1. Packages
  2. Sumo Logic
  3. API Docs
  4. CseOutlierRule
Sumo Logic v0.21.0 published on Thursday, Apr 11, 2024 by Pulumi

sumologic.CseOutlierRule

Explore with Pulumi AI

sumologic logo
Sumo Logic v0.21.0 published on Thursday, Apr 11, 2024 by Pulumi

    ___

    layout: “sumologic” page_title: “SumoLogic: sumologic.CseOutlierRule” description: |- Provides a CSE Outlier Rule

    sumologic.CseOutlierRule

    Provides a Sumo Logic CSE Outlier Rule.

    Example Usage

    Coming soon!
    
    Coming soon!
    
    Coming soon!
    
    Coming soon!
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.sumologic.CseFirstSeenRule;
    import com.pulumi.sumologic.CseFirstSeenRuleArgs;
    import com.pulumi.sumologic.inputs.CseFirstSeenRuleEntitySelectorArgs;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            var firstSeenRule = new CseFirstSeenRule("firstSeenRule", CseFirstSeenRuleArgs.builder()        
                .aggregationFunctions(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
                .baselineWindowSize("1209600000")
                .descriptionExpression("Spike in Login Failures - {{ user_username }}")
                .deviationThreshold(3)
                .enabled(true)
                .entitySelectors(CseFirstSeenRuleEntitySelectorArgs.builder()
                    .entityType("_username")
                    .expression("user_username")
                    .build())
                .floorValue(0)
                .groupByFields("user_username")
                .isPrototype(false)
                .matchExpression("objectType=\"Authentication\" AND success=false")
                .nameExpression("Spike in Login Failures - {{ user_username }}")
                .retentionWindowSize("7776000000")
                .severity(1)
                .summaryExpression("Spike in Login Failures - {{ user_username }}")
                .suppressionWindowSize(90000000)
                .windowSize("T24H")
                .build());
    
        }
    }
    
    resources:
      firstSeenRule:
        type: sumologic:CseFirstSeenRule
        properties:
          aggregationFunctions:
            - arguments:
                - 'true'
              function: count
              name: total
          baselineWindowSize: '1209600000'
          # 14 days
          descriptionExpression: Spike in Login Failures - {{ user_username }}
          deviationThreshold: 3
          enabled: true
          entitySelectors:
            - entityType: _username
              expression: user_username
          floorValue: 0
          groupByFields:
            - user_username
          isPrototype: false
          matchExpression: objectType="Authentication" AND success=false
          nameExpression: Spike in Login Failures - {{ user_username }}
          retentionWindowSize: '7776000000'
          # 90 days
          severity: 1
          summaryExpression: Spike in Login Failures - {{ user_username }}
          suppressionWindowSize: 9e+07
          windowSize: T24H
    

    Create CseOutlierRule Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new CseOutlierRule(name: string, args: CseOutlierRuleArgs, opts?: CustomResourceOptions);
    @overload
    def CseOutlierRule(resource_name: str,
                       args: CseOutlierRuleArgs,
                       opts: Optional[ResourceOptions] = None)
    
    @overload
    def CseOutlierRule(resource_name: str,
                       opts: Optional[ResourceOptions] = None,
                       retention_window_size: Optional[str] = None,
                       description_expression: Optional[str] = None,
                       match_expression: Optional[str] = None,
                       severity: Optional[int] = None,
                       enabled: Optional[bool] = None,
                       entity_selectors: Optional[Sequence[CseOutlierRuleEntitySelectorArgs]] = None,
                       floor_value: Optional[int] = None,
                       aggregation_functions: Optional[CseOutlierRuleAggregationFunctionsArgs] = None,
                       window_size: Optional[str] = None,
                       baseline_window_size: Optional[str] = None,
                       deviation_threshold: Optional[int] = None,
                       name_expression: Optional[str] = None,
                       group_by_fields: Optional[Sequence[str]] = None,
                       name: Optional[str] = None,
                       summary_expression: Optional[str] = None,
                       suppression_window_size: Optional[int] = None,
                       tags: Optional[Sequence[str]] = None,
                       is_prototype: Optional[bool] = None)
    func NewCseOutlierRule(ctx *Context, name string, args CseOutlierRuleArgs, opts ...ResourceOption) (*CseOutlierRule, error)
    public CseOutlierRule(string name, CseOutlierRuleArgs args, CustomResourceOptions? opts = null)
    public CseOutlierRule(String name, CseOutlierRuleArgs args)
    public CseOutlierRule(String name, CseOutlierRuleArgs args, CustomResourceOptions options)
    
