1. Packages
  2. Elasticstack Provider
  3. API Docs
  4. KibanaSecurityDetectionRule
elasticstack 0.12.1 published on Thursday, Oct 23, 2025 by elastic
elastic/terraform-provider-elasticstack

elasticstack.KibanaSecurityDetectionRule

Get Started
elasticstack logo
elasticstack 0.12.1 published on Thursday, Oct 23, 2025 by elastic
elastic/terraform-provider-elasticstack

    Creates or updates a Kibana security detection rule. See the rules API documentation for more details.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as elasticstack from "@pulumi/elasticstack";

// Basic security detection rule
const example = new elasticstack.KibanaSecurityDetectionRule("example", {
    authors: ["Security Team"],
    description: "Detects suspicious admin logon activities",
    enabled: true,
    falsePositives: ["Legitimate admin access during maintenance windows"],
    from: "now-6m",
    interval: "5m",
    language: "kuery",
    license: "Elastic License v2",
    note: "Investigate the source IP and verify if the admin access is legitimate.",
    query: "event.action:logon AND user.name:admin",
    references: [
        "https://example.com/security-docs",
        "https://example.com/admin-access-policy",
    ],
    riskScore: 75,
    setup: "Ensure that authentication logs are being collected and indexed.",
    severity: "high",
    tags: [
        "security",
        "authentication",
        "admin",
    ],
    to: "now",
    type: "query",
});
// Advanced security detection rule with custom settings
const advanced = new elasticstack.KibanaSecurityDetectionRule("advanced", {
    authors: [
        "Threat Intelligence Team",
        "SOC Analysts",
    ],
    description: "Detects encoded PowerShell commands which may indicate malicious activity",
    enabled: true,
    falsePositives: [
        "Legitimate encoded PowerShell scripts used by automation",
        "Software installation scripts",
    ],
    from: "now-10m",
    indices: [
        "winlogbeat-*",
        "logs-windows-*",
    ],
    interval: "2m",
    language: "kuery",
    license: "Elastic License v2",
    maxSignals: 200,
    note: `  ## Investigation Steps
  1. Examine the full PowerShell command line
  2. Decode any base64 encoded content
  3. Check the parent process that spawned PowerShell
  4. Review network connections made during execution
  5. Check for file system modifications

`,
    query: "process.name:powershell.exe AND process.args:*encoded*",
    references: [
        "https://attack.mitre.org/techniques/T1059/001/",
        "https://example.com/powershell-security-guide",
    ],
    riskScore: 90,
    setup: `  ## Prerequisites
  - Windows endpoint monitoring must be enabled
  - PowerShell logging should be configured
  - Sysmon or equivalent process monitoring required

`,
    severity: "critical",
    tags: [
        "windows",
        "powershell",
        "encoded",
        "malware",
        "critical",
    ],
    to: "now",
    type: "query",
    version: 1,
});

    import pulumi
import pulumi_elasticstack as elasticstack

# Basic security detection rule
example = elasticstack.KibanaSecurityDetectionRule("example",
    authors=["Security Team"],
    description="Detects suspicious admin logon activities",
    enabled=True,
    false_positives=["Legitimate admin access during maintenance windows"],
    from_="now-6m",
    interval="5m",
    language="kuery",
    license="Elastic License v2",
    note="Investigate the source IP and verify if the admin access is legitimate.",
    query="event.action:logon AND user.name:admin",
    references=[
        "https://example.com/security-docs",
        "https://example.com/admin-access-policy",
    ],
    risk_score=75,
    setup="Ensure that authentication logs are being collected and indexed.",
    severity="high",
    tags=[
        "security",
        "authentication",
        "admin",
    ],
    to="now",
    type="query")
# Advanced security detection rule with custom settings
advanced = elasticstack.KibanaSecurityDetectionRule("advanced",
    authors=[
        "Threat Intelligence Team",
        "SOC Analysts",
    ],
    description="Detects encoded PowerShell commands which may indicate malicious activity",
    enabled=True,
    false_positives=[
        "Legitimate encoded PowerShell scripts used by automation",
        "Software installation scripts",
    ],
    from_="now-10m",
    indices=[
        "winlogbeat-*",
        "logs-windows-*",
    ],
    interval="2m",
    language="kuery",
    license="Elastic License v2",
    max_signals=200,
    note="""  ## Investigation Steps
  1. Examine the full PowerShell command line
  2. Decode any base64 encoded content
  3. Check the parent process that spawned PowerShell
  4. Review network connections made during execution
  5. Check for file system modifications

""",
    query="process.name:powershell.exe AND process.args:*encoded*",
    references=[
        "https://attack.mitre.org/techniques/T1059/001/",
        "https://example.com/powershell-security-guide",
    ],
    risk_score=90,
    setup="""  ## Prerequisites
  - Windows endpoint monitoring must be enabled
  - PowerShell logging should be configured
  - Sysmon or equivalent process monitoring required

""",
    severity="critical",
    tags=[
        "windows",
        "powershell",
        "encoded",
        "malware",
        "critical",
    ],
    to="now",
    type="query",
    version=1)

    package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/elasticstack/elasticstack"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// Basic security detection rule
		_, err := elasticstack.NewKibanaSecurityDetectionRule(ctx, "example", &elasticstack.KibanaSecurityDetectionRuleArgs{
			Authors: pulumi.StringArray{
				pulumi.String("Security Team"),
			},
			Description: pulumi.String("Detects suspicious admin logon activities"),
			Enabled:     pulumi.Bool(true),
			FalsePositives: pulumi.StringArray{
				pulumi.String("Legitimate admin access during maintenance windows"),
			},
			From:     pulumi.String("now-6m"),
			Interval: pulumi.String("5m"),
			Language: pulumi.String("kuery"),
			License:  pulumi.String("Elastic License v2"),
			Note:     pulumi.String("Investigate the source IP and verify if the admin access is legitimate."),
			Query:    pulumi.String("event.action:logon AND user.name:admin"),
			References: pulumi.StringArray{
				pulumi.String("https://example.com/security-docs"),
				pulumi.String("https://example.com/admin-access-policy"),
			},
			RiskScore: pulumi.Float64(75),
			Setup:     pulumi.String("Ensure that authentication logs are being collected and indexed."),
			Severity:  pulumi.String("high"),
			Tags: pulumi.StringArray{
				pulumi.String("security"),
				pulumi.String("authentication"),
				pulumi.String("admin"),
			},
			To:   pulumi.String("now"),
			Type: pulumi.String("query"),
		})
		if err != nil {
			return err
		}
		// Advanced security detection rule with custom settings
		_, err = elasticstack.NewKibanaSecurityDetectionRule(ctx, "advanced", &elasticstack.KibanaSecurityDetectionRuleArgs{
			Authors: pulumi.StringArray{
				pulumi.String("Threat Intelligence Team"),
				pulumi.String("SOC Analysts"),
			},
			Description: pulumi.String("Detects encoded PowerShell commands which may indicate malicious activity"),
			Enabled:     pulumi.Bool(true),
			FalsePositives: pulumi.StringArray{
				pulumi.String("Legitimate encoded PowerShell scripts used by automation"),
				pulumi.String("Software installation scripts"),
			},
			From: pulumi.String("now-10m"),
			Indices: pulumi.StringArray{
				pulumi.String("winlogbeat-*"),
				pulumi.String("logs-windows-*"),
			},
			Interval:   pulumi.String("2m"),
			Language:   pulumi.String("kuery"),
			License:    pulumi.String("Elastic License v2"),
			MaxSignals: pulumi.Float64(200),
			Note: pulumi.String(`  ## Investigation Steps
  1. Examine the full PowerShell command line
  2. Decode any base64 encoded content
  3. Check the parent process that spawned PowerShell
  4. Review network connections made during execution
  5. Check for file system modifications

`),
			Query: pulumi.String("process.name:powershell.exe AND process.args:*encoded*"),
			References: pulumi.StringArray{
				pulumi.String("https://attack.mitre.org/techniques/T1059/001/"),
				pulumi.String("https://example.com/powershell-security-guide"),
			},
			RiskScore: pulumi.Float64(90),
			Setup: pulumi.String(`  ## Prerequisites
  - Windows endpoint monitoring must be enabled
  - PowerShell logging should be configured
  - Sysmon or equivalent process monitoring required

`),
			Severity: pulumi.String("critical"),
			Tags: pulumi.StringArray{
				pulumi.String("windows"),
				pulumi.String("powershell"),
				pulumi.String("encoded"),
				pulumi.String("malware"),
				pulumi.String("critical"),
			},
			To:      pulumi.String("now"),
			Type:    pulumi.String("query"),
			Version: pulumi.Float64(1),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Elasticstack = Pulumi.Elasticstack;

return await Deployment.RunAsync(() => 
{
    // Basic security detection rule
    var example = new Elasticstack.KibanaSecurityDetectionRule("example", new()
    {
        Authors = new[]
        {
            "Security Team",
        },
        Description = "Detects suspicious admin logon activities",
        Enabled = true,
        FalsePositives = new[]
        {
            "Legitimate admin access during maintenance windows",
        },
        From = "now-6m",
        Interval = "5m",
        Language = "kuery",
        License = "Elastic License v2",
        Note = "Investigate the source IP and verify if the admin access is legitimate.",
        Query = "event.action:logon AND user.name:admin",
        References = new[]
        {
            "https://example.com/security-docs",
            "https://example.com/admin-access-policy",
        },
        RiskScore = 75,
        Setup = "Ensure that authentication logs are being collected and indexed.",
        Severity = "high",
        Tags = new[]
        {
            "security",
            "authentication",
            "admin",
        },
        To = "now",
        Type = "query",
    });

    // Advanced security detection rule with custom settings
    var advanced = new Elasticstack.KibanaSecurityDetectionRule("advanced", new()
    {
        Authors = new[]
        {
            "Threat Intelligence Team",
            "SOC Analysts",
        },
        Description = "Detects encoded PowerShell commands which may indicate malicious activity",
        Enabled = true,
        FalsePositives = new[]
        {
            "Legitimate encoded PowerShell scripts used by automation",
            "Software installation scripts",
        },
        From = "now-10m",
        Indices = new[]
        {
            "winlogbeat-*",
            "logs-windows-*",
        },
        Interval = "2m",
        Language = "kuery",
        License = "Elastic License v2",
        MaxSignals = 200,
        Note = @"  ## Investigation Steps
  1. Examine the full PowerShell command line
  2. Decode any base64 encoded content
  3. Check the parent process that spawned PowerShell
  4. Review network connections made during execution
  5. Check for file system modifications

",
        Query = "process.name:powershell.exe AND process.args:*encoded*",
        References = new[]
        {
            "https://attack.mitre.org/techniques/T1059/001/",
            "https://example.com/powershell-security-guide",
        },
        RiskScore = 90,
        Setup = @"  ## Prerequisites
  - Windows endpoint monitoring must be enabled
  - PowerShell logging should be configured
  - Sysmon or equivalent process monitoring required

",
        Severity = "critical",
        Tags = new[]
        {
            "windows",
            "powershell",
            "encoded",
            "malware",
            "critical",
        },
        To = "now",
        Type = "query",
        Version = 1,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.elasticstack.KibanaSecurityDetectionRule;
import com.pulumi.elasticstack.KibanaSecurityDetectionRuleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // Basic security detection rule
        var example = new KibanaSecurityDetectionRule("example", KibanaSecurityDetectionRuleArgs.builder()
            .authors("Security Team")
            .description("Detects suspicious admin logon activities")
            .enabled(true)
            .falsePositives("Legitimate admin access during maintenance windows")
            .from("now-6m")
            .interval("5m")
            .language("kuery")
            .license("Elastic License v2")
            .note("Investigate the source IP and verify if the admin access is legitimate.")
            .query("event.action:logon AND user.name:admin")
            .references(            
                "https://example.com/security-docs",
                "https://example.com/admin-access-policy")
            .riskScore(75)
            .setup("Ensure that authentication logs are being collected and indexed.")
            .severity("high")
            .tags(            
                "security",
                "authentication",
                "admin")
            .to("now")
            .type("query")
            .build());

        // Advanced security detection rule with custom settings
        var advanced = new KibanaSecurityDetectionRule("advanced", KibanaSecurityDetectionRuleArgs.builder()
            .authors(            
                "Threat Intelligence Team",
                "SOC Analysts")
            .description("Detects encoded PowerShell commands which may indicate malicious activity")
            .enabled(true)
            .falsePositives(            
                "Legitimate encoded PowerShell scripts used by automation",
                "Software installation scripts")
            .from("now-10m")
            .indices(            
                "winlogbeat-*",
                "logs-windows-*")
            .interval("2m")
            .language("kuery")
            .license("Elastic License v2")
            .maxSignals(200)
            .note("""
  ## Investigation Steps
  1. Examine the full PowerShell command line
  2. Decode any base64 encoded content
  3. Check the parent process that spawned PowerShell
  4. Review network connections made during execution
  5. Check for file system modifications

            """)
            .query("process.name:powershell.exe AND process.args:*encoded*")
            .references(            
                "https://attack.mitre.org/techniques/T1059/001/",
                "https://example.com/powershell-security-guide")
            .riskScore(90)
            .setup("""
  ## Prerequisites
  - Windows endpoint monitoring must be enabled
  - PowerShell logging should be configured
  - Sysmon or equivalent process monitoring required

            """)
            .severity("critical")
            .tags(            
                "windows",
                "powershell",
                "encoded",
                "malware",
                "critical")
            .to("now")
            .type("query")
            .version(1)
            .build());

    }
}

    resources:
  # Basic security detection rule
  example:
    type: elasticstack:KibanaSecurityDetectionRule
    properties:
      authors:
        - Security Team
      description: Detects suspicious admin logon activities
      enabled: true
      falsePositives:
        - Legitimate admin access during maintenance windows
      from: now-6m
      interval: 5m
      language: kuery
      license: Elastic License v2
      note: Investigate the source IP and verify if the admin access is legitimate.
      query: event.action:logon AND user.name:admin
      references:
        - https://example.com/security-docs
        - https://example.com/admin-access-policy
      riskScore: 75
      setup: Ensure that authentication logs are being collected and indexed.
      severity: high
      tags:
        - security
        - authentication
        - admin
      to: now
      type: query
  # Advanced security detection rule with custom settings
  advanced:
    type: elasticstack:KibanaSecurityDetectionRule
    properties:
      authors:
        - Threat Intelligence Team
        - SOC Analysts
      description: Detects encoded PowerShell commands which may indicate malicious activity
      enabled: true
      falsePositives:
        - Legitimate encoded PowerShell scripts used by automation
        - Software installation scripts
      from: now-10m
      indices:
        - winlogbeat-*
        - logs-windows-*
      interval: 2m
      language: kuery
      license: Elastic License v2
      maxSignals: 200
      note: |2+
          ## Investigation Steps
          1. Examine the full PowerShell command line
          2. Decode any base64 encoded content
          3. Check the parent process that spawned PowerShell
          4. Review network connections made during execution
          5. Check for file system modifications

      query: process.name:powershell.exe AND process.args:*encoded*
      references:
        - https://attack.mitre.org/techniques/T1059/001/
        - https://example.com/powershell-security-guide
      riskScore: 90
      setup: |2+
          ## Prerequisites
          - Windows endpoint monitoring must be enabled
          - PowerShell logging should be configured
          - Sysmon or equivalent process monitoring required

      severity: critical
      tags:
        - windows
        - powershell
        - encoded
        - malware
        - critical
      to: now
      type: query
      version: 1

    Create KibanaSecurityDetectionRule Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new KibanaSecurityDetectionRule(name: string, args: KibanaSecurityDetectionRuleArgs, opts?: CustomResourceOptions);
    @overload
def KibanaSecurityDetectionRule(resource_name: str,
                                args: KibanaSecurityDetectionRuleArgs,
                                opts: Optional[ResourceOptions] = None)

