Azure Native v1.102.0, May 2 23

azure-native.securityinsights.Incident

Explore with Pulumi AI

Represents an incident in Azure Security Insights. API Version: 2020-01-01.

Example Usage

Creates or updates an incident.

using System.Collections.Generic;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var incident = new AzureNative.SecurityInsights.Incident("incident", new()
    {
        Classification = "FalsePositive",
        ClassificationComment = "Not a malicious activity",
        ClassificationReason = "IncorrectAlertLogic",
        Description = "This is a demo incident",
        FirstActivityTimeUtc = "2019-01-01T13:00:30Z",
        IncidentId = "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
        LastActivityTimeUtc = "2019-01-01T13:05:30Z",
        Owner = new AzureNative.SecurityInsights.Inputs.IncidentOwnerInfoArgs
        {
            ObjectId = "2046feea-040d-4a46-9e2b-91c2941bfa70",
        },
        ResourceGroupName = "myRg",
        Severity = "High",
        Status = "Closed",
        Title = "My incident",
        WorkspaceName = "myWorkspace",
    });

});

package main

import (
	securityinsights "github.com/pulumi/pulumi-azure-native/sdk/go/azure/securityinsights"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := securityinsights.NewIncident(ctx, "incident", &securityinsights.IncidentArgs{
			Classification:        pulumi.String("FalsePositive"),
			ClassificationComment: pulumi.String("Not a malicious activity"),
			ClassificationReason:  pulumi.String("IncorrectAlertLogic"),
			Description:           pulumi.String("This is a demo incident"),
			FirstActivityTimeUtc:  pulumi.String("2019-01-01T13:00:30Z"),
			IncidentId:            pulumi.String("73e01a99-5cd7-4139-a149-9f2736ff2ab5"),
			LastActivityTimeUtc:   pulumi.String("2019-01-01T13:05:30Z"),
			Owner: &securityinsights.IncidentOwnerInfoArgs{
				ObjectId: pulumi.String("2046feea-040d-4a46-9e2b-91c2941bfa70"),
			},
			ResourceGroupName: pulumi.String("myRg"),
			Severity:          pulumi.String("High"),
			Status:            pulumi.String("Closed"),
			Title:             pulumi.String("My incident"),
			WorkspaceName:     pulumi.String("myWorkspace"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.securityinsights.Incident;
import com.pulumi.azurenative.securityinsights.IncidentArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var incident = new Incident("incident", IncidentArgs.builder()        
            .classification("FalsePositive")
            .classificationComment("Not a malicious activity")
            .classificationReason("IncorrectAlertLogic")
            .description("This is a demo incident")
            .firstActivityTimeUtc("2019-01-01T13:00:30Z")
            .incidentId("73e01a99-5cd7-4139-a149-9f2736ff2ab5")
            .lastActivityTimeUtc("2019-01-01T13:05:30Z")
            .owner(Map.of("objectId", "2046feea-040d-4a46-9e2b-91c2941bfa70"))
            .resourceGroupName("myRg")
            .severity("High")
            .status("Closed")
            .title("My incident")
            .workspaceName("myWorkspace")
            .build());

    }
}

import pulumi
import pulumi_azure_native as azure_native

incident = azure_native.securityinsights.Incident("incident",
    classification="FalsePositive",
    classification_comment="Not a malicious activity",
    classification_reason="IncorrectAlertLogic",
    description="This is a demo incident",
    first_activity_time_utc="2019-01-01T13:00:30Z",
    incident_id="73e01a99-5cd7-4139-a149-9f2736ff2ab5",
    last_activity_time_utc="2019-01-01T13:05:30Z",
    owner=azure_native.securityinsights.IncidentOwnerInfoArgs(
        object_id="2046feea-040d-4a46-9e2b-91c2941bfa70",
    ),
    resource_group_name="myRg",
    severity="High",
    status="Closed",
    title="My incident",
    workspace_name="myWorkspace")

