1. Packages
  2. Alibaba Cloud
  3. API Docs
  4. threatdetection
  5. ClientUserDefineRule
Alibaba Cloud v3.54.0 published on Wednesday, Apr 24, 2024 by Pulumi

alicloud.threatdetection.ClientUserDefineRule

Explore with Pulumi AI

alicloud logo
Alibaba Cloud v3.54.0 published on Wednesday, Apr 24, 2024 by Pulumi

    Provides a Threat Detection Client User Define Rule resource. Malicious Behavior Defense Custom Rules.

    For information about Threat Detection Client User Define Rule and how to use it, see What is Client User Define Rule.

    NOTE: Available since v1.212.0.

    Example Usage

    Basic Usage

    import * as pulumi from "@pulumi/pulumi";
    import * as alicloud from "@pulumi/alicloud";
    
    const config = new pulumi.Config();
    const name = config.get("name") || "terraform-example";
    const _default = new alicloud.threatdetection.ClientUserDefineRule("default", {
        actionType: 0,
        platform: "windows",
        registryContent: "123",
        clientUserDefineRuleName: name,
        parentProcPath: "/root/bash",
        type: 5,
        cmdline: "bash",
        procPath: "/root/bash",
        parentCmdline: "bash",
        registryKey: "123",
    });
    
    import pulumi
    import pulumi_alicloud as alicloud
    
    config = pulumi.Config()
    name = config.get("name")
    if name is None:
        name = "terraform-example"
    default = alicloud.threatdetection.ClientUserDefineRule("default",
        action_type=0,
        platform="windows",
        registry_content="123",
        client_user_define_rule_name=name,
        parent_proc_path="/root/bash",
        type=5,
        cmdline="bash",
        proc_path="/root/bash",
        parent_cmdline="bash",
        registry_key="123")
    
    package main
    
    import (
    	"github.com/pulumi/pulumi-alicloud/sdk/v3/go/alicloud/threatdetection"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		cfg := config.New(ctx, "")
    		name := "terraform-example"
    		if param := cfg.Get("name"); param != "" {
    			name = param
    		}
    		_, err := threatdetection.NewClientUserDefineRule(ctx, "default", &threatdetection.ClientUserDefineRuleArgs{
    			ActionType:               pulumi.Int(0),
    			Platform:                 pulumi.String("windows"),
    			RegistryContent:          pulumi.String("123"),
    			ClientUserDefineRuleName: pulumi.String(name),
    			ParentProcPath:           pulumi.String("/root/bash"),
    			Type:                     pulumi.Int(5),
    			Cmdline:                  pulumi.String("bash"),
    			ProcPath:                 pulumi.String("/root/bash"),
    			ParentCmdline:            pulumi.String("bash"),
    			RegistryKey:              pulumi.String("123"),
    		})
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using AliCloud = Pulumi.AliCloud;
    
    return await Deployment.RunAsync(() => 
    {
        var config = new Config();
        var name = config.Get("name") ?? "terraform-example";
        var @default = new AliCloud.ThreatDetection.ClientUserDefineRule("default", new()
        {
            ActionType = 0,
            Platform = "windows",
            RegistryContent = "123",
            ClientUserDefineRuleName = name,
            ParentProcPath = "/root/bash",
            Type = 5,
            Cmdline = "bash",
            ProcPath = "/root/bash",
            ParentCmdline = "bash",
            RegistryKey = "123",
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.alicloud.threatdetection.ClientUserDefineRule;
    import com.pulumi.alicloud.threatdetection.ClientUserDefineRuleArgs;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            final var config = ctx.config();
            final var name = config.get("name").orElse("terraform-example");
            var default_ = new ClientUserDefineRule("default", ClientUserDefineRuleArgs.builder()        
                .actionType("0")
                .platform("windows")
                .registryContent("123")
                .clientUserDefineRuleName(name)
                .parentProcPath("/root/bash")
                .type("5")
                .cmdline("bash")
                .procPath("/root/bash")
                .parentCmdline("bash")
                .registryKey("123")
                .build());
    
        }
    }
    
    configuration:
      name:
        type: string
        default: terraform-example
    resources:
      default:
        type: alicloud:threatdetection:ClientUserDefineRule
        properties:
          actionType: '0'
          platform: windows
          registryContent: '123'
          clientUserDefineRuleName: ${name}
          parentProcPath: /root/bash
          type: '5'
          cmdline: bash
          procPath: /root/bash
          parentCmdline: bash
          registryKey: '123'
    