@overload
def KibanaSecurityDetectionRule(resource_name: str,
                                opts: Optional[ResourceOptions] = None,
                                description: Optional[str] = None,
                                type: Optional[str] = None,
                                actions: Optional[Sequence[KibanaSecurityDetectionRuleActionArgs]] = None,
                                alert_suppression: Optional[KibanaSecurityDetectionRuleAlertSuppressionArgs] = None,
                                anomaly_threshold: Optional[float] = None,
                                authors: Optional[Sequence[str]] = None,
                                building_block_type: Optional[str] = None,
                                concurrent_searches: Optional[float] = None,
                                data_view_id: Optional[str] = None,
                                enabled: Optional[bool] = None,
                                exceptions_lists: Optional[Sequence[KibanaSecurityDetectionRuleExceptionsListArgs]] = None,
                                false_positives: Optional[Sequence[str]] = None,
                                filters: Optional[str] = None,
                                from_: Optional[str] = None,
                                history_window_start: Optional[str] = None,
                                indices: Optional[Sequence[str]] = None,
                                interval: Optional[str] = None,
                                investigation_fields: Optional[Sequence[str]] = None,
                                items_per_search: Optional[float] = None,
                                language: Optional[str] = None,
                                license: Optional[str] = None,
                                machine_learning_job_ids: Optional[Sequence[str]] = None,
                                max_signals: Optional[float] = None,
                                name: Optional[str] = None,
                                namespace: Optional[str] = None,
                                new_terms_fields: Optional[Sequence[str]] = None,
                                note: Optional[str] = None,
                                query: Optional[str] = None,
                                references: Optional[Sequence[str]] = None,
                                related_integrations: Optional[Sequence[KibanaSecurityDetectionRuleRelatedIntegrationArgs]] = None,
                                required_fields: Optional[Sequence[KibanaSecurityDetectionRuleRequiredFieldArgs]] = None,
                                response_actions: Optional[Sequence[KibanaSecurityDetectionRuleResponseActionArgs]] = None,
                                risk_score: Optional[float] = None,
                                risk_score_mappings: Optional[Sequence[KibanaSecurityDetectionRuleRiskScoreMappingArgs]] = None,
                                rule_id: Optional[str] = None,
                                rule_name_override: Optional[str] = None,
                                saved_id: Optional[str] = None,
                                setup: Optional[str] = None,
                                severity: Optional[str] = None,
                                severity_mappings: Optional[Sequence[KibanaSecurityDetectionRuleSeverityMappingArgs]] = None,
                                space_id: Optional[str] = None,
                                tags: Optional[Sequence[str]] = None,
                                threat_filters: Optional[Sequence[str]] = None,
                                threat_indicator_path: Optional[str] = None,
                                threat_indices: Optional[Sequence[str]] = None,
                                threat_mappings: Optional[Sequence[KibanaSecurityDetectionRuleThreatMappingArgs]] = None,
                                threat_query: Optional[str] = None,
                                threats: Optional[Sequence[KibanaSecurityDetectionRuleThreatArgs]] = None,
                                threshold: Optional[KibanaSecurityDetectionRuleThresholdArgs] = None,
                                tiebreaker_field: Optional[str] = None,
                                timeline_id: Optional[str] = None,
                                timeline_title: Optional[str] = None,
                                timestamp_override: Optional[str] = None,
                                timestamp_override_fallback_disabled: Optional[bool] = None,
                                to: Optional[str] = None,
                                version: Optional[float] = None)
    func NewKibanaSecurityDetectionRule(ctx *Context, name string, args KibanaSecurityDetectionRuleArgs, opts ...ResourceOption) (*KibanaSecurityDetectionRule, error)
    public KibanaSecurityDetectionRule(string name, KibanaSecurityDetectionRuleArgs args, CustomResourceOptions? opts = null)
    public KibanaSecurityDetectionRule(String name, KibanaSecurityDetectionRuleArgs args)
public KibanaSecurityDetectionRule(String name, KibanaSecurityDetectionRuleArgs args, CustomResourceOptions options)

    type: elasticstack:KibanaSecurityDetectionRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args KibanaSecurityDetectionRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args KibanaSecurityDetectionRuleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args KibanaSecurityDetectionRuleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args KibanaSecurityDetectionRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args KibanaSecurityDetectionRuleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var kibanaSecurityDetectionRuleResource = new Elasticstack.KibanaSecurityDetectionRule("kibanaSecurityDetectionRuleResource", new()
{
    Description = "string",
    Type = "string",
    Actions = new[]
    {
        new Elasticstack.Inputs.KibanaSecurityDetectionRuleActionArgs
        {
            ActionTypeId = "string",
            Id = "string",
            Params = 
            {
                { "string", "string" },
            },
            AlertsFilter = 
            {
                { "string", "string" },
            },
            Frequency = new Elasticstack.Inputs.KibanaSecurityDetectionRuleActionFrequencyArgs
            {
                NotifyWhen = "string",
                Summary = false,
                Throttle = "string",
            },
            Group = "string",
            Uuid = "string",
        },
    },
    AlertSuppression = new Elasticstack.Inputs.KibanaSecurityDetectionRuleAlertSuppressionArgs
    {
        Duration = "string",
        GroupBies = new[]
        {
            "string",
        },
        MissingFieldsStrategy = "string",
    },
    AnomalyThreshold = 0,
    Authors = new[]
    {
        "string",
    },
    BuildingBlockType = "string",
    ConcurrentSearches = 0,
    DataViewId = "string",
    Enabled = false,
    ExceptionsLists = new[]
    {
        new Elasticstack.Inputs.KibanaSecurityDetectionRuleExceptionsListArgs
        {
            Id = "string",
            ListId = "string",
            NamespaceType = "string",
            Type = "string",
        },
    },
    FalsePositives = new[]
    {
        "string",
    },
    Filters = "string",
    From = "string",
    HistoryWindowStart = "string",
    Indices = new[]
    {
        "string",
    },
    Interval = "string",
    InvestigationFields = new[]
    {
        "string",
    },
    ItemsPerSearch = 0,
    Language = "string",
    License = "string",
    MachineLearningJobIds = new[]
    {
        "string",
    },
    MaxSignals = 0,
    Name = "string",
    Namespace = "string",
    NewTermsFields = new[]
    {
        "string",
    },
    Note = "string",
    Query = "string",
    References = new[]
    {
        "string",
    },
    RelatedIntegrations = new[]
    {
        new Elasticstack.Inputs.KibanaSecurityDetectionRuleRelatedIntegrationArgs
        {
            Package = "string",
            Version = "string",
            Integration = "string",
        },
    },
    RequiredFields = new[]
    {
        new Elasticstack.Inputs.KibanaSecurityDetectionRuleRequiredFieldArgs
        {
            Name = "string",
            Type = "string",
            Ecs = false,
        },
    },
    ResponseActions = new[]
    {
        new Elasticstack.Inputs.KibanaSecurityDetectionRuleResponseActionArgs
        {
            ActionTypeId = "string",
            Params = new Elasticstack.Inputs.KibanaSecurityDetectionRuleResponseActionParamsArgs
            {
                Command = "string",
                Comment = "string",
                Config = new Elasticstack.Inputs.KibanaSecurityDetectionRuleResponseActionParamsConfigArgs
                {
                    Field = "string",
                    Overwrite = false,
                },
                EcsMapping = 
                {
                    { "string", "string" },
                },
                PackId = "string",
                Queries = new[]
                {
                    new Elasticstack.Inputs.KibanaSecurityDetectionRuleResponseActionParamsQueryArgs
                    {
                        Id = "string",
                        Query = "string",
                        EcsMapping = 
                        {
                            { "string", "string" },
                        },
                        Platform = "string",
                        Removed = false,
                        Snapshot = false,
                        Version = "string",
                    },
                },
                Query = "string",
                SavedQueryId = "string",
                Timeout = 0,
            },
        },
    },
    RiskScore = 0,
    RiskScoreMappings = new[]
    {
        new Elasticstack.Inputs.KibanaSecurityDetectionRuleRiskScoreMappingArgs
        {
            Field = "string",
            Operator = "string",
            Value = "string",
            RiskScore = 0,
        },
    },
    RuleId = "string",
    RuleNameOverride = "string",
    SavedId = "string",
    Setup = "string",
    Severity = "string",
    SeverityMappings = new[]
    {
        new Elasticstack.Inputs.KibanaSecurityDetectionRuleSeverityMappingArgs
        {
            Field = "string",
            Operator = "string",
            Severity = "string",
            Value = "string",
        },
    },
    SpaceId = "string",
    Tags = new[]
    {
        "string",
    },
    ThreatFilters = new[]
    {
        "string",
    },
    ThreatIndicatorPath = "string",
    ThreatIndices = new[]
    {
        "string",
    },
    ThreatMappings = new[]
    {
        new Elasticstack.Inputs.KibanaSecurityDetectionRuleThreatMappingArgs
        {
            Entries = new[]
            {
                new Elasticstack.Inputs.KibanaSecurityDetectionRuleThreatMappingEntryArgs
                {
                    Field = "string",
                    Type = "string",
                    Value = "string",
                },
            },
        },
    },
    ThreatQuery = "string",
    Threats = new[]
    {
        new Elasticstack.Inputs.KibanaSecurityDetectionRuleThreatArgs
        {
            Framework = "string",
            Tactic = new Elasticstack.Inputs.KibanaSecurityDetectionRuleThreatTacticArgs
            {
                Id = "string",
                Name = "string",
                Reference = "string",
            },
            Techniques = new[]
            {
                new Elasticstack.Inputs.KibanaSecurityDetectionRuleThreatTechniqueArgs
                {
                    Id = "string",
                    Name = "string",
                    Reference = "string",
                    Subtechniques = new[]
                    {
                        new Elasticstack.Inputs.KibanaSecurityDetectionRuleThreatTechniqueSubtechniqueArgs
                        {
                            Id = "string",
                            Name = "string",
                            Reference = "string",
                        },
                    },
                },
            },
        },
    },
    Threshold = new Elasticstack.Inputs.KibanaSecurityDetectionRuleThresholdArgs
    {
        Value = 0,
        Cardinalities = new[]
        {
            new Elasticstack.Inputs.KibanaSecurityDetectionRuleThresholdCardinalityArgs
            {
                Field = "string",
                Value = 0,
            },
        },
        Fields = new[]
        {
            "string",
        },
    },
    TiebreakerField = "string",
    TimelineId = "string",
    TimelineTitle = "string",
    TimestampOverride = "string",
    TimestampOverrideFallbackDisabled = false,
    To = "string",
    Version = 0,
});

    example, err := elasticstack.NewKibanaSecurityDetectionRule(ctx, "kibanaSecurityDetectionRuleResource", &elasticstack.KibanaSecurityDetectionRuleArgs{
	Description: pulumi.String("string"),
	Type:        pulumi.String("string"),
	Actions: elasticstack.KibanaSecurityDetectionRuleActionArray{
		&elasticstack.KibanaSecurityDetectionRuleActionArgs{
			ActionTypeId: pulumi.String("string"),
			Id:           pulumi.String("string"),
			Params: pulumi.StringMap{
				"string": pulumi.String("string"),
			},
			AlertsFilter: pulumi.StringMap{
				"string": pulumi.String("string"),
			},
			Frequency: &elasticstack.KibanaSecurityDetectionRuleActionFrequencyArgs{
				NotifyWhen: pulumi.String("string"),
				Summary:    pulumi.Bool(false),
				Throttle:   pulumi.String("string"),
			},
			Group: pulumi.String("string"),
			Uuid:  pulumi.String("string"),
		},
	},
	AlertSuppression: &elasticstack.KibanaSecurityDetectionRuleAlertSuppressionArgs{
		Duration: pulumi.String("string"),
		GroupBies: pulumi.StringArray{
			pulumi.String("string"),
		},
		MissingFieldsStrategy: pulumi.String("string"),
	},
	AnomalyThreshold: pulumi.Float64(0),
	Authors: pulumi.StringArray{
		pulumi.String("string"),
	},
	BuildingBlockType:  pulumi.String("string"),
	ConcurrentSearches: pulumi.Float64(0),
	DataViewId:         pulumi.String("string"),
	Enabled:            pulumi.Bool(false),
	ExceptionsLists: elasticstack.KibanaSecurityDetectionRuleExceptionsListArray{
		&elasticstack.KibanaSecurityDetectionRuleExceptionsListArgs{
			Id:            pulumi.String("string"),
			ListId:        pulumi.String("string"),
			NamespaceType: pulumi.String("string"),
			Type:          pulumi.String("string"),
		},
	},
	FalsePositives: pulumi.StringArray{
		pulumi.String("string"),
	},
	Filters:            pulumi.String("string"),
	From:               pulumi.String("string"),
	HistoryWindowStart: pulumi.String("string"),
	Indices: pulumi.StringArray{
		pulumi.String("string"),
	},
	Interval: pulumi.String("string"),
	InvestigationFields: pulumi.StringArray{
		pulumi.String("string"),
	},
	ItemsPerSearch: pulumi.Float64(0),
	Language:       pulumi.String("string"),
	License:        pulumi.String("string"),
	MachineLearningJobIds: pulumi.StringArray{
		pulumi.String("string"),
	},
	MaxSignals: pulumi.Float64(0),
	Name:       pulumi.String("string"),
	Namespace:  pulumi.String("string"),
	NewTermsFields: pulumi.StringArray{
		pulumi.String("string"),
	},
	Note:  pulumi.String("string"),
	Query: pulumi.String("string"),
	References: pulumi.StringArray{
		pulumi.String("string"),
	},
	RelatedIntegrations: elasticstack.KibanaSecurityDetectionRuleRelatedIntegrationArray{
		&elasticstack.KibanaSecurityDetectionRuleRelatedIntegrationArgs{
			Package:     pulumi.String("string"),
			Version:     pulumi.String("string"),
			Integration: pulumi.String("string"),
		},
	},
	RequiredFields: elasticstack.KibanaSecurityDetectionRuleRequiredFieldArray{
		&elasticstack.KibanaSecurityDetectionRuleRequiredFieldArgs{
			Name: pulumi.String("string"),
			Type: pulumi.String("string"),
			Ecs:  pulumi.Bool(false),
		},
	},
	ResponseActions: elasticstack.KibanaSecurityDetectionRuleResponseActionArray{
		&elasticstack.KibanaSecurityDetectionRuleResponseActionArgs{
			ActionTypeId: pulumi.String("string"),
			Params: &elasticstack.KibanaSecurityDetectionRuleResponseActionParamsArgs{
				Command: pulumi.String("string"),
				Comment: pulumi.String("string"),
				Config: &elasticstack.KibanaSecurityDetectionRuleResponseActionParamsConfigArgs{
					Field:     pulumi.String("string"),
					Overwrite: pulumi.Bool(false),
				},
				EcsMapping: pulumi.StringMap{
					"string": pulumi.String("string"),
				},
				PackId: pulumi.String("string"),
				Queries: elasticstack.KibanaSecurityDetectionRuleResponseActionParamsQueryArray{
					&elasticstack.KibanaSecurityDetectionRuleResponseActionParamsQueryArgs{
						Id:    pulumi.String("string"),
						Query: pulumi.String("string"),
						EcsMapping: pulumi.StringMap{
							"string": pulumi.String("string"),
						},
						Platform: pulumi.String("string"),
						Removed:  pulumi.Bool(false),
						Snapshot: pulumi.Bool(false),
						Version:  pulumi.String("string"),
					},
				},
				Query:        pulumi.String("string"),
				SavedQueryId: pulumi.String("string"),
				Timeout:      pulumi.Float64(0),
			},
		},
	},
	RiskScore: pulumi.Float64(0),
	RiskScoreMappings: elasticstack.KibanaSecurityDetectionRuleRiskScoreMappingArray{
		&elasticstack.KibanaSecurityDetectionRuleRiskScoreMappingArgs{
			Field:     pulumi.String("string"),
			Operator:  pulumi.String("string"),
			Value:     pulumi.String("string"),
			RiskScore: pulumi.Float64(0),
		},
	},
	RuleId:           pulumi.String("string"),
	RuleNameOverride: pulumi.String("string"),
	SavedId:          pulumi.String("string"),
	Setup:            pulumi.String("string"),
	Severity:         pulumi.String("string"),
	SeverityMappings: elasticstack.KibanaSecurityDetectionRuleSeverityMappingArray{
		&elasticstack.KibanaSecurityDetectionRuleSeverityMappingArgs{
			Field:    pulumi.String("string"),
			Operator: pulumi.String("string"),
			Severity: pulumi.String("string"),
			Value:    pulumi.String("string"),
		},
	},
	SpaceId: pulumi.String("string"),
	Tags: pulumi.StringArray{
		pulumi.String("string"),
	},
	ThreatFilters: pulumi.StringArray{
		pulumi.String("string"),
	},
	ThreatIndicatorPath: pulumi.String("string"),
	ThreatIndices: pulumi.StringArray{
		pulumi.String("string"),
	},
	ThreatMappings: elasticstack.KibanaSecurityDetectionRuleThreatMappingArray{
		&elasticstack.KibanaSecurityDetectionRuleThreatMappingArgs{
			Entries: elasticstack.KibanaSecurityDetectionRuleThreatMappingEntryArray{
				&elasticstack.KibanaSecurityDetectionRuleThreatMappingEntryArgs{
					Field: pulumi.String("string"),
					Type:  pulumi.String("string"),
					Value: pulumi.String("string"),
				},
			},
		},
	},
	ThreatQuery: pulumi.String("string"),
	Threats: elasticstack.KibanaSecurityDetectionRuleThreatArray{
		&elasticstack.KibanaSecurityDetectionRuleThreatArgs{
			Framework: pulumi.String("string"),
			Tactic: &elasticstack.KibanaSecurityDetectionRuleThreatTacticArgs{
				Id:        pulumi.String("string"),
				Name:      pulumi.String("string"),
				Reference: pulumi.String("string"),
			},
			Techniques: elasticstack.KibanaSecurityDetectionRuleThreatTechniqueArray{
				&elasticstack.KibanaSecurityDetectionRuleThreatTechniqueArgs{
					Id:        pulumi.String("string"),
					Name:      pulumi.String("string"),
					Reference: pulumi.String("string"),
					Subtechniques: elasticstack.KibanaSecurityDetectionRuleThreatTechniqueSubtechniqueArray{
						&elasticstack.KibanaSecurityDetectionRuleThreatTechniqueSubtechniqueArgs{
							Id:        pulumi.String("string"),
							Name:      pulumi.String("string"),
							Reference: pulumi.String("string"),
						},
					},
				},
			},
		},
	},
	Threshold: &elasticstack.KibanaSecurityDetectionRuleThresholdArgs{
		Value: pulumi.Float64(0),
		Cardinalities: elasticstack.KibanaSecurityDetectionRuleThresholdCardinalityArray{
			&elasticstack.KibanaSecurityDetectionRuleThresholdCardinalityArgs{
				Field: pulumi.String("string"),
				Value: pulumi.Float64(0),
			},
		},
		Fields: pulumi.StringArray{
			pulumi.String("string"),
		},
	},
	TiebreakerField:                   pulumi.String("string"),
	TimelineId:                        pulumi.String("string"),
	TimelineTitle:                     pulumi.String("string"),
	TimestampOverride:                 pulumi.String("string"),
	TimestampOverrideFallbackDisabled: pulumi.Bool(false),
	To:                                pulumi.String("string"),
	Version:                           pulumi.Float64(0),
})

