Azure Native v1.102.0, May 2 23

azure-native.securityinsights.ScheduledAlertRule

Explore with Pulumi AI

Represents scheduled alert rule. API Version: 2020-01-01.

Example Usage

Creates or updates a Fusion alert rule.

using System.Collections.Generic;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var scheduledAlertRule = new AzureNative.SecurityInsights.ScheduledAlertRule("scheduledAlertRule", new()
    {
        ResourceGroupName = "myRg",
        RuleId = "myFirstFusionRule",
        WorkspaceName = "myWorkspace",
    });

});

package main

import (
	securityinsights "github.com/pulumi/pulumi-azure-native/sdk/go/azure/securityinsights"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := securityinsights.NewScheduledAlertRule(ctx, "scheduledAlertRule", &securityinsights.ScheduledAlertRuleArgs{
			ResourceGroupName: pulumi.String("myRg"),
			RuleId:            pulumi.String("myFirstFusionRule"),
			WorkspaceName:     pulumi.String("myWorkspace"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.securityinsights.ScheduledAlertRule;
import com.pulumi.azurenative.securityinsights.ScheduledAlertRuleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var scheduledAlertRule = new ScheduledAlertRule("scheduledAlertRule", ScheduledAlertRuleArgs.builder()        
            .resourceGroupName("myRg")
            .ruleId("myFirstFusionRule")
            .workspaceName("myWorkspace")
            .build());

    }
}

import pulumi
import pulumi_azure_native as azure_native

scheduled_alert_rule = azure_native.securityinsights.ScheduledAlertRule("scheduledAlertRule",
    resource_group_name="myRg",
    rule_id="myFirstFusionRule",
    workspace_name="myWorkspace")

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const scheduledAlertRule = new azure_native.securityinsights.ScheduledAlertRule("scheduledAlertRule", {
    resourceGroupName: "myRg",
    ruleId: "myFirstFusionRule",
    workspaceName: "myWorkspace",
});

resources:
  scheduledAlertRule:
    type: azure-native:securityinsights:ScheduledAlertRule
    properties:
      resourceGroupName: myRg
      ruleId: myFirstFusionRule
      workspaceName: myWorkspace

Creates or updates a MicrosoftSecurityIncidentCreation rule.

using System.Collections.Generic;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var scheduledAlertRule = new AzureNative.SecurityInsights.ScheduledAlertRule("scheduledAlertRule", new()
    {
        ResourceGroupName = "myRg",
        RuleId = "microsoftSecurityIncidentCreationRuleExample",
        WorkspaceName = "myWorkspace",
    });

});

package main

import (
	securityinsights "github.com/pulumi/pulumi-azure-native/sdk/go/azure/securityinsights"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := securityinsights.NewScheduledAlertRule(ctx, "scheduledAlertRule", &securityinsights.ScheduledAlertRuleArgs{
			ResourceGroupName: pulumi.String("myRg"),
			RuleId:            pulumi.String("microsoftSecurityIncidentCreationRuleExample"),
			WorkspaceName:     pulumi.String("myWorkspace"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.securityinsights.ScheduledAlertRule;
import com.pulumi.azurenative.securityinsights.ScheduledAlertRuleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var scheduledAlertRule = new ScheduledAlertRule("scheduledAlertRule", ScheduledAlertRuleArgs.builder()        
            .resourceGroupName("myRg")
            .ruleId("microsoftSecurityIncidentCreationRuleExample")
            .workspaceName("myWorkspace")
            .build());

    }
}

import pulumi
import pulumi_azure_native as azure_native

scheduled_alert_rule = azure_native.securityinsights.ScheduledAlertRule("scheduledAlertRule",
    resource_group_name="myRg",
    rule_id="microsoftSecurityIncidentCreationRuleExample",
    workspace_name="myWorkspace")

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const scheduledAlertRule = new azure_native.securityinsights.ScheduledAlertRule("scheduledAlertRule", {
    resourceGroupName: "myRg",
    ruleId: "microsoftSecurityIncidentCreationRuleExample",
    workspaceName: "myWorkspace",
});

resources:
  scheduledAlertRule:
    type: azure-native:securityinsights:ScheduledAlertRule
    properties:
      resourceGroupName: myRg
      ruleId: microsoftSecurityIncidentCreationRuleExample
      workspaceName: myWorkspace

