Datadog v4.23.0, Sep 27 23

Datadog v4.23.0 published on Wednesday, Sep 27, 2023 by Pulumi

datadog.SecurityMonitoringRule

Explore with Pulumi AI

Datadog v4.23.0 published on Wednesday, Sep 27, 2023 by Pulumi

Example Usage

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Datadog = Pulumi.Datadog;

return await Deployment.RunAsync(() => 
{
    var myrule = new Datadog.SecurityMonitoringRule("myrule", new()
    {
        Cases = new[]
        {
            new Datadog.Inputs.SecurityMonitoringRuleCaseArgs
            {
                Condition = "errors > 3 && warnings > 10",
                Notifications = new[]
                {
                    "@user",
                },
                Status = "high",
            },
        },
        Enabled = true,
        Message = "The rule has triggered.",
        Name = "My rule",
        Options = new Datadog.Inputs.SecurityMonitoringRuleOptionsArgs
        {
            EvaluationWindow = 300,
            KeepAlive = 600,
            MaxSignalDuration = 900,
        },
        Queries = new[]
        {
            new Datadog.Inputs.SecurityMonitoringRuleQueryArgs
            {
                Aggregation = "count",
                GroupByFields = new[]
                {
                    "host",
                },
                Name = "errors",
                Query = "status:error",
            },
            new Datadog.Inputs.SecurityMonitoringRuleQueryArgs
            {
                Aggregation = "count",
                GroupByFields = new[]
                {
                    "host",
                },
                Name = "warnings",
                Query = "status:warning",
            },
        },
        Tags = new[]
        {
            "type:dos",
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-datadog/sdk/v4/go/datadog"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := datadog.NewSecurityMonitoringRule(ctx, "myrule", &datadog.SecurityMonitoringRuleArgs{
			Cases: datadog.SecurityMonitoringRuleCaseArray{
				&datadog.SecurityMonitoringRuleCaseArgs{
					Condition: pulumi.String("errors > 3 && warnings > 10"),
					Notifications: pulumi.StringArray{
						pulumi.String("@user"),
					},
					Status: pulumi.String("high"),
				},
			},
			Enabled: pulumi.Bool(true),
			Message: pulumi.String("The rule has triggered."),
			Name:    pulumi.String("My rule"),
			Options: &datadog.SecurityMonitoringRuleOptionsArgs{
				EvaluationWindow:  pulumi.Int(300),
				KeepAlive:         pulumi.Int(600),
				MaxSignalDuration: pulumi.Int(900),
			},
			Queries: datadog.SecurityMonitoringRuleQueryArray{
				&datadog.SecurityMonitoringRuleQueryArgs{
					Aggregation: pulumi.String("count"),
					GroupByFields: pulumi.StringArray{
						pulumi.String("host"),
					},
					Name:  pulumi.String("errors"),
					Query: pulumi.String("status:error"),
				},
				&datadog.SecurityMonitoringRuleQueryArgs{
					Aggregation: pulumi.String("count"),
					GroupByFields: pulumi.StringArray{
						pulumi.String("host"),
					},
					Name:  pulumi.String("warnings"),
					Query: pulumi.String("status:warning"),
				},
			},
			Tags: pulumi.StringArray{
				pulumi.String("type:dos"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.datadog.SecurityMonitoringRule;
import com.pulumi.datadog.SecurityMonitoringRuleArgs;
import com.pulumi.datadog.inputs.SecurityMonitoringRuleCaseArgs;
import com.pulumi.datadog.inputs.SecurityMonitoringRuleOptionsArgs;
import com.pulumi.datadog.inputs.SecurityMonitoringRuleQueryArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var myrule = new SecurityMonitoringRule("myrule", SecurityMonitoringRuleArgs.builder()        
            .cases(SecurityMonitoringRuleCaseArgs.builder()
                .condition("errors > 3 && warnings > 10")
                .notifications("@user")
                .status("high")
                .build())
            .enabled(true)
            .message("The rule has triggered.")
            .name("My rule")
            .options(SecurityMonitoringRuleOptionsArgs.builder()
                .evaluationWindow(300)
                .keepAlive(600)
                .maxSignalDuration(900)
                .build())
            .queries(            
                SecurityMonitoringRuleQueryArgs.builder()
                    .aggregation("count")
                    .groupByFields("host")
                    .name("errors")
                    .query("status:error")
                    .build(),
                SecurityMonitoringRuleQueryArgs.builder()
                    .aggregation("count")
                    .groupByFields("host")
                    .name("warnings")
                    .query("status:warning")
                    .build())
            .tags("type:dos")
            .build());

