Docs Packages
  1. Packages
  2. Sumo Logic
  3. API Docs
  4. CseFirstSeenRule
Sumo Logic v0.21.0 published on Thursday, Apr 11, 2024 by Pulumi
pulumi/pulumi-sumologic

sumologic.CseFirstSeenRule

Explore with Pulumi AI

sumologic logo
Sumo Logic v0.21.0 published on Thursday, Apr 11, 2024 by Pulumi
pulumi/pulumi-sumologic

    Provides a Sumo Logic CSE First Seen Rule.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as sumologic from "@pulumi/sumologic";

const firstSeenRule = new sumologic.CseFirstSeenRule("firstSeenRule", {
    baselineType: "PER_ENTITY",
    baselineWindowSize: "35000",
    descriptionExpression: "First User Login - {{ user_username }}",
    enabled: true,
    entitySelectors: [
        {
            entityType: "_username",
            expression: "user_username",
        },
        {
            entityType: "_hostname",
            expression: "dstDevice_hostname",
        },
    ],
    filterExpression: "objectType=\"Network\"",
    groupByFields: ["user_username"],
    isPrototype: false,
    nameExpression: "First User Login - {{ user_username }}",
    retentionWindowSize: "86400000",
    severity: 1,
    suppressionWindowSize: 2100000,
    valueFields: ["dstDevice_hostname"],
});

    import pulumi
import pulumi_sumologic as sumologic

first_seen_rule = sumologic.CseFirstSeenRule("firstSeenRule",
    baseline_type="PER_ENTITY",
    baseline_window_size="35000",
    description_expression="First User Login - {{ user_username }}",
    enabled=True,
    entity_selectors=[
        sumologic.CseFirstSeenRuleEntitySelectorArgs(
            entity_type="_username",
            expression="user_username",
        ),
        sumologic.CseFirstSeenRuleEntitySelectorArgs(
            entity_type="_hostname",
            expression="dstDevice_hostname",
        ),
    ],
    filter_expression="objectType=\"Network\"",
    group_by_fields=["user_username"],
    is_prototype=False,
    name_expression="First User Login - {{ user_username }}",
    retention_window_size="86400000",
    severity=1,
    suppression_window_size=2100000,
    value_fields=["dstDevice_hostname"])

    package main

import (
	"github.com/pulumi/pulumi-sumologic/sdk/go/sumologic"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := sumologic.NewCseFirstSeenRule(ctx, "firstSeenRule", &sumologic.CseFirstSeenRuleArgs{
			BaselineType:          pulumi.String("PER_ENTITY"),
			BaselineWindowSize:    pulumi.String("35000"),
			DescriptionExpression: pulumi.String("First User Login - {{ user_username }}"),
			Enabled:               pulumi.Bool(true),
			EntitySelectors: sumologic.CseFirstSeenRuleEntitySelectorArray{
				&sumologic.CseFirstSeenRuleEntitySelectorArgs{
					EntityType: pulumi.String("_username"),
					Expression: pulumi.String("user_username"),
				},
				&sumologic.CseFirstSeenRuleEntitySelectorArgs{
					EntityType: pulumi.String("_hostname"),
					Expression: pulumi.String("dstDevice_hostname"),
				},
			},
			FilterExpression: pulumi.String("objectType=\"Network\""),
			GroupByFields: pulumi.StringArray{
				pulumi.String("user_username"),
			},
			IsPrototype:           pulumi.Bool(false),
			NameExpression:        pulumi.String("First User Login - {{ user_username }}"),
			RetentionWindowSize:   pulumi.String("86400000"),
			Severity:              pulumi.Int(1),
			SuppressionWindowSize: pulumi.Int(2100000),
			ValueFields: pulumi.StringArray{
				pulumi.String("dstDevice_hostname"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using SumoLogic = Pulumi.SumoLogic;