Creates or updates a Scheduled alert rule.

using System.Collections.Generic;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var scheduledAlertRule = new AzureNative.SecurityInsights.ScheduledAlertRule("scheduledAlertRule", new()
    {
        Description = "",
        DisplayName = "Rule2",
        Enabled = true,
        Kind = "Scheduled",
        Query = "ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden",
        QueryFrequency = "PT1H",
        QueryPeriod = "P2DT1H30M",
        ResourceGroupName = "myRg",
        RuleId = "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
        Severity = "High",
        SuppressionDuration = "PT1H",
        SuppressionEnabled = false,
        Tactics = new[]
        {
            "Persistence",
            "LateralMovement",
        },
        TriggerOperator = AzureNative.SecurityInsights.TriggerOperator.GreaterThan,
        TriggerThreshold = 0,
        WorkspaceName = "myWorkspace",
    });

});

package main

import (
	securityinsights "github.com/pulumi/pulumi-azure-native/sdk/go/azure/securityinsights"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := securityinsights.NewScheduledAlertRule(ctx, "scheduledAlertRule", &securityinsights.ScheduledAlertRuleArgs{
			Description:         pulumi.String(""),
			DisplayName:         pulumi.String("Rule2"),
			Enabled:             pulumi.Bool(true),
			Kind:                pulumi.String("Scheduled"),
			Query:               pulumi.String("ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden"),
			QueryFrequency:      pulumi.String("PT1H"),
			QueryPeriod:         pulumi.String("P2DT1H30M"),
			ResourceGroupName:   pulumi.String("myRg"),
			RuleId:              pulumi.String("73e01a99-5cd7-4139-a149-9f2736ff2ab5"),
			Severity:            pulumi.String("High"),
			SuppressionDuration: pulumi.String("PT1H"),
			SuppressionEnabled:  pulumi.Bool(false),
			Tactics: pulumi.StringArray{
				pulumi.String("Persistence"),
				pulumi.String("LateralMovement"),
			},
			TriggerOperator:  securityinsights.TriggerOperatorGreaterThan,
			TriggerThreshold: pulumi.Int(0),
			WorkspaceName:    pulumi.String("myWorkspace"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.securityinsights.ScheduledAlertRule;
import com.pulumi.azurenative.securityinsights.ScheduledAlertRuleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var scheduledAlertRule = new ScheduledAlertRule("scheduledAlertRule", ScheduledAlertRuleArgs.builder()        
            .description("")
            .displayName("Rule2")
            .enabled(true)
            .kind("Scheduled")
            .query("ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden")
            .queryFrequency("PT1H")
            .queryPeriod("P2DT1H30M")
            .resourceGroupName("myRg")
            .ruleId("73e01a99-5cd7-4139-a149-9f2736ff2ab5")
            .severity("High")
            .suppressionDuration("PT1H")
            .suppressionEnabled(false)
            .tactics(            
                "Persistence",
                "LateralMovement")
            .triggerOperator("GreaterThan")
            .triggerThreshold(0)
            .workspaceName("myWorkspace")
            .build());

    }
}

import pulumi
import pulumi_azure_native as azure_native

scheduled_alert_rule = azure_native.securityinsights.ScheduledAlertRule("scheduledAlertRule",
    description="",
    display_name="Rule2",
    enabled=True,
    kind="Scheduled",
    query="ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden",
    query_frequency="PT1H",
    query_period="P2DT1H30M",
    resource_group_name="myRg",
    rule_id="73e01a99-5cd7-4139-a149-9f2736ff2ab5",
    severity="High",
    suppression_duration="PT1H",
    suppression_enabled=False,
    tactics=[
        "Persistence",
        "LateralMovement",
    ],
    trigger_operator=azure_native.securityinsights.TriggerOperator.GREATER_THAN,
    trigger_threshold=0,
    workspace_name="myWorkspace")