    }
}

import pulumi
import pulumi_datadog as datadog

myrule = datadog.SecurityMonitoringRule("myrule",
    cases=[datadog.SecurityMonitoringRuleCaseArgs(
        condition="errors > 3 && warnings > 10",
        notifications=["@user"],
        status="high",
    )],
    enabled=True,
    message="The rule has triggered.",
    name="My rule",
    options=datadog.SecurityMonitoringRuleOptionsArgs(
        evaluation_window=300,
        keep_alive=600,
        max_signal_duration=900,
    ),
    queries=[
        datadog.SecurityMonitoringRuleQueryArgs(
            aggregation="count",
            group_by_fields=["host"],
            name="errors",
            query="status:error",
        ),
        datadog.SecurityMonitoringRuleQueryArgs(
            aggregation="count",
            group_by_fields=["host"],
            name="warnings",
            query="status:warning",
        ),
    ],
    tags=["type:dos"])

import * as pulumi from "@pulumi/pulumi";
import * as datadog from "@pulumi/datadog";

const myrule = new datadog.SecurityMonitoringRule("myrule", {
    cases: [{
        condition: "errors > 3 && warnings > 10",
        notifications: ["@user"],
        status: "high",
    }],
    enabled: true,
    message: "The rule has triggered.",
    name: "My rule",
    options: {
        evaluationWindow: 300,
        keepAlive: 600,
        maxSignalDuration: 900,
    },
    queries: [
        {
            aggregation: "count",
            groupByFields: ["host"],
            name: "errors",
            query: "status:error",
        },
        {
            aggregation: "count",
            groupByFields: ["host"],
            name: "warnings",
            query: "status:warning",
        },
    ],
    tags: ["type:dos"],
});

resources:
  myrule:
    type: datadog:SecurityMonitoringRule
    properties:
      cases:
        - condition: errors > 3 && warnings > 10
          notifications:
            - '@user'
          status: high
      enabled: true
      message: The rule has triggered.
      name: My rule
      options:
        evaluationWindow: 300
        keepAlive: 600
        maxSignalDuration: 900
      queries:
        - aggregation: count
          groupByFields:
            - host
          name: errors
          query: status:error
        - aggregation: count
          groupByFields:
            - host
          name: warnings
          query: status:warning
      tags:
        - type:dos

Create SecurityMonitoringRule Resource

new SecurityMonitoringRule(name: string, args: SecurityMonitoringRuleArgs, opts?: CustomResourceOptions);

@overload
def SecurityMonitoringRule(resource_name: str,
                           opts: Optional[ResourceOptions] = None,
                           cases: Optional[Sequence[SecurityMonitoringRuleCaseArgs]] = None,
                           enabled: Optional[bool] = None,
                           filters: Optional[Sequence[SecurityMonitoringRuleFilterArgs]] = None,
                           has_extended_title: Optional[bool] = None,
                           message: Optional[str] = None,
                           name: Optional[str] = None,
                           options: Optional[SecurityMonitoringRuleOptionsArgs] = None,
                           queries: Optional[Sequence[SecurityMonitoringRuleQueryArgs]] = None,
                           signal_queries: Optional[Sequence[SecurityMonitoringRuleSignalQueryArgs]] = None,
                           tags: Optional[Sequence[str]] = None,
                           type: Optional[str] = None)
@overload
def SecurityMonitoringRule(resource_name: str,
                           args: SecurityMonitoringRuleArgs,
                           opts: Optional[ResourceOptions] = None)

func NewSecurityMonitoringRule(ctx *Context, name string, args SecurityMonitoringRuleArgs, opts ...ResourceOption) (*SecurityMonitoringRule, error)

public SecurityMonitoringRule(string name, SecurityMonitoringRuleArgs args, CustomResourceOptions? opts = null)

public SecurityMonitoringRule(String name, SecurityMonitoringRuleArgs args)
public SecurityMonitoringRule(String name, SecurityMonitoringRuleArgs args, CustomResourceOptions options)

type: datadog:SecurityMonitoringRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

name string: The unique name of the resource.
args SecurityMonitoringRuleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args SecurityMonitoringRuleArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args SecurityMonitoringRuleArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args SecurityMonitoringRuleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args SecurityMonitoringRuleArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

SecurityMonitoringRule Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The SecurityMonitoringRule resource accepts the following input properties:

Cases List<SecurityMonitoringRuleCase>: Cases for generating signals.
Message string: Message for generated signals.
Name string: The name of the rule.
Enabled bool: Whether the rule is enabled.
Filters List<SecurityMonitoringRuleFilter>: Additional queries to filter matched events before they are processed.
HasExtendedTitle bool: Whether the notifications include the triggering group-by values in their title.
Options SecurityMonitoringRuleOptions: Options on rules.
Queries List<SecurityMonitoringRuleQuery>: Queries for selecting logs which are part of the rule.
SignalQueries List<SecurityMonitoringRuleSignalQuery>: Queries for selecting logs which are part of the rule.
Tags List<string>: Tags for generated signals.
Type string: The rule type. Valid values are log_detection, workload_security, signal_correlation.

Cases []SecurityMonitoringRuleCaseArgs: Cases for generating signals.
Message string: Message for generated signals.
Name string: The name of the rule.
Enabled bool: Whether the rule is enabled.
Filters []SecurityMonitoringRuleFilterArgs: Additional queries to filter matched events before they are processed.
HasExtendedTitle bool: Whether the notifications include the triggering group-by values in their title.
Options SecurityMonitoringRuleOptionsArgs: Options on rules.
Queries []SecurityMonitoringRuleQueryArgs: Queries for selecting logs which are part of the rule.
SignalQueries []SecurityMonitoringRuleSignalQueryArgs: Queries for selecting logs which are part of the rule.
Tags []string: Tags for generated signals.
Type string: The rule type. Valid values are log_detection, workload_security, signal_correlation.

cases List<SecurityMonitoringRuleCase>: Cases for generating signals.
message String: Message for generated signals.
name String: The name of the rule.
enabled Boolean: Whether the rule is enabled.
filters List<SecurityMonitoringRuleFilter>: Additional queries to filter matched events before they are processed.
hasExtendedTitle Boolean: Whether the notifications include the triggering group-by values in their title.
options SecurityMonitoringRuleOptions: Options on rules.
queries List<SecurityMonitoringRuleQuery>: Queries for selecting logs which are part of the rule.
signalQueries List<SecurityMonitoringRuleSignalQuery>: Queries for selecting logs which are part of the rule.
tags List<String>: Tags for generated signals.
type String: The rule type. Valid values are log_detection, workload_security, signal_correlation.

cases SecurityMonitoringRuleCase[]: Cases for generating signals.
message string: Message for generated signals.
name string: The name of the rule.
enabled boolean: Whether the rule is enabled.
filters SecurityMonitoringRuleFilter[]: Additional queries to filter matched events before they are processed.
hasExtendedTitle boolean: Whether the notifications include the triggering group-by values in their title.
options SecurityMonitoringRuleOptions: Options on rules.
queries SecurityMonitoringRuleQuery[]: Queries for selecting logs which are part of the rule.
signalQueries SecurityMonitoringRuleSignalQuery[]: Queries for selecting logs which are part of the rule.
tags string[]: Tags for generated signals.
type string: The rule type. Valid values are log_detection, workload_security, signal_correlation.

cases Sequence[SecurityMonitoringRuleCaseArgs]: Cases for generating signals.
message str: Message for generated signals.
name str: The name of the rule.
enabled bool: Whether the rule is enabled.
filters Sequence[SecurityMonitoringRuleFilterArgs]: Additional queries to filter matched events before they are processed.
has_extended_title bool: Whether the notifications include the triggering group-by values in their title.
options SecurityMonitoringRuleOptionsArgs: Options on rules.
queries Sequence[SecurityMonitoringRuleQueryArgs]: Queries for selecting logs which are part of the rule.
signal_queries Sequence[SecurityMonitoringRuleSignalQueryArgs]: Queries for selecting logs which are part of the rule.
tags Sequence[str]: Tags for generated signals.
type str: The rule type. Valid values are log_detection, workload_security, signal_correlation.

cases List<Property Map>: Cases for generating signals.
message String: Message for generated signals.
name String: The name of the rule.
enabled Boolean: Whether the rule is enabled.
filters List<Property Map>: Additional queries to filter matched events before they are processed.
hasExtendedTitle Boolean: Whether the notifications include the triggering group-by values in their title.
options Property Map: Options on rules.
queries List<Property Map>: Queries for selecting logs which are part of the rule.
signalQueries List<Property Map>: Queries for selecting logs which are part of the rule.
tags List<String>: Tags for generated signals.
type String: The rule type. Valid values are log_detection, workload_security, signal_correlation.