return await Deployment.RunAsync(() => 
{
    var firstSeenRule = new SumoLogic.CseFirstSeenRule("firstSeenRule", new()
    {
        BaselineType = "PER_ENTITY",
        BaselineWindowSize = "35000",
        DescriptionExpression = "First User Login - {{ user_username }}",
        Enabled = true,
        EntitySelectors = new[]
        {
            new SumoLogic.Inputs.CseFirstSeenRuleEntitySelectorArgs
            {
                EntityType = "_username",
                Expression = "user_username",
            },
            new SumoLogic.Inputs.CseFirstSeenRuleEntitySelectorArgs
            {
                EntityType = "_hostname",
                Expression = "dstDevice_hostname",
            },
        },
        FilterExpression = "objectType=\"Network\"",
        GroupByFields = new[]
        {
            "user_username",
        },
        IsPrototype = false,
        NameExpression = "First User Login - {{ user_username }}",
        RetentionWindowSize = "86400000",
        Severity = 1,
        SuppressionWindowSize = 2100000,
        ValueFields = new[]
        {
            "dstDevice_hostname",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.sumologic.CseFirstSeenRule;
import com.pulumi.sumologic.CseFirstSeenRuleArgs;
import com.pulumi.sumologic.inputs.CseFirstSeenRuleEntitySelectorArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var firstSeenRule = new CseFirstSeenRule("firstSeenRule", CseFirstSeenRuleArgs.builder()        
            .baselineType("PER_ENTITY")
            .baselineWindowSize("35000")
            .descriptionExpression("First User Login - {{ user_username }}")
            .enabled(true)
            .entitySelectors(            
                CseFirstSeenRuleEntitySelectorArgs.builder()
                    .entityType("_username")
                    .expression("user_username")
                    .build(),
                CseFirstSeenRuleEntitySelectorArgs.builder()
                    .entityType("_hostname")
                    .expression("dstDevice_hostname")
                    .build())
            .filterExpression("objectType=\"Network\"")
            .groupByFields("user_username")
            .isPrototype(false)
            .nameExpression("First User Login - {{ user_username }}")
            .retentionWindowSize("86400000")
            .severity(1)
            .suppressionWindowSize(2100000)
            .valueFields("dstDevice_hostname")
            .build());

    }
}

    resources:
  firstSeenRule:
    type: sumologic:CseFirstSeenRule
    properties:
      baselineType: PER_ENTITY
      baselineWindowSize: '35000'
      descriptionExpression: First User Login - {{ user_username }}
      enabled: true
      entitySelectors:
        - entityType: _username
          expression: user_username
        - entityType: _hostname
          expression: dstDevice_hostname
      filterExpression: objectType="Network"
      groupByFields:
        - user_username
      isPrototype: false
      nameExpression: First User Login - {{ user_username }}
      retentionWindowSize: '86400000'
      severity: 1
      suppressionWindowSize: 2.1e+06
      valueFields:
        - dstDevice_hostname

    Create CseFirstSeenRule Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new CseFirstSeenRule(name: string, args: CseFirstSeenRuleArgs, opts?: CustomResourceOptions);
    @overload
def CseFirstSeenRule(resource_name: str,
                     args: CseFirstSeenRuleArgs,
                     opts: Optional[ResourceOptions] = None)

@overload
def CseFirstSeenRule(resource_name: str,
                     opts: Optional[ResourceOptions] = None,
                     retention_window_size: Optional[str] = None,
                     baseline_window_size: Optional[str] = None,
                     description_expression: Optional[str] = None,
                     enabled: Optional[bool] = None,
                     entity_selectors: Optional[Sequence[CseFirstSeenRuleEntitySelectorArgs]] = None,
                     filter_expression: Optional[str] = None,
                     value_fields: Optional[Sequence[str]] = None,
                     severity: Optional[int] = None,
                     baseline_type: Optional[str] = None,
                     name_expression: Optional[str] = None,
                     name: Optional[str] = None,
                     is_prototype: Optional[bool] = None,
                     summary_expression: Optional[str] = None,
                     suppression_window_size: Optional[int] = None,
                     tags: Optional[Sequence[str]] = None,
                     group_by_fields: Optional[Sequence[str]] = None)
    func NewCseFirstSeenRule(ctx *Context, name string, args CseFirstSeenRuleArgs, opts ...ResourceOption) (*CseFirstSeenRule, error)
    public CseFirstSeenRule(string name, CseFirstSeenRuleArgs args, CustomResourceOptions? opts = null)
    public CseFirstSeenRule(String name, CseFirstSeenRuleArgs args)
public CseFirstSeenRule(String name, CseFirstSeenRuleArgs args, CustomResourceOptions options)

