com.pulumi.azure.sentinel.kotlin.AlertRuleNrtArgs.kt Maven / Gradle / Ivy
Go to download
Show more of this group Show more artifacts with this name
Show all versions of pulumi-azure-kotlin Show documentation
Show all versions of pulumi-azure-kotlin Show documentation
Build cloud applications and infrastructure by combining the safety and reliability of infrastructure as code with the power of the Kotlin programming language.
@file:Suppress("NAME_SHADOWING", "DEPRECATION")
package com.pulumi.azure.sentinel.kotlin
import com.pulumi.azure.sentinel.AlertRuleNrtArgs.builder
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleNrtAlertDetailsOverrideArgs
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleNrtAlertDetailsOverrideArgsBuilder
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleNrtEntityMappingArgs
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleNrtEntityMappingArgsBuilder
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleNrtEventGroupingArgs
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleNrtEventGroupingArgsBuilder
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleNrtIncidentArgs
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleNrtIncidentArgsBuilder
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleNrtSentinelEntityMappingArgs
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleNrtSentinelEntityMappingArgsBuilder
import com.pulumi.core.Output
import com.pulumi.core.Output.of
import com.pulumi.kotlin.ConvertibleToJava
import com.pulumi.kotlin.PulumiTagMarker
import com.pulumi.kotlin.applySuspend
import kotlin.Boolean
import kotlin.Pair
import kotlin.String
import kotlin.Suppress
import kotlin.Unit
import kotlin.collections.List
import kotlin.collections.Map
import kotlin.jvm.JvmName
/**
* Manages a Sentinel NRT Alert Rule.
* ## Example Usage
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as azure from "@pulumi/azure";
* const example = new azure.core.ResourceGroup("example", {
* name: "example-resources",
* location: "West Europe",
* });
* const exampleAnalyticsWorkspace = new azure.operationalinsights.AnalyticsWorkspace("example", {
* name: "example-workspace",
* location: example.location,
* resourceGroupName: example.name,
* sku: "pergb2018",
* });
* const exampleLogAnalyticsWorkspaceOnboarding = new azure.sentinel.LogAnalyticsWorkspaceOnboarding("example", {workspaceId: exampleAnalyticsWorkspace.id});
* const exampleAlertRuleNrt = new azure.sentinel.AlertRuleNrt("example", {
* name: "example",
* logAnalyticsWorkspaceId: exampleLogAnalyticsWorkspaceOnboarding.workspaceId,
* displayName: "example",
* severity: "High",
* query: `AzureActivity |
* where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
* where ActivityStatus == "Succeeded" |
* make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
* `,
* });
* ```
* ```python
* import pulumi
* import pulumi_azure as azure
* example = azure.core.ResourceGroup("example",
* name="example-resources",
* location="West Europe")
* example_analytics_workspace = azure.operationalinsights.AnalyticsWorkspace("example",
* name="example-workspace",
* location=example.location,
* resource_group_name=example.name,
* sku="pergb2018")
* example_log_analytics_workspace_onboarding = azure.sentinel.LogAnalyticsWorkspaceOnboarding("example", workspace_id=example_analytics_workspace.id)
* example_alert_rule_nrt = azure.sentinel.AlertRuleNrt("example",
* name="example",
* log_analytics_workspace_id=example_log_analytics_workspace_onboarding.workspace_id,
* display_name="example",
* severity="High",
* query="""AzureActivity |
* where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
* where ActivityStatus == "Succeeded" |
* make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
* """)
* ```
* ```csharp
* using System.Collections.Generic;
* using System.Linq;
* using Pulumi;
* using Azure = Pulumi.Azure;
* return await Deployment.RunAsync(() =>
* {
* var example = new Azure.Core.ResourceGroup("example", new()
* {
* Name = "example-resources",
* Location = "West Europe",
* });
* var exampleAnalyticsWorkspace = new Azure.OperationalInsights.AnalyticsWorkspace("example", new()
* {
* Name = "example-workspace",
* Location = example.Location,
* ResourceGroupName = example.Name,
* Sku = "pergb2018",
* });
* var exampleLogAnalyticsWorkspaceOnboarding = new Azure.Sentinel.LogAnalyticsWorkspaceOnboarding("example", new()
* {
* WorkspaceId = exampleAnalyticsWorkspace.Id,
* });
* var exampleAlertRuleNrt = new Azure.Sentinel.AlertRuleNrt("example", new()
* {
* Name = "example",
* LogAnalyticsWorkspaceId = exampleLogAnalyticsWorkspaceOnboarding.WorkspaceId,
* DisplayName = "example",
* Severity = "High",
* Query = @"AzureActivity |
* where OperationName == ""Create or Update Virtual Machine"" or OperationName ==""Create Deployment"" |
* where ActivityStatus == ""Succeeded"" |
