Many resources are needed to download a project. Please understand that we have to compensate our server costs. Thank you in advance. Project price only 1 $
You can buy this project and download/modify it how often you want.
@file:Suppress("NAME_SHADOWING", "DEPRECATION")
package com.pulumi.azure.sentinel.kotlin
import com.pulumi.azure.sentinel.AlertRuleScheduledArgs.builder
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleScheduledAlertDetailsOverrideArgs
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleScheduledAlertDetailsOverrideArgsBuilder
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleScheduledEntityMappingArgs
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleScheduledEntityMappingArgsBuilder
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleScheduledEventGroupingArgs
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleScheduledEventGroupingArgsBuilder
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleScheduledIncidentArgs
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleScheduledIncidentArgsBuilder
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleScheduledIncidentConfigurationArgs
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleScheduledIncidentConfigurationArgsBuilder
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleScheduledSentinelEntityMappingArgs
import com.pulumi.azure.sentinel.kotlin.inputs.AlertRuleScheduledSentinelEntityMappingArgsBuilder
import com.pulumi.core.Output
import com.pulumi.core.Output.of
import com.pulumi.kotlin.ConvertibleToJava
import com.pulumi.kotlin.PulumiTagMarker
import com.pulumi.kotlin.applySuspend
import kotlin.Boolean
import kotlin.Deprecated
import kotlin.Int
import kotlin.Pair
import kotlin.String
import kotlin.Suppress
import kotlin.Unit
import kotlin.collections.List
import kotlin.collections.Map
import kotlin.jvm.JvmName
/**
* Manages a Sentinel Scheduled Alert Rule.
* ## Example Usage
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as azure from "@pulumi/azure";
* const example = new azure.core.ResourceGroup("example", {
* name: "example-resources",
* location: "West Europe",
* });
* const exampleAnalyticsWorkspace = new azure.operationalinsights.AnalyticsWorkspace("example", {
* name: "example-workspace",
* location: example.location,
* resourceGroupName: example.name,
* sku: "PerGB2018",
* });
* const exampleLogAnalyticsWorkspaceOnboarding = new azure.sentinel.LogAnalyticsWorkspaceOnboarding("example", {workspaceId: exampleAnalyticsWorkspace.id});
* const exampleAlertRuleScheduled = new azure.sentinel.AlertRuleScheduled("example", {
* name: "example",
* logAnalyticsWorkspaceId: exampleLogAnalyticsWorkspaceOnboarding.workspaceId,
* displayName: "example",
* severity: "High",
* query: `AzureActivity |
* where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
* where ActivityStatus == "Succeeded" |
* make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
* `,
* });
* ```
* ```python
* import pulumi
* import pulumi_azure as azure
* example = azure.core.ResourceGroup("example",
* name="example-resources",
* location="West Europe")
* example_analytics_workspace = azure.operationalinsights.AnalyticsWorkspace("example",
* name="example-workspace",
* location=example.location,
* resource_group_name=example.name,
* sku="PerGB2018")
* example_log_analytics_workspace_onboarding = azure.sentinel.LogAnalyticsWorkspaceOnboarding("example", workspace_id=example_analytics_workspace.id)
* example_alert_rule_scheduled = azure.sentinel.AlertRuleScheduled("example",
* name="example",
* log_analytics_workspace_id=example_log_analytics_workspace_onboarding.workspace_id,
* display_name="example",
* severity="High",
* query="""AzureActivity |
* where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
* where ActivityStatus == "Succeeded" |
* make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
* """)
* ```
* ```csharp
* using System.Collections.Generic;
* using System.Linq;
* using Pulumi;
* using Azure = Pulumi.Azure;
* return await Deployment.RunAsync(() =>
* {
* var example = new Azure.Core.ResourceGroup("example", new()
* {
* Name = "example-resources",
* Location = "West Europe",
* });
* var exampleAnalyticsWorkspace = new Azure.OperationalInsights.AnalyticsWorkspace("example", new()
* {
* Name = "example-workspace",
* Location = example.Location,
* ResourceGroupName = example.Name,
* Sku = "PerGB2018",
* });
* var exampleLogAnalyticsWorkspaceOnboarding = new Azure.Sentinel.LogAnalyticsWorkspaceOnboarding("example", new()
* {
* WorkspaceId = exampleAnalyticsWorkspace.Id,
* });
* var exampleAlertRuleScheduled = new Azure.Sentinel.AlertRuleScheduled("example", new()
* {
* Name = "example",
* LogAnalyticsWorkspaceId = exampleLogAnalyticsWorkspaceOnboarding.WorkspaceId,
* DisplayName = "example",
* Severity = "High",
* Query = @"AzureActivity |
* where OperationName == ""Create or Update Virtual Machine"" or OperationName ==""Create Deployment"" |
* where ActivityStatus == ""Succeeded"" |
* make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
* ",
* });
* });
* ```
* ```go
* package main
* import (
* "github.com/pulumi/pulumi-azure/sdk/v5/go/azure/core"
* "github.com/pulumi/pulumi-azure/sdk/v5/go/azure/operationalinsights"
* "github.com/pulumi/pulumi-azure/sdk/v5/go/azure/sentinel"
* "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
* )