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const incident = new azure_native.securityinsights.Incident("incident", {
    classification: "FalsePositive",
    classificationComment: "Not a malicious activity",
    classificationReason: "IncorrectAlertLogic",
    description: "This is a demo incident",
    firstActivityTimeUtc: "2019-01-01T13:00:30Z",
    incidentId: "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
    lastActivityTimeUtc: "2019-01-01T13:05:30Z",
    owner: {
        objectId: "2046feea-040d-4a46-9e2b-91c2941bfa70",
    },
    resourceGroupName: "myRg",
    severity: "High",
    status: "Closed",
    title: "My incident",
    workspaceName: "myWorkspace",
});

resources:
  incident:
    type: azure-native:securityinsights:Incident
    properties:
      classification: FalsePositive
      classificationComment: Not a malicious activity
      classificationReason: IncorrectAlertLogic
      description: This is a demo incident
      firstActivityTimeUtc: 2019-01-01T13:00:30Z
      incidentId: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
      lastActivityTimeUtc: 2019-01-01T13:05:30Z
      owner:
        objectId: 2046feea-040d-4a46-9e2b-91c2941bfa70
      resourceGroupName: myRg
      severity: High
      status: Closed
      title: My incident
      workspaceName: myWorkspace

Create Incident Resource

new Incident(name: string, args: IncidentArgs, opts?: CustomResourceOptions);

@overload
def Incident(resource_name: str,
             opts: Optional[ResourceOptions] = None,
             classification: Optional[Union[str, IncidentClassification]] = None,
             classification_comment: Optional[str] = None,
             classification_reason: Optional[Union[str, IncidentClassificationReason]] = None,
             description: Optional[str] = None,
             first_activity_time_utc: Optional[str] = None,
             incident_id: Optional[str] = None,
             labels: Optional[Sequence[IncidentLabelArgs]] = None,
             last_activity_time_utc: Optional[str] = None,
             owner: Optional[IncidentOwnerInfoArgs] = None,
             resource_group_name: Optional[str] = None,
             severity: Optional[Union[str, IncidentSeverity]] = None,
             status: Optional[Union[str, IncidentStatus]] = None,
             title: Optional[str] = None,
             workspace_name: Optional[str] = None)
@overload
def Incident(resource_name: str,
             args: IncidentArgs,
             opts: Optional[ResourceOptions] = None)

func NewIncident(ctx *Context, name string, args IncidentArgs, opts ...ResourceOption) (*Incident, error)

public Incident(string name, IncidentArgs args, CustomResourceOptions? opts = null)

public Incident(String name, IncidentArgs args)
public Incident(String name, IncidentArgs args, CustomResourceOptions options)

type: azure-native:securityinsights:Incident
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

name string: The unique name of the resource.
args IncidentArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args IncidentArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args IncidentArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args IncidentArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args IncidentArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

Incident Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The Incident resource accepts the following input properties:

ResourceGroupName string: The name of the resource group within the user's subscription. The name is case insensitive.
Severity string | Pulumi.AzureNative.SecurityInsights.IncidentSeverity: The severity of the incident
Status string | Pulumi.AzureNative.SecurityInsights.IncidentStatus: The status of the incident
Title string: The title of the incident
WorkspaceName string: The name of the workspace.
Classification string | Pulumi.AzureNative.SecurityInsights.IncidentClassification: The reason the incident was closed
ClassificationComment string: Describes the reason the incident was closed
ClassificationReason string | Pulumi.AzureNative.SecurityInsights.IncidentClassificationReason: The classification reason the incident was closed with
Description string: The description of the incident
FirstActivityTimeUtc string: The time of the first activity in the incident
IncidentId string: Incident ID
Labels List<Pulumi.AzureNative.SecurityInsights.Inputs.IncidentLabelArgs>: List of labels relevant to this incident
LastActivityTimeUtc string: The time of the last activity in the incident
Owner Pulumi.AzureNative.SecurityInsights.Inputs.IncidentOwnerInfoArgs: Describes a user that the incident is assigned to

ResourceGroupName string: The name of the resource group within the user's subscription. The name is case insensitive.
Severity string | IncidentSeverity: The severity of the incident
Status string | IncidentStatus: The status of the incident
Title string: The title of the incident
WorkspaceName string: The name of the workspace.
Classification string | IncidentClassification: The reason the incident was closed
ClassificationComment string: Describes the reason the incident was closed
ClassificationReason string | IncidentClassificationReason: The classification reason the incident was closed with
Description string: The description of the incident
FirstActivityTimeUtc string: The time of the first activity in the incident
IncidentId string: Incident ID
Labels []IncidentLabelArgs: List of labels relevant to this incident
LastActivityTimeUtc string: The time of the last activity in the incident
Owner IncidentOwnerInfoArgs: Describes a user that the incident is assigned to