    type: sumologic:CseFirstSeenRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args CseFirstSeenRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args CseFirstSeenRuleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args CseFirstSeenRuleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args CseFirstSeenRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args CseFirstSeenRuleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Example

    The following reference example uses placeholder values for all input properties.

    var cseFirstSeenRuleResource = new SumoLogic.CseFirstSeenRule("cseFirstSeenRuleResource", new()
{
    RetentionWindowSize = "string",
    BaselineWindowSize = "string",
    DescriptionExpression = "string",
    Enabled = false,
    EntitySelectors = new[]
    {
        new SumoLogic.Inputs.CseFirstSeenRuleEntitySelectorArgs
        {
            EntityType = "string",
            Expression = "string",
        },
    },
    FilterExpression = "string",
    ValueFields = new[]
    {
        "string",
    },
    Severity = 0,
    BaselineType = "string",
    NameExpression = "string",
    Name = "string",
    IsPrototype = false,
    SummaryExpression = "string",
    SuppressionWindowSize = 0,
    Tags = new[]
    {
        "string",
    },
    GroupByFields = new[]
    {
        "string",
    },
});

    example, err := sumologic.NewCseFirstSeenRule(ctx, "cseFirstSeenRuleResource", &sumologic.CseFirstSeenRuleArgs{
	RetentionWindowSize:   pulumi.String("string"),
	BaselineWindowSize:    pulumi.String("string"),
	DescriptionExpression: pulumi.String("string"),
	Enabled:               pulumi.Bool(false),
	EntitySelectors: sumologic.CseFirstSeenRuleEntitySelectorArray{
		&sumologic.CseFirstSeenRuleEntitySelectorArgs{
			EntityType: pulumi.String("string"),
			Expression: pulumi.String("string"),
		},
	},
	FilterExpression: pulumi.String("string"),
	ValueFields: pulumi.StringArray{
		pulumi.String("string"),
	},
	Severity:              pulumi.Int(0),
	BaselineType:          pulumi.String("string"),
	NameExpression:        pulumi.String("string"),
	Name:                  pulumi.String("string"),
	IsPrototype:           pulumi.Bool(false),
	SummaryExpression:     pulumi.String("string"),
	SuppressionWindowSize: pulumi.Int(0),
	Tags: pulumi.StringArray{
		pulumi.String("string"),
	},
	GroupByFields: pulumi.StringArray{
		pulumi.String("string"),
	},
})

    var cseFirstSeenRuleResource = new CseFirstSeenRule("cseFirstSeenRuleResource", CseFirstSeenRuleArgs.builder()        
    .retentionWindowSize("string")
    .baselineWindowSize("string")
    .descriptionExpression("string")
    .enabled(false)
    .entitySelectors(CseFirstSeenRuleEntitySelectorArgs.builder()
        .entityType("string")
        .expression("string")
        .build())
    .filterExpression("string")
    .valueFields("string")
    .severity(0)
    .baselineType("string")
    .nameExpression("string")
    .name("string")
    .isPrototype(false)
    .summaryExpression("string")
    .suppressionWindowSize(0)
    .tags("string")
    .groupByFields("string")
    .build());

    cse_first_seen_rule_resource = sumologic.CseFirstSeenRule("cseFirstSeenRuleResource",
    retention_window_size="string",
    baseline_window_size="string",
    description_expression="string",
    enabled=False,
    entity_selectors=[sumologic.CseFirstSeenRuleEntitySelectorArgs(
        entity_type="string",
        expression="string",
    )],
    filter_expression="string",
    value_fields=["string"],
    severity=0,
    baseline_type="string",
    name_expression="string",
    name="string",
    is_prototype=False,
    summary_expression="string",
    suppression_window_size=0,
    tags=["string"],
    group_by_fields=["string"])

