Azure Native v1.98.1, Mar 24 23

azure-native.securityinsights.AnomalySecurityMLAnalyticsSettings

Represents Anomaly Security ML Analytics Settings API Version: 2022-05-01-preview.

Example Usage

Creates or updates a Anomaly Security ML Analytics Settings.

using System.Collections.Generic;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var anomalySecurityMLAnalyticsSettings = new AzureNative.SecurityInsights.AnomalySecurityMLAnalyticsSettings("anomalySecurityMLAnalyticsSettings", new()
    {
        AnomalySettingsVersion = 0,
        AnomalyVersion = "1.0.5",
        CustomizableObservations = 
        {
            { "multiSelectObservations", null },
            { "prioritizeExcludeObservations", null },
            { "singleSelectObservations", new[]
            {
                
                {
                    { "description", "Select device vendor of network connection logs from CommonSecurityLog" },
                    { "name", "Device vendor" },
                    { "rerun", "RerunAlways" },
                    { "sequenceNumber", 1 },
                    { "supportedValues", new[]
                    {
                        "Palo Alto Networks",
                        "Fortinet",
                        "Check Point",
                    } },
                    { "supportedValuesKql", null },
                    { "value", new[]
                    {
                        "Palo Alto Networks",
                    } },
                    { "valuesKql", null },
                },
            } },
            { "singleValueObservations", null },
            { "thresholdObservations", new[]
            {
                
                {
                    { "description", "Suppress anomalies when daily data transfered (in MB) per hour is less than the chosen value" },
                    { "maximum", "100" },
                    { "minimum", "1" },
                    { "name", "Daily data transfer threshold in MB" },
                    { "rerun", "RerunAlways" },
                    { "sequenceNumber", 1 },
                    { "value", "25" },
                },
                
                {
                    { "description", "Triggers anomalies when number of standard deviations is greater than the chosen value" },
                    { "maximum", "10" },
                    { "minimum", "2" },
                    { "name", "Number of standard deviations" },
                    { "rerun", "RerunAlways" },
                    { "sequenceNumber", 2 },
                    { "value", "3" },
                },
            } },
        },
        Description = "When account logs from a source region that has rarely been logged in from during the last 14 days, an anomaly is triggered.",
        DisplayName = "Login from unusual region",
        Enabled = true,
        Frequency = "PT1H",
        IsDefaultSettings = true,
        Kind = "Anomaly",
        RequiredDataConnectors = new[]
        {
            new AzureNative.SecurityInsights.Inputs.SecurityMLAnalyticsSettingsDataSourceArgs
            {
                ConnectorId = "AWS",
                DataTypes = new[]
                {
                    "AWSCloudTrail",
                },
            },
        },
        ResourceGroupName = "myRg",
        SettingsDefinitionId = "f209187f-1d17-4431-94af-c141bf5f23db",
        SettingsResourceName = "f209187f-1d17-4431-94af-c141bf5f23db",
        SettingsStatus = "Production",
        Tactics = new[]
        {
            "Exfiltration",
            "CommandAndControl",
        },
        Techniques = new[]
        {
            "T1037",
            "T1021",
        },
        WorkspaceName = "myWorkspace",
    });

});