Outputs

All input properties are implicitly available as output properties. Additionally, the SecurityMonitoringRule resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.

Id string: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id str: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

Look up Existing SecurityMonitoringRule Resource

Get an existing SecurityMonitoringRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: SecurityMonitoringRuleState, opts?: CustomResourceOptions): SecurityMonitoringRule

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        cases: Optional[Sequence[SecurityMonitoringRuleCaseArgs]] = None,
        enabled: Optional[bool] = None,
        filters: Optional[Sequence[SecurityMonitoringRuleFilterArgs]] = None,
        has_extended_title: Optional[bool] = None,
        message: Optional[str] = None,
        name: Optional[str] = None,
        options: Optional[SecurityMonitoringRuleOptionsArgs] = None,
        queries: Optional[Sequence[SecurityMonitoringRuleQueryArgs]] = None,
        signal_queries: Optional[Sequence[SecurityMonitoringRuleSignalQueryArgs]] = None,
        tags: Optional[Sequence[str]] = None,
        type: Optional[str] = None) -> SecurityMonitoringRule

func GetSecurityMonitoringRule(ctx *Context, name string, id IDInput, state *SecurityMonitoringRuleState, opts ...ResourceOption) (*SecurityMonitoringRule, error)

public static SecurityMonitoringRule Get(string name, Input<string> id, SecurityMonitoringRuleState? state, CustomResourceOptions? opts = null)

public static SecurityMonitoringRule get(String name, Output<String> id, SecurityMonitoringRuleState state, CustomResourceOptions options)

Resource lookup is not supported in YAML

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

Cases List<SecurityMonitoringRuleCase>: Cases for generating signals.
Enabled bool: Whether the rule is enabled.
Filters List<SecurityMonitoringRuleFilter>: Additional queries to filter matched events before they are processed.
HasExtendedTitle bool: Whether the notifications include the triggering group-by values in their title.
Message string: Message for generated signals.
Name string: The name of the rule.
Options SecurityMonitoringRuleOptions: Options on rules.
Queries List<SecurityMonitoringRuleQuery>: Queries for selecting logs which are part of the rule.
SignalQueries List<SecurityMonitoringRuleSignalQuery>: Queries for selecting logs which are part of the rule.
Tags List<string>: Tags for generated signals.
Type string: The rule type. Valid values are log_detection, workload_security, signal_correlation.

Cases []SecurityMonitoringRuleCaseArgs: Cases for generating signals.
Enabled bool: Whether the rule is enabled.
Filters []SecurityMonitoringRuleFilterArgs: Additional queries to filter matched events before they are processed.
HasExtendedTitle bool: Whether the notifications include the triggering group-by values in their title.
Message string: Message for generated signals.
Name string: The name of the rule.
Options SecurityMonitoringRuleOptionsArgs: Options on rules.
Queries []SecurityMonitoringRuleQueryArgs: Queries for selecting logs which are part of the rule.
SignalQueries []SecurityMonitoringRuleSignalQueryArgs: Queries for selecting logs which are part of the rule.
Tags []string: Tags for generated signals.
Type string: The rule type. Valid values are log_detection, workload_security, signal_correlation.

cases List<SecurityMonitoringRuleCase>: Cases for generating signals.
enabled Boolean: Whether the rule is enabled.
filters List<SecurityMonitoringRuleFilter>: Additional queries to filter matched events before they are processed.
hasExtendedTitle Boolean: Whether the notifications include the triggering group-by values in their title.
message String: Message for generated signals.
name String: The name of the rule.
options SecurityMonitoringRuleOptions: Options on rules.
queries List<SecurityMonitoringRuleQuery>: Queries for selecting logs which are part of the rule.
signalQueries List<SecurityMonitoringRuleSignalQuery>: Queries for selecting logs which are part of the rule.
tags List<String>: Tags for generated signals.
type String: The rule type. Valid values are log_detection, workload_security, signal_correlation.

cases SecurityMonitoringRuleCase[]: Cases for generating signals.
enabled boolean: Whether the rule is enabled.
filters SecurityMonitoringRuleFilter[]: Additional queries to filter matched events before they are processed.
hasExtendedTitle boolean: Whether the notifications include the triggering group-by values in their title.
message string: Message for generated signals.
name string: The name of the rule.
options SecurityMonitoringRuleOptions: Options on rules.
queries SecurityMonitoringRuleQuery[]: Queries for selecting logs which are part of the rule.
signalQueries SecurityMonitoringRuleSignalQuery[]: Queries for selecting logs which are part of the rule.
tags string[]: Tags for generated signals.
type string: The rule type. Valid values are log_detection, workload_security, signal_correlation.

