pulumi-azure-kotlin/com.pulumi.azure.sentinel.kotlin/AlertRuleMsSecurityIncidentArgs

AlertRuleMsSecurityIncidentArgs

data class AlertRuleMsSecurityIncidentArgs(val alertRuleTemplateGuid: Output<String>? = null, val description: Output<String>? = null, val displayName: Output<String>? = null, val displayNameExcludeFilters: Output<List<String>>? = null, val displayNameFilters: Output<List<String>>? = null, val enabled: Output<Boolean>? = null, val logAnalyticsWorkspaceId: Output<String>? = null, val name: Output<String>? = null, val productFilter: Output<String>? = null, val severityFilters: Output<List<String>>? = null) : ConvertibleToJava<AlertRuleMsSecurityIncidentArgs>

Manages a Sentinel MS Security Incident Alert Rule.

Example Usage

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.operationalinsights.AnalyticsWorkspace;
import com.pulumi.azure.operationalinsights.AnalyticsWorkspaceArgs;
import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboarding;
import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboardingArgs;
import com.pulumi.azure.sentinel.AlertRuleMsSecurityIncident;
import com.pulumi.azure.sentinel.AlertRuleMsSecurityIncidentArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var example = new ResourceGroup("example", ResourceGroupArgs.builder()
            .name("example-resources")
            .location("West Europe")
            .build());
        var exampleAnalyticsWorkspace = new AnalyticsWorkspace("exampleAnalyticsWorkspace", AnalyticsWorkspaceArgs.builder()
            .name("example-workspace")
            .location(example.location())
            .resourceGroupName(example.name())
            .sku("PerGB2018")
            .build());
        var exampleLogAnalyticsWorkspaceOnboarding = new LogAnalyticsWorkspaceOnboarding("exampleLogAnalyticsWorkspaceOnboarding", LogAnalyticsWorkspaceOnboardingArgs.builder()
            .workspaceId(exampleAnalyticsWorkspace.id())
            .build());
        var exampleAlertRuleMsSecurityIncident = new AlertRuleMsSecurityIncident("exampleAlertRuleMsSecurityIncident", AlertRuleMsSecurityIncidentArgs.builder()
            .name("example-ms-security-incident-alert-rule")
            .logAnalyticsWorkspaceId(exampleLogAnalyticsWorkspaceOnboarding.workspaceId())
            .productFilter("Microsoft Cloud App Security")
            .displayName("example rule")
            .severityFilters("High")
            .build());
    }
}

Import

Sentinel MS Security Incident Alert Rules can be imported using the resource id, e.g.

$ pulumi import azure:sentinel/alertRuleMsSecurityIncident:AlertRuleMsSecurityIncident example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.OperationalInsights/workspaces/workspace1/providers/Microsoft.SecurityInsights/alertRules/rule1

Constructors

AlertRuleMsSecurityIncidentArgs

fun AlertRuleMsSecurityIncidentArgs(alertRuleTemplateGuid: Output<String>? = null, description: Output<String>? = null, displayName: Output<String>? = null, displayNameExcludeFilters: Output<List<String>>? = null, displayNameFilters: Output<List<String>>? = null, enabled: Output<Boolean>? = null, logAnalyticsWorkspaceId: Output<String>? = null, name: Output<String>? = null, productFilter: Output<String>? = null, severityFilters: Output<List<String>>? = null)

Functions

toJava

open override fun toJava(): AlertRuleMsSecurityIncidentArgs

Properties

alertRuleTemplateGuid

val alertRuleTemplateGuid: Output<String>? = null

The GUID of the alert rule template which is used to create this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel MS Security Incident Alert Rule to be created.

description

val description: Output<String>? = null

The description of this Sentinel MS Security Incident Alert Rule.

displayName

val displayName: Output<String>? = null

The friendly name of this Sentinel MS Security Incident Alert Rule.

displayNameExcludeFilters

val displayNameExcludeFilters: Output<List<String>>? = null

Only create incidents when the alert display name doesn't contain text from this list.

displayNameFilters

val displayNameFilters: Output<List<String>>? = null

Only create incidents when the alert display name contain text from this list, leave empty to apply no filter.

enabled

val enabled: Output<Boolean>? = null

Should this Sentinel MS Security Incident Alert Rule be enabled? Defaults to true.

logAnalyticsWorkspaceId

val logAnalyticsWorkspaceId: Output<String>? = null

The ID of the Log Analytics Workspace this Sentinel MS Security Incident Alert Rule belongs to. Changing this forces a new Sentinel MS Security Incident Alert Rule to be created.

name

val name: Output<String>? = null

The name which should be used for this Sentinel MS Security Incident Alert Rule. Changing this forces a new Sentinel MS Security Incident Alert Rule to be created.

productFilter

val productFilter: Output<String>? = null

The Microsoft Security Service from where the alert will be generated. Possible values are Azure Active Directory Identity Protection, Azure Advanced Threat Protection, Azure Security Center, Azure Security Center for IoT, Microsoft Cloud App Security, Microsoft Defender Advanced Threat Protection and Office 365 Advanced Threat Protection.

severityFilters

val severityFilters: Output<List<String>>? = null

Only create incidents from alerts when alert severity level is contained in this list. Possible values are High, Medium, Low and Informational.