package main

import (
	securityinsights "github.com/pulumi/pulumi-azure-native/sdk/go/azure/securityinsights"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := securityinsights.NewAnomalySecurityMLAnalyticsSettings(ctx, "anomalySecurityMLAnalyticsSettings", &securityinsights.AnomalySecurityMLAnalyticsSettingsArgs{
			AnomalySettingsVersion: pulumi.Int(0),
			AnomalyVersion:         pulumi.String("1.0.5"),
			CustomizableObservations: pulumi.Any{
				MultiSelectObservations:       nil,
				PrioritizeExcludeObservations: nil,
				SingleSelectObservations: []map[string]interface{}{
					map[string]interface{}{
						"description":    "Select device vendor of network connection logs from CommonSecurityLog",
						"name":           "Device vendor",
						"rerun":          "RerunAlways",
						"sequenceNumber": 1,
						"supportedValues": []string{
							"Palo Alto Networks",
							"Fortinet",
							"Check Point",
						},
						"supportedValuesKql": nil,
						"value": []string{
							"Palo Alto Networks",
						},
						"valuesKql": nil,
					},
				},
				SingleValueObservations: nil,
				ThresholdObservations: []interface{}{
					map[string]interface{}{
						"description":    "Suppress anomalies when daily data transfered (in MB) per hour is less than the chosen value",
						"maximum":        "100",
						"minimum":        "1",
						"name":           "Daily data transfer threshold in MB",
						"rerun":          "RerunAlways",
						"sequenceNumber": 1,
						"value":          "25",
					},
					map[string]interface{}{
						"description":    "Triggers anomalies when number of standard deviations is greater than the chosen value",
						"maximum":        "10",
						"minimum":        "2",
						"name":           "Number of standard deviations",
						"rerun":          "RerunAlways",
						"sequenceNumber": 2,
						"value":          "3",
					},
				},
			},
			Description:       pulumi.String("When account logs from a source region that has rarely been logged in from during the last 14 days, an anomaly is triggered."),
			DisplayName:       pulumi.String("Login from unusual region"),
			Enabled:           pulumi.Bool(true),
			Frequency:         pulumi.String("PT1H"),
			IsDefaultSettings: pulumi.Bool(true),
			Kind:              pulumi.String("Anomaly"),
			RequiredDataConnectors: []securityinsights.SecurityMLAnalyticsSettingsDataSourceArgs{
				{
					ConnectorId: pulumi.String("AWS"),
					DataTypes: pulumi.StringArray{
						pulumi.String("AWSCloudTrail"),
					},
				},
			},
			ResourceGroupName:    pulumi.String("myRg"),
			SettingsDefinitionId: pulumi.String("f209187f-1d17-4431-94af-c141bf5f23db"),
			SettingsResourceName: pulumi.String("f209187f-1d17-4431-94af-c141bf5f23db"),
			SettingsStatus:       pulumi.String("Production"),
			Tactics: pulumi.StringArray{
				pulumi.String("Exfiltration"),
				pulumi.String("CommandAndControl"),
			},
			Techniques: pulumi.StringArray{
				pulumi.String("T1037"),
				pulumi.String("T1021"),
			},
			WorkspaceName: pulumi.String("myWorkspace"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.securityinsights.AnomalySecurityMLAnalyticsSettings;
import com.pulumi.azurenative.securityinsights.AnomalySecurityMLAnalyticsSettingsArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var anomalySecurityMLAnalyticsSettings = new AnomalySecurityMLAnalyticsSettings("anomalySecurityMLAnalyticsSettings", AnomalySecurityMLAnalyticsSettingsArgs.builder()        
            .anomalySettingsVersion(0)
            .anomalyVersion("1.0.5")
            .customizableObservations(Map.ofEntries(
                Map.entry("multiSelectObservations", null),
                Map.entry("prioritizeExcludeObservations", null),
                Map.entry("singleSelectObservations", Map.ofEntries(
                    Map.entry("description", "Select device vendor of network connection logs from CommonSecurityLog"),
                    Map.entry("name", "Device vendor"),
                    Map.entry("rerun", "RerunAlways"),
                    Map.entry("sequenceNumber", 1),
                    Map.entry("supportedValues",                     
                        "Palo Alto Networks",
                        "Fortinet",
                        "Check Point"),
                    Map.entry("supportedValuesKql", null),
                    Map.entry("value", "Palo Alto Networks"),
                    Map.entry("valuesKql", null)
                )),
                Map.entry("singleValueObservations", null),
                Map.entry("thresholdObservations",                 
                    Map.ofEntries(
                        Map.entry("description", "Suppress anomalies when daily data transfered (in MB) per hour is less than the chosen value"),
                        Map.entry("maximum", "100"),
                        Map.entry("minimum", "1"),
                        Map.entry("name", "Daily data transfer threshold in MB"),
                        Map.entry("rerun", "RerunAlways"),
                        Map.entry("sequenceNumber", 1),
                        Map.entry("value", "25")
                    ),
                    Map.ofEntries(
                        Map.entry("description", "Triggers anomalies when number of standard deviations is greater than the chosen value"),
                        Map.entry("maximum", "10"),
                        Map.entry("minimum", "2"),
                        Map.entry("name", "Number of standard deviations"),
                        Map.entry("rerun", "RerunAlways"),
                        Map.entry("sequenceNumber", 2),
                        Map.entry("value", "3")
                    ))
            ))
            .description("When account logs from a source region that has rarely been logged in from during the last 14 days, an anomaly is triggered.")
            .displayName("Login from unusual region")
            .enabled(true)
            .frequency("PT1H")
            .isDefaultSettings(true)
            .kind("Anomaly")
            .requiredDataConnectors(Map.ofEntries(
                Map.entry("connectorId", "AWS"),
                Map.entry("dataTypes", "AWSCloudTrail")
            ))
            .resourceGroupName("myRg")
            .settingsDefinitionId("f209187f-1d17-4431-94af-c141bf5f23db")
            .settingsResourceName("f209187f-1d17-4431-94af-c141bf5f23db")
            .settingsStatus("Production")
            .tactics(            
                "Exfiltration",
                "CommandAndControl")
            .techniques(            
                "T1037",
                "T1021")
            .workspaceName("myWorkspace")
            .build());