resourceGroupName String: The name of the resource group within the user's subscription. The name is case insensitive.
severity String | IncidentSeverity: The severity of the incident
status String | IncidentStatus: The status of the incident
title String: The title of the incident
workspaceName String: The name of the workspace.
classification String | IncidentClassification: The reason the incident was closed
classificationComment String: Describes the reason the incident was closed
classificationReason String | IncidentClassificationReason: The classification reason the incident was closed with
description String: The description of the incident
firstActivityTimeUtc String: The time of the first activity in the incident
incidentId String: Incident ID
labels List<IncidentLabelArgs>: List of labels relevant to this incident
lastActivityTimeUtc String: The time of the last activity in the incident
owner IncidentOwnerInfoArgs: Describes a user that the incident is assigned to

resourceGroupName string: The name of the resource group within the user's subscription. The name is case insensitive.
severity string | IncidentSeverity: The severity of the incident
status string | IncidentStatus: The status of the incident
title string: The title of the incident
workspaceName string: The name of the workspace.
classification string | IncidentClassification: The reason the incident was closed
classificationComment string: Describes the reason the incident was closed
classificationReason string | IncidentClassificationReason: The classification reason the incident was closed with
description string: The description of the incident
firstActivityTimeUtc string: The time of the first activity in the incident
incidentId string: Incident ID
labels IncidentLabelArgs[]: List of labels relevant to this incident
lastActivityTimeUtc string: The time of the last activity in the incident
owner IncidentOwnerInfoArgs: Describes a user that the incident is assigned to

resource_group_name str: The name of the resource group within the user's subscription. The name is case insensitive.
severity str | IncidentSeverity: The severity of the incident
status str | IncidentStatus: The status of the incident
title str: The title of the incident
workspace_name str: The name of the workspace.
classification str | IncidentClassification: The reason the incident was closed
classification_comment str: Describes the reason the incident was closed
classification_reason str | IncidentClassificationReason: The classification reason the incident was closed with
description str: The description of the incident
first_activity_time_utc str: The time of the first activity in the incident
incident_id str: Incident ID
labels Sequence[IncidentLabelArgs]: List of labels relevant to this incident
last_activity_time_utc str: The time of the last activity in the incident
owner IncidentOwnerInfoArgs: Describes a user that the incident is assigned to

resourceGroupName String: The name of the resource group within the user's subscription. The name is case insensitive.
severity String | "High" | "Medium" | "Low" | "Informational": The severity of the incident
status String | "New" | "Active" | "Closed": The status of the incident
title String: The title of the incident
workspaceName String: The name of the workspace.
classification String | "Undetermined" | "TruePositive" | "BenignPositive" | "FalsePositive": The reason the incident was closed
classificationComment String: Describes the reason the incident was closed
classificationReason String | "SuspiciousActivity" | "SuspiciousButExpected" | "IncorrectAlertLogic" | "InaccurateData": The classification reason the incident was closed with
description String: The description of the incident
firstActivityTimeUtc String: The time of the first activity in the incident
incidentId String: Incident ID
labels List<Property Map>: List of labels relevant to this incident
lastActivityTimeUtc String: The time of the last activity in the incident
owner Property Map: Describes a user that the incident is assigned to

Outputs

All input properties are implicitly available as output properties. Additionally, the Incident resource produces the following output properties:

AdditionalData Pulumi.AzureNative.SecurityInsights.Outputs.IncidentAdditionalDataResponse: Additional data on the incident
CreatedTimeUtc string: The time the incident was created
Id string: The provider-assigned unique ID for this managed resource.
IncidentNumber int: A sequential number
IncidentUrl string: The deep-link url to the incident in Azure portal
LastModifiedTimeUtc string: The last time the incident was updated
Name string: Azure resource name
RelatedAnalyticRuleIds List<string>: List of resource ids of Analytic rules related to the incident
Type string: Azure resource type
Etag string: Etag of the azure resource

