AnomalySecurityMLAnalyticsSettings

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;
return await Deployment.RunAsync(() =>
{
    var anomalySecurityMLAnalyticsSettings = new AzureNative.SecurityInsights.AnomalySecurityMLAnalyticsSettings("anomalySecurityMLAnalyticsSettings", new()
    {
        AnomalySettingsVersion = 0,
        AnomalyVersion = "1.0.5",
        CustomizableObservations = new Dictionary<string, object?>
        {
            ["multiSelectObservations"] = null,
            ["prioritizeExcludeObservations"] = null,
            ["singleSelectObservations"] = new[]
            {
                new Dictionary<string, object?>
                {
                    ["description"] = "Select device vendor of network connection logs from CommonSecurityLog",
                    ["name"] = "Device vendor",
                    ["rerun"] = "RerunAlways",
                    ["sequenceNumber"] = 1,
                    ["supportedValues"] = new[]
                    {
                        "Palo Alto Networks",
                        "Fortinet",
                        "Check Point",
                    },
                    ["supportedValuesKql"] = null,
                    ["value"] = new[]
                    {
                        "Palo Alto Networks",
                    },
                    ["valuesKql"] = null,
                },
            },
            ["singleValueObservations"] = null,
            ["thresholdObservations"] = new[]
            {
                new Dictionary<string, object?>
                {
                    ["description"] = "Suppress anomalies when daily data transfered (in MB) per hour is less than the chosen value",
                    ["maximum"] = "100",
                    ["minimum"] = "1",
                    ["name"] = "Daily data transfer threshold in MB",
                    ["rerun"] = "RerunAlways",
                    ["sequenceNumber"] = 1,
                    ["value"] = "25",
                },
                new Dictionary<string, object?>
                {
                    ["description"] = "Triggers anomalies when number of standard deviations is greater than the chosen value",
                    ["maximum"] = "10",
                    ["minimum"] = "2",
                    ["name"] = "Number of standard deviations",
                    ["rerun"] = "RerunAlways",
                    ["sequenceNumber"] = 2,
                    ["value"] = "3",
                },
            },
        },
        Description = "When account logs from a source region that has rarely been logged in from during the last 14 days, an anomaly is triggered.",
        DisplayName = "Login from unusual region",
        Enabled = true,
        Frequency = "PT1H",
        IsDefaultSettings = true,
        Kind = "Anomaly",
        RequiredDataConnectors = new[]
        {
            new AzureNative.SecurityInsights.Inputs.SecurityMLAnalyticsSettingsDataSourceArgs
            {
                ConnectorId = "AWS",
                DataTypes = new[]
                {
                    "AWSCloudTrail",
                },
            },
        },
        ResourceGroupName = "myRg",
        SettingsDefinitionId = "f209187f-1d17-4431-94af-c141bf5f23db",
        SettingsResourceName = "f209187f-1d17-4431-94af-c141bf5f23db",
        SettingsStatus = AzureNative.SecurityInsights.SettingsStatus.Production,
        Tactics = new[]
        {
            AzureNative.SecurityInsights.AttackTactic.Exfiltration,
            AzureNative.SecurityInsights.AttackTactic.CommandAndControl,
        },
        Techniques = new[]
        {
            "T1037",
            "T1021",
        },
        WorkspaceName = "myWorkspace",
    });
});