    }
}

import pulumi
import pulumi_azure_native as azure_native

anomaly_security_ml_analytics_settings = azure_native.securityinsights.AnomalySecurityMLAnalyticsSettings("anomalySecurityMLAnalyticsSettings",
    anomaly_settings_version=0,
    anomaly_version="1.0.5",
    customizable_observations={
        "multiSelectObservations": None,
        "prioritizeExcludeObservations": None,
        "singleSelectObservations": [{
            "description": "Select device vendor of network connection logs from CommonSecurityLog",
            "name": "Device vendor",
            "rerun": "RerunAlways",
            "sequenceNumber": 1,
            "supportedValues": [
                "Palo Alto Networks",
                "Fortinet",
                "Check Point",
            ],
            "supportedValuesKql": None,
            "value": ["Palo Alto Networks"],
            "valuesKql": None,
        }],
        "singleValueObservations": None,
        "thresholdObservations": [
            {
                "description": "Suppress anomalies when daily data transfered (in MB) per hour is less than the chosen value",
                "maximum": "100",
                "minimum": "1",
                "name": "Daily data transfer threshold in MB",
                "rerun": "RerunAlways",
                "sequenceNumber": 1,
                "value": "25",
            },
            {
                "description": "Triggers anomalies when number of standard deviations is greater than the chosen value",
                "maximum": "10",
                "minimum": "2",
                "name": "Number of standard deviations",
                "rerun": "RerunAlways",
                "sequenceNumber": 2,
                "value": "3",
            },
        ],
    },
    description="When account logs from a source region that has rarely been logged in from during the last 14 days, an anomaly is triggered.",
    display_name="Login from unusual region",
    enabled=True,
    frequency="PT1H",
    is_default_settings=True,
    kind="Anomaly",
    required_data_connectors=[azure_native.securityinsights.SecurityMLAnalyticsSettingsDataSourceArgs(
        connector_id="AWS",
        data_types=["AWSCloudTrail"],
    )],
    resource_group_name="myRg",
    settings_definition_id="f209187f-1d17-4431-94af-c141bf5f23db",
    settings_resource_name="f209187f-1d17-4431-94af-c141bf5f23db",
    settings_status="Production",
    tactics=[
        "Exfiltration",
        "CommandAndControl",
    ],
    techniques=[
        "T1037",
        "T1021",
    ],
    workspace_name="myWorkspace")

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const anomalySecurityMLAnalyticsSettings = new azure_native.securityinsights.AnomalySecurityMLAnalyticsSettings("anomalySecurityMLAnalyticsSettings", {
    anomalySettingsVersion: 0,
    anomalyVersion: "1.0.5",
    customizableObservations: {
        multiSelectObservations: undefined,
        prioritizeExcludeObservations: undefined,
        singleSelectObservations: [{
            description: "Select device vendor of network connection logs from CommonSecurityLog",
            name: "Device vendor",
            rerun: "RerunAlways",
            sequenceNumber: 1,
            supportedValues: [
                "Palo Alto Networks",
                "Fortinet",
                "Check Point",
            ],
            supportedValuesKql: undefined,
            value: ["Palo Alto Networks"],
            valuesKql: undefined,
        }],
        singleValueObservations: undefined,
        thresholdObservations: [
            {
                description: "Suppress anomalies when daily data transfered (in MB) per hour is less than the chosen value",
                maximum: "100",
                minimum: "1",
                name: "Daily data transfer threshold in MB",
                rerun: "RerunAlways",
                sequenceNumber: 1,
                value: "25",
            },
            {
                description: "Triggers anomalies when number of standard deviations is greater than the chosen value",
                maximum: "10",
                minimum: "2",
                name: "Number of standard deviations",
                rerun: "RerunAlways",
                sequenceNumber: 2,
                value: "3",
            },
        ],
    },
    description: "When account logs from a source region that has rarely been logged in from during the last 14 days, an anomaly is triggered.",
    displayName: "Login from unusual region",
    enabled: true,
    frequency: "PT1H",
    isDefaultSettings: true,
    kind: "Anomaly",
    requiredDataConnectors: [{
        connectorId: "AWS",
        dataTypes: ["AWSCloudTrail"],
    }],
    resourceGroupName: "myRg",
    settingsDefinitionId: "f209187f-1d17-4431-94af-c141bf5f23db",
    settingsResourceName: "f209187f-1d17-4431-94af-c141bf5f23db",
    settingsStatus: "Production",
    tactics: [
        "Exfiltration",
        "CommandAndControl",
    ],
    techniques: [
        "T1037",
        "T1021",
    ],
    workspaceName: "myWorkspace",
});

