Alert
data class AlertRuleMsSecurityIncidentArgs(val alertRuleTemplateGuid: Output<String>? = null, val description: Output<String>? = null, val displayName: Output<String>? = null, val displayNameExcludeFilters: Output<List<String>>? = null, val displayNameFilters: Output<List<String>>? = null, val enabled: Output<Boolean>? = null, val logAnalyticsWorkspaceId: Output<String>? = null, val name: Output<String>? = null, val productFilter: Output<String>? = null, val severityFilters: Output<List<String>>? = null) : ConvertibleToJava<AlertRuleMsSecurityIncidentArgs>
Manages a Sentinel MS Security Incident Alert Rule.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";
const example = new azure.core.ResourceGroup("example", {
name: "example-resources",
location: "West Europe",
});
const exampleAnalyticsWorkspace = new azure.operationalinsights.AnalyticsWorkspace("example", {
name: "example-workspace",
location: example.location,
resourceGroupName: example.name,
sku: "PerGB2018",
});
const exampleLogAnalyticsWorkspaceOnboarding = new azure.sentinel.LogAnalyticsWorkspaceOnboarding("example", {workspaceId: exampleAnalyticsWorkspace.id});
const exampleAlertRuleMsSecurityIncident = new azure.sentinel.AlertRuleMsSecurityIncident("example", {
name: "example-ms-security-incident-alert-rule",
logAnalyticsWorkspaceId: exampleLogAnalyticsWorkspaceOnboarding.workspaceId,
productFilter: "Microsoft Cloud App Security",
displayName: "example rule",
severityFilters: ["High"],
});Content copied to clipboard
import pulumi
import pulumi_azure as azure
example = azure.core.ResourceGroup("example",
name="example-resources",
location="West Europe")
example_analytics_workspace = azure.operationalinsights.AnalyticsWorkspace("example",
name="example-workspace",
location=example.location,
resource_group_name=example.name,
sku="PerGB2018")
example_log_analytics_workspace_onboarding = azure.sentinel.LogAnalyticsWorkspaceOnboarding("example", workspace_id=example_analytics_workspace.id)
example_alert_rule_ms_security_incident = azure.sentinel.AlertRuleMsSecurityIncident("example",
name="example-ms-security-incident-alert-rule",
log_analytics_workspace_id=example_log_analytics_workspace_onboarding.workspace_id,
product_filter="Microsoft Cloud App Security",
display_name="example rule",
severity_filters=["High"])Content copied to clipboard
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Azure = Pulumi.Azure;
return await Deployment.RunAsync(() =>
{
var example = new Azure.Core.ResourceGroup("example", new()
{
Name = "example-resources",
Location = "West Europe",
});
var exampleAnalyticsWorkspace = new Azure.OperationalInsights.AnalyticsWorkspace("example", new()
{
Name = "example-workspace",
Location = example.Location,
ResourceGroupName = example.Name,
Sku = "PerGB2018",
});
var exampleLogAnalyticsWorkspaceOnboarding = new Azure.Sentinel.LogAnalyticsWorkspaceOnboarding("example", new()
{
WorkspaceId = exampleAnalyticsWorkspace.Id,
});
var exampleAlertRuleMsSecurityIncident = new Azure.Sentinel.AlertRuleMsSecurityIncident("example", new()
{
Name = "example-ms-security-incident-alert-rule",
LogAnalyticsWorkspaceId = exampleLogAnalyticsWorkspaceOnboarding.WorkspaceId,
ProductFilter = "Microsoft Cloud App Security",
DisplayName = "example rule",
SeverityFilters = new[]
{
"High",
},
});
});Content copied to clipboard
package main
import (
"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/core"
"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/operationalinsights"
"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/sentinel"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
example, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
Name: pulumi.String("example-resources"),
Location: pulumi.String("West Europe"),
})
if err != nil {
return err
}
exampleAnalyticsWorkspace, err := operationalinsights.NewAnalyticsWorkspace(ctx, "example", &operationalinsights.AnalyticsWorkspaceArgs{
Name: pulumi.String("example-workspace"),
Location: example.Location,
ResourceGroupName: example.Name,
Sku: pulumi.String("PerGB2018"),
})
if err != nil {
return err
}
exampleLogAnalyticsWorkspaceOnboarding, err := sentinel.NewLogAnalyticsWorkspaceOnboarding(ctx, "example", &sentinel.LogAnalyticsWorkspaceOnboardingArgs{
WorkspaceId: exampleAnalyticsWorkspace.ID(),
})
if err != nil {
return err
}
_, err = sentinel.NewAlertRuleMsSecurityIncident(ctx, "example", &sentinel.AlertRuleMsSecurityIncidentArgs{
Name: pulumi.String("example-ms-security-incident-alert-rule"),
LogAnalyticsWorkspaceId: exampleLogAnalyticsWorkspaceOnboarding.WorkspaceId,
ProductFilter: pulumi.String("Microsoft Cloud App Security"),
DisplayName: pulumi.String("example rule"),