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const scheduledAlertRule = new azure_native.securityinsights.ScheduledAlertRule("scheduledAlertRule", {
    description: "",
    displayName: "Rule2",
    enabled: true,
    kind: "Scheduled",
    query: "ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden",
    queryFrequency: "PT1H",
    queryPeriod: "P2DT1H30M",
    resourceGroupName: "myRg",
    ruleId: "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
    severity: "High",
    suppressionDuration: "PT1H",
    suppressionEnabled: false,
    tactics: [
        "Persistence",
        "LateralMovement",
    ],
    triggerOperator: azure_native.securityinsights.TriggerOperator.GreaterThan,
    triggerThreshold: 0,
    workspaceName: "myWorkspace",
});

resources:
  scheduledAlertRule:
    type: azure-native:securityinsights:ScheduledAlertRule
    properties:
      description:
      displayName: Rule2
      enabled: true
      kind: Scheduled
      query: ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden
      queryFrequency: PT1H
      queryPeriod: P2DT1H30M
      resourceGroupName: myRg
      ruleId: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
      severity: High
      suppressionDuration: PT1H
      suppressionEnabled: false
      tactics:
        - Persistence
        - LateralMovement
      triggerOperator: GreaterThan
      triggerThreshold: 0
      workspaceName: myWorkspace

Create ScheduledAlertRule Resource

new ScheduledAlertRule(name: string, args: ScheduledAlertRuleArgs, opts?: CustomResourceOptions);

@overload
def ScheduledAlertRule(resource_name: str,
                       opts: Optional[ResourceOptions] = None,
                       alert_rule_template_name: Optional[str] = None,
                       description: Optional[str] = None,
                       display_name: Optional[str] = None,
                       enabled: Optional[bool] = None,
                       query: Optional[str] = None,
                       query_frequency: Optional[str] = None,
                       query_period: Optional[str] = None,
                       resource_group_name: Optional[str] = None,
                       rule_id: Optional[str] = None,
                       severity: Optional[Union[str, AlertSeverity]] = None,
                       suppression_duration: Optional[str] = None,
                       suppression_enabled: Optional[bool] = None,
                       tactics: Optional[Sequence[Union[str, AttackTactic]]] = None,
                       trigger_operator: Optional[TriggerOperator] = None,
                       trigger_threshold: Optional[int] = None,
                       workspace_name: Optional[str] = None)
@overload
def ScheduledAlertRule(resource_name: str,
                       args: ScheduledAlertRuleArgs,
                       opts: Optional[ResourceOptions] = None)

func NewScheduledAlertRule(ctx *Context, name string, args ScheduledAlertRuleArgs, opts ...ResourceOption) (*ScheduledAlertRule, error)

public ScheduledAlertRule(string name, ScheduledAlertRuleArgs args, CustomResourceOptions? opts = null)

public ScheduledAlertRule(String name, ScheduledAlertRuleArgs args)
public ScheduledAlertRule(String name, ScheduledAlertRuleArgs args, CustomResourceOptions options)

type: azure-native:securityinsights:ScheduledAlertRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

name string: The unique name of the resource.
args ScheduledAlertRuleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args ScheduledAlertRuleArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args ScheduledAlertRuleArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args ScheduledAlertRuleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args ScheduledAlertRuleArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

ScheduledAlertRule Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The ScheduledAlertRule resource accepts the following input properties:

DisplayName string: The display name for alerts created by this alert rule.
Enabled bool: Determines whether this alert rule is enabled or disabled.
Query string: The query that creates alerts for this rule.
QueryFrequency string: The frequency (in ISO 8601 duration format) for this alert rule to run.
QueryPeriod string: The period (in ISO 8601 duration format) that this alert rule looks at.
ResourceGroupName string: The name of the resource group within the user's subscription. The name is case insensitive.
Severity string | Pulumi.AzureNative.SecurityInsights.AlertSeverity: The severity for alerts created by this alert rule.
SuppressionDuration string: The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.
SuppressionEnabled bool: Determines whether the suppression for this alert rule is enabled or disabled.
TriggerOperator Pulumi.AzureNative.SecurityInsights.TriggerOperator: The operation against the threshold that triggers alert rule.
TriggerThreshold int: The threshold triggers this alert rule.
WorkspaceName string: The name of the workspace.
AlertRuleTemplateName string: The Name of the alert rule template used to create this rule.
Description string: The description of the alert rule.
RuleId string: Alert rule ID
Tactics List<Union<string, Pulumi.AzureNative.SecurityInsights.AttackTactic>>: The tactics of the alert rule

