Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Azure Native
  3. API Docs
  4. securityinsights
  5. ContentTemplate
This is the latest version of Azure Native. Use the Azure Native v2 docs if using the v2 version of this package.
Azure Native v3.2.0 published on Monday, Apr 14, 2025 by Pulumi
pulumi/pulumi-azure-native

azure-native.securityinsights.ContentTemplate

Explore with Pulumi AI

azure-native logo
This is the latest version of Azure Native. Use the Azure Native v2 docs if using the v2 version of this package.
Azure Native v3.2.0 published on Monday, Apr 14, 2025 by Pulumi
pulumi/pulumi-azure-native

    Template resource definition.

    Uses Azure REST API version 2024-09-01. In version 2.x of the Azure Native provider, it used API version 2023-06-01-preview.

    Other available API versions: 2023-04-01-preview, 2023-05-01-preview, 2023-06-01-preview, 2023-07-01-preview, 2023-08-01-preview, 2023-09-01-preview, 2023-10-01-preview, 2023-11-01, 2023-12-01-preview, 2024-01-01-preview, 2024-03-01, 2024-04-01-preview, 2024-10-01-preview, 2025-01-01-preview, 2025-03-01. These can be accessed by generating a local SDK package using the CLI command pulumi package add azure-native securityinsights [ApiVersion]. See the version guide for details.

    Example Usage

    Get a template.

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var contentTemplate = new AzureNative.SecurityInsights.ContentTemplate("contentTemplate", new()
    {
        Author = new AzureNative.SecurityInsights.Inputs.MetadataAuthorArgs
        {
            Email = "support@microsoft.com",
            Name = "Microsoft",
        },
        ContentId = "8365ebfe-a381-45b7-ad08-7d818070e11f",
        ContentKind = AzureNative.SecurityInsights.Kind.AnalyticsRule,
        ContentProductId = "str.azure-sentinel-solution-str-ar-cbfe4fndz66bi",
        DisplayName = "API Protection workbook template",
        MainTemplate = new Dictionary<string, object?>
        {
            ["$schema"] = "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
            ["contentVersion"] = "1.0.1",
            ["resources"] = new[]
            {
                new Dictionary<string, object?>
                {
                    ["apiVersion"] = "2022-04-01-preview",
                    ["kind"] = "Scheduled",
                    ["location"] = "[parameters('workspace-location')]",
                    ["name"] = "8365ebfe-a381-45b7-ad08-7d818070e11f",
                    ["properties"] = new Dictionary<string, object?>
                    {
                        ["description"] = "Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user",
                        ["displayName"] = "Critical or High Severity Detections by User",
                        ["enabled"] = false,
                        ["query"] = "...",
                        ["queryFrequency"] = "PT1H",
                        ["queryPeriod"] = "PT1H",
                        ["severity"] = "High",
                        ["status"] = "Available",
                        ["suppressionDuration"] = "PT1H",
                        ["suppressionEnabled"] = false,
                        ["triggerOperator"] = "GreaterThan",
                        ["triggerThreshold"] = 0,
                    },
                    ["type"] = "Microsoft.SecurityInsights/AlertRuleTemplates",
                },
                new Dictionary<string, object?>
                {
                    ["apiVersion"] = "2022-01-01-preview",
                    ["name"] = "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split([resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)],'/'))))]",
                    ["properties"] = new Dictionary<string, object?>
                    {
                        ["author"] = new Dictionary<string, object?>
                        {
                            ["email"] = "support@microsoft.com",
                            ["name"] = "Microsoft",
                        },
                        ["contentId"] = "4465ebde-b381-45f7-ad08-7d818070a11c",
                        ["description"] = "CrowdStrike Falcon Endpoint Protection Analytics Rule 1",
                        ["kind"] = "AnalyticsRule",
                        ["parentId"] = "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)]",
                        ["source"] = new Dictionary<string, object?>
                        {
                            ["kind"] = "Solution",
                            ["name"] = "str",
                            ["sourceId"] = "str.azure-sentinel-solution-str",
                        },
                        ["support"] = new Dictionary<string, object?>
                        {
                            ["email"] = "support@microsoft.com",
                            ["link"] = "https://support.microsoft.com/",
                            ["name"] = "Microsoft Corporation",
                            ["tier"] = "Microsoft",
                        },
                        ["version"] = "1.0.0",
                    },
                    ["type"] = "Microsoft.OperationalInsights/workspaces/providers/metadata",
                },
            },
        },
        PackageId = "str.azure-sentinel-solution-str",
        PackageKind = AzureNative.SecurityInsights.PackageKind.Solution,
        PackageName = "str",
        PackageVersion = "1.0.0",
        ResourceGroupName = "myRg",
        Source = new AzureNative.SecurityInsights.Inputs.MetadataSourceArgs
        {
            Kind = AzureNative.SecurityInsights.SourceKind.Solution,
            Name = "str",
            SourceId = "str.azure-sentinel-solution-str",
        },
        Support = new AzureNative.SecurityInsights.Inputs.MetadataSupportArgs
        {
            Email = "support@microsoft.com",
            Link = "https://support.microsoft.com/",
            Name = "Microsoft Corporation",
            Tier = AzureNative.SecurityInsights.SupportTier.Microsoft,
        },
        TemplateId = "str.azure-sentinel-solution-str",
        Version = "1.0.1",
        WorkspaceName = "myWorkspace",
    });

});

    package main

import (
	securityinsights "github.com/pulumi/pulumi-azure-native-sdk/securityinsights/v3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := securityinsights.NewContentTemplate(ctx, "contentTemplate", &securityinsights.ContentTemplateArgs{
			Author: &securityinsights.MetadataAuthorArgs{
				Email: pulumi.String("support@microsoft.com"),
				Name:  pulumi.String("Microsoft"),
			},
			ContentId:        pulumi.String("8365ebfe-a381-45b7-ad08-7d818070e11f"),
			ContentKind:      pulumi.String(securityinsights.KindAnalyticsRule),
			ContentProductId: pulumi.String("str.azure-sentinel-solution-str-ar-cbfe4fndz66bi"),
			DisplayName:      pulumi.String("API Protection workbook template"),
			MainTemplate: pulumi.Any(map[string]interface{}{
				"$schema":        "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
				"contentVersion": "1.0.1",
				"resources": []interface{}{
					map[string]interface{}{
						"apiVersion": "2022-04-01-preview",
						"kind":       "Scheduled",
						"location":   "[parameters('workspace-location')]",
						"name":       "8365ebfe-a381-45b7-ad08-7d818070e11f",
						"properties": map[string]interface{}{
							"description":         "Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user",
							"displayName":         "Critical or High Severity Detections by User",
							"enabled":             false,
							"query":               "...",
							"queryFrequency":      "PT1H",
							"queryPeriod":         "PT1H",
							"severity":            "High",
							"status":              "Available",
							"suppressionDuration": "PT1H",
							"suppressionEnabled":  false,
							"triggerOperator":     "GreaterThan",
							"triggerThreshold":    0,
						},
						"type": "Microsoft.SecurityInsights/AlertRuleTemplates",
					},
					map[string]interface{}{
						"apiVersion": "2022-01-01-preview",
						"name":       "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split([resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)],'/'))))]",
						"properties": map[string]interface{}{
							"author": map[string]interface{}{
								"email": "support@microsoft.com",
								"name":  "Microsoft",
							},
							"contentId":   "4465ebde-b381-45f7-ad08-7d818070a11c",
							"description": "CrowdStrike Falcon Endpoint Protection Analytics Rule 1",
							"kind":        "AnalyticsRule",
							"parentId":    "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)]",
							"source": map[string]interface{}{
								"kind":     "Solution",
								"name":     "str",
								"sourceId": "str.azure-sentinel-solution-str",
							},
							"support": map[string]interface{}{
								"email": "support@microsoft.com",
								"link":  "https://support.microsoft.com/",
								"name":  "Microsoft Corporation",
								"tier":  "Microsoft",
							},
							"version": "1.0.0",
						},
						"type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
					},
				},
			}),
			PackageId:         pulumi.String("str.azure-sentinel-solution-str"),
			PackageKind:       pulumi.String(securityinsights.PackageKindSolution),
			PackageName:       pulumi.String("str"),
			PackageVersion:    pulumi.String("1.0.0"),
			ResourceGroupName: pulumi.String("myRg"),
			Source: &securityinsights.MetadataSourceArgs{
				Kind:     pulumi.String(securityinsights.SourceKindSolution),
				Name:     pulumi.String("str"),
				SourceId: pulumi.String("str.azure-sentinel-solution-str"),
			},
			Support: &securityinsights.MetadataSupportArgs{
				Email: pulumi.String("support@microsoft.com"),
				Link:  pulumi.String("https://support.microsoft.com/"),
				Name:  pulumi.String("Microsoft Corporation"),
				Tier:  pulumi.String(securityinsights.SupportTierMicrosoft),
			},
			TemplateId:    pulumi.String("str.azure-sentinel-solution-str"),
			Version:       pulumi.String("1.0.1"),
			WorkspaceName: pulumi.String("myWorkspace"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.securityinsights.ContentTemplate;
import com.pulumi.azurenative.securityinsights.ContentTemplateArgs;
import com.pulumi.azurenative.securityinsights.inputs.MetadataAuthorArgs;
import com.pulumi.azurenative.securityinsights.inputs.MetadataSourceArgs;
import com.pulumi.azurenative.securityinsights.inputs.MetadataSupportArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var contentTemplate = new ContentTemplate("contentTemplate", ContentTemplateArgs.builder()
            .author(MetadataAuthorArgs.builder()
                .email("support@microsoft.com")
                .name("Microsoft")
                .build())
            .contentId("8365ebfe-a381-45b7-ad08-7d818070e11f")
            .contentKind("AnalyticsRule")
            .contentProductId("str.azure-sentinel-solution-str-ar-cbfe4fndz66bi")
            .displayName("API Protection workbook template")
            .mainTemplate(Map.ofEntries(
                Map.entry("$schema", "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#"),
                Map.entry("contentVersion", "1.0.1"),
                Map.entry("resources",                 
                    Map.ofEntries(
                        Map.entry("apiVersion", "2022-04-01-preview"),
                        Map.entry("kind", "Scheduled"),
                        Map.entry("location", "[parameters('workspace-location')]"),
                        Map.entry("name", "8365ebfe-a381-45b7-ad08-7d818070e11f"),
                        Map.entry("properties", Map.ofEntries(
                            Map.entry("description", "Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user"),
                            Map.entry("displayName", "Critical or High Severity Detections by User"),
                            Map.entry("enabled", false),
                            Map.entry("query", "..."),
                            Map.entry("queryFrequency", "PT1H"),
                            Map.entry("queryPeriod", "PT1H"),
                            Map.entry("severity", "High"),
                            Map.entry("status", "Available"),
                            Map.entry("suppressionDuration", "PT1H"),
                            Map.entry("suppressionEnabled", false),
                            Map.entry("triggerOperator", "GreaterThan"),
                            Map.entry("triggerThreshold", 0)
                        )),
                        Map.entry("type", "Microsoft.SecurityInsights/AlertRuleTemplates")
                    ),
                    Map.ofEntries(
                        Map.entry("apiVersion", "2022-01-01-preview"),
                        Map.entry("name", "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split([resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)],'/'))))]"),
                        Map.entry("properties", Map.ofEntries(
                            Map.entry("author", Map.ofEntries(
                                Map.entry("email", "support@microsoft.com"),
                                Map.entry("name", "Microsoft")
                            )),
                            Map.entry("contentId", "4465ebde-b381-45f7-ad08-7d818070a11c"),
                            Map.entry("description", "CrowdStrike Falcon Endpoint Protection Analytics Rule 1"),
                            Map.entry("kind", "AnalyticsRule"),
                            Map.entry("parentId", "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)]"),
                            Map.entry("source", Map.ofEntries(
                                Map.entry("kind", "Solution"),
                                Map.entry("name", "str"),
                                Map.entry("sourceId", "str.azure-sentinel-solution-str")
                            )),
                            Map.entry("support", Map.ofEntries(
                                Map.entry("email", "support@microsoft.com"),
                                Map.entry("link", "https://support.microsoft.com/"),
                                Map.entry("name", "Microsoft Corporation"),
                                Map.entry("tier", "Microsoft")
                            )),
                            Map.entry("version", "1.0.0")
                        )),
                        Map.entry("type", "Microsoft.OperationalInsights/workspaces/providers/metadata")
                    ))
            ))
            .packageId("str.azure-sentinel-solution-str")
            .packageKind("Solution")
            .packageName("str")
            .packageVersion("1.0.0")
            .resourceGroupName("myRg")
            .source(MetadataSourceArgs.builder()
                .kind("Solution")
                .name("str")
                .sourceId("str.azure-sentinel-solution-str")
                .build())
            .support(MetadataSupportArgs.builder()
                .email("support@microsoft.com")
                .link("https://support.microsoft.com/")
                .name("Microsoft Corporation")
                .tier("Microsoft")
                .build())
            .templateId("str.azure-sentinel-solution-str")
            .version("1.0.1")
            .workspaceName("myWorkspace")
            .build());