package main
import (
	securityinsights "github.com/pulumi/pulumi-azure-native-sdk/securityinsights/v2"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := securityinsights.NewAnomalySecurityMLAnalyticsSettings(ctx, "anomalySecurityMLAnalyticsSettings", &securityinsights.AnomalySecurityMLAnalyticsSettingsArgs{
			AnomalySettingsVersion: pulumi.Int(0),
			AnomalyVersion:         pulumi.String("1.0.5"),
			CustomizableObservations: pulumi.Any(map[string]interface{}{
				"multiSelectObservations":       nil,
				"prioritizeExcludeObservations": nil,
				"singleSelectObservations": []map[string]interface{}{
					map[string]interface{}{
						"description":    "Select device vendor of network connection logs from CommonSecurityLog",
						"name":           "Device vendor",
						"rerun":          "RerunAlways",
						"sequenceNumber": 1,
						"supportedValues": []string{
							"Palo Alto Networks",
							"Fortinet",
							"Check Point",
						},
						"supportedValuesKql": nil,
						"value": []string{
							"Palo Alto Networks",
						},
						"valuesKql": nil,
					},
				},
				"singleValueObservations": nil,
				"thresholdObservations": []interface{}{
					map[string]interface{}{
						"description":    "Suppress anomalies when daily data transfered (in MB) per hour is less than the chosen value",
						"maximum":        "100",
						"minimum":        "1",
						"name":           "Daily data transfer threshold in MB",
						"rerun":          "RerunAlways",
						"sequenceNumber": 1,
						"value":          "25",
					},
					map[string]interface{}{
						"description":    "Triggers anomalies when number of standard deviations is greater than the chosen value",
						"maximum":        "10",
						"minimum":        "2",
						"name":           "Number of standard deviations",
						"rerun":          "RerunAlways",
						"sequenceNumber": 2,
						"value":          "3",
					},
				},
			}),
			Description:       pulumi.String("When account logs from a source region that has rarely been logged in from during the last 14 days, an anomaly is triggered."),
			DisplayName:       pulumi.String("Login from unusual region"),
			Enabled:           pulumi.Bool(true),
			Frequency:         pulumi.String("PT1H"),
			IsDefaultSettings: pulumi.Bool(true),
			Kind:              pulumi.String("Anomaly"),
			RequiredDataConnectors: securityinsights.SecurityMLAnalyticsSettingsDataSourceArray{
				&securityinsights.SecurityMLAnalyticsSettingsDataSourceArgs{
					ConnectorId: pulumi.String("AWS"),
					DataTypes: pulumi.StringArray{
						pulumi.String("AWSCloudTrail"),
					},
				},
			},
			ResourceGroupName:    pulumi.String("myRg"),
			SettingsDefinitionId: pulumi.String("f209187f-1d17-4431-94af-c141bf5f23db"),
			SettingsResourceName: pulumi.String("f209187f-1d17-4431-94af-c141bf5f23db"),
			SettingsStatus:       pulumi.String(securityinsights.SettingsStatusProduction),
			Tactics: pulumi.StringArray{
				pulumi.String(securityinsights.AttackTacticExfiltration),
				pulumi.String(securityinsights.AttackTacticCommandAndControl),
			},
			Techniques: pulumi.StringArray{
				pulumi.String("T1037"),
				pulumi.String("T1021"),
			},
			WorkspaceName: pulumi.String("myWorkspace"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.securityinsights.AnomalySecurityMLAnalyticsSettings;
import com.pulumi.azurenative.securityinsights.AnomalySecurityMLAnalyticsSettingsArgs;
import com.pulumi.azurenative.securityinsights.inputs.SecurityMLAnalyticsSettingsDataSourceArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var anomalySecurityMLAnalyticsSettings = new AnomalySecurityMLAnalyticsSettings("anomalySecurityMLAnalyticsSettings", AnomalySecurityMLAnalyticsSettingsArgs.builder()
            .anomalySettingsVersion(0)
            .anomalyVersion("1.0.5")
            .customizableObservations(Map.ofEntries(
                Map.entry("multiSelectObservations", null),
                Map.entry("prioritizeExcludeObservations", null),
                Map.entry("singleSelectObservations", Map.ofEntries(
                    Map.entry("description", "Select device vendor of network connection logs from CommonSecurityLog"),
                    Map.entry("name", "Device vendor"),
                    Map.entry("rerun", "RerunAlways"),
                    Map.entry("sequenceNumber", 1),
                    Map.entry("supportedValues",
                        "Palo Alto Networks",
                        "Fortinet",
                        "Check Point"),
                    Map.entry("supportedValuesKql", null),
                    Map.entry("value", "Palo Alto Networks"),
                    Map.entry("valuesKql", null)
                )),
                Map.entry("singleValueObservations", null),
                Map.entry("thresholdObservations",
                    Map.ofEntries(
                        Map.entry("description", "Suppress anomalies when daily data transfered (in MB) per hour is less than the chosen value"),
                        Map.entry("maximum", "100"),
                        Map.entry("minimum", "1"),
                        Map.entry("name", "Daily data transfer threshold in MB"),
                        Map.entry("rerun", "RerunAlways"),
                        Map.entry("sequenceNumber", 1),
                        Map.entry("value", "25")
                    ),
                    Map.ofEntries(
                        Map.entry("description", "Triggers anomalies when number of standard deviations is greater than the chosen value"),
                        Map.entry("maximum", "10"),
                        Map.entry("minimum", "2"),
                        Map.entry("name", "Number of standard deviations"),
                        Map.entry("rerun", "RerunAlways"),
                        Map.entry("sequenceNumber", 2),
                        Map.entry("value", "3")
                    ))
            ))
            .description("When account logs from a source region that has rarely been logged in from during the last 14 days, an anomaly is triggered.")
            .displayName("Login from unusual region")
            .enabled(true)
            .frequency("PT1H")
            .isDefaultSettings(true)
            .kind("Anomaly")
            .requiredDataConnectors(SecurityMLAnalyticsSettingsDataSourceArgs.builder()
                .connectorId("AWS")
                .dataTypes("AWSCloudTrail")
                .build())
            .resourceGroupName("myRg")
            .settingsDefinitionId("f209187f-1d17-4431-94af-c141bf5f23db")
            .settingsResourceName("f209187f-1d17-4431-94af-c141bf5f23db")
            .settingsStatus("Production")
            .tactics(
                "Exfiltration",
                "CommandAndControl")
            .techniques(
                "T1037",
                "T1021")
            .workspaceName("myWorkspace")
            .build());
    }
}

$ pulumi import azure-native:securityinsights:AnomalySecurityMLAnalyticsSettings f209187f-1d17-4431-94af-c141bf5f23db /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/securityMLAnalyticsSettings/{settingsResourceName}