* make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
* ",
* });
* });
* ```
* ```go
* package main
* import (
* "github.com/pulumi/pulumi-azure/sdk/v5/go/azure/core"
* "github.com/pulumi/pulumi-azure/sdk/v5/go/azure/operationalinsights"
* "github.com/pulumi/pulumi-azure/sdk/v5/go/azure/sentinel"
* "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
* )
* func main() {
* pulumi.Run(func(ctx *pulumi.Context) error {
* example, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
* Name: pulumi.String("example-resources"),
* Location: pulumi.String("West Europe"),
* })
* if err != nil {
* return err
* }
* exampleAnalyticsWorkspace, err := operationalinsights.NewAnalyticsWorkspace(ctx, "example", &operationalinsights.AnalyticsWorkspaceArgs{
* Name: pulumi.String("example-workspace"),
* Location: example.Location,
* ResourceGroupName: example.Name,
* Sku: pulumi.String("pergb2018"),
* })
* if err != nil {
* return err
* }
* exampleLogAnalyticsWorkspaceOnboarding, err := sentinel.NewLogAnalyticsWorkspaceOnboarding(ctx, "example", &sentinel.LogAnalyticsWorkspaceOnboardingArgs{
* WorkspaceId: exampleAnalyticsWorkspace.ID(),
* })
* if err != nil {
* return err
* }
* _, err = sentinel.NewAlertRuleNrt(ctx, "example", &sentinel.AlertRuleNrtArgs{
* Name: pulumi.String("example"),
* LogAnalyticsWorkspaceId: exampleLogAnalyticsWorkspaceOnboarding.WorkspaceId,
* DisplayName: pulumi.String("example"),
* Severity: pulumi.String("High"),
* Query: pulumi.String("AzureActivity |\n where OperationName == \"Create or Update Virtual Machine\" or OperationName ==\"Create Deployment\" |\n where ActivityStatus == \"Succeeded\" |\n make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller\n"),
* })
* if err != nil {
* return err
* }
* return nil
* })
* }
* ```
* ```java
* package generated_program;
* import com.pulumi.Context;
* import com.pulumi.Pulumi;
* import com.pulumi.core.Output;
* import com.pulumi.azure.core.ResourceGroup;
* import com.pulumi.azure.core.ResourceGroupArgs;
* import com.pulumi.azure.operationalinsights.AnalyticsWorkspace;
* import com.pulumi.azure.operationalinsights.AnalyticsWorkspaceArgs;
* import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboarding;
* import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboardingArgs;
* import com.pulumi.azure.sentinel.AlertRuleNrt;
* import com.pulumi.azure.sentinel.AlertRuleNrtArgs;
* import java.util.List;
* import java.util.ArrayList;
* import java.util.Map;
* import java.io.File;
* import java.nio.file.Files;
* import java.nio.file.Paths;
* public class App {
* public static void main(String[] args) {
* Pulumi.run(App::stack);
* }
* public static void stack(Context ctx) {
* var example = new ResourceGroup("example", ResourceGroupArgs.builder()
* .name("example-resources")
* .location("West Europe")
* .build());
* var exampleAnalyticsWorkspace = new AnalyticsWorkspace("exampleAnalyticsWorkspace", AnalyticsWorkspaceArgs.builder()
* .name("example-workspace")
* .location(example.location())
* .resourceGroupName(example.name())
* .sku("pergb2018")
* .build());
* var exampleLogAnalyticsWorkspaceOnboarding = new LogAnalyticsWorkspaceOnboarding("exampleLogAnalyticsWorkspaceOnboarding", LogAnalyticsWorkspaceOnboardingArgs.builder()
* .workspaceId(exampleAnalyticsWorkspace.id())
* .build());
* var exampleAlertRuleNrt = new AlertRuleNrt("exampleAlertRuleNrt", AlertRuleNrtArgs.builder()
* .name("example")
* .logAnalyticsWorkspaceId(exampleLogAnalyticsWorkspaceOnboarding.workspaceId())
* .displayName("example")
* .severity("High")
* .query("""
* AzureActivity |
* where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
* where ActivityStatus == "Succeeded" |
* make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
* """)
* .build());
* }
* }
* ```
* ```yaml
* resources:
* example:
* type: azure:core:ResourceGroup
* properties:
* name: example-resources
* location: West Europe
* exampleAnalyticsWorkspace:
* type: azure:operationalinsights:AnalyticsWorkspace
* name: example
* properties:
* name: example-workspace
* location: ${example.location}
* resourceGroupName: ${example.name}
* sku: pergb2018
* exampleLogAnalyticsWorkspaceOnboarding:
* type: azure:sentinel:LogAnalyticsWorkspaceOnboarding
* name: example
* properties:
* workspaceId: ${exampleAnalyticsWorkspace.id}
* exampleAlertRuleNrt:
* type: azure:sentinel:AlertRuleNrt
* name: example
* properties:
* name: example
* logAnalyticsWorkspaceId: ${exampleLogAnalyticsWorkspaceOnboarding.workspaceId}
* displayName: example
* severity: High
* query: |
* AzureActivity |
* where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
* where ActivityStatus == "Succeeded" |
* make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
* ```
*
* ## Import
* Sentinel NRT Alert Rules can be imported using the `resource id`, e.g.
