azure.sentinel.AutomationRule

using Pulumi;
using Azure = Pulumi.Azure;

class MyStack : Stack
{
    public MyStack()
    {
        var exampleResourceGroup = new Azure.Core.ResourceGroup("exampleResourceGroup", new Azure.Core.ResourceGroupArgs
        {
            Location = "west europe",
        });
        var exampleAnalyticsWorkspace = new Azure.OperationalInsights.AnalyticsWorkspace("exampleAnalyticsWorkspace", new Azure.OperationalInsights.AnalyticsWorkspaceArgs
        {
            Location = exampleResourceGroup.Location,
            ResourceGroupName = exampleResourceGroup.Name,
            Sku = "pergb2018",
        });
        var sentinel = new Azure.OperationalInsights.AnalyticsSolution("sentinel", new Azure.OperationalInsights.AnalyticsSolutionArgs
        {
            SolutionName = "SecurityInsights",
            Location = exampleResourceGroup.Location,
            ResourceGroupName = exampleResourceGroup.Name,
            WorkspaceResourceId = exampleAnalyticsWorkspace.Id,
            WorkspaceName = exampleAnalyticsWorkspace.Name,
            Plan = new Azure.OperationalInsights.Inputs.AnalyticsSolutionPlanArgs
            {
                Publisher = "Microsoft",
                Product = "OMSGallery/SecurityInsights",
            },
        });
        var exampleAutomationRule = new Azure.Sentinel.AutomationRule("exampleAutomationRule", new Azure.Sentinel.AutomationRuleArgs
        {
            LogAnalyticsWorkspaceId = sentinel.WorkspaceResourceId,
            DisplayName = "automation_rule1",
            Order = 1,
            ActionIncidents = 
            {
                new Azure.Sentinel.Inputs.AutomationRuleActionIncidentArgs
                {
                    Order = 1,
                    Status = "Active",
                },
            },
        });
    }

}

package main

import (
	"github.com/pulumi/pulumi-azure/sdk/v4/go/azure/core"
	"github.com/pulumi/pulumi-azure/sdk/v4/go/azure/operationalinsights"
	"github.com/pulumi/pulumi-azure/sdk/v4/go/azure/sentinel"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		exampleResourceGroup, err := core.NewResourceGroup(ctx, "exampleResourceGroup", &core.ResourceGroupArgs{
			Location: pulumi.String("west europe"),
		})
		if err != nil {
			return err
		}
		exampleAnalyticsWorkspace, err := operationalinsights.NewAnalyticsWorkspace(ctx, "exampleAnalyticsWorkspace", &operationalinsights.AnalyticsWorkspaceArgs{
			Location:          exampleResourceGroup.Location,
			ResourceGroupName: exampleResourceGroup.Name,
			Sku:               pulumi.String("pergb2018"),
		})
		if err != nil {
			return err
		}
		sentinel, err := operationalinsights.NewAnalyticsSolution(ctx, "sentinel", &operationalinsights.AnalyticsSolutionArgs{
			SolutionName:        pulumi.String("SecurityInsights"),
			Location:            exampleResourceGroup.Location,
			ResourceGroupName:   exampleResourceGroup.Name,
			WorkspaceResourceId: exampleAnalyticsWorkspace.ID(),
			WorkspaceName:       exampleAnalyticsWorkspace.Name,
			Plan: &operationalinsights.AnalyticsSolutionPlanArgs{
				Publisher: pulumi.String("Microsoft"),
				Product:   pulumi.String("OMSGallery/SecurityInsights"),
			},
		})
		if err != nil {
			return err
		}
		_, err = sentinel.NewAutomationRule(ctx, "exampleAutomationRule", &sentinel.AutomationRuleArgs{
			LogAnalyticsWorkspaceId: sentinel.WorkspaceResourceId,
			DisplayName:             pulumi.String("automation_rule1"),
			Order:                   pulumi.Int(1),
			ActionIncidents: sentinel.AutomationRuleActionIncidentArray{
				&sentinel.AutomationRuleActionIncidentArgs{
					Order:  pulumi.Int(1),
					Status: pulumi.String("Active"),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";

const exampleResourceGroup = new azure.core.ResourceGroup("exampleResourceGroup", {location: "west europe"});
const exampleAnalyticsWorkspace = new azure.operationalinsights.AnalyticsWorkspace("exampleAnalyticsWorkspace", {
    location: exampleResourceGroup.location,
    resourceGroupName: exampleResourceGroup.name,
    sku: "pergb2018",
});
const sentinel = new azure.operationalinsights.AnalyticsSolution("sentinel", {
    solutionName: "SecurityInsights",
    location: exampleResourceGroup.location,
    resourceGroupName: exampleResourceGroup.name,
    workspaceResourceId: exampleAnalyticsWorkspace.id,
    workspaceName: exampleAnalyticsWorkspace.name,
    plan: {
        publisher: "Microsoft",
        product: "OMSGallery/SecurityInsights",
    },
});
const exampleAutomationRule = new azure.sentinel.AutomationRule("exampleAutomationRule", {
    logAnalyticsWorkspaceId: sentinel.workspaceResourceId,
    displayName: "automation_rule1",
    order: 1,
    actionIncidents: [{
        order: 1,
        status: "Active",
    }],
});

import pulumi
import pulumi_azure as azure

example_resource_group = azure.core.ResourceGroup("exampleResourceGroup", location="west europe")
example_analytics_workspace = azure.operationalinsights.AnalyticsWorkspace("exampleAnalyticsWorkspace",
    location=example_resource_group.location,
    resource_group_name=example_resource_group.name,
    sku="pergb2018")
sentinel = azure.operationalinsights.AnalyticsSolution("sentinel",
    solution_name="SecurityInsights",
    location=example_resource_group.location,
    resource_group_name=example_resource_group.name,
    workspace_resource_id=example_analytics_workspace.id,
    workspace_name=example_analytics_workspace.name,
    plan=azure.operationalinsights.AnalyticsSolutionPlanArgs(
        publisher="Microsoft",
        product="OMSGallery/SecurityInsights",
    ))
example_automation_rule = azure.sentinel.AutomationRule("exampleAutomationRule",
    log_analytics_workspace_id=sentinel.workspace_resource_id,
    display_name="automation_rule1",
    order=1,
    action_incidents=[azure.sentinel.AutomationRuleActionIncidentArgs(
        order=1,
        status="Active",
    )])