AdditionalData IncidentAdditionalDataResponse: Additional data on the incident
CreatedTimeUtc string: The time the incident was created
Id string: The provider-assigned unique ID for this managed resource.
IncidentNumber int: A sequential number
IncidentUrl string: The deep-link url to the incident in Azure portal
LastModifiedTimeUtc string: The last time the incident was updated
Name string: Azure resource name
RelatedAnalyticRuleIds []string: List of resource ids of Analytic rules related to the incident
Type string: Azure resource type
Etag string: Etag of the azure resource

additionalData IncidentAdditionalDataResponse: Additional data on the incident
createdTimeUtc String: The time the incident was created
id String: The provider-assigned unique ID for this managed resource.
incidentNumber Integer: A sequential number
incidentUrl String: The deep-link url to the incident in Azure portal
lastModifiedTimeUtc String: The last time the incident was updated
name String: Azure resource name
relatedAnalyticRuleIds List<String>: List of resource ids of Analytic rules related to the incident
type String: Azure resource type
etag String: Etag of the azure resource

additionalData IncidentAdditionalDataResponse: Additional data on the incident
createdTimeUtc string: The time the incident was created
id string: The provider-assigned unique ID for this managed resource.
incidentNumber number: A sequential number
incidentUrl string: The deep-link url to the incident in Azure portal
lastModifiedTimeUtc string: The last time the incident was updated
name string: Azure resource name
relatedAnalyticRuleIds string[]: List of resource ids of Analytic rules related to the incident
type string: Azure resource type
etag string: Etag of the azure resource

additional_data IncidentAdditionalDataResponse: Additional data on the incident
created_time_utc str: The time the incident was created
id str: The provider-assigned unique ID for this managed resource.
incident_number int: A sequential number
incident_url str: The deep-link url to the incident in Azure portal
last_modified_time_utc str: The last time the incident was updated
name str: Azure resource name
related_analytic_rule_ids Sequence[str]: List of resource ids of Analytic rules related to the incident
type str: Azure resource type
etag str: Etag of the azure resource

additionalData Property Map: Additional data on the incident
createdTimeUtc String: The time the incident was created
id String: The provider-assigned unique ID for this managed resource.
incidentNumber Number: A sequential number
incidentUrl String: The deep-link url to the incident in Azure portal
lastModifiedTimeUtc String: The last time the incident was updated
name String: Azure resource name
relatedAnalyticRuleIds List<String>: List of resource ids of Analytic rules related to the incident
type String: Azure resource type
etag String: Etag of the azure resource

Supporting Types

IncidentAdditionalDataResponse

AlertProductNames List<string>: List of product names of alerts in the incident
AlertsCount int: The number of alerts in the incident
BookmarksCount int: The number of bookmarks in the incident
CommentsCount int: The number of comments in the incident
Tactics List<string>: The tactics associated with incident

AlertProductNames []string: List of product names of alerts in the incident
AlertsCount int: The number of alerts in the incident
BookmarksCount int: The number of bookmarks in the incident
CommentsCount int: The number of comments in the incident
Tactics []string: The tactics associated with incident

alertProductNames List<String>: List of product names of alerts in the incident
alertsCount Integer: The number of alerts in the incident
bookmarksCount Integer: The number of bookmarks in the incident
commentsCount Integer: The number of comments in the incident
tactics List<String>: The tactics associated with incident

alertProductNames string[]: List of product names of alerts in the incident
alertsCount number: The number of alerts in the incident
bookmarksCount number: The number of bookmarks in the incident
commentsCount number: The number of comments in the incident
tactics string[]: The tactics associated with incident

alert_product_names Sequence[str]: List of product names of alerts in the incident
alerts_count int: The number of alerts in the incident
bookmarks_count int: The number of bookmarks in the incident
comments_count int: The number of comments in the incident
tactics Sequence[str]: The tactics associated with incident

alertProductNames List<String>: List of product names of alerts in the incident
alertsCount Number: The number of alerts in the incident
bookmarksCount Number: The number of bookmarks in the incident
commentsCount Number: The number of comments in the incident
tactics List<String>: The tactics associated with incident

IncidentClassification

Undetermined: Undetermined
Incident classification was undetermined
TruePositive: TruePositive
Incident was true positive
BenignPositive: BenignPositive
Incident was benign positive
FalsePositive: FalsePositive
Incident was false positive

IncidentClassificationUndetermined: Undetermined
Incident classification was undetermined
IncidentClassificationTruePositive: TruePositive
Incident was true positive
IncidentClassificationBenignPositive: BenignPositive
Incident was benign positive
IncidentClassificationFalsePositive: FalsePositive
Incident was false positive