* ```sh
* $ pulumi import azure:sentinel/alertRuleNrt:AlertRuleNrt example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.OperationalInsights/workspaces/workspace1/providers/Microsoft.SecurityInsights/alertRules/rule1
* ```
* @property alertDetailsOverrides An `alert_details_override` block as defined below.
* @property alertRuleTemplateGuid The GUID of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
* @property alertRuleTemplateVersion The version of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
* @property customDetails A map of string key-value pairs of columns to be attached to this Sentinel NRT Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
* @property description The description of this Sentinel NRT Alert Rule.
* @property displayName The friendly name of this Sentinel NRT Alert Rule.
* @property enabled Should the Sentinel NRT Alert Rule be enabled? Defaults to `true`.
* @property entityMappings A list of `entity_mapping` blocks as defined below.
* @property eventGrouping A `event_grouping` block as defined below.
* > **NOTE:** `event_grouping` will be required in the next major version of the AzureRM Provider.
* @property incident A `incident` block as defined below.
* @property logAnalyticsWorkspaceId The ID of the Log Analytics Workspace this Sentinel NRT Alert Rule belongs to. Changing this forces a new Sentinel NRT Alert Rule to be created.
* @property name The name which should be used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
* @property query The query of this Sentinel NRT Alert Rule.
* @property sentinelEntityMappings A list of `sentinel_entity_mapping` blocks as defined below.
* > **NOTE:** `entity_mapping` and `sentinel_entity_mapping` together can't exceed 5.
* @property severity The alert severity of this Sentinel NRT Alert Rule. Possible values are `High`, `Medium`, `Low` and `Informational`.
* @property suppressionDuration If `suppression_enabled` is `true`, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to `PT5H`.
* @property suppressionEnabled Should the Sentinel NRT Alert Rulea stop running query after alert is generated? Defaults to `false`.
* @property tactics A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `Impact`, `ImpairProcessControl`, `InhibitResponseFunction`, `InitialAccess`, `LateralMovement`, `Persistence`, `PreAttack`, `PrivilegeEscalation`, `Reconnaissance` and `ResourceDevelopment`.
* @property techniques A list of techniques of attacks by which to classify the rule.
*/
public data class AlertRuleNrtArgs(
public val alertDetailsOverrides: Output>? = null,
public val alertRuleTemplateGuid: Output? = null,
public val alertRuleTemplateVersion: Output? = null,
public val customDetails: Output>? = null,
public val description: Output? = null,
public val displayName: Output? = null,
public val enabled: Output? = null,
public val entityMappings: Output>? = null,
public val eventGrouping: Output? = null,
public val incident: Output? = null,
public val logAnalyticsWorkspaceId: Output? = null,
public val name: Output? = null,
public val query: Output? = null,
public val sentinelEntityMappings: Output>? = null,
public val severity: Output? = null,
public val suppressionDuration: Output? = null,
public val suppressionEnabled: Output? = null,
public val tactics: Output>? = null,
public val techniques: Output>? = null,
) : ConvertibleToJava {
override fun toJava(): com.pulumi.azure.sentinel.AlertRuleNrtArgs =
com.pulumi.azure.sentinel.AlertRuleNrtArgs.builder()
.alertDetailsOverrides(
alertDetailsOverrides?.applyValue({ args0 ->
args0.map({ args0 ->
args0.let({ args0 -> args0.toJava() })
})
}),
)
.alertRuleTemplateGuid(alertRuleTemplateGuid?.applyValue({ args0 -> args0 }))
.alertRuleTemplateVersion(alertRuleTemplateVersion?.applyValue({ args0 -> args0 }))
.customDetails(
customDetails?.applyValue({ args0 ->
args0.map({ args0 ->
args0.key.to(args0.value)
}).toMap()
}),
)
