pulumi-azure-kotlin/com.pulumi.azure.sentinel.kotlin/ThreatIntelligenceIndicatorArgs

ThreatIntelligenceIndicatorArgs

data class ThreatIntelligenceIndicatorArgs(val confidence: Output<Int>? = null, val createdBy: Output<String>? = null, val description: Output<String>? = null, val displayName: Output<String>? = null, val extension: Output<String>? = null, val externalReferences: Output<List<ThreatIntelligenceIndicatorExternalReferenceArgs>>? = null, val granularMarkings: Output<List<ThreatIntelligenceIndicatorGranularMarkingArgs>>? = null, val killChainPhases: Output<List<ThreatIntelligenceIndicatorKillChainPhaseArgs>>? = null, val language: Output<String>? = null, val objectMarkingRefs: Output<List<String>>? = null, val pattern: Output<String>? = null, val patternType: Output<String>? = null, val patternVersion: Output<String>? = null, val revoked: Output<Boolean>? = null, val source: Output<String>? = null, val tags: Output<List<String>>? = null, val threatTypes: Output<List<String>>? = null, val validateFromUtc: Output<String>? = null, val validateUntilUtc: Output<String>? = null, val workspaceId: Output<String>? = null) : ConvertibleToJava<ThreatIntelligenceIndicatorArgs>

Manages a Sentinel Threat Intelligence Indicator.

Example Usage

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.operationalinsights.AnalyticsWorkspace;
import com.pulumi.azure.operationalinsights.AnalyticsWorkspaceArgs;
import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboarding;
import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboardingArgs;
import com.pulumi.azure.sentinel.ThreatIntelligenceIndicator;
import com.pulumi.azure.sentinel.ThreatIntelligenceIndicatorArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var exampleResourceGroup = new ResourceGroup("exampleResourceGroup", ResourceGroupArgs.builder()
            .location("east us")
            .build());
        var exampleAnalyticsWorkspace = new AnalyticsWorkspace("exampleAnalyticsWorkspace", AnalyticsWorkspaceArgs.builder()
            .location(exampleResourceGroup.location())
            .resourceGroupName(exampleResourceGroup.name())
            .sku("PerGB2018")
            .retentionInDays(30)
            .build());
        var exampleLogAnalyticsWorkspaceOnboarding = new LogAnalyticsWorkspaceOnboarding("exampleLogAnalyticsWorkspaceOnboarding", LogAnalyticsWorkspaceOnboardingArgs.builder()
            .resourceGroupName(exampleResourceGroup.name())
            .workspaceName(exampleAnalyticsWorkspace.name())
            .build());
        var exampleThreatIntelligenceIndicator = new ThreatIntelligenceIndicator("exampleThreatIntelligenceIndicator", ThreatIntelligenceIndicatorArgs.builder()
            .workspaceId(exampleAnalyticsWorkspace.id())
            .patternType("domain-name")
            .pattern("http://example.com")
            .source("Microsoft Sentinel")
            .validateFromUtc("2022-12-14T16:00:00Z")
            .displayName("example-indicator")
            .build(), CustomResourceOptions.builder()
                .dependsOn(azurerm_sentinel_log_analytics_workspace_onboarding.test())
                .build());
    }
}
Content copied to clipboard

Import

Sentinel Threat Intelligence Indicators can be imported using the resource id, e.g.

$ pulumi import azure:sentinel/threatIntelligenceIndicator:ThreatIntelligenceIndicator example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/resourcegroup1/providers/Microsoft.OperationalInsights/workspaces/workspace1/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators/indicator1
Content copied to clipboard

Constructors

Link copied to clipboard
fun ThreatIntelligenceIndicatorArgs(confidence: Output<Int>? = null, createdBy: Output<String>? = null, description: Output<String>? = null, displayName: Output<String>? = null, extension: Output<String>? = null, externalReferences: Output<List<ThreatIntelligenceIndicatorExternalReferenceArgs>>? = null, granularMarkings: Output<List<ThreatIntelligenceIndicatorGranularMarkingArgs>>? = null, killChainPhases: Output<List<ThreatIntelligenceIndicatorKillChainPhaseArgs>>? = null, language: Output<String>? = null, objectMarkingRefs: Output<List<String>>? = null, pattern: Output<String>? = null, patternType: Output<String>? = null, patternVersion: Output<String>? = null, revoked: Output<Boolean>? = null, source: Output<String>? = null, tags: Output<List<String>>? = null, threatTypes: Output<List<String>>? = null, validateFromUtc: Output<String>? = null, validateUntilUtc: Output<String>? = null, workspaceId: Output<String>? = null)

Functions

Link copied to clipboard
open override fun toJava(): ThreatIntelligenceIndicatorArgs

Properties

Link copied to clipboard
val confidence: Output<Int>? = null

Confidence levels of the Threat Intelligence Indicator.

Link copied to clipboard
val createdBy: Output<String>? = null

The creator of the Threat Intelligence Indicator.

Link copied to clipboard
val description: Output<String>? = null

The description of the Threat Intelligence Indicator.

Link copied to clipboard
val displayName: Output<String>? = null

The display name of the Threat Intelligence Indicator.

Link copied to clipboard
val extension: Output<String>? = null

The extension config of the Threat Intelligence Indicator in JSON format.

Link copied to clipboard
val externalReferences: Output<List<ThreatIntelligenceIndicatorExternalReferenceArgs>>? = null

One or more external_reference blocks as defined below.

Link copied to clipboard
val granularMarkings: Output<List<ThreatIntelligenceIndicatorGranularMarkingArgs>>? = null

One or more granular_marking blocks as defined below.

Link copied to clipboard
val killChainPhases: Output<List<ThreatIntelligenceIndicatorKillChainPhaseArgs>>? = null

One or more kill_chain_phase blocks as defined below.

Link copied to clipboard
val language: Output<String>? = null

The language of the Threat Intelligence Indicator.

Link copied to clipboard
val objectMarkingRefs: Output<List<String>>? = null

Specifies a list of Threat Intelligence marking references.

Link copied to clipboard
val pattern: Output<String>? = null

The pattern used by the Threat Intelligence Indicator. When pattern_type set to file, pattern must be specified with <HashName>:<Value> format, such as MD5:78ecc5c05cd8b79af480df2f8fba0b9d.

Link copied to clipboard
val patternType: Output<String>? = null

The type of pattern used by the Threat Intelligence Indicator. Possible values are domain-name, file, ipv4-addr, ipv6-addr and url.

Link copied to clipboard
val patternVersion: Output<String>? = null

The version of a Threat Intelligence entity.

Link copied to clipboard
val revoked: Output<Boolean>? = null

Whether the Threat Intelligence entity revoked.

Link copied to clipboard
val source: Output<String>? = null

Source of the Threat Intelligence Indicator.

Link copied to clipboard
val tags: Output<List<String>>? = null

Specifies a list of tags of the Threat Intelligence Indicator.

Link copied to clipboard
val threatTypes: Output<List<String>>? = null

Specifies a list of threat types of this Threat Intelligence Indicator.

Link copied to clipboard
val validateFromUtc: Output<String>? = null

The start of validate date in RFC3339.

Link copied to clipboard
val validateUntilUtc: Output<String>? = null

The end of validate date of the Threat Intelligence Indicator in RFC3339 format.

Link copied to clipboard
val workspaceId: Output<String>? = null

The ID of the Log Analytics Workspace. Changing this forces a new Sentinel Threat Intelligence Indicator to be created.