    var kibanaSecurityDetectionRuleResource = new KibanaSecurityDetectionRule("kibanaSecurityDetectionRuleResource", KibanaSecurityDetectionRuleArgs.builder()
    .description("string")
    .type("string")
    .actions(KibanaSecurityDetectionRuleActionArgs.builder()
        .actionTypeId("string")
        .id("string")
        .params(Map.of("string", "string"))
        .alertsFilter(Map.of("string", "string"))
        .frequency(KibanaSecurityDetectionRuleActionFrequencyArgs.builder()
            .notifyWhen("string")
            .summary(false)
            .throttle("string")
            .build())
        .group("string")
        .uuid("string")
        .build())
    .alertSuppression(KibanaSecurityDetectionRuleAlertSuppressionArgs.builder()
        .duration("string")
        .groupBies("string")
        .missingFieldsStrategy("string")
        .build())
    .anomalyThreshold(0.0)
    .authors("string")
    .buildingBlockType("string")
    .concurrentSearches(0.0)
    .dataViewId("string")
    .enabled(false)
    .exceptionsLists(KibanaSecurityDetectionRuleExceptionsListArgs.builder()
        .id("string")
        .listId("string")
        .namespaceType("string")
        .type("string")
        .build())
    .falsePositives("string")
    .filters("string")
    .from("string")
    .historyWindowStart("string")
    .indices("string")
    .interval("string")
    .investigationFields("string")
    .itemsPerSearch(0.0)
    .language("string")
    .license("string")
    .machineLearningJobIds("string")
    .maxSignals(0.0)
    .name("string")
    .namespace("string")
    .newTermsFields("string")
    .note("string")
    .query("string")
    .references("string")
    .relatedIntegrations(KibanaSecurityDetectionRuleRelatedIntegrationArgs.builder()
        .package_("string")
        .version("string")
        .integration("string")
        .build())
    .requiredFields(KibanaSecurityDetectionRuleRequiredFieldArgs.builder()
        .name("string")
        .type("string")
        .ecs(false)
        .build())
    .responseActions(KibanaSecurityDetectionRuleResponseActionArgs.builder()
        .actionTypeId("string")
        .params(KibanaSecurityDetectionRuleResponseActionParamsArgs.builder()
            .command("string")
            .comment("string")
            .config(KibanaSecurityDetectionRuleResponseActionParamsConfigArgs.builder()
                .field("string")
                .overwrite(false)
                .build())
            .ecsMapping(Map.of("string", "string"))
            .packId("string")
            .queries(KibanaSecurityDetectionRuleResponseActionParamsQueryArgs.builder()
                .id("string")
                .query("string")
                .ecsMapping(Map.of("string", "string"))
                .platform("string")
                .removed(false)
                .snapshot(false)
                .version("string")
                .build())
            .query("string")
            .savedQueryId("string")
            .timeout(0.0)
            .build())
        .build())
    .riskScore(0.0)
    .riskScoreMappings(KibanaSecurityDetectionRuleRiskScoreMappingArgs.builder()
        .field("string")
        .operator("string")
        .value("string")
        .riskScore(0.0)
        .build())
    .ruleId("string")
    .ruleNameOverride("string")
    .savedId("string")
    .setup("string")
    .severity("string")
    .severityMappings(KibanaSecurityDetectionRuleSeverityMappingArgs.builder()
        .field("string")
        .operator("string")
        .severity("string")
        .value("string")
        .build())
    .spaceId("string")
    .tags("string")
    .threatFilters("string")
    .threatIndicatorPath("string")
    .threatIndices("string")
    .threatMappings(KibanaSecurityDetectionRuleThreatMappingArgs.builder()
        .entries(KibanaSecurityDetectionRuleThreatMappingEntryArgs.builder()
            .field("string")
            .type("string")
            .value("string")
            .build())
        .build())
    .threatQuery("string")
    .threats(KibanaSecurityDetectionRuleThreatArgs.builder()
        .framework("string")
        .tactic(KibanaSecurityDetectionRuleThreatTacticArgs.builder()
            .id("string")
            .name("string")
            .reference("string")
            .build())
        .techniques(KibanaSecurityDetectionRuleThreatTechniqueArgs.builder()
            .id("string")
            .name("string")
            .reference("string")
            .subtechniques(KibanaSecurityDetectionRuleThreatTechniqueSubtechniqueArgs.builder()
                .id("string")
                .name("string")
                .reference("string")
                .build())
            .build())
        .build())
    .threshold(KibanaSecurityDetectionRuleThresholdArgs.builder()
        .value(0.0)
        .cardinalities(KibanaSecurityDetectionRuleThresholdCardinalityArgs.builder()
            .field("string")
            .value(0.0)
            .build())
        .fields("string")
        .build())
    .tiebreakerField("string")
    .timelineId("string")
    .timelineTitle("string")
    .timestampOverride("string")
    .timestampOverrideFallbackDisabled(false)
    .to("string")
    .version(0.0)
    .build());

    kibana_security_detection_rule_resource = elasticstack.KibanaSecurityDetectionRule("kibanaSecurityDetectionRuleResource",
    description="string",
    type="string",
    actions=[{
        "action_type_id": "string",
        "id": "string",
        "params": {
            "string": "string",
        },
        "alerts_filter": {
            "string": "string",
        },
        "frequency": {
            "notify_when": "string",
            "summary": False,
            "throttle": "string",
        },
        "group": "string",
        "uuid": "string",
    }],
    alert_suppression={
        "duration": "string",
        "group_bies": ["string"],
        "missing_fields_strategy": "string",
    },
    anomaly_threshold=0,
    authors=["string"],
    building_block_type="string",
    concurrent_searches=0,
    data_view_id="string",
    enabled=False,
    exceptions_lists=[{
        "id": "string",
        "list_id": "string",
        "namespace_type": "string",
        "type": "string",
    }],
    false_positives=["string"],
    filters="string",
    from_="string",
    history_window_start="string",
    indices=["string"],
    interval="string",
    investigation_fields=["string"],
    items_per_search=0,
    language="string",
    license="string",
    machine_learning_job_ids=["string"],
    max_signals=0,
    name="string",
    namespace="string",
    new_terms_fields=["string"],
    note="string",
    query="string",
    references=["string"],
    related_integrations=[{
        "package": "string",
        "version": "string",
        "integration": "string",
    }],
    required_fields=[{
        "name": "string",
        "type": "string",
        "ecs": False,
    }],
    response_actions=[{
        "action_type_id": "string",
        "params": {
            "command": "string",
            "comment": "string",
            "config": {
                "field": "string",
                "overwrite": False,
            },
            "ecs_mapping": {
                "string": "string",
            },
            "pack_id": "string",
            "queries": [{
                "id": "string",
                "query": "string",
                "ecs_mapping": {
                    "string": "string",
                },
                "platform": "string",
                "removed": False,
                "snapshot": False,
                "version": "string",
            }],
            "query": "string",
            "saved_query_id": "string",
            "timeout": 0,
        },
    }],
    risk_score=0,
    risk_score_mappings=[{
        "field": "string",
        "operator": "string",
        "value": "string",
        "risk_score": 0,
    }],
    rule_id="string",
    rule_name_override="string",
    saved_id="string",
    setup="string",
    severity="string",
    severity_mappings=[{
        "field": "string",
        "operator": "string",
        "severity": "string",
        "value": "string",
    }],
    space_id="string",
    tags=["string"],
    threat_filters=["string"],
    threat_indicator_path="string",
    threat_indices=["string"],
    threat_mappings=[{
        "entries": [{
            "field": "string",
            "type": "string",
            "value": "string",
        }],
    }],
    threat_query="string",
    threats=[{
        "framework": "string",
        "tactic": {
            "id": "string",
            "name": "string",
            "reference": "string",
        },
        "techniques": [{
            "id": "string",
            "name": "string",
            "reference": "string",
            "subtechniques": [{
                "id": "string",
                "name": "string",
                "reference": "string",
            }],
        }],
    }],
    threshold={
        "value": 0,
        "cardinalities": [{
            "field": "string",
            "value": 0,
        }],
        "fields": ["string"],
    },
    tiebreaker_field="string",
    timeline_id="string",
    timeline_title="string",
    timestamp_override="string",
    timestamp_override_fallback_disabled=False,
    to="string",
    version=0)

    const kibanaSecurityDetectionRuleResource = new elasticstack.KibanaSecurityDetectionRule("kibanaSecurityDetectionRuleResource", {
    description: "string",
    type: "string",
    actions: [{
        actionTypeId: "string",
        id: "string",
        params: {
            string: "string",
        },
        alertsFilter: {
            string: "string",
        },
        frequency: {
            notifyWhen: "string",
            summary: false,
            throttle: "string",
        },
        group: "string",
        uuid: "string",
    }],
    alertSuppression: {
        duration: "string",
        groupBies: ["string"],
        missingFieldsStrategy: "string",
    },
    anomalyThreshold: 0,
    authors: ["string"],
    buildingBlockType: "string",
    concurrentSearches: 0,
    dataViewId: "string",
    enabled: false,
    exceptionsLists: [{
        id: "string",
        listId: "string",
        namespaceType: "string",
        type: "string",
    }],
    falsePositives: ["string"],
    filters: "string",
    from: "string",
    historyWindowStart: "string",
    indices: ["string"],
    interval: "string",
    investigationFields: ["string"],
    itemsPerSearch: 0,
    language: "string",
    license: "string",
    machineLearningJobIds: ["string"],
    maxSignals: 0,
    name: "string",
    namespace: "string",
    newTermsFields: ["string"],
    note: "string",
    query: "string",
    references: ["string"],
    relatedIntegrations: [{
        "package": "string",
        version: "string",
        integration: "string",
    }],
    requiredFields: [{
        name: "string",
        type: "string",
        ecs: false,
    }],
    responseActions: [{
        actionTypeId: "string",
        params: {
            command: "string",
            comment: "string",
            config: {
                field: "string",
                overwrite: false,
            },
            ecsMapping: {
                string: "string",
            },
            packId: "string",
            queries: [{
                id: "string",
                query: "string",
                ecsMapping: {
                    string: "string",
                },
                platform: "string",
                removed: false,
                snapshot: false,
                version: "string",
            }],
            query: "string",
            savedQueryId: "string",
            timeout: 0,
        },
    }],
    riskScore: 0,
    riskScoreMappings: [{
        field: "string",
        operator: "string",
        value: "string",
        riskScore: 0,
    }],
    ruleId: "string",
    ruleNameOverride: "string",
    savedId: "string",
    setup: "string",
    severity: "string",
    severityMappings: [{
        field: "string",
        operator: "string",
        severity: "string",
        value: "string",
    }],
    spaceId: "string",
    tags: ["string"],
    threatFilters: ["string"],
    threatIndicatorPath: "string",
    threatIndices: ["string"],
    threatMappings: [{
        entries: [{
            field: "string",
            type: "string",
            value: "string",
        }],
    }],
    threatQuery: "string",
    threats: [{
        framework: "string",
        tactic: {
            id: "string",
            name: "string",
            reference: "string",
        },
        techniques: [{
            id: "string",
            name: "string",
            reference: "string",
            subtechniques: [{
                id: "string",
                name: "string",
                reference: "string",
            }],
        }],
    }],
    threshold: {
        value: 0,
        cardinalities: [{
            field: "string",
            value: 0,
        }],
        fields: ["string"],
    },
    tiebreakerField: "string",
    timelineId: "string",
    timelineTitle: "string",
    timestampOverride: "string",
    timestampOverrideFallbackDisabled: false,
    to: "string",
    version: 0,
});

    type: elasticstack:KibanaSecurityDetectionRule
properties:
    actions:
        - actionTypeId: string
          alertsFilter:
            string: string
          frequency:
            notifyWhen: string
            summary: false
            throttle: string
          group: string
          id: string
          params:
            string: string
          uuid: string
    alertSuppression:
        duration: string
        groupBies:
            - string
        missingFieldsStrategy: string
    anomalyThreshold: 0
    authors:
        - string
    buildingBlockType: string
    concurrentSearches: 0
    dataViewId: string
    description: string
    enabled: false
    exceptionsLists:
        - id: string
          listId: string
          namespaceType: string
          type: string
    falsePositives:
        - string
    filters: string
    from: string
    historyWindowStart: string
    indices:
        - string
    interval: string
    investigationFields:
        - string
    itemsPerSearch: 0
    language: string
    license: string
    machineLearningJobIds:
        - string
    maxSignals: 0
    name: string
    namespace: string
    newTermsFields:
        - string
    note: string
    query: string
    references:
        - string
    relatedIntegrations:
        - integration: string
          package: string
          version: string
    requiredFields:
        - ecs: false
          name: string
          type: string
    responseActions:
        - actionTypeId: string
          params:
            command: string
            comment: string
            config:
                field: string
                overwrite: false
            ecsMapping:
                string: string
            packId: string
            queries:
                - ecsMapping:
                    string: string
                  id: string
                  platform: string
                  query: string
                  removed: false
                  snapshot: false
                  version: string
            query: string
            savedQueryId: string
            timeout: 0
    riskScore: 0
    riskScoreMappings:
        - field: string
          operator: string
          riskScore: 0
          value: string
    ruleId: string
    ruleNameOverride: string
    savedId: string
    setup: string
    severity: string
    severityMappings:
        - field: string
          operator: string
          severity: string
          value: string
    spaceId: string
    tags:
        - string
    threatFilters:
        - string
    threatIndicatorPath: string
    threatIndices:
        - string
    threatMappings:
        - entries:
            - field: string
              type: string
              value: string
    threatQuery: string
    threats:
        - framework: string
          tactic:
            id: string
            name: string
            reference: string
          techniques:
            - id: string
              name: string
              reference: string
              subtechniques:
                - id: string
                  name: string
                  reference: string
    threshold:
        cardinalities:
            - field: string
              value: 0
        fields:
            - string
        value: 0
    tiebreakerField: string
    timelineId: string
    timelineTitle: string
    timestampOverride: string
    timestampOverrideFallbackDisabled: false
    to: string
    type: string
    version: 0

    KibanaSecurityDetectionRule Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The KibanaSecurityDetectionRule resource accepts the following input properties:

    Description string
    The rule's description.
    Type string
    Rule type. Supported types: query, eql, esql, machinelearning, newterms, savedquery, threatmatch, threshold.
    Actions List<KibanaSecurityDetectionRuleAction>
    Array of automated actions taken when alerts are generated by the rule.
    AlertSuppression KibanaSecurityDetectionRuleAlertSuppression
    Defines alert suppression configuration to reduce duplicate alerts.
    AnomalyThreshold double
    Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100. Required for machine_learning rules.
    Authors List<string>
    The rule's author.
    BuildingBlockType string
    Determines if the rule acts as a building block. If set, value must be default. Building-block alerts are not displayed in the UI by default and are used as a foundation for other rules.
    ConcurrentSearches double
    Number of concurrent searches for threat intelligence. Optional for threat_match rules.
    DataViewId string
    Data view ID for the rule. Not supported for esql and machine_learning rule types.
    Enabled bool
    Determines whether the rule is enabled.
    ExceptionsLists List<KibanaSecurityDetectionRuleExceptionsList>
    Array of exception containers to prevent the rule from generating alerts.
    FalsePositives List<string>
    String array used to describe common reasons why the rule may issue false-positive alerts.
    Filters string
    Query and filter context array to define alert conditions as JSON. Supports complex filter structures including bool queries, term filters, range filters, etc. Available for all rule types.
    From string
    Time from which data is analyzed each time the rule runs, using a date math range.
    HistoryWindowStart string
    Start date to use when checking if a term has been seen before. Supports relative dates like 'now-30d'. Required for new_terms rules.
    Indices List<string>
    Indices on which the rule functions.
    Interval string
    Frequency of rule execution, using a date math range.
    InvestigationFields List<string>
    Array of field names to include in alert investigation. Available for all rule types.
    ItemsPerSearch double
    Number of items to search for in each concurrent search. Optional for threat_match rules.
    Language string
    The query language (KQL or Lucene).
    License string
    The rule's license.
    MachineLearningJobIds List<string>
    Machine learning job ID(s) the rule monitors for anomaly scores. Required for machine_learning rules.
    MaxSignals double
    Maximum number of alerts the rule can create during a single run.
    Name string
    A human-readable name for the rule.
    Namespace string
    Alerts index namespace. Available for all rule types.
    NewTermsFields List<string>
    Field names containing the new terms. Required for new_terms rules.
    Note string
    Notes to help investigate alerts produced by the rule.
    Query string
    The query language definition.
    References List<string>
    String array containing references and URLs to sources of additional information.
    RelatedIntegrations List<KibanaSecurityDetectionRuleRelatedIntegration>
    Array of related integrations that provide additional context for the rule.
    RequiredFields List<KibanaSecurityDetectionRuleRequiredField>
    Array of Elasticsearch fields and types that must be present in source indices for the rule to function properly.
    ResponseActions List<KibanaSecurityDetectionRuleResponseAction>
    Array of response actions to take when alerts are generated by the rule.
    RiskScore double
    A numerical representation of the alert's severity from 0 to 100.
    RiskScoreMappings List<KibanaSecurityDetectionRuleRiskScoreMapping>
    Array of risk score mappings to override the default risk score based on source event field values.
    RuleId string
    A stable unique identifier for the rule object. If omitted, a UUID is generated.
    RuleNameOverride string
    Override the rule name in Kibana. Available for all rule types.
    SavedId string
    Identifier of the saved query used for the rule. Required for saved_query rules.
    Setup string
    Setup guide with instructions on rule prerequisites.
    Severity string
    Severity level of alerts produced by the rule.
    SeverityMappings List<KibanaSecurityDetectionRuleSeverityMapping>
    Array of severity mappings to override the default severity based on source event field values.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Tags List<string>
    String array containing words and phrases to help categorize, filter, and search rules.
    ThreatFilters List<string>
    Additional filters for threat intelligence data. Optional for threat_match rules.
    ThreatIndicatorPath string
    Path to the threat indicator in the indicator documents. Optional for threat_match rules.
    ThreatIndices List<string>
    Array of index patterns for the threat intelligence indices. Required for threat_match rules.
    ThreatMappings List<KibanaSecurityDetectionRuleThreatMapping>
    Array of threat mappings that specify how to match events with threat intelligence. Required for threat*match rules.
    ThreatQuery string
    Query used to filter threat intelligence data. Optional for threat_match rules.
    Threats List<KibanaSecurityDetectionRuleThreat>
    MITRE ATT&CK framework threat information.
    Threshold KibanaSecurityDetectionRuleThreshold
    Threshold settings for the rule. Required for threshold rules.
    TiebreakerField string
    Sets the tiebreaker field. Required for EQL rules when event.dataset is not provided.
    TimelineId string
    Timeline template ID for the rule.
    TimelineTitle string
    Timeline template title for the rule.
    TimestampOverride string
    Field name to use for timestamp override. Available for all rule types.
    TimestampOverrideFallbackDisabled bool
    Disables timestamp override fallback. Available for all rule types.
    To string
    Time to which data is analyzed each time the rule runs, using a date math range.
    Version double
    The rule's version number.
    Description string
    The rule's description.
    Type string
    Rule type. Supported types: query, eql, esql, machinelearning, newterms, savedquery, threatmatch, threshold.
    Actions []KibanaSecurityDetectionRuleActionArgs
    Array of automated actions taken when alerts are generated by the rule.
    AlertSuppression KibanaSecurityDetectionRuleAlertSuppressionArgs
    Defines alert suppression configuration to reduce duplicate alerts.
    AnomalyThreshold float64
    Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100. Required for machine_learning rules.
    Authors []string
    The rule's author.
    BuildingBlockType string
    Determines if the rule acts as a building block. If set, value must be default. Building-block alerts are not displayed in the UI by default and are used as a foundation for other rules.
    ConcurrentSearches float64
    Number of concurrent searches for threat intelligence. Optional for threat_match rules.
    DataViewId string
    Data view ID for the rule. Not supported for esql and machine_learning rule types.
    Enabled bool
    Determines whether the rule is enabled.
    ExceptionsLists []KibanaSecurityDetectionRuleExceptionsListArgs
    Array of exception containers to prevent the rule from generating alerts.
    FalsePositives []string
    String array used to describe common reasons why the rule may issue false-positive alerts.
    Filters string
    Query and filter context array to define alert conditions as JSON. Supports complex filter structures including bool queries, term filters, range filters, etc. Available for all rule types.
    From string
    Time from which data is analyzed each time the rule runs, using a date math range.
    HistoryWindowStart string
    Start date to use when checking if a term has been seen before. Supports relative dates like 'now-30d'. Required for new_terms rules.
    Indices []string
    Indices on which the rule functions.
    Interval string
    Frequency of rule execution, using a date math range.
    InvestigationFields []string
    Array of field names to include in alert investigation. Available for all rule types.
    ItemsPerSearch float64
    Number of items to search for in each concurrent search. Optional for threat_match rules.
    Language string
    The query language (KQL or Lucene).
    License string
    The rule's license.
    MachineLearningJobIds []string
    Machine learning job ID(s) the rule monitors for anomaly scores. Required for machine_learning rules.
    MaxSignals float64
    Maximum number of alerts the rule can create during a single run.
    Name string
    A human-readable name for the rule.
    Namespace string
    Alerts index namespace. Available for all rule types.
    NewTermsFields []string
    Field names containing the new terms. Required for new_terms rules.
    Note string
    Notes to help investigate alerts produced by the rule.
    Query string
    The query language definition.
    References []string
    String array containing references and URLs to sources of additional information.
    RelatedIntegrations []KibanaSecurityDetectionRuleRelatedIntegrationArgs
    Array of related integrations that provide additional context for the rule.
    RequiredFields []KibanaSecurityDetectionRuleRequiredFieldArgs
    Array of Elasticsearch fields and types that must be present in source indices for the rule to function properly.
    ResponseActions []KibanaSecurityDetectionRuleResponseActionArgs
    Array of response actions to take when alerts are generated by the rule.
    RiskScore float64
    A numerical representation of the alert's severity from 0 to 100.
    RiskScoreMappings []KibanaSecurityDetectionRuleRiskScoreMappingArgs
    Array of risk score mappings to override the default risk score based on source event field values.
    RuleId string
    A stable unique identifier for the rule object. If omitted, a UUID is generated.
    RuleNameOverride string
    Override the rule name in Kibana. Available for all rule types.
    SavedId string
    Identifier of the saved query used for the rule. Required for saved_query rules.
    Setup string
    Setup guide with instructions on rule prerequisites.
    Severity string
    Severity level of alerts produced by the rule.
    SeverityMappings []KibanaSecurityDetectionRuleSeverityMappingArgs
    Array of severity mappings to override the default severity based on source event field values.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Tags []string
    String array containing words and phrases to help categorize, filter, and search rules.
    ThreatFilters []string
    Additional filters for threat intelligence data. Optional for threat_match rules.
    ThreatIndicatorPath string
    Path to the threat indicator in the indicator documents. Optional for threat_match rules.
    ThreatIndices []string
    Array of index patterns for the threat intelligence indices. Required for threat_match rules.
    ThreatMappings []KibanaSecurityDetectionRuleThreatMappingArgs
    Array of threat mappings that specify how to match events with threat intelligence. Required for threat*match rules.
    ThreatQuery string
    Query used to filter threat intelligence data. Optional for threat_match rules.
    Threats []KibanaSecurityDetectionRuleThreatArgs
    MITRE ATT&CK framework threat information.
    Threshold KibanaSecurityDetectionRuleThresholdArgs
    Threshold settings for the rule. Required for threshold rules.
    TiebreakerField string
    Sets the tiebreaker field. Required for EQL rules when event.dataset is not provided.
    TimelineId string
    Timeline template ID for the rule.
    TimelineTitle string
    Timeline template title for the rule.
    TimestampOverride string
    Field name to use for timestamp override. Available for all rule types.
    TimestampOverrideFallbackDisabled bool
    Disables timestamp override fallback. Available for all rule types.
    To string
    Time to which data is analyzed each time the rule runs, using a date math range.
    Version float64
    The rule's version number.
    description String
    The rule's description.
    type String
    Rule type. Supported types: query, eql, esql, machinelearning, newterms, savedquery, threatmatch, threshold.
    actions List<KibanaSecurityDetectionRuleAction>
    Array of automated actions taken when alerts are generated by the rule.
    alertSuppression KibanaSecurityDetectionRuleAlertSuppression
    Defines alert suppression configuration to reduce duplicate alerts.
    anomalyThreshold Double
    Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100. Required for machine_learning rules.
    authors List<String>
    The rule's author.
    buildingBlockType String
    Determines if the rule acts as a building block. If set, value must be default. Building-block alerts are not displayed in the UI by default and are used as a foundation for other rules.
    concurrentSearches Double
    Number of concurrent searches for threat intelligence. Optional for threat_match rules.
    dataViewId String
    Data view ID for the rule. Not supported for esql and machine_learning rule types.
    enabled Boolean
    Determines whether the rule is enabled.
    exceptionsLists List<KibanaSecurityDetectionRuleExceptionsList>
    Array of exception containers to prevent the rule from generating alerts.
    falsePositives List<String>
    String array used to describe common reasons why the rule may issue false-positive alerts.
    filters String
    Query and filter context array to define alert conditions as JSON. Supports complex filter structures including bool queries, term filters, range filters, etc. Available for all rule types.
    from String
    Time from which data is analyzed each time the rule runs, using a date math range.
    historyWindowStart String
    Start date to use when checking if a term has been seen before. Supports relative dates like 'now-30d'. Required for new_terms rules.
    indices List<String>
    Indices on which the rule functions.
    interval String
    Frequency of rule execution, using a date math range.
    investigationFields List<String>
    Array of field names to include in alert investigation. Available for all rule types.
    itemsPerSearch Double
    Number of items to search for in each concurrent search. Optional for threat_match rules.
    language String
    The query language (KQL or Lucene).
    license String
    The rule's license.
    machineLearningJobIds List<String>
    Machine learning job ID(s) the rule monitors for anomaly scores. Required for machine_learning rules.
    maxSignals Double
    Maximum number of alerts the rule can create during a single run.
    name String
    A human-readable name for the rule.
    namespace String
    Alerts index namespace. Available for all rule types.
    newTermsFields List<String>
    Field names containing the new terms. Required for new_terms rules.
    note String
    Notes to help investigate alerts produced by the rule.
    query String
    The query language definition.
    references List<String>
    String array containing references and URLs to sources of additional information.
    relatedIntegrations List<KibanaSecurityDetectionRuleRelatedIntegration>
    Array of related integrations that provide additional context for the rule.
    requiredFields List<KibanaSecurityDetectionRuleRequiredField>
    Array of Elasticsearch fields and types that must be present in source indices for the rule to function properly.
    responseActions List<KibanaSecurityDetectionRuleResponseAction>
    Array of response actions to take when alerts are generated by the rule.
    riskScore Double
    A numerical representation of the alert's severity from 0 to 100.
    riskScoreMappings List<KibanaSecurityDetectionRuleRiskScoreMapping>
    Array of risk score mappings to override the default risk score based on source event field values.
    ruleId String
    A stable unique identifier for the rule object. If omitted, a UUID is generated.
    ruleNameOverride String
    Override the rule name in Kibana. Available for all rule types.
    savedId String
    Identifier of the saved query used for the rule. Required for saved_query rules.
    setup String
    Setup guide with instructions on rule prerequisites.
    severity String
    Severity level of alerts produced by the rule.
    severityMappings List<KibanaSecurityDetectionRuleSeverityMapping>
    Array of severity mappings to override the default severity based on source event field values.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    tags List<String>
    String array containing words and phrases to help categorize, filter, and search rules.
    threatFilters List<String>
    Additional filters for threat intelligence data. Optional for threat_match rules.
    threatIndicatorPath String
    Path to the threat indicator in the indicator documents. Optional for threat_match rules.
    threatIndices List<String>
    Array of index patterns for the threat intelligence indices. Required for threat_match rules.
    threatMappings List<KibanaSecurityDetectionRuleThreatMapping>
    Array of threat mappings that specify how to match events with threat intelligence. Required for threat*match rules.
    threatQuery String
    Query used to filter threat intelligence data. Optional for threat_match rules.
    threats List<KibanaSecurityDetectionRuleThreat>
    MITRE ATT&CK framework threat information.
    threshold KibanaSecurityDetectionRuleThreshold
    Threshold settings for the rule. Required for threshold rules.
    tiebreakerField String
    Sets the tiebreaker field. Required for EQL rules when event.dataset is not provided.
    timelineId String
    Timeline template ID for the rule.
    timelineTitle String
    Timeline template title for the rule.
    timestampOverride String
    Field name to use for timestamp override. Available for all rule types.
    timestampOverrideFallbackDisabled Boolean
    Disables timestamp override fallback. Available for all rule types.
    to String
    Time to which data is analyzed each time the rule runs, using a date math range.
    version Double
    The rule's version number.
    description string
    The rule's description.
    type string
    Rule type. Supported types: query, eql, esql, machinelearning, newterms, savedquery, threatmatch, threshold.
    actions KibanaSecurityDetectionRuleAction[]
    Array of automated actions taken when alerts are generated by the rule.
    alertSuppression KibanaSecurityDetectionRuleAlertSuppression
    Defines alert suppression configuration to reduce duplicate alerts.
    anomalyThreshold number
    Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100. Required for machine_learning rules.
    authors string[]
    The rule's author.
    buildingBlockType string
    Determines if the rule acts as a building block. If set, value must be default. Building-block alerts are not displayed in the UI by default and are used as a foundation for other rules.
    concurrentSearches number
    Number of concurrent searches for threat intelligence. Optional for threat_match rules.
    dataViewId string
    Data view ID for the rule. Not supported for esql and machine_learning rule types.
    enabled boolean
    Determines whether the rule is enabled.
    exceptionsLists KibanaSecurityDetectionRuleExceptionsList[]
    Array of exception containers to prevent the rule from generating alerts.
    falsePositives string[]
    String array used to describe common reasons why the rule may issue false-positive alerts.
    filters string
    Query and filter context array to define alert conditions as JSON. Supports complex filter structures including bool queries, term filters, range filters, etc. Available for all rule types.
    from string
    Time from which data is analyzed each time the rule runs, using a date math range.
    historyWindowStart string
    Start date to use when checking if a term has been seen before. Supports relative dates like 'now-30d'. Required for new_terms rules.
    indices string[]
    Indices on which the rule functions.
    interval string
    Frequency of rule execution, using a date math range.
    investigationFields string[]
    Array of field names to include in alert investigation. Available for all rule types.
    itemsPerSearch number
    Number of items to search for in each concurrent search. Optional for threat_match rules.
    language string
    The query language (KQL or Lucene).
    license string
    The rule's license.
    machineLearningJobIds string[]
    Machine learning job ID(s) the rule monitors for anomaly scores. Required for machine_learning rules.
    maxSignals number
    Maximum number of alerts the rule can create during a single run.
    name string
    A human-readable name for the rule.
    namespace string
    Alerts index namespace. Available for all rule types.
    newTermsFields string[]
    Field names containing the new terms. Required for new_terms rules.
    note string
    Notes to help investigate alerts produced by the rule.
    query string
    The query language definition.
    references string[]
    String array containing references and URLs to sources of additional information.
    relatedIntegrations KibanaSecurityDetectionRuleRelatedIntegration[]
    Array of related integrations that provide additional context for the rule.
    requiredFields KibanaSecurityDetectionRuleRequiredField[]
    Array of Elasticsearch fields and types that must be present in source indices for the rule to function properly.
    responseActions KibanaSecurityDetectionRuleResponseAction[]
    Array of response actions to take when alerts are generated by the rule.
    riskScore number
    A numerical representation of the alert's severity from 0 to 100.
    riskScoreMappings KibanaSecurityDetectionRuleRiskScoreMapping[]
    Array of risk score mappings to override the default risk score based on source event field values.
    ruleId string
    A stable unique identifier for the rule object. If omitted, a UUID is generated.
    ruleNameOverride string
    Override the rule name in Kibana. Available for all rule types.
    savedId string
    Identifier of the saved query used for the rule. Required for saved_query rules.
    setup string
    Setup guide with instructions on rule prerequisites.
    severity string
    Severity level of alerts produced by the rule.
    severityMappings KibanaSecurityDetectionRuleSeverityMapping[]
    Array of severity mappings to override the default severity based on source event field values.
    spaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    tags string[]
    String array containing words and phrases to help categorize, filter, and search rules.
    threatFilters string[]
    Additional filters for threat intelligence data. Optional for threat_match rules.
    threatIndicatorPath string
    Path to the threat indicator in the indicator documents. Optional for threat_match rules.
    threatIndices string[]
    Array of index patterns for the threat intelligence indices. Required for threat_match rules.
    threatMappings KibanaSecurityDetectionRuleThreatMapping[]
    Array of threat mappings that specify how to match events with threat intelligence. Required for threat*match rules.
    threatQuery string
    Query used to filter threat intelligence data. Optional for threat_match rules.
    threats KibanaSecurityDetectionRuleThreat[]
    MITRE ATT&CK framework threat information.
    threshold KibanaSecurityDetectionRuleThreshold
    Threshold settings for the rule. Required for threshold rules.
    tiebreakerField string
    Sets the tiebreaker field. Required for EQL rules when event.dataset is not provided.
    timelineId string
    Timeline template ID for the rule.
    timelineTitle string
    Timeline template title for the rule.
    timestampOverride string
    Field name to use for timestamp override. Available for all rule types.
    timestampOverrideFallbackDisabled boolean
    Disables timestamp override fallback. Available for all rule types.
    to string
    Time to which data is analyzed each time the rule runs, using a date math range.
    version number
    The rule's version number.
    description str
    The rule's description.
    type str
    Rule type. Supported types: query, eql, esql, machinelearning, newterms, savedquery, threatmatch, threshold.
    actions Sequence[KibanaSecurityDetectionRuleActionArgs]
    Array of automated actions taken when alerts are generated by the rule.
    alert_suppression KibanaSecurityDetectionRuleAlertSuppressionArgs
    Defines alert suppression configuration to reduce duplicate alerts.
    anomaly_threshold float
    Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100. Required for machine_learning rules.
    authors Sequence[str]
    The rule's author.
    building_block_type str
    Determines if the rule acts as a building block. If set, value must be default. Building-block alerts are not displayed in the UI by default and are used as a foundation for other rules.
    concurrent_searches float
    Number of concurrent searches for threat intelligence. Optional for threat_match rules.
    data_view_id str
    Data view ID for the rule. Not supported for esql and machine_learning rule types.
    enabled bool
    Determines whether the rule is enabled.
    exceptions_lists Sequence[KibanaSecurityDetectionRuleExceptionsListArgs]
    Array of exception containers to prevent the rule from generating alerts.
    false_positives Sequence[str]
    String array used to describe common reasons why the rule may issue false-positive alerts.
    filters str
    Query and filter context array to define alert conditions as JSON. Supports complex filter structures including bool queries, term filters, range filters, etc. Available for all rule types.
    from_ str
    Time from which data is analyzed each time the rule runs, using a date math range.
    history_window_start str
    Start date to use when checking if a term has been seen before. Supports relative dates like 'now-30d'. Required for new_terms rules.
    indices Sequence[str]
    Indices on which the rule functions.
    interval str
    Frequency of rule execution, using a date math range.
    investigation_fields Sequence[str]
    Array of field names to include in alert investigation. Available for all rule types.
    items_per_search float
    Number of items to search for in each concurrent search. Optional for threat_match rules.
    language str
    The query language (KQL or Lucene).
    license str
    The rule's license.
    machine_learning_job_ids Sequence[str]
    Machine learning job ID(s) the rule monitors for anomaly scores. Required for machine_learning rules.
    max_signals float
    Maximum number of alerts the rule can create during a single run.
    name str
    A human-readable name for the rule.
    namespace str
    Alerts index namespace. Available for all rule types.
    new_terms_fields Sequence[str]
    Field names containing the new terms. Required for new_terms rules.
    note str
    Notes to help investigate alerts produced by the rule.
    query str
    The query language definition.
    references Sequence[str]
    String array containing references and URLs to sources of additional information.
    related_integrations Sequence[KibanaSecurityDetectionRuleRelatedIntegrationArgs]
    Array of related integrations that provide additional context for the rule.
    required_fields Sequence[KibanaSecurityDetectionRuleRequiredFieldArgs]
    Array of Elasticsearch fields and types that must be present in source indices for the rule to function properly.
    response_actions Sequence[KibanaSecurityDetectionRuleResponseActionArgs]
    Array of response actions to take when alerts are generated by the rule.
    risk_score float
    A numerical representation of the alert's severity from 0 to 100.
    risk_score_mappings Sequence[KibanaSecurityDetectionRuleRiskScoreMappingArgs]
    Array of risk score mappings to override the default risk score based on source event field values.
    rule_id str
    A stable unique identifier for the rule object. If omitted, a UUID is generated.
    rule_name_override str
    Override the rule name in Kibana. Available for all rule types.
    saved_id str
    Identifier of the saved query used for the rule. Required for saved_query rules.
    setup str
    Setup guide with instructions on rule prerequisites.
    severity str
    Severity level of alerts produced by the rule.
    severity_mappings Sequence[KibanaSecurityDetectionRuleSeverityMappingArgs]
    Array of severity mappings to override the default severity based on source event field values.
    space_id str
    An identifier for the space. If space_id is not provided, the default space is used.
    tags Sequence[str]
    String array containing words and phrases to help categorize, filter, and search rules.
    threat_filters Sequence[str]
    Additional filters for threat intelligence data. Optional for threat_match rules.
    threat_indicator_path str
    Path to the threat indicator in the indicator documents. Optional for threat_match rules.
    threat_indices Sequence[str]
    Array of index patterns for the threat intelligence indices. Required for threat_match rules.
    threat_mappings Sequence[KibanaSecurityDetectionRuleThreatMappingArgs]
    Array of threat mappings that specify how to match events with threat intelligence. Required for threat*match rules.
    threat_query str
    Query used to filter threat intelligence data. Optional for threat_match rules.
    threats Sequence[KibanaSecurityDetectionRuleThreatArgs]
    MITRE ATT&CK framework threat information.
    threshold KibanaSecurityDetectionRuleThresholdArgs
    Threshold settings for the rule. Required for threshold rules.
    tiebreaker_field str
    Sets the tiebreaker field. Required for EQL rules when event.dataset is not provided.
    timeline_id str
    Timeline template ID for the rule.
    timeline_title str
    Timeline template title for the rule.
    timestamp_override str
    Field name to use for timestamp override. Available for all rule types.
    timestamp_override_fallback_disabled bool
    Disables timestamp override fallback. Available for all rule types.
    to str
    Time to which data is analyzed each time the rule runs, using a date math range.
    version float
    The rule's version number.
    description String
    The rule's description.
    type String
    Rule type. Supported types: query, eql, esql, machinelearning, newterms, savedquery, threatmatch, threshold.
    actions List<Property Map>
    Array of automated actions taken when alerts are generated by the rule.
    alertSuppression Property Map
    Defines alert suppression configuration to reduce duplicate alerts.
    anomalyThreshold Number
    Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100. Required for machine_learning rules.
    authors List<String>
    The rule's author.
    buildingBlockType String
    Determines if the rule acts as a building block. If set, value must be default. Building-block alerts are not displayed in the UI by default and are used as a foundation for other rules.
    concurrentSearches Number
    Number of concurrent searches for threat intelligence. Optional for threat_match rules.
    dataViewId String
    Data view ID for the rule. Not supported for esql and machine_learning rule types.
    enabled Boolean
    Determines whether the rule is enabled.
    exceptionsLists List<Property Map>
    Array of exception containers to prevent the rule from generating alerts.
    falsePositives List<String>
    String array used to describe common reasons why the rule may issue false-positive alerts.
    filters String
    Query and filter context array to define alert conditions as JSON. Supports complex filter structures including bool queries, term filters, range filters, etc. Available for all rule types.
    from String
    Time from which data is analyzed each time the rule runs, using a date math range.
    historyWindowStart String
    Start date to use when checking if a term has been seen before. Supports relative dates like 'now-30d'. Required for new_terms rules.
    indices List<String>
    Indices on which the rule functions.
    interval String
    Frequency of rule execution, using a date math range.
    investigationFields List<String>
    Array of field names to include in alert investigation. Available for all rule types.
    itemsPerSearch Number
    Number of items to search for in each concurrent search. Optional for threat_match rules.
    language String
    The query language (KQL or Lucene).
    license String
    The rule's license.
    machineLearningJobIds List<String>
    Machine learning job ID(s) the rule monitors for anomaly scores. Required for machine_learning rules.
    maxSignals Number
    Maximum number of alerts the rule can create during a single run.
    name String
    A human-readable name for the rule.
    namespace String
    Alerts index namespace. Available for all rule types.
    newTermsFields List<String>
    Field names containing the new terms. Required for new_terms rules.
    note String
    Notes to help investigate alerts produced by the rule.
    query String
    The query language definition.
    references List<String>
    String array containing references and URLs to sources of additional information.
    relatedIntegrations List<Property Map>
    Array of related integrations that provide additional context for the rule.
    requiredFields List<Property Map>
    Array of Elasticsearch fields and types that must be present in source indices for the rule to function properly.
    responseActions List<Property Map>
    Array of response actions to take when alerts are generated by the rule.
    riskScore Number
    A numerical representation of the alert's severity from 0 to 100.
    riskScoreMappings List<Property Map>
    Array of risk score mappings to override the default risk score based on source event field values.
    ruleId String
    A stable unique identifier for the rule object. If omitted, a UUID is generated.
    ruleNameOverride String
    Override the rule name in Kibana. Available for all rule types.
    savedId String
    Identifier of the saved query used for the rule. Required for saved_query rules.
    setup String
    Setup guide with instructions on rule prerequisites.
    severity String
    Severity level of alerts produced by the rule.
    severityMappings List<Property Map>
    Array of severity mappings to override the default severity based on source event field values.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    tags List<String>
    String array containing words and phrases to help categorize, filter, and search rules.
    threatFilters List<String>
    Additional filters for threat intelligence data. Optional for threat_match rules.
    threatIndicatorPath String
    Path to the threat indicator in the indicator documents. Optional for threat_match rules.
    threatIndices List<String>
    Array of index patterns for the threat intelligence indices. Required for threat_match rules.
    threatMappings List<Property Map>
    Array of threat mappings that specify how to match events with threat intelligence. Required for threat*match rules.
    threatQuery String
    Query used to filter threat intelligence data. Optional for threat_match rules.
    threats List<Property Map>
    MITRE ATT&CK framework threat information.
    threshold Property Map
    Threshold settings for the rule. Required for threshold rules.
    tiebreakerField String
    Sets the tiebreaker field. Required for EQL rules when event.dataset is not provided.
    timelineId String
    Timeline template ID for the rule.
    timelineTitle String
    Timeline template title for the rule.
    timestampOverride String
    Field name to use for timestamp override. Available for all rule types.
    timestampOverrideFallbackDisabled Boolean
    Disables timestamp override fallback. Available for all rule types.
    to String
    Time to which data is analyzed each time the rule runs, using a date math range.
    version Number
    The rule's version number.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the KibanaSecurityDetectionRule resource produces the following output properties:

    CreatedAt string
    The time the rule was created.
    CreatedBy string
    The user who created the rule.
    Id string
    The provider-assigned unique ID for this managed resource.
    Revision double
    The rule's revision number.
    UpdatedAt string
    The time the rule was last updated.
    UpdatedBy string
    The user who last updated the rule.
    CreatedAt string
    The time the rule was created.
    CreatedBy string
    The user who created the rule.
    Id string
    The provider-assigned unique ID for this managed resource.
    Revision float64
    The rule's revision number.
    UpdatedAt string
    The time the rule was last updated.
    UpdatedBy string
    The user who last updated the rule.
    createdAt String
    The time the rule was created.
    createdBy String
    The user who created the rule.
    id String
    The provider-assigned unique ID for this managed resource.
    revision Double
    The rule's revision number.
    updatedAt String
    The time the rule was last updated.
    updatedBy String
    The user who last updated the rule.
    createdAt string
    The time the rule was created.
    createdBy string
    The user who created the rule.
    id string
    The provider-assigned unique ID for this managed resource.
    revision number
    The rule's revision number.
    updatedAt string
    The time the rule was last updated.
    updatedBy string
    The user who last updated the rule.
    created_at str
    The time the rule was created.
    created_by str
    The user who created the rule.
    id str
    The provider-assigned unique ID for this managed resource.
    revision float
    The rule's revision number.
    updated_at str
    The time the rule was last updated.
    updated_by str
    The user who last updated the rule.
    createdAt String
    The time the rule was created.
    createdBy String
    The user who created the rule.
    id String
    The provider-assigned unique ID for this managed resource.
    revision Number
    The rule's revision number.
    updatedAt String
    The time the rule was last updated.
    updatedBy String
    The user who last updated the rule.