    type: sumologic:CseOutlierRule
    properties: # The arguments to resource properties.
    options: # Bag of options to control resource's behavior.
    
    

    Parameters

    name string
    The unique name of the resource.
    args CseOutlierRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args CseOutlierRuleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args CseOutlierRuleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args CseOutlierRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args CseOutlierRuleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Example

    The following reference example uses placeholder values for all input properties.

    var cseOutlierRuleResource = new SumoLogic.CseOutlierRule("cseOutlierRuleResource", new()
    {
        RetentionWindowSize = "string",
        DescriptionExpression = "string",
        MatchExpression = "string",
        Severity = 0,
        Enabled = false,
        EntitySelectors = new[]
        {
            new SumoLogic.Inputs.CseOutlierRuleEntitySelectorArgs
            {
                EntityType = "string",
                Expression = "string",
            },
        },
        FloorValue = 0,
        AggregationFunctions = new SumoLogic.Inputs.CseOutlierRuleAggregationFunctionsArgs
        {
            Arguments = new[]
            {
                "string",
            },
            Function = "string",
            Name = "string",
        },
        WindowSize = "string",
        BaselineWindowSize = "string",
        DeviationThreshold = 0,
        NameExpression = "string",
        GroupByFields = new[]
        {
            "string",
        },
        Name = "string",
        SummaryExpression = "string",
        SuppressionWindowSize = 0,
        Tags = new[]
        {
            "string",
        },
        IsPrototype = false,
    });
    
    example, err := sumologic.NewCseOutlierRule(ctx, "cseOutlierRuleResource", &sumologic.CseOutlierRuleArgs{
    	RetentionWindowSize:   pulumi.String("string"),
    	DescriptionExpression: pulumi.String("string"),
    	MatchExpression:       pulumi.String("string"),
    	Severity:              pulumi.Int(0),
    	Enabled:               pulumi.Bool(false),
    	EntitySelectors: sumologic.CseOutlierRuleEntitySelectorArray{
    		&sumologic.CseOutlierRuleEntitySelectorArgs{
    			EntityType: pulumi.String("string"),
    			Expression: pulumi.String("string"),
    		},
    	},
    	FloorValue: pulumi.Int(0),
    	AggregationFunctions: &sumologic.CseOutlierRuleAggregationFunctionsArgs{
    		Arguments: pulumi.StringArray{
    			pulumi.String("string"),
    		},
    		Function: pulumi.String("string"),
    		Name:     pulumi.String("string"),
    	},
    	WindowSize:         pulumi.String("string"),
    	BaselineWindowSize: pulumi.String("string"),
    	DeviationThreshold: pulumi.Int(0),
    	NameExpression:     pulumi.String("string"),
    	GroupByFields: pulumi.StringArray{
    		pulumi.String("string"),
    	},
    	Name:                  pulumi.String("string"),
    	SummaryExpression:     pulumi.String("string"),
    	SuppressionWindowSize: pulumi.Int(0),
    	Tags: pulumi.StringArray{
    		pulumi.String("string"),
    	},
    	IsPrototype: pulumi.Bool(false),
    })
    
