pulumi-azure-kotlin/com.pulumi.azure.sentinel.kotlin/AlertRuleThreatIntelligenceArgs

AlertRuleThreatIntelligenceArgs

data class AlertRuleThreatIntelligenceArgs(val alertRuleTemplateGuid: Output<String>? = null, val enabled: Output<Boolean>? = null, val logAnalyticsWorkspaceId: Output<String>? = null, val name: Output<String>? = null) : ConvertibleToJava<AlertRuleThreatIntelligenceArgs>

Manages a Sentinel Threat Intelligence Alert Rule.

Example Usage

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.operationalinsights.AnalyticsWorkspace;
import com.pulumi.azure.operationalinsights.AnalyticsWorkspaceArgs;
import com.pulumi.azure.operationalinsights.AnalyticsSolution;
import com.pulumi.azure.operationalinsights.AnalyticsSolutionArgs;
import com.pulumi.azure.operationalinsights.inputs.AnalyticsSolutionPlanArgs;
import com.pulumi.azure.sentinel.SentinelFunctions;
import com.pulumi.azure.sentinel.inputs.GetAlertRuleTemplateArgs;
import com.pulumi.azure.sentinel.AlertRuleThreatIntelligence;
import com.pulumi.azure.sentinel.AlertRuleThreatIntelligenceArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var exampleResourceGroup = new ResourceGroup("exampleResourceGroup", ResourceGroupArgs.builder()
            .location("West Europe")
            .build());
        var exampleAnalyticsWorkspace = new AnalyticsWorkspace("exampleAnalyticsWorkspace", AnalyticsWorkspaceArgs.builder()
            .location(exampleResourceGroup.location())
            .resourceGroupName(exampleResourceGroup.name())
            .sku("pergb2018")
            .build());
        var exampleAnalyticsSolution = new AnalyticsSolution("exampleAnalyticsSolution", AnalyticsSolutionArgs.builder()
            .solutionName("SecurityInsights")
            .location(exampleResourceGroup.location())
            .resourceGroupName(exampleResourceGroup.name())
            .workspaceResourceId(exampleAnalyticsWorkspace.id())
            .workspaceName(exampleAnalyticsWorkspace.name())
            .plan(AnalyticsSolutionPlanArgs.builder()
                .publisher("Microsoft")
                .product("OMSGallery/SecurityInsights")
                .build())
            .build());
        final var exampleAlertRuleTemplate = SentinelFunctions.getAlertRuleTemplate(GetAlertRuleTemplateArgs.builder()
            .displayName("(Preview) Microsoft Defender Threat Intelligence Analytics")
            .logAnalyticsWorkspaceId(exampleAnalyticsSolution.workspaceResourceId())
            .build());
        var exampleAlertRuleThreatIntelligence = new AlertRuleThreatIntelligence("exampleAlertRuleThreatIntelligence", AlertRuleThreatIntelligenceArgs.builder()
            .logAnalyticsWorkspaceId(exampleAnalyticsSolution.workspaceResourceId())
            .alertRuleTemplateGuid(exampleAlertRuleTemplate.applyValue(getAlertRuleTemplateResult -> getAlertRuleTemplateResult).applyValue(exampleAlertRuleTemplate -> exampleAlertRuleTemplate.applyValue(getAlertRuleTemplateResult -> getAlertRuleTemplateResult.name())))
            .build());
    }
}
Content copied to clipboard

Import

Sentinel Threat Intelligence Alert Rules can be imported using the resource id, e.g.

$ pulumi import azure:sentinel/alertRuleThreatIntelligence:AlertRuleThreatIntelligence example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.OperationalInsights/workspaces/workspace1/providers/Microsoft.SecurityInsights/alertRules/rule1
Content copied to clipboard

Constructors

Link copied to clipboard
fun AlertRuleThreatIntelligenceArgs(alertRuleTemplateGuid: Output<String>? = null, enabled: Output<Boolean>? = null, logAnalyticsWorkspaceId: Output<String>? = null, name: Output<String>? = null)

Functions

Link copied to clipboard
open override fun toJava(): AlertRuleThreatIntelligenceArgs

Properties

Link copied to clipboard
val alertRuleTemplateGuid: Output<String>? = null

The GUID of the alert rule template which is used for this Sentinel Threat Intelligence Alert Rule. Changing this forces a new Sentinel Threat Intelligence Alert Rule to be created.

Link copied to clipboard
val enabled: Output<Boolean>? = null

Whether the Threat Intelligence Alert rule enabled? Defaults to true.

Link copied to clipboard
val logAnalyticsWorkspaceId: Output<String>? = null

The ID of the Log Analytics Workspace this Sentinel Threat Intelligence Alert Rule belongs to. Changing this forces a new Sentinel Threat Intelligence Alert Rule to be created.

Link copied to clipboard
val name: Output<String>? = null

The name which should be used for this Sentinel Threat Intelligence Alert Rule. Changing this forces a new Sentinel Threat Intelligence Alert Rule to be created.