    const cseFirstSeenRuleResource = new sumologic.CseFirstSeenRule("cseFirstSeenRuleResource", {
    retentionWindowSize: "string",
    baselineWindowSize: "string",
    descriptionExpression: "string",
    enabled: false,
    entitySelectors: [{
        entityType: "string",
        expression: "string",
    }],
    filterExpression: "string",
    valueFields: ["string"],
    severity: 0,
    baselineType: "string",
    nameExpression: "string",
    name: "string",
    isPrototype: false,
    summaryExpression: "string",
    suppressionWindowSize: 0,
    tags: ["string"],
    groupByFields: ["string"],
});

    type: sumologic:CseFirstSeenRule
properties:
    baselineType: string
    baselineWindowSize: string
    descriptionExpression: string
    enabled: false
    entitySelectors:
        - entityType: string
          expression: string
    filterExpression: string
    groupByFields:
        - string
    isPrototype: false
    name: string
    nameExpression: string
    retentionWindowSize: string
    severity: 0
    summaryExpression: string
    suppressionWindowSize: 0
    tags:
        - string
    valueFields:
        - string

    CseFirstSeenRule Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    The CseFirstSeenRule resource accepts the following input properties:

    BaselineType string
    The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
    BaselineWindowSize string
    The baseline window size in milliseconds
    DescriptionExpression string
    The description of the generated Signals
    Enabled bool
    Whether the rule should generate Signals
    EntitySelectors List<Pulumi.SumoLogic.Inputs.CseFirstSeenRuleEntitySelector>
    The entities to generate Signals on
    FilterExpression string
    The expression for which records to match on
    NameExpression string
    The name of the generated Signals
    RetentionWindowSize string
    The retention window size in milliseconds
    Severity int
    The severity of the generated Signals
    ValueFields List<string>
    The value fields
    GroupByFields List<string>
    A list of fields to group records by
    IsPrototype bool
    Whether the generated Signals should be prototype Signals
    Name string
    The name of the Rule
    SummaryExpression string
    The summary of the generated Signals
    SuppressionWindowSize int

    For how long to suppress Signal generation, in milliseconds. Must be greater than 0 and less than the global limit of 7 days.

    The following attributes are exported:

    Tags List<string>
    The tags of the generated Signals
    BaselineType string
    The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
    BaselineWindowSize string
    The baseline window size in milliseconds
    DescriptionExpression string
    The description of the generated Signals
    Enabled bool
    Whether the rule should generate Signals
    EntitySelectors []CseFirstSeenRuleEntitySelectorArgs
    The entities to generate Signals on
    FilterExpression string
    The expression for which records to match on
    NameExpression string
    The name of the generated Signals
    RetentionWindowSize string
    The retention window size in milliseconds
    Severity int
    The severity of the generated Signals
    ValueFields []string
    The value fields
    GroupByFields []string
    A list of fields to group records by
    IsPrototype bool
    Whether the generated Signals should be prototype Signals
    Name string
    The name of the Rule
    SummaryExpression string
    The summary of the generated Signals
    SuppressionWindowSize int

    For how long to suppress Signal generation, in milliseconds. Must be greater than 0 and less than the global limit of 7 days.

    The following attributes are exported:

    Tags []string
    The tags of the generated Signals
    baselineType String
    The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
    baselineWindowSize String
    The baseline window size in milliseconds
    descriptionExpression String
    The description of the generated Signals
    enabled Boolean
    Whether the rule should generate Signals
    entitySelectors List<CseFirstSeenRuleEntitySelector>
    The entities to generate Signals on
    filterExpression String
    The expression for which records to match on
    nameExpression String
    The name of the generated Signals
    retentionWindowSize String
    The retention window size in milliseconds
    severity Integer
    The severity of the generated Signals
    valueFields List<String>
    The value fields
    groupByFields List<String>
    A list of fields to group records by
    isPrototype Boolean
    Whether the generated Signals should be prototype Signals
    name String
    The name of the Rule
    summaryExpression String
    The summary of the generated Signals
    suppressionWindowSize Integer

    For how long to suppress Signal generation, in milliseconds. Must be greater than 0 and less than the global limit of 7 days.