    Create ClientUserDefineRule Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new ClientUserDefineRule(name: string, args: ClientUserDefineRuleArgs, opts?: CustomResourceOptions);
    @overload
    def ClientUserDefineRule(resource_name: str,
                             args: ClientUserDefineRuleArgs,
                             opts: Optional[ResourceOptions] = None)
    
    @overload
    def ClientUserDefineRule(resource_name: str,
                             opts: Optional[ResourceOptions] = None,
                             platform: Optional[str] = None,
                             client_user_define_rule_name: Optional[str] = None,
                             type: Optional[int] = None,
                             action_type: Optional[int] = None,
                             file_path: Optional[str] = None,
                             ip: Optional[str] = None,
                             new_file_path: Optional[str] = None,
                             parent_cmdline: Optional[str] = None,
                             parent_proc_path: Optional[str] = None,
                             hash: Optional[str] = None,
                             port_str: Optional[str] = None,
                             proc_path: Optional[str] = None,
                             registry_content: Optional[str] = None,
                             registry_key: Optional[str] = None,
                             cmdline: Optional[str] = None)
    func NewClientUserDefineRule(ctx *Context, name string, args ClientUserDefineRuleArgs, opts ...ResourceOption) (*ClientUserDefineRule, error)
    public ClientUserDefineRule(string name, ClientUserDefineRuleArgs args, CustomResourceOptions? opts = null)
    public ClientUserDefineRule(String name, ClientUserDefineRuleArgs args)
    public ClientUserDefineRule(String name, ClientUserDefineRuleArgs args, CustomResourceOptions options)
    
    type: alicloud:threatdetection:ClientUserDefineRule
    properties: # The arguments to resource properties.
    options: # Bag of options to control resource's behavior.
    
    

    Parameters

    name string
    The unique name of the resource.
    args ClientUserDefineRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ClientUserDefineRuleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ClientUserDefineRuleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ClientUserDefineRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ClientUserDefineRuleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Example

    The following reference example uses placeholder values for all input properties.

    var clientUserDefineRuleResource = new AliCloud.ThreatDetection.ClientUserDefineRule("clientUserDefineRuleResource", new()
    {
        Platform = "string",
        ClientUserDefineRuleName = "string",
        Type = 0,
        ActionType = 0,
        FilePath = "string",
        Ip = "string",
        NewFilePath = "string",
        ParentCmdline = "string",
        ParentProcPath = "string",
        Hash = "string",
        PortStr = "string",
        ProcPath = "string",
        RegistryContent = "string",
        RegistryKey = "string",
        Cmdline = "string",
    });
    
    example, err := threatdetection.NewClientUserDefineRule(ctx, "clientUserDefineRuleResource", &threatdetection.ClientUserDefineRuleArgs{
    	Platform:                 pulumi.String("string"),
    	ClientUserDefineRuleName: pulumi.String("string"),
    	Type:                     pulumi.Int(0),
    	ActionType:               pulumi.Int(0),
    	FilePath:                 pulumi.String("string"),
    	Ip:                       pulumi.String("string"),
    	NewFilePath:              pulumi.String("string"),
    	ParentCmdline:            pulumi.String("string"),
    	ParentProcPath:           pulumi.String("string"),
    	Hash:                     pulumi.String("string"),
    	PortStr:                  pulumi.String("string"),
    	ProcPath:                 pulumi.String("string"),
    	RegistryContent:          pulumi.String("string"),
    	RegistryKey:              pulumi.String("string"),
    	Cmdline:                  pulumi.String("string"),
    })
    
    var clientUserDefineRuleResource = new ClientUserDefineRule("clientUserDefineRuleResource", ClientUserDefineRuleArgs.builder()        
        .platform("string")
        .clientUserDefineRuleName("string")
        .type(0)
        .actionType(0)
        .filePath("string")
        .ip("string")
        .newFilePath("string")
        .parentCmdline("string")
        .parentProcPath("string")
        .hash("string")
        .portStr("string")
        .procPath("string")
        .registryContent("string")
        .registryKey("string")
        .cmdline("string")
        .build());
    