    }
}

    import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const contentTemplate = new azure_native.securityinsights.ContentTemplate("contentTemplate", {
    author: {
        email: "support@microsoft.com",
        name: "Microsoft",
    },
    contentId: "8365ebfe-a381-45b7-ad08-7d818070e11f",
    contentKind: azure_native.securityinsights.Kind.AnalyticsRule,
    contentProductId: "str.azure-sentinel-solution-str-ar-cbfe4fndz66bi",
    displayName: "API Protection workbook template",
    mainTemplate: {
        $schema: "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
        contentVersion: "1.0.1",
        resources: [
            {
                apiVersion: "2022-04-01-preview",
                kind: "Scheduled",
                location: "[parameters('workspace-location')]",
                name: "8365ebfe-a381-45b7-ad08-7d818070e11f",
                properties: {
                    description: "Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user",
                    displayName: "Critical or High Severity Detections by User",
                    enabled: false,
                    query: "...",
                    queryFrequency: "PT1H",
                    queryPeriod: "PT1H",
                    severity: "High",
                    status: "Available",
                    suppressionDuration: "PT1H",
                    suppressionEnabled: false,
                    triggerOperator: "GreaterThan",
                    triggerThreshold: 0,
                },
                type: "Microsoft.SecurityInsights/AlertRuleTemplates",
            },
            {
                apiVersion: "2022-01-01-preview",
                name: "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split([resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)],'/'))))]",
                properties: {
                    author: {
                        email: "support@microsoft.com",
                        name: "Microsoft",
                    },
                    contentId: "4465ebde-b381-45f7-ad08-7d818070a11c",
                    description: "CrowdStrike Falcon Endpoint Protection Analytics Rule 1",
                    kind: "AnalyticsRule",
                    parentId: "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)]",
                    source: {
                        kind: "Solution",
                        name: "str",
                        sourceId: "str.azure-sentinel-solution-str",
                    },
                    support: {
                        email: "support@microsoft.com",
                        link: "https://support.microsoft.com/",
                        name: "Microsoft Corporation",
                        tier: "Microsoft",
                    },
                    version: "1.0.0",
                },
                type: "Microsoft.OperationalInsights/workspaces/providers/metadata",
            },
        ],
    },
    packageId: "str.azure-sentinel-solution-str",
    packageKind: azure_native.securityinsights.PackageKind.Solution,
    packageName: "str",
    packageVersion: "1.0.0",
    resourceGroupName: "myRg",
    source: {
        kind: azure_native.securityinsights.SourceKind.Solution,
        name: "str",
        sourceId: "str.azure-sentinel-solution-str",
    },
    support: {
        email: "support@microsoft.com",
        link: "https://support.microsoft.com/",
        name: "Microsoft Corporation",
        tier: azure_native.securityinsights.SupportTier.Microsoft,
    },
    templateId: "str.azure-sentinel-solution-str",
    version: "1.0.1",
    workspaceName: "myWorkspace",
});

    import pulumi
import pulumi_azure_native as azure_native

content_template = azure_native.securityinsights.ContentTemplate("contentTemplate",
    author={
        "email": "support@microsoft.com",
        "name": "Microsoft",
    },
    content_id="8365ebfe-a381-45b7-ad08-7d818070e11f",
    content_kind=azure_native.securityinsights.Kind.ANALYTICS_RULE,
    content_product_id="str.azure-sentinel-solution-str-ar-cbfe4fndz66bi",
    display_name="API Protection workbook template",
    main_template={
        "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
        "contentVersion": "1.0.1",
        "resources": [
            {
                "apiVersion": "2022-04-01-preview",
                "kind": "Scheduled",
                "location": "[parameters('workspace-location')]",
                "name": "8365ebfe-a381-45b7-ad08-7d818070e11f",
                "properties": {
                    "description": "Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user",
                    "displayName": "Critical or High Severity Detections by User",
                    "enabled": False,
                    "query": "...",
                    "queryFrequency": "PT1H",
                    "queryPeriod": "PT1H",
                    "severity": "High",
                    "status": "Available",
                    "suppressionDuration": "PT1H",
                    "suppressionEnabled": False,
                    "triggerOperator": "GreaterThan",
                    "triggerThreshold": 0,
                },
                "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
            },
            {
                "apiVersion": "2022-01-01-preview",
                "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split([resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)],'/'))))]",
                "properties": {
                    "author": {
                        "email": "support@microsoft.com",
                        "name": "Microsoft",
                    },
                    "contentId": "4465ebde-b381-45f7-ad08-7d818070a11c",
                    "description": "CrowdStrike Falcon Endpoint Protection Analytics Rule 1",
                    "kind": "AnalyticsRule",
                    "parentId": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)]",
                    "source": {
                        "kind": "Solution",
                        "name": "str",
                        "sourceId": "str.azure-sentinel-solution-str",
                    },
                    "support": {
                        "email": "support@microsoft.com",
                        "link": "https://support.microsoft.com/",
                        "name": "Microsoft Corporation",
                        "tier": "Microsoft",
                    },
                    "version": "1.0.0",
                },
                "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
            },
        ],
    },
    package_id="str.azure-sentinel-solution-str",
    package_kind=azure_native.securityinsights.PackageKind.SOLUTION,
    package_name="str",
    package_version="1.0.0",
    resource_group_name="myRg",
    source={
        "kind": azure_native.securityinsights.SourceKind.SOLUTION,
        "name": "str",
        "source_id": "str.azure-sentinel-solution-str",
    },
    support={
        "email": "support@microsoft.com",
        "link": "https://support.microsoft.com/",
        "name": "Microsoft Corporation",
        "tier": azure_native.securityinsights.SupportTier.MICROSOFT,
    },
    template_id="str.azure-sentinel-solution-str",
    version="1.0.1",
    workspace_name="myWorkspace")