DisplayName string: The display name for alerts created by this alert rule.
Enabled bool: Determines whether this alert rule is enabled or disabled.
Query string: The query that creates alerts for this rule.
QueryFrequency string: The frequency (in ISO 8601 duration format) for this alert rule to run.
QueryPeriod string: The period (in ISO 8601 duration format) that this alert rule looks at.
ResourceGroupName string: The name of the resource group within the user's subscription. The name is case insensitive.
Severity string | AlertSeverity: The severity for alerts created by this alert rule.
SuppressionDuration string: The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.
SuppressionEnabled bool: Determines whether the suppression for this alert rule is enabled or disabled.
TriggerOperator TriggerOperator: The operation against the threshold that triggers alert rule.
TriggerThreshold int: The threshold triggers this alert rule.
WorkspaceName string: The name of the workspace.
AlertRuleTemplateName string: The Name of the alert rule template used to create this rule.
Description string: The description of the alert rule.
RuleId string: Alert rule ID
Tactics []string: The tactics of the alert rule

displayName String: The display name for alerts created by this alert rule.
enabled Boolean: Determines whether this alert rule is enabled or disabled.
query String: The query that creates alerts for this rule.
queryFrequency String: The frequency (in ISO 8601 duration format) for this alert rule to run.
queryPeriod String: The period (in ISO 8601 duration format) that this alert rule looks at.
resourceGroupName String: The name of the resource group within the user's subscription. The name is case insensitive.
severity String | AlertSeverity: The severity for alerts created by this alert rule.
suppressionDuration String: The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.
suppressionEnabled Boolean: Determines whether the suppression for this alert rule is enabled or disabled.
triggerOperator TriggerOperator: The operation against the threshold that triggers alert rule.
triggerThreshold Integer: The threshold triggers this alert rule.
workspaceName String: The name of the workspace.
alertRuleTemplateName String: The Name of the alert rule template used to create this rule.
description String: The description of the alert rule.
ruleId String: Alert rule ID
tactics List<Either<String,AttackTactic>>: The tactics of the alert rule

displayName string: The display name for alerts created by this alert rule.
enabled boolean: Determines whether this alert rule is enabled or disabled.
query string: The query that creates alerts for this rule.
queryFrequency string: The frequency (in ISO 8601 duration format) for this alert rule to run.
queryPeriod string: The period (in ISO 8601 duration format) that this alert rule looks at.
resourceGroupName string: The name of the resource group within the user's subscription. The name is case insensitive.
severity string | AlertSeverity: The severity for alerts created by this alert rule.
suppressionDuration string: The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.
suppressionEnabled boolean: Determines whether the suppression for this alert rule is enabled or disabled.
triggerOperator TriggerOperator: The operation against the threshold that triggers alert rule.
triggerThreshold number: The threshold triggers this alert rule.
workspaceName string: The name of the workspace.
alertRuleTemplateName string: The Name of the alert rule template used to create this rule.
description string: The description of the alert rule.
ruleId string: Alert rule ID
tactics (string | AttackTactic)[]: The tactics of the alert rule

display_name str: The display name for alerts created by this alert rule.
enabled bool: Determines whether this alert rule is enabled or disabled.
query str: The query that creates alerts for this rule.
query_frequency str: The frequency (in ISO 8601 duration format) for this alert rule to run.
query_period str: The period (in ISO 8601 duration format) that this alert rule looks at.
resource_group_name str: The name of the resource group within the user's subscription. The name is case insensitive.
severity str | AlertSeverity: The severity for alerts created by this alert rule.
suppression_duration str: The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.
suppression_enabled bool: Determines whether the suppression for this alert rule is enabled or disabled.
trigger_operator TriggerOperator: The operation against the threshold that triggers alert rule.
trigger_threshold int: The threshold triggers this alert rule.
workspace_name str: The name of the workspace.
alert_rule_template_name str: The Name of the alert rule template used to create this rule.
description str: The description of the alert rule.
rule_id str: Alert rule ID
tactics Sequence[Union[str, AttackTactic]]: The tactics of the alert rule