.description(description?.applyValue({ args0 -> args0 }))
.displayName(displayName?.applyValue({ args0 -> args0 }))
.enabled(enabled?.applyValue({ args0 -> args0 }))
.entityMappings(
entityMappings?.applyValue({ args0 ->
args0.map({ args0 ->
args0.let({ args0 ->
args0.toJava()
})
})
}),
)
.eventGrouping(eventGrouping?.applyValue({ args0 -> args0.let({ args0 -> args0.toJava() }) }))
.incident(incident?.applyValue({ args0 -> args0.let({ args0 -> args0.toJava() }) }))
.logAnalyticsWorkspaceId(logAnalyticsWorkspaceId?.applyValue({ args0 -> args0 }))
.name(name?.applyValue({ args0 -> args0 }))
.query(query?.applyValue({ args0 -> args0 }))
.sentinelEntityMappings(
sentinelEntityMappings?.applyValue({ args0 ->
args0.map({ args0 ->
args0.let({ args0 -> args0.toJava() })
})
}),
)
.severity(severity?.applyValue({ args0 -> args0 }))
.suppressionDuration(suppressionDuration?.applyValue({ args0 -> args0 }))
.suppressionEnabled(suppressionEnabled?.applyValue({ args0 -> args0 }))
.tactics(tactics?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.techniques(techniques?.applyValue({ args0 -> args0.map({ args0 -> args0 }) })).build()
}
/**
* Builder for [AlertRuleNrtArgs].
*/
@PulumiTagMarker
public class AlertRuleNrtArgsBuilder internal constructor() {
private var alertDetailsOverrides: Output>? = null
private var alertRuleTemplateGuid: Output? = null
private var alertRuleTemplateVersion: Output? = null
private var customDetails: Output>? = null
private var description: Output? = null
private var displayName: Output? = null
private var enabled: Output? = null
private var entityMappings: Output>? = null
private var eventGrouping: Output? = null
private var incident: Output? = null
private var logAnalyticsWorkspaceId: Output? = null
private var name: Output? = null
private var query: Output? = null
private var sentinelEntityMappings: Output>? = null
private var severity: Output? = null
private var suppressionDuration: Output? = null
private var suppressionEnabled: Output? = null
private var tactics: Output>? = null
private var techniques: Output>? = null
/**
* @param value An `alert_details_override` block as defined below.
*/
@JvmName("iyrqhvdupojehggo")
public suspend fun alertDetailsOverrides(`value`: Output>) {
this.alertDetailsOverrides = value
}
@JvmName("siqtqgrexyyfvbjs")
public suspend fun alertDetailsOverrides(vararg values: Output) {
this.alertDetailsOverrides = Output.all(values.asList())
}
/**
* @param values An `alert_details_override` block as defined below.
*/
@JvmName("ankagcfdlsypyolw")
public suspend fun alertDetailsOverrides(values: List>) {
this.alertDetailsOverrides = Output.all(values)
}
/**
* @param value The GUID of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
*/
@JvmName("vuwkjdoyujmeyosl")
public suspend fun alertRuleTemplateGuid(`value`: Output) {
this.alertRuleTemplateGuid = value
}
/**
* @param value The version of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
*/
@JvmName("eatwepprsycksiar")
public suspend fun alertRuleTemplateVersion(`value`: Output) {
this.alertRuleTemplateVersion = value
}
/**
* @param value A map of string key-value pairs of columns to be attached to this Sentinel NRT Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
*/
@JvmName("bskrmxxyitoqdbto")
public suspend fun customDetails(`value`: Output>) {
this.customDetails = value
}
/**
* @param value The description of this Sentinel NRT Alert Rule.
*/
@JvmName("icboulawnksbubvp")
public suspend fun description(`value`: Output) {
this.description = value
}
/**
* @param value The friendly name of this Sentinel NRT Alert Rule.
*/
@JvmName("jdontwebqmaylilh")
public suspend fun displayName(`value`: Output) {
this.displayName = value
}
/**
* @param value Should the Sentinel NRT Alert Rule be enabled? Defaults to `true`.
*/
@JvmName("hhinrtgymjgmfdrc")
public suspend fun enabled(`value`: Output) {
this.enabled = value
}
/**
* @param value A list of `entity_mapping` blocks as defined below.