cases Sequence[SecurityMonitoringRuleCaseArgs]: Cases for generating signals.
enabled bool: Whether the rule is enabled.
filters Sequence[SecurityMonitoringRuleFilterArgs]: Additional queries to filter matched events before they are processed.
has_extended_title bool: Whether the notifications include the triggering group-by values in their title.
message str: Message for generated signals.
name str: The name of the rule.
options SecurityMonitoringRuleOptionsArgs: Options on rules.
queries Sequence[SecurityMonitoringRuleQueryArgs]: Queries for selecting logs which are part of the rule.
signal_queries Sequence[SecurityMonitoringRuleSignalQueryArgs]: Queries for selecting logs which are part of the rule.
tags Sequence[str]: Tags for generated signals.
type str: The rule type. Valid values are log_detection, workload_security, signal_correlation.

cases List<Property Map>: Cases for generating signals.
enabled Boolean: Whether the rule is enabled.
filters List<Property Map>: Additional queries to filter matched events before they are processed.
hasExtendedTitle Boolean: Whether the notifications include the triggering group-by values in their title.
message String: Message for generated signals.
name String: The name of the rule.
options Property Map: Options on rules.
queries List<Property Map>: Queries for selecting logs which are part of the rule.
signalQueries List<Property Map>: Queries for selecting logs which are part of the rule.
tags List<String>: Tags for generated signals.
type String: The rule type. Valid values are log_detection, workload_security, signal_correlation.

Supporting Types

SecurityMonitoringRuleCase, SecurityMonitoringRuleCaseArgs

Status string: Severity of the Security Signal. Valid values are info, low, medium, high, critical.
Condition string: A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated based on the event counts in the previously defined queries.
Name string: Name of the case.
Notifications List<string>: Notification targets for each rule case.

Status string: Severity of the Security Signal. Valid values are info, low, medium, high, critical.
Condition string: A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated based on the event counts in the previously defined queries.
Name string: Name of the case.
Notifications []string: Notification targets for each rule case.

status String: Severity of the Security Signal. Valid values are info, low, medium, high, critical.
condition String: A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated based on the event counts in the previously defined queries.
name String: Name of the case.
notifications List<String>: Notification targets for each rule case.

status string: Severity of the Security Signal. Valid values are info, low, medium, high, critical.
condition string: A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated based on the event counts in the previously defined queries.
name string: Name of the case.
notifications string[]: Notification targets for each rule case.

status str: Severity of the Security Signal. Valid values are info, low, medium, high, critical.
condition str: A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated based on the event counts in the previously defined queries.
name str: Name of the case.
notifications Sequence[str]: Notification targets for each rule case.

status String: Severity of the Security Signal. Valid values are info, low, medium, high, critical.
condition String: A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated based on the event counts in the previously defined queries.
name String: Name of the case.
notifications List<String>: Notification targets for each rule case.

SecurityMonitoringRuleFilter, SecurityMonitoringRuleFilterArgs

Action string: The type of filtering action. Valid values are require, suppress.
Query string: Query for selecting logs to apply the filtering action.

Action string: The type of filtering action. Valid values are require, suppress.
Query string: Query for selecting logs to apply the filtering action.

action String: The type of filtering action. Valid values are require, suppress.
query String: Query for selecting logs to apply the filtering action.

action string: The type of filtering action. Valid values are require, suppress.
query string: Query for selecting logs to apply the filtering action.

action str: The type of filtering action. Valid values are require, suppress.
query str: Query for selecting logs to apply the filtering action.

action String: The type of filtering action. Valid values are require, suppress.
query String: Query for selecting logs to apply the filtering action.

SecurityMonitoringRuleOptions, SecurityMonitoringRuleOptionsArgs

KeepAlive int: Once a signal is generated, the signal will remain “open” if a case is matched at least once within this keep alive window (in seconds). Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600.
MaxSignalDuration int: A signal will “close” regardless of the query being matched once the time exceeds the maximum duration (in seconds). This time is calculated from the first seen timestamp. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
DecreaseCriticalityBasedOnEnv bool: If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce noise. The decrement is applied when the environment tag of the signal starts with staging, test, or dev. Only available when the rule type is log_detection.
DetectionMethod string: The detection method. Valid values are threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party.
EvaluationWindow int: A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200.
ImpossibleTravelOptions SecurityMonitoringRuleOptionsImpossibleTravelOptions: Options for rules using the impossible travel detection method.
NewValueOptions SecurityMonitoringRuleOptionsNewValueOptions: New value rules specific options.

