pulumi-azure-kotlin/com.pulumi.azure.sentinel.kotlin/AlertRuleFusionArgs

AlertRuleFusionArgs

data class AlertRuleFusionArgs(val alertRuleTemplateGuid: Output<String>? = null, val enabled: Output<Boolean>? = null, val logAnalyticsWorkspaceId: Output<String>? = null, val name: Output<String>? = null, val sources: Output<List<AlertRuleFusionSourceArgs>>? = null) : ConvertibleToJava<AlertRuleFusionArgs>

Manages a Sentinel Fusion Alert Rule.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";
const example = new azure.core.ResourceGroup("example", {
    name: "example-resources",
    location: "West Europe",
});
const exampleAnalyticsWorkspace = new azure.operationalinsights.AnalyticsWorkspace("example", {
    name: "example-workspace",
    location: example.location,
    resourceGroupName: example.name,
    sku: "PerGB2018",
});
const exampleAnalyticsSolution = new azure.operationalinsights.AnalyticsSolution("example", {
    solutionName: "SecurityInsights",
    location: example.location,
    resourceGroupName: example.name,
    workspaceResourceId: exampleAnalyticsWorkspace.id,
    workspaceName: exampleAnalyticsWorkspace.name,
    plan: {
        publisher: "Microsoft",
        product: "OMSGallery/SecurityInsights",
    },
});
const exampleAlertRuleFusion = new azure.sentinel.AlertRuleFusion("example", {
    name: "example-fusion-alert-rule",
    logAnalyticsWorkspaceId: exampleAnalyticsSolution.workspaceResourceId,
    alertRuleTemplateGuid: "f71aba3d-28fb-450b-b192-4e76a83015c8",
});
Content copied to clipboard
import pulumi
import pulumi_azure as azure
example = azure.core.ResourceGroup("example",
    name="example-resources",
    location="West Europe")
example_analytics_workspace = azure.operationalinsights.AnalyticsWorkspace("example",
    name="example-workspace",
    location=example.location,
    resource_group_name=example.name,
    sku="PerGB2018")
example_analytics_solution = azure.operationalinsights.AnalyticsSolution("example",
    solution_name="SecurityInsights",
    location=example.location,
    resource_group_name=example.name,
    workspace_resource_id=example_analytics_workspace.id,
    workspace_name=example_analytics_workspace.name,
    plan={
        "publisher": "Microsoft",
        "product": "OMSGallery/SecurityInsights",
    })
example_alert_rule_fusion = azure.sentinel.AlertRuleFusion("example",
    name="example-fusion-alert-rule",
    log_analytics_workspace_id=example_analytics_solution.workspace_resource_id,
    alert_rule_template_guid="f71aba3d-28fb-450b-b192-4e76a83015c8")
Content copied to clipboard
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Azure = Pulumi.Azure;
return await Deployment.RunAsync(() =>
{
    var example = new Azure.Core.ResourceGroup("example", new()
    {
        Name = "example-resources",
        Location = "West Europe",
    });
    var exampleAnalyticsWorkspace = new Azure.OperationalInsights.AnalyticsWorkspace("example", new()
    {
        Name = "example-workspace",
        Location = example.Location,
        ResourceGroupName = example.Name,
        Sku = "PerGB2018",
    });
    var exampleAnalyticsSolution = new Azure.OperationalInsights.AnalyticsSolution("example", new()
    {
        SolutionName = "SecurityInsights",
        Location = example.Location,
        ResourceGroupName = example.Name,
        WorkspaceResourceId = exampleAnalyticsWorkspace.Id,
        WorkspaceName = exampleAnalyticsWorkspace.Name,
        Plan = new Azure.OperationalInsights.Inputs.AnalyticsSolutionPlanArgs
        {
            Publisher = "Microsoft",
            Product = "OMSGallery/SecurityInsights",
        },
    });
    var exampleAlertRuleFusion = new Azure.Sentinel.AlertRuleFusion("example", new()
    {
        Name = "example-fusion-alert-rule",
        LogAnalyticsWorkspaceId = exampleAnalyticsSolution.WorkspaceResourceId,
        AlertRuleTemplateGuid = "f71aba3d-28fb-450b-b192-4e76a83015c8",
    });
});
Content copied to clipboard
package main
import (
	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/core"
	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/operationalinsights"
	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/sentinel"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
			Name:     pulumi.String("example-resources"),
			Location: pulumi.String("West Europe"),
		})
		if err != nil {
			return err
		}
		exampleAnalyticsWorkspace, err := operationalinsights.NewAnalyticsWorkspace(ctx, "example", &operationalinsights.AnalyticsWorkspaceArgs{
			Name:              pulumi.String("example-workspace"),
			Location:          example.Location,
			ResourceGroupName: example.Name,
			Sku:               pulumi.String("PerGB2018"),
		})
		if err != nil {
			return err
		}
		exampleAnalyticsSolution, err := operationalinsights.NewAnalyticsSolution(ctx, "example", &operationalinsights.AnalyticsSolutionArgs{
			SolutionName:        pulumi.String("SecurityInsights"),
			Location:            example.Location,
			ResourceGroupName:   example.Name,
			WorkspaceResourceId: exampleAnalyticsWorkspace.ID(),
			WorkspaceName:       exampleAnalyticsWorkspace.Name,
			Plan: &operationalinsights.AnalyticsSolutionPlanArgs{
				Publisher: pulumi.String("Microsoft"),
				Product:   pulumi.String("OMSGallery/SecurityInsights"),
			},
		})
		if err != nil {
			return err
		}
		_, err = sentinel.NewAlertRuleFusion(ctx, "example", &sentinel.AlertRuleFusionArgs{
			Name:                    pulumi.String("example-fusion-alert-rule"),
			LogAnalyticsWorkspaceId: exampleAnalyticsSolution.WorkspaceResourceId,
			AlertRuleTemplateGuid:   pulumi.String("f71aba3d-28fb-450b-b192-4e76a83015c8"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Content copied to clipboard
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.operationalinsights.AnalyticsWorkspace;
import com.pulumi.azure.operationalinsights.AnalyticsWorkspaceArgs;
import com.pulumi.azure.operationalinsights.AnalyticsSolution;
import com.pulumi.azure.operationalinsights.AnalyticsSolutionArgs;
import com.pulumi.azure.operationalinsights.inputs.AnalyticsSolutionPlanArgs;
import com.pulumi.azure.sentinel.AlertRuleFusion;
import com.pulumi.azure.sentinel.AlertRuleFusionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var example = new ResourceGroup("example", ResourceGroupArgs.builder()
            .name("example-resources")
            .location("West Europe")
            .build());
        var exampleAnalyticsWorkspace = new AnalyticsWorkspace("exampleAnalyticsWorkspace", AnalyticsWorkspaceArgs.builder()
            .name("example-workspace")
            .location(example.location())
            .resourceGroupName(example.name())
            .sku("PerGB2018")
            .build());
        var exampleAnalyticsSolution = new AnalyticsSolution("exampleAnalyticsSolution", AnalyticsSolutionArgs.builder()
            .solutionName("SecurityInsights")
            .location(example.location())
            .resourceGroupName(example.name())
            .workspaceResourceId(exampleAnalyticsWorkspace.id())
            .workspaceName(exampleAnalyticsWorkspace.name())
            .plan(AnalyticsSolutionPlanArgs.builder()
                .publisher("Microsoft")
                .product("OMSGallery/SecurityInsights")
                .build())
            .build());
        var exampleAlertRuleFusion = new AlertRuleFusion("exampleAlertRuleFusion", AlertRuleFusionArgs.builder()
            .name("example-fusion-alert-rule")
            .logAnalyticsWorkspaceId(exampleAnalyticsSolution.workspaceResourceId())
            .alertRuleTemplateGuid("f71aba3d-28fb-450b-b192-4e76a83015c8")
            .build());
    }
}
Content copied to clipboard
resources:
  example:
    type: azure:core:ResourceGroup
    properties:
      name: example-resources
      location: West Europe
  exampleAnalyticsWorkspace:
    type: azure:operationalinsights:AnalyticsWorkspace
    name: example
    properties:
      name: example-workspace
      location: ${example.location}
      resourceGroupName: ${example.name}
      sku: PerGB2018
  exampleAnalyticsSolution:
    type: azure:operationalinsights:AnalyticsSolution
    name: example
    properties:
      solutionName: SecurityInsights
      location: ${example.location}
      resourceGroupName: ${example.name}
      workspaceResourceId: ${exampleAnalyticsWorkspace.id}
      workspaceName: ${exampleAnalyticsWorkspace.name}
      plan:
        publisher: Microsoft
        product: OMSGallery/SecurityInsights
  exampleAlertRuleFusion:
    type: azure:sentinel:AlertRuleFusion
    name: example
    properties:
      name: example-fusion-alert-rule
      logAnalyticsWorkspaceId: ${exampleAnalyticsSolution.workspaceResourceId}
      alertRuleTemplateGuid: f71aba3d-28fb-450b-b192-4e76a83015c8
Content copied to clipboard

