azure-native.securityinsights.ContentTemplate

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var contentTemplate = new AzureNative.SecurityInsights.ContentTemplate("contentTemplate", new()
    {
        Author = new AzureNative.SecurityInsights.Inputs.MetadataAuthorArgs
        {
            Email = "support@microsoft.com",
            Name = "Microsoft",
        },
        ContentId = "8365ebfe-a381-45b7-ad08-7d818070e11f",
        ContentKind = "AnalyticsRule",
        DisplayName = "API Protection workbook template",
        MainTemplate = 
        {
            { "$schema", "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#" },
            { "contentVersion", "1.0.1" },
            { "resources", new[]
            {
                
                {
                    { "apiVersion", "2022-04-01-preview" },
                    { "kind", "Scheduled" },
                    { "location", "[parameters('workspace-location')]" },
                    { "name", "8365ebfe-a381-45b7-ad08-7d818070e11f" },
                    { "properties", 
                    {
                        { "description", "Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user" },
                        { "displayName", "Critical or High Severity Detections by User" },
                        { "enabled", false },
                        { "query", "..." },
                        { "queryFrequency", "PT1H" },
                        { "queryPeriod", "PT1H" },
                        { "severity", "High" },
                        { "status", "Available" },
                        { "suppressionDuration", "PT1H" },
                        { "suppressionEnabled", false },
                        { "triggerOperator", "GreaterThan" },
                        { "triggerThreshold", 0 },
                    } },
                    { "type", "Microsoft.SecurityInsights/AlertRuleTemplates" },
                },
                
                {
                    { "apiVersion", "2022-01-01-preview" },
                    { "name", "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split([resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)],'/'))))]" },
                    { "properties", 
                    {
                        { "author", 
                        {
                            { "email", "support@microsoft.com" },
                            { "name", "Microsoft" },
                        } },
                        { "contentId", "4465ebde-b381-45f7-ad08-7d818070a11c" },
                        { "description", "CrowdStrike Falcon Endpoint Protection Analytics Rule 1" },
                        { "kind", "AnalyticsRule" },
                        { "parentId", "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)]" },
                        { "source", 
                        {
                            { "kind", "Solution" },
                            { "name", "str" },
                            { "sourceId", "str.azure-sentinel-solution-str" },
                        } },
                        { "support", 
                        {
                            { "email", "support@microsoft.com" },
                            { "link", "https://support.microsoft.com/" },
                            { "name", "Microsoft Corporation" },
                            { "tier", "Microsoft" },
                        } },
                        { "version", "1.0.0" },
                    } },
                    { "type", "Microsoft.OperationalInsights/workspaces/providers/metadata" },
                },
            } },
        },
        PackageId = "str.azure-sentinel-solution-str",
        PackageKind = "Solution",
        PackageName = "str",
        ResourceGroupName = "myRg",
        Source = new AzureNative.SecurityInsights.Inputs.MetadataSourceArgs
        {
            Kind = "Solution",
            Name = "str",
            SourceId = "str.azure-sentinel-solution-str",
        },
        Support = new AzureNative.SecurityInsights.Inputs.MetadataSupportArgs
        {
            Email = "support@microsoft.com",
            Link = "https://support.microsoft.com/",
            Name = "Microsoft Corporation",
            Tier = "Microsoft",
        },
        TemplateId = "str.azure-sentinel-solution-str",
        Version = "1.0.1",
        WorkspaceName = "myWorkspace",
    });

});