* func main() {
* pulumi.Run(func(ctx *pulumi.Context) error {
* example, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
* Name: pulumi.String("example-resources"),
* Location: pulumi.String("West Europe"),
* })
* if err != nil {
* return err
* }
* exampleAnalyticsWorkspace, err := operationalinsights.NewAnalyticsWorkspace(ctx, "example", &operationalinsights.AnalyticsWorkspaceArgs{
* Name: pulumi.String("example-workspace"),
* Location: example.Location,
* ResourceGroupName: example.Name,
* Sku: pulumi.String("PerGB2018"),
* })
* if err != nil {
* return err
* }
* exampleLogAnalyticsWorkspaceOnboarding, err := sentinel.NewLogAnalyticsWorkspaceOnboarding(ctx, "example", &sentinel.LogAnalyticsWorkspaceOnboardingArgs{
* WorkspaceId: exampleAnalyticsWorkspace.ID(),
* })
* if err != nil {
* return err
* }
* _, err = sentinel.NewAlertRuleScheduled(ctx, "example", &sentinel.AlertRuleScheduledArgs{
* Name: pulumi.String("example"),
* LogAnalyticsWorkspaceId: exampleLogAnalyticsWorkspaceOnboarding.WorkspaceId,
* DisplayName: pulumi.String("example"),
* Severity: pulumi.String("High"),
* Query: pulumi.String("AzureActivity |\n where OperationName == \"Create or Update Virtual Machine\" or OperationName ==\"Create Deployment\" |\n where ActivityStatus == \"Succeeded\" |\n make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller\n"),
* })
* if err != nil {
* return err
* }
* return nil
* })
* }
* ```
* ```java
* package generated_program;
* import com.pulumi.Context;
* import com.pulumi.Pulumi;
* import com.pulumi.core.Output;
* import com.pulumi.azure.core.ResourceGroup;
* import com.pulumi.azure.core.ResourceGroupArgs;
* import com.pulumi.azure.operationalinsights.AnalyticsWorkspace;
* import com.pulumi.azure.operationalinsights.AnalyticsWorkspaceArgs;
* import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboarding;
* import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboardingArgs;
* import com.pulumi.azure.sentinel.AlertRuleScheduled;
* import com.pulumi.azure.sentinel.AlertRuleScheduledArgs;
* import java.util.List;
* import java.util.ArrayList;
* import java.util.Map;
* import java.io.File;
* import java.nio.file.Files;
* import java.nio.file.Paths;
* public class App {
* public static void main(String[] args) {
* Pulumi.run(App::stack);
* }
* public static void stack(Context ctx) {
* var example = new ResourceGroup("example", ResourceGroupArgs.builder()
* .name("example-resources")
* .location("West Europe")
* .build());
* var exampleAnalyticsWorkspace = new AnalyticsWorkspace("exampleAnalyticsWorkspace", AnalyticsWorkspaceArgs.builder()
* .name("example-workspace")
* .location(example.location())
* .resourceGroupName(example.name())
* .sku("PerGB2018")
* .build());
* var exampleLogAnalyticsWorkspaceOnboarding = new LogAnalyticsWorkspaceOnboarding("exampleLogAnalyticsWorkspaceOnboarding", LogAnalyticsWorkspaceOnboardingArgs.builder()
* .workspaceId(exampleAnalyticsWorkspace.id())
* .build());
* var exampleAlertRuleScheduled = new AlertRuleScheduled("exampleAlertRuleScheduled", AlertRuleScheduledArgs.builder()
* .name("example")
* .logAnalyticsWorkspaceId(exampleLogAnalyticsWorkspaceOnboarding.workspaceId())
* .displayName("example")
* .severity("High")
* .query("""
* AzureActivity |
* where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
* where ActivityStatus == "Succeeded" |
* make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
* """)
* .build());
* }
* }
* ```
* ```yaml
* resources:
* example:
* type: azure:core:ResourceGroup
* properties:
* name: example-resources
* location: West Europe
* exampleAnalyticsWorkspace:
* type: azure:operationalinsights:AnalyticsWorkspace
* name: example
* properties:
* name: example-workspace
* location: ${example.location}
* resourceGroupName: ${example.name}
* sku: PerGB2018
* exampleLogAnalyticsWorkspaceOnboarding:
* type: azure:sentinel:LogAnalyticsWorkspaceOnboarding
* name: example
* properties:
* workspaceId: ${exampleAnalyticsWorkspace.id}
* exampleAlertRuleScheduled:
* type: azure:sentinel:AlertRuleScheduled
* name: example
* properties:
* name: example
* logAnalyticsWorkspaceId: ${exampleLogAnalyticsWorkspaceOnboarding.workspaceId}
* displayName: example
* severity: High
* query: |
* AzureActivity |
* where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
* where ActivityStatus == "Succeeded" |
* make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
* ```
*
* ## Import
* Sentinel Scheduled Alert Rules can be imported using the `resource id`, e.g.
* ```sh
* $ pulumi import azure:sentinel/alertRuleScheduled:AlertRuleScheduled example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.OperationalInsights/workspaces/workspace1/providers/Microsoft.SecurityInsights/alertRules/rule1
* ```
* @property alertDetailsOverrides An `alert_details_override` block as defined below.
* @property alertRuleTemplateGuid The GUID of the alert rule template which is used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
* @property alertRuleTemplateVersion The version of the alert rule template which is used for this Sentinel Scheduled Alert Rule.
* @property customDetails A map of string key-value pairs of columns to be attached to this Sentinel Scheduled Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
* @property description The description of this Sentinel Scheduled Alert Rule.