Import

Sentinel Fusion Alert Rules can be imported using the resource id, e.g.

$ pulumi import azure:sentinel/alertRuleFusion:AlertRuleFusion example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.OperationalInsights/workspaces/workspace1/providers/Microsoft.SecurityInsights/alertRules/rule1
Content copied to clipboard

Constructors

Link copied to clipboard
constructor(alertRuleTemplateGuid: Output<String>? = null, enabled: Output<Boolean>? = null, logAnalyticsWorkspaceId: Output<String>? = null, name: Output<String>? = null, sources: Output<List<AlertRuleFusionSourceArgs>>? = null)

Properties

Link copied to clipboard
val alertRuleTemplateGuid: Output<String>? = null

The GUID of the alert rule template which is used for this Sentinel Fusion Alert Rule. Changing this forces a new Sentinel Fusion Alert Rule to be created.

Link copied to clipboard
val enabled: Output<Boolean>? = null

Should this Sentinel Fusion Alert Rule be enabled? Defaults to true.

Link copied to clipboard
val logAnalyticsWorkspaceId: Output<String>? = null

The ID of the Log Analytics Workspace this Sentinel Fusion Alert Rule belongs to. Changing this forces a new Sentinel Fusion Alert Rule to be created.

Link copied to clipboard
val name: Output<String>? = null

The name which should be used for this Sentinel Fusion Alert Rule. Changing this forces a new Sentinel Fusion Alert Rule to be created.

Link copied to clipboard
val sources: Output<List<AlertRuleFusionSourceArgs>>? = null

One or more source blocks as defined below.

Functions

Link copied to clipboard
open override fun toJava(): AlertRuleFusionArgs