*/
@JvmName("lvndftbkjxgqrsks")
public suspend fun entityMappings(`value`: Output>) {
this.entityMappings = value
}
@JvmName("jjarnoysnphqerlg")
public suspend fun entityMappings(vararg values: Output) {
this.entityMappings = Output.all(values.asList())
}
/**
* @param values A list of `entity_mapping` blocks as defined below.
*/
@JvmName("jvfcycpapakjagig")
public suspend fun entityMappings(values: List>) {
this.entityMappings = Output.all(values)
}
/**
* @param value A `event_grouping` block as defined below.
* > **NOTE:** `event_grouping` will be required in the next major version of the AzureRM Provider.
*/
@JvmName("howgcyctbiyttpea")
public suspend fun eventGrouping(`value`: Output) {
this.eventGrouping = value
}
/**
* @param value A `incident` block as defined below.
*/
@JvmName("gpkomcqugbqkwvtl")
public suspend fun incident(`value`: Output) {
this.incident = value
}
/**
* @param value The ID of the Log Analytics Workspace this Sentinel NRT Alert Rule belongs to. Changing this forces a new Sentinel NRT Alert Rule to be created.
*/
@JvmName("xbkvcnejfhtqenyt")
public suspend fun logAnalyticsWorkspaceId(`value`: Output) {
this.logAnalyticsWorkspaceId = value
}
/**
* @param value The name which should be used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
*/
@JvmName("firrppukeucrnusp")
public suspend fun name(`value`: Output) {
this.name = value
}
/**
* @param value The query of this Sentinel NRT Alert Rule.
*/
@JvmName("mpnwkqcgiwsnodbh")
public suspend fun query(`value`: Output) {
this.query = value
}
/**
* @param value A list of `sentinel_entity_mapping` blocks as defined below.
* > **NOTE:** `entity_mapping` and `sentinel_entity_mapping` together can't exceed 5.
*/
@JvmName("vfrfbbbelosoqpao")
public suspend fun sentinelEntityMappings(`value`: Output>) {
this.sentinelEntityMappings = value
}
@JvmName("wgqbxwrhgsrbhotv")
public suspend fun sentinelEntityMappings(vararg values: Output) {
this.sentinelEntityMappings = Output.all(values.asList())
}
/**
* @param values A list of `sentinel_entity_mapping` blocks as defined below.
* > **NOTE:** `entity_mapping` and `sentinel_entity_mapping` together can't exceed 5.
*/
@JvmName("qoyevdprbbjctjhw")
public suspend fun sentinelEntityMappings(values: List>) {
this.sentinelEntityMappings = Output.all(values)
}
/**
* @param value The alert severity of this Sentinel NRT Alert Rule. Possible values are `High`, `Medium`, `Low` and `Informational`.
*/
@JvmName("cxhlybkshuugirlt")
public suspend fun severity(`value`: Output) {
this.severity = value
}
/**
* @param value If `suppression_enabled` is `true`, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to `PT5H`.
*/
@JvmName("cycmsavdxpbfcevo")
public suspend fun suppressionDuration(`value`: Output) {
this.suppressionDuration = value
}
/**
* @param value Should the Sentinel NRT Alert Rulea stop running query after alert is generated? Defaults to `false`.
*/
@JvmName("stcxtcqpuotrwpnd")
public suspend fun suppressionEnabled(`value`: Output) {
this.suppressionEnabled = value
}
/**
* @param value A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `Impact`, `ImpairProcessControl`, `InhibitResponseFunction`, `InitialAccess`, `LateralMovement`, `Persistence`, `PreAttack`, `PrivilegeEscalation`, `Reconnaissance` and `ResourceDevelopment`.
*/
@JvmName("wbrmfophwsibyhie")
public suspend fun tactics(`value`: Output>) {
this.tactics = value
}
@JvmName("fhxrtbwmnpxavdit")
public suspend fun tactics(vararg values: Output) {
this.tactics = Output.all(values.asList())
}
/**
* @param values A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `Impact`, `ImpairProcessControl`, `InhibitResponseFunction`, `InitialAccess`, `LateralMovement`, `Persistence`, `PreAttack`, `PrivilegeEscalation`, `Reconnaissance` and `ResourceDevelopment`.
*/
@JvmName("nitpqucpfcofsooo")
public suspend fun tactics(values: List>) {
this.tactics = Output.all(values)
}
/**
* @param value A list of techniques of attacks by which to classify the rule.
*/
@JvmName("lthnfrpwsycuqjae")
public suspend fun techniques(`value`: Output>) {
this.techniques = value
}
@JvmName("dpuftmtadagfqddh")
public suspend fun techniques(vararg values: Output) {
this.techniques = Output.all(values.asList())
}
/**
* @param values A list of techniques of attacks by which to classify the rule.