* @property displayName The friendly name of this Sentinel Scheduled Alert Rule.
* @property enabled Should the Sentinel Scheduled Alert Rule be enabled? Defaults to `true`.
* @property entityMappings A list of `entity_mapping` blocks as defined below.
* @property eventGrouping A `event_grouping` block as defined below.
* @property incident A `incident` block as defined below.
* @property incidentConfiguration
* @property logAnalyticsWorkspaceId The ID of the Log Analytics Workspace this Sentinel Scheduled Alert Rule belongs to. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
* @property name The name which should be used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
* @property query The query of this Sentinel Scheduled Alert Rule.
* @property queryFrequency The ISO 8601 timespan duration between two consecutive queries. Defaults to `PT5H`.
* @property queryPeriod The ISO 8601 timespan duration, which determine the time period of the data covered by the query. For example, it can query the past 10 minutes of data, or the past 6 hours of data. Defaults to `PT5H`.
* > **NOTE** `query_period` must larger than or equal to `query_frequency`, which ensures there is no gaps in the overall query coverage.
* @property sentinelEntityMappings A list of `sentinel_entity_mapping` blocks as defined below.
* > **NOTE:** `entity_mapping` and `sentinel_entity_mapping` together can't exceed 5.
* @property severity The alert severity of this Sentinel Scheduled Alert Rule. Possible values are `High`, `Medium`, `Low` and `Informational`.
* @property suppressionDuration If `suppression_enabled` is `true`, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to `PT5H`.
* > **NOTE** `suppression_duration` must larger than or equal to `query_frequency`, otherwise the suppression has no actual effect since no query will happen during the suppression duration.
* @property suppressionEnabled Should the Sentinel Scheduled Alert Rulea stop running query after alert is generated? Defaults to `false`.
* @property tactics A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `ImpairProcessControl`, `InhibitResponseFunction`, `Impact`, `InitialAccess`, `LateralMovement`, `Persistence`, `PrivilegeEscalation`, `PreAttack`, `Reconnaissance` and `ResourceDevelopment`.
* @property techniques A list of techniques of attacks by which to classify the rule.
* @property triggerOperator The alert trigger operator, combined with `trigger_threshold`, setting alert threshold of this Sentinel Scheduled Alert Rule. Possible values are `Equal`, `GreaterThan`, `LessThan`, `NotEqual`. Defaults to `GreaterThan`.
* @property triggerThreshold The baseline number of query results generated, combined with `trigger_operator`, setting alert threshold of this Sentinel Scheduled Alert Rule. Defaults to `0`.
*/
public data class AlertRuleScheduledArgs(
public val alertDetailsOverrides: Output>? =
null,
public val alertRuleTemplateGuid: Output? = null,
public val alertRuleTemplateVersion: Output? = null,
public val customDetails: Output>? = null,
public val description: Output? = null,
public val displayName: Output? = null,
public val enabled: Output? = null,
public val entityMappings: Output>? = null,
public val eventGrouping: Output? = null,
public val incident: Output? = null,
@Deprecated(
message = """
The `incident_configuration` block has been superseded by the `incident` block and will be removed
in v4.0 of the AzureRM Provider
""",
)
public val incidentConfiguration: Output? = null,
public val logAnalyticsWorkspaceId: Output? = null,
public val name: Output? = null,
public val query: Output? = null,
public val queryFrequency: Output? = null,
public val queryPeriod: Output? = null,
public val sentinelEntityMappings: Output>? =
null,
public val severity: Output? = null,
public val suppressionDuration: Output? = null,
public val suppressionEnabled: Output? = null,
public val tactics: Output>? = null,
public val techniques: Output>? = null,
public val triggerOperator: Output? = null,
public val triggerThreshold: Output? = null,
) : ConvertibleToJava {
override fun toJava(): com.pulumi.azure.sentinel.AlertRuleScheduledArgs =
com.pulumi.azure.sentinel.AlertRuleScheduledArgs.builder()
.alertDetailsOverrides(
alertDetailsOverrides?.applyValue({ args0 ->
args0.map({ args0 ->
args0.let({ args0 -> args0.toJava() })
})
}),
)
.alertRuleTemplateGuid(alertRuleTemplateGuid?.applyValue({ args0 -> args0 }))
.alertRuleTemplateVersion(alertRuleTemplateVersion?.applyValue({ args0 -> args0 }))
.customDetails(
customDetails?.applyValue({ args0 ->
args0.map({ args0 ->
args0.key.to(args0.value)
}).toMap()
}),
)
.description(description?.applyValue({ args0 -> args0 }))
.displayName(displayName?.applyValue({ args0 -> args0 }))
.enabled(enabled?.applyValue({ args0 -> args0 }))
.entityMappings(
entityMappings?.applyValue({ args0 ->
args0.map({ args0 ->
args0.let({ args0 ->
args0.toJava()
})
})
}),
)
.eventGrouping(eventGrouping?.applyValue({ args0 -> args0.let({ args0 -> args0.toJava() }) }))
.incident(incident?.applyValue({ args0 -> args0.let({ args0 -> args0.toJava() }) }))
.incidentConfiguration(
incidentConfiguration?.applyValue({ args0 ->
args0.let({ args0 ->
args0.toJava()
})
}),
)
.logAnalyticsWorkspaceId(logAnalyticsWorkspaceId?.applyValue({ args0 -> args0 }))
.name(name?.applyValue({ args0 -> args0 }))
.query(query?.applyValue({ args0 -> args0 }))
.queryFrequency(queryFrequency?.applyValue({ args0 -> args0 }))
.queryPeriod(queryPeriod?.applyValue({ args0 -> args0 }))
.sentinelEntityMappings(
sentinelEntityMappings?.applyValue({ args0 ->
args0.map({ args0 ->
args0.let({ args0 -> args0.toJava() })
})
}),
)
.severity(severity?.applyValue({ args0 -> args0 }))
.suppressionDuration(suppressionDuration?.applyValue({ args0 -> args0 }))
.suppressionEnabled(suppressionEnabled?.applyValue({ args0 -> args0 }))
.tactics(tactics?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.techniques(techniques?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.triggerOperator(triggerOperator?.applyValue({ args0 -> args0 }))
.triggerThreshold(triggerThreshold?.applyValue({ args0 -> args0 })).build()
}
/**
* Builder for [AlertRuleScheduledArgs].
