pulumi-azure-kotlin/com.pulumi.azure.sentinel.kotlin/AlertRuleAnomalyDuplicateArgs

AlertRuleAnomalyDuplicateArgs

data class AlertRuleAnomalyDuplicateArgs(val builtInRuleId: Output<String>? = null, val displayName: Output<String>? = null, val enabled: Output<Boolean>? = null, val logAnalyticsWorkspaceId: Output<String>? = null, val mode: Output<String>? = null, val multiSelectObservations: Output<List<AlertRuleAnomalyDuplicateMultiSelectObservationArgs>>? = null, val prioritizedExcludeObservations: Output<List<AlertRuleAnomalyDuplicatePrioritizedExcludeObservationArgs>>? = null, val singleSelectObservations: Output<List<AlertRuleAnomalyDuplicateSingleSelectObservationArgs>>? = null, val thresholdObservations: Output<List<AlertRuleAnomalyDuplicateThresholdObservationArgs>>? = null) : ConvertibleToJava<AlertRuleAnomalyDuplicateArgs>

Manages a Duplicated Anomaly Alert Rule.

Example Usage

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.operationalinsights.AnalyticsWorkspace;
import com.pulumi.azure.operationalinsights.AnalyticsWorkspaceArgs;
import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboarding;
import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboardingArgs;
import com.pulumi.azure.sentinel.SentinelFunctions;
import com.pulumi.azure.sentinel.inputs.GetAlertRuleAnomalyArgs;
import com.pulumi.azure.sentinel.AlertRuleAnomalyDuplicate;
import com.pulumi.azure.sentinel.AlertRuleAnomalyDuplicateArgs;
import com.pulumi.azure.sentinel.inputs.AlertRuleAnomalyDuplicateThresholdObservationArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var exampleResourceGroup = new ResourceGroup("exampleResourceGroup", ResourceGroupArgs.builder()
            .location("West Europe")
            .build());
        var exampleAnalyticsWorkspace = new AnalyticsWorkspace("exampleAnalyticsWorkspace", AnalyticsWorkspaceArgs.builder()
            .location(exampleResourceGroup.location())
            .resourceGroupName(exampleResourceGroup.name())
            .sku("PerGB2018")
            .build());
        var exampleLogAnalyticsWorkspaceOnboarding = new LogAnalyticsWorkspaceOnboarding("exampleLogAnalyticsWorkspaceOnboarding", LogAnalyticsWorkspaceOnboardingArgs.builder()
            .workspaceId(exampleAnalyticsWorkspace.id())
            .customerManagedKeyEnabled(false)
            .build());
        final var exampleAlertRuleAnomaly = SentinelFunctions.getAlertRuleAnomaly(GetAlertRuleAnomalyArgs.builder()
            .logAnalyticsWorkspaceId(exampleLogAnalyticsWorkspaceOnboarding.workspaceId())
            .displayName("UEBA Anomalous Sign In")
            .build());
        var exampleAlertRuleAnomalyDuplicate = new AlertRuleAnomalyDuplicate("exampleAlertRuleAnomalyDuplicate", AlertRuleAnomalyDuplicateArgs.builder()
            .displayName("example duplicated UEBA Anomalous Sign In")
            .logAnalyticsWorkspaceId(exampleAnalyticsWorkspace.id())
            .builtInRuleId(exampleAlertRuleAnomaly.applyValue(getAlertRuleAnomalyResult -> getAlertRuleAnomalyResult).applyValue(exampleAlertRuleAnomaly -> exampleAlertRuleAnomaly.applyValue(getAlertRuleAnomalyResult -> getAlertRuleAnomalyResult.id())))
            .enabled(true)
            .mode("Flighting")
            .thresholdObservations(AlertRuleAnomalyDuplicateThresholdObservationArgs.builder()
                .name("Anomaly score threshold")
                .value("0.6")
                .build())
            .build());
    }
}

Import

Built In Anomaly Alert Rules can be imported using the resource id, e.g.

$ pulumi import azure:sentinel/alertRuleAnomalyDuplicate:AlertRuleAnomalyDuplicate example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.OperationalInsights/workspaces/workspace1/providers/Microsoft.SecurityInsights/securityMLAnalyticsSettings/setting1