azure.securitycenter.Automation

using Pulumi;
using Azure = Pulumi.Azure;

class MyStack : Stack
{
    public MyStack()
    {
        var current = Output.Create(Azure.Core.GetClientConfig.InvokeAsync());
        var exampleResourceGroup = new Azure.Core.ResourceGroup("exampleResourceGroup", new Azure.Core.ResourceGroupArgs
        {
            Location = "West Europe",
        });
        var exampleEventHubNamespace = new Azure.EventHub.EventHubNamespace("exampleEventHubNamespace", new Azure.EventHub.EventHubNamespaceArgs
        {
            Location = exampleResourceGroup.Location,
            ResourceGroupName = exampleResourceGroup.Name,
            Sku = "Standard",
            Capacity = 2,
        });
        var exampleEventHub = new Azure.EventHub.EventHub("exampleEventHub", new Azure.EventHub.EventHubArgs
        {
            NamespaceName = exampleEventHubNamespace.Name,
            ResourceGroupName = exampleResourceGroup.Name,
            PartitionCount = 2,
            MessageRetention = 2,
        });
        var exampleAuthorizationRule = new Azure.EventHub.AuthorizationRule("exampleAuthorizationRule", new Azure.EventHub.AuthorizationRuleArgs
        {
            NamespaceName = exampleEventHubNamespace.Name,
            EventhubName = exampleEventHub.Name,
            ResourceGroupName = exampleResourceGroup.Name,
            Listen = true,
            Send = false,
            Manage = false,
        });
        var exampleAutomation = new Azure.SecurityCenter.Automation("exampleAutomation", new Azure.SecurityCenter.AutomationArgs
        {
            Location = exampleResourceGroup.Location,
            ResourceGroupName = exampleResourceGroup.Name,
            Actions = 
            {
                new Azure.SecurityCenter.Inputs.AutomationActionArgs
                {
                    Type = "EventHub",
                    ResourceId = exampleEventHub.Id,
                    ConnectionString = exampleAuthorizationRule.PrimaryConnectionString,
                },
            },
            Sources = 
            {
                new Azure.SecurityCenter.Inputs.AutomationSourceArgs
                {
                    EventSource = "Alerts",
                    RuleSets = 
                    {
                        new Azure.SecurityCenter.Inputs.AutomationSourceRuleSetArgs
                        {
                            Rules = 
                            {
                                new Azure.SecurityCenter.Inputs.AutomationSourceRuleSetRuleArgs
                                {
                                    PropertyPath = "properties.metadata.severity",
                                    Operator = "Equals",
                                    ExpectedValue = "High",
                                    PropertyType = "String",
                                },
                            },
                        },
                    },
                },
            },
            Scopes = 
            {
                current.Apply(current => $"/subscriptions/{current.SubscriptionId}"),
            },
        });
    }

}

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-azure/sdk/v4/go/azure/core"
	"github.com/pulumi/pulumi-azure/sdk/v4/go/azure/eventhub"
	"github.com/pulumi/pulumi-azure/sdk/v4/go/azure/securitycenter"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		current, err := core.GetClientConfig(ctx, nil, nil)
		if err != nil {
			return err
		}
		exampleResourceGroup, err := core.NewResourceGroup(ctx, "exampleResourceGroup", &core.ResourceGroupArgs{
			Location: pulumi.String("West Europe"),
		})
		if err != nil {
			return err
		}
		exampleEventHubNamespace, err := eventhub.NewEventHubNamespace(ctx, "exampleEventHubNamespace", &eventhub.EventHubNamespaceArgs{
			Location:          exampleResourceGroup.Location,
			ResourceGroupName: exampleResourceGroup.Name,
			Sku:               pulumi.String("Standard"),
			Capacity:          pulumi.Int(2),
		})
		if err != nil {
			return err
		}
		exampleEventHub, err := eventhub.NewEventHub(ctx, "exampleEventHub", &eventhub.EventHubArgs{
			NamespaceName:     exampleEventHubNamespace.Name,
			ResourceGroupName: exampleResourceGroup.Name,
			PartitionCount:    pulumi.Int(2),
			MessageRetention:  pulumi.Int(2),
		})
		if err != nil {
			return err
		}
		exampleAuthorizationRule, err := eventhub.NewAuthorizationRule(ctx, "exampleAuthorizationRule", &eventhub.AuthorizationRuleArgs{
			NamespaceName:     exampleEventHubNamespace.Name,
			EventhubName:      exampleEventHub.Name,
			ResourceGroupName: exampleResourceGroup.Name,
			Listen:            pulumi.Bool(true),
			Send:              pulumi.Bool(false),
			Manage:            pulumi.Bool(false),
		})
		if err != nil {
			return err
		}
		_, err = securitycenter.NewAutomation(ctx, "exampleAutomation", &securitycenter.AutomationArgs{
			Location:          exampleResourceGroup.Location,
			ResourceGroupName: exampleResourceGroup.Name,
			Actions: securitycenter.AutomationActionArray{
				&securitycenter.AutomationActionArgs{
					Type:             pulumi.String("EventHub"),
					ResourceId:       exampleEventHub.ID(),
					ConnectionString: exampleAuthorizationRule.PrimaryConnectionString,
				},
			},
			Sources: securitycenter.AutomationSourceArray{
				&securitycenter.AutomationSourceArgs{
					EventSource: pulumi.String("Alerts"),
					RuleSets: securitycenter.AutomationSourceRuleSetArray{
						&securitycenter.AutomationSourceRuleSetArgs{
							Rules: securitycenter.AutomationSourceRuleSetRuleArray{
								&securitycenter.AutomationSourceRuleSetRuleArgs{
									PropertyPath:  pulumi.String("properties.metadata.severity"),
									Operator:      pulumi.String("Equals"),
									ExpectedValue: pulumi.String("High"),
									PropertyType:  pulumi.String("String"),
								},
							},
						},
					},
				},
			},
			Scopes: pulumi.StringArray{
				pulumi.String(fmt.Sprintf("%v%v", "/subscriptions/", current.SubscriptionId)),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";