*/
@PulumiTagMarker
public class AlertRuleScheduledArgsBuilder internal constructor() {
private var alertDetailsOverrides: Output>? =
null
private var alertRuleTemplateGuid: Output? = null
private var alertRuleTemplateVersion: Output? = null
private var customDetails: Output>? = null
private var description: Output? = null
private var displayName: Output? = null
private var enabled: Output? = null
private var entityMappings: Output>? = null
private var eventGrouping: Output? = null
private var incident: Output? = null
private var incidentConfiguration: Output? = null
private var logAnalyticsWorkspaceId: Output? = null
private var name: Output? = null
private var query: Output? = null
private var queryFrequency: Output? = null
private var queryPeriod: Output? = null
private var sentinelEntityMappings: Output>? =
null
private var severity: Output? = null
private var suppressionDuration: Output? = null
private var suppressionEnabled: Output? = null
private var tactics: Output>? = null
private var techniques: Output>? = null
private var triggerOperator: Output? = null
private var triggerThreshold: Output? = null
/**
* @param value An `alert_details_override` block as defined below.
*/
@JvmName("ochtqmkuwesgovic")
public suspend fun alertDetailsOverrides(`value`: Output>) {
this.alertDetailsOverrides = value
}
@JvmName("truavjogyimajdmq")
public suspend fun alertDetailsOverrides(vararg values: Output) {
this.alertDetailsOverrides = Output.all(values.asList())
}
/**
* @param values An `alert_details_override` block as defined below.
*/
@JvmName("lhxpmopnyfbslhcj")
public suspend fun alertDetailsOverrides(values: List>) {
this.alertDetailsOverrides = Output.all(values)
}
/**
* @param value The GUID of the alert rule template which is used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
*/
@JvmName("psadqokkxoiblkqh")
public suspend fun alertRuleTemplateGuid(`value`: Output) {
this.alertRuleTemplateGuid = value
}
/**
* @param value The version of the alert rule template which is used for this Sentinel Scheduled Alert Rule.
*/
@JvmName("eeeebpeyfcvvysqp")
public suspend fun alertRuleTemplateVersion(`value`: Output) {
this.alertRuleTemplateVersion = value
}
/**
* @param value A map of string key-value pairs of columns to be attached to this Sentinel Scheduled Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
*/
@JvmName("tajnxkyydmnqljyx")
public suspend fun customDetails(`value`: Output>) {
this.customDetails = value
}
/**
* @param value The description of this Sentinel Scheduled Alert Rule.
*/
@JvmName("wafhyckmdyxpmoxh")
public suspend fun description(`value`: Output) {
this.description = value
}
/**
* @param value The friendly name of this Sentinel Scheduled Alert Rule.
*/
@JvmName("glababgcxttscuju")
public suspend fun displayName(`value`: Output) {
this.displayName = value
}
/**
* @param value Should the Sentinel Scheduled Alert Rule be enabled? Defaults to `true`.
*/
@JvmName("fqxeqidlfccqixwr")
public suspend fun enabled(`value`: Output) {
this.enabled = value
}
/**
* @param value A list of `entity_mapping` blocks as defined below.
*/
@JvmName("qrdqyqfwkmegbvwm")
public suspend fun entityMappings(`value`: Output>) {
this.entityMappings = value
}
@JvmName("kjyexjekrotqqlkn")
public suspend fun entityMappings(vararg values: Output) {
this.entityMappings = Output.all(values.asList())
}
/**
* @param values A list of `entity_mapping` blocks as defined below.
*/
@JvmName("osalpncpiljpclal")
public suspend fun entityMappings(values: List>) {
this.entityMappings = Output.all(values)
}
/**
* @param value A `event_grouping` block as defined below.
*/
@JvmName("bupgokmeehjamesb")
public suspend fun eventGrouping(`value`: Output) {
this.eventGrouping = value
}
/**
* @param value A `incident` block as defined below.