    resources:
  contentTemplate:
    type: azure-native:securityinsights:ContentTemplate
    properties:
      author:
        email: support@microsoft.com
        name: Microsoft
      contentId: 8365ebfe-a381-45b7-ad08-7d818070e11f
      contentKind: AnalyticsRule
      contentProductId: str.azure-sentinel-solution-str-ar-cbfe4fndz66bi
      displayName: API Protection workbook template
      mainTemplate:
        $schema: https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#
        contentVersion: 1.0.1
        resources:
          - apiVersion: 2022-04-01-preview
            kind: Scheduled
            location: '[parameters(''workspace-location'')]'
            name: 8365ebfe-a381-45b7-ad08-7d818070e11f
            properties:
              description: Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user
              displayName: Critical or High Severity Detections by User
              enabled: false
              query: '...'
              queryFrequency: PT1H
              queryPeriod: PT1H
              severity: High
              status: Available
              suppressionDuration: PT1H
              suppressionEnabled: false
              triggerOperator: GreaterThan
              triggerThreshold: 0
            type: Microsoft.SecurityInsights/AlertRuleTemplates
          - apiVersion: 2022-01-01-preview
            name: '[concat(parameters(''workspace''),''/Microsoft.SecurityInsights/'',concat(''AnalyticsRule-'', last(split([resourceId(''Microsoft.SecurityInsights/AlertRuleTemplates'', 8365ebfe-a381-45b7-ad08-7d818070e11f)],''/''))))]'
            properties:
              author:
                email: support@microsoft.com
                name: Microsoft
              contentId: 4465ebde-b381-45f7-ad08-7d818070a11c
              description: CrowdStrike Falcon Endpoint Protection Analytics Rule 1
              kind: AnalyticsRule
              parentId: '[resourceId(''Microsoft.SecurityInsights/AlertRuleTemplates'', 8365ebfe-a381-45b7-ad08-7d818070e11f)]'
              source:
                kind: Solution
                name: str
                sourceId: str.azure-sentinel-solution-str
              support:
                email: support@microsoft.com
                link: https://support.microsoft.com/
                name: Microsoft Corporation
                tier: Microsoft
              version: 1.0.0
            type: Microsoft.OperationalInsights/workspaces/providers/metadata
      packageId: str.azure-sentinel-solution-str
      packageKind: Solution
      packageName: str
      packageVersion: 1.0.0
      resourceGroupName: myRg
      source:
        kind: Solution
        name: str
        sourceId: str.azure-sentinel-solution-str
      support:
        email: support@microsoft.com
        link: https://support.microsoft.com/
        name: Microsoft Corporation
        tier: Microsoft
      templateId: str.azure-sentinel-solution-str
      version: 1.0.1
      workspaceName: myWorkspace

    Create ContentTemplate Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new ContentTemplate(name: string, args: ContentTemplateArgs, opts?: CustomResourceOptions);
    @overload
def ContentTemplate(resource_name: str,
                    args: ContentTemplateArgs,
                    opts: Optional[ResourceOptions] = None)

@overload
def ContentTemplate(resource_name: str,
                    opts: Optional[ResourceOptions] = None,
                    package_id: Optional[str] = None,
                    workspace_name: Optional[str] = None,
                    content_id: Optional[str] = None,
                    content_kind: Optional[Union[str, Kind]] = None,
                    content_product_id: Optional[str] = None,
                    version: Optional[str] = None,
                    source: Optional[MetadataSourceArgs] = None,
                    resource_group_name: Optional[str] = None,
                    display_name: Optional[str] = None,
                    package_version: Optional[str] = None,
                    dependencies: Optional[MetadataDependenciesArgs] = None,
                    providers: Optional[Sequence[str]] = None,
                    main_template: Optional[Any] = None,
                    icon: Optional[str] = None,
                    package_kind: Optional[Union[str, PackageKind]] = None,
                    package_name: Optional[str] = None,
                    first_publish_date: Optional[str] = None,
                    preview_images: Optional[Sequence[str]] = None,
                    preview_images_dark: Optional[Sequence[str]] = None,
                    last_publish_date: Optional[str] = None,
                    author: Optional[MetadataAuthorArgs] = None,
                    custom_version: Optional[str] = None,
                    support: Optional[MetadataSupportArgs] = None,
                    template_id: Optional[str] = None,
                    threat_analysis_tactics: Optional[Sequence[str]] = None,
                    threat_analysis_techniques: Optional[Sequence[str]] = None,
                    content_schema_version: Optional[str] = None,
                    categories: Optional[MetadataCategoriesArgs] = None)
    func NewContentTemplate(ctx *Context, name string, args ContentTemplateArgs, opts ...ResourceOption) (*ContentTemplate, error)
    public ContentTemplate(string name, ContentTemplateArgs args, CustomResourceOptions? opts = null)
    public ContentTemplate(String name, ContentTemplateArgs args)
public ContentTemplate(String name, ContentTemplateArgs args, CustomResourceOptions options)

    type: azure-native:securityinsights:ContentTemplate
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args ContentTemplateArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ContentTemplateArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ContentTemplateArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ContentTemplateArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ContentTemplateArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var contentTemplateResource = new AzureNative.SecurityInsights.ContentTemplate("contentTemplateResource", new()
{
    PackageId = "string",
    WorkspaceName = "string",
    ContentId = "string",
    ContentKind = "string",
    ContentProductId = "string",
    Version = "string",
    Source = new AzureNative.SecurityInsights.Inputs.MetadataSourceArgs
    {
        Kind = "string",
        Name = "string",
        SourceId = "string",
    },
    ResourceGroupName = "string",
    DisplayName = "string",
    PackageVersion = "string",
    Dependencies = new AzureNative.SecurityInsights.Inputs.MetadataDependenciesArgs
    {
        ContentId = "string",
        Criteria = new[]
        {
            metadataDependencies,
        },
        Kind = "string",
        Name = "string",
        Operator = "string",
        Version = "string",
    },
    Providers = new[]
    {
        "string",
    },
    MainTemplate = "any",
    Icon = "string",
    PackageKind = "string",
    PackageName = "string",
    FirstPublishDate = "string",
    PreviewImages = new[]
    {
        "string",
    },
    PreviewImagesDark = new[]
    {
        "string",
    },
    LastPublishDate = "string",
    Author = new AzureNative.SecurityInsights.Inputs.MetadataAuthorArgs
    {
        Email = "string",
        Link = "string",
        Name = "string",
    },
    CustomVersion = "string",
    Support = new AzureNative.SecurityInsights.Inputs.MetadataSupportArgs
    {
        Tier = "string",
        Email = "string",
        Link = "string",
        Name = "string",
    },
    TemplateId = "string",
    ThreatAnalysisTactics = new[]
    {
        "string",
    },
    ThreatAnalysisTechniques = new[]
    {
        "string",
    },
    ContentSchemaVersion = "string",
    Categories = new AzureNative.SecurityInsights.Inputs.MetadataCategoriesArgs
    {
        Domains = new[]
        {
            "string",
        },
        Verticals = new[]
        {
            "string",
        },
    },
});

    example, err := securityinsights.NewContentTemplate(ctx, "contentTemplateResource", &securityinsights.ContentTemplateArgs{
	PackageId:        pulumi.String("string"),
	WorkspaceName:    pulumi.String("string"),
	ContentId:        pulumi.String("string"),
	ContentKind:      pulumi.String("string"),
	ContentProductId: pulumi.String("string"),
	Version:          pulumi.String("string"),
	Source: &securityinsights.MetadataSourceArgs{
		Kind:     pulumi.String("string"),
		Name:     pulumi.String("string"),
		SourceId: pulumi.String("string"),
	},
	ResourceGroupName: pulumi.String("string"),
	DisplayName:       pulumi.String("string"),
	PackageVersion:    pulumi.String("string"),
	Dependencies: &securityinsights.MetadataDependenciesArgs{
		ContentId: pulumi.String("string"),
		Criteria: securityinsights.MetadataDependenciesArray{
			metadataDependencies,
		},
		Kind:     pulumi.String("string"),
		Name:     pulumi.String("string"),
		Operator: pulumi.String("string"),
		Version:  pulumi.String("string"),
	},
	Providers: pulumi.StringArray{
		pulumi.String("string"),
	},
	MainTemplate:     pulumi.Any("any"),
	Icon:             pulumi.String("string"),
	PackageKind:      pulumi.String("string"),
	PackageName:      pulumi.String("string"),
	FirstPublishDate: pulumi.String("string"),
	PreviewImages: pulumi.StringArray{
		pulumi.String("string"),
	},
	PreviewImagesDark: pulumi.StringArray{
		pulumi.String("string"),
	},
	LastPublishDate: pulumi.String("string"),
	Author: &securityinsights.MetadataAuthorArgs{
		Email: pulumi.String("string"),
		Link:  pulumi.String("string"),
		Name:  pulumi.String("string"),
	},
	CustomVersion: pulumi.String("string"),
	Support: &securityinsights.MetadataSupportArgs{
		Tier:  pulumi.String("string"),
		Email: pulumi.String("string"),
		Link:  pulumi.String("string"),
		Name:  pulumi.String("string"),
	},
	TemplateId: pulumi.String("string"),
	ThreatAnalysisTactics: pulumi.StringArray{
		pulumi.String("string"),
	},
	ThreatAnalysisTechniques: pulumi.StringArray{
		pulumi.String("string"),
	},
	ContentSchemaVersion: pulumi.String("string"),
	Categories: &securityinsights.MetadataCategoriesArgs{
		Domains: pulumi.StringArray{
			pulumi.String("string"),
		},
		Verticals: pulumi.StringArray{
			pulumi.String("string"),
		},
	},
})

    var contentTemplateResource = new ContentTemplate("contentTemplateResource", ContentTemplateArgs.builder()
    .packageId("string")
    .workspaceName("string")
    .contentId("string")
    .contentKind("string")
    .contentProductId("string")
    .version("string")
    .source(MetadataSourceArgs.builder()
        .kind("string")
        .name("string")
        .sourceId("string")
        .build())
    .resourceGroupName("string")
    .displayName("string")
    .packageVersion("string")
    .dependencies(MetadataDependenciesArgs.builder()
        .contentId("string")
        .criteria(metadataDependencies)
        .kind("string")
        .name("string")
        .operator("string")
        .version("string")
        .build())
    .providers("string")
    .mainTemplate("any")
    .icon("string")
    .packageKind("string")
    .packageName("string")
    .firstPublishDate("string")
    .previewImages("string")
    .previewImagesDark("string")
    .lastPublishDate("string")
    .author(MetadataAuthorArgs.builder()
        .email("string")
        .link("string")
        .name("string")
        .build())
    .customVersion("string")
    .support(MetadataSupportArgs.builder()
        .tier("string")
        .email("string")
        .link("string")
        .name("string")
        .build())
    .templateId("string")
    .threatAnalysisTactics("string")
    .threatAnalysisTechniques("string")
    .contentSchemaVersion("string")
    .categories(MetadataCategoriesArgs.builder()
        .domains("string")
        .verticals("string")
        .build())
    .build());