package main

import (
	"github.com/pulumi/pulumi-azure-native-sdk/securityinsights/v2"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := securityinsights.NewContentTemplate(ctx, "contentTemplate", &securityinsights.ContentTemplateArgs{
			Author: &securityinsights.MetadataAuthorArgs{
				Email: pulumi.String("support@microsoft.com"),
				Name:  pulumi.String("Microsoft"),
			},
			ContentId:   pulumi.String("8365ebfe-a381-45b7-ad08-7d818070e11f"),
			ContentKind: pulumi.String("AnalyticsRule"),
			DisplayName: pulumi.String("API Protection workbook template"),
			MainTemplate: pulumi.Any{
				Schema:         "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
				ContentVersion: "1.0.1",
				Resources: []interface{}{
					map[string]interface{}{
						"apiVersion": "2022-04-01-preview",
						"kind":       "Scheduled",
						"location":   "[parameters('workspace-location')]",
						"name":       "8365ebfe-a381-45b7-ad08-7d818070e11f",
						"properties": map[string]interface{}{
							"description":         "Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user",
							"displayName":         "Critical or High Severity Detections by User",
							"enabled":             false,
							"query":               "...",
							"queryFrequency":      "PT1H",
							"queryPeriod":         "PT1H",
							"severity":            "High",
							"status":              "Available",
							"suppressionDuration": "PT1H",
							"suppressionEnabled":  false,
							"triggerOperator":     "GreaterThan",
							"triggerThreshold":    0,
						},
						"type": "Microsoft.SecurityInsights/AlertRuleTemplates",
					},
					map[string]interface{}{
						"apiVersion": "2022-01-01-preview",
						"name":       "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split([resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)],'/'))))]",
						"properties": map[string]interface{}{
							"author": map[string]interface{}{
								"email": "support@microsoft.com",
								"name":  "Microsoft",
							},
							"contentId":   "4465ebde-b381-45f7-ad08-7d818070a11c",
							"description": "CrowdStrike Falcon Endpoint Protection Analytics Rule 1",
							"kind":        "AnalyticsRule",
							"parentId":    "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)]",
							"source": map[string]interface{}{
								"kind":     "Solution",
								"name":     "str",
								"sourceId": "str.azure-sentinel-solution-str",
							},
							"support": map[string]interface{}{
								"email": "support@microsoft.com",
								"link":  "https://support.microsoft.com/",
								"name":  "Microsoft Corporation",
								"tier":  "Microsoft",
							},
							"version": "1.0.0",
						},
						"type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
					},
				},
			},
			PackageId:         pulumi.String("str.azure-sentinel-solution-str"),
			PackageKind:       pulumi.String("Solution"),
			PackageName:       pulumi.String("str"),
			ResourceGroupName: pulumi.String("myRg"),
			Source: &securityinsights.MetadataSourceArgs{
				Kind:     pulumi.String("Solution"),
				Name:     pulumi.String("str"),
				SourceId: pulumi.String("str.azure-sentinel-solution-str"),
			},
			Support: &securityinsights.MetadataSupportArgs{
				Email: pulumi.String("support@microsoft.com"),
				Link:  pulumi.String("https://support.microsoft.com/"),
				Name:  pulumi.String("Microsoft Corporation"),
				Tier:  pulumi.String("Microsoft"),
			},
			TemplateId:    pulumi.String("str.azure-sentinel-solution-str"),
			Version:       pulumi.String("1.0.1"),
			WorkspaceName: pulumi.String("myWorkspace"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.securityinsights.ContentTemplate;
import com.pulumi.azurenative.securityinsights.ContentTemplateArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var contentTemplate = new ContentTemplate("contentTemplate", ContentTemplateArgs.builder()        
            .author(Map.ofEntries(
                Map.entry("email", "support@microsoft.com"),
                Map.entry("name", "Microsoft")
            ))
            .contentId("8365ebfe-a381-45b7-ad08-7d818070e11f")
            .contentKind("AnalyticsRule")
            .displayName("API Protection workbook template")
            .mainTemplate(Map.ofEntries(
                Map.entry("$schema", "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#"),
                Map.entry("contentVersion", "1.0.1"),
                Map.entry("resources",                 
                    Map.ofEntries(
                        Map.entry("apiVersion", "2022-04-01-preview"),
                        Map.entry("kind", "Scheduled"),
                        Map.entry("location", "[parameters('workspace-location')]"),
                        Map.entry("name", "8365ebfe-a381-45b7-ad08-7d818070e11f"),
                        Map.entry("properties", Map.ofEntries(
                            Map.entry("description", "Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user"),
                            Map.entry("displayName", "Critical or High Severity Detections by User"),
                            Map.entry("enabled", false),
                            Map.entry("query", "..."),
                            Map.entry("queryFrequency", "PT1H"),
                            Map.entry("queryPeriod", "PT1H"),
                            Map.entry("severity", "High"),
                            Map.entry("status", "Available"),
                            Map.entry("suppressionDuration", "PT1H"),
                            Map.entry("suppressionEnabled", false),
                            Map.entry("triggerOperator", "GreaterThan"),
                            Map.entry("triggerThreshold", 0)
                        )),
                        Map.entry("type", "Microsoft.SecurityInsights/AlertRuleTemplates")
                    ),
                    Map.ofEntries(
                        Map.entry("apiVersion", "2022-01-01-preview"),
                        Map.entry("name", "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split([resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)],'/'))))]"),
                        Map.entry("properties", Map.ofEntries(
                            Map.entry("author", Map.ofEntries(
                                Map.entry("email", "support@microsoft.com"),
                                Map.entry("name", "Microsoft")
                            )),
                            Map.entry("contentId", "4465ebde-b381-45f7-ad08-7d818070a11c"),
                            Map.entry("description", "CrowdStrike Falcon Endpoint Protection Analytics Rule 1"),
                            Map.entry("kind", "AnalyticsRule"),
                            Map.entry("parentId", "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)]"),
                            Map.entry("source", Map.ofEntries(
                                Map.entry("kind", "Solution"),
                                Map.entry("name", "str"),
                                Map.entry("sourceId", "str.azure-sentinel-solution-str")
                            )),
                            Map.entry("support", Map.ofEntries(
                                Map.entry("email", "support@microsoft.com"),
                                Map.entry("link", "https://support.microsoft.com/"),
                                Map.entry("name", "Microsoft Corporation"),
                                Map.entry("tier", "Microsoft")
                            )),
                            Map.entry("version", "1.0.0")
                        )),
                        Map.entry("type", "Microsoft.OperationalInsights/workspaces/providers/metadata")
                    ))
            ))
            .packageId("str.azure-sentinel-solution-str")
            .packageKind("Solution")
            .packageName("str")
            .resourceGroupName("myRg")
            .source(Map.ofEntries(
                Map.entry("kind", "Solution"),
                Map.entry("name", "str"),
                Map.entry("sourceId", "str.azure-sentinel-solution-str")
            ))
            .support(Map.ofEntries(
                Map.entry("email", "support@microsoft.com"),
                Map.entry("link", "https://support.microsoft.com/"),
                Map.entry("name", "Microsoft Corporation"),
                Map.entry("tier", "Microsoft")
            ))
            .templateId("str.azure-sentinel-solution-str")
            .version("1.0.1")
            .workspaceName("myWorkspace")
            .build());