*/
@JvmName("yqmmxvekkuyrwrsf")
public suspend fun techniques(values: List>) {
this.techniques = Output.all(values)
}
/**
* @param value An `alert_details_override` block as defined below.
*/
@JvmName("vyehrsrbtnfhachj")
public suspend fun alertDetailsOverrides(`value`: List?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.alertDetailsOverrides = mapped
}
/**
* @param argument An `alert_details_override` block as defined below.
*/
@JvmName("msknlruloccpfajm")
public suspend fun alertDetailsOverrides(argument: List Unit>) {
val toBeMapped = argument.toList().map {
AlertRuleNrtAlertDetailsOverrideArgsBuilder().applySuspend { it() }.build()
}
val mapped = of(toBeMapped)
this.alertDetailsOverrides = mapped
}
/**
* @param argument An `alert_details_override` block as defined below.
*/
@JvmName("eqwdeiirndeiwnpn")
public suspend fun alertDetailsOverrides(vararg argument: suspend AlertRuleNrtAlertDetailsOverrideArgsBuilder.() -> Unit) {
val toBeMapped = argument.toList().map {
AlertRuleNrtAlertDetailsOverrideArgsBuilder().applySuspend { it() }.build()
}
val mapped = of(toBeMapped)
this.alertDetailsOverrides = mapped
}
/**
* @param argument An `alert_details_override` block as defined below.
*/
@JvmName("flkgiixgoocflepo")
public suspend fun alertDetailsOverrides(argument: suspend AlertRuleNrtAlertDetailsOverrideArgsBuilder.() -> Unit) {
val toBeMapped = listOf(
AlertRuleNrtAlertDetailsOverrideArgsBuilder().applySuspend {
argument()
}.build(),
)
val mapped = of(toBeMapped)
this.alertDetailsOverrides = mapped
}
/**
* @param values An `alert_details_override` block as defined below.
*/
@JvmName("njuorgychljxrpry")
public suspend fun alertDetailsOverrides(vararg values: AlertRuleNrtAlertDetailsOverrideArgs) {
val toBeMapped = values.toList()
val mapped = toBeMapped.let({ args0 -> of(args0) })
this.alertDetailsOverrides = mapped
}
/**
* @param value The GUID of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
*/
@JvmName("jxxvjkblrhrprsmf")
public suspend fun alertRuleTemplateGuid(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.alertRuleTemplateGuid = mapped
}
/**
* @param value The version of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
*/
@JvmName("ipnkqdkpeohdtrce")
public suspend fun alertRuleTemplateVersion(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.alertRuleTemplateVersion = mapped
}
/**
* @param value A map of string key-value pairs of columns to be attached to this Sentinel NRT Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
*/
@JvmName("igkmdmxdjuavxchj")
public suspend fun customDetails(`value`: Map?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.customDetails = mapped
}
/**
* @param values A map of string key-value pairs of columns to be attached to this Sentinel NRT Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
*/
@JvmName("urgsaciswnblahnr")
public fun customDetails(vararg values: Pair) {
val toBeMapped = values.toMap()
val mapped = toBeMapped.let({ args0 -> of(args0) })
this.customDetails = mapped
}
/**
* @param value The description of this Sentinel NRT Alert Rule.
*/
@JvmName("wmgxrdkvgmsnmxrw")
public suspend fun description(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.description = mapped
}
/**
* @param value The friendly name of this Sentinel NRT Alert Rule.
*/
@JvmName("duamkiaabibhabee")
public suspend fun displayName(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.displayName = mapped
}
/**
* @param value Should the Sentinel NRT Alert Rule be enabled? Defaults to `true`.
*/
@JvmName("vaaiwoijrpycacph")
public suspend fun enabled(`value`: Boolean?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.enabled = mapped
}
/**
* @param value A list of `entity_mapping` blocks as defined below.
*/
@JvmName("mdpyhqiyefnedkiq")
public suspend fun entityMappings(`value`: List?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.entityMappings = mapped
}
/**
* @param argument A list of `entity_mapping` blocks as defined below.
*/
@JvmName("jfbrmdwecklwsfih")
public suspend fun entityMappings(argument: List Unit>) {
val toBeMapped = argument.toList().map {
AlertRuleNrtEntityMappingArgsBuilder().applySuspend {
it()
}.build()
}
val mapped = of(toBeMapped)
this.entityMappings = mapped
}
/**
* @param argument A list of `entity_mapping` blocks as defined below.