    var cseOutlierRuleResource = new CseOutlierRule("cseOutlierRuleResource", CseOutlierRuleArgs.builder()        
        .retentionWindowSize("string")
        .descriptionExpression("string")
        .matchExpression("string")
        .severity(0)
        .enabled(false)
        .entitySelectors(CseOutlierRuleEntitySelectorArgs.builder()
            .entityType("string")
            .expression("string")
            .build())
        .floorValue(0)
        .aggregationFunctions(CseOutlierRuleAggregationFunctionsArgs.builder()
            .arguments("string")
            .function("string")
            .name("string")
            .build())
        .windowSize("string")
        .baselineWindowSize("string")
        .deviationThreshold(0)
        .nameExpression("string")
        .groupByFields("string")
        .name("string")
        .summaryExpression("string")
        .suppressionWindowSize(0)
        .tags("string")
        .isPrototype(false)
        .build());
    
    cse_outlier_rule_resource = sumologic.CseOutlierRule("cseOutlierRuleResource",
        retention_window_size="string",
        description_expression="string",
        match_expression="string",
        severity=0,
        enabled=False,
        entity_selectors=[sumologic.CseOutlierRuleEntitySelectorArgs(
            entity_type="string",
            expression="string",
        )],
        floor_value=0,
        aggregation_functions=sumologic.CseOutlierRuleAggregationFunctionsArgs(
            arguments=["string"],
            function="string",
            name="string",
        ),
        window_size="string",
        baseline_window_size="string",
        deviation_threshold=0,
        name_expression="string",
        group_by_fields=["string"],
        name="string",
        summary_expression="string",
        suppression_window_size=0,
        tags=["string"],
        is_prototype=False)
    
    const cseOutlierRuleResource = new sumologic.CseOutlierRule("cseOutlierRuleResource", {
        retentionWindowSize: "string",
        descriptionExpression: "string",
        matchExpression: "string",
        severity: 0,
        enabled: false,
        entitySelectors: [{
            entityType: "string",
            expression: "string",
        }],
        floorValue: 0,
        aggregationFunctions: {
            arguments: ["string"],
            "function": "string",
            name: "string",
        },
        windowSize: "string",
        baselineWindowSize: "string",
        deviationThreshold: 0,
        nameExpression: "string",
        groupByFields: ["string"],
        name: "string",
        summaryExpression: "string",
        suppressionWindowSize: 0,
        tags: ["string"],
        isPrototype: false,
    });
    
    type: sumologic:CseOutlierRule
    properties:
        aggregationFunctions:
            arguments:
                - string
            function: string
            name: string
        baselineWindowSize: string
        descriptionExpression: string
        deviationThreshold: 0
        enabled: false
        entitySelectors:
            - entityType: string
              expression: string
        floorValue: 0
        groupByFields:
            - string
        isPrototype: false
        matchExpression: string
        name: string
        nameExpression: string
        retentionWindowSize: string
        severity: 0
        summaryExpression: string
        suppressionWindowSize: 0
        tags:
            - string
        windowSize: string
    

    CseOutlierRule Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    The CseOutlierRule resource accepts the following input properties:

    AggregationFunctions Pulumi.SumoLogic.Inputs.CseOutlierRuleAggregationFunctions
    BaselineWindowSize string
    The baseline window size in milliseconds
    DescriptionExpression string
    The description of the generated Signals
    DeviationThreshold int
    The deviation threshold used to calculate the threshold to trigger signals
    Enabled bool
    Whether the rule should generate Signals
    EntitySelectors List<Pulumi.SumoLogic.Inputs.CseOutlierRuleEntitySelector>
    The entities to generate Signals on
    FloorValue int
    The minimum threshold to trigger signals
    MatchExpression string
    The expression for which records to match on
    NameExpression string
    The name of the generated Signals
    RetentionWindowSize string
    The retention window size in milliseconds
    Severity int
    The severity of the generated Signals
    WindowSize string
    The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
    GroupByFields List<string>
    A list of fields to group records by
    IsPrototype bool
    Whether the generated Signals should be prototype Signals
    Name string
    The name of the Rule
    SummaryExpression string
    The summary of the generated Signals
    SuppressionWindowSize int

    For how long to suppress Signal generation, in milliseconds. Must be greater than window_size and less than the global limit of 7 days.