    }
}

import pulumi
import pulumi_azure_native as azure_native

content_template = azure_native.securityinsights.ContentTemplate("contentTemplate",
    author=azure_native.securityinsights.MetadataAuthorArgs(
        email="support@microsoft.com",
        name="Microsoft",
    ),
    content_id="8365ebfe-a381-45b7-ad08-7d818070e11f",
    content_kind="AnalyticsRule",
    display_name="API Protection workbook template",
    main_template={
        "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
        "contentVersion": "1.0.1",
        "resources": [
            {
                "apiVersion": "2022-04-01-preview",
                "kind": "Scheduled",
                "location": "[parameters('workspace-location')]",
                "name": "8365ebfe-a381-45b7-ad08-7d818070e11f",
                "properties": {
                    "description": "Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user",
                    "displayName": "Critical or High Severity Detections by User",
                    "enabled": False,
                    "query": "...",
                    "queryFrequency": "PT1H",
                    "queryPeriod": "PT1H",
                    "severity": "High",
                    "status": "Available",
                    "suppressionDuration": "PT1H",
                    "suppressionEnabled": False,
                    "triggerOperator": "GreaterThan",
                    "triggerThreshold": 0,
                },
                "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
            },
            {
                "apiVersion": "2022-01-01-preview",
                "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split([resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)],'/'))))]",
                "properties": {
                    "author": {
                        "email": "support@microsoft.com",
                        "name": "Microsoft",
                    },
                    "contentId": "4465ebde-b381-45f7-ad08-7d818070a11c",
                    "description": "CrowdStrike Falcon Endpoint Protection Analytics Rule 1",
                    "kind": "AnalyticsRule",
                    "parentId": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)]",
                    "source": {
                        "kind": "Solution",
                        "name": "str",
                        "sourceId": "str.azure-sentinel-solution-str",
                    },
                    "support": {
                        "email": "support@microsoft.com",
                        "link": "https://support.microsoft.com/",
                        "name": "Microsoft Corporation",
                        "tier": "Microsoft",
                    },
                    "version": "1.0.0",
                },
                "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
            },
        ],
    },
    package_id="str.azure-sentinel-solution-str",
    package_kind="Solution",
    package_name="str",
    resource_group_name="myRg",
    source=azure_native.securityinsights.MetadataSourceArgs(
        kind="Solution",
        name="str",
        source_id="str.azure-sentinel-solution-str",
    ),
    support=azure_native.securityinsights.MetadataSupportArgs(
        email="support@microsoft.com",
        link="https://support.microsoft.com/",
        name="Microsoft Corporation",
        tier="Microsoft",
    ),
    template_id="str.azure-sentinel-solution-str",
    version="1.0.1",
    workspace_name="myWorkspace")

