Azure Native v1.102.0, May 2 23

azure-native.securityinsights.ThreatIntelligenceIndicator

Explore with Pulumi AI

Threat intelligence information object. API Version: 2019-01-01-preview.

Example Usage

Update a threat Intelligence indicator

using System.Collections.Generic;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var threatIntelligenceIndicator = new AzureNative.SecurityInsights.ThreatIntelligenceIndicator("threatIntelligenceIndicator", new()
    {
        Confidence = 78,
        CreatedByRef = "contoso@contoso.com",
        Description = "debugging indicators",
        DisplayName = "new schema",
        ExternalReferences = new[] {},
        GranularMarkings = new[] {},
        KillChainPhases = new[] {},
        Kind = "indicator",
        Labels = new[] {},
        Modified = "",
        Name = "d9cd6f0b-96b9-3984-17cd-a779d1e15a93",
        OperationalInsightsResourceProvider = "Microsoft.OperationalInsights",
        Pattern = "[url:value = 'https://www.contoso.com']",
        PatternType = "url",
        ResourceGroupName = "myRg",
        Revoked = false,
        Source = "Azure Sentinel",
        ThreatIntelligenceTags = new[]
        {
            "new schema",
        },
        ThreatTypes = new[]
        {
            "compromised",
        },
        ValidFrom = "2020-04-15T17:44:00.114052Z",
        ValidUntil = "",
        WorkspaceName = "myWorkspace",
    });

});

package main

import (
	securityinsights "github.com/pulumi/pulumi-azure-native/sdk/go/azure/securityinsights"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := securityinsights.NewThreatIntelligenceIndicator(ctx, "threatIntelligenceIndicator", &securityinsights.ThreatIntelligenceIndicatorArgs{
			Confidence:                          pulumi.Int(78),
			CreatedByRef:                        pulumi.String("contoso@contoso.com"),
			Description:                         pulumi.String("debugging indicators"),
			DisplayName:                         pulumi.String("new schema"),
			ExternalReferences:                  securityinsights.ThreatIntelligenceExternalReferenceArray{},
			GranularMarkings:                    securityinsights.ThreatIntelligenceGranularMarkingModelArray{},
			KillChainPhases:                     securityinsights.ThreatIntelligenceKillChainPhaseArray{},
			Kind:                                pulumi.String("indicator"),
			Labels:                              pulumi.StringArray{},
			Modified:                            pulumi.String(""),
			Name:                                pulumi.String("d9cd6f0b-96b9-3984-17cd-a779d1e15a93"),
			OperationalInsightsResourceProvider: pulumi.String("Microsoft.OperationalInsights"),
			Pattern:                             pulumi.String("[url:value = 'https://www.contoso.com']"),
			PatternType:                         pulumi.String("url"),
			ResourceGroupName:                   pulumi.String("myRg"),
			Revoked:                             pulumi.Bool(false),
			Source:                              pulumi.String("Azure Sentinel"),
			ThreatIntelligenceTags: pulumi.StringArray{
				pulumi.String("new schema"),
			},
			ThreatTypes: pulumi.StringArray{
				pulumi.String("compromised"),
			},
			ValidFrom:     pulumi.String("2020-04-15T17:44:00.114052Z"),
			ValidUntil:    pulumi.String(""),
			WorkspaceName: pulumi.String("myWorkspace"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.securityinsights.ThreatIntelligenceIndicator;
import com.pulumi.azurenative.securityinsights.ThreatIntelligenceIndicatorArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var threatIntelligenceIndicator = new ThreatIntelligenceIndicator("threatIntelligenceIndicator", ThreatIntelligenceIndicatorArgs.builder()        
            .confidence(78)
            .createdByRef("contoso@contoso.com")
            .description("debugging indicators")
            .displayName("new schema")
            .externalReferences()
            .granularMarkings()
            .killChainPhases()
            .kind("indicator")
            .labels()
            .modified("")
            .name("d9cd6f0b-96b9-3984-17cd-a779d1e15a93")
            .operationalInsightsResourceProvider("Microsoft.OperationalInsights")
            .pattern("[url:value = 'https://www.contoso.com']")
            .patternType("url")
            .resourceGroupName("myRg")
            .revoked(false)
            .source("Azure Sentinel")
            .threatIntelligenceTags("new schema")
            .threatTypes("compromised")
            .validFrom("2020-04-15T17:44:00.114052Z")
            .validUntil("")
            .workspaceName("myWorkspace")
            .build());