displayName String: The display name for alerts created by this alert rule.
enabled Boolean: Determines whether this alert rule is enabled or disabled.
query String: The query that creates alerts for this rule.
queryFrequency String: The frequency (in ISO 8601 duration format) for this alert rule to run.
queryPeriod String: The period (in ISO 8601 duration format) that this alert rule looks at.
resourceGroupName String: The name of the resource group within the user's subscription. The name is case insensitive.
severity String | "High" | "Medium" | "Low" | "Informational": The severity for alerts created by this alert rule.
suppressionDuration String: The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.
suppressionEnabled Boolean: Determines whether the suppression for this alert rule is enabled or disabled.
triggerOperator "GreaterThan" | "LessThan" | "Equal" | "NotEqual": The operation against the threshold that triggers alert rule.
triggerThreshold Number: The threshold triggers this alert rule.
workspaceName String: The name of the workspace.
alertRuleTemplateName String: The Name of the alert rule template used to create this rule.
description String: The description of the alert rule.
ruleId String: Alert rule ID
tactics List<String | "Reconnaissance" | "ResourceDevelopment" | "InitialAccess" | "Execution" | "Persistence" | "PrivilegeEscalation" | "DefenseEvasion" | "CredentialAccess" | "Discovery" | "LateralMovement" | "Collection" | "Exfiltration" | "CommandAndControl" | "Impact" | "PreAttack" | "ImpairProcessControl" | "InhibitResponseFunction">: The tactics of the alert rule

Outputs

All input properties are implicitly available as output properties. Additionally, the ScheduledAlertRule resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.
LastModifiedUtc string: The last time that this alert rule has been modified.
Name string: Azure resource name
Type string: Azure resource type
Etag string: Etag of the azure resource

Id string: The provider-assigned unique ID for this managed resource.
LastModifiedUtc string: The last time that this alert rule has been modified.
Name string: Azure resource name
Type string: Azure resource type
Etag string: Etag of the azure resource

id String: The provider-assigned unique ID for this managed resource.
lastModifiedUtc String: The last time that this alert rule has been modified.
name String: Azure resource name
type String: Azure resource type
etag String: Etag of the azure resource

id string: The provider-assigned unique ID for this managed resource.
lastModifiedUtc string: The last time that this alert rule has been modified.
name string: Azure resource name
type string: Azure resource type
etag string: Etag of the azure resource

id str: The provider-assigned unique ID for this managed resource.
last_modified_utc str: The last time that this alert rule has been modified.
name str: Azure resource name
type str: Azure resource type
etag str: Etag of the azure resource

id String: The provider-assigned unique ID for this managed resource.
lastModifiedUtc String: The last time that this alert rule has been modified.
name String: Azure resource name
type String: Azure resource type
etag String: Etag of the azure resource

Supporting Types

AlertSeverity

High: High
High severity
Medium: Medium
Medium severity
Low: Low
Low severity
Informational: Informational
Informational severity

AlertSeverityHigh: High
High severity
AlertSeverityMedium: Medium
Medium severity
AlertSeverityLow: Low
Low severity
AlertSeverityInformational: Informational
Informational severity

High: High
High severity
Medium: Medium
Medium severity
Low: Low
Low severity
Informational: Informational
Informational severity

High: High
High severity
Medium: Medium
Medium severity
Low: Low
Low severity
Informational: Informational
Informational severity

HIGH: High
High severity
MEDIUM: Medium
Medium severity
LOW: Low
Low severity
INFORMATIONAL: Informational
Informational severity

"High": High
High severity
"Medium": Medium
Medium severity
"Low": Low
Low severity
"Informational": Informational
Informational severity

AttackTactic

Reconnaissance: Reconnaissance
ResourceDevelopment: ResourceDevelopment
InitialAccess: InitialAccess
Execution: Execution
Persistence: Persistence
PrivilegeEscalation: PrivilegeEscalation
DefenseEvasion: DefenseEvasion
CredentialAccess: CredentialAccess
Discovery: Discovery
LateralMovement: LateralMovement
Collection: Collection
Exfiltration: Exfiltration
CommandAndControl: CommandAndControl
Impact: Impact
PreAttack: PreAttack
ImpairProcessControl: ImpairProcessControl
InhibitResponseFunction: InhibitResponseFunction

AttackTacticReconnaissance: Reconnaissance
AttackTacticResourceDevelopment: ResourceDevelopment
AttackTacticInitialAccess: InitialAccess
AttackTacticExecution: Execution
AttackTacticPersistence: Persistence
AttackTacticPrivilegeEscalation: PrivilegeEscalation
AttackTacticDefenseEvasion: DefenseEvasion
AttackTacticCredentialAccess: CredentialAccess
AttackTacticDiscovery: Discovery
AttackTacticLateralMovement: LateralMovement
AttackTacticCollection: Collection
AttackTacticExfiltration: Exfiltration
AttackTacticCommandAndControl: CommandAndControl
AttackTacticImpact: Impact
AttackTacticPreAttack: PreAttack
AttackTacticImpairProcessControl: ImpairProcessControl
AttackTacticInhibitResponseFunction: InhibitResponseFunction