    content_template_resource = azure_native.securityinsights.ContentTemplate("contentTemplateResource",
    package_id="string",
    workspace_name="string",
    content_id="string",
    content_kind="string",
    content_product_id="string",
    version="string",
    source={
        "kind": "string",
        "name": "string",
        "source_id": "string",
    },
    resource_group_name="string",
    display_name="string",
    package_version="string",
    dependencies={
        "content_id": "string",
        "criteria": [metadata_dependencies],
        "kind": "string",
        "name": "string",
        "operator": "string",
        "version": "string",
    },
    providers=["string"],
    main_template="any",
    icon="string",
    package_kind="string",
    package_name="string",
    first_publish_date="string",
    preview_images=["string"],
    preview_images_dark=["string"],
    last_publish_date="string",
    author={
        "email": "string",
        "link": "string",
        "name": "string",
    },
    custom_version="string",
    support={
        "tier": "string",
        "email": "string",
        "link": "string",
        "name": "string",
    },
    template_id="string",
    threat_analysis_tactics=["string"],
    threat_analysis_techniques=["string"],
    content_schema_version="string",
    categories={
        "domains": ["string"],
        "verticals": ["string"],
    })

    const contentTemplateResource = new azure_native.securityinsights.ContentTemplate("contentTemplateResource", {
    packageId: "string",
    workspaceName: "string",
    contentId: "string",
    contentKind: "string",
    contentProductId: "string",
    version: "string",
    source: {
        kind: "string",
        name: "string",
        sourceId: "string",
    },
    resourceGroupName: "string",
    displayName: "string",
    packageVersion: "string",
    dependencies: {
        contentId: "string",
        criteria: [metadataDependencies],
        kind: "string",
        name: "string",
        operator: "string",
        version: "string",
    },
    providers: ["string"],
    mainTemplate: "any",
    icon: "string",
    packageKind: "string",
    packageName: "string",
    firstPublishDate: "string",
    previewImages: ["string"],
    previewImagesDark: ["string"],
    lastPublishDate: "string",
    author: {
        email: "string",
        link: "string",
        name: "string",
    },
    customVersion: "string",
    support: {
        tier: "string",
        email: "string",
        link: "string",
        name: "string",
    },
    templateId: "string",
    threatAnalysisTactics: ["string"],
    threatAnalysisTechniques: ["string"],
    contentSchemaVersion: "string",
    categories: {
        domains: ["string"],
        verticals: ["string"],
    },
});

    type: azure-native:securityinsights:ContentTemplate
properties:
    author:
        email: string
        link: string
        name: string
    categories:
        domains:
            - string
        verticals:
            - string
    contentId: string
    contentKind: string
    contentProductId: string
    contentSchemaVersion: string
    customVersion: string
    dependencies:
        contentId: string
        criteria:
            - ${metadataDependencies}
        kind: string
        name: string
        operator: string
        version: string
    displayName: string
    firstPublishDate: string
    icon: string
    lastPublishDate: string
    mainTemplate: any
    packageId: string
    packageKind: string
    packageName: string
    packageVersion: string
    previewImages:
        - string
    previewImagesDark:
        - string
    providers:
        - string
    resourceGroupName: string
    source:
        kind: string
        name: string
        sourceId: string
    support:
        email: string
        link: string
        name: string
        tier: string
    templateId: string
    threatAnalysisTactics:
        - string
    threatAnalysisTechniques:
        - string
    version: string
    workspaceName: string

    ContentTemplate Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The ContentTemplate resource accepts the following input properties:

    ContentId string
    Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
    ContentKind string | Pulumi.AzureNative.SecurityInsights.Kind
    The kind of content the template is for.
    ContentProductId string
    Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template
    DisplayName string
    The display name of the template
    PackageId string
    the package Id contains this template
    PackageVersion string
    Version of the package. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    ResourceGroupName string
    The name of the resource group. The name is case insensitive.
    Source Pulumi.AzureNative.SecurityInsights.Inputs.MetadataSource
    Source of the content. This is where/how it was created.
    Version string
    Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    WorkspaceName string
    The name of the workspace.
    Author Pulumi.AzureNative.SecurityInsights.Inputs.MetadataAuthor
    The creator of the content item.
    Categories Pulumi.AzureNative.SecurityInsights.Inputs.MetadataCategories
    Categories for the item
    ContentSchemaVersion string
    Schema version of the content. Can be used to distinguish between different flow based on the schema version
    CustomVersion string
    The custom version of the content. A optional free text
    Dependencies Pulumi.AzureNative.SecurityInsights.Inputs.MetadataDependencies
    Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
    FirstPublishDate string
    first publish date content item
    Icon string
    the icon identifier. this id can later be fetched from the content metadata
    LastPublishDate string
    last publish date for the content item
    MainTemplate object
    The JSON of the ARM template to deploy active content. Expandable.
    PackageKind string | Pulumi.AzureNative.SecurityInsights.PackageKind
    the packageKind of the package contains this template
    PackageName string
    the name of the package contains this template
    PreviewImages List<string>
    preview image file names. These will be taken from the solution artifacts
    PreviewImagesDark List<string>
    preview image file names. These will be taken from the solution artifacts. used for dark theme support
    Providers List<string>
    Providers for the content item
    Support Pulumi.AzureNative.SecurityInsights.Inputs.MetadataSupport
    Support information for the template - type, name, contact information
    TemplateId string
    template Id
    ThreatAnalysisTactics List<string>
    the tactics the resource covers
    ThreatAnalysisTechniques List<string>
    the techniques the resource covers, these have to be aligned with the tactics being used
    ContentId string
    Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
    ContentKind string | Kind
    The kind of content the template is for.
    ContentProductId string
    Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template
    DisplayName string
    The display name of the template
    PackageId string
    the package Id contains this template
    PackageVersion string
    Version of the package. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    ResourceGroupName string
    The name of the resource group. The name is case insensitive.
    Source MetadataSourceArgs
    Source of the content. This is where/how it was created.
    Version string
    Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    WorkspaceName string
    The name of the workspace.
    Author MetadataAuthorArgs
    The creator of the content item.
    Categories MetadataCategoriesArgs
    Categories for the item
    ContentSchemaVersion string
    Schema version of the content. Can be used to distinguish between different flow based on the schema version
    CustomVersion string
    The custom version of the content. A optional free text
    Dependencies MetadataDependenciesArgs
    Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
    FirstPublishDate string
    first publish date content item
    Icon string
    the icon identifier. this id can later be fetched from the content metadata
    LastPublishDate string
    last publish date for the content item
    MainTemplate interface{}
    The JSON of the ARM template to deploy active content. Expandable.
    PackageKind string | PackageKind
    the packageKind of the package contains this template
    PackageName string
    the name of the package contains this template
    PreviewImages []string
    preview image file names. These will be taken from the solution artifacts
    PreviewImagesDark []string
    preview image file names. These will be taken from the solution artifacts. used for dark theme support
    Providers []string
    Providers for the content item
    Support MetadataSupportArgs
    Support information for the template - type, name, contact information
    TemplateId string
    template Id
    ThreatAnalysisTactics []string
    the tactics the resource covers
    ThreatAnalysisTechniques []string
    the techniques the resource covers, these have to be aligned with the tactics being used
    contentId String
    Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
    contentKind String | Kind
    The kind of content the template is for.
    contentProductId String
    Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template
    displayName String
    The display name of the template
    packageId String
    the package Id contains this template
    packageVersion String
    Version of the package. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    resourceGroupName String
    The name of the resource group. The name is case insensitive.
    source MetadataSource
    Source of the content. This is where/how it was created.
    version String
    Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    workspaceName String
    The name of the workspace.
    author MetadataAuthor
    The creator of the content item.
    categories MetadataCategories
    Categories for the item
    contentSchemaVersion String
    Schema version of the content. Can be used to distinguish between different flow based on the schema version
    customVersion String
    The custom version of the content. A optional free text
    dependencies MetadataDependencies
    Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
    firstPublishDate String
    first publish date content item
    icon String
    the icon identifier. this id can later be fetched from the content metadata
    lastPublishDate String
    last publish date for the content item
    mainTemplate Object
    The JSON of the ARM template to deploy active content. Expandable.
    packageKind String | PackageKind
    the packageKind of the package contains this template
    packageName String
    the name of the package contains this template
    previewImages List<String>
    preview image file names. These will be taken from the solution artifacts
    previewImagesDark List<String>
    preview image file names. These will be taken from the solution artifacts. used for dark theme support
    providers List<String>
    Providers for the content item
    support MetadataSupport
    Support information for the template - type, name, contact information
    templateId String
    template Id
    threatAnalysisTactics List<String>
    the tactics the resource covers
    threatAnalysisTechniques List<String>
    the techniques the resource covers, these have to be aligned with the tactics being used
    contentId string
    Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
    contentKind string | Kind
    The kind of content the template is for.
    contentProductId string
    Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template
    displayName string
    The display name of the template
    packageId string
    the package Id contains this template
    packageVersion string
    Version of the package. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    resourceGroupName string
    The name of the resource group. The name is case insensitive.
    source MetadataSource
    Source of the content. This is where/how it was created.
    version string
    Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    workspaceName string
    The name of the workspace.
    author MetadataAuthor
    The creator of the content item.
    categories MetadataCategories
    Categories for the item
    contentSchemaVersion string
    Schema version of the content. Can be used to distinguish between different flow based on the schema version
    customVersion string
    The custom version of the content. A optional free text
    dependencies MetadataDependencies
    Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
    firstPublishDate string
    first publish date content item
    icon string
    the icon identifier. this id can later be fetched from the content metadata
    lastPublishDate string
    last publish date for the content item
    mainTemplate any
    The JSON of the ARM template to deploy active content. Expandable.
    packageKind string | PackageKind
    the packageKind of the package contains this template
    packageName string
    the name of the package contains this template
    previewImages string[]
    preview image file names. These will be taken from the solution artifacts
    previewImagesDark string[]
    preview image file names. These will be taken from the solution artifacts. used for dark theme support
    providers string[]
    Providers for the content item
    support MetadataSupport
    Support information for the template - type, name, contact information
    templateId string
    template Id
    threatAnalysisTactics string[]
    the tactics the resource covers
    threatAnalysisTechniques string[]
    the techniques the resource covers, these have to be aligned with the tactics being used
    content_id str
    Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
    content_kind str | Kind
    The kind of content the template is for.
    content_product_id str
    Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template
    display_name str
    The display name of the template
    package_id str
    the package Id contains this template
    package_version str
    Version of the package. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    resource_group_name str
    The name of the resource group. The name is case insensitive.
    source MetadataSourceArgs
    Source of the content. This is where/how it was created.
    version str
    Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    workspace_name str
    The name of the workspace.
    author MetadataAuthorArgs
    The creator of the content item.
    categories MetadataCategoriesArgs
    Categories for the item
    content_schema_version str
    Schema version of the content. Can be used to distinguish between different flow based on the schema version
    custom_version str
    The custom version of the content. A optional free text
    dependencies MetadataDependenciesArgs
    Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
    first_publish_date str
    first publish date content item
    icon str
    the icon identifier. this id can later be fetched from the content metadata
    last_publish_date str
    last publish date for the content item
    main_template Any
    The JSON of the ARM template to deploy active content. Expandable.
    package_kind str | PackageKind
    the packageKind of the package contains this template
    package_name str
    the name of the package contains this template
    preview_images Sequence[str]
    preview image file names. These will be taken from the solution artifacts
    preview_images_dark Sequence[str]
    preview image file names. These will be taken from the solution artifacts. used for dark theme support
    providers Sequence[str]
    Providers for the content item
    support MetadataSupportArgs
    Support information for the template - type, name, contact information
    template_id str
    template Id
    threat_analysis_tactics Sequence[str]
    the tactics the resource covers
    threat_analysis_techniques Sequence[str]
    the techniques the resource covers, these have to be aligned with the tactics being used
    contentId String
    Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
    contentKind String | "DataConnector" | "DataType" | "Workbook" | "WorkbookTemplate" | "Playbook" | "PlaybookTemplate" | "AnalyticsRuleTemplate" | "AnalyticsRule" | "HuntingQuery" | "InvestigationQuery" | "Parser" | "Watchlist" | "WatchlistTemplate" | "Solution" | "AzureFunction" | "LogicAppsCustomConnector" | "AutomationRule"
    The kind of content the template is for.
    contentProductId String
    Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template
    displayName String
    The display name of the template
    packageId String
    the package Id contains this template
    packageVersion String
    Version of the package. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    resourceGroupName String
    The name of the resource group. The name is case insensitive.
    source Property Map
    Source of the content. This is where/how it was created.
    version String
    Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    workspaceName String
    The name of the workspace.
    author Property Map
    The creator of the content item.
    categories Property Map
    Categories for the item
    contentSchemaVersion String
    Schema version of the content. Can be used to distinguish between different flow based on the schema version
    customVersion String
    The custom version of the content. A optional free text
    dependencies Property Map
    Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
    firstPublishDate String
    first publish date content item
    icon String
    the icon identifier. this id can later be fetched from the content metadata
    lastPublishDate String
    last publish date for the content item
    mainTemplate Any
    The JSON of the ARM template to deploy active content. Expandable.
    packageKind String | "Solution" | "Standalone"
    the packageKind of the package contains this template
    packageName String
    the name of the package contains this template
    previewImages List<String>
    preview image file names. These will be taken from the solution artifacts
    previewImagesDark List<String>
    preview image file names. These will be taken from the solution artifacts. used for dark theme support
    providers List<String>
    Providers for the content item
    support Property Map
    Support information for the template - type, name, contact information
    templateId String
    template Id
    threatAnalysisTactics List<String>
    the tactics the resource covers
    threatAnalysisTechniques List<String>
    the techniques the resource covers, these have to be aligned with the tactics being used

