pulumi-azure-kotlin/com.pulumi.azure.sentinel.kotlin/AlertRuleMsSecurityIncident

AlertRuleMsSecurityIncident

class AlertRuleMsSecurityIncident : KotlinCustomResource

Manages a Sentinel MS Security Incident Alert Rule.

Example Usage

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.operationalinsights.AnalyticsWorkspace;
import com.pulumi.azure.operationalinsights.AnalyticsWorkspaceArgs;
import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboarding;
import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboardingArgs;
import com.pulumi.azure.sentinel.AlertRuleMsSecurityIncident;
import com.pulumi.azure.sentinel.AlertRuleMsSecurityIncidentArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var exampleResourceGroup = new ResourceGroup("exampleResourceGroup", ResourceGroupArgs.builder()
            .location("West Europe")
            .build());
        var exampleAnalyticsWorkspace = new AnalyticsWorkspace("exampleAnalyticsWorkspace", AnalyticsWorkspaceArgs.builder()
            .location(exampleResourceGroup.location())
            .resourceGroupName(exampleResourceGroup.name())
            .sku("PerGB2018")
            .build());
        var exampleLogAnalyticsWorkspaceOnboarding = new LogAnalyticsWorkspaceOnboarding("exampleLogAnalyticsWorkspaceOnboarding", LogAnalyticsWorkspaceOnboardingArgs.builder()
            .workspaceId(exampleAnalyticsWorkspace.id())
            .build());
        var exampleAlertRuleMsSecurityIncident = new AlertRuleMsSecurityIncident("exampleAlertRuleMsSecurityIncident", AlertRuleMsSecurityIncidentArgs.builder()
            .logAnalyticsWorkspaceId(exampleLogAnalyticsWorkspaceOnboarding.workspaceId())
            .productFilter("Microsoft Cloud App Security")
            .displayName("example rule")
            .severityFilters("High")
            .build());
    }
}

Import

Sentinel MS Security Incident Alert Rules can be imported using the resource id, e.g.

$ pulumi import azure:sentinel/alertRuleMsSecurityIncident:AlertRuleMsSecurityIncident example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.OperationalInsights/workspaces/workspace1/providers/Microsoft.SecurityInsights/alertRules/rule1

Properties

alertRuleTemplateGuid

val alertRuleTemplateGuid: Output<String>?

The GUID of the alert rule template which is used to create this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel MS Security Incident Alert Rule to be created.

description

val description: Output<String>?

The description of this Sentinel MS Security Incident Alert Rule.

displayName

val displayName: Output<String>

The friendly name of this Sentinel MS Security Incident Alert Rule.

displayNameExcludeFilters

val displayNameExcludeFilters: Output<List<String>>?

Only create incidents when the alert display name doesn't contain text from this list.

displayNameFilters

val displayNameFilters: Output<List<String>>

Only create incidents when the alert display name contain text from this list, leave empty to apply no filter.

enabled

val enabled: Output<Boolean>?

Should this Sentinel MS Security Incident Alert Rule be enabled? Defaults to true.

val id: Output<String>

logAnalyticsWorkspaceId

val logAnalyticsWorkspaceId: Output<String>

The ID of the Log Analytics Workspace this Sentinel MS Security Incident Alert Rule belongs to. Changing this forces a new Sentinel MS Security Incident Alert Rule to be created.

name

val name: Output<String>

The name which should be used for this Sentinel MS Security Incident Alert Rule. Changing this forces a new Sentinel MS Security Incident Alert Rule to be created.

productFilter

val productFilter: Output<String>

The Microsoft Security Service from where the alert will be generated. Possible values are Azure Active Directory Identity Protection, Azure Advanced Threat Protection, Azure Security Center, Azure Security Center for IoT, Microsoft Cloud App Security, Microsoft Defender Advanced Threat Protection and Office 365 Advanced Threat Protection.

pulumiChildResources

val pulumiChildResources: Set<KotlinResource>

pulumiResourceName

val pulumiResourceName: String

pulumiResourceType

val pulumiResourceType: String

severityFilters

val severityFilters: Output<List<String>>

Only create incidents from alerts when alert severity level is contained in this list. Possible values are High, Medium, Low and Informational.

urn

val urn: Output<String>