*/
@JvmName("tfbetdawpfhnvofh")
public suspend fun incident(`value`: Output) {
this.incident = value
}
/**
* @param value
*/
@Deprecated(
message = """
The `incident_configuration` block has been superseded by the `incident` block and will be removed
in v4.0 of the AzureRM Provider
""",
)
@JvmName("qobrfansufxnfxxq")
public suspend fun incidentConfiguration(`value`: Output) {
this.incidentConfiguration = value
}
/**
* @param value The ID of the Log Analytics Workspace this Sentinel Scheduled Alert Rule belongs to. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
*/
@JvmName("mtxwwqsdxldqgejn")
public suspend fun logAnalyticsWorkspaceId(`value`: Output) {
this.logAnalyticsWorkspaceId = value
}
/**
* @param value The name which should be used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
*/
@JvmName("tqrcealvaohcnitd")
public suspend fun name(`value`: Output) {
this.name = value
}
/**
* @param value The query of this Sentinel Scheduled Alert Rule.
*/
@JvmName("fpdljlhkuhyjnbkr")
public suspend fun query(`value`: Output) {
this.query = value
}
/**
* @param value The ISO 8601 timespan duration between two consecutive queries. Defaults to `PT5H`.
*/
@JvmName("pkkpcwbcikwwpxas")
public suspend fun queryFrequency(`value`: Output) {
this.queryFrequency = value
}
/**
* @param value The ISO 8601 timespan duration, which determine the time period of the data covered by the query. For example, it can query the past 10 minutes of data, or the past 6 hours of data. Defaults to `PT5H`.
* > **NOTE** `query_period` must larger than or equal to `query_frequency`, which ensures there is no gaps in the overall query coverage.
*/
@JvmName("xqlpeutjkxarsnwa")
public suspend fun queryPeriod(`value`: Output) {
this.queryPeriod = value
}
/**
* @param value A list of `sentinel_entity_mapping` blocks as defined below.
* > **NOTE:** `entity_mapping` and `sentinel_entity_mapping` together can't exceed 5.
*/
@JvmName("geisfjveolpdtgpy")
public suspend fun sentinelEntityMappings(`value`: Output>) {
this.sentinelEntityMappings = value
}
@JvmName("mbhiycccxtbhjcil")
public suspend fun sentinelEntityMappings(vararg values: Output) {
this.sentinelEntityMappings = Output.all(values.asList())
}
/**
* @param values A list of `sentinel_entity_mapping` blocks as defined below.
* > **NOTE:** `entity_mapping` and `sentinel_entity_mapping` together can't exceed 5.
*/
@JvmName("dbwmcbiyxubapuwn")
public suspend fun sentinelEntityMappings(values: List>) {
this.sentinelEntityMappings = Output.all(values)
}
/**
* @param value The alert severity of this Sentinel Scheduled Alert Rule. Possible values are `High`, `Medium`, `Low` and `Informational`.
*/
@JvmName("jncehmithtyqaggw")
public suspend fun severity(`value`: Output) {
this.severity = value
}
/**
* @param value If `suppression_enabled` is `true`, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to `PT5H`.
* > **NOTE** `suppression_duration` must larger than or equal to `query_frequency`, otherwise the suppression has no actual effect since no query will happen during the suppression duration.
*/
@JvmName("wevftktosyknecbo")
public suspend fun suppressionDuration(`value`: Output) {
this.suppressionDuration = value
}
/**
* @param value Should the Sentinel Scheduled Alert Rulea stop running query after alert is generated? Defaults to `false`.
*/
@JvmName("oysaafmbcwdxqdln")
public suspend fun suppressionEnabled(`value`: Output) {
this.suppressionEnabled = value
}
/**
* @param value A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `ImpairProcessControl`, `InhibitResponseFunction`, `Impact`, `InitialAccess`, `LateralMovement`, `Persistence`, `PrivilegeEscalation`, `PreAttack`, `Reconnaissance` and `ResourceDevelopment`.
*/
@JvmName("scbmnqdhhwykoknl")
public suspend fun tactics(`value`: Output>) {
this.tactics = value
}
@JvmName("decdmrrmrdeltxou")
public suspend fun tactics(vararg values: Output) {
this.tactics = Output.all(values.asList())
}
/**
* @param values A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `ImpairProcessControl`, `InhibitResponseFunction`, `Impact`, `InitialAccess`, `LateralMovement`, `Persistence`, `PrivilegeEscalation`, `PreAttack`, `Reconnaissance` and `ResourceDevelopment`.
*/
@JvmName("mssedntkrvnaincx")
public suspend fun tactics(values: List>) {
this.tactics = Output.all(values)
}
/**
* @param value A list of techniques of attacks by which to classify the rule.
*/
@JvmName("twreaoiunlymmrkh")
public suspend fun techniques(`value`: Output>) {
this.techniques = value
}
@JvmName("ilknarfwxkvqykgt")
public suspend fun techniques(vararg values: Output) {
this.techniques = Output.all(values.asList())
}
/**
* @param values A list of techniques of attacks by which to classify the rule.
*/
@JvmName("twlfaudsadhsxekp")
public suspend fun techniques(values: List>) {
this.techniques = Output.all(values)
}
/**
* @param value The alert trigger operator, combined with `trigger_threshold`, setting alert threshold of this Sentinel Scheduled Alert Rule. Possible values are `Equal`, `GreaterThan`, `LessThan`, `NotEqual`. Defaults to `GreaterThan`.
*/
@JvmName("awmtohbeesghivge")
public suspend fun triggerOperator(`value`: Output) {
this.triggerOperator = value
}
/**
* @param value The baseline number of query results generated, combined with `trigger_operator`, setting alert threshold of this Sentinel Scheduled Alert Rule. Defaults to `0`.
