pulumi-azure-kotlin/com.pulumi.azure.sentinel.kotlin.outputs/AlertRuleScheduledIncidentConfigurationGrouping

AlertRuleScheduledIncidentConfigurationGrouping

data class AlertRuleScheduledIncidentConfigurationGrouping(val enabled: Boolean? = null, val entityMatchingMethod: String? = null, val groupByAlertDetails: List<String>? = null, val groupByCustomDetails: List<String>? = null, val groupByEntities: List<String>? = null, val lookbackDuration: String? = null, val reopenClosedIncidents: Boolean? = null)

Constructors

fun AlertRuleScheduledIncidentConfigurationGrouping(enabled: Boolean? = null, entityMatchingMethod: String? = null, groupByAlertDetails: List<String>? = null, groupByCustomDetails: List<String>? = null, groupByEntities: List<String>? = null, lookbackDuration: String? = null, reopenClosedIncidents: Boolean? = null)

Types

Link copied to clipboard
object Companion

Properties

Link copied to clipboard
val enabled: Boolean? = null

Enable grouping incidents created from alerts triggered by this Sentinel Scheduled Alert Rule. Defaults to true.

Link copied to clipboard
val entityMatchingMethod: String? = null

The method used to group incidents. Possible values are AnyAlert, Selected and AllEntities. Defaults to AnyAlert.

Link copied to clipboard
val groupByAlertDetails: List<String>? = null

A list of alert details to group by, only when the entity_matching_method is Selected. Possible values are DisplayName and Severity.

Link copied to clipboard
val groupByCustomDetails: List<String>? = null

A list of custom details keys to group by, only when the entity_matching_method is Selected. Only keys defined in the custom_details may be used.

Link copied to clipboard
val groupByEntities: List<String>? = null

A list of entity types to group by, only when the entity_matching_method is Selected. Possible values are Account, AzureResource, CloudApplication, DNS, File, FileHash, Host, IP, Mailbox, MailCluster, MailMessage, Malware, Process, RegistryKey, RegistryValue, SecurityGroup, SubmissionMail, URL.

Link copied to clipboard
val lookbackDuration: String? = null

Limit the group to alerts created within the lookback duration (in ISO 8601 duration format). Defaults to PT5M.

Link copied to clipboard
val reopenClosedIncidents: Boolean? = null

Whether to re-open closed matching incidents? Defaults to false.