*/
@JvmName("vcucgdprertjhanb")
public suspend fun entityMappings(vararg argument: suspend AlertRuleNrtEntityMappingArgsBuilder.() -> Unit) {
val toBeMapped = argument.toList().map {
AlertRuleNrtEntityMappingArgsBuilder().applySuspend {
it()
}.build()
}
val mapped = of(toBeMapped)
this.entityMappings = mapped
}
/**
* @param argument A list of `entity_mapping` blocks as defined below.
*/
@JvmName("hlkbjbhclxscdyqj")
public suspend fun entityMappings(argument: suspend AlertRuleNrtEntityMappingArgsBuilder.() -> Unit) {
val toBeMapped = listOf(
AlertRuleNrtEntityMappingArgsBuilder().applySuspend {
argument()
}.build(),
)
val mapped = of(toBeMapped)
this.entityMappings = mapped
}
/**
* @param values A list of `entity_mapping` blocks as defined below.
*/
@JvmName("cpldqbgepeawuibx")
public suspend fun entityMappings(vararg values: AlertRuleNrtEntityMappingArgs) {
val toBeMapped = values.toList()
val mapped = toBeMapped.let({ args0 -> of(args0) })
this.entityMappings = mapped
}
/**
* @param value A `event_grouping` block as defined below.
* > **NOTE:** `event_grouping` will be required in the next major version of the AzureRM Provider.
*/
@JvmName("wleignnqxtndkmym")
public suspend fun eventGrouping(`value`: AlertRuleNrtEventGroupingArgs?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.eventGrouping = mapped
}
/**
* @param argument A `event_grouping` block as defined below.
* > **NOTE:** `event_grouping` will be required in the next major version of the AzureRM Provider.
*/
@JvmName("qnmlqdmwxhqtruah")
public suspend fun eventGrouping(argument: suspend AlertRuleNrtEventGroupingArgsBuilder.() -> Unit) {
val toBeMapped = AlertRuleNrtEventGroupingArgsBuilder().applySuspend { argument() }.build()
val mapped = of(toBeMapped)
this.eventGrouping = mapped
}
/**
* @param value A `incident` block as defined below.
*/
@JvmName("vmrnxcwpmxcwegya")
public suspend fun incident(`value`: AlertRuleNrtIncidentArgs?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.incident = mapped
}
/**
* @param argument A `incident` block as defined below.
*/
@JvmName("kgvvmfefwpmnscqu")
public suspend fun incident(argument: suspend AlertRuleNrtIncidentArgsBuilder.() -> Unit) {
val toBeMapped = AlertRuleNrtIncidentArgsBuilder().applySuspend { argument() }.build()
val mapped = of(toBeMapped)
this.incident = mapped
}
/**
* @param value The ID of the Log Analytics Workspace this Sentinel NRT Alert Rule belongs to. Changing this forces a new Sentinel NRT Alert Rule to be created.
*/
@JvmName("goktwuijpxlrsfap")
public suspend fun logAnalyticsWorkspaceId(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.logAnalyticsWorkspaceId = mapped
}
/**
* @param value The name which should be used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
*/
@JvmName("yfeysceafllighgx")
public suspend fun name(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.name = mapped
}
/**
* @param value The query of this Sentinel NRT Alert Rule.
*/
@JvmName("jocbyhhyoccnttcb")
public suspend fun query(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.query = mapped
}
/**
* @param value A list of `sentinel_entity_mapping` blocks as defined below.
* > **NOTE:** `entity_mapping` and `sentinel_entity_mapping` together can't exceed 5.
*/
@JvmName("obavodcadfymkyyo")
public suspend fun sentinelEntityMappings(`value`: List?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.sentinelEntityMappings = mapped
}
/**
* @param argument A list of `sentinel_entity_mapping` blocks as defined below.
* > **NOTE:** `entity_mapping` and `sentinel_entity_mapping` together can't exceed 5.
*/
@JvmName("ligemlqmefyfgkgk")
public suspend fun sentinelEntityMappings(argument: List Unit>) {
val toBeMapped = argument.toList().map {
AlertRuleNrtSentinelEntityMappingArgsBuilder().applySuspend { it() }.build()
}
val mapped = of(toBeMapped)
this.sentinelEntityMappings = mapped
}
/**
* @param argument A list of `sentinel_entity_mapping` blocks as defined below.
* > **NOTE:** `entity_mapping` and `sentinel_entity_mapping` together can't exceed 5.