    The following attributes are exported:

    Tags List<string>
    The tags of the generated Signals
    AggregationFunctions CseOutlierRuleAggregationFunctionsArgs
    BaselineWindowSize string
    The baseline window size in milliseconds
    DescriptionExpression string
    The description of the generated Signals
    DeviationThreshold int
    The deviation threshold used to calculate the threshold to trigger signals
    Enabled bool
    Whether the rule should generate Signals
    EntitySelectors []CseOutlierRuleEntitySelectorArgs
    The entities to generate Signals on
    FloorValue int
    The minimum threshold to trigger signals
    MatchExpression string
    The expression for which records to match on
    NameExpression string
    The name of the generated Signals
    RetentionWindowSize string
    The retention window size in milliseconds
    Severity int
    The severity of the generated Signals
    WindowSize string
    The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
    GroupByFields []string
    A list of fields to group records by
    IsPrototype bool
    Whether the generated Signals should be prototype Signals
    Name string
    The name of the Rule
    SummaryExpression string
    The summary of the generated Signals
    SuppressionWindowSize int

    For how long to suppress Signal generation, in milliseconds. Must be greater than window_size and less than the global limit of 7 days.

    The following attributes are exported:

    Tags []string
    The tags of the generated Signals
    aggregationFunctions CseOutlierRuleAggregationFunctions
    baselineWindowSize String
    The baseline window size in milliseconds
    descriptionExpression String
    The description of the generated Signals
    deviationThreshold Integer
    The deviation threshold used to calculate the threshold to trigger signals
    enabled Boolean
    Whether the rule should generate Signals
    entitySelectors List<CseOutlierRuleEntitySelector>
    The entities to generate Signals on
    floorValue Integer
    The minimum threshold to trigger signals
    matchExpression String
    The expression for which records to match on
    nameExpression String
    The name of the generated Signals
    retentionWindowSize String
    The retention window size in milliseconds
    severity Integer
    The severity of the generated Signals
    windowSize String
    The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
    groupByFields List<String>
    A list of fields to group records by
    isPrototype Boolean
    Whether the generated Signals should be prototype Signals
    name String
    The name of the Rule
    summaryExpression String
    The summary of the generated Signals
    suppressionWindowSize Integer

    For how long to suppress Signal generation, in milliseconds. Must be greater than window_size and less than the global limit of 7 days.

    The following attributes are exported:

    tags List<String>
    The tags of the generated Signals
    aggregationFunctions CseOutlierRuleAggregationFunctions
    baselineWindowSize string
    The baseline window size in milliseconds
    descriptionExpression string
    The description of the generated Signals
    deviationThreshold number
    The deviation threshold used to calculate the threshold to trigger signals
    enabled boolean
    Whether the rule should generate Signals
    entitySelectors CseOutlierRuleEntitySelector[]
    The entities to generate Signals on
    floorValue number
    The minimum threshold to trigger signals
    matchExpression string
    The expression for which records to match on
    nameExpression string
    The name of the generated Signals
    retentionWindowSize string
    The retention window size in milliseconds
    severity number
    The severity of the generated Signals
    windowSize string
    The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
    groupByFields string[]
    A list of fields to group records by
    isPrototype boolean
    Whether the generated Signals should be prototype Signals
    name string
    The name of the Rule
    summaryExpression string
    The summary of the generated Signals
    suppressionWindowSize number

    For how long to suppress Signal generation, in milliseconds. Must be greater than window_size and less than the global limit of 7 days.

    The following attributes are exported:

    tags string[]
    The tags of the generated Signals
    aggregation_functions CseOutlierRuleAggregationFunctionsArgs
    baseline_window_size str
    The baseline window size in milliseconds
    description_expression str
    The description of the generated Signals
    deviation_threshold int
    The deviation threshold used to calculate the threshold to trigger signals
    enabled bool
    Whether the rule should generate Signals
    entity_selectors Sequence[CseOutlierRuleEntitySelectorArgs]
    The entities to generate Signals on
    floor_value int
    The minimum threshold to trigger signals
    match_expression str
    The expression for which records to match on
    name_expression str
    The name of the generated Signals
    retention_window_size str
    The retention window size in milliseconds
    severity int
    The severity of the generated Signals
    window_size str
    The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
    group_by_fields Sequence[str]
    A list of fields to group records by
    is_prototype bool
    Whether the generated Signals should be prototype Signals
    name str
    The name of the Rule
    summary_expression str
    The summary of the generated Signals
    suppression_window_size int

    For how long to suppress Signal generation, in milliseconds. Must be greater than window_size and less than the global limit of 7 days.