    Look up Existing KibanaSecurityDetectionRule Resource

    Get an existing KibanaSecurityDetectionRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: KibanaSecurityDetectionRuleState, opts?: CustomResourceOptions): KibanaSecurityDetectionRule
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        actions: Optional[Sequence[KibanaSecurityDetectionRuleActionArgs]] = None,
        alert_suppression: Optional[KibanaSecurityDetectionRuleAlertSuppressionArgs] = None,
        anomaly_threshold: Optional[float] = None,
        authors: Optional[Sequence[str]] = None,
        building_block_type: Optional[str] = None,
        concurrent_searches: Optional[float] = None,
        created_at: Optional[str] = None,
        created_by: Optional[str] = None,
        data_view_id: Optional[str] = None,
        description: Optional[str] = None,
        enabled: Optional[bool] = None,
        exceptions_lists: Optional[Sequence[KibanaSecurityDetectionRuleExceptionsListArgs]] = None,
        false_positives: Optional[Sequence[str]] = None,
        filters: Optional[str] = None,
        from_: Optional[str] = None,
        history_window_start: Optional[str] = None,
        indices: Optional[Sequence[str]] = None,
        interval: Optional[str] = None,
        investigation_fields: Optional[Sequence[str]] = None,
        items_per_search: Optional[float] = None,
        language: Optional[str] = None,
        license: Optional[str] = None,
        machine_learning_job_ids: Optional[Sequence[str]] = None,
        max_signals: Optional[float] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None,
        new_terms_fields: Optional[Sequence[str]] = None,
        note: Optional[str] = None,
        query: Optional[str] = None,
        references: Optional[Sequence[str]] = None,
        related_integrations: Optional[Sequence[KibanaSecurityDetectionRuleRelatedIntegrationArgs]] = None,
        required_fields: Optional[Sequence[KibanaSecurityDetectionRuleRequiredFieldArgs]] = None,
        response_actions: Optional[Sequence[KibanaSecurityDetectionRuleResponseActionArgs]] = None,
        revision: Optional[float] = None,
        risk_score: Optional[float] = None,
        risk_score_mappings: Optional[Sequence[KibanaSecurityDetectionRuleRiskScoreMappingArgs]] = None,
        rule_id: Optional[str] = None,
        rule_name_override: Optional[str] = None,
        saved_id: Optional[str] = None,
        setup: Optional[str] = None,
        severity: Optional[str] = None,
        severity_mappings: Optional[Sequence[KibanaSecurityDetectionRuleSeverityMappingArgs]] = None,
        space_id: Optional[str] = None,
        tags: Optional[Sequence[str]] = None,
        threat_filters: Optional[Sequence[str]] = None,
        threat_indicator_path: Optional[str] = None,
        threat_indices: Optional[Sequence[str]] = None,
        threat_mappings: Optional[Sequence[KibanaSecurityDetectionRuleThreatMappingArgs]] = None,
        threat_query: Optional[str] = None,
        threats: Optional[Sequence[KibanaSecurityDetectionRuleThreatArgs]] = None,
        threshold: Optional[KibanaSecurityDetectionRuleThresholdArgs] = None,
        tiebreaker_field: Optional[str] = None,
        timeline_id: Optional[str] = None,
        timeline_title: Optional[str] = None,
        timestamp_override: Optional[str] = None,
        timestamp_override_fallback_disabled: Optional[bool] = None,
        to: Optional[str] = None,
        type: Optional[str] = None,
        updated_at: Optional[str] = None,
        updated_by: Optional[str] = None,
        version: Optional[float] = None) -> KibanaSecurityDetectionRule
    func GetKibanaSecurityDetectionRule(ctx *Context, name string, id IDInput, state *KibanaSecurityDetectionRuleState, opts ...ResourceOption) (*KibanaSecurityDetectionRule, error)
    public static KibanaSecurityDetectionRule Get(string name, Input<string> id, KibanaSecurityDetectionRuleState? state, CustomResourceOptions? opts = null)
    public static KibanaSecurityDetectionRule get(String name, Output<String> id, KibanaSecurityDetectionRuleState state, CustomResourceOptions options)
    resources:  _:    type: elasticstack:KibanaSecurityDetectionRule    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Actions List<KibanaSecurityDetectionRuleAction>
    Array of automated actions taken when alerts are generated by the rule.
    AlertSuppression KibanaSecurityDetectionRuleAlertSuppression
    Defines alert suppression configuration to reduce duplicate alerts.
    AnomalyThreshold double
    Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100. Required for machine_learning rules.
    Authors List<string>
    The rule's author.
    BuildingBlockType string
    Determines if the rule acts as a building block. If set, value must be default. Building-block alerts are not displayed in the UI by default and are used as a foundation for other rules.
    ConcurrentSearches double
    Number of concurrent searches for threat intelligence. Optional for threat_match rules.
    CreatedAt string
    The time the rule was created.
    CreatedBy string
    The user who created the rule.
    DataViewId string
    Data view ID for the rule. Not supported for esql and machine_learning rule types.
    Description string
    The rule's description.
    Enabled bool
    Determines whether the rule is enabled.
    ExceptionsLists List<KibanaSecurityDetectionRuleExceptionsList>
    Array of exception containers to prevent the rule from generating alerts.
    FalsePositives List<string>
    String array used to describe common reasons why the rule may issue false-positive alerts.
    Filters string
    Query and filter context array to define alert conditions as JSON. Supports complex filter structures including bool queries, term filters, range filters, etc. Available for all rule types.
    From string
    Time from which data is analyzed each time the rule runs, using a date math range.
    HistoryWindowStart string
    Start date to use when checking if a term has been seen before. Supports relative dates like 'now-30d'. Required for new_terms rules.
    Indices List<string>
    Indices on which the rule functions.
    Interval string
    Frequency of rule execution, using a date math range.
    InvestigationFields List<string>
    Array of field names to include in alert investigation. Available for all rule types.
    ItemsPerSearch double
    Number of items to search for in each concurrent search. Optional for threat_match rules.
    Language string
    The query language (KQL or Lucene).
    License string
    The rule's license.
    MachineLearningJobIds List<string>
    Machine learning job ID(s) the rule monitors for anomaly scores. Required for machine_learning rules.
    MaxSignals double
    Maximum number of alerts the rule can create during a single run.
    Name string
    A human-readable name for the rule.
    Namespace string
    Alerts index namespace. Available for all rule types.
    NewTermsFields List<string>
    Field names containing the new terms. Required for new_terms rules.
    Note string
    Notes to help investigate alerts produced by the rule.
    Query string
    The query language definition.
    References List<string>
    String array containing references and URLs to sources of additional information.
    RelatedIntegrations List<KibanaSecurityDetectionRuleRelatedIntegration>
    Array of related integrations that provide additional context for the rule.
    RequiredFields List<KibanaSecurityDetectionRuleRequiredField>
    Array of Elasticsearch fields and types that must be present in source indices for the rule to function properly.
    ResponseActions List<KibanaSecurityDetectionRuleResponseAction>
    Array of response actions to take when alerts are generated by the rule.
    Revision double
    The rule's revision number.
    RiskScore double
    A numerical representation of the alert's severity from 0 to 100.
    RiskScoreMappings List<KibanaSecurityDetectionRuleRiskScoreMapping>
    Array of risk score mappings to override the default risk score based on source event field values.
    RuleId string
    A stable unique identifier for the rule object. If omitted, a UUID is generated.
    RuleNameOverride string
    Override the rule name in Kibana. Available for all rule types.
    SavedId string
    Identifier of the saved query used for the rule. Required for saved_query rules.
    Setup string
    Setup guide with instructions on rule prerequisites.
    Severity string
    Severity level of alerts produced by the rule.
    SeverityMappings List<KibanaSecurityDetectionRuleSeverityMapping>
    Array of severity mappings to override the default severity based on source event field values.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Tags List<string>
    String array containing words and phrases to help categorize, filter, and search rules.
    ThreatFilters List<string>
    Additional filters for threat intelligence data. Optional for threat_match rules.
    ThreatIndicatorPath string
    Path to the threat indicator in the indicator documents. Optional for threat_match rules.
    ThreatIndices List<string>
    Array of index patterns for the threat intelligence indices. Required for threat_match rules.
    ThreatMappings List<KibanaSecurityDetectionRuleThreatMapping>
    Array of threat mappings that specify how to match events with threat intelligence. Required for threat*match rules.
    ThreatQuery string
    Query used to filter threat intelligence data. Optional for threat_match rules.
    Threats List<KibanaSecurityDetectionRuleThreat>
    MITRE ATT&CK framework threat information.
    Threshold KibanaSecurityDetectionRuleThreshold
    Threshold settings for the rule. Required for threshold rules.
    TiebreakerField string
    Sets the tiebreaker field. Required for EQL rules when event.dataset is not provided.
    TimelineId string
    Timeline template ID for the rule.
    TimelineTitle string
    Timeline template title for the rule.
    TimestampOverride string
    Field name to use for timestamp override. Available for all rule types.
    TimestampOverrideFallbackDisabled bool
    Disables timestamp override fallback. Available for all rule types.
    To string
    Time to which data is analyzed each time the rule runs, using a date math range.
    Type string
    Rule type. Supported types: query, eql, esql, machinelearning, newterms, savedquery, threatmatch, threshold.
    UpdatedAt string
    The time the rule was last updated.
    UpdatedBy string
    The user who last updated the rule.
    Version double
    The rule's version number.
    Actions []KibanaSecurityDetectionRuleActionArgs
    Array of automated actions taken when alerts are generated by the rule.
    AlertSuppression KibanaSecurityDetectionRuleAlertSuppressionArgs
    Defines alert suppression configuration to reduce duplicate alerts.
    AnomalyThreshold float64
    Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100. Required for machine_learning rules.
    Authors []string
    The rule's author.
    BuildingBlockType string
    Determines if the rule acts as a building block. If set, value must be default. Building-block alerts are not displayed in the UI by default and are used as a foundation for other rules.
    ConcurrentSearches float64
    Number of concurrent searches for threat intelligence. Optional for threat_match rules.
    CreatedAt string
    The time the rule was created.
    CreatedBy string
    The user who created the rule.
    DataViewId string
    Data view ID for the rule. Not supported for esql and machine_learning rule types.
    Description string
    The rule's description.
    Enabled bool
    Determines whether the rule is enabled.
    ExceptionsLists []KibanaSecurityDetectionRuleExceptionsListArgs
    Array of exception containers to prevent the rule from generating alerts.
    FalsePositives []string
    String array used to describe common reasons why the rule may issue false-positive alerts.
    Filters string
    Query and filter context array to define alert conditions as JSON. Supports complex filter structures including bool queries, term filters, range filters, etc. Available for all rule types.
    From string
    Time from which data is analyzed each time the rule runs, using a date math range.
    HistoryWindowStart string
    Start date to use when checking if a term has been seen before. Supports relative dates like 'now-30d'. Required for new_terms rules.
    Indices []string
    Indices on which the rule functions.
    Interval string
    Frequency of rule execution, using a date math range.
    InvestigationFields []string
    Array of field names to include in alert investigation. Available for all rule types.
    ItemsPerSearch float64
    Number of items to search for in each concurrent search. Optional for threat_match rules.
    Language string
    The query language (KQL or Lucene).
    License string
    The rule's license.
    MachineLearningJobIds []string
    Machine learning job ID(s) the rule monitors for anomaly scores. Required for machine_learning rules.
    MaxSignals float64
    Maximum number of alerts the rule can create during a single run.
    Name string
    A human-readable name for the rule.
    Namespace string
    Alerts index namespace. Available for all rule types.
    NewTermsFields []string
    Field names containing the new terms. Required for new_terms rules.
    Note string
    Notes to help investigate alerts produced by the rule.
    Query string
    The query language definition.
    References []string
    String array containing references and URLs to sources of additional information.
    RelatedIntegrations []KibanaSecurityDetectionRuleRelatedIntegrationArgs
    Array of related integrations that provide additional context for the rule.
    RequiredFields []KibanaSecurityDetectionRuleRequiredFieldArgs
    Array of Elasticsearch fields and types that must be present in source indices for the rule to function properly.
    ResponseActions []KibanaSecurityDetectionRuleResponseActionArgs
    Array of response actions to take when alerts are generated by the rule.
    Revision float64
    The rule's revision number.
    RiskScore float64
    A numerical representation of the alert's severity from 0 to 100.
    RiskScoreMappings []KibanaSecurityDetectionRuleRiskScoreMappingArgs
    Array of risk score mappings to override the default risk score based on source event field values.
    RuleId string
    A stable unique identifier for the rule object. If omitted, a UUID is generated.
    RuleNameOverride string
    Override the rule name in Kibana. Available for all rule types.
    SavedId string
    Identifier of the saved query used for the rule. Required for saved_query rules.
    Setup string
    Setup guide with instructions on rule prerequisites.
    Severity string
    Severity level of alerts produced by the rule.
    SeverityMappings []KibanaSecurityDetectionRuleSeverityMappingArgs
    Array of severity mappings to override the default severity based on source event field values.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Tags []string
    String array containing words and phrases to help categorize, filter, and search rules.
    ThreatFilters []string
    Additional filters for threat intelligence data. Optional for threat_match rules.
    ThreatIndicatorPath string
    Path to the threat indicator in the indicator documents. Optional for threat_match rules.
    ThreatIndices []string
    Array of index patterns for the threat intelligence indices. Required for threat_match rules.
    ThreatMappings []KibanaSecurityDetectionRuleThreatMappingArgs
    Array of threat mappings that specify how to match events with threat intelligence. Required for threat*match rules.
    ThreatQuery string
    Query used to filter threat intelligence data. Optional for threat_match rules.
    Threats []KibanaSecurityDetectionRuleThreatArgs
    MITRE ATT&CK framework threat information.
    Threshold KibanaSecurityDetectionRuleThresholdArgs
    Threshold settings for the rule. Required for threshold rules.
    TiebreakerField string
    Sets the tiebreaker field. Required for EQL rules when event.dataset is not provided.
    TimelineId string
    Timeline template ID for the rule.
    TimelineTitle string
    Timeline template title for the rule.
    TimestampOverride string
    Field name to use for timestamp override. Available for all rule types.
    TimestampOverrideFallbackDisabled bool
    Disables timestamp override fallback. Available for all rule types.
    To string
    Time to which data is analyzed each time the rule runs, using a date math range.
    Type string
    Rule type. Supported types: query, eql, esql, machinelearning, newterms, savedquery, threatmatch, threshold.
    UpdatedAt string
    The time the rule was last updated.
    UpdatedBy string
    The user who last updated the rule.
    Version float64
    The rule's version number.
    actions List<KibanaSecurityDetectionRuleAction>
    Array of automated actions taken when alerts are generated by the rule.
    alertSuppression KibanaSecurityDetectionRuleAlertSuppression
    Defines alert suppression configuration to reduce duplicate alerts.
    anomalyThreshold Double
    Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100. Required for machine_learning rules.
    authors List<String>
    The rule's author.
    buildingBlockType String
    Determines if the rule acts as a building block. If set, value must be default. Building-block alerts are not displayed in the UI by default and are used as a foundation for other rules.
    concurrentSearches Double
    Number of concurrent searches for threat intelligence. Optional for threat_match rules.
    createdAt String
    The time the rule was created.
    createdBy String
    The user who created the rule.
    dataViewId String
    Data view ID for the rule. Not supported for esql and machine_learning rule types.
    description String
    The rule's description.
    enabled Boolean
    Determines whether the rule is enabled.
    exceptionsLists List<KibanaSecurityDetectionRuleExceptionsList>
    Array of exception containers to prevent the rule from generating alerts.
    falsePositives List<String>
    String array used to describe common reasons why the rule may issue false-positive alerts.
    filters String
    Query and filter context array to define alert conditions as JSON. Supports complex filter structures including bool queries, term filters, range filters, etc. Available for all rule types.
    from String
    Time from which data is analyzed each time the rule runs, using a date math range.
    historyWindowStart String
    Start date to use when checking if a term has been seen before. Supports relative dates like 'now-30d'. Required for new_terms rules.
    indices List<String>
    Indices on which the rule functions.
    interval String
    Frequency of rule execution, using a date math range.
    investigationFields List<String>
    Array of field names to include in alert investigation. Available for all rule types.
    itemsPerSearch Double
    Number of items to search for in each concurrent search. Optional for threat_match rules.
    language String
    The query language (KQL or Lucene).
    license String
    The rule's license.
    machineLearningJobIds List<String>
    Machine learning job ID(s) the rule monitors for anomaly scores. Required for machine_learning rules.
    maxSignals Double
    Maximum number of alerts the rule can create during a single run.
    name String
    A human-readable name for the rule.
    namespace String
    Alerts index namespace. Available for all rule types.
    newTermsFields List<String>
    Field names containing the new terms. Required for new_terms rules.
    note String
    Notes to help investigate alerts produced by the rule.
    query String
    The query language definition.
    references List<String>
    String array containing references and URLs to sources of additional information.
    relatedIntegrations List<KibanaSecurityDetectionRuleRelatedIntegration>
    Array of related integrations that provide additional context for the rule.
    requiredFields List<KibanaSecurityDetectionRuleRequiredField>
    Array of Elasticsearch fields and types that must be present in source indices for the rule to function properly.
    responseActions List<KibanaSecurityDetectionRuleResponseAction>
    Array of response actions to take when alerts are generated by the rule.
    revision Double
    The rule's revision number.
    riskScore Double
    A numerical representation of the alert's severity from 0 to 100.
    riskScoreMappings List<KibanaSecurityDetectionRuleRiskScoreMapping>
    Array of risk score mappings to override the default risk score based on source event field values.
    ruleId String
    A stable unique identifier for the rule object. If omitted, a UUID is generated.
    ruleNameOverride String
    Override the rule name in Kibana. Available for all rule types.
    savedId String
    Identifier of the saved query used for the rule. Required for saved_query rules.
    setup String
    Setup guide with instructions on rule prerequisites.
    severity String
    Severity level of alerts produced by the rule.
    severityMappings List<KibanaSecurityDetectionRuleSeverityMapping>
    Array of severity mappings to override the default severity based on source event field values.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    tags List<String>
    String array containing words and phrases to help categorize, filter, and search rules.
    threatFilters List<String>
    Additional filters for threat intelligence data. Optional for threat_match rules.
    threatIndicatorPath String
    Path to the threat indicator in the indicator documents. Optional for threat_match rules.
    threatIndices List<String>
    Array of index patterns for the threat intelligence indices. Required for threat_match rules.
    threatMappings List<KibanaSecurityDetectionRuleThreatMapping>
    Array of threat mappings that specify how to match events with threat intelligence. Required for threat*match rules.
    threatQuery String
    Query used to filter threat intelligence data. Optional for threat_match rules.
    threats List<KibanaSecurityDetectionRuleThreat>
    MITRE ATT&CK framework threat information.
    threshold KibanaSecurityDetectionRuleThreshold
    Threshold settings for the rule. Required for threshold rules.
    tiebreakerField String
    Sets the tiebreaker field. Required for EQL rules when event.dataset is not provided.
    timelineId String
    Timeline template ID for the rule.
    timelineTitle String
    Timeline template title for the rule.
    timestampOverride String
    Field name to use for timestamp override. Available for all rule types.
    timestampOverrideFallbackDisabled Boolean
    Disables timestamp override fallback. Available for all rule types.
    to String
    Time to which data is analyzed each time the rule runs, using a date math range.
    type String
    Rule type. Supported types: query, eql, esql, machinelearning, newterms, savedquery, threatmatch, threshold.
    updatedAt String
    The time the rule was last updated.
    updatedBy String
    The user who last updated the rule.
    version Double
    The rule's version number.
    actions KibanaSecurityDetectionRuleAction[]
    Array of automated actions taken when alerts are generated by the rule.
    alertSuppression KibanaSecurityDetectionRuleAlertSuppression
    Defines alert suppression configuration to reduce duplicate alerts.
    anomalyThreshold number
    Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100. Required for machine_learning rules.
    authors string[]
    The rule's author.
    buildingBlockType string
    Determines if the rule acts as a building block. If set, value must be default. Building-block alerts are not displayed in the UI by default and are used as a foundation for other rules.
    concurrentSearches number
    Number of concurrent searches for threat intelligence. Optional for threat_match rules.
    createdAt string
    The time the rule was created.
    createdBy string
    The user who created the rule.
    dataViewId string
    Data view ID for the rule. Not supported for esql and machine_learning rule types.
    description string
    The rule's description.
    enabled boolean
    Determines whether the rule is enabled.
    exceptionsLists KibanaSecurityDetectionRuleExceptionsList[]
    Array of exception containers to prevent the rule from generating alerts.
    falsePositives string[]
    String array used to describe common reasons why the rule may issue false-positive alerts.
    filters string
    Query and filter context array to define alert conditions as JSON. Supports complex filter structures including bool queries, term filters, range filters, etc. Available for all rule types.
    from string
    Time from which data is analyzed each time the rule runs, using a date math range.
    historyWindowStart string
    Start date to use when checking if a term has been seen before. Supports relative dates like 'now-30d'. Required for new_terms rules.
    indices string[]
    Indices on which the rule functions.
    interval string
    Frequency of rule execution, using a date math range.
    investigationFields string[]
    Array of field names to include in alert investigation. Available for all rule types.
    itemsPerSearch number
    Number of items to search for in each concurrent search. Optional for threat_match rules.
    language string
    The query language (KQL or Lucene).
    license string
    The rule's license.
    machineLearningJobIds string[]
    Machine learning job ID(s) the rule monitors for anomaly scores. Required for machine_learning rules.
    maxSignals number
    Maximum number of alerts the rule can create during a single run.
    name string
    A human-readable name for the rule.
    namespace string
    Alerts index namespace. Available for all rule types.
    newTermsFields string[]
    Field names containing the new terms. Required for new_terms rules.
    note string
    Notes to help investigate alerts produced by the rule.
    query string
    The query language definition.
    references string[]
    String array containing references and URLs to sources of additional information.
    relatedIntegrations KibanaSecurityDetectionRuleRelatedIntegration[]
    Array of related integrations that provide additional context for the rule.
    requiredFields KibanaSecurityDetectionRuleRequiredField[]
    Array of Elasticsearch fields and types that must be present in source indices for the rule to function properly.
    responseActions KibanaSecurityDetectionRuleResponseAction[]
    Array of response actions to take when alerts are generated by the rule.
    revision number
    The rule's revision number.
    riskScore number
    A numerical representation of the alert's severity from 0 to 100.
    riskScoreMappings KibanaSecurityDetectionRuleRiskScoreMapping[]
    Array of risk score mappings to override the default risk score based on source event field values.
    ruleId string
    A stable unique identifier for the rule object. If omitted, a UUID is generated.
    ruleNameOverride string
    Override the rule name in Kibana. Available for all rule types.
    savedId string
    Identifier of the saved query used for the rule. Required for saved_query rules.
    setup string
    Setup guide with instructions on rule prerequisites.
    severity string
    Severity level of alerts produced by the rule.
    severityMappings KibanaSecurityDetectionRuleSeverityMapping[]
    Array of severity mappings to override the default severity based on source event field values.
    spaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    tags string[]
    String array containing words and phrases to help categorize, filter, and search rules.
    threatFilters string[]
    Additional filters for threat intelligence data. Optional for threat_match rules.
    threatIndicatorPath string
    Path to the threat indicator in the indicator documents. Optional for threat_match rules.
    threatIndices string[]
    Array of index patterns for the threat intelligence indices. Required for threat_match rules.
    threatMappings KibanaSecurityDetectionRuleThreatMapping[]
    Array of threat mappings that specify how to match events with threat intelligence. Required for threat*match rules.
    threatQuery string
    Query used to filter threat intelligence data. Optional for threat_match rules.
    threats KibanaSecurityDetectionRuleThreat[]
    MITRE ATT&CK framework threat information.
    threshold KibanaSecurityDetectionRuleThreshold
    Threshold settings for the rule. Required for threshold rules.
    tiebreakerField string
    Sets the tiebreaker field. Required for EQL rules when event.dataset is not provided.
    timelineId string
    Timeline template ID for the rule.
    timelineTitle string
    Timeline template title for the rule.
    timestampOverride string
    Field name to use for timestamp override. Available for all rule types.
    timestampOverrideFallbackDisabled boolean
    Disables timestamp override fallback. Available for all rule types.
    to string
    Time to which data is analyzed each time the rule runs, using a date math range.
    type string
    Rule type. Supported types: query, eql, esql, machinelearning, newterms, savedquery, threatmatch, threshold.
    updatedAt string
    The time the rule was last updated.
    updatedBy string
    The user who last updated the rule.
    version number
    The rule's version number.
    actions Sequence[KibanaSecurityDetectionRuleActionArgs]
    Array of automated actions taken when alerts are generated by the rule.
    alert_suppression KibanaSecurityDetectionRuleAlertSuppressionArgs
    Defines alert suppression configuration to reduce duplicate alerts.
    anomaly_threshold float
    Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100. Required for machine_learning rules.
    authors Sequence[str]
    The rule's author.
    building_block_type str
    Determines if the rule acts as a building block. If set, value must be default. Building-block alerts are not displayed in the UI by default and are used as a foundation for other rules.
    concurrent_searches float
    Number of concurrent searches for threat intelligence. Optional for threat_match rules.
    created_at str
    The time the rule was created.
    created_by str
    The user who created the rule.
    data_view_id str
    Data view ID for the rule. Not supported for esql and machine_learning rule types.
    description str
    The rule's description.
    enabled bool
    Determines whether the rule is enabled.
    exceptions_lists Sequence[KibanaSecurityDetectionRuleExceptionsListArgs]
    Array of exception containers to prevent the rule from generating alerts.
    false_positives Sequence[str]
    String array used to describe common reasons why the rule may issue false-positive alerts.
    filters str
    Query and filter context array to define alert conditions as JSON. Supports complex filter structures including bool queries, term filters, range filters, etc. Available for all rule types.
    from_ str
    Time from which data is analyzed each time the rule runs, using a date math range.
    history_window_start str
    Start date to use when checking if a term has been seen before. Supports relative dates like 'now-30d'. Required for new_terms rules.
    indices Sequence[str]
    Indices on which the rule functions.
    interval str
    Frequency of rule execution, using a date math range.
    investigation_fields Sequence[str]
    Array of field names to include in alert investigation. Available for all rule types.
    items_per_search float
    Number of items to search for in each concurrent search. Optional for threat_match rules.
    language str
    The query language (KQL or Lucene).
    license str
    The rule's license.
    machine_learning_job_ids Sequence[str]
    Machine learning job ID(s) the rule monitors for anomaly scores. Required for machine_learning rules.
    max_signals float
    Maximum number of alerts the rule can create during a single run.
    name str
    A human-readable name for the rule.
    namespace str
    Alerts index namespace. Available for all rule types.
    new_terms_fields Sequence[str]
    Field names containing the new terms. Required for new_terms rules.
    note str
    Notes to help investigate alerts produced by the rule.
    query str
    The query language definition.
    references Sequence[str]
    String array containing references and URLs to sources of additional information.
    related_integrations Sequence[KibanaSecurityDetectionRuleRelatedIntegrationArgs]
    Array of related integrations that provide additional context for the rule.
    required_fields Sequence[KibanaSecurityDetectionRuleRequiredFieldArgs]
    Array of Elasticsearch fields and types that must be present in source indices for the rule to function properly.
    response_actions Sequence[KibanaSecurityDetectionRuleResponseActionArgs]
    Array of response actions to take when alerts are generated by the rule.
    revision float
    The rule's revision number.
    risk_score float
    A numerical representation of the alert's severity from 0 to 100.
    risk_score_mappings Sequence[KibanaSecurityDetectionRuleRiskScoreMappingArgs]
    Array of risk score mappings to override the default risk score based on source event field values.
    rule_id str
    A stable unique identifier for the rule object. If omitted, a UUID is generated.
    rule_name_override str
    Override the rule name in Kibana. Available for all rule types.
    saved_id str
    Identifier of the saved query used for the rule. Required for saved_query rules.
    setup str
    Setup guide with instructions on rule prerequisites.
    severity str
    Severity level of alerts produced by the rule.
    severity_mappings Sequence[KibanaSecurityDetectionRuleSeverityMappingArgs]
    Array of severity mappings to override the default severity based on source event field values.
    space_id str
    An identifier for the space. If space_id is not provided, the default space is used.
    tags Sequence[str]
    String array containing words and phrases to help categorize, filter, and search rules.
    threat_filters Sequence[str]
    Additional filters for threat intelligence data. Optional for threat_match rules.
    threat_indicator_path str
    Path to the threat indicator in the indicator documents. Optional for threat_match rules.
    threat_indices Sequence[str]
    Array of index patterns for the threat intelligence indices. Required for threat_match rules.
    threat_mappings Sequence[KibanaSecurityDetectionRuleThreatMappingArgs]
    Array of threat mappings that specify how to match events with threat intelligence. Required for threat*match rules.
    threat_query str
    Query used to filter threat intelligence data. Optional for threat_match rules.
    threats Sequence[KibanaSecurityDetectionRuleThreatArgs]
    MITRE ATT&CK framework threat information.
    threshold KibanaSecurityDetectionRuleThresholdArgs
    Threshold settings for the rule. Required for threshold rules.
    tiebreaker_field str
    Sets the tiebreaker field. Required for EQL rules when event.dataset is not provided.
    timeline_id str
    Timeline template ID for the rule.
    timeline_title str
    Timeline template title for the rule.
    timestamp_override str
    Field name to use for timestamp override. Available for all rule types.
    timestamp_override_fallback_disabled bool
    Disables timestamp override fallback. Available for all rule types.
    to str
    Time to which data is analyzed each time the rule runs, using a date math range.
    type str
    Rule type. Supported types: query, eql, esql, machinelearning, newterms, savedquery, threatmatch, threshold.
    updated_at str
    The time the rule was last updated.
    updated_by str
    The user who last updated the rule.
    version float
    The rule's version number.
    actions List<Property Map>
    Array of automated actions taken when alerts are generated by the rule.
    alertSuppression Property Map
    Defines alert suppression configuration to reduce duplicate alerts.
    anomalyThreshold Number
    Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100. Required for machine_learning rules.
    authors List<String>
    The rule's author.
    buildingBlockType String
    Determines if the rule acts as a building block. If set, value must be default. Building-block alerts are not displayed in the UI by default and are used as a foundation for other rules.
    concurrentSearches Number
    Number of concurrent searches for threat intelligence. Optional for threat_match rules.
    createdAt String
    The time the rule was created.
    createdBy String
    The user who created the rule.
    dataViewId String
    Data view ID for the rule. Not supported for esql and machine_learning rule types.
    description String
    The rule's description.
    enabled Boolean
    Determines whether the rule is enabled.
    exceptionsLists List<Property Map>
    Array of exception containers to prevent the rule from generating alerts.
    falsePositives List<String>
    String array used to describe common reasons why the rule may issue false-positive alerts.
    filters String
    Query and filter context array to define alert conditions as JSON. Supports complex filter structures including bool queries, term filters, range filters, etc. Available for all rule types.
    from String
    Time from which data is analyzed each time the rule runs, using a date math range.
    historyWindowStart String
    Start date to use when checking if a term has been seen before. Supports relative dates like 'now-30d'. Required for new_terms rules.
    indices List<String>
    Indices on which the rule functions.
    interval String
    Frequency of rule execution, using a date math range.
    investigationFields List<String>
    Array of field names to include in alert investigation. Available for all rule types.
    itemsPerSearch Number
    Number of items to search for in each concurrent search. Optional for threat_match rules.
    language String
    The query language (KQL or Lucene).
    license String
    The rule's license.
    machineLearningJobIds List<String>
    Machine learning job ID(s) the rule monitors for anomaly scores. Required for machine_learning rules.
    maxSignals Number
    Maximum number of alerts the rule can create during a single run.
    name String
    A human-readable name for the rule.
    namespace String
    Alerts index namespace. Available for all rule types.
    newTermsFields List<String>
    Field names containing the new terms. Required for new_terms rules.
    note String
    Notes to help investigate alerts produced by the rule.
    query String
    The query language definition.
    references List<String>
    String array containing references and URLs to sources of additional information.
    relatedIntegrations List<Property Map>
    Array of related integrations that provide additional context for the rule.
    requiredFields List<Property Map>
    Array of Elasticsearch fields and types that must be present in source indices for the rule to function properly.
    responseActions List<Property Map>
    Array of response actions to take when alerts are generated by the rule.
    revision Number
    The rule's revision number.
    riskScore Number
    A numerical representation of the alert's severity from 0 to 100.
    riskScoreMappings List<Property Map>
    Array of risk score mappings to override the default risk score based on source event field values.
    ruleId String
    A stable unique identifier for the rule object. If omitted, a UUID is generated.
    ruleNameOverride String
    Override the rule name in Kibana. Available for all rule types.
    savedId String
    Identifier of the saved query used for the rule. Required for saved_query rules.
    setup String
    Setup guide with instructions on rule prerequisites.
    severity String
    Severity level of alerts produced by the rule.
    severityMappings List<Property Map>
    Array of severity mappings to override the default severity based on source event field values.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    tags List<String>
    String array containing words and phrases to help categorize, filter, and search rules.
    threatFilters List<String>
    Additional filters for threat intelligence data. Optional for threat_match rules.
    threatIndicatorPath String
    Path to the threat indicator in the indicator documents. Optional for threat_match rules.
    threatIndices List<String>
    Array of index patterns for the threat intelligence indices. Required for threat_match rules.
    threatMappings List<Property Map>
    Array of threat mappings that specify how to match events with threat intelligence. Required for threat*match rules.
    threatQuery String
    Query used to filter threat intelligence data. Optional for threat_match rules.
    threats List<Property Map>
    MITRE ATT&CK framework threat information.
    threshold Property Map
    Threshold settings for the rule. Required for threshold rules.
    tiebreakerField String
    Sets the tiebreaker field. Required for EQL rules when event.dataset is not provided.
    timelineId String
    Timeline template ID for the rule.
    timelineTitle String
    Timeline template title for the rule.
    timestampOverride String
    Field name to use for timestamp override. Available for all rule types.
    timestampOverrideFallbackDisabled Boolean
    Disables timestamp override fallback. Available for all rule types.
    to String
    Time to which data is analyzed each time the rule runs, using a date math range.
    type String
    Rule type. Supported types: query, eql, esql, machinelearning, newterms, savedquery, threatmatch, threshold.
    updatedAt String
    The time the rule was last updated.
    updatedBy String
    The user who last updated the rule.
    version Number
    The rule's version number.

