Azure Classic v5.38.0, Mar 21 23

azure.sentinel.getAlertRuleTemplate

Use this data source to access information about an existing Sentinel Alert Rule Template.

Example Usage

using System.Collections.Generic;
using Pulumi;
using Azure = Pulumi.Azure;

return await Deployment.RunAsync(() => 
{
    var example = Azure.Sentinel.GetAlertRuleTemplate.Invoke(new()
    {
        LogAnalyticsWorkspaceId = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/mygroup1/providers/Microsoft.OperationalInsights/workspaces/workspace1",
        DisplayName = "Create incidents based on Azure Security Center for IoT alerts",
    });

    return new Dictionary<string, object?>
    {
        ["id"] = example.Apply(getAlertRuleTemplateResult => getAlertRuleTemplateResult.Id),
    };
});

package main

import (
	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/sentinel"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := sentinel.GetAlertRuleTemplate(ctx, &sentinel.GetAlertRuleTemplateArgs{
			LogAnalyticsWorkspaceId: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/mygroup1/providers/Microsoft.OperationalInsights/workspaces/workspace1",
			DisplayName:             pulumi.StringRef("Create incidents based on Azure Security Center for IoT alerts"),
		}, nil)
		if err != nil {
			return err
		}
		ctx.Export("id", example.Id)
		return nil
	})
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.sentinel.SentinelFunctions;
import com.pulumi.azure.sentinel.inputs.GetAlertRuleTemplateArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var example = SentinelFunctions.getAlertRuleTemplate(GetAlertRuleTemplateArgs.builder()
            .logAnalyticsWorkspaceId("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/mygroup1/providers/Microsoft.OperationalInsights/workspaces/workspace1")
            .displayName("Create incidents based on Azure Security Center for IoT alerts")
            .build());

        ctx.export("id", example.applyValue(getAlertRuleTemplateResult -> getAlertRuleTemplateResult.id()));
    }
}

import pulumi
import pulumi_azure as azure

example = azure.sentinel.get_alert_rule_template(log_analytics_workspace_id="/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/mygroup1/providers/Microsoft.OperationalInsights/workspaces/workspace1",
    display_name="Create incidents based on Azure Security Center for IoT alerts")
pulumi.export("id", example.id)

import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";

const example = azure.sentinel.getAlertRuleTemplate({
    logAnalyticsWorkspaceId: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/mygroup1/providers/Microsoft.OperationalInsights/workspaces/workspace1",
    displayName: "Create incidents based on Azure Security Center for IoT alerts",
});
export const id = example.then(example => example.id);

variables:
  example:
    fn::invoke:
      Function: azure:sentinel:getAlertRuleTemplate
      Arguments:
        logAnalyticsWorkspaceId: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/mygroup1/providers/Microsoft.OperationalInsights/workspaces/workspace1
        displayName: Create incidents based on Azure Security Center for IoT alerts
outputs:
  id: ${example.id}

Using getAlertRuleTemplate

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getAlertRuleTemplate(args: GetAlertRuleTemplateArgs, opts?: InvokeOptions): Promise<GetAlertRuleTemplateResult>
function getAlertRuleTemplateOutput(args: GetAlertRuleTemplateOutputArgs, opts?: InvokeOptions): Output<GetAlertRuleTemplateResult>

def get_alert_rule_template(display_name: Optional[str] = None,
                            log_analytics_workspace_id: Optional[str] = None,
                            name: Optional[str] = None,
                            opts: Optional[InvokeOptions] = None) -> GetAlertRuleTemplateResult
def get_alert_rule_template_output(display_name: Optional[pulumi.Input[str]] = None,
                            log_analytics_workspace_id: Optional[pulumi.Input[str]] = None,
                            name: Optional[pulumi.Input[str]] = None,
                            opts: Optional[InvokeOptions] = None) -> Output[GetAlertRuleTemplateResult]

func GetAlertRuleTemplate(ctx *Context, args *GetAlertRuleTemplateArgs, opts ...InvokeOption) (*GetAlertRuleTemplateResult, error)
func GetAlertRuleTemplateOutput(ctx *Context, args *GetAlertRuleTemplateOutputArgs, opts ...InvokeOption) GetAlertRuleTemplateResultOutput

> Note: This function is named GetAlertRuleTemplate in the Go SDK.