    The following attributes are exported:

    tags Sequence[str]
    The tags of the generated Signals
    aggregationFunctions Property Map
    baselineWindowSize String
    The baseline window size in milliseconds
    descriptionExpression String
    The description of the generated Signals
    deviationThreshold Number
    The deviation threshold used to calculate the threshold to trigger signals
    enabled Boolean
    Whether the rule should generate Signals
    entitySelectors List<Property Map>
    The entities to generate Signals on
    floorValue Number
    The minimum threshold to trigger signals
    matchExpression String
    The expression for which records to match on
    nameExpression String
    The name of the generated Signals
    retentionWindowSize String
    The retention window size in milliseconds
    severity Number
    The severity of the generated Signals
    windowSize String
    The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
    groupByFields List<String>
    A list of fields to group records by
    isPrototype Boolean
    Whether the generated Signals should be prototype Signals
    name String
    The name of the Rule
    summaryExpression String
    The summary of the generated Signals
    suppressionWindowSize Number

    For how long to suppress Signal generation, in milliseconds. Must be greater than window_size and less than the global limit of 7 days.

    The following attributes are exported:

    tags List<String>
    The tags of the generated Signals

    Outputs

    All input properties are implicitly available as output properties. Additionally, the CseOutlierRule resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing CseOutlierRule Resource

    Get an existing CseOutlierRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: CseOutlierRuleState, opts?: CustomResourceOptions): CseOutlierRule
    @staticmethod
    def get(resource_name: str,
            id: str,
            opts: Optional[ResourceOptions] = None,
            aggregation_functions: Optional[CseOutlierRuleAggregationFunctionsArgs] = None,
            baseline_window_size: Optional[str] = None,
            description_expression: Optional[str] = None,
            deviation_threshold: Optional[int] = None,
            enabled: Optional[bool] = None,
            entity_selectors: Optional[Sequence[CseOutlierRuleEntitySelectorArgs]] = None,
            floor_value: Optional[int] = None,
            group_by_fields: Optional[Sequence[str]] = None,
            is_prototype: Optional[bool] = None,
            match_expression: Optional[str] = None,
            name: Optional[str] = None,
            name_expression: Optional[str] = None,
            retention_window_size: Optional[str] = None,
            severity: Optional[int] = None,
            summary_expression: Optional[str] = None,
            suppression_window_size: Optional[int] = None,
            tags: Optional[Sequence[str]] = None,
            window_size: Optional[str] = None) -> CseOutlierRule
    func GetCseOutlierRule(ctx *Context, name string, id IDInput, state *CseOutlierRuleState, opts ...ResourceOption) (*CseOutlierRule, error)
    public static CseOutlierRule Get(string name, Input<string> id, CseOutlierRuleState? state, CustomResourceOptions? opts = null)
    public static CseOutlierRule get(String name, Output<String> id, CseOutlierRuleState state, CustomResourceOptions options)
    Resource lookup is not supported in YAML
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AggregationFunctions Pulumi.SumoLogic.Inputs.CseOutlierRuleAggregationFunctions
    BaselineWindowSize string
    The baseline window size in milliseconds
    DescriptionExpression string
    The description of the generated Signals
    DeviationThreshold int
    The deviation threshold used to calculate the threshold to trigger signals
    Enabled bool
    Whether the rule should generate Signals
    EntitySelectors List<Pulumi.SumoLogic.Inputs.CseOutlierRuleEntitySelector>
    The entities to generate Signals on
    FloorValue int
    The minimum threshold to trigger signals
    GroupByFields List<string>
    A list of fields to group records by
    IsPrototype bool
    Whether the generated Signals should be prototype Signals
    MatchExpression string
    The expression for which records to match on
    Name string
    The name of the Rule
    NameExpression string
    The name of the generated Signals
    RetentionWindowSize string
    The retention window size in milliseconds
    Severity int
    The severity of the generated Signals
    SummaryExpression string
    The summary of the generated Signals
    SuppressionWindowSize int

    For how long to suppress Signal generation, in milliseconds. Must be greater than window_size and less than the global limit of 7 days.