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ContentTemplate resource produces the following output properties:

    AzureApiVersion string
    The Azure API version of the resource.
    DependantTemplates List<Pulumi.AzureNative.SecurityInsights.Outputs.TemplatePropertiesResponse>
    Dependant templates. Expandable.
    Id string
    The provider-assigned unique ID for this managed resource.
    IsDeprecated string
    Flag indicates if this template is deprecated
    Name string
    The name of the resource
    SystemData Pulumi.AzureNative.SecurityInsights.Outputs.SystemDataResponse
    Azure Resource Manager metadata containing createdBy and modifiedBy information.
    Type string
    The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
    Etag string
    Etag of the azure resource
    AzureApiVersion string
    The Azure API version of the resource.
    DependantTemplates []TemplatePropertiesResponse
    Dependant templates. Expandable.
    Id string
    The provider-assigned unique ID for this managed resource.
    IsDeprecated string
    Flag indicates if this template is deprecated
    Name string
    The name of the resource
    SystemData SystemDataResponse
    Azure Resource Manager metadata containing createdBy and modifiedBy information.
    Type string
    The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
    Etag string
    Etag of the azure resource
    azureApiVersion String
    The Azure API version of the resource.
    dependantTemplates List<TemplatePropertiesResponse>
    Dependant templates. Expandable.
    id String
    The provider-assigned unique ID for this managed resource.
    isDeprecated String
    Flag indicates if this template is deprecated
    name String
    The name of the resource
    systemData SystemDataResponse
    Azure Resource Manager metadata containing createdBy and modifiedBy information.
    type String
    The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
    etag String
    Etag of the azure resource
    azureApiVersion string
    The Azure API version of the resource.
    dependantTemplates TemplatePropertiesResponse[]
    Dependant templates. Expandable.
    id string
    The provider-assigned unique ID for this managed resource.
    isDeprecated string
    Flag indicates if this template is deprecated
    name string
    The name of the resource
    systemData SystemDataResponse
    Azure Resource Manager metadata containing createdBy and modifiedBy information.
    type string
    The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
    etag string
    Etag of the azure resource
    azure_api_version str
    The Azure API version of the resource.
    dependant_templates Sequence[TemplatePropertiesResponse]
    Dependant templates. Expandable.
    id str
    The provider-assigned unique ID for this managed resource.
    is_deprecated str
    Flag indicates if this template is deprecated
    name str
    The name of the resource
    system_data SystemDataResponse
    Azure Resource Manager metadata containing createdBy and modifiedBy information.
    type str
    The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
    etag str
    Etag of the azure resource
    azureApiVersion String
    The Azure API version of the resource.
    dependantTemplates List<Property Map>
    Dependant templates. Expandable.
    id String
    The provider-assigned unique ID for this managed resource.
    isDeprecated String
    Flag indicates if this template is deprecated
    name String
    The name of the resource
    systemData Property Map
    Azure Resource Manager metadata containing createdBy and modifiedBy information.
    type String
    The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
    etag String
    Etag of the azure resource

    Supporting Types

    Kind, KindArgs

    DataConnector
    DataConnector
    DataType
    DataType
    Workbook
    Workbook
    WorkbookTemplate
    WorkbookTemplate
    Playbook
    Playbook
    PlaybookTemplate
    PlaybookTemplate
    AnalyticsRuleTemplate
    AnalyticsRuleTemplate
    AnalyticsRule
    AnalyticsRule
    HuntingQuery
    HuntingQuery
    InvestigationQuery
    InvestigationQuery
    Parser
    Parser
    Watchlist
    Watchlist
    WatchlistTemplate
    WatchlistTemplate
    Solution
    Solution
    AzureFunction
    AzureFunction
    LogicAppsCustomConnector
    LogicAppsCustomConnector
    AutomationRule
    AutomationRule
    KindDataConnector
    DataConnector
    KindDataType
    DataType
    KindWorkbook
    Workbook
    KindWorkbookTemplate
    WorkbookTemplate
    KindPlaybook
    Playbook
    KindPlaybookTemplate
    PlaybookTemplate
    KindAnalyticsRuleTemplate
    AnalyticsRuleTemplate
    KindAnalyticsRule
    AnalyticsRule
    KindHuntingQuery
    HuntingQuery
    KindInvestigationQuery
    InvestigationQuery
    KindParser
    Parser
    KindWatchlist
    Watchlist
    KindWatchlistTemplate
    WatchlistTemplate
    KindSolution
    Solution
    KindAzureFunction
    AzureFunction
    KindLogicAppsCustomConnector
    LogicAppsCustomConnector
    KindAutomationRule
    AutomationRule
    DataConnector
    DataConnector
    DataType
    DataType
    Workbook
    Workbook
    WorkbookTemplate
    WorkbookTemplate
    Playbook
    Playbook
    PlaybookTemplate
    PlaybookTemplate
    AnalyticsRuleTemplate
    AnalyticsRuleTemplate
    AnalyticsRule
    AnalyticsRule
    HuntingQuery
    HuntingQuery
    InvestigationQuery
    InvestigationQuery
    Parser
    Parser
    Watchlist
    Watchlist
    WatchlistTemplate
    WatchlistTemplate
    Solution
    Solution
    AzureFunction
    AzureFunction
    LogicAppsCustomConnector
    LogicAppsCustomConnector
    AutomationRule
    AutomationRule
    DataConnector
    DataConnector
    DataType
    DataType
    Workbook
    Workbook
    WorkbookTemplate
    WorkbookTemplate
    Playbook
    Playbook
    PlaybookTemplate
    PlaybookTemplate
    AnalyticsRuleTemplate
    AnalyticsRuleTemplate
    AnalyticsRule
    AnalyticsRule
    HuntingQuery
    HuntingQuery
    InvestigationQuery
    InvestigationQuery
    Parser
    Parser
    Watchlist
    Watchlist
    WatchlistTemplate
    WatchlistTemplate
    Solution
    Solution
    AzureFunction
    AzureFunction
    LogicAppsCustomConnector
    LogicAppsCustomConnector
    AutomationRule
    AutomationRule
    DATA_CONNECTOR
    DataConnector
    DATA_TYPE
    DataType
    WORKBOOK
    Workbook
    WORKBOOK_TEMPLATE
    WorkbookTemplate
    PLAYBOOK
    Playbook
    PLAYBOOK_TEMPLATE
    PlaybookTemplate
    ANALYTICS_RULE_TEMPLATE
    AnalyticsRuleTemplate
    ANALYTICS_RULE
    AnalyticsRule
    HUNTING_QUERY
    HuntingQuery
    INVESTIGATION_QUERY
    InvestigationQuery
    PARSER
    Parser
    WATCHLIST
    Watchlist
    WATCHLIST_TEMPLATE
    WatchlistTemplate
    SOLUTION
    Solution
    AZURE_FUNCTION
    AzureFunction
    LOGIC_APPS_CUSTOM_CONNECTOR
    LogicAppsCustomConnector
    AUTOMATION_RULE
    AutomationRule
    "DataConnector"
    DataConnector
    "DataType"
    DataType
    "Workbook"
    Workbook
    "WorkbookTemplate"
    WorkbookTemplate
    "Playbook"
    Playbook
    "PlaybookTemplate"
    PlaybookTemplate
    "AnalyticsRuleTemplate"
    AnalyticsRuleTemplate
    "AnalyticsRule"
    AnalyticsRule
    "HuntingQuery"
    HuntingQuery
    "InvestigationQuery"
    InvestigationQuery
    "Parser"
    Parser
    "Watchlist"
    Watchlist
    "WatchlistTemplate"
    WatchlistTemplate
    "Solution"
    Solution
    "AzureFunction"
    AzureFunction
    "LogicAppsCustomConnector"
    LogicAppsCustomConnector
    "AutomationRule"
    AutomationRule