public static class GetAlertRuleTemplate 
{
    public static Task<GetAlertRuleTemplateResult> InvokeAsync(GetAlertRuleTemplateArgs args, InvokeOptions? opts = null)
    public static Output<GetAlertRuleTemplateResult> Invoke(GetAlertRuleTemplateInvokeArgs args, InvokeOptions? opts = null)
}

public static CompletableFuture<GetAlertRuleTemplateResult> getAlertRuleTemplate(GetAlertRuleTemplateArgs args, InvokeOptions options)
// Output-based functions aren't available in Java yet

fn::invoke:
  function: azure:sentinel/getAlertRuleTemplate:getAlertRuleTemplate
  arguments:
    # arguments dictionary

The following arguments are supported:

LogAnalyticsWorkspaceId string: The ID of the Log Analytics Workspace.
DisplayName string: The display name of this Sentinel Alert Rule Template. Either display_name or name have to be specified.
Name string: The name of this Sentinel Alert Rule Template. Either display_name or name have to be specified.

LogAnalyticsWorkspaceId string: The ID of the Log Analytics Workspace.
DisplayName string: The display name of this Sentinel Alert Rule Template. Either display_name or name have to be specified.
Name string: The name of this Sentinel Alert Rule Template. Either display_name or name have to be specified.

logAnalyticsWorkspaceId String: The ID of the Log Analytics Workspace.
displayName String: The display name of this Sentinel Alert Rule Template. Either display_name or name have to be specified.
name String: The name of this Sentinel Alert Rule Template. Either display_name or name have to be specified.

logAnalyticsWorkspaceId string: The ID of the Log Analytics Workspace.
displayName string: The display name of this Sentinel Alert Rule Template. Either display_name or name have to be specified.
name string: The name of this Sentinel Alert Rule Template. Either display_name or name have to be specified.

log_analytics_workspace_id str: The ID of the Log Analytics Workspace.
display_name str: The display name of this Sentinel Alert Rule Template. Either display_name or name have to be specified.
name str: The name of this Sentinel Alert Rule Template. Either display_name or name have to be specified.

logAnalyticsWorkspaceId String: The ID of the Log Analytics Workspace.
displayName String: The display name of this Sentinel Alert Rule Template. Either display_name or name have to be specified.
name String: The name of this Sentinel Alert Rule Template. Either display_name or name have to be specified.

getAlertRuleTemplate Result

The following output properties are available:

DisplayName string
Id string: The provider-assigned unique ID for this managed resource.
LogAnalyticsWorkspaceId string
Name string
NrtTemplates List<GetAlertRuleTemplateNrtTemplate>: A nrt_template block as defined below. This only applies to Sentinel NRT Alert Rule Template.
ScheduledTemplates List<GetAlertRuleTemplateScheduledTemplate>: A scheduled_template block as defined below. This only applies to Sentinel Scheduled Alert Rule Template.
SecurityIncidentTemplates List<GetAlertRuleTemplateSecurityIncidentTemplate>: A security_incident_template block as defined below. This only applies to Sentinel MS Security Incident Alert Rule Template.

DisplayName string
Id string: The provider-assigned unique ID for this managed resource.
LogAnalyticsWorkspaceId string
Name string
NrtTemplates []GetAlertRuleTemplateNrtTemplate: A nrt_template block as defined below. This only applies to Sentinel NRT Alert Rule Template.
ScheduledTemplates []GetAlertRuleTemplateScheduledTemplate: A scheduled_template block as defined below. This only applies to Sentinel Scheduled Alert Rule Template.
SecurityIncidentTemplates []GetAlertRuleTemplateSecurityIncidentTemplate: A security_incident_template block as defined below. This only applies to Sentinel MS Security Incident Alert Rule Template.

displayName String
id String: The provider-assigned unique ID for this managed resource.
logAnalyticsWorkspaceId String
name String
nrtTemplates List<GetAlertRuleTemplateNrtTemplate>: A nrt_template block as defined below. This only applies to Sentinel NRT Alert Rule Template.
scheduledTemplates List<GetAlertRuleTemplateScheduledTemplate>: A scheduled_template block as defined below. This only applies to Sentinel Scheduled Alert Rule Template.
securityIncidentTemplates List<GetAlertRuleTemplateSecurityIncidentTemplate>: A security_incident_template block as defined below. This only applies to Sentinel MS Security Incident Alert Rule Template.

