("isrduhotlnhwandd")
public suspend fun multiSelectObservations(`value`: Output>) {
this.multiSelectObservations = value
}
@JvmName("cnyciugldhfrxuok")
public suspend fun multiSelectObservations(vararg values: Output) {
this.multiSelectObservations = Output.all(values.asList())
}
/**
* @param values A list of `multi_select_observation` blocks as defined below.
*/
@JvmName("ltjuoecuwdeldvea")
public suspend fun multiSelectObservations(values: List
© 2015 - 2025 Weber Informatics LLC | Privacy Policy