    }
}

import pulumi
import pulumi_azure_native as azure_native

threat_intelligence_indicator = azure_native.securityinsights.ThreatIntelligenceIndicator("threatIntelligenceIndicator",
    confidence=78,
    created_by_ref="contoso@contoso.com",
    description="debugging indicators",
    display_name="new schema",
    external_references=[],
    granular_markings=[],
    kill_chain_phases=[],
    kind="indicator",
    labels=[],
    modified="",
    name="d9cd6f0b-96b9-3984-17cd-a779d1e15a93",
    operational_insights_resource_provider="Microsoft.OperationalInsights",
    pattern="[url:value = 'https://www.contoso.com']",
    pattern_type="url",
    resource_group_name="myRg",
    revoked=False,
    source="Azure Sentinel",
    threat_intelligence_tags=["new schema"],
    threat_types=["compromised"],
    valid_from="2020-04-15T17:44:00.114052Z",
    valid_until="",
    workspace_name="myWorkspace")

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const threatIntelligenceIndicator = new azure_native.securityinsights.ThreatIntelligenceIndicator("threatIntelligenceIndicator", {
    confidence: 78,
    createdByRef: "contoso@contoso.com",
    description: "debugging indicators",
    displayName: "new schema",
    externalReferences: [],
    granularMarkings: [],
    killChainPhases: [],
    kind: "indicator",
    labels: [],
    modified: "",
    name: "d9cd6f0b-96b9-3984-17cd-a779d1e15a93",
    operationalInsightsResourceProvider: "Microsoft.OperationalInsights",
    pattern: "[url:value = 'https://www.contoso.com']",
    patternType: "url",
    resourceGroupName: "myRg",
    revoked: false,
    source: "Azure Sentinel",
    threatIntelligenceTags: ["new schema"],
    threatTypes: ["compromised"],
    validFrom: "2020-04-15T17:44:00.114052Z",
    validUntil: "",
    workspaceName: "myWorkspace",
});

resources:
  threatIntelligenceIndicator:
    type: azure-native:securityinsights:ThreatIntelligenceIndicator
    properties:
      confidence: 78
      createdByRef: contoso@contoso.com
      description: debugging indicators
      displayName: new schema
      externalReferences: []
      granularMarkings: []
      killChainPhases: []
      kind: indicator
      labels: []
      modified:
      name: d9cd6f0b-96b9-3984-17cd-a779d1e15a93
      operationalInsightsResourceProvider: Microsoft.OperationalInsights
      pattern: '[url:value = ''https://www.contoso.com'']'
      patternType: url
      resourceGroupName: myRg
      revoked: false
      source: Azure Sentinel
      threatIntelligenceTags:
        - new schema
      threatTypes:
        - compromised
      validFrom: 2020-04-15T17:44:00.114052Z
      validUntil:
      workspaceName: myWorkspace

Create ThreatIntelligenceIndicator Resource

new ThreatIntelligenceIndicator(name: string, args: ThreatIntelligenceIndicatorArgs, opts?: CustomResourceOptions);