KeepAlive int: Once a signal is generated, the signal will remain “open” if a case is matched at least once within this keep alive window (in seconds). Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600.
MaxSignalDuration int: A signal will “close” regardless of the query being matched once the time exceeds the maximum duration (in seconds). This time is calculated from the first seen timestamp. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
DecreaseCriticalityBasedOnEnv bool: If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce noise. The decrement is applied when the environment tag of the signal starts with staging, test, or dev. Only available when the rule type is log_detection.
DetectionMethod string: The detection method. Valid values are threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party.
EvaluationWindow int: A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200.
ImpossibleTravelOptions SecurityMonitoringRuleOptionsImpossibleTravelOptions: Options for rules using the impossible travel detection method.
NewValueOptions SecurityMonitoringRuleOptionsNewValueOptions: New value rules specific options.

keepAlive Integer: Once a signal is generated, the signal will remain “open” if a case is matched at least once within this keep alive window (in seconds). Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600.
maxSignalDuration Integer: A signal will “close” regardless of the query being matched once the time exceeds the maximum duration (in seconds). This time is calculated from the first seen timestamp. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
decreaseCriticalityBasedOnEnv Boolean: If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce noise. The decrement is applied when the environment tag of the signal starts with staging, test, or dev. Only available when the rule type is log_detection.
detectionMethod String: The detection method. Valid values are threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party.
evaluationWindow Integer: A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200.
impossibleTravelOptions SecurityMonitoringRuleOptionsImpossibleTravelOptions: Options for rules using the impossible travel detection method.
newValueOptions SecurityMonitoringRuleOptionsNewValueOptions: New value rules specific options.

keepAlive number: Once a signal is generated, the signal will remain “open” if a case is matched at least once within this keep alive window (in seconds). Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600.
maxSignalDuration number: A signal will “close” regardless of the query being matched once the time exceeds the maximum duration (in seconds). This time is calculated from the first seen timestamp. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
decreaseCriticalityBasedOnEnv boolean: If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce noise. The decrement is applied when the environment tag of the signal starts with staging, test, or dev. Only available when the rule type is log_detection.
detectionMethod string: The detection method. Valid values are threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party.
evaluationWindow number: A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200.
impossibleTravelOptions SecurityMonitoringRuleOptionsImpossibleTravelOptions: Options for rules using the impossible travel detection method.
newValueOptions SecurityMonitoringRuleOptionsNewValueOptions: New value rules specific options.

keep_alive int: Once a signal is generated, the signal will remain “open” if a case is matched at least once within this keep alive window (in seconds). Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600.
max_signal_duration int: A signal will “close” regardless of the query being matched once the time exceeds the maximum duration (in seconds). This time is calculated from the first seen timestamp. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
decrease_criticality_based_on_env bool: If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce noise. The decrement is applied when the environment tag of the signal starts with staging, test, or dev. Only available when the rule type is log_detection.
detection_method str: The detection method. Valid values are threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party.
evaluation_window int: A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200.
impossible_travel_options SecurityMonitoringRuleOptionsImpossibleTravelOptions: Options for rules using the impossible travel detection method.
new_value_options SecurityMonitoringRuleOptionsNewValueOptions: New value rules specific options.

keepAlive Number: Once a signal is generated, the signal will remain “open” if a case is matched at least once within this keep alive window (in seconds). Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600.
maxSignalDuration Number: A signal will “close” regardless of the query being matched once the time exceeds the maximum duration (in seconds). This time is calculated from the first seen timestamp. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
decreaseCriticalityBasedOnEnv Boolean: If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce noise. The decrement is applied when the environment tag of the signal starts with staging, test, or dev. Only available when the rule type is log_detection.
detectionMethod String: The detection method. Valid values are threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party.
evaluationWindow Number: A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200.
impossibleTravelOptions Property Map: Options for rules using the impossible travel detection method.
newValueOptions Property Map: New value rules specific options.