    The following attributes are exported:

    Tags List<string>
    The tags of the generated Signals
    WindowSize string
    The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
    AggregationFunctions CseOutlierRuleAggregationFunctionsArgs
    BaselineWindowSize string
    The baseline window size in milliseconds
    DescriptionExpression string
    The description of the generated Signals
    DeviationThreshold int
    The deviation threshold used to calculate the threshold to trigger signals
    Enabled bool
    Whether the rule should generate Signals
    EntitySelectors []CseOutlierRuleEntitySelectorArgs
    The entities to generate Signals on
    FloorValue int
    The minimum threshold to trigger signals
    GroupByFields []string
    A list of fields to group records by
    IsPrototype bool
    Whether the generated Signals should be prototype Signals
    MatchExpression string
    The expression for which records to match on
    Name string
    The name of the Rule
    NameExpression string
    The name of the generated Signals
    RetentionWindowSize string
    The retention window size in milliseconds
    Severity int
    The severity of the generated Signals
    SummaryExpression string
    The summary of the generated Signals
    SuppressionWindowSize int

    For how long to suppress Signal generation, in milliseconds. Must be greater than window_size and less than the global limit of 7 days.

    The following attributes are exported:

    Tags []string
    The tags of the generated Signals
    WindowSize string
    The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
    aggregationFunctions CseOutlierRuleAggregationFunctions
    baselineWindowSize String
    The baseline window size in milliseconds
    descriptionExpression String
    The description of the generated Signals
    deviationThreshold Integer
    The deviation threshold used to calculate the threshold to trigger signals
    enabled Boolean
    Whether the rule should generate Signals
    entitySelectors List<CseOutlierRuleEntitySelector>
    The entities to generate Signals on
    floorValue Integer
    The minimum threshold to trigger signals
    groupByFields List<String>
    A list of fields to group records by
    isPrototype Boolean
    Whether the generated Signals should be prototype Signals
    matchExpression String
    The expression for which records to match on
    name String
    The name of the Rule
    nameExpression String
    The name of the generated Signals
    retentionWindowSize String
    The retention window size in milliseconds
    severity Integer
    The severity of the generated Signals
    summaryExpression String
    The summary of the generated Signals
    suppressionWindowSize Integer

    For how long to suppress Signal generation, in milliseconds. Must be greater than window_size and less than the global limit of 7 days.

    The following attributes are exported:

    tags List<String>
    The tags of the generated Signals
    windowSize String
    The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
    aggregationFunctions CseOutlierRuleAggregationFunctions
    baselineWindowSize string
    The baseline window size in milliseconds
    descriptionExpression string
    The description of the generated Signals
    deviationThreshold number
    The deviation threshold used to calculate the threshold to trigger signals
    enabled boolean
    Whether the rule should generate Signals
    entitySelectors CseOutlierRuleEntitySelector[]
    The entities to generate Signals on
    floorValue number
    The minimum threshold to trigger signals
    groupByFields string[]
    A list of fields to group records by
    isPrototype boolean
    Whether the generated Signals should be prototype Signals
    matchExpression string
    The expression for which records to match on
    name string
    The name of the Rule
    nameExpression string
    The name of the generated Signals
    retentionWindowSize string
    The retention window size in milliseconds
    severity number
    The severity of the generated Signals
    summaryExpression string
    The summary of the generated Signals
    suppressionWindowSize number

    For how long to suppress Signal generation, in milliseconds. Must be greater than window_size and less than the global limit of 7 days.