    MetadataAuthor, MetadataAuthorArgs

    Email string
    Email of author contact
    Link string
    Link for author/vendor page
    Name string
    Name of the author. Company or person.
    Email string
    Email of author contact
    Link string
    Link for author/vendor page
    Name string
    Name of the author. Company or person.
    email String
    Email of author contact
    link String
    Link for author/vendor page
    name String
    Name of the author. Company or person.
    email string
    Email of author contact
    link string
    Link for author/vendor page
    name string
    Name of the author. Company or person.
    email str
    Email of author contact
    link str
    Link for author/vendor page
    name str
    Name of the author. Company or person.
    email String
    Email of author contact
    link String
    Link for author/vendor page
    name String
    Name of the author. Company or person.

    MetadataAuthorResponse, MetadataAuthorResponseArgs

    Email string
    Email of author contact
    Link string
    Link for author/vendor page
    Name string
    Name of the author. Company or person.
    Email string
    Email of author contact
    Link string
    Link for author/vendor page
    Name string
    Name of the author. Company or person.
    email String
    Email of author contact
    link String
    Link for author/vendor page
    name String
    Name of the author. Company or person.
    email string
    Email of author contact
    link string
    Link for author/vendor page
    name string
    Name of the author. Company or person.
    email str
    Email of author contact
    link str
    Link for author/vendor page
    name str
    Name of the author. Company or person.
    email String
    Email of author contact
    link String
    Link for author/vendor page
    name String
    Name of the author. Company or person.

    MetadataCategories, MetadataCategoriesArgs

    Domains List<string>
    domain for the solution content item
    Verticals List<string>
    Industry verticals for the solution content item
    Domains []string
    domain for the solution content item
    Verticals []string
    Industry verticals for the solution content item
    domains List<String>
    domain for the solution content item
    verticals List<String>
    Industry verticals for the solution content item
    domains string[]
    domain for the solution content item
    verticals string[]
    Industry verticals for the solution content item
    domains Sequence[str]
    domain for the solution content item
    verticals Sequence[str]
    Industry verticals for the solution content item
    domains List<String>
    domain for the solution content item
    verticals List<String>
    Industry verticals for the solution content item

    MetadataCategoriesResponse, MetadataCategoriesResponseArgs

    Domains List<string>
    domain for the solution content item
    Verticals List<string>
    Industry verticals for the solution content item
    Domains []string
    domain for the solution content item
    Verticals []string
    Industry verticals for the solution content item
    domains List<String>
    domain for the solution content item
    verticals List<String>
    Industry verticals for the solution content item
    domains string[]
    domain for the solution content item
    verticals string[]
    Industry verticals for the solution content item
    domains Sequence[str]
    domain for the solution content item
    verticals Sequence[str]
    Industry verticals for the solution content item
    domains List<String>
    domain for the solution content item
    verticals List<String>
    Industry verticals for the solution content item

    MetadataDependencies, MetadataDependenciesArgs

    ContentId string
    Id of the content item we depend on
    Criteria List<Pulumi.AzureNative.SecurityInsights.Inputs.MetadataDependencies>
    This is the list of dependencies we must fulfill, according to the AND/OR operator
    Kind string | Pulumi.AzureNative.SecurityInsights.Kind
    Type of the content item we depend on
    Name string
    Name of the content item
    Operator string | Pulumi.AzureNative.SecurityInsights.Operator
    Operator used for list of dependencies in criteria array.
    Version string
    Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
    ContentId string
    Id of the content item we depend on
    Criteria []MetadataDependencies
    This is the list of dependencies we must fulfill, according to the AND/OR operator
    Kind string | Kind
    Type of the content item we depend on
    Name string
    Name of the content item
    Operator string | Operator
    Operator used for list of dependencies in criteria array.
    Version string
    Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
    contentId String
    Id of the content item we depend on
    criteria List<MetadataDependencies>
    This is the list of dependencies we must fulfill, according to the AND/OR operator
    kind String | Kind
    Type of the content item we depend on
    name String
    Name of the content item
    operator String | Operator
    Operator used for list of dependencies in criteria array.
    version String
    Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
    contentId string
    Id of the content item we depend on
    criteria MetadataDependencies[]
    This is the list of dependencies we must fulfill, according to the AND/OR operator
    kind string | Kind
    Type of the content item we depend on
    name string
    Name of the content item
    operator string | Operator
    Operator used for list of dependencies in criteria array.
    version string
    Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
    content_id str
    Id of the content item we depend on
    criteria Sequence[MetadataDependencies]
    This is the list of dependencies we must fulfill, according to the AND/OR operator
    kind str | Kind
    Type of the content item we depend on
    name str
    Name of the content item
    operator str | Operator
    Operator used for list of dependencies in criteria array.
    version str
    Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
    contentId String
    Id of the content item we depend on
    criteria List<Property Map>
    This is the list of dependencies we must fulfill, according to the AND/OR operator
    kind String | "DataConnector" | "DataType" | "Workbook" | "WorkbookTemplate" | "Playbook" | "PlaybookTemplate" | "AnalyticsRuleTemplate" | "AnalyticsRule" | "HuntingQuery" | "InvestigationQuery" | "Parser" | "Watchlist" | "WatchlistTemplate" | "Solution" | "AzureFunction" | "LogicAppsCustomConnector" | "AutomationRule"
    Type of the content item we depend on
    name String
    Name of the content item
    operator String | "AND" | "OR"
    Operator used for list of dependencies in criteria array.
    version String
    Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.

    MetadataDependenciesResponse, MetadataDependenciesResponseArgs

    ContentId string
    Id of the content item we depend on
    Criteria List<Pulumi.AzureNative.SecurityInsights.Inputs.MetadataDependenciesResponse>
    This is the list of dependencies we must fulfill, according to the AND/OR operator
    Kind string
    Type of the content item we depend on
    Name string
    Name of the content item
    Operator string
    Operator used for list of dependencies in criteria array.
    Version string
    Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
    ContentId string
    Id of the content item we depend on
    Criteria []MetadataDependenciesResponse
    This is the list of dependencies we must fulfill, according to the AND/OR operator
    Kind string
    Type of the content item we depend on
    Name string
    Name of the content item
    Operator string
    Operator used for list of dependencies in criteria array.
    Version string
    Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
    contentId String
    Id of the content item we depend on
    criteria List<MetadataDependenciesResponse>
    This is the list of dependencies we must fulfill, according to the AND/OR operator
    kind String
    Type of the content item we depend on
    name String
    Name of the content item
    operator String
    Operator used for list of dependencies in criteria array.
    version String
    Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
    contentId string
    Id of the content item we depend on
    criteria MetadataDependenciesResponse[]
    This is the list of dependencies we must fulfill, according to the AND/OR operator
    kind string
    Type of the content item we depend on
    name string
    Name of the content item
    operator string
    Operator used for list of dependencies in criteria array.
    version string
    Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
    content_id str
    Id of the content item we depend on
    criteria Sequence[MetadataDependenciesResponse]
    This is the list of dependencies we must fulfill, according to the AND/OR operator
    kind str
    Type of the content item we depend on
    name str
    Name of the content item
    operator str
    Operator used for list of dependencies in criteria array.
    version str
    Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
    contentId String
    Id of the content item we depend on
    criteria List<Property Map>
    This is the list of dependencies we must fulfill, according to the AND/OR operator
    kind String
    Type of the content item we depend on
    name String
    Name of the content item
    operator String
    Operator used for list of dependencies in criteria array.
    version String
    Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.