    Supporting Types

    KibanaSecurityDetectionRuleAction, KibanaSecurityDetectionRuleActionArgs

    ActionTypeId string
    The action type used for sending notifications (e.g., .slack, .email, .webhook, .pagerduty, etc.).
    Id string
    The connector ID.
    Params Dictionary<string, string>
    Object containing the allowed connector fields, which varies according to the connector type.
    AlertsFilter Dictionary<string, string>
    Object containing an action's conditional filters.
    Frequency KibanaSecurityDetectionRuleActionFrequency
    The action frequency defines when the action runs.
    Group string
    Optionally groups actions by use cases. Use 'default' for alert notifications.
    Uuid string
    A unique identifier for the action.
    ActionTypeId string
    The action type used for sending notifications (e.g., .slack, .email, .webhook, .pagerduty, etc.).
    Id string
    The connector ID.
    Params map[string]string
    Object containing the allowed connector fields, which varies according to the connector type.
    AlertsFilter map[string]string
    Object containing an action's conditional filters.
    Frequency KibanaSecurityDetectionRuleActionFrequency
    The action frequency defines when the action runs.
    Group string
    Optionally groups actions by use cases. Use 'default' for alert notifications.
    Uuid string
    A unique identifier for the action.
    actionTypeId String
    The action type used for sending notifications (e.g., .slack, .email, .webhook, .pagerduty, etc.).
    id String
    The connector ID.
    params Map<String,String>
    Object containing the allowed connector fields, which varies according to the connector type.
    alertsFilter Map<String,String>
    Object containing an action's conditional filters.
    frequency KibanaSecurityDetectionRuleActionFrequency
    The action frequency defines when the action runs.
    group String
    Optionally groups actions by use cases. Use 'default' for alert notifications.
    uuid String
    A unique identifier for the action.
    actionTypeId string
    The action type used for sending notifications (e.g., .slack, .email, .webhook, .pagerduty, etc.).
    id string
    The connector ID.
    params {[key: string]: string}
    Object containing the allowed connector fields, which varies according to the connector type.
    alertsFilter {[key: string]: string}
    Object containing an action's conditional filters.
    frequency KibanaSecurityDetectionRuleActionFrequency
    The action frequency defines when the action runs.
    group string
    Optionally groups actions by use cases. Use 'default' for alert notifications.
    uuid string
    A unique identifier for the action.
    action_type_id str
    The action type used for sending notifications (e.g., .slack, .email, .webhook, .pagerduty, etc.).
    id str
    The connector ID.
    params Mapping[str, str]
    Object containing the allowed connector fields, which varies according to the connector type.
    alerts_filter Mapping[str, str]
    Object containing an action's conditional filters.
    frequency KibanaSecurityDetectionRuleActionFrequency
    The action frequency defines when the action runs.
    group str
    Optionally groups actions by use cases. Use 'default' for alert notifications.
    uuid str
    A unique identifier for the action.
    actionTypeId String
    The action type used for sending notifications (e.g., .slack, .email, .webhook, .pagerduty, etc.).
    id String
    The connector ID.
    params Map<String>
    Object containing the allowed connector fields, which varies according to the connector type.
    alertsFilter Map<String>
    Object containing an action's conditional filters.
    frequency Property Map
    The action frequency defines when the action runs.
    group String
    Optionally groups actions by use cases. Use 'default' for alert notifications.
    uuid String
    A unique identifier for the action.