SecurityMonitoringRuleOptionsImpossibleTravelOptions, SecurityMonitoringRuleOptionsImpossibleTravelOptionsArgs

BaselineUserLocations bool

BaselineUserLocations bool

baselineUserLocations Boolean

baselineUserLocations boolean

baseline_user_locations bool

baselineUserLocations Boolean

SecurityMonitoringRuleOptionsNewValueOptions, SecurityMonitoringRuleOptionsNewValueOptionsArgs

ForgetAfter int
LearningDuration int
LearningMethod string
LearningThreshold int

ForgetAfter int
LearningDuration int
LearningMethod string
LearningThreshold int

forgetAfter Integer
learningDuration Integer
learningMethod String
learningThreshold Integer

forgetAfter number
learningDuration number
learningMethod string
learningThreshold number

forget_after int
learning_duration int
learning_method str
learning_threshold int

forgetAfter Number
learningDuration Number
learningMethod String
learningThreshold Number

SecurityMonitoringRuleQuery, SecurityMonitoringRuleQueryArgs

Query string

Query to run on logs.

AgentRules List<SecurityMonitoringRuleQueryAgentRule>

Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource.

Deprecated:

agent_rule has been deprecated in favor of new Agent Rule resource.

Aggregation string

The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none.

DistinctFields List<string>

Field for which the cardinality is measured. Sent as an array.

GroupByFields List<string>

Fields to group by.

Metric string

The target field to aggregate over when using the sum, max, or geo_data aggregations. Deprecated. Configure metrics instead. This attribute will be removed in the next major version of the provider.

Deprecated:

Configure metrics instead. This attribute will be removed in the next major version of the provider.

Metrics List<string>

Group of target fields to aggregate over when using the sum, max, geo_data, or new_value aggregations. The sum, max, and geo_data aggregations only accept one value in this list, whereas the new_value aggregation accepts up to five values.

Name string

Name of the query. Not compatible with new_value aggregations.

Query string

Query to run on logs.

AgentRules []SecurityMonitoringRuleQueryAgentRule

Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource.

Deprecated:

agent_rule has been deprecated in favor of new Agent Rule resource.

Aggregation string

The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none.

DistinctFields []string

Field for which the cardinality is measured. Sent as an array.

GroupByFields []string

Fields to group by.

Metric string

Deprecated:

Configure metrics instead. This attribute will be removed in the next major version of the provider.

Metrics []string

Name string

Name of the query. Not compatible with new_value aggregations.

query String

Query to run on logs.

agentRules List<SecurityMonitoringRuleQueryAgentRule>

Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource.

Deprecated:

agent_rule has been deprecated in favor of new Agent Rule resource.

aggregation String

The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none.

distinctFields List<String>

Field for which the cardinality is measured. Sent as an array.

groupByFields List<String>

Fields to group by.

metric String

Deprecated:

Configure metrics instead. This attribute will be removed in the next major version of the provider.

metrics List<String>

name String

Name of the query. Not compatible with new_value aggregations.

query string

Query to run on logs.

agentRules SecurityMonitoringRuleQueryAgentRule[]

Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource.

Deprecated:

agent_rule has been deprecated in favor of new Agent Rule resource.

aggregation string

The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none.

distinctFields string[]

Field for which the cardinality is measured. Sent as an array.

groupByFields string[]

Fields to group by.

metric string

Deprecated:

Configure metrics instead. This attribute will be removed in the next major version of the provider.

metrics string[]

name string

Name of the query. Not compatible with new_value aggregations.

query str

Query to run on logs.

agent_rules Sequence[SecurityMonitoringRuleQueryAgentRule]

Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource.

Deprecated:

agent_rule has been deprecated in favor of new Agent Rule resource.

aggregation str

The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none.

distinct_fields Sequence[str]

Field for which the cardinality is measured. Sent as an array.

group_by_fields Sequence[str]

Fields to group by.

metric str

Deprecated:

Configure metrics instead. This attribute will be removed in the next major version of the provider.

metrics Sequence[str]

name str

Name of the query. Not compatible with new_value aggregations.

query String

Query to run on logs.

agentRules List<Property Map>

Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource.

Deprecated:

agent_rule has been deprecated in favor of new Agent Rule resource.

aggregation String

The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none.

distinctFields List<String>

Field for which the cardinality is measured. Sent as an array.

groupByFields List<String>

Fields to group by.

metric String

Deprecated:

Configure metrics instead. This attribute will be removed in the next major version of the provider.

metrics List<String>

name String

Name of the query. Not compatible with new_value aggregations.

