AlertRuleNrt

class AlertRuleNrt : KotlinCustomResource

Manages a Sentinel NRT Alert Rule.

Example Usage

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.operationalinsights.AnalyticsWorkspace;
import com.pulumi.azure.operationalinsights.AnalyticsWorkspaceArgs;
import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboarding;
import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboardingArgs;
import com.pulumi.azure.sentinel.AlertRuleNrt;
import com.pulumi.azure.sentinel.AlertRuleNrtArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var exampleResourceGroup = new ResourceGroup("exampleResourceGroup", ResourceGroupArgs.builder()
.location("West Europe")
.build());
var exampleAnalyticsWorkspace = new AnalyticsWorkspace("exampleAnalyticsWorkspace", AnalyticsWorkspaceArgs.builder()
.location(exampleResourceGroup.location())
.resourceGroupName(exampleResourceGroup.name())
.sku("pergb2018")
.build());
var exampleLogAnalyticsWorkspaceOnboarding = new LogAnalyticsWorkspaceOnboarding("exampleLogAnalyticsWorkspaceOnboarding", LogAnalyticsWorkspaceOnboardingArgs.builder()
.workspaceId(exampleAnalyticsWorkspace.id())
.build());
var exampleAlertRuleNrt = new AlertRuleNrt("exampleAlertRuleNrt", AlertRuleNrtArgs.builder()
.logAnalyticsWorkspaceId(exampleLogAnalyticsWorkspaceOnboarding.workspaceId())
.displayName("example")
.severity("High")
.query("""
AzureActivity |
where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
where ActivityStatus == "Succeeded" |
make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
""")
.build());
}
}

Import

Sentinel NRT Alert Rules can be imported using the resource id, e.g.

$ pulumi import azure:sentinel/alertRuleNrt:AlertRuleNrt example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.OperationalInsights/workspaces/workspace1/providers/Microsoft.SecurityInsights/alertRules/rule1

Properties

Link copied to clipboard

An alert_details_override block as defined below.

Link copied to clipboard

The GUID of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.

Link copied to clipboard

The version of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.

Link copied to clipboard
val customDetails: Output<Map<String, String>>?

A map of string key-value pairs of columns to be attached to this Sentinel NRT Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.

Link copied to clipboard
val description: Output<String>?

The description of this Sentinel NRT Alert Rule.

Link copied to clipboard
val displayName: Output<String>

The friendly name of this Sentinel NRT Alert Rule.

Link copied to clipboard
val enabled: Output<Boolean>?

Should the Sentinel NRT Alert Rule be enabled? Defaults to true.

Link copied to clipboard

A list of entity_mapping blocks as defined below.

Link copied to clipboard

A event_grouping block as defined below.

Link copied to clipboard
val id: Output<String>
Link copied to clipboard

A incident block as defined below.

Link copied to clipboard

The ID of the Log Analytics Workspace this Sentinel NRT Alert Rule belongs to. Changing this forces a new Sentinel NRT Alert Rule to be created.

Link copied to clipboard
val name: Output<String>

The name which should be used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.

Link copied to clipboard
val pulumiChildResources: Set<KotlinResource>
Link copied to clipboard
Link copied to clipboard
Link copied to clipboard
val query: Output<String>

The query of this Sentinel NRT Alert Rule.

Link copied to clipboard

A list of sentinel_entity_mapping blocks as defined below.

Link copied to clipboard
val severity: Output<String>

The alert severity of this Sentinel NRT Alert Rule. Possible values are High, Medium, Low and Informational.

Link copied to clipboard

If suppression_enabled is true, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to PT5H.

Link copied to clipboard

Should the Sentinel NRT Alert Rulea stop running query after alert is generated? Defaults to false.

Link copied to clipboard
val tactics: Output<List<String>>?

A list of categories of attacks by which to classify the rule. Possible values are Collection, CommandAndControl, CredentialAccess, DefenseEvasion, Discovery, Execution, Exfiltration, Impact, InitialAccess, LateralMovement, Persistence, PrivilegeEscalation and PreAttack.

Link copied to clipboard
val techniques: Output<List<String>>?

A list of techniques of attacks by which to classify the rule.

Link copied to clipboard
val urn: Output<String>