    The following attributes are exported:

    tags List<String>
    The tags of the generated Signals
    baselineType string
    The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
    baselineWindowSize string
    The baseline window size in milliseconds
    descriptionExpression string
    The description of the generated Signals
    enabled boolean
    Whether the rule should generate Signals
    entitySelectors CseFirstSeenRuleEntitySelector[]
    The entities to generate Signals on
    filterExpression string
    The expression for which records to match on
    nameExpression string
    The name of the generated Signals
    retentionWindowSize string
    The retention window size in milliseconds
    severity number
    The severity of the generated Signals
    valueFields string[]
    The value fields
    groupByFields string[]
    A list of fields to group records by
    isPrototype boolean
    Whether the generated Signals should be prototype Signals
    name string
    The name of the Rule
    summaryExpression string
    The summary of the generated Signals
    suppressionWindowSize number

    For how long to suppress Signal generation, in milliseconds. Must be greater than 0 and less than the global limit of 7 days.

    The following attributes are exported:

    tags string[]
    The tags of the generated Signals
    baseline_type str
    The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
    baseline_window_size str
    The baseline window size in milliseconds
    description_expression str
    The description of the generated Signals
    enabled bool
    Whether the rule should generate Signals
    entity_selectors Sequence[CseFirstSeenRuleEntitySelectorArgs]
    The entities to generate Signals on
    filter_expression str
    The expression for which records to match on
    name_expression str
    The name of the generated Signals
    retention_window_size str
    The retention window size in milliseconds
    severity int
    The severity of the generated Signals
    value_fields Sequence[str]
    The value fields
    group_by_fields Sequence[str]
    A list of fields to group records by
    is_prototype bool
    Whether the generated Signals should be prototype Signals
    name str
    The name of the Rule
    summary_expression str
    The summary of the generated Signals
    suppression_window_size int

    For how long to suppress Signal generation, in milliseconds. Must be greater than 0 and less than the global limit of 7 days.

    The following attributes are exported:

    tags Sequence[str]
    The tags of the generated Signals
    baselineType String
    The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
    baselineWindowSize String
    The baseline window size in milliseconds
    descriptionExpression String
    The description of the generated Signals
    enabled Boolean
    Whether the rule should generate Signals
    entitySelectors List<Property Map>
    The entities to generate Signals on
    filterExpression String
    The expression for which records to match on
    nameExpression String
    The name of the generated Signals
    retentionWindowSize String
    The retention window size in milliseconds
    severity Number
    The severity of the generated Signals
    valueFields List<String>
    The value fields
    groupByFields List<String>
    A list of fields to group records by
    isPrototype Boolean
    Whether the generated Signals should be prototype Signals
    name String
    The name of the Rule
    summaryExpression String
    The summary of the generated Signals
    suppressionWindowSize Number

    For how long to suppress Signal generation, in milliseconds. Must be greater than 0 and less than the global limit of 7 days.

    The following attributes are exported:

    tags List<String>
    The tags of the generated Signals

    Outputs

    All input properties are implicitly available as output properties. Additionally, the CseFirstSeenRule resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing CseFirstSeenRule Resource