*/
@JvmName("hbjfglriadjvrtfy")
public suspend fun triggerThreshold(`value`: Output) {
this.triggerThreshold = value
}
/**
* @param value An `alert_details_override` block as defined below.
*/
@JvmName("vafnvllebcgceswj")
public suspend fun alertDetailsOverrides(`value`: List?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.alertDetailsOverrides = mapped
}
/**
* @param argument An `alert_details_override` block as defined below.
*/
@JvmName("cvkgqqqwgayaseig")
public suspend fun alertDetailsOverrides(argument: List Unit>) {
val toBeMapped = argument.toList().map {
AlertRuleScheduledAlertDetailsOverrideArgsBuilder().applySuspend { it() }.build()
}
val mapped = of(toBeMapped)
this.alertDetailsOverrides = mapped
}
/**
* @param argument An `alert_details_override` block as defined below.
*/
@JvmName("fkypcruxjivvhxab")
public suspend fun alertDetailsOverrides(vararg argument: suspend AlertRuleScheduledAlertDetailsOverrideArgsBuilder.() -> Unit) {
val toBeMapped = argument.toList().map {
AlertRuleScheduledAlertDetailsOverrideArgsBuilder().applySuspend { it() }.build()
}
val mapped = of(toBeMapped)
this.alertDetailsOverrides = mapped
}
/**
* @param argument An `alert_details_override` block as defined below.
*/
@JvmName("vfglwsnjxrjhgtoc")
public suspend fun alertDetailsOverrides(argument: suspend AlertRuleScheduledAlertDetailsOverrideArgsBuilder.() -> Unit) {
val toBeMapped = listOf(
AlertRuleScheduledAlertDetailsOverrideArgsBuilder().applySuspend {
argument()
}.build(),
)
val mapped = of(toBeMapped)
this.alertDetailsOverrides = mapped
}
/**
* @param values An `alert_details_override` block as defined below.
*/
@JvmName("sqtkuthbwtckjgpl")
public suspend fun alertDetailsOverrides(vararg values: AlertRuleScheduledAlertDetailsOverrideArgs) {
val toBeMapped = values.toList()
val mapped = toBeMapped.let({ args0 -> of(args0) })
this.alertDetailsOverrides = mapped
}
/**
* @param value The GUID of the alert rule template which is used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
*/
@JvmName("exqfnsosnekojgah")
public suspend fun alertRuleTemplateGuid(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.alertRuleTemplateGuid = mapped
}
/**
* @param value The version of the alert rule template which is used for this Sentinel Scheduled Alert Rule.
*/
@JvmName("wwvmoajgtynnlnpl")
public suspend fun alertRuleTemplateVersion(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.alertRuleTemplateVersion = mapped
}
/**
* @param value A map of string key-value pairs of columns to be attached to this Sentinel Scheduled Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
*/
@JvmName("oqqsrudyooxmrvqp")
public suspend fun customDetails(`value`: Map?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.customDetails = mapped
}
/**
* @param values A map of string key-value pairs of columns to be attached to this Sentinel Scheduled Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
*/
@JvmName("hboivytserilqxlg")
public fun customDetails(vararg values: Pair) {
val toBeMapped = values.toMap()
val mapped = toBeMapped.let({ args0 -> of(args0) })
this.customDetails = mapped
}
/**
* @param value The description of this Sentinel Scheduled Alert Rule.
*/
@JvmName("slarbphibadhpxab")
public suspend fun description(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.description = mapped
}
/**
* @param value The friendly name of this Sentinel Scheduled Alert Rule.
*/
@JvmName("biupmoomvnnslrwt")
public suspend fun displayName(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.displayName = mapped
}
/**
* @param value Should the Sentinel Scheduled Alert Rule be enabled? Defaults to `true`.
*/
@JvmName("ikoycbkugvwrrdbj")
public suspend fun enabled(`value`: Boolean?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.enabled = mapped
}
/**
* @param value A list of `entity_mapping` blocks as defined below.
*/
@JvmName("wwgrqxnmpsalpway")
public suspend fun entityMappings(`value`: List?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.entityMappings = mapped
}
/**
* @param argument A list of `entity_mapping` blocks as defined below.
*/
@JvmName("vvtlkfiglhyibwfj")
public suspend fun entityMappings(argument: List Unit>) {
val toBeMapped = argument.toList().map {
AlertRuleScheduledEntityMappingArgsBuilder().applySuspend { it() }.build()
}
val mapped = of(toBeMapped)
this.entityMappings = mapped
}
/**
* @param argument A list of `entity_mapping` blocks as defined below.
*/
@JvmName("xnviblpolutyhrfj")
public suspend fun entityMappings(vararg argument: suspend AlertRuleScheduledEntityMappingArgsBuilder.() -> Unit) {
val toBeMapped = argument.toList().map {
AlertRuleScheduledEntityMappingArgsBuilder().applySuspend { it() }.build()
}
val mapped = of(toBeMapped)
this.entityMappings = mapped
}
/**
* @param argument A list of `entity_mapping` blocks as defined below.
*/
@JvmName("wjlrmnclkqgeeapm")
public suspend fun entityMappings(argument: suspend AlertRuleScheduledEntityMappingArgsBuilder.() -> Unit) {
val toBeMapped = listOf(
AlertRuleScheduledEntityMappingArgsBuilder().applySuspend {
argument()
}.build(),
)
val mapped = of(toBeMapped)
this.entityMappings = mapped
}
/**
* @param values A list of `entity_mapping` blocks as defined below.