    MetadataSource, MetadataSourceArgs

    Kind string | Pulumi.AzureNative.SecurityInsights.SourceKind
    Source type of the content
    Name string
    Name of the content source. The repo name, solution name, LA workspace name etc.
    SourceId string
    ID of the content source. The solution ID, workspace ID, etc
    Kind string | SourceKind
    Source type of the content
    Name string
    Name of the content source. The repo name, solution name, LA workspace name etc.
    SourceId string
    ID of the content source. The solution ID, workspace ID, etc
    kind String | SourceKind
    Source type of the content
    name String
    Name of the content source. The repo name, solution name, LA workspace name etc.
    sourceId String
    ID of the content source. The solution ID, workspace ID, etc
    kind string | SourceKind
    Source type of the content
    name string
    Name of the content source. The repo name, solution name, LA workspace name etc.
    sourceId string
    ID of the content source. The solution ID, workspace ID, etc
    kind str | SourceKind
    Source type of the content
    name str
    Name of the content source. The repo name, solution name, LA workspace name etc.
    source_id str
    ID of the content source. The solution ID, workspace ID, etc
    kind String | "LocalWorkspace" | "Community" | "Solution" | "SourceRepository"
    Source type of the content
    name String
    Name of the content source. The repo name, solution name, LA workspace name etc.
    sourceId String
    ID of the content source. The solution ID, workspace ID, etc

    MetadataSourceResponse, MetadataSourceResponseArgs

    Kind string
    Source type of the content
    Name string
    Name of the content source. The repo name, solution name, LA workspace name etc.
    SourceId string
    ID of the content source. The solution ID, workspace ID, etc
    Kind string
    Source type of the content
    Name string
    Name of the content source. The repo name, solution name, LA workspace name etc.
    SourceId string
    ID of the content source. The solution ID, workspace ID, etc
    kind String
    Source type of the content
    name String
    Name of the content source. The repo name, solution name, LA workspace name etc.
    sourceId String
    ID of the content source. The solution ID, workspace ID, etc
    kind string
    Source type of the content
    name string
    Name of the content source. The repo name, solution name, LA workspace name etc.
    sourceId string
    ID of the content source. The solution ID, workspace ID, etc
    kind str
    Source type of the content
    name str
    Name of the content source. The repo name, solution name, LA workspace name etc.
    source_id str
    ID of the content source. The solution ID, workspace ID, etc
    kind String
    Source type of the content
    name String
    Name of the content source. The repo name, solution name, LA workspace name etc.
    sourceId String
    ID of the content source. The solution ID, workspace ID, etc

    MetadataSupport, MetadataSupportArgs

    Tier string | Pulumi.AzureNative.SecurityInsights.SupportTier
    Type of support for content item
    Email string
    Email of support contact
    Link string
    Link for support help, like to support page to open a ticket etc.
    Name string
    Name of the support contact. Company or person.
    Tier string | SupportTier
    Type of support for content item
    Email string
    Email of support contact
    Link string
    Link for support help, like to support page to open a ticket etc.
    Name string
    Name of the support contact. Company or person.
    tier String | SupportTier
    Type of support for content item
    email String
    Email of support contact
    link String
    Link for support help, like to support page to open a ticket etc.
    name String
    Name of the support contact. Company or person.
    tier string | SupportTier
    Type of support for content item
    email string
    Email of support contact
    link string
    Link for support help, like to support page to open a ticket etc.
    name string
    Name of the support contact. Company or person.
    tier str | SupportTier
    Type of support for content item
    email str
    Email of support contact
    link str
    Link for support help, like to support page to open a ticket etc.
    name str
    Name of the support contact. Company or person.
    tier String | "Microsoft" | "Partner" | "Community"
    Type of support for content item
    email String
    Email of support contact
    link String
    Link for support help, like to support page to open a ticket etc.
    name String
    Name of the support contact. Company or person.

    MetadataSupportResponse, MetadataSupportResponseArgs

    Tier string
    Type of support for content item
    Email string
    Email of support contact
    Link string
    Link for support help, like to support page to open a ticket etc.
    Name string
    Name of the support contact. Company or person.
    Tier string
    Type of support for content item
    Email string
    Email of support contact
    Link string
    Link for support help, like to support page to open a ticket etc.
    Name string
    Name of the support contact. Company or person.
    tier String
    Type of support for content item
    email String
    Email of support contact
    link String
    Link for support help, like to support page to open a ticket etc.
    name String
    Name of the support contact. Company or person.
    tier string
    Type of support for content item
    email string
    Email of support contact
    link string
    Link for support help, like to support page to open a ticket etc.
    name string
    Name of the support contact. Company or person.
    tier str
    Type of support for content item
    email str
    Email of support contact
    link str
    Link for support help, like to support page to open a ticket etc.
    name str
    Name of the support contact. Company or person.
    tier String
    Type of support for content item
    email String
    Email of support contact
    link String
    Link for support help, like to support page to open a ticket etc.
    name String
    Name of the support contact. Company or person.

    Operator, OperatorArgs

    AND
    AND
    OR
    OR
    OperatorAND
    AND
    OperatorOR
    OR
    AND
    AND
    OR
    OR
    AND
    AND
    OR
    OR
    AND_
    AND
    OR_
    OR
    "AND"
    AND
    "OR"
    OR

    PackageKind, PackageKindArgs

    Solution
    Solution
    Standalone
    Standalone
    PackageKindSolution
    Solution
    PackageKindStandalone
    Standalone
    Solution
    Solution
    Standalone
    Standalone
    Solution
    Solution
    Standalone
    Standalone
    SOLUTION
    Solution
    STANDALONE
    Standalone
    "Solution"
    Solution
    "Standalone"
    Standalone

    SourceKind, SourceKindArgs

    LocalWorkspace
    LocalWorkspace
    Community
    Community
    Solution
    Solution
    SourceRepository
    SourceRepository
    SourceKindLocalWorkspace
    LocalWorkspace
    SourceKindCommunity
    Community
    SourceKindSolution
    Solution
    SourceKindSourceRepository
    SourceRepository
    LocalWorkspace
    LocalWorkspace
    Community
    Community
    Solution
    Solution
    SourceRepository
    SourceRepository
    LocalWorkspace
    LocalWorkspace
    Community
    Community
    Solution
    Solution
    SourceRepository
    SourceRepository
    LOCAL_WORKSPACE
    LocalWorkspace
    COMMUNITY
    Community
    SOLUTION
    Solution
    SOURCE_REPOSITORY
    SourceRepository
    "LocalWorkspace"
    LocalWorkspace
    "Community"
    Community
    "Solution"
    Solution
    "SourceRepository"
    SourceRepository

    SupportTier, SupportTierArgs

    Microsoft
    Microsoft
    Partner
    Partner
    Community
    Community
    SupportTierMicrosoft
    Microsoft
    SupportTierPartner
    Partner
    SupportTierCommunity
    Community
    Microsoft
    Microsoft
    Partner
    Partner
    Community
    Community
    Microsoft
    Microsoft
    Partner
    Partner
    Community
    Community
    MICROSOFT
    Microsoft
    PARTNER
    Partner
    COMMUNITY
    Community
    "Microsoft"
    Microsoft
    "Partner"
    Partner
    "Community"
    Community

    SystemDataResponse, SystemDataResponseArgs

    CreatedAt string
    The timestamp of resource creation (UTC).
    CreatedBy string
    The identity that created the resource.
    CreatedByType string
    The type of identity that created the resource.
    LastModifiedAt string
    The timestamp of resource last modification (UTC)
    LastModifiedBy string
    The identity that last modified the resource.
    LastModifiedByType string
    The type of identity that last modified the resource.
    CreatedAt string
    The timestamp of resource creation (UTC).
    CreatedBy string
    The identity that created the resource.
    CreatedByType string
    The type of identity that created the resource.
    LastModifiedAt string
    The timestamp of resource last modification (UTC)
    LastModifiedBy string
    The identity that last modified the resource.
    LastModifiedByType string
    The type of identity that last modified the resource.
    createdAt String
    The timestamp of resource creation (UTC).
    createdBy String
    The identity that created the resource.
    createdByType String
    The type of identity that created the resource.
    lastModifiedAt String
    The timestamp of resource last modification (UTC)
    lastModifiedBy String
    The identity that last modified the resource.
    lastModifiedByType String
    The type of identity that last modified the resource.
    createdAt string
    The timestamp of resource creation (UTC).
    createdBy string
    The identity that created the resource.
    createdByType string
    The type of identity that created the resource.
    lastModifiedAt string
    The timestamp of resource last modification (UTC)
    lastModifiedBy string
    The identity that last modified the resource.
    lastModifiedByType string
    The type of identity that last modified the resource.
    created_at str
    The timestamp of resource creation (UTC).
    created_by str
    The identity that created the resource.
    created_by_type str
    The type of identity that created the resource.
    last_modified_at str
    The timestamp of resource last modification (UTC)
    last_modified_by str
    The identity that last modified the resource.
    last_modified_by_type str
    The type of identity that last modified the resource.
    createdAt String
    The timestamp of resource creation (UTC).
    createdBy String
    The identity that created the resource.
    createdByType String
    The type of identity that created the resource.
    lastModifiedAt String
    The timestamp of resource last modification (UTC)
    lastModifiedBy String
    The identity that last modified the resource.
    lastModifiedByType String
    The type of identity that last modified the resource.