@overload
def ThreatIntelligenceIndicator(resource_name: str,
                                opts: Optional[ResourceOptions] = None,
                                confidence: Optional[int] = None,
                                created: Optional[str] = None,
                                created_by_ref: Optional[str] = None,
                                defanged: Optional[bool] = None,
                                description: Optional[str] = None,
                                display_name: Optional[str] = None,
                                extensions: Optional[Any] = None,
                                external_id: Optional[str] = None,
                                external_last_updated_time_utc: Optional[str] = None,
                                external_references: Optional[Sequence[ThreatIntelligenceExternalReferenceArgs]] = None,
                                granular_markings: Optional[Sequence[ThreatIntelligenceGranularMarkingModelArgs]] = None,
                                indicator_types: Optional[Sequence[str]] = None,
                                kill_chain_phases: Optional[Sequence[ThreatIntelligenceKillChainPhaseArgs]] = None,
                                kind: Optional[Union[str, ThreatIntelligenceResourceKind]] = None,
                                labels: Optional[Sequence[str]] = None,
                                language: Optional[str] = None,
                                last_updated_time_utc: Optional[str] = None,
                                modified: Optional[str] = None,
                                name: Optional[str] = None,
                                object_marking_refs: Optional[Sequence[str]] = None,
                                operational_insights_resource_provider: Optional[str] = None,
                                parsed_pattern: Optional[Sequence[ThreatIntelligenceParsedPatternArgs]] = None,
                                pattern: Optional[str] = None,
                                pattern_type: Optional[str] = None,
                                pattern_version: Optional[str] = None,
                                resource_group_name: Optional[str] = None,
                                revoked: Optional[bool] = None,
                                source: Optional[str] = None,
                                threat_intelligence_tags: Optional[Sequence[str]] = None,
                                threat_types: Optional[Sequence[str]] = None,
                                valid_from: Optional[str] = None,
                                valid_until: Optional[str] = None,
                                workspace_name: Optional[str] = None)
@overload
def ThreatIntelligenceIndicator(resource_name: str,
                                args: ThreatIntelligenceIndicatorArgs,
                                opts: Optional[ResourceOptions] = None)

func NewThreatIntelligenceIndicator(ctx *Context, name string, args ThreatIntelligenceIndicatorArgs, opts ...ResourceOption) (*ThreatIntelligenceIndicator, error)

public ThreatIntelligenceIndicator(string name, ThreatIntelligenceIndicatorArgs args, CustomResourceOptions? opts = null)

public ThreatIntelligenceIndicator(String name, ThreatIntelligenceIndicatorArgs args)
public ThreatIntelligenceIndicator(String name, ThreatIntelligenceIndicatorArgs args, CustomResourceOptions options)

type: azure-native:securityinsights:ThreatIntelligenceIndicator
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

name string: The unique name of the resource.
args ThreatIntelligenceIndicatorArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args ThreatIntelligenceIndicatorArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args ThreatIntelligenceIndicatorArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args ThreatIntelligenceIndicatorArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args ThreatIntelligenceIndicatorArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

ThreatIntelligenceIndicator Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The ThreatIntelligenceIndicator resource accepts the following input properties:

Kind string | Pulumi.AzureNative.SecurityInsights.ThreatIntelligenceResourceKind: The kind of the entity.
OperationalInsightsResourceProvider string: The namespace of workspaces resource provider- Microsoft.OperationalInsights.
ResourceGroupName string: The name of the resource group within the user's subscription. The name is case insensitive.
WorkspaceName string: The name of the workspace.
Confidence int: Confidence of threat intelligence entity
Created string: Created by
CreatedByRef string: Created by reference of threat intelligence entity
Defanged bool: Is threat intelligence entity defanged
Description string: Description of a threat intelligence entity
DisplayName string: Display name of a threat intelligence entity
Extensions object: Extensions map
ExternalId string: External ID of threat intelligence entity
ExternalLastUpdatedTimeUtc string: External last updated time in UTC
ExternalReferences List<Pulumi.AzureNative.SecurityInsights.Inputs.ThreatIntelligenceExternalReferenceArgs>: External References
GranularMarkings List<Pulumi.AzureNative.SecurityInsights.Inputs.ThreatIntelligenceGranularMarkingModelArgs>: Granular Markings
IndicatorTypes List<string>: Indicator types of threat intelligence entities
KillChainPhases List<Pulumi.AzureNative.SecurityInsights.Inputs.ThreatIntelligenceKillChainPhaseArgs>: Kill chain phases
Labels List<string>: Labels of threat intelligence entity
Language string: Language of threat intelligence entity
LastUpdatedTimeUtc string: Last updated time in UTC
Modified string: Modified by
Name string: Threat intelligence indicator name field.
ObjectMarkingRefs List<string>: Threat intelligence entity object marking references
ParsedPattern List<Pulumi.AzureNative.SecurityInsights.Inputs.ThreatIntelligenceParsedPatternArgs>: Parsed patterns
Pattern string: Pattern of a threat intelligence entity
PatternType string: Pattern type of a threat intelligence entity
PatternVersion string: Pattern version of a threat intelligence entity
Revoked bool: Is threat intelligence entity revoked
Source string: Source of a threat intelligence entity
ThreatIntelligenceTags List<string>: List of tags
ThreatTypes List<string>: Threat types
ValidFrom string: Valid from
ValidUntil string: Valid until

Kind string | ThreatIntelligenceResourceKind: The kind of the entity.
OperationalInsightsResourceProvider string: The namespace of workspaces resource provider- Microsoft.OperationalInsights.
ResourceGroupName string: The name of the resource group within the user's subscription. The name is case insensitive.
WorkspaceName string: The name of the workspace.
Confidence int: Confidence of threat intelligence entity
Created string: Created by
CreatedByRef string: Created by reference of threat intelligence entity
Defanged bool: Is threat intelligence entity defanged
Description string: Description of a threat intelligence entity
DisplayName string: Display name of a threat intelligence entity
Extensions interface{}: Extensions map
ExternalId string: External ID of threat intelligence entity
ExternalLastUpdatedTimeUtc string: External last updated time in UTC
ExternalReferences []ThreatIntelligenceExternalReferenceArgs: External References
GranularMarkings []ThreatIntelligenceGranularMarkingModelArgs: Granular Markings
IndicatorTypes []string: Indicator types of threat intelligence entities
KillChainPhases []ThreatIntelligenceKillChainPhaseArgs: Kill chain phases
Labels []string: Labels of threat intelligence entity
Language string: Language of threat intelligence entity
LastUpdatedTimeUtc string: Last updated time in UTC
Modified string: Modified by
Name string: Threat intelligence indicator name field.
ObjectMarkingRefs []string: Threat intelligence entity object marking references
ParsedPattern []ThreatIntelligenceParsedPatternArgs: Parsed patterns
Pattern string: Pattern of a threat intelligence entity
PatternType string: Pattern type of a threat intelligence entity
PatternVersion string: Pattern version of a threat intelligence entity
Revoked bool: Is threat intelligence entity revoked
Source string: Source of a threat intelligence entity
ThreatIntelligenceTags []string: List of tags
ThreatTypes []string: Threat types
ValidFrom string: Valid from
ValidUntil string: Valid until