Reconnaissance: Reconnaissance
ResourceDevelopment: ResourceDevelopment
InitialAccess: InitialAccess
Execution: Execution
Persistence: Persistence
PrivilegeEscalation: PrivilegeEscalation
DefenseEvasion: DefenseEvasion
CredentialAccess: CredentialAccess
Discovery: Discovery
LateralMovement: LateralMovement
Collection: Collection
Exfiltration: Exfiltration
CommandAndControl: CommandAndControl
Impact: Impact
PreAttack: PreAttack
ImpairProcessControl: ImpairProcessControl
InhibitResponseFunction: InhibitResponseFunction

Reconnaissance: Reconnaissance
ResourceDevelopment: ResourceDevelopment
InitialAccess: InitialAccess
Execution: Execution
Persistence: Persistence
PrivilegeEscalation: PrivilegeEscalation
DefenseEvasion: DefenseEvasion
CredentialAccess: CredentialAccess
Discovery: Discovery
LateralMovement: LateralMovement
Collection: Collection
Exfiltration: Exfiltration
CommandAndControl: CommandAndControl
Impact: Impact
PreAttack: PreAttack
ImpairProcessControl: ImpairProcessControl
InhibitResponseFunction: InhibitResponseFunction

RECONNAISSANCE: Reconnaissance
RESOURCE_DEVELOPMENT: ResourceDevelopment
INITIAL_ACCESS: InitialAccess
EXECUTION: Execution
PERSISTENCE: Persistence
PRIVILEGE_ESCALATION: PrivilegeEscalation
DEFENSE_EVASION: DefenseEvasion
CREDENTIAL_ACCESS: CredentialAccess
DISCOVERY: Discovery
LATERAL_MOVEMENT: LateralMovement
COLLECTION: Collection
EXFILTRATION: Exfiltration
COMMAND_AND_CONTROL: CommandAndControl
IMPACT: Impact
PRE_ATTACK: PreAttack
IMPAIR_PROCESS_CONTROL: ImpairProcessControl
INHIBIT_RESPONSE_FUNCTION: InhibitResponseFunction

"Reconnaissance": Reconnaissance
"ResourceDevelopment": ResourceDevelopment
"InitialAccess": InitialAccess
"Execution": Execution
"Persistence": Persistence
"PrivilegeEscalation": PrivilegeEscalation
"DefenseEvasion": DefenseEvasion
"CredentialAccess": CredentialAccess
"Discovery": Discovery
"LateralMovement": LateralMovement
"Collection": Collection
"Exfiltration": Exfiltration
"CommandAndControl": CommandAndControl
"Impact": Impact
"PreAttack": PreAttack
"ImpairProcessControl": ImpairProcessControl
"InhibitResponseFunction": InhibitResponseFunction

TriggerOperator

GreaterThan: GreaterThan
LessThan: LessThan
Equal: Equal
NotEqual: NotEqual

TriggerOperatorGreaterThan: GreaterThan
TriggerOperatorLessThan: LessThan
TriggerOperatorEqual: Equal
TriggerOperatorNotEqual: NotEqual

GreaterThan: GreaterThan
LessThan: LessThan
Equal: Equal
NotEqual: NotEqual

GreaterThan: GreaterThan
LessThan: LessThan
Equal: Equal
NotEqual: NotEqual

GREATER_THAN: GreaterThan
LESS_THAN: LessThan
EQUAL: Equal
NOT_EQUAL: NotEqual

"GreaterThan": GreaterThan
"LessThan": LessThan
"Equal": Equal
"NotEqual": NotEqual

Import

An existing resource can be imported using its type token, name, and identifier, e.g.

$ pulumi import azure-native:securityinsights:ScheduledAlertRule 73e01a99-5cd7-4139-a149-9f2736ff2ab5 /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5

Package Details

Repository: Azure Native pulumi/pulumi-azure-native
License: Apache-2.0