*/
@JvmName("isrojudeqqdubnet")
public suspend fun entityMappings(vararg values: AlertRuleScheduledEntityMappingArgs) {
val toBeMapped = values.toList()
val mapped = toBeMapped.let({ args0 -> of(args0) })
this.entityMappings = mapped
}
/**
* @param value A `event_grouping` block as defined below.
*/
@JvmName("xswtqjmygdpbfrlo")
public suspend fun eventGrouping(`value`: AlertRuleScheduledEventGroupingArgs?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.eventGrouping = mapped
}
/**
* @param argument A `event_grouping` block as defined below.
*/
@JvmName("glyflkevckyuxhxv")
public suspend fun eventGrouping(argument: suspend AlertRuleScheduledEventGroupingArgsBuilder.() -> Unit) {
val toBeMapped = AlertRuleScheduledEventGroupingArgsBuilder().applySuspend { argument() }.build()
val mapped = of(toBeMapped)
this.eventGrouping = mapped
}
/**
* @param value A `incident` block as defined below.
*/
@JvmName("mfpbwkryjtgvxjig")
public suspend fun incident(`value`: AlertRuleScheduledIncidentArgs?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.incident = mapped
}
/**
* @param argument A `incident` block as defined below.
*/
@JvmName("yinhvrvsmwiwptns")
public suspend fun incident(argument: suspend AlertRuleScheduledIncidentArgsBuilder.() -> Unit) {
val toBeMapped = AlertRuleScheduledIncidentArgsBuilder().applySuspend { argument() }.build()
val mapped = of(toBeMapped)
this.incident = mapped
}
/**
* @param value
*/
@Deprecated(
message = """
The `incident_configuration` block has been superseded by the `incident` block and will be removed
in v4.0 of the AzureRM Provider
""",
)
@JvmName("vyttghufenxitrdd")
public suspend fun incidentConfiguration(`value`: AlertRuleScheduledIncidentConfigurationArgs?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.incidentConfiguration = mapped
}
/**
* @param argument
*/
@Deprecated(
message = """
The `incident_configuration` block has been superseded by the `incident` block and will be removed
in v4.0 of the AzureRM Provider
""",
)
@JvmName("guydtmsbixouxgcx")
public suspend fun incidentConfiguration(argument: suspend AlertRuleScheduledIncidentConfigurationArgsBuilder.() -> Unit) {
val toBeMapped = AlertRuleScheduledIncidentConfigurationArgsBuilder().applySuspend {
argument()
}.build()
val mapped = of(toBeMapped)
this.incidentConfiguration = mapped
}
/**
* @param value The ID of the Log Analytics Workspace this Sentinel Scheduled Alert Rule belongs to. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
*/
@JvmName("vonqgmaayffbwrsi")
public suspend fun logAnalyticsWorkspaceId(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.logAnalyticsWorkspaceId = mapped
}
/**
* @param value The name which should be used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
*/
@JvmName("phdvrolmbfghidda")
public suspend fun name(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.name = mapped
}
/**
* @param value The query of this Sentinel Scheduled Alert Rule.
*/
@JvmName("ooeosjbgqpsdmqcr")
public suspend fun query(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.query = mapped
}
/**
* @param value The ISO 8601 timespan duration between two consecutive queries. Defaults to `PT5H`.
*/
@JvmName("vuhbtnieoammgalr")
public suspend fun queryFrequency(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.queryFrequency = mapped
}
/**
* @param value The ISO 8601 timespan duration, which determine the time period of the data covered by the query. For example, it can query the past 10 minutes of data, or the past 6 hours of data. Defaults to `PT5H`.
* > **NOTE** `query_period` must larger than or equal to `query_frequency`, which ensures there is no gaps in the overall query coverage.
*/
@JvmName("cthaujofqtdyrnma")
public suspend fun queryPeriod(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.queryPeriod = mapped
}
/**
* @param value A list of `sentinel_entity_mapping` blocks as defined below.
* > **NOTE:** `entity_mapping` and `sentinel_entity_mapping` together can't exceed 5.
*/
@JvmName("yekobbfsrhclewje")
public suspend fun sentinelEntityMappings(`value`: List?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.sentinelEntityMappings = mapped
}
/**
* @param argument A list of `sentinel_entity_mapping` blocks as defined below.
* > **NOTE:** `entity_mapping` and `sentinel_entity_mapping` together can't exceed 5.
*/
@JvmName("qluugymwiasrbmoy")
public suspend fun sentinelEntityMappings(argument: List Unit>) {
val toBeMapped = argument.toList().map {
AlertRuleScheduledSentinelEntityMappingArgsBuilder().applySuspend { it() }.build()
}
val mapped = of(toBeMapped)
this.sentinelEntityMappings = mapped
}
/**
* @param argument A list of `sentinel_entity_mapping` blocks as defined below.
* > **NOTE:** `entity_mapping` and `sentinel_entity_mapping` together can't exceed 5.