SeverityFilters: pulumi.StringArray{
pulumi.String("High"),
},
})
if err != nil {
return err
}
return nil
})
}Content copied to clipboard
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.operationalinsights.AnalyticsWorkspace;
import com.pulumi.azure.operationalinsights.AnalyticsWorkspaceArgs;
import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboarding;
import com.pulumi.azure.sentinel.LogAnalyticsWorkspaceOnboardingArgs;
import com.pulumi.azure.sentinel.AlertRuleMsSecurityIncident;
import com.pulumi.azure.sentinel.AlertRuleMsSecurityIncidentArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var example = new ResourceGroup("example", ResourceGroupArgs.builder()
.name("example-resources")
.location("West Europe")
.build());
var exampleAnalyticsWorkspace = new AnalyticsWorkspace("exampleAnalyticsWorkspace", AnalyticsWorkspaceArgs.builder()
.name("example-workspace")
.location(example.location())
.resourceGroupName(example.name())
.sku("PerGB2018")
.build());
var exampleLogAnalyticsWorkspaceOnboarding = new LogAnalyticsWorkspaceOnboarding("exampleLogAnalyticsWorkspaceOnboarding", LogAnalyticsWorkspaceOnboardingArgs.builder()
.workspaceId(exampleAnalyticsWorkspace.id())
.build());
var exampleAlertRuleMsSecurityIncident = new AlertRuleMsSecurityIncident("exampleAlertRuleMsSecurityIncident", AlertRuleMsSecurityIncidentArgs.builder()
.name("example-ms-security-incident-alert-rule")
.logAnalyticsWorkspaceId(exampleLogAnalyticsWorkspaceOnboarding.workspaceId())
.productFilter("Microsoft Cloud App Security")
.displayName("example rule")
.severityFilters("High")
.build());
}
}Content copied to clipboard
resources:
example:
type: azure:core:ResourceGroup
properties:
name: example-resources
location: West Europe
exampleAnalyticsWorkspace:
type: azure:operationalinsights:AnalyticsWorkspace
name: example
properties:
name: example-workspace
location: ${example.location}
resourceGroupName: ${example.name}
sku: PerGB2018
exampleLogAnalyticsWorkspaceOnboarding:
type: azure:sentinel:LogAnalyticsWorkspaceOnboarding
name: example
properties:
workspaceId: ${exampleAnalyticsWorkspace.id}
exampleAlertRuleMsSecurityIncident:
type: azure:sentinel:AlertRuleMsSecurityIncident
name: example
properties:
name: example-ms-security-incident-alert-rule
logAnalyticsWorkspaceId: ${exampleLogAnalyticsWorkspaceOnboarding.workspaceId}
productFilter: Microsoft Cloud App Security
displayName: example rule
severityFilters:
- HighContent copied to clipboard
Import
Sentinel MS Security Incident Alert Rules can be imported using the resource id, e.g.
$ pulumi import azure:sentinel/alertRuleMsSecurityIncident:AlertRuleMsSecurityIncident example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.OperationalInsights/workspaces/workspace1/providers/Microsoft.SecurityInsights/alertRules/rule1Content copied to clipboard
Constructors
Link copied to clipboard
constructor(alertRuleTemplateGuid: Output<String>? = null, description: Output<String>? = null, displayName: Output<String>? = null, displayNameExcludeFilters: Output<List<String>>? = null, displayNameFilters: Output<List<String>>? = null, enabled: Output<Boolean>? = null, logAnalyticsWorkspaceId: Output<String>? = null, name: Output<String>? = null, productFilter: Output<String>? = null, severityFilters: Output<List<String>>? = null)
Properties
Link copied to clipboard
The GUID of the alert rule template which is used to create this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel MS Security Incident Alert Rule to be created.
Link copied to clipboard
The description of this Sentinel MS Security Incident Alert Rule.
Link copied to clipboard
The friendly name of this Sentinel MS Security Incident Alert Rule.
Link copied to clipboard
Only create incidents when the alert display name doesn't contain text from this list.
Link copied to clipboard
Only create incidents when the alert display name contain text from this list, leave empty to apply no filter.
Link copied to clipboard
The ID of the Log Analytics Workspace this Sentinel MS Security Incident Alert Rule belongs to. Changing this forces a new Sentinel MS Security Incident Alert Rule to be created.
Link copied to clipboard
The Microsoft Security Service from where the alert will be generated. Possible values are Azure Active Directory Identity Protection, Azure Advanced Threat Protection, Azure Security Center, Azure Security Center for IoT, Microsoft Cloud App Security, Microsoft Defender Advanced Threat Protection and Office 365 Advanced Threat Protection.
Link copied to clipboard
Only create incidents from alerts when alert severity level is contained in this list. Possible values are High, Medium, Low and Informational.