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const contentTemplate = new azure_native.securityinsights.ContentTemplate("contentTemplate", {
    author: {
        email: "support@microsoft.com",
        name: "Microsoft",
    },
    contentId: "8365ebfe-a381-45b7-ad08-7d818070e11f",
    contentKind: "AnalyticsRule",
    displayName: "API Protection workbook template",
    mainTemplate: {
        $schema: "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
        contentVersion: "1.0.1",
        resources: [
            {
                apiVersion: "2022-04-01-preview",
                kind: "Scheduled",
                location: "[parameters('workspace-location')]",
                name: "8365ebfe-a381-45b7-ad08-7d818070e11f",
                properties: {
                    description: "Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user",
                    displayName: "Critical or High Severity Detections by User",
                    enabled: false,
                    query: "...",
                    queryFrequency: "PT1H",
                    queryPeriod: "PT1H",
                    severity: "High",
                    status: "Available",
                    suppressionDuration: "PT1H",
                    suppressionEnabled: false,
                    triggerOperator: "GreaterThan",
                    triggerThreshold: 0,
                },
                type: "Microsoft.SecurityInsights/AlertRuleTemplates",
            },
            {
                apiVersion: "2022-01-01-preview",
                name: "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split([resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)],'/'))))]",
                properties: {
                    author: {
                        email: "support@microsoft.com",
                        name: "Microsoft",
                    },
                    contentId: "4465ebde-b381-45f7-ad08-7d818070a11c",
                    description: "CrowdStrike Falcon Endpoint Protection Analytics Rule 1",
                    kind: "AnalyticsRule",
                    parentId: "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)]",
                    source: {
                        kind: "Solution",
                        name: "str",
                        sourceId: "str.azure-sentinel-solution-str",
                    },
                    support: {
                        email: "support@microsoft.com",
                        link: "https://support.microsoft.com/",
                        name: "Microsoft Corporation",
                        tier: "Microsoft",
                    },
                    version: "1.0.0",
                },
                type: "Microsoft.OperationalInsights/workspaces/providers/metadata",
            },
        ],
    },
    packageId: "str.azure-sentinel-solution-str",
    packageKind: "Solution",
    packageName: "str",
    resourceGroupName: "myRg",
    source: {
        kind: "Solution",
        name: "str",
        sourceId: "str.azure-sentinel-solution-str",
    },
    support: {
        email: "support@microsoft.com",
        link: "https://support.microsoft.com/",
        name: "Microsoft Corporation",
        tier: "Microsoft",
    },
    templateId: "str.azure-sentinel-solution-str",
    version: "1.0.1",
    workspaceName: "myWorkspace",
});

resources:
  contentTemplate:
    type: azure-native:securityinsights:ContentTemplate
    properties:
      author:
        email: support@microsoft.com
        name: Microsoft
      contentId: 8365ebfe-a381-45b7-ad08-7d818070e11f
      contentKind: AnalyticsRule
      displayName: API Protection workbook template
      mainTemplate:
        $schema: https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#
        contentVersion: 1.0.1
        resources:
          - apiVersion: 2022-04-01-preview
            kind: Scheduled
            location: '[parameters(''workspace-location'')]'
            name: 8365ebfe-a381-45b7-ad08-7d818070e11f
            properties:
              description: Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user
              displayName: Critical or High Severity Detections by User
              enabled: false
              query: '...'
              queryFrequency: PT1H
              queryPeriod: PT1H
              severity: High
              status: Available
              suppressionDuration: PT1H
              suppressionEnabled: false
              triggerOperator: GreaterThan
              triggerThreshold: 0
            type: Microsoft.SecurityInsights/AlertRuleTemplates
          - apiVersion: 2022-01-01-preview
            name: '[concat(parameters(''workspace''),''/Microsoft.SecurityInsights/'',concat(''AnalyticsRule-'', last(split([resourceId(''Microsoft.SecurityInsights/AlertRuleTemplates'', 8365ebfe-a381-45b7-ad08-7d818070e11f)],''/''))))]'
            properties:
              author:
                email: support@microsoft.com
                name: Microsoft
              contentId: 4465ebde-b381-45f7-ad08-7d818070a11c
              description: CrowdStrike Falcon Endpoint Protection Analytics Rule 1
              kind: AnalyticsRule
              parentId: '[resourceId(''Microsoft.SecurityInsights/AlertRuleTemplates'', 8365ebfe-a381-45b7-ad08-7d818070e11f)]'
              source:
                kind: Solution
                name: str
                sourceId: str.azure-sentinel-solution-str
              support:
                email: support@microsoft.com
                link: https://support.microsoft.com/
                name: Microsoft Corporation
                tier: Microsoft
              version: 1.0.0
            type: Microsoft.OperationalInsights/workspaces/providers/metadata
      packageId: str.azure-sentinel-solution-str
      packageKind: Solution
      packageName: str
      resourceGroupName: myRg
      source:
        kind: Solution
        name: str
        sourceId: str.azure-sentinel-solution-str
      support:
        email: support@microsoft.com
        link: https://support.microsoft.com/
        name: Microsoft Corporation
        tier: Microsoft
      templateId: str.azure-sentinel-solution-str
      version: 1.0.1
      workspaceName: myWorkspace