*/
@JvmName("pscqrhxldrgkrmba")
public suspend fun sentinelEntityMappings(vararg argument: suspend AlertRuleScheduledSentinelEntityMappingArgsBuilder.() -> Unit) {
val toBeMapped = argument.toList().map {
AlertRuleScheduledSentinelEntityMappingArgsBuilder().applySuspend { it() }.build()
}
val mapped = of(toBeMapped)
this.sentinelEntityMappings = mapped
}
/**
* @param argument A list of `sentinel_entity_mapping` blocks as defined below.
* > **NOTE:** `entity_mapping` and `sentinel_entity_mapping` together can't exceed 5.
*/
@JvmName("cbdbjodnpykqkxnl")
public suspend fun sentinelEntityMappings(argument: suspend AlertRuleScheduledSentinelEntityMappingArgsBuilder.() -> Unit) {
val toBeMapped = listOf(
AlertRuleScheduledSentinelEntityMappingArgsBuilder().applySuspend {
argument()
}.build(),
)
val mapped = of(toBeMapped)
this.sentinelEntityMappings = mapped
}
/**
* @param values A list of `sentinel_entity_mapping` blocks as defined below.
* > **NOTE:** `entity_mapping` and `sentinel_entity_mapping` together can't exceed 5.
*/
@JvmName("cadqesixjtlgxiqh")
public suspend fun sentinelEntityMappings(vararg values: AlertRuleScheduledSentinelEntityMappingArgs) {
val toBeMapped = values.toList()
val mapped = toBeMapped.let({ args0 -> of(args0) })
this.sentinelEntityMappings = mapped
}
/**
* @param value The alert severity of this Sentinel Scheduled Alert Rule. Possible values are `High`, `Medium`, `Low` and `Informational`.
*/
@JvmName("woychenjdjelvtip")
public suspend fun severity(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.severity = mapped
}
/**
* @param value If `suppression_enabled` is `true`, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to `PT5H`.
* > **NOTE** `suppression_duration` must larger than or equal to `query_frequency`, otherwise the suppression has no actual effect since no query will happen during the suppression duration.
*/
@JvmName("ymerowoijqqqlwni")
public suspend fun suppressionDuration(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.suppressionDuration = mapped
}
/**
* @param value Should the Sentinel Scheduled Alert Rulea stop running query after alert is generated? Defaults to `false`.
*/
@JvmName("nybswatyruusvjgv")
public suspend fun suppressionEnabled(`value`: Boolean?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.suppressionEnabled = mapped
}
/**
* @param value A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `ImpairProcessControl`, `InhibitResponseFunction`, `Impact`, `InitialAccess`, `LateralMovement`, `Persistence`, `PrivilegeEscalation`, `PreAttack`, `Reconnaissance` and `ResourceDevelopment`.
*/
@JvmName("jfiwvcsywqawipbb")
public suspend fun tactics(`value`: List?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.tactics = mapped
}
/**
* @param values A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `ImpairProcessControl`, `InhibitResponseFunction`, `Impact`, `InitialAccess`, `LateralMovement`, `Persistence`, `PrivilegeEscalation`, `PreAttack`, `Reconnaissance` and `ResourceDevelopment`.
*/
@JvmName("uhsdaldqwlswosis")
public suspend fun tactics(vararg values: String) {
val toBeMapped = values.toList()
val mapped = toBeMapped.let({ args0 -> of(args0) })
this.tactics = mapped
}
/**
* @param value A list of techniques of attacks by which to classify the rule.
*/
@JvmName("ybqbipnjlwmmnsit")
public suspend fun techniques(`value`: List?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.techniques = mapped
}
/**
* @param values A list of techniques of attacks by which to classify the rule.
*/
@JvmName("psvrbmdrrmpuyfgn")
public suspend fun techniques(vararg values: String) {
val toBeMapped = values.toList()
val mapped = toBeMapped.let({ args0 -> of(args0) })
this.techniques = mapped
}
/**
* @param value The alert trigger operator, combined with `trigger_threshold`, setting alert threshold of this Sentinel Scheduled Alert Rule. Possible values are `Equal`, `GreaterThan`, `LessThan`, `NotEqual`. Defaults to `GreaterThan`.
*/
@JvmName("fhojvsyslgbyivuc")
public suspend fun triggerOperator(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.triggerOperator = mapped
}
/**
* @param value The baseline number of query results generated, combined with `trigger_operator`, setting alert threshold of this Sentinel Scheduled Alert Rule. Defaults to `0`.
*/
@JvmName("ksfrpdmxpojvqrhy")
public suspend fun triggerThreshold(`value`: Int?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.triggerThreshold = mapped
}
internal fun build(): AlertRuleScheduledArgs = AlertRuleScheduledArgs(
alertDetailsOverrides = alertDetailsOverrides,
alertRuleTemplateGuid = alertRuleTemplateGuid,
alertRuleTemplateVersion = alertRuleTemplateVersion,
customDetails = customDetails,
description = description,
displayName = displayName,
enabled = enabled,
entityMappings = entityMappings,
eventGrouping = eventGrouping,
incident = incident,
incidentConfiguration = incidentConfiguration,
logAnalyticsWorkspaceId = logAnalyticsWorkspaceId,
name = name,
query = query,
queryFrequency = queryFrequency,
queryPeriod = queryPeriod,
sentinelEntityMappings = sentinelEntityMappings,
severity = severity,
suppressionDuration = suppressionDuration,
suppressionEnabled = suppressionEnabled,
tactics = tactics,
techniques = techniques,
triggerOperator = triggerOperator,
triggerThreshold = triggerThreshold,
)
}