    client_user_define_rule_resource = alicloud.threatdetection.ClientUserDefineRule("clientUserDefineRuleResource",
        platform="string",
        client_user_define_rule_name="string",
        type=0,
        action_type=0,
        file_path="string",
        ip="string",
        new_file_path="string",
        parent_cmdline="string",
        parent_proc_path="string",
        hash="string",
        port_str="string",
        proc_path="string",
        registry_content="string",
        registry_key="string",
        cmdline="string")
    
    const clientUserDefineRuleResource = new alicloud.threatdetection.ClientUserDefineRule("clientUserDefineRuleResource", {
        platform: "string",
        clientUserDefineRuleName: "string",
        type: 0,
        actionType: 0,
        filePath: "string",
        ip: "string",
        newFilePath: "string",
        parentCmdline: "string",
        parentProcPath: "string",
        hash: "string",
        portStr: "string",
        procPath: "string",
        registryContent: "string",
        registryKey: "string",
        cmdline: "string",
    });
    
    type: alicloud:threatdetection:ClientUserDefineRule
    properties:
        actionType: 0
        clientUserDefineRuleName: string
        cmdline: string
        filePath: string
        hash: string
        ip: string
        newFilePath: string
        parentCmdline: string
        parentProcPath: string
        platform: string
        portStr: string
        procPath: string
        registryContent: string
        registryKey: string
        type: 0
    

    ClientUserDefineRule Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    The ClientUserDefineRule resource accepts the following input properties:

    ActionType int
    The operation type. Value:

    • 0: plus White
    • 1: Plus Black.
    ClientUserDefineRuleName string
    The custom rule name.
    Platform string
    The operating system type. Value:

    • windows:widows
    • linux:linux
    • all: all.
    Type int
    The rule type. Value:

    • 1: Process hash
    • 2: command line
    • 3: Process network
    • 4: File reading and writing
    • 5: Operate the registry
    • 6: Load Dynamic Link Library
    • 7: File Rename.
    Cmdline string
    Command line. When the value of the Type attribute is 2, 3, 4, 5, 6, or 7, the command line field is required.
    FilePath string
    The file path. When the value of the Type attribute is 4 or 6, 7, the FilePath field is required.
    Hash string
    Process hash list. When the value of the Type attribute is 1, the Hash attribute is required.
    Ip string
    IP address. When the value of the Type attribute is 3, the Ip attribute is required.
    NewFilePath string
    The new file path to rename the file. When the value of the Type attribute is 7, the NewFilePath attribute is required.
    ParentCmdline string
    The parent command line.
    ParentProcPath string
    Parent process path.
    PortStr string
    The port number. When the value of the Type attribute is 3, the PortStr attribute is required. Value range: 1-65535.
    ProcPath string
    The process path. When the Type attribute is set to 2, 3, 4, 5, 6, or 7, the ProcPath attribute is required.
    RegistryContent string
    The registry value. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    RegistryKey string
    The registry key. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    ActionType int
    The operation type. Value:

    • 0: plus White
    • 1: Plus Black.
    ClientUserDefineRuleName string
    The custom rule name.
    Platform string
    The operating system type. Value:

    • windows:widows
    • linux:linux
    • all: all.
    Type int
    The rule type. Value:

    • 1: Process hash
    • 2: command line
    • 3: Process network
    • 4: File reading and writing
    • 5: Operate the registry
    • 6: Load Dynamic Link Library
    • 7: File Rename.
    Cmdline string
    Command line. When the value of the Type attribute is 2, 3, 4, 5, 6, or 7, the command line field is required.
    FilePath string
    The file path. When the value of the Type attribute is 4 or 6, 7, the FilePath field is required.
    Hash string
    Process hash list. When the value of the Type attribute is 1, the Hash attribute is required.
    Ip string
    IP address. When the value of the Type attribute is 3, the Ip attribute is required.
    NewFilePath string
    The new file path to rename the file. When the value of the Type attribute is 7, the NewFilePath attribute is required.
    ParentCmdline string
    The parent command line.
    ParentProcPath string
    Parent process path.
    PortStr string
    The port number. When the value of the Type attribute is 3, the PortStr attribute is required. Value range: 1-65535.
    ProcPath string
    The process path. When the Type attribute is set to 2, 3, 4, 5, 6, or 7, the ProcPath attribute is required.
    RegistryContent string
    The registry value. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    RegistryKey string
    The registry key. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    actionType Integer
    The operation type. Value:

    • 0: plus White
    • 1: Plus Black.
    clientUserDefineRuleName String
    The custom rule name.
    platform String
    The operating system type. Value:

    • windows:widows
    • linux:linux
    • all: all.
    type Integer
    The rule type. Value:

    • 1: Process hash
    • 2: command line
    • 3: Process network
    • 4: File reading and writing
    • 5: Operate the registry
    • 6: Load Dynamic Link Library
    • 7: File Rename.
    cmdline String
    Command line. When the value of the Type attribute is 2, 3, 4, 5, 6, or 7, the command line field is required.
    filePath String
    The file path. When the value of the Type attribute is 4 or 6, 7, the FilePath field is required.
    hash String
    Process hash list. When the value of the Type attribute is 1, the Hash attribute is required.
    ip String
    IP address. When the value of the Type attribute is 3, the Ip attribute is required.
    newFilePath String
    The new file path to rename the file. When the value of the Type attribute is 7, the NewFilePath attribute is required.
    parentCmdline String
    The parent command line.
    parentProcPath String
    Parent process path.
    portStr String
    The port number. When the value of the Type attribute is 3, the PortStr attribute is required. Value range: 1-65535.
    procPath String
    The process path. When the Type attribute is set to 2, 3, 4, 5, 6, or 7, the ProcPath attribute is required.
    registryContent String
    The registry value. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    registryKey String
    The registry key. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    actionType number
    The operation type. Value:

    • 0: plus White
    • 1: Plus Black.
    clientUserDefineRuleName string
    The custom rule name.
    platform string
    The operating system type. Value:

    • windows:widows
    • linux:linux
    • all: all.
    type number
    The rule type. Value:

    • 1: Process hash
    • 2: command line
    • 3: Process network
    • 4: File reading and writing
    • 5: Operate the registry
    • 6: Load Dynamic Link Library
    • 7: File Rename.
    cmdline string
    Command line. When the value of the Type attribute is 2, 3, 4, 5, 6, or 7, the command line field is required.
    filePath string
    The file path. When the value of the Type attribute is 4 or 6, 7, the FilePath field is required.
    hash string
    Process hash list. When the value of the Type attribute is 1, the Hash attribute is required.
    ip string
    IP address. When the value of the Type attribute is 3, the Ip attribute is required.
    newFilePath string
    The new file path to rename the file. When the value of the Type attribute is 7, the NewFilePath attribute is required.
    parentCmdline string
    The parent command line.
    parentProcPath string
    Parent process path.
    portStr string
    The port number. When the value of the Type attribute is 3, the PortStr attribute is required. Value range: 1-65535.
    procPath string
    The process path. When the Type attribute is set to 2, 3, 4, 5, 6, or 7, the ProcPath attribute is required.
    registryContent string
    The registry value. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    registryKey string
    The registry key. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    action_type int
    The operation type. Value:

    • 0: plus White
    • 1: Plus Black.
    client_user_define_rule_name str
    The custom rule name.
    platform str
    The operating system type. Value:

    • windows:widows
    • linux:linux
    • all: all.
    type int
    The rule type. Value:

    • 1: Process hash
    • 2: command line
    • 3: Process network
    • 4: File reading and writing
    • 5: Operate the registry
    • 6: Load Dynamic Link Library
    • 7: File Rename.
    cmdline str
    Command line. When the value of the Type attribute is 2, 3, 4, 5, 6, or 7, the command line field is required.
    file_path str
    The file path. When the value of the Type attribute is 4 or 6, 7, the FilePath field is required.
    hash str
    Process hash list. When the value of the Type attribute is 1, the Hash attribute is required.
    ip str
    IP address. When the value of the Type attribute is 3, the Ip attribute is required.
    new_file_path str
    The new file path to rename the file. When the value of the Type attribute is 7, the NewFilePath attribute is required.
    parent_cmdline str
    The parent command line.
    parent_proc_path str
    Parent process path.
    port_str str
    The port number. When the value of the Type attribute is 3, the PortStr attribute is required. Value range: 1-65535.
    proc_path str
    The process path. When the Type attribute is set to 2, 3, 4, 5, 6, or 7, the ProcPath attribute is required.
    registry_content str
    The registry value. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    registry_key str
    The registry key. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    actionType Number
    The operation type. Value:

    • 0: plus White
    • 1: Plus Black.
    clientUserDefineRuleName String
    The custom rule name.
    platform String
    The operating system type. Value:

    • windows:widows
    • linux:linux
    • all: all.
    type Number
    The rule type. Value:

    • 1: Process hash
    • 2: command line
    • 3: Process network
    • 4: File reading and writing
    • 5: Operate the registry
    • 6: Load Dynamic Link Library
    • 7: File Rename.
    cmdline String
    Command line. When the value of the Type attribute is 2, 3, 4, 5, 6, or 7, the command line field is required.
    filePath String
    The file path. When the value of the Type attribute is 4 or 6, 7, the FilePath field is required.
    hash String
    Process hash list. When the value of the Type attribute is 1, the Hash attribute is required.
    ip String
    IP address. When the value of the Type attribute is 3, the Ip attribute is required.
    newFilePath String
    The new file path to rename the file. When the value of the Type attribute is 7, the NewFilePath attribute is required.
    parentCmdline String
    The parent command line.
    parentProcPath String
    Parent process path.
    portStr String
    The port number. When the value of the Type attribute is 3, the PortStr attribute is required. Value range: 1-65535.
    procPath String
    The process path. When the Type attribute is set to 2, 3, 4, 5, 6, or 7, the ProcPath attribute is required.
    registryContent String
    The registry value. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    registryKey String
    The registry key. When the value of the Type attribute is 5, the RegistryKey attribute is required.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ClientUserDefineRule resource produces the following output properties:

    CreateTime int
    The creation time of the resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    CreateTime int
    The creation time of the resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    createTime Integer
    The creation time of the resource.
    id String
    The provider-assigned unique ID for this managed resource.
    createTime number
    The creation time of the resource.
    id string
    The provider-assigned unique ID for this managed resource.
    create_time int
    The creation time of the resource.
    id str
    The provider-assigned unique ID for this managed resource.
    createTime Number
    The creation time of the resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing ClientUserDefineRule Resource

    Get an existing ClientUserDefineRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: ClientUserDefineRuleState, opts?: CustomResourceOptions): ClientUserDefineRule
    @staticmethod
    def get(resource_name: str,
            id: str,
            opts: Optional[ResourceOptions] = None,
            action_type: Optional[int] = None,
            client_user_define_rule_name: Optional[str] = None,
            cmdline: Optional[str] = None,
            create_time: Optional[int] = None,
            file_path: Optional[str] = None,
            hash: Optional[str] = None,
            ip: Optional[str] = None,
            new_file_path: Optional[str] = None,
            parent_cmdline: Optional[str] = None,
            parent_proc_path: Optional[str] = None,
            platform: Optional[str] = None,
            port_str: Optional[str] = None,
            proc_path: Optional[str] = None,
            registry_content: Optional[str] = None,
            registry_key: Optional[str] = None,
            type: Optional[int] = None) -> ClientUserDefineRule
    func GetClientUserDefineRule(ctx *Context, name string, id IDInput, state *ClientUserDefineRuleState, opts ...ResourceOption) (*ClientUserDefineRule, error)
    public static ClientUserDefineRule Get(string name, Input<string> id, ClientUserDefineRuleState? state, CustomResourceOptions? opts = null)
    public static ClientUserDefineRule get(String name, Output<String> id, ClientUserDefineRuleState state, CustomResourceOptions options)
    Resource lookup is not supported in YAML
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    ActionType int
    The operation type. Value:

    • 0: plus White
    • 1: Plus Black.
    ClientUserDefineRuleName string
    The custom rule name.
    Cmdline string
    Command line. When the value of the Type attribute is 2, 3, 4, 5, 6, or 7, the command line field is required.
    CreateTime int
    The creation time of the resource.
    FilePath string
    The file path. When the value of the Type attribute is 4 or 6, 7, the FilePath field is required.
    Hash string
    Process hash list. When the value of the Type attribute is 1, the Hash attribute is required.
    Ip string
    IP address. When the value of the Type attribute is 3, the Ip attribute is required.
    NewFilePath string
    The new file path to rename the file. When the value of the Type attribute is 7, the NewFilePath attribute is required.
    ParentCmdline string
    The parent command line.
    ParentProcPath string
    Parent process path.
    Platform string
    The operating system type. Value:

    • windows:widows
    • linux:linux
    • all: all.
    PortStr string
    The port number. When the value of the Type attribute is 3, the PortStr attribute is required. Value range: 1-65535.
    ProcPath string
    The process path. When the Type attribute is set to 2, 3, 4, 5, 6, or 7, the ProcPath attribute is required.
    RegistryContent string
    The registry value. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    RegistryKey string
    The registry key. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    Type int
    The rule type. Value:

    • 1: Process hash
    • 2: command line
    • 3: Process network
    • 4: File reading and writing
    • 5: Operate the registry
    • 6: Load Dynamic Link Library
    • 7: File Rename.
    ActionType int
    The operation type. Value:

    • 0: plus White
    • 1: Plus Black.
    ClientUserDefineRuleName string
    The custom rule name.
    Cmdline string
    Command line. When the value of the Type attribute is 2, 3, 4, 5, 6, or 7, the command line field is required.
    CreateTime int
    The creation time of the resource.
    FilePath string
    The file path. When the value of the Type attribute is 4 or 6, 7, the FilePath field is required.
    Hash string
    Process hash list. When the value of the Type attribute is 1, the Hash attribute is required.
    Ip string
    IP address. When the value of the Type attribute is 3, the Ip attribute is required.
    NewFilePath string
    The new file path to rename the file. When the value of the Type attribute is 7, the NewFilePath attribute is required.
    ParentCmdline string
    The parent command line.
    ParentProcPath string
    Parent process path.
    Platform string
    The operating system type. Value:

    • windows:widows
    • linux:linux
    • all: all.
    PortStr string
    The port number. When the value of the Type attribute is 3, the PortStr attribute is required. Value range: 1-65535.
    ProcPath string
    The process path. When the Type attribute is set to 2, 3, 4, 5, 6, or 7, the ProcPath attribute is required.
    RegistryContent string
    The registry value. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    RegistryKey string
    The registry key. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    Type int
    The rule type. Value:

    • 1: Process hash
    • 2: command line
    • 3: Process network
    • 4: File reading and writing
    • 5: Operate the registry
    • 6: Load Dynamic Link Library
    • 7: File Rename.
    actionType Integer
    The operation type. Value:

    • 0: plus White
    • 1: Plus Black.
    clientUserDefineRuleName String
    The custom rule name.
    cmdline String
    Command line. When the value of the Type attribute is 2, 3, 4, 5, 6, or 7, the command line field is required.
    createTime Integer
    The creation time of the resource.
    filePath String
    The file path. When the value of the Type attribute is 4 or 6, 7, the FilePath field is required.
    hash String
    Process hash list. When the value of the Type attribute is 1, the Hash attribute is required.
    ip String
    IP address. When the value of the Type attribute is 3, the Ip attribute is required.
    newFilePath String
    The new file path to rename the file. When the value of the Type attribute is 7, the NewFilePath attribute is required.
    parentCmdline String
    The parent command line.
    parentProcPath String
    Parent process path.
    platform String
    The operating system type. Value:

    • windows:widows
    • linux:linux
    • all: all.
    portStr String
    The port number. When the value of the Type attribute is 3, the PortStr attribute is required. Value range: 1-65535.
    procPath String
    The process path. When the Type attribute is set to 2, 3, 4, 5, 6, or 7, the ProcPath attribute is required.
    registryContent String
    The registry value. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    registryKey String
    The registry key. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    type Integer
    The rule type. Value:

    • 1: Process hash
    • 2: command line
    • 3: Process network
    • 4: File reading and writing
    • 5: Operate the registry
    • 6: Load Dynamic Link Library
    • 7: File Rename.
    actionType number
    The operation type. Value:

    • 0: plus White
    • 1: Plus Black.
    clientUserDefineRuleName string
    The custom rule name.
    cmdline string
    Command line. When the value of the Type attribute is 2, 3, 4, 5, 6, or 7, the command line field is required.
    createTime number
    The creation time of the resource.
    filePath string
    The file path. When the value of the Type attribute is 4 or 6, 7, the FilePath field is required.
    hash string
    Process hash list. When the value of the Type attribute is 1, the Hash attribute is required.
    ip string
    IP address. When the value of the Type attribute is 3, the Ip attribute is required.
    newFilePath string
    The new file path to rename the file. When the value of the Type attribute is 7, the NewFilePath attribute is required.
    parentCmdline string
    The parent command line.
    parentProcPath string
    Parent process path.
    platform string
    The operating system type. Value:

    • windows:widows
    • linux:linux
    • all: all.
    portStr string
    The port number. When the value of the Type attribute is 3, the PortStr attribute is required. Value range: 1-65535.
    procPath string
    The process path. When the Type attribute is set to 2, 3, 4, 5, 6, or 7, the ProcPath attribute is required.
    registryContent string
    The registry value. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    registryKey string
    The registry key. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    type number
    The rule type. Value:

    • 1: Process hash
    • 2: command line
    • 3: Process network
    • 4: File reading and writing
    • 5: Operate the registry
    • 6: Load Dynamic Link Library
    • 7: File Rename.
    action_type int
    The operation type. Value:

    • 0: plus White
    • 1: Plus Black.
    client_user_define_rule_name str
    The custom rule name.
    cmdline str
    Command line. When the value of the Type attribute is 2, 3, 4, 5, 6, or 7, the command line field is required.
    create_time int
    The creation time of the resource.
    file_path str
    The file path. When the value of the Type attribute is 4 or 6, 7, the FilePath field is required.
    hash str
    Process hash list. When the value of the Type attribute is 1, the Hash attribute is required.
    ip str
    IP address. When the value of the Type attribute is 3, the Ip attribute is required.
    new_file_path str
    The new file path to rename the file. When the value of the Type attribute is 7, the NewFilePath attribute is required.
    parent_cmdline str
    The parent command line.
    parent_proc_path str
    Parent process path.
    platform str
    The operating system type. Value:

    • windows:widows
    • linux:linux
    • all: all.
    port_str str
    The port number. When the value of the Type attribute is 3, the PortStr attribute is required. Value range: 1-65535.
    proc_path str
    The process path. When the Type attribute is set to 2, 3, 4, 5, 6, or 7, the ProcPath attribute is required.
    registry_content str
    The registry value. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    registry_key str
    The registry key. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    type int
    The rule type. Value:

    • 1: Process hash
    • 2: command line
    • 3: Process network
    • 4: File reading and writing
    • 5: Operate the registry
    • 6: Load Dynamic Link Library
    • 7: File Rename.
    actionType Number
    The operation type. Value:

    • 0: plus White
    • 1: Plus Black.
    clientUserDefineRuleName String
    The custom rule name.
    cmdline String
    Command line. When the value of the Type attribute is 2, 3, 4, 5, 6, or 7, the command line field is required.
    createTime Number
    The creation time of the resource.
    filePath String
    The file path. When the value of the Type attribute is 4 or 6, 7, the FilePath field is required.
    hash String
    Process hash list. When the value of the Type attribute is 1, the Hash attribute is required.
    ip String
    IP address. When the value of the Type attribute is 3, the Ip attribute is required.
    newFilePath String
    The new file path to rename the file. When the value of the Type attribute is 7, the NewFilePath attribute is required.
    parentCmdline String
    The parent command line.
    parentProcPath String
    Parent process path.
    platform String
    The operating system type. Value:

    • windows:widows
    • linux:linux
    • all: all.
    portStr String
    The port number. When the value of the Type attribute is 3, the PortStr attribute is required. Value range: 1-65535.
    procPath String
    The process path. When the Type attribute is set to 2, 3, 4, 5, 6, or 7, the ProcPath attribute is required.
    registryContent String
    The registry value. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    registryKey String
    The registry key. When the value of the Type attribute is 5, the RegistryKey attribute is required.
    type Number
    The rule type. Value:

    • 1: Process hash
    • 2: command line
    • 3: Process network
    • 4: File reading and writing
    • 5: Operate the registry
    • 6: Load Dynamic Link Library
    • 7: File Rename.

    Import

    Threat Detection Client User Define Rule can be imported using the id, e.g.

    $ pulumi import alicloud:threatdetection/clientUserDefineRule:ClientUserDefineRule example <id>
    

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Alibaba Cloud pulumi/pulumi-alicloud
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the alicloud Terraform Provider.
    alicloud logo
    Alibaba Cloud v3.54.0 published on Wednesday, Apr 24, 2024 by Pulumi