resources:
  anomalySecurityMLAnalyticsSettings:
    type: azure-native:securityinsights:AnomalySecurityMLAnalyticsSettings
    properties:
      anomalySettingsVersion: 0
      anomalyVersion: 1.0.5
      customizableObservations:
        multiSelectObservations: null
        prioritizeExcludeObservations: null
        singleSelectObservations:
          - description: Select device vendor of network connection logs from CommonSecurityLog
            name: Device vendor
            rerun: RerunAlways
            sequenceNumber: 1
            supportedValues:
              - Palo Alto Networks
              - Fortinet
              - Check Point
            supportedValuesKql: null
            value:
              - Palo Alto Networks
            valuesKql: null
        singleValueObservations: null
        thresholdObservations:
          - description: Suppress anomalies when daily data transfered (in MB) per hour is less than the chosen value
            maximum: '100'
            minimum: '1'
            name: Daily data transfer threshold in MB
            rerun: RerunAlways
            sequenceNumber: 1
            value: '25'
          - description: Triggers anomalies when number of standard deviations is greater than the chosen value
            maximum: '10'
            minimum: '2'
            name: Number of standard deviations
            rerun: RerunAlways
            sequenceNumber: 2
            value: '3'
      description: When account logs from a source region that has rarely been logged in from during the last 14 days, an anomaly is triggered.
      displayName: Login from unusual region
      enabled: true
      frequency: PT1H
      isDefaultSettings: true
      kind: Anomaly
      requiredDataConnectors:
        - connectorId: AWS
          dataTypes:
            - AWSCloudTrail
      resourceGroupName: myRg
      settingsDefinitionId: f209187f-1d17-4431-94af-c141bf5f23db
      settingsResourceName: f209187f-1d17-4431-94af-c141bf5f23db
      settingsStatus: Production
      tactics:
        - Exfiltration
        - CommandAndControl
      techniques:
        - T1037
        - T1021
      workspaceName: myWorkspace

Create AnomalySecurityMLAnalyticsSettings Resource

new AnomalySecurityMLAnalyticsSettings(name: string, args: AnomalySecurityMLAnalyticsSettingsArgs, opts?: CustomResourceOptions);

@overload
def AnomalySecurityMLAnalyticsSettings(resource_name: str,
                                       opts: Optional[ResourceOptions] = None,
                                       anomaly_settings_version: Optional[int] = None,
                                       anomaly_version: Optional[str] = None,
                                       customizable_observations: Optional[Any] = None,
                                       description: Optional[str] = None,
                                       display_name: Optional[str] = None,
                                       enabled: Optional[bool] = None,
                                       frequency: Optional[str] = None,
                                       is_default_settings: Optional[bool] = None,
                                       required_data_connectors: Optional[Sequence[SecurityMLAnalyticsSettingsDataSourceArgs]] = None,
                                       resource_group_name: Optional[str] = None,
                                       settings_definition_id: Optional[str] = None,
                                       settings_resource_name: Optional[str] = None,
                                       settings_status: Optional[Union[str, SettingsStatus]] = None,
                                       tactics: Optional[Sequence[Union[str, AttackTactic]]] = None,
                                       techniques: Optional[Sequence[str]] = None,
                                       workspace_name: Optional[str] = None)
@overload
def AnomalySecurityMLAnalyticsSettings(resource_name: str,
                                       args: AnomalySecurityMLAnalyticsSettingsArgs,
                                       opts: Optional[ResourceOptions] = None)

func NewAnomalySecurityMLAnalyticsSettings(ctx *Context, name string, args AnomalySecurityMLAnalyticsSettingsArgs, opts ...ResourceOption) (*AnomalySecurityMLAnalyticsSettings, error)

public AnomalySecurityMLAnalyticsSettings(string name, AnomalySecurityMLAnalyticsSettingsArgs args, CustomResourceOptions? opts = null)

public AnomalySecurityMLAnalyticsSettings(String name, AnomalySecurityMLAnalyticsSettingsArgs args)
public AnomalySecurityMLAnalyticsSettings(String name, AnomalySecurityMLAnalyticsSettingsArgs args, CustomResourceOptions options)

type: azure-native:securityinsights:AnomalySecurityMLAnalyticsSettings
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

name string: The unique name of the resource.
args AnomalySecurityMLAnalyticsSettingsArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args AnomalySecurityMLAnalyticsSettingsArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args AnomalySecurityMLAnalyticsSettingsArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args AnomalySecurityMLAnalyticsSettingsArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args AnomalySecurityMLAnalyticsSettingsArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

AnomalySecurityMLAnalyticsSettings Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The AnomalySecurityMLAnalyticsSettings resource accepts the following input properties:

AnomalyVersion string: The anomaly version of the AnomalySecurityMLAnalyticsSettings.
DisplayName string: The display name for settings created by this SecurityMLAnalyticsSettings.
Enabled bool: Determines whether this settings is enabled or disabled.
Frequency string: The frequency that this SecurityMLAnalyticsSettings will be run.
IsDefaultSettings bool: Determines whether this anomaly security ml analytics settings is a default settings
ResourceGroupName string: The name of the resource group. The name is case insensitive.
SettingsStatus string | Pulumi.AzureNative.SecurityInsights.SettingsStatus: The anomaly SecurityMLAnalyticsSettings status
WorkspaceName string: The name of the workspace.
AnomalySettingsVersion int: The anomaly settings version of the Anomaly security ml analytics settings that dictates whether job version gets updated or not.
CustomizableObservations object: The customizable observations of the AnomalySecurityMLAnalyticsSettings.
Description string: The description of the SecurityMLAnalyticsSettings.
RequiredDataConnectors List<Pulumi.AzureNative.SecurityInsights.Inputs.SecurityMLAnalyticsSettingsDataSourceArgs>: The required data sources for this SecurityMLAnalyticsSettings
SettingsDefinitionId string: The anomaly settings definition Id
SettingsResourceName string: Security ML Analytics Settings resource name
Tactics List<Union<string, Pulumi.AzureNative.SecurityInsights.AttackTactic>>: The tactics of the SecurityMLAnalyticsSettings
Techniques List<string>: The techniques of the SecurityMLAnalyticsSettings

AnomalyVersion string: The anomaly version of the AnomalySecurityMLAnalyticsSettings.
DisplayName string: The display name for settings created by this SecurityMLAnalyticsSettings.
Enabled bool: Determines whether this settings is enabled or disabled.
Frequency string: The frequency that this SecurityMLAnalyticsSettings will be run.
IsDefaultSettings bool: Determines whether this anomaly security ml analytics settings is a default settings
ResourceGroupName string: The name of the resource group. The name is case insensitive.
SettingsStatus string | SettingsStatus: The anomaly SecurityMLAnalyticsSettings status
WorkspaceName string: The name of the workspace.
AnomalySettingsVersion int: The anomaly settings version of the Anomaly security ml analytics settings that dictates whether job version gets updated or not.
CustomizableObservations interface{}: The customizable observations of the AnomalySecurityMLAnalyticsSettings.
Description string: The description of the SecurityMLAnalyticsSettings.
RequiredDataConnectors []SecurityMLAnalyticsSettingsDataSourceArgs: The required data sources for this SecurityMLAnalyticsSettings
SettingsDefinitionId string: The anomaly settings definition Id
SettingsResourceName string: Security ML Analytics Settings resource name
Tactics []string: The tactics of the SecurityMLAnalyticsSettings
Techniques []string: The techniques of the SecurityMLAnalyticsSettings

anomalyVersion String: The anomaly version of the AnomalySecurityMLAnalyticsSettings.
displayName String: The display name for settings created by this SecurityMLAnalyticsSettings.
enabled Boolean: Determines whether this settings is enabled or disabled.
frequency String: The frequency that this SecurityMLAnalyticsSettings will be run.
isDefaultSettings Boolean: Determines whether this anomaly security ml analytics settings is a default settings
resourceGroupName String: The name of the resource group. The name is case insensitive.
settingsStatus String | SettingsStatus: The anomaly SecurityMLAnalyticsSettings status
workspaceName String: The name of the workspace.
anomalySettingsVersion Integer: The anomaly settings version of the Anomaly security ml analytics settings that dictates whether job version gets updated or not.
customizableObservations Object: The customizable observations of the AnomalySecurityMLAnalyticsSettings.
description String: The description of the SecurityMLAnalyticsSettings.
requiredDataConnectors List<SecurityMLAnalyticsSettingsDataSourceArgs>: The required data sources for this SecurityMLAnalyticsSettings
settingsDefinitionId String: The anomaly settings definition Id
settingsResourceName String: Security ML Analytics Settings resource name
tactics List<Either<String,AttackTactic>>: The tactics of the SecurityMLAnalyticsSettings
techniques List<String>: The techniques of the SecurityMLAnalyticsSettings

anomalyVersion string: The anomaly version of the AnomalySecurityMLAnalyticsSettings.
displayName string: The display name for settings created by this SecurityMLAnalyticsSettings.
enabled boolean: Determines whether this settings is enabled or disabled.
frequency string: The frequency that this SecurityMLAnalyticsSettings will be run.
isDefaultSettings boolean: Determines whether this anomaly security ml analytics settings is a default settings
resourceGroupName string: The name of the resource group. The name is case insensitive.
settingsStatus string | SettingsStatus: The anomaly SecurityMLAnalyticsSettings status
workspaceName string: The name of the workspace.
anomalySettingsVersion number: The anomaly settings version of the Anomaly security ml analytics settings that dictates whether job version gets updated or not.
customizableObservations any: The customizable observations of the AnomalySecurityMLAnalyticsSettings.
description string: The description of the SecurityMLAnalyticsSettings.
requiredDataConnectors SecurityMLAnalyticsSettingsDataSourceArgs[]: The required data sources for this SecurityMLAnalyticsSettings
settingsDefinitionId string: The anomaly settings definition Id
settingsResourceName string: Security ML Analytics Settings resource name
tactics (string | AttackTactic)[]: The tactics of the SecurityMLAnalyticsSettings
techniques string[]: The techniques of the SecurityMLAnalyticsSettings