const current = azure.core.getClientConfig({});
const exampleResourceGroup = new azure.core.ResourceGroup("exampleResourceGroup", {location: "West Europe"});
const exampleEventHubNamespace = new azure.eventhub.EventHubNamespace("exampleEventHubNamespace", {
    location: exampleResourceGroup.location,
    resourceGroupName: exampleResourceGroup.name,
    sku: "Standard",
    capacity: 2,
});
const exampleEventHub = new azure.eventhub.EventHub("exampleEventHub", {
    namespaceName: exampleEventHubNamespace.name,
    resourceGroupName: exampleResourceGroup.name,
    partitionCount: 2,
    messageRetention: 2,
});
const exampleAuthorizationRule = new azure.eventhub.AuthorizationRule("exampleAuthorizationRule", {
    namespaceName: exampleEventHubNamespace.name,
    eventhubName: exampleEventHub.name,
    resourceGroupName: exampleResourceGroup.name,
    listen: true,
    send: false,
    manage: false,
});
const exampleAutomation = new azure.securitycenter.Automation("exampleAutomation", {
    location: exampleResourceGroup.location,
    resourceGroupName: exampleResourceGroup.name,
    actions: [{
        type: "EventHub",
        resourceId: exampleEventHub.id,
        connectionString: exampleAuthorizationRule.primaryConnectionString,
    }],
    sources: [{
        eventSource: "Alerts",
        ruleSets: [{
            rules: [{
                propertyPath: "properties.metadata.severity",
                operator: "Equals",
                expectedValue: "High",
                propertyType: "String",
            }],
        }],
    }],
    scopes: [current.then(current => `/subscriptions/${current.subscriptionId}`)],
});

import pulumi
import pulumi_azure as azure

current = azure.core.get_client_config()
example_resource_group = azure.core.ResourceGroup("exampleResourceGroup", location="West Europe")
example_event_hub_namespace = azure.eventhub.EventHubNamespace("exampleEventHubNamespace",
    location=example_resource_group.location,
    resource_group_name=example_resource_group.name,
    sku="Standard",
    capacity=2)
example_event_hub = azure.eventhub.EventHub("exampleEventHub",
    namespace_name=example_event_hub_namespace.name,
    resource_group_name=example_resource_group.name,
    partition_count=2,
    message_retention=2)
example_authorization_rule = azure.eventhub.AuthorizationRule("exampleAuthorizationRule",
    namespace_name=example_event_hub_namespace.name,
    eventhub_name=example_event_hub.name,
    resource_group_name=example_resource_group.name,
    listen=True,
    send=False,
    manage=False)
example_automation = azure.securitycenter.Automation("exampleAutomation",
    location=example_resource_group.location,
    resource_group_name=example_resource_group.name,
    actions=[azure.securitycenter.AutomationActionArgs(
        type="EventHub",
        resource_id=example_event_hub.id,
        connection_string=example_authorization_rule.primary_connection_string,
    )],
    sources=[azure.securitycenter.AutomationSourceArgs(
        event_source="Alerts",
        rule_sets=[azure.securitycenter.AutomationSourceRuleSetArgs(
            rules=[azure.securitycenter.AutomationSourceRuleSetRuleArgs(
                property_path="properties.metadata.severity",
                operator="Equals",
                expected_value="High",
                property_type="String",
            )],
        )],
    )],
    scopes=[f"/subscriptions/{current.subscription_id}"])