displayName string
id string: The provider-assigned unique ID for this managed resource.
logAnalyticsWorkspaceId string
name string
nrtTemplates GetAlertRuleTemplateNrtTemplate[]: A nrt_template block as defined below. This only applies to Sentinel NRT Alert Rule Template.
scheduledTemplates GetAlertRuleTemplateScheduledTemplate[]: A scheduled_template block as defined below. This only applies to Sentinel Scheduled Alert Rule Template.
securityIncidentTemplates GetAlertRuleTemplateSecurityIncidentTemplate[]: A security_incident_template block as defined below. This only applies to Sentinel MS Security Incident Alert Rule Template.

display_name str
id str: The provider-assigned unique ID for this managed resource.
log_analytics_workspace_id str
name str
nrt_templates Sequence[GetAlertRuleTemplateNrtTemplate]: A nrt_template block as defined below. This only applies to Sentinel NRT Alert Rule Template.
scheduled_templates Sequence[GetAlertRuleTemplateScheduledTemplate]: A scheduled_template block as defined below. This only applies to Sentinel Scheduled Alert Rule Template.
security_incident_templates Sequence[GetAlertRuleTemplateSecurityIncidentTemplate]: A security_incident_template block as defined below. This only applies to Sentinel MS Security Incident Alert Rule Template.

displayName String
id String: The provider-assigned unique ID for this managed resource.
logAnalyticsWorkspaceId String
name String
nrtTemplates List<Property Map>: A nrt_template block as defined below. This only applies to Sentinel NRT Alert Rule Template.
scheduledTemplates List<Property Map>: A scheduled_template block as defined below. This only applies to Sentinel Scheduled Alert Rule Template.
securityIncidentTemplates List<Property Map>: A security_incident_template block as defined below. This only applies to Sentinel MS Security Incident Alert Rule Template.

Supporting Types

GetAlertRuleTemplateNrtTemplate

Description string: The description of this Sentinel Scheduled Alert Rule Template.
Query string: The query of this Sentinel Scheduled Alert Rule Template.
Severity string: The alert severity of this Sentinel Scheduled Alert Rule Template.
Tactics List<string>: A list of categories of attacks by which to classify the rule.

Description string: The description of this Sentinel Scheduled Alert Rule Template.
Query string: The query of this Sentinel Scheduled Alert Rule Template.
Severity string: The alert severity of this Sentinel Scheduled Alert Rule Template.
Tactics []string: A list of categories of attacks by which to classify the rule.

description String: The description of this Sentinel Scheduled Alert Rule Template.
query String: The query of this Sentinel Scheduled Alert Rule Template.
severity String: The alert severity of this Sentinel Scheduled Alert Rule Template.
tactics List<String>: A list of categories of attacks by which to classify the rule.

description string: The description of this Sentinel Scheduled Alert Rule Template.
query string: The query of this Sentinel Scheduled Alert Rule Template.
severity string: The alert severity of this Sentinel Scheduled Alert Rule Template.
tactics string[]: A list of categories of attacks by which to classify the rule.

description str: The description of this Sentinel Scheduled Alert Rule Template.
query str: The query of this Sentinel Scheduled Alert Rule Template.
severity str: The alert severity of this Sentinel Scheduled Alert Rule Template.
tactics Sequence[str]: A list of categories of attacks by which to classify the rule.

description String: The description of this Sentinel Scheduled Alert Rule Template.
query String: The query of this Sentinel Scheduled Alert Rule Template.
severity String: The alert severity of this Sentinel Scheduled Alert Rule Template.
tactics List<String>: A list of categories of attacks by which to classify the rule.

GetAlertRuleTemplateScheduledTemplate

Description string: The description of this Sentinel Scheduled Alert Rule Template.
Query string: The query of this Sentinel Scheduled Alert Rule Template.
QueryFrequency string: The ISO 8601 timespan duration between two consecutive queries.
QueryPeriod string: The ISO 8601 timespan duration, which determine the time period of the data covered by the query.
Severity string: The alert severity of this Sentinel Scheduled Alert Rule Template.
Tactics List<string>: A list of categories of attacks by which to classify the rule.
TriggerOperator string: The alert trigger operator, combined with trigger_threshold, setting alert threshold of this Sentinel Scheduled Alert Rule Template.
TriggerThreshold int: The baseline number of query results generated, combined with trigger_operator, setting alert threshold of this Sentinel Scheduled Alert Rule Template.