*/
@JvmName("dlwvaddrwgojhywh")
public suspend fun sentinelEntityMappings(vararg argument: suspend AlertRuleNrtSentinelEntityMappingArgsBuilder.() -> Unit) {
val toBeMapped = argument.toList().map {
AlertRuleNrtSentinelEntityMappingArgsBuilder().applySuspend { it() }.build()
}
val mapped = of(toBeMapped)
this.sentinelEntityMappings = mapped
}
/**
* @param argument A list of `sentinel_entity_mapping` blocks as defined below.
* > **NOTE:** `entity_mapping` and `sentinel_entity_mapping` together can't exceed 5.
*/
@JvmName("sobgfexwmnletdmp")
public suspend fun sentinelEntityMappings(argument: suspend AlertRuleNrtSentinelEntityMappingArgsBuilder.() -> Unit) {
val toBeMapped = listOf(
AlertRuleNrtSentinelEntityMappingArgsBuilder().applySuspend {
argument()
}.build(),
)
val mapped = of(toBeMapped)
this.sentinelEntityMappings = mapped
}
/**
* @param values A list of `sentinel_entity_mapping` blocks as defined below.
* > **NOTE:** `entity_mapping` and `sentinel_entity_mapping` together can't exceed 5.
*/
@JvmName("onxtbglonhchgjos")
public suspend fun sentinelEntityMappings(vararg values: AlertRuleNrtSentinelEntityMappingArgs) {
val toBeMapped = values.toList()
val mapped = toBeMapped.let({ args0 -> of(args0) })
this.sentinelEntityMappings = mapped
}
/**
* @param value The alert severity of this Sentinel NRT Alert Rule. Possible values are `High`, `Medium`, `Low` and `Informational`.
*/
@JvmName("wekyxhtlnagymbwr")
public suspend fun severity(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.severity = mapped
}
/**
* @param value If `suppression_enabled` is `true`, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to `PT5H`.
*/
@JvmName("yrfnboesycobfbmx")
public suspend fun suppressionDuration(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.suppressionDuration = mapped
}
/**
* @param value Should the Sentinel NRT Alert Rulea stop running query after alert is generated? Defaults to `false`.
*/
@JvmName("gqoeyjtaspaxbnhq")
public suspend fun suppressionEnabled(`value`: Boolean?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.suppressionEnabled = mapped
}
/**
* @param value A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `Impact`, `ImpairProcessControl`, `InhibitResponseFunction`, `InitialAccess`, `LateralMovement`, `Persistence`, `PreAttack`, `PrivilegeEscalation`, `Reconnaissance` and `ResourceDevelopment`.
*/
@JvmName("penmjwfbhhobyrrx")
public suspend fun tactics(`value`: List?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.tactics = mapped
}
/**
* @param values A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `Impact`, `ImpairProcessControl`, `InhibitResponseFunction`, `InitialAccess`, `LateralMovement`, `Persistence`, `PreAttack`, `PrivilegeEscalation`, `Reconnaissance` and `ResourceDevelopment`.
*/
@JvmName("egtwlwxrnxfbpibi")
public suspend fun tactics(vararg values: String) {
val toBeMapped = values.toList()
val mapped = toBeMapped.let({ args0 -> of(args0) })
this.tactics = mapped
}
/**
* @param value A list of techniques of attacks by which to classify the rule.
*/
@JvmName("qttqpjbeffpcyssn")
public suspend fun techniques(`value`: List?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.techniques = mapped
}
/**
* @param values A list of techniques of attacks by which to classify the rule.
*/
@JvmName("rhkpqwstmrfcjefs")
public suspend fun techniques(vararg values: String) {
val toBeMapped = values.toList()
val mapped = toBeMapped.let({ args0 -> of(args0) })
this.techniques = mapped
}
internal fun build(): AlertRuleNrtArgs = AlertRuleNrtArgs(
alertDetailsOverrides = alertDetailsOverrides,
alertRuleTemplateGuid = alertRuleTemplateGuid,
alertRuleTemplateVersion = alertRuleTemplateVersion,
customDetails = customDetails,
description = description,
displayName = displayName,
enabled = enabled,
entityMappings = entityMappings,
eventGrouping = eventGrouping,
incident = incident,
logAnalyticsWorkspaceId = logAnalyticsWorkspaceId,
name = name,
query = query,
sentinelEntityMappings = sentinelEntityMappings,
severity = severity,
suppressionDuration = suppressionDuration,
suppressionEnabled = suppressionEnabled,
tactics = tactics,
techniques = techniques,
)
}
© 2015 - 2025 Weber Informatics LLC | Privacy Policy