Undetermined: Undetermined
Incident classification was undetermined
TruePositive: TruePositive
Incident was true positive
BenignPositive: BenignPositive
Incident was benign positive
FalsePositive: FalsePositive
Incident was false positive

Undetermined: Undetermined
Incident classification was undetermined
TruePositive: TruePositive
Incident was true positive
BenignPositive: BenignPositive
Incident was benign positive
FalsePositive: FalsePositive
Incident was false positive

UNDETERMINED: Undetermined
Incident classification was undetermined
TRUE_POSITIVE: TruePositive
Incident was true positive
BENIGN_POSITIVE: BenignPositive
Incident was benign positive
FALSE_POSITIVE: FalsePositive
Incident was false positive

"Undetermined": Undetermined
Incident classification was undetermined
"TruePositive": TruePositive
Incident was true positive
"BenignPositive": BenignPositive
Incident was benign positive
"FalsePositive": FalsePositive
Incident was false positive

IncidentClassificationReason

SuspiciousActivity: SuspiciousActivity
Classification reason was suspicious activity
SuspiciousButExpected: SuspiciousButExpected
Classification reason was suspicious but expected
IncorrectAlertLogic: IncorrectAlertLogic
Classification reason was incorrect alert logic
InaccurateData: InaccurateData
Classification reason was inaccurate data

IncidentClassificationReasonSuspiciousActivity: SuspiciousActivity
Classification reason was suspicious activity
IncidentClassificationReasonSuspiciousButExpected: SuspiciousButExpected
Classification reason was suspicious but expected
IncidentClassificationReasonIncorrectAlertLogic: IncorrectAlertLogic
Classification reason was incorrect alert logic
IncidentClassificationReasonInaccurateData: InaccurateData
Classification reason was inaccurate data

SuspiciousActivity: SuspiciousActivity
Classification reason was suspicious activity
SuspiciousButExpected: SuspiciousButExpected
Classification reason was suspicious but expected
IncorrectAlertLogic: IncorrectAlertLogic
Classification reason was incorrect alert logic
InaccurateData: InaccurateData
Classification reason was inaccurate data

SuspiciousActivity: SuspiciousActivity
Classification reason was suspicious activity
SuspiciousButExpected: SuspiciousButExpected
Classification reason was suspicious but expected
IncorrectAlertLogic: IncorrectAlertLogic
Classification reason was incorrect alert logic
InaccurateData: InaccurateData
Classification reason was inaccurate data

SUSPICIOUS_ACTIVITY: SuspiciousActivity
Classification reason was suspicious activity
SUSPICIOUS_BUT_EXPECTED: SuspiciousButExpected
Classification reason was suspicious but expected
INCORRECT_ALERT_LOGIC: IncorrectAlertLogic
Classification reason was incorrect alert logic
INACCURATE_DATA: InaccurateData
Classification reason was inaccurate data

"SuspiciousActivity": SuspiciousActivity
Classification reason was suspicious activity
"SuspiciousButExpected": SuspiciousButExpected
Classification reason was suspicious but expected
"IncorrectAlertLogic": IncorrectAlertLogic
Classification reason was incorrect alert logic
"InaccurateData": InaccurateData
Classification reason was inaccurate data

IncidentLabel

LabelName string: The name of the label

LabelName string: The name of the label

labelName String: The name of the label

labelName string: The name of the label

label_name str: The name of the label

labelName String: The name of the label

IncidentLabelResponse

LabelName string: The name of the label
LabelType string: The type of the label

LabelName string: The name of the label
LabelType string: The type of the label

labelName String: The name of the label
labelType String: The type of the label

labelName string: The name of the label
labelType string: The type of the label

label_name str: The name of the label
label_type str: The type of the label

labelName String: The name of the label
labelType String: The type of the label

IncidentOwnerInfo

AssignedTo string: The name of the user the incident is assigned to.
Email string: The email of the user the incident is assigned to.
ObjectId string: The object id of the user the incident is assigned to.
UserPrincipalName string: The user principal name of the user the incident is assigned to.