kind String | ThreatIntelligenceResourceKind: The kind of the entity.
operationalInsightsResourceProvider String: The namespace of workspaces resource provider- Microsoft.OperationalInsights.
resourceGroupName String: The name of the resource group within the user's subscription. The name is case insensitive.
workspaceName String: The name of the workspace.
confidence Integer: Confidence of threat intelligence entity
created String: Created by
createdByRef String: Created by reference of threat intelligence entity
defanged Boolean: Is threat intelligence entity defanged
description String: Description of a threat intelligence entity
displayName String: Display name of a threat intelligence entity
extensions Object: Extensions map
externalId String: External ID of threat intelligence entity
externalLastUpdatedTimeUtc String: External last updated time in UTC
externalReferences List<ThreatIntelligenceExternalReferenceArgs>: External References
granularMarkings List<ThreatIntelligenceGranularMarkingModelArgs>: Granular Markings
indicatorTypes List<String>: Indicator types of threat intelligence entities
killChainPhases List<ThreatIntelligenceKillChainPhaseArgs>: Kill chain phases
labels List<String>: Labels of threat intelligence entity
language String: Language of threat intelligence entity
lastUpdatedTimeUtc String: Last updated time in UTC
modified String: Modified by
name String: Threat intelligence indicator name field.
objectMarkingRefs List<String>: Threat intelligence entity object marking references
parsedPattern List<ThreatIntelligenceParsedPatternArgs>: Parsed patterns
pattern String: Pattern of a threat intelligence entity
patternType String: Pattern type of a threat intelligence entity
patternVersion String: Pattern version of a threat intelligence entity
revoked Boolean: Is threat intelligence entity revoked
source String: Source of a threat intelligence entity
threatIntelligenceTags List<String>: List of tags
threatTypes List<String>: Threat types
validFrom String: Valid from
validUntil String: Valid until

kind string | ThreatIntelligenceResourceKind: The kind of the entity.
operationalInsightsResourceProvider string: The namespace of workspaces resource provider- Microsoft.OperationalInsights.
resourceGroupName string: The name of the resource group within the user's subscription. The name is case insensitive.
workspaceName string: The name of the workspace.
confidence number: Confidence of threat intelligence entity
created string: Created by
createdByRef string: Created by reference of threat intelligence entity
defanged boolean: Is threat intelligence entity defanged
description string: Description of a threat intelligence entity
displayName string: Display name of a threat intelligence entity
extensions any: Extensions map
externalId string: External ID of threat intelligence entity
externalLastUpdatedTimeUtc string: External last updated time in UTC
externalReferences ThreatIntelligenceExternalReferenceArgs[]: External References
granularMarkings ThreatIntelligenceGranularMarkingModelArgs[]: Granular Markings
indicatorTypes string[]: Indicator types of threat intelligence entities
killChainPhases ThreatIntelligenceKillChainPhaseArgs[]: Kill chain phases
labels string[]: Labels of threat intelligence entity
language string: Language of threat intelligence entity
lastUpdatedTimeUtc string: Last updated time in UTC
modified string: Modified by
name string: Threat intelligence indicator name field.
objectMarkingRefs string[]: Threat intelligence entity object marking references
parsedPattern ThreatIntelligenceParsedPatternArgs[]: Parsed patterns
pattern string: Pattern of a threat intelligence entity
patternType string: Pattern type of a threat intelligence entity
patternVersion string: Pattern version of a threat intelligence entity
revoked boolean: Is threat intelligence entity revoked
source string: Source of a threat intelligence entity
threatIntelligenceTags string[]: List of tags
threatTypes string[]: Threat types
validFrom string: Valid from
validUntil string: Valid until

kind str | ThreatIntelligenceResourceKind: The kind of the entity.
operational_insights_resource_provider str: The namespace of workspaces resource provider- Microsoft.OperationalInsights.
resource_group_name str: The name of the resource group within the user's subscription. The name is case insensitive.
workspace_name str: The name of the workspace.
confidence int: Confidence of threat intelligence entity
created str: Created by
created_by_ref str: Created by reference of threat intelligence entity
defanged bool: Is threat intelligence entity defanged
description str: Description of a threat intelligence entity
display_name str: Display name of a threat intelligence entity
extensions Any: Extensions map
external_id str: External ID of threat intelligence entity
external_last_updated_time_utc str: External last updated time in UTC
external_references Sequence[ThreatIntelligenceExternalReferenceArgs]: External References
granular_markings Sequence[ThreatIntelligenceGranularMarkingModelArgs]: Granular Markings
indicator_types Sequence[str]: Indicator types of threat intelligence entities
kill_chain_phases Sequence[ThreatIntelligenceKillChainPhaseArgs]: Kill chain phases
labels Sequence[str]: Labels of threat intelligence entity
language str: Language of threat intelligence entity
last_updated_time_utc str: Last updated time in UTC
modified str: Modified by
name str: Threat intelligence indicator name field.
object_marking_refs Sequence[str]: Threat intelligence entity object marking references
parsed_pattern Sequence[ThreatIntelligenceParsedPatternArgs]: Parsed patterns
pattern str: Pattern of a threat intelligence entity
pattern_type str: Pattern type of a threat intelligence entity
pattern_version str: Pattern version of a threat intelligence entity
revoked bool: Is threat intelligence entity revoked
source str: Source of a threat intelligence entity
threat_intelligence_tags Sequence[str]: List of tags
threat_types Sequence[str]: Threat types
valid_from str: Valid from
valid_until str: Valid until