anomaly_version str: The anomaly version of the AnomalySecurityMLAnalyticsSettings.
display_name str: The display name for settings created by this SecurityMLAnalyticsSettings.
enabled bool: Determines whether this settings is enabled or disabled.
frequency str: The frequency that this SecurityMLAnalyticsSettings will be run.
is_default_settings bool: Determines whether this anomaly security ml analytics settings is a default settings
resource_group_name str: The name of the resource group. The name is case insensitive.
settings_status str | SettingsStatus: The anomaly SecurityMLAnalyticsSettings status
workspace_name str: The name of the workspace.
anomaly_settings_version int: The anomaly settings version of the Anomaly security ml analytics settings that dictates whether job version gets updated or not.
customizable_observations Any: The customizable observations of the AnomalySecurityMLAnalyticsSettings.
description str: The description of the SecurityMLAnalyticsSettings.
required_data_connectors Sequence[SecurityMLAnalyticsSettingsDataSourceArgs]: The required data sources for this SecurityMLAnalyticsSettings
settings_definition_id str: The anomaly settings definition Id
settings_resource_name str: Security ML Analytics Settings resource name
tactics Sequence[Union[str, AttackTactic]]: The tactics of the SecurityMLAnalyticsSettings
techniques Sequence[str]: The techniques of the SecurityMLAnalyticsSettings

anomalyVersion String: The anomaly version of the AnomalySecurityMLAnalyticsSettings.
displayName String: The display name for settings created by this SecurityMLAnalyticsSettings.
enabled Boolean: Determines whether this settings is enabled or disabled.
frequency String: The frequency that this SecurityMLAnalyticsSettings will be run.
isDefaultSettings Boolean: Determines whether this anomaly security ml analytics settings is a default settings
resourceGroupName String: The name of the resource group. The name is case insensitive.
settingsStatus String | "Production" | "Flighting": The anomaly SecurityMLAnalyticsSettings status
workspaceName String: The name of the workspace.
anomalySettingsVersion Number: The anomaly settings version of the Anomaly security ml analytics settings that dictates whether job version gets updated or not.
customizableObservations Any: The customizable observations of the AnomalySecurityMLAnalyticsSettings.
description String: The description of the SecurityMLAnalyticsSettings.
requiredDataConnectors List<Property Map>: The required data sources for this SecurityMLAnalyticsSettings
settingsDefinitionId String: The anomaly settings definition Id
settingsResourceName String: Security ML Analytics Settings resource name
tactics List<String | "Reconnaissance" | "ResourceDevelopment" | "InitialAccess" | "Execution" | "Persistence" | "PrivilegeEscalation" | "DefenseEvasion" | "CredentialAccess" | "Discovery" | "LateralMovement" | "Collection" | "Exfiltration" | "CommandAndControl" | "Impact" | "PreAttack" | "ImpairProcessControl" | "InhibitResponseFunction">: The tactics of the SecurityMLAnalyticsSettings
techniques List<String>: The techniques of the SecurityMLAnalyticsSettings

Outputs

All input properties are implicitly available as output properties. Additionally, the AnomalySecurityMLAnalyticsSettings resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.
LastModifiedUtc string: The last time that this SecurityMLAnalyticsSettings has been modified.
Name string: The name of the resource
SystemData Pulumi.AzureNative.SecurityInsights.Outputs.SystemDataResponse: Azure Resource Manager metadata containing createdBy and modifiedBy information.
Type string: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
Etag string: Etag of the azure resource

Id string: The provider-assigned unique ID for this managed resource.
LastModifiedUtc string: The last time that this SecurityMLAnalyticsSettings has been modified.
Name string: The name of the resource
SystemData SystemDataResponse: Azure Resource Manager metadata containing createdBy and modifiedBy information.
Type string: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
Etag string: Etag of the azure resource

id String: The provider-assigned unique ID for this managed resource.
lastModifiedUtc String: The last time that this SecurityMLAnalyticsSettings has been modified.
name String: The name of the resource
systemData SystemDataResponse: Azure Resource Manager metadata containing createdBy and modifiedBy information.
type String: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
etag String: Etag of the azure resource

id string: The provider-assigned unique ID for this managed resource.
lastModifiedUtc string: The last time that this SecurityMLAnalyticsSettings has been modified.
name string: The name of the resource
systemData SystemDataResponse: Azure Resource Manager metadata containing createdBy and modifiedBy information.
type string: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
etag string: Etag of the azure resource

id str: The provider-assigned unique ID for this managed resource.
last_modified_utc str: The last time that this SecurityMLAnalyticsSettings has been modified.
name str: The name of the resource
system_data SystemDataResponse: Azure Resource Manager metadata containing createdBy and modifiedBy information.
type str: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
etag str: Etag of the azure resource

id String: The provider-assigned unique ID for this managed resource.
lastModifiedUtc String: The last time that this SecurityMLAnalyticsSettings has been modified.
name String: The name of the resource
systemData Property Map: Azure Resource Manager metadata containing createdBy and modifiedBy information.
type String: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
etag String: Etag of the azure resource