Description string: The description of this Sentinel Scheduled Alert Rule Template.
Query string: The query of this Sentinel Scheduled Alert Rule Template.
QueryFrequency string: The ISO 8601 timespan duration between two consecutive queries.
QueryPeriod string: The ISO 8601 timespan duration, which determine the time period of the data covered by the query.
Severity string: The alert severity of this Sentinel Scheduled Alert Rule Template.
Tactics []string: A list of categories of attacks by which to classify the rule.
TriggerOperator string: The alert trigger operator, combined with trigger_threshold, setting alert threshold of this Sentinel Scheduled Alert Rule Template.
TriggerThreshold int: The baseline number of query results generated, combined with trigger_operator, setting alert threshold of this Sentinel Scheduled Alert Rule Template.

description String: The description of this Sentinel Scheduled Alert Rule Template.
query String: The query of this Sentinel Scheduled Alert Rule Template.
queryFrequency String: The ISO 8601 timespan duration between two consecutive queries.
queryPeriod String: The ISO 8601 timespan duration, which determine the time period of the data covered by the query.
severity String: The alert severity of this Sentinel Scheduled Alert Rule Template.
tactics List<String>: A list of categories of attacks by which to classify the rule.
triggerOperator String: The alert trigger operator, combined with trigger_threshold, setting alert threshold of this Sentinel Scheduled Alert Rule Template.
triggerThreshold Integer: The baseline number of query results generated, combined with trigger_operator, setting alert threshold of this Sentinel Scheduled Alert Rule Template.

description string: The description of this Sentinel Scheduled Alert Rule Template.
query string: The query of this Sentinel Scheduled Alert Rule Template.
queryFrequency string: The ISO 8601 timespan duration between two consecutive queries.
queryPeriod string: The ISO 8601 timespan duration, which determine the time period of the data covered by the query.
severity string: The alert severity of this Sentinel Scheduled Alert Rule Template.
tactics string[]: A list of categories of attacks by which to classify the rule.
triggerOperator string: The alert trigger operator, combined with trigger_threshold, setting alert threshold of this Sentinel Scheduled Alert Rule Template.
triggerThreshold number: The baseline number of query results generated, combined with trigger_operator, setting alert threshold of this Sentinel Scheduled Alert Rule Template.

description str: The description of this Sentinel Scheduled Alert Rule Template.
query str: The query of this Sentinel Scheduled Alert Rule Template.
query_frequency str: The ISO 8601 timespan duration between two consecutive queries.
query_period str: The ISO 8601 timespan duration, which determine the time period of the data covered by the query.
severity str: The alert severity of this Sentinel Scheduled Alert Rule Template.
tactics Sequence[str]: A list of categories of attacks by which to classify the rule.
trigger_operator str: The alert trigger operator, combined with trigger_threshold, setting alert threshold of this Sentinel Scheduled Alert Rule Template.
trigger_threshold int: The baseline number of query results generated, combined with trigger_operator, setting alert threshold of this Sentinel Scheduled Alert Rule Template.

description String: The description of this Sentinel Scheduled Alert Rule Template.
query String: The query of this Sentinel Scheduled Alert Rule Template.
queryFrequency String: The ISO 8601 timespan duration between two consecutive queries.
queryPeriod String: The ISO 8601 timespan duration, which determine the time period of the data covered by the query.
severity String: The alert severity of this Sentinel Scheduled Alert Rule Template.
tactics List<String>: A list of categories of attacks by which to classify the rule.
triggerOperator String: The alert trigger operator, combined with trigger_threshold, setting alert threshold of this Sentinel Scheduled Alert Rule Template.
triggerThreshold Number: The baseline number of query results generated, combined with trigger_operator, setting alert threshold of this Sentinel Scheduled Alert Rule Template.

GetAlertRuleTemplateSecurityIncidentTemplate

Description string: The description of this Sentinel Scheduled Alert Rule Template.
ProductFilter string: The Microsoft Security Service from where the alert will be generated.

Description string: The description of this Sentinel Scheduled Alert Rule Template.
ProductFilter string: The Microsoft Security Service from where the alert will be generated.

description String: The description of this Sentinel Scheduled Alert Rule Template.
productFilter String: The Microsoft Security Service from where the alert will be generated.

description string: The description of this Sentinel Scheduled Alert Rule Template.
productFilter string: The Microsoft Security Service from where the alert will be generated.

description str: The description of this Sentinel Scheduled Alert Rule Template.
product_filter str: The Microsoft Security Service from where the alert will be generated.

description String: The description of this Sentinel Scheduled Alert Rule Template.
productFilter String: The Microsoft Security Service from where the alert will be generated.

Package Details

Repository: Azure Classic pulumi/pulumi-azure
License: Apache-2.0
Notes: This Pulumi package is based on the azurerm Terraform Provider.