pulumi-azure-kotlin/com.pulumi.azure.sentinel.kotlin/ThreatIntelligenceIndicator

ThreatIntelligenceIndicator

class ThreatIntelligenceIndicator : KotlinCustomResource

Manages a Sentinel Threat Intelligence Indicator.

Example Usage

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.operationalinsights.AnalyticsWorkspace;
import com.pulumi.azure.operationalinsights.AnalyticsWorkspaceArgs;
import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboarding;
import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboardingArgs;
import com.pulumi.azure.sentinel.ThreatIntelligenceIndicator;
import com.pulumi.azure.sentinel.ThreatIntelligenceIndicatorArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var exampleResourceGroup = new ResourceGroup("exampleResourceGroup", ResourceGroupArgs.builder()
            .location("east us")
            .build());
        var exampleAnalyticsWorkspace = new AnalyticsWorkspace("exampleAnalyticsWorkspace", AnalyticsWorkspaceArgs.builder()
            .location(exampleResourceGroup.location())
            .resourceGroupName(exampleResourceGroup.name())
            .sku("PerGB2018")
            .retentionInDays(30)
            .build());
        var exampleLogAnalyticsWorkspaceOnboarding = new LogAnalyticsWorkspaceOnboarding("exampleLogAnalyticsWorkspaceOnboarding", LogAnalyticsWorkspaceOnboardingArgs.builder()
            .resourceGroupName(exampleResourceGroup.name())
            .workspaceName(exampleAnalyticsWorkspace.name())
            .build());
        var exampleThreatIntelligenceIndicator = new ThreatIntelligenceIndicator("exampleThreatIntelligenceIndicator", ThreatIntelligenceIndicatorArgs.builder()
            .workspaceId(exampleAnalyticsWorkspace.id())
            .patternType("domain-name")
            .pattern("http://example.com")
            .source("Microsoft Sentinel")
            .validateFromUtc("2022-12-14T16:00:00Z")
            .displayName("example-indicator")
            .build(), CustomResourceOptions.builder()
                .dependsOn(azurerm_sentinel_log_analytics_workspace_onboarding.test())
                .build());
    }
}

Import

Sentinel Threat Intelligence Indicators can be imported using the resource id, e.g.

$ pulumi import azure:sentinel/threatIntelligenceIndicator:ThreatIntelligenceIndicator example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/resourcegroup1/providers/Microsoft.OperationalInsights/workspaces/workspace1/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators/indicator1

Properties

confidence

val confidence: Output<Int>?

Confidence levels of the Threat Intelligence Indicator.

createdBy

val createdBy: Output<String>?

The creator of the Threat Intelligence Indicator.

createdOn

val createdOn: Output<String>

The date of this Threat Intelligence Indicator created.

defanged

val defanged: Output<Boolean>

Whether the Threat Intelligence entity is defanged?

description

val description: Output<String>?

The description of the Threat Intelligence Indicator.

displayName

val displayName: Output<String>

The display name of the Threat Intelligence Indicator.

extension

val extension: Output<String>

The extension config of the Threat Intelligence Indicator in JSON format.

externalId

val externalId: Output<String>

The external ID of the Threat Intelligence Indicator.

externalLastUpdatedTimeUtc

val externalLastUpdatedTimeUtc: Output<String>

the External last updated time in UTC.

externalReferences

val externalReferences: Output<List<ThreatIntelligenceIndicatorExternalReference>>?

One or more external_reference blocks as defined below.

granularMarkings

val granularMarkings: Output<List<ThreatIntelligenceIndicatorGranularMarking>>?

One or more granular_marking blocks as defined below.

guid

val guid: Output<String>

The guid of this Sentinel Threat Intelligence Indicator.

val id: Output<String>

indicatorTypes

val indicatorTypes: Output<List<String>>

killChainPhases

val killChainPhases: Output<List<ThreatIntelligenceIndicatorKillChainPhase>>?

One or more kill_chain_phase blocks as defined below.

language

val language: Output<String>?

The language of the Threat Intelligence Indicator.

lastUpdatedTimeUtc

val lastUpdatedTimeUtc: Output<String>

The last updated time of the Threat Intelligence Indicator in UTC.

objectMarkingRefs

val objectMarkingRefs: Output<List<String>>?

Specifies a list of Threat Intelligence marking references.

parsedPatterns

val parsedPatterns: Output<List<ThreatIntelligenceIndicatorParsedPattern>>

A parsed_pattern block as defined below.

pattern

val pattern: Output<String>

The pattern used by the Threat Intelligence Indicator. When pattern_type set to file, pattern must be specified with <HashName>:<Value> format, such as MD5:78ecc5c05cd8b79af480df2f8fba0b9d.