Supporting Types

AttackTactic

Reconnaissance: Reconnaissance
ResourceDevelopment: ResourceDevelopment
InitialAccess: InitialAccess
Execution: Execution
Persistence: Persistence
PrivilegeEscalation: PrivilegeEscalation
DefenseEvasion: DefenseEvasion
CredentialAccess: CredentialAccess
Discovery: Discovery
LateralMovement: LateralMovement
Collection: Collection
Exfiltration: Exfiltration
CommandAndControl: CommandAndControl
Impact: Impact
PreAttack: PreAttack
ImpairProcessControl: ImpairProcessControl
InhibitResponseFunction: InhibitResponseFunction

AttackTacticReconnaissance: Reconnaissance
AttackTacticResourceDevelopment: ResourceDevelopment
AttackTacticInitialAccess: InitialAccess
AttackTacticExecution: Execution
AttackTacticPersistence: Persistence
AttackTacticPrivilegeEscalation: PrivilegeEscalation
AttackTacticDefenseEvasion: DefenseEvasion
AttackTacticCredentialAccess: CredentialAccess
AttackTacticDiscovery: Discovery
AttackTacticLateralMovement: LateralMovement
AttackTacticCollection: Collection
AttackTacticExfiltration: Exfiltration
AttackTacticCommandAndControl: CommandAndControl
AttackTacticImpact: Impact
AttackTacticPreAttack: PreAttack
AttackTacticImpairProcessControl: ImpairProcessControl
AttackTacticInhibitResponseFunction: InhibitResponseFunction

Reconnaissance: Reconnaissance
ResourceDevelopment: ResourceDevelopment
InitialAccess: InitialAccess
Execution: Execution
Persistence: Persistence
PrivilegeEscalation: PrivilegeEscalation
DefenseEvasion: DefenseEvasion
CredentialAccess: CredentialAccess
Discovery: Discovery
LateralMovement: LateralMovement
Collection: Collection
Exfiltration: Exfiltration
CommandAndControl: CommandAndControl
Impact: Impact
PreAttack: PreAttack
ImpairProcessControl: ImpairProcessControl
InhibitResponseFunction: InhibitResponseFunction

Reconnaissance: Reconnaissance
ResourceDevelopment: ResourceDevelopment
InitialAccess: InitialAccess
Execution: Execution
Persistence: Persistence
PrivilegeEscalation: PrivilegeEscalation
DefenseEvasion: DefenseEvasion
CredentialAccess: CredentialAccess
Discovery: Discovery
LateralMovement: LateralMovement
Collection: Collection
Exfiltration: Exfiltration
CommandAndControl: CommandAndControl
Impact: Impact
PreAttack: PreAttack
ImpairProcessControl: ImpairProcessControl
InhibitResponseFunction: InhibitResponseFunction

RECONNAISSANCE: Reconnaissance
RESOURCE_DEVELOPMENT: ResourceDevelopment
INITIAL_ACCESS: InitialAccess
EXECUTION: Execution
PERSISTENCE: Persistence
PRIVILEGE_ESCALATION: PrivilegeEscalation
DEFENSE_EVASION: DefenseEvasion
CREDENTIAL_ACCESS: CredentialAccess
DISCOVERY: Discovery
LATERAL_MOVEMENT: LateralMovement
COLLECTION: Collection
EXFILTRATION: Exfiltration
COMMAND_AND_CONTROL: CommandAndControl
IMPACT: Impact
PRE_ATTACK: PreAttack
IMPAIR_PROCESS_CONTROL: ImpairProcessControl
INHIBIT_RESPONSE_FUNCTION: InhibitResponseFunction

"Reconnaissance": Reconnaissance
"ResourceDevelopment": ResourceDevelopment
"InitialAccess": InitialAccess
"Execution": Execution
"Persistence": Persistence
"PrivilegeEscalation": PrivilegeEscalation
"DefenseEvasion": DefenseEvasion
"CredentialAccess": CredentialAccess
"Discovery": Discovery
"LateralMovement": LateralMovement
"Collection": Collection
"Exfiltration": Exfiltration
"CommandAndControl": CommandAndControl
"Impact": Impact
"PreAttack": PreAttack
"ImpairProcessControl": ImpairProcessControl
"InhibitResponseFunction": InhibitResponseFunction