    TemplatePropertiesResponse, TemplatePropertiesResponseArgs

    ContentId string
    Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
    ContentKind string
    The kind of content the template is for.
    ContentProductId string
    Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template
    DependantTemplates List<Pulumi.AzureNative.SecurityInsights.Inputs.TemplatePropertiesResponse>
    Dependant templates. Expandable.
    DisplayName string
    The display name of the template
    IsDeprecated string
    Flag indicates if this template is deprecated
    PackageId string
    the package Id contains this template
    PackageVersion string
    Version of the package. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    Source Pulumi.AzureNative.SecurityInsights.Inputs.MetadataSourceResponse
    Source of the content. This is where/how it was created.
    Version string
    Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    Author Pulumi.AzureNative.SecurityInsights.Inputs.MetadataAuthorResponse
    The creator of the content item.
    Categories Pulumi.AzureNative.SecurityInsights.Inputs.MetadataCategoriesResponse
    Categories for the item
    ContentSchemaVersion string
    Schema version of the content. Can be used to distinguish between different flow based on the schema version
    CustomVersion string
    The custom version of the content. A optional free text
    Dependencies Pulumi.AzureNative.SecurityInsights.Inputs.MetadataDependenciesResponse
    Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
    FirstPublishDate string
    first publish date content item
    Icon string
    the icon identifier. this id can later be fetched from the content metadata
    LastPublishDate string
    last publish date for the content item
    MainTemplate object
    The JSON of the ARM template to deploy active content. Expandable.
    PackageKind string
    the packageKind of the package contains this template
    PackageName string
    the name of the package contains this template
    PreviewImages List<string>
    preview image file names. These will be taken from the solution artifacts
    PreviewImagesDark List<string>
    preview image file names. These will be taken from the solution artifacts. used for dark theme support
    Providers List<string>
    Providers for the content item
    Support Pulumi.AzureNative.SecurityInsights.Inputs.MetadataSupportResponse
    Support information for the template - type, name, contact information
    ThreatAnalysisTactics List<string>
    the tactics the resource covers
    ThreatAnalysisTechniques List<string>
    the techniques the resource covers, these have to be aligned with the tactics being used
    ContentId string
    Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
    ContentKind string
    The kind of content the template is for.
    ContentProductId string
    Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template
    DependantTemplates []TemplatePropertiesResponse
    Dependant templates. Expandable.
    DisplayName string
    The display name of the template
    IsDeprecated string
    Flag indicates if this template is deprecated
    PackageId string
    the package Id contains this template
    PackageVersion string
    Version of the package. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    Source MetadataSourceResponse
    Source of the content. This is where/how it was created.
    Version string
    Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    Author MetadataAuthorResponse
    The creator of the content item.
    Categories MetadataCategoriesResponse
    Categories for the item
    ContentSchemaVersion string
    Schema version of the content. Can be used to distinguish between different flow based on the schema version
    CustomVersion string
    The custom version of the content. A optional free text
    Dependencies MetadataDependenciesResponse
    Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
    FirstPublishDate string
    first publish date content item
    Icon string
    the icon identifier. this id can later be fetched from the content metadata
    LastPublishDate string
    last publish date for the content item
    MainTemplate interface{}
    The JSON of the ARM template to deploy active content. Expandable.
    PackageKind string
    the packageKind of the package contains this template
    PackageName string
    the name of the package contains this template
    PreviewImages []string
    preview image file names. These will be taken from the solution artifacts
    PreviewImagesDark []string
    preview image file names. These will be taken from the solution artifacts. used for dark theme support
    Providers []string
    Providers for the content item
    Support MetadataSupportResponse
    Support information for the template - type, name, contact information
    ThreatAnalysisTactics []string
    the tactics the resource covers
    ThreatAnalysisTechniques []string
    the techniques the resource covers, these have to be aligned with the tactics being used
    contentId String
    Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
    contentKind String
    The kind of content the template is for.
    contentProductId String
    Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template
    dependantTemplates List<TemplatePropertiesResponse>
    Dependant templates. Expandable.
    displayName String
    The display name of the template
    isDeprecated String
    Flag indicates if this template is deprecated
    packageId String
    the package Id contains this template
    packageVersion String
    Version of the package. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    source MetadataSourceResponse
    Source of the content. This is where/how it was created.
    version String
    Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    author MetadataAuthorResponse
    The creator of the content item.
    categories MetadataCategoriesResponse
    Categories for the item
    contentSchemaVersion String
    Schema version of the content. Can be used to distinguish between different flow based on the schema version
    customVersion String
    The custom version of the content. A optional free text
    dependencies MetadataDependenciesResponse
    Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
    firstPublishDate String
    first publish date content item
    icon String
    the icon identifier. this id can later be fetched from the content metadata
    lastPublishDate String
    last publish date for the content item
    mainTemplate Object
    The JSON of the ARM template to deploy active content. Expandable.
    packageKind String
    the packageKind of the package contains this template
    packageName String
    the name of the package contains this template
    previewImages List<String>
    preview image file names. These will be taken from the solution artifacts
    previewImagesDark List<String>
    preview image file names. These will be taken from the solution artifacts. used for dark theme support
    providers List<String>
    Providers for the content item
    support MetadataSupportResponse
    Support information for the template - type, name, contact information
    threatAnalysisTactics List<String>
    the tactics the resource covers
    threatAnalysisTechniques List<String>
    the techniques the resource covers, these have to be aligned with the tactics being used
    contentId string
    Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
    contentKind string
    The kind of content the template is for.
    contentProductId string
    Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template
    dependantTemplates TemplatePropertiesResponse[]
    Dependant templates. Expandable.
    displayName string
    The display name of the template
    isDeprecated string
    Flag indicates if this template is deprecated
    packageId string
    the package Id contains this template
    packageVersion string
    Version of the package. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    source MetadataSourceResponse
    Source of the content. This is where/how it was created.
    version string
    Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    author MetadataAuthorResponse
    The creator of the content item.
    categories MetadataCategoriesResponse
    Categories for the item
    contentSchemaVersion string
    Schema version of the content. Can be used to distinguish between different flow based on the schema version
    customVersion string
    The custom version of the content. A optional free text
    dependencies MetadataDependenciesResponse
    Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
    firstPublishDate string
    first publish date content item
    icon string
    the icon identifier. this id can later be fetched from the content metadata
    lastPublishDate string
    last publish date for the content item
    mainTemplate any
    The JSON of the ARM template to deploy active content. Expandable.
    packageKind string
    the packageKind of the package contains this template
    packageName string
    the name of the package contains this template
    previewImages string[]
    preview image file names. These will be taken from the solution artifacts
    previewImagesDark string[]
    preview image file names. These will be taken from the solution artifacts. used for dark theme support
    providers string[]
    Providers for the content item
    support MetadataSupportResponse
    Support information for the template - type, name, contact information
    threatAnalysisTactics string[]
    the tactics the resource covers
    threatAnalysisTechniques string[]
    the techniques the resource covers, these have to be aligned with the tactics being used
    content_id str
    Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
    content_kind str
    The kind of content the template is for.
    content_product_id str
    Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template
    dependant_templates Sequence[TemplatePropertiesResponse]
    Dependant templates. Expandable.
    display_name str
    The display name of the template
    is_deprecated str
    Flag indicates if this template is deprecated
    package_id str
    the package Id contains this template
    package_version str
    Version of the package. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    source MetadataSourceResponse
    Source of the content. This is where/how it was created.
    version str
    Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    author MetadataAuthorResponse
    The creator of the content item.
    categories MetadataCategoriesResponse
    Categories for the item
    content_schema_version str
    Schema version of the content. Can be used to distinguish between different flow based on the schema version
    custom_version str
    The custom version of the content. A optional free text
    dependencies MetadataDependenciesResponse
    Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
    first_publish_date str
    first publish date content item
    icon str
    the icon identifier. this id can later be fetched from the content metadata
    last_publish_date str
    last publish date for the content item
    main_template Any
    The JSON of the ARM template to deploy active content. Expandable.
    package_kind str
    the packageKind of the package contains this template
    package_name str
    the name of the package contains this template
    preview_images Sequence[str]
    preview image file names. These will be taken from the solution artifacts
    preview_images_dark Sequence[str]
    preview image file names. These will be taken from the solution artifacts. used for dark theme support
    providers Sequence[str]
    Providers for the content item
    support MetadataSupportResponse
    Support information for the template - type, name, contact information
    threat_analysis_tactics Sequence[str]
    the tactics the resource covers
    threat_analysis_techniques Sequence[str]
    the techniques the resource covers, these have to be aligned with the tactics being used
    contentId String
    Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
    contentKind String
    The kind of content the template is for.
    contentProductId String
    Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template
    dependantTemplates List<Property Map>
    Dependant templates. Expandable.
    displayName String
    The display name of the template
    isDeprecated String
    Flag indicates if this template is deprecated
    packageId String
    the package Id contains this template
    packageVersion String
    Version of the package. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    source Property Map
    Source of the content. This is where/how it was created.
    version String
    Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
    author Property Map
    The creator of the content item.
    categories Property Map
    Categories for the item
    contentSchemaVersion String
    Schema version of the content. Can be used to distinguish between different flow based on the schema version
    customVersion String
    The custom version of the content. A optional free text
    dependencies Property Map
    Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
    firstPublishDate String
    first publish date content item
    icon String
    the icon identifier. this id can later be fetched from the content metadata
    lastPublishDate String
    last publish date for the content item
    mainTemplate Any
    The JSON of the ARM template to deploy active content. Expandable.
    packageKind String
    the packageKind of the package contains this template
    packageName String
    the name of the package contains this template
    previewImages List<String>
    preview image file names. These will be taken from the solution artifacts
    previewImagesDark List<String>
    preview image file names. These will be taken from the solution artifacts. used for dark theme support
    providers List<String>
    Providers for the content item
    support Property Map
    Support information for the template - type, name, contact information
    threatAnalysisTactics List<String>
    the tactics the resource covers
    threatAnalysisTechniques List<String>
    the techniques the resource covers, these have to be aligned with the tactics being used

    Import

    An existing resource can be imported using its type token, name, and identifier, e.g.

    $ pulumi import azure-native:securityinsights:ContentTemplate azuresentinel.azure-sentinel-solution-ciscoumbrella /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/contentTemplates/{templateId}

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Azure Native pulumi/pulumi-azure-native
    License
    Apache-2.0
    azure-native logo
    This is the latest version of Azure Native. Use the Azure Native v2 docs if using the v2 version of this package.
    Azure Native v3.2.0 published on Monday, Apr 14, 2025 by Pulumi
    pulumi/pulumi-azure-native