kind String | "indicator": The kind of the entity.
operationalInsightsResourceProvider String: The namespace of workspaces resource provider- Microsoft.OperationalInsights.
resourceGroupName String: The name of the resource group within the user's subscription. The name is case insensitive.
workspaceName String: The name of the workspace.
confidence Number: Confidence of threat intelligence entity
created String: Created by
createdByRef String: Created by reference of threat intelligence entity
defanged Boolean: Is threat intelligence entity defanged
description String: Description of a threat intelligence entity
displayName String: Display name of a threat intelligence entity
extensions Any: Extensions map
externalId String: External ID of threat intelligence entity
externalLastUpdatedTimeUtc String: External last updated time in UTC
externalReferences List<Property Map>: External References
granularMarkings List<Property Map>: Granular Markings
indicatorTypes List<String>: Indicator types of threat intelligence entities
killChainPhases List<Property Map>: Kill chain phases
labels List<String>: Labels of threat intelligence entity
language String: Language of threat intelligence entity
lastUpdatedTimeUtc String: Last updated time in UTC
modified String: Modified by
name String: Threat intelligence indicator name field.
objectMarkingRefs List<String>: Threat intelligence entity object marking references
parsedPattern List<Property Map>: Parsed patterns
pattern String: Pattern of a threat intelligence entity
patternType String: Pattern type of a threat intelligence entity
patternVersion String: Pattern version of a threat intelligence entity
revoked Boolean: Is threat intelligence entity revoked
source String: Source of a threat intelligence entity
threatIntelligenceTags List<String>: List of tags
threatTypes List<String>: Threat types
validFrom String: Valid from
validUntil String: Valid until

Outputs

All input properties are implicitly available as output properties. Additionally, the ThreatIntelligenceIndicator resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.
Type string: Azure resource type
Etag string: Etag of the azure resource

Id string: The provider-assigned unique ID for this managed resource.
Type string: Azure resource type
Etag string: Etag of the azure resource

id String: The provider-assigned unique ID for this managed resource.
type String: Azure resource type
etag String: Etag of the azure resource

id string: The provider-assigned unique ID for this managed resource.
type string: Azure resource type
etag string: Etag of the azure resource

id str: The provider-assigned unique ID for this managed resource.
type str: Azure resource type
etag str: Etag of the azure resource

id String: The provider-assigned unique ID for this managed resource.
type String: Azure resource type
etag String: Etag of the azure resource

Supporting Types

ThreatIntelligenceExternalReference

Description string: External reference description
ExternalId string: External reference ID
Hashes Dictionary<string, string>: External reference hashes
SourceName string: External reference source name
Url string: External reference URL