SecurityMLAnalyticsSettingsDataSource

ConnectorId string: The connector id that provides the following data types
DataTypes List<string>: The data types used by the security ml analytics settings

ConnectorId string: The connector id that provides the following data types
DataTypes []string: The data types used by the security ml analytics settings

connectorId String: The connector id that provides the following data types
dataTypes List<String>: The data types used by the security ml analytics settings

connectorId string: The connector id that provides the following data types
dataTypes string[]: The data types used by the security ml analytics settings

connector_id str: The connector id that provides the following data types
data_types Sequence[str]: The data types used by the security ml analytics settings

connectorId String: The connector id that provides the following data types
dataTypes List<String>: The data types used by the security ml analytics settings

SecurityMLAnalyticsSettingsDataSourceResponse

ConnectorId string: The connector id that provides the following data types
DataTypes List<string>: The data types used by the security ml analytics settings

ConnectorId string: The connector id that provides the following data types
DataTypes []string: The data types used by the security ml analytics settings

connectorId String: The connector id that provides the following data types
dataTypes List<String>: The data types used by the security ml analytics settings

connectorId string: The connector id that provides the following data types
dataTypes string[]: The data types used by the security ml analytics settings

connector_id str: The connector id that provides the following data types
data_types Sequence[str]: The data types used by the security ml analytics settings

connectorId String: The connector id that provides the following data types
dataTypes List<String>: The data types used by the security ml analytics settings

SettingsStatus

Production: Production
Anomaly settings status in Production mode
Flighting: Flighting
Anomaly settings status in Flighting mode

SettingsStatusProduction: Production
Anomaly settings status in Production mode
SettingsStatusFlighting: Flighting
Anomaly settings status in Flighting mode

Production: Production
Anomaly settings status in Production mode
Flighting: Flighting
Anomaly settings status in Flighting mode

Production: Production
Anomaly settings status in Production mode
Flighting: Flighting
Anomaly settings status in Flighting mode

PRODUCTION: Production
Anomaly settings status in Production mode
FLIGHTING: Flighting
Anomaly settings status in Flighting mode

"Production": Production
Anomaly settings status in Production mode
"Flighting": Flighting
Anomaly settings status in Flighting mode

SystemDataResponse

CreatedAt string: The timestamp of resource creation (UTC).
CreatedBy string: The identity that created the resource.
CreatedByType string: The type of identity that created the resource.
LastModifiedAt string: The timestamp of resource last modification (UTC)
LastModifiedBy string: The identity that last modified the resource.
LastModifiedByType string: The type of identity that last modified the resource.

CreatedAt string: The timestamp of resource creation (UTC).
CreatedBy string: The identity that created the resource.
CreatedByType string: The type of identity that created the resource.
LastModifiedAt string: The timestamp of resource last modification (UTC)
LastModifiedBy string: The identity that last modified the resource.
LastModifiedByType string: The type of identity that last modified the resource.

createdAt String: The timestamp of resource creation (UTC).
createdBy String: The identity that created the resource.
createdByType String: The type of identity that created the resource.
lastModifiedAt String: The timestamp of resource last modification (UTC)
lastModifiedBy String: The identity that last modified the resource.
lastModifiedByType String: The type of identity that last modified the resource.

createdAt string: The timestamp of resource creation (UTC).
createdBy string: The identity that created the resource.
createdByType string: The type of identity that created the resource.
lastModifiedAt string: The timestamp of resource last modification (UTC)
lastModifiedBy string: The identity that last modified the resource.
lastModifiedByType string: The type of identity that last modified the resource.

created_at str: The timestamp of resource creation (UTC).
created_by str: The identity that created the resource.
created_by_type str: The type of identity that created the resource.
last_modified_at str: The timestamp of resource last modification (UTC)
last_modified_by str: The identity that last modified the resource.
last_modified_by_type str: The type of identity that last modified the resource.

createdAt String: The timestamp of resource creation (UTC).
createdBy String: The identity that created the resource.
createdByType String: The type of identity that created the resource.
lastModifiedAt String: The timestamp of resource last modification (UTC)
lastModifiedBy String: The identity that last modified the resource.
lastModifiedByType String: The type of identity that last modified the resource.

Import

An existing resource can be imported using its type token, name, and identifier, e.g.

$ pulumi import azure-native:securityinsights:AnomalySecurityMLAnalyticsSettings f209187f-1d17-4431-94af-c141bf5f23db /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/securityMLAnalyticsSettings/f209187f-1d17-4431-94af-c141bf5f23db

Package Details

Repository: Azure Native pulumi/pulumi-azure-native
License: Apache-2.0