SecurityMonitoringRuleQueryAgentRule, SecurityMonitoringRuleQueryAgentRuleArgs

AgentRuleId string
Expression string

AgentRuleId string
Expression string

agentRuleId String
expression String

agentRuleId string
expression string

agent_rule_id str
expression str

agentRuleId String
expression String

SecurityMonitoringRuleSignalQuery, SecurityMonitoringRuleSignalQueryArgs

RuleId string: Rule ID of the signal to correlate.
Aggregation string: The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none.
CorrelatedByFields List<string>: Fields to correlate by.
CorrelatedQueryIndex string: Index of the rule query used to retrieve the correlated field. An empty string applies correlation on the non-projected per query attributes of the rule.
DefaultRuleId string: Default Rule ID of the signal to correlate. This value is READ-ONLY.
Name string: Name of the query. Not compatible with new_value aggregations.

RuleId string: Rule ID of the signal to correlate.
Aggregation string: The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none.
CorrelatedByFields []string: Fields to correlate by.
CorrelatedQueryIndex string: Index of the rule query used to retrieve the correlated field. An empty string applies correlation on the non-projected per query attributes of the rule.
DefaultRuleId string: Default Rule ID of the signal to correlate. This value is READ-ONLY.
Name string: Name of the query. Not compatible with new_value aggregations.

ruleId String: Rule ID of the signal to correlate.
aggregation String: The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none.
correlatedByFields List<String>: Fields to correlate by.
correlatedQueryIndex String: Index of the rule query used to retrieve the correlated field. An empty string applies correlation on the non-projected per query attributes of the rule.
defaultRuleId String: Default Rule ID of the signal to correlate. This value is READ-ONLY.
name String: Name of the query. Not compatible with new_value aggregations.

ruleId string: Rule ID of the signal to correlate.
aggregation string: The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none.
correlatedByFields string[]: Fields to correlate by.
correlatedQueryIndex string: Index of the rule query used to retrieve the correlated field. An empty string applies correlation on the non-projected per query attributes of the rule.
defaultRuleId string: Default Rule ID of the signal to correlate. This value is READ-ONLY.
name string: Name of the query. Not compatible with new_value aggregations.

rule_id str: Rule ID of the signal to correlate.
aggregation str: The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none.
correlated_by_fields Sequence[str]: Fields to correlate by.
correlated_query_index str: Index of the rule query used to retrieve the correlated field. An empty string applies correlation on the non-projected per query attributes of the rule.
default_rule_id str: Default Rule ID of the signal to correlate. This value is READ-ONLY.
name str: Name of the query. Not compatible with new_value aggregations.

ruleId String: Rule ID of the signal to correlate.
aggregation String: The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none.
correlatedByFields List<String>: Fields to correlate by.
correlatedQueryIndex String: Index of the rule query used to retrieve the correlated field. An empty string applies correlation on the non-projected per query attributes of the rule.
defaultRuleId String: Default Rule ID of the signal to correlate. This value is READ-ONLY.
name String: Name of the query. Not compatible with new_value aggregations.

Import

Security monitoring rules can be imported using ID, e.g.

 $ pulumi import datadog:index/securityMonitoringRule:SecurityMonitoringRule my_rule m0o-hto-lkb

Package Details

Repository: Datadog pulumi/pulumi-datadog
License: Apache-2.0
Notes: This Pulumi package is based on the datadog Terraform Provider.

Datadog v4.23.0 published on Wednesday, Sep 27, 2023 by Pulumi

pulumi/pulumi-datadog

datadog.SecurityMonitoringRule

On this page

On this page

Example Usage

Create SecurityMonitoringRule Resource

SecurityMonitoringRule Resource Properties

Inputs

Outputs

Look up Existing SecurityMonitoringRule Resource

Supporting Types

SecurityMonitoringRuleCase, SecurityMonitoringRuleCaseArgs

SecurityMonitoringRuleFilter, SecurityMonitoringRuleFilterArgs

SecurityMonitoringRuleOptions, SecurityMonitoringRuleOptionsArgs

SecurityMonitoringRuleOptionsImpossibleTravelOptions, SecurityMonitoringRuleOptionsImpossibleTravelOptionsArgs

SecurityMonitoringRuleOptionsNewValueOptions, SecurityMonitoringRuleOptionsNewValueOptionsArgs

SecurityMonitoringRuleQuery, SecurityMonitoringRuleQueryArgs

SecurityMonitoringRuleQueryAgentRule, SecurityMonitoringRuleQueryAgentRuleArgs

SecurityMonitoringRuleSignalQuery, SecurityMonitoringRuleSignalQueryArgs

Import

Package Details

On this page

On this page