    The following attributes are exported:

    tags string[]
    The tags of the generated Signals
    windowSize string
    The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
    aggregation_functions CseOutlierRuleAggregationFunctionsArgs
    baseline_window_size str
    The baseline window size in milliseconds
    description_expression str
    The description of the generated Signals
    deviation_threshold int
    The deviation threshold used to calculate the threshold to trigger signals
    enabled bool
    Whether the rule should generate Signals
    entity_selectors Sequence[CseOutlierRuleEntitySelectorArgs]
    The entities to generate Signals on
    floor_value int
    The minimum threshold to trigger signals
    group_by_fields Sequence[str]
    A list of fields to group records by
    is_prototype bool
    Whether the generated Signals should be prototype Signals
    match_expression str
    The expression for which records to match on
    name str
    The name of the Rule
    name_expression str
    The name of the generated Signals
    retention_window_size str
    The retention window size in milliseconds
    severity int
    The severity of the generated Signals
    summary_expression str
    The summary of the generated Signals
    suppression_window_size int

    For how long to suppress Signal generation, in milliseconds. Must be greater than window_size and less than the global limit of 7 days.

    The following attributes are exported:

    tags Sequence[str]
    The tags of the generated Signals
    window_size str
    The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
    aggregationFunctions Property Map
    baselineWindowSize String
    The baseline window size in milliseconds
    descriptionExpression String
    The description of the generated Signals
    deviationThreshold Number
    The deviation threshold used to calculate the threshold to trigger signals
    enabled Boolean
    Whether the rule should generate Signals
    entitySelectors List<Property Map>
    The entities to generate Signals on
    floorValue Number
    The minimum threshold to trigger signals
    groupByFields List<String>
    A list of fields to group records by
    isPrototype Boolean
    Whether the generated Signals should be prototype Signals
    matchExpression String
    The expression for which records to match on
    name String
    The name of the Rule
    nameExpression String
    The name of the generated Signals
    retentionWindowSize String
    The retention window size in milliseconds
    severity Number
    The severity of the generated Signals
    summaryExpression String
    The summary of the generated Signals
    suppressionWindowSize Number

    For how long to suppress Signal generation, in milliseconds. Must be greater than window_size and less than the global limit of 7 days.

    The following attributes are exported:

    tags List<String>
    The tags of the generated Signals
    windowSize String
    The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)

    Supporting Types

    CseOutlierRuleAggregationFunctions, CseOutlierRuleAggregationFunctionsArgs

    Arguments List<string>
    One or more expressions to pass as arguments to the function
    Function string
    The function to aggregate with
    Name string
    The name of the Rule
    Arguments []string
    One or more expressions to pass as arguments to the function
    Function string
    The function to aggregate with
    Name string
    The name of the Rule
    arguments List<String>
    One or more expressions to pass as arguments to the function
    function String
    The function to aggregate with
    name String
    The name of the Rule
    arguments string[]
    One or more expressions to pass as arguments to the function
    function string
    The function to aggregate with
    name string
    The name of the Rule
    arguments Sequence[str]
    One or more expressions to pass as arguments to the function
    function str
    The function to aggregate with
    name str
    The name of the Rule
    arguments List<String>
    One or more expressions to pass as arguments to the function
    function String
    The function to aggregate with
    name String
    The name of the Rule

    CseOutlierRuleEntitySelector, CseOutlierRuleEntitySelectorArgs

    EntityType string
    Expression string
    The expression or field name to generate the Signal on
    EntityType string
    Expression string
    The expression or field name to generate the Signal on
    entityType String
    expression String
    The expression or field name to generate the Signal on
    entityType string
    expression string
    The expression or field name to generate the Signal on
    entity_type str
    expression str
    The expression or field name to generate the Signal on
    entityType String
    expression String
    The expression or field name to generate the Signal on

    Import

    Outlier rules can be imported using the field id, e.g.:

    hcl

    $ pulumi import sumologic:index/cseOutlierRule:CseOutlierRule outlier_rule id
    

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Sumo Logic pulumi/pulumi-sumologic
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the sumologic Terraform Provider.
    sumologic logo
    Sumo Logic v0.21.0 published on Thursday, Apr 11, 2024 by Pulumi