    Get an existing CseFirstSeenRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: CseFirstSeenRuleState, opts?: CustomResourceOptions): CseFirstSeenRule
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        baseline_type: Optional[str] = None,
        baseline_window_size: Optional[str] = None,
        description_expression: Optional[str] = None,
        enabled: Optional[bool] = None,
        entity_selectors: Optional[Sequence[CseFirstSeenRuleEntitySelectorArgs]] = None,
        filter_expression: Optional[str] = None,
        group_by_fields: Optional[Sequence[str]] = None,
        is_prototype: Optional[bool] = None,
        name: Optional[str] = None,
        name_expression: Optional[str] = None,
        retention_window_size: Optional[str] = None,
        severity: Optional[int] = None,
        summary_expression: Optional[str] = None,
        suppression_window_size: Optional[int] = None,
        tags: Optional[Sequence[str]] = None,
        value_fields: Optional[Sequence[str]] = None) -> CseFirstSeenRule
    func GetCseFirstSeenRule(ctx *Context, name string, id IDInput, state *CseFirstSeenRuleState, opts ...ResourceOption) (*CseFirstSeenRule, error)
    public static CseFirstSeenRule Get(string name, Input<string> id, CseFirstSeenRuleState? state, CustomResourceOptions? opts = null)
    public static CseFirstSeenRule get(String name, Output<String> id, CseFirstSeenRuleState state, CustomResourceOptions options)
    Resource lookup is not supported in YAML
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    BaselineType string
    The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
    BaselineWindowSize string
    The baseline window size in milliseconds
    DescriptionExpression string
    The description of the generated Signals
    Enabled bool
    Whether the rule should generate Signals
    EntitySelectors List<Pulumi.SumoLogic.Inputs.CseFirstSeenRuleEntitySelector>
    The entities to generate Signals on
    FilterExpression string
    The expression for which records to match on
    GroupByFields List<string>
    A list of fields to group records by
    IsPrototype bool
    Whether the generated Signals should be prototype Signals
    Name string
    The name of the Rule
    NameExpression string
    The name of the generated Signals
    RetentionWindowSize string
    The retention window size in milliseconds
    Severity int
    The severity of the generated Signals
    SummaryExpression string
    The summary of the generated Signals
    SuppressionWindowSize int

    For how long to suppress Signal generation, in milliseconds. Must be greater than 0 and less than the global limit of 7 days.

    The following attributes are exported:

    Tags List<string>
    The tags of the generated Signals
    ValueFields List<string>
    The value fields
    BaselineType string
    The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
    BaselineWindowSize string
    The baseline window size in milliseconds
    DescriptionExpression string
    The description of the generated Signals
    Enabled bool
    Whether the rule should generate Signals
    EntitySelectors []CseFirstSeenRuleEntitySelectorArgs
    The entities to generate Signals on
    FilterExpression string
    The expression for which records to match on
    GroupByFields []string
    A list of fields to group records by
    IsPrototype bool
    Whether the generated Signals should be prototype Signals
    Name string
    The name of the Rule
    NameExpression string
    The name of the generated Signals
    RetentionWindowSize string
    The retention window size in milliseconds
    Severity int
    The severity of the generated Signals
    SummaryExpression string
    The summary of the generated Signals
    SuppressionWindowSize int

    For how long to suppress Signal generation, in milliseconds. Must be greater than 0 and less than the global limit of 7 days.

    The following attributes are exported:

    Tags []string
    The tags of the generated Signals
    ValueFields []string
    The value fields
    baselineType String
    The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
    baselineWindowSize String
    The baseline window size in milliseconds
    descriptionExpression String
    The description of the generated Signals
    enabled Boolean
    Whether the rule should generate Signals
    entitySelectors List<CseFirstSeenRuleEntitySelector>
    The entities to generate Signals on
    filterExpression String
    The expression for which records to match on
    groupByFields List<String>
    A list of fields to group records by
    isPrototype Boolean
    Whether the generated Signals should be prototype Signals
    name String
    The name of the Rule
    nameExpression String
    The name of the generated Signals
    retentionWindowSize String
    The retention window size in milliseconds
    severity Integer
    The severity of the generated Signals
    summaryExpression String
    The summary of the generated Signals
    suppressionWindowSize Integer

    For how long to suppress Signal generation, in milliseconds. Must be greater than 0 and less than the global limit of 7 days.