Description string: External reference description
ExternalId string: External reference ID
Hashes map[string]string: External reference hashes
SourceName string: External reference source name
Url string: External reference URL

description String: External reference description
externalId String: External reference ID
hashes Map<String,String>: External reference hashes
sourceName String: External reference source name
url String: External reference URL

description string: External reference description
externalId string: External reference ID
hashes {[key: string]: string}: External reference hashes
sourceName string: External reference source name
url string: External reference URL

description str: External reference description
external_id str: External reference ID
hashes Mapping[str, str]: External reference hashes
source_name str: External reference source name
url str: External reference URL

description String: External reference description
externalId String: External reference ID
hashes Map<String>: External reference hashes
sourceName String: External reference source name
url String: External reference URL

ThreatIntelligenceGranularMarkingModel

Language string: Language granular marking model
MarkingRef int: marking reference granular marking model
Selectors List<string>: granular marking model selectors

Language string: Language granular marking model
MarkingRef int: marking reference granular marking model
Selectors []string: granular marking model selectors

language String: Language granular marking model
markingRef Integer: marking reference granular marking model
selectors List<String>: granular marking model selectors

language string: Language granular marking model
markingRef number: marking reference granular marking model
selectors string[]: granular marking model selectors

language str: Language granular marking model
marking_ref int: marking reference granular marking model
selectors Sequence[str]: granular marking model selectors

language String: Language granular marking model
markingRef Number: marking reference granular marking model
selectors List<String>: granular marking model selectors

ThreatIntelligenceKillChainPhase

KillChainName string: Kill chainName name
PhaseName string: Phase name

KillChainName string: Kill chainName name
PhaseName string: Phase name

killChainName String: Kill chainName name
phaseName String: Phase name

killChainName string: Kill chainName name
phaseName string: Phase name

kill_chain_name str: Kill chainName name
phase_name str: Phase name

killChainName String: Kill chainName name
phaseName String: Phase name

ThreatIntelligenceParsedPattern

PatternTypeKey string: Pattern type key
PatternTypeValues List<Pulumi.AzureNative.SecurityInsights.Inputs.ThreatIntelligenceParsedPatternTypeValue>: Pattern type keys

PatternTypeKey string: Pattern type key
PatternTypeValues []ThreatIntelligenceParsedPatternTypeValue: Pattern type keys

patternTypeKey String: Pattern type key
patternTypeValues List<ThreatIntelligenceParsedPatternTypeValue>: Pattern type keys

patternTypeKey string: Pattern type key
patternTypeValues ThreatIntelligenceParsedPatternTypeValue[]: Pattern type keys

pattern_type_key str: Pattern type key
pattern_type_values Sequence[ThreatIntelligenceParsedPatternTypeValue]: Pattern type keys

patternTypeKey String: Pattern type key
patternTypeValues List<Property Map>: Pattern type keys

ThreatIntelligenceParsedPatternTypeValue

Value string: Value of parsed pattern
ValueType string: Type of the value

Value string: Value of parsed pattern
ValueType string: Type of the value

value String: Value of parsed pattern
valueType String: Type of the value

value string: Value of parsed pattern
valueType string: Type of the value

value str: Value of parsed pattern
value_type str: Type of the value

value String: Value of parsed pattern
valueType String: Type of the value

ThreatIntelligenceResourceKind

Indicator: indicator
Entity represents threat intelligence indicator in the system.

ThreatIntelligenceResourceKindIndicator: indicator
Entity represents threat intelligence indicator in the system.

Indicator: indicator
Entity represents threat intelligence indicator in the system.

Indicator: indicator
Entity represents threat intelligence indicator in the system.

INDICATOR: indicator
Entity represents threat intelligence indicator in the system.

"indicator": indicator
Entity represents threat intelligence indicator in the system.

Import

An existing resource can be imported using its type token, name, and identifier, e.g.

$ pulumi import azure-native:securityinsights:ThreatIntelligenceIndicator 180105c7-a28d-b1a2-4a78-234f6ec80fd6 /subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/ThreatIntelligence/180105c7-a28d-b1a2-4a78-234f6ec80fd6

Package Details

Repository: Azure Native pulumi/pulumi-azure-native
License: Apache-2.0