AssignedTo string: The name of the user the incident is assigned to.
Email string: The email of the user the incident is assigned to.
ObjectId string: The object id of the user the incident is assigned to.
UserPrincipalName string: The user principal name of the user the incident is assigned to.

assignedTo String: The name of the user the incident is assigned to.
email String: The email of the user the incident is assigned to.
objectId String: The object id of the user the incident is assigned to.
userPrincipalName String: The user principal name of the user the incident is assigned to.

assignedTo string: The name of the user the incident is assigned to.
email string: The email of the user the incident is assigned to.
objectId string: The object id of the user the incident is assigned to.
userPrincipalName string: The user principal name of the user the incident is assigned to.

assigned_to str: The name of the user the incident is assigned to.
email str: The email of the user the incident is assigned to.
object_id str: The object id of the user the incident is assigned to.
user_principal_name str: The user principal name of the user the incident is assigned to.

assignedTo String: The name of the user the incident is assigned to.
email String: The email of the user the incident is assigned to.
objectId String: The object id of the user the incident is assigned to.
userPrincipalName String: The user principal name of the user the incident is assigned to.

IncidentOwnerInfoResponse

AssignedTo string: The name of the user the incident is assigned to.
Email string: The email of the user the incident is assigned to.
ObjectId string: The object id of the user the incident is assigned to.
UserPrincipalName string: The user principal name of the user the incident is assigned to.

AssignedTo string: The name of the user the incident is assigned to.
Email string: The email of the user the incident is assigned to.
ObjectId string: The object id of the user the incident is assigned to.
UserPrincipalName string: The user principal name of the user the incident is assigned to.

assignedTo String: The name of the user the incident is assigned to.
email String: The email of the user the incident is assigned to.
objectId String: The object id of the user the incident is assigned to.
userPrincipalName String: The user principal name of the user the incident is assigned to.

assignedTo string: The name of the user the incident is assigned to.
email string: The email of the user the incident is assigned to.
objectId string: The object id of the user the incident is assigned to.
userPrincipalName string: The user principal name of the user the incident is assigned to.

assigned_to str: The name of the user the incident is assigned to.
email str: The email of the user the incident is assigned to.
object_id str: The object id of the user the incident is assigned to.
user_principal_name str: The user principal name of the user the incident is assigned to.

assignedTo String: The name of the user the incident is assigned to.
email String: The email of the user the incident is assigned to.
objectId String: The object id of the user the incident is assigned to.
userPrincipalName String: The user principal name of the user the incident is assigned to.

IncidentSeverity

High: High
High severity
Medium: Medium
Medium severity
Low: Low
Low severity
Informational: Informational
Informational severity

IncidentSeverityHigh: High
High severity
IncidentSeverityMedium: Medium
Medium severity
IncidentSeverityLow: Low
Low severity
IncidentSeverityInformational: Informational
Informational severity

High: High
High severity
Medium: Medium
Medium severity
Low: Low
Low severity
Informational: Informational
Informational severity

High: High
High severity
Medium: Medium
Medium severity
Low: Low
Low severity
Informational: Informational
Informational severity

HIGH: High
High severity
MEDIUM: Medium
Medium severity
LOW: Low
Low severity
INFORMATIONAL: Informational
Informational severity

"High": High
High severity
"Medium": Medium
Medium severity
"Low": Low
Low severity
"Informational": Informational
Informational severity

IncidentStatus

New: New
An active incident which isn't being handled currently
Active: Active
An active incident which is being handled
Closed: Closed
A non-active incident

IncidentStatusNew: New
An active incident which isn't being handled currently
IncidentStatusActive: Active
An active incident which is being handled
IncidentStatusClosed: Closed
A non-active incident

New: New
An active incident which isn't being handled currently
Active: Active
An active incident which is being handled
Closed: Closed
A non-active incident

New: New
An active incident which isn't being handled currently
Active: Active
An active incident which is being handled
Closed: Closed
A non-active incident

NEW: New
An active incident which isn't being handled currently
ACTIVE: Active
An active incident which is being handled
CLOSED: Closed
A non-active incident

"New": New
An active incident which isn't being handled currently
"Active": Active
An active incident which is being handled
"Closed": Closed
A non-active incident

Import

An existing resource can be imported using its type token, name, and identifier, e.g.

$ pulumi import azure-native:securityinsights:Incident 73e01a99-5cd7-4139-a149-9f2736ff2ab5 /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5

Package Details

Repository: Azure Native pulumi/pulumi-azure-native
License: Apache-2.0