    The following attributes are exported:

    tags List<String>
    The tags of the generated Signals
    valueFields List<String>
    The value fields
    baselineType string
    The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
    baselineWindowSize string
    The baseline window size in milliseconds
    descriptionExpression string
    The description of the generated Signals
    enabled boolean
    Whether the rule should generate Signals
    entitySelectors CseFirstSeenRuleEntitySelector[]
    The entities to generate Signals on
    filterExpression string
    The expression for which records to match on
    groupByFields string[]
    A list of fields to group records by
    isPrototype boolean
    Whether the generated Signals should be prototype Signals
    name string
    The name of the Rule
    nameExpression string
    The name of the generated Signals
    retentionWindowSize string
    The retention window size in milliseconds
    severity number
    The severity of the generated Signals
    summaryExpression string
    The summary of the generated Signals
    suppressionWindowSize number

    For how long to suppress Signal generation, in milliseconds. Must be greater than 0 and less than the global limit of 7 days.

    The following attributes are exported:

    tags string[]
    The tags of the generated Signals
    valueFields string[]
    The value fields
    baseline_type str
    The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
    baseline_window_size str
    The baseline window size in milliseconds
    description_expression str
    The description of the generated Signals
    enabled bool
    Whether the rule should generate Signals
    entity_selectors Sequence[CseFirstSeenRuleEntitySelectorArgs]
    The entities to generate Signals on
    filter_expression str
    The expression for which records to match on
    group_by_fields Sequence[str]
    A list of fields to group records by
    is_prototype bool
    Whether the generated Signals should be prototype Signals
    name str
    The name of the Rule
    name_expression str
    The name of the generated Signals
    retention_window_size str
    The retention window size in milliseconds
    severity int
    The severity of the generated Signals
    summary_expression str
    The summary of the generated Signals
    suppression_window_size int

    For how long to suppress Signal generation, in milliseconds. Must be greater than 0 and less than the global limit of 7 days.

    The following attributes are exported:

    tags Sequence[str]
    The tags of the generated Signals
    value_fields Sequence[str]
    The value fields
    baselineType String
    The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
    baselineWindowSize String
    The baseline window size in milliseconds
    descriptionExpression String
    The description of the generated Signals
    enabled Boolean
    Whether the rule should generate Signals
    entitySelectors List<Property Map>
    The entities to generate Signals on
    filterExpression String
    The expression for which records to match on
    groupByFields List<String>
    A list of fields to group records by
    isPrototype Boolean
    Whether the generated Signals should be prototype Signals
    name String
    The name of the Rule
    nameExpression String
    The name of the generated Signals
    retentionWindowSize String
    The retention window size in milliseconds
    severity Number
    The severity of the generated Signals
    summaryExpression String
    The summary of the generated Signals
    suppressionWindowSize Number

    For how long to suppress Signal generation, in milliseconds. Must be greater than 0 and less than the global limit of 7 days.

    The following attributes are exported:

    tags List<String>
    The tags of the generated Signals
    valueFields List<String>
    The value fields

    Supporting Types

    CseFirstSeenRuleEntitySelector, CseFirstSeenRuleEntitySelectorArgs

    EntityType string
    Expression string
    The expression or field name to generate the Signal on
    EntityType string
    Expression string
    The expression or field name to generate the Signal on
    entityType String
    expression String
    The expression or field name to generate the Signal on
    entityType string
    expression string
    The expression or field name to generate the Signal on
    entity_type str
    expression str
    The expression or field name to generate the Signal on
    entityType String
    expression String
    The expression or field name to generate the Signal on

    Import

    First Seen Rules can be imported using the field id, e.g.:

    hcl

    $ pulumi import sumologic:index/cseFirstSeenRule:CseFirstSeenRule first_seen_rule id

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Sumo Logic pulumi/pulumi-sumologic
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the sumologic Terraform Provider.
    sumologic logo
    Sumo Logic v0.21.0 published on Thursday, Apr 11, 2024 by Pulumi
    pulumi/pulumi-sumologic