    KibanaSecurityDetectionRuleActionFrequency, KibanaSecurityDetectionRuleActionFrequencyArgs

    NotifyWhen string
    Defines how often rules run actions. Valid values: onActionGroupChange, onActiveAlert, onThrottleInterval.
    Summary bool
    Action summary indicates whether we will send a summary notification about all the generated alerts or notification per individual alert.
    Throttle string
    Time interval for throttling actions (e.g., '1h', '30m', 'no_actions', 'rule').
    NotifyWhen string
    Defines how often rules run actions. Valid values: onActionGroupChange, onActiveAlert, onThrottleInterval.
    Summary bool
    Action summary indicates whether we will send a summary notification about all the generated alerts or notification per individual alert.
    Throttle string
    Time interval for throttling actions (e.g., '1h', '30m', 'no_actions', 'rule').
    notifyWhen String
    Defines how often rules run actions. Valid values: onActionGroupChange, onActiveAlert, onThrottleInterval.
    summary Boolean
    Action summary indicates whether we will send a summary notification about all the generated alerts or notification per individual alert.
    throttle String
    Time interval for throttling actions (e.g., '1h', '30m', 'no_actions', 'rule').
    notifyWhen string
    Defines how often rules run actions. Valid values: onActionGroupChange, onActiveAlert, onThrottleInterval.
    summary boolean
    Action summary indicates whether we will send a summary notification about all the generated alerts or notification per individual alert.
    throttle string
    Time interval for throttling actions (e.g., '1h', '30m', 'no_actions', 'rule').
    notify_when str
    Defines how often rules run actions. Valid values: onActionGroupChange, onActiveAlert, onThrottleInterval.
    summary bool
    Action summary indicates whether we will send a summary notification about all the generated alerts or notification per individual alert.
    throttle str
    Time interval for throttling actions (e.g., '1h', '30m', 'no_actions', 'rule').
    notifyWhen String
    Defines how often rules run actions. Valid values: onActionGroupChange, onActiveAlert, onThrottleInterval.
    summary Boolean
    Action summary indicates whether we will send a summary notification about all the generated alerts or notification per individual alert.
    throttle String
    Time interval for throttling actions (e.g., '1h', '30m', 'no_actions', 'rule').

    KibanaSecurityDetectionRuleAlertSuppression, KibanaSecurityDetectionRuleAlertSuppressionArgs

    Duration string
    Duration for which alerts are suppressed.
    GroupBies List<string>
    Array of field names to group alerts by for suppression.
    MissingFieldsStrategy string
    Strategy for handling missing fields in suppression grouping: 'suppress' - only one alert will be created per suppress by bucket, 'doNotSuppress' - per each document a separate alert will be created.
    Duration string
    Duration for which alerts are suppressed.
    GroupBies []string
    Array of field names to group alerts by for suppression.
    MissingFieldsStrategy string
    Strategy for handling missing fields in suppression grouping: 'suppress' - only one alert will be created per suppress by bucket, 'doNotSuppress' - per each document a separate alert will be created.
    duration String
    Duration for which alerts are suppressed.
    groupBies List<String>
    Array of field names to group alerts by for suppression.
    missingFieldsStrategy String
    Strategy for handling missing fields in suppression grouping: 'suppress' - only one alert will be created per suppress by bucket, 'doNotSuppress' - per each document a separate alert will be created.
    duration string
    Duration for which alerts are suppressed.
    groupBies string[]
    Array of field names to group alerts by for suppression.
    missingFieldsStrategy string
    Strategy for handling missing fields in suppression grouping: 'suppress' - only one alert will be created per suppress by bucket, 'doNotSuppress' - per each document a separate alert will be created.
    duration str
    Duration for which alerts are suppressed.
    group_bies Sequence[str]
    Array of field names to group alerts by for suppression.
    missing_fields_strategy str
    Strategy for handling missing fields in suppression grouping: 'suppress' - only one alert will be created per suppress by bucket, 'doNotSuppress' - per each document a separate alert will be created.
    duration String
    Duration for which alerts are suppressed.
    groupBies List<String>
    Array of field names to group alerts by for suppression.
    missingFieldsStrategy String
    Strategy for handling missing fields in suppression grouping: 'suppress' - only one alert will be created per suppress by bucket, 'doNotSuppress' - per each document a separate alert will be created.

    KibanaSecurityDetectionRuleExceptionsList, KibanaSecurityDetectionRuleExceptionsListArgs

    Id string
    The exception container ID.
    ListId string
    The exception container's list ID.
    NamespaceType string
    The namespace type for the exception container.
    Type string
    The type of exception container.
    Id string
    The exception container ID.
    ListId string
    The exception container's list ID.
    NamespaceType string
    The namespace type for the exception container.
    Type string
    The type of exception container.
    id String
    The exception container ID.
    listId String
    The exception container's list ID.
    namespaceType String
    The namespace type for the exception container.
    type String
    The type of exception container.
    id string
    The exception container ID.
    listId string
    The exception container's list ID.
    namespaceType string
    The namespace type for the exception container.
    type string
    The type of exception container.
    id str
    The exception container ID.
    list_id str
    The exception container's list ID.
    namespace_type str
    The namespace type for the exception container.
    type str
    The type of exception container.
    id String
    The exception container ID.
    listId String
    The exception container's list ID.
    namespaceType String
    The namespace type for the exception container.
    type String
    The type of exception container.

    KibanaSecurityDetectionRuleRelatedIntegration, KibanaSecurityDetectionRuleRelatedIntegrationArgs

    Package string
    Name of the integration package.
    Version string
    Version of the integration package.
    Integration string
    Name of the specific integration.
    Package string
    Name of the integration package.
    Version string
    Version of the integration package.
    Integration string
    Name of the specific integration.
    package_ String
    Name of the integration package.
    version String
    Version of the integration package.
    integration String
    Name of the specific integration.
    package string
    Name of the integration package.
    version string
    Version of the integration package.
    integration string
    Name of the specific integration.
    package str
    Name of the integration package.
    version str
    Version of the integration package.
    integration str
    Name of the specific integration.
    package String
    Name of the integration package.
    version String
    Version of the integration package.
    integration String
    Name of the specific integration.

    KibanaSecurityDetectionRuleRequiredField, KibanaSecurityDetectionRuleRequiredFieldArgs

    Name string
    Name of the Elasticsearch field.
    Type string
    Type of the Elasticsearch field.
    Ecs bool
    Indicates whether the field is ECS-compliant. This is computed by the backend based on the field name and type.
    Name string
    Name of the Elasticsearch field.
    Type string
    Type of the Elasticsearch field.
    Ecs bool
    Indicates whether the field is ECS-compliant. This is computed by the backend based on the field name and type.
    name String
    Name of the Elasticsearch field.
    type String
    Type of the Elasticsearch field.
    ecs Boolean
    Indicates whether the field is ECS-compliant. This is computed by the backend based on the field name and type.
    name string
    Name of the Elasticsearch field.
    type string
    Type of the Elasticsearch field.
    ecs boolean
    Indicates whether the field is ECS-compliant. This is computed by the backend based on the field name and type.
    name str
    Name of the Elasticsearch field.
    type str
    Type of the Elasticsearch field.
    ecs bool
    Indicates whether the field is ECS-compliant. This is computed by the backend based on the field name and type.
    name String
    Name of the Elasticsearch field.
    type String
    Type of the Elasticsearch field.
    ecs Boolean
    Indicates whether the field is ECS-compliant. This is computed by the backend based on the field name and type.

    KibanaSecurityDetectionRuleResponseAction, KibanaSecurityDetectionRuleResponseActionArgs

    ActionTypeId string
    The action type used for response actions (.osquery, .endpoint).
    Params KibanaSecurityDetectionRuleResponseActionParams
    Parameters for the response action. Structure varies based on actiontypeid.
    ActionTypeId string
    The action type used for response actions (.osquery, .endpoint).
    Params KibanaSecurityDetectionRuleResponseActionParams
    Parameters for the response action. Structure varies based on actiontypeid.
    actionTypeId String
    The action type used for response actions (.osquery, .endpoint).
    params KibanaSecurityDetectionRuleResponseActionParams
    Parameters for the response action. Structure varies based on actiontypeid.
    actionTypeId string
    The action type used for response actions (.osquery, .endpoint).
    params KibanaSecurityDetectionRuleResponseActionParams
    Parameters for the response action. Structure varies based on actiontypeid.
    action_type_id str
    The action type used for response actions (.osquery, .endpoint).
    params KibanaSecurityDetectionRuleResponseActionParams
    Parameters for the response action. Structure varies based on actiontypeid.
    actionTypeId String
    The action type used for response actions (.osquery, .endpoint).
    params Property Map
    Parameters for the response action. Structure varies based on actiontypeid.

    KibanaSecurityDetectionRuleResponseActionParams, KibanaSecurityDetectionRuleResponseActionParamsArgs

    Command string
    Command to run (endpoint only). Valid values: isolate, kill-process, suspend-process.
    Comment string
    Comment describing the action (endpoint only).
    Config KibanaSecurityDetectionRuleResponseActionParamsConfig
    Configuration for process commands (endpoint only).
    EcsMapping Dictionary<string, string>
    Map Osquery results columns to ECS fields (osquery only).
    PackId string
    Query pack identifier (osquery only).
    Queries List<KibanaSecurityDetectionRuleResponseActionParamsQuery>
    Array of queries to run (osquery only).
    Query string
    SQL query to run (osquery only). Example: 'SELECT * FROM processes;'
    SavedQueryId string
    Saved query identifier (osquery only).
    Timeout double
    Timeout period in seconds (osquery only). Min: 60, Max: 900.
    Command string
    Command to run (endpoint only). Valid values: isolate, kill-process, suspend-process.
    Comment string
    Comment describing the action (endpoint only).
    Config KibanaSecurityDetectionRuleResponseActionParamsConfig
    Configuration for process commands (endpoint only).
    EcsMapping map[string]string
    Map Osquery results columns to ECS fields (osquery only).
    PackId string
    Query pack identifier (osquery only).
    Queries []KibanaSecurityDetectionRuleResponseActionParamsQuery
    Array of queries to run (osquery only).
    Query string
    SQL query to run (osquery only). Example: 'SELECT * FROM processes;'
    SavedQueryId string
    Saved query identifier (osquery only).
    Timeout float64
    Timeout period in seconds (osquery only). Min: 60, Max: 900.
    command String
    Command to run (endpoint only). Valid values: isolate, kill-process, suspend-process.
    comment String
    Comment describing the action (endpoint only).
    config KibanaSecurityDetectionRuleResponseActionParamsConfig
    Configuration for process commands (endpoint only).
    ecsMapping Map<String,String>
    Map Osquery results columns to ECS fields (osquery only).
    packId String
    Query pack identifier (osquery only).
    queries List<KibanaSecurityDetectionRuleResponseActionParamsQuery>
    Array of queries to run (osquery only).
    query String
    SQL query to run (osquery only). Example: 'SELECT * FROM processes;'
    savedQueryId String
    Saved query identifier (osquery only).
    timeout Double
    Timeout period in seconds (osquery only). Min: 60, Max: 900.
    command string
    Command to run (endpoint only). Valid values: isolate, kill-process, suspend-process.
    comment string
    Comment describing the action (endpoint only).
    config KibanaSecurityDetectionRuleResponseActionParamsConfig
    Configuration for process commands (endpoint only).
    ecsMapping {[key: string]: string}
    Map Osquery results columns to ECS fields (osquery only).
    packId string
    Query pack identifier (osquery only).
    queries KibanaSecurityDetectionRuleResponseActionParamsQuery[]
    Array of queries to run (osquery only).
    query string
    SQL query to run (osquery only). Example: 'SELECT * FROM processes;'
    savedQueryId string
    Saved query identifier (osquery only).
    timeout number
    Timeout period in seconds (osquery only). Min: 60, Max: 900.
    command str
    Command to run (endpoint only). Valid values: isolate, kill-process, suspend-process.
    comment str
    Comment describing the action (endpoint only).
    config KibanaSecurityDetectionRuleResponseActionParamsConfig
    Configuration for process commands (endpoint only).
    ecs_mapping Mapping[str, str]
    Map Osquery results columns to ECS fields (osquery only).
    pack_id str
    Query pack identifier (osquery only).
    queries Sequence[KibanaSecurityDetectionRuleResponseActionParamsQuery]
    Array of queries to run (osquery only).
    query str
    SQL query to run (osquery only). Example: 'SELECT * FROM processes;'
    saved_query_id str
    Saved query identifier (osquery only).
    timeout float
    Timeout period in seconds (osquery only). Min: 60, Max: 900.
    command String
    Command to run (endpoint only). Valid values: isolate, kill-process, suspend-process.
    comment String
    Comment describing the action (endpoint only).
    config Property Map
    Configuration for process commands (endpoint only).
    ecsMapping Map<String>
    Map Osquery results columns to ECS fields (osquery only).
    packId String
    Query pack identifier (osquery only).
    queries List<Property Map>
    Array of queries to run (osquery only).
    query String
    SQL query to run (osquery only). Example: 'SELECT * FROM processes;'
    savedQueryId String
    Saved query identifier (osquery only).
    timeout Number
    Timeout period in seconds (osquery only). Min: 60, Max: 900.

    KibanaSecurityDetectionRuleResponseActionParamsConfig, KibanaSecurityDetectionRuleResponseActionParamsConfigArgs

    Field string
    Field to use instead of process.pid.
    Overwrite bool
    Whether to overwrite field with process.pid.
    Field string
    Field to use instead of process.pid.
    Overwrite bool
    Whether to overwrite field with process.pid.
    field String
    Field to use instead of process.pid.
    overwrite Boolean
    Whether to overwrite field with process.pid.
    field string
    Field to use instead of process.pid.
    overwrite boolean
    Whether to overwrite field with process.pid.
    field str
    Field to use instead of process.pid.
    overwrite bool
    Whether to overwrite field with process.pid.
    field String
    Field to use instead of process.pid.
    overwrite Boolean
    Whether to overwrite field with process.pid.

    KibanaSecurityDetectionRuleResponseActionParamsQuery, KibanaSecurityDetectionRuleResponseActionParamsQueryArgs

    Id string
    Query ID.
    Query string
    Query to run.
    EcsMapping Dictionary<string, string>
    ECS field mappings for this query.
    Platform string
    Platform to run the query on.
    Removed bool
    Whether the query is removed.
    Snapshot bool
    Whether this is a snapshot query.
    Version string
    Query version.
    Id string
    Query ID.
    Query string
    Query to run.
    EcsMapping map[string]string
    ECS field mappings for this query.
    Platform string
    Platform to run the query on.
    Removed bool
    Whether the query is removed.
    Snapshot bool
    Whether this is a snapshot query.
    Version string
    Query version.
    id String
    Query ID.
    query String
    Query to run.
    ecsMapping Map<String,String>
    ECS field mappings for this query.
    platform String
    Platform to run the query on.
    removed Boolean
    Whether the query is removed.
    snapshot Boolean
    Whether this is a snapshot query.
    version String
    Query version.
    id string
    Query ID.
    query string
    Query to run.
    ecsMapping {[key: string]: string}
    ECS field mappings for this query.
    platform string
    Platform to run the query on.
    removed boolean
    Whether the query is removed.
    snapshot boolean
    Whether this is a snapshot query.
    version string
    Query version.
    id str
    Query ID.
    query str
    Query to run.
    ecs_mapping Mapping[str, str]
    ECS field mappings for this query.
    platform str
    Platform to run the query on.
    removed bool
    Whether the query is removed.
    snapshot bool
    Whether this is a snapshot query.
    version str
    Query version.
    id String
    Query ID.
    query String
    Query to run.
    ecsMapping Map<String>
    ECS field mappings for this query.
    platform String
    Platform to run the query on.
    removed Boolean
    Whether the query is removed.
    snapshot Boolean
    Whether this is a snapshot query.
    version String
    Query version.

    KibanaSecurityDetectionRuleRiskScoreMapping, KibanaSecurityDetectionRuleRiskScoreMappingArgs

    Field string
    Source event field used to override the default risk_score.
    Operator string
    Operator to use for field value matching. Currently only 'equals' is supported.
    Value string
    Value to match against the field.
    RiskScore double
    Risk score to use when the field matches the value (0-100). If omitted, uses the rule's default risk_score.
    Field string
    Source event field used to override the default risk_score.
    Operator string
    Operator to use for field value matching. Currently only 'equals' is supported.
    Value string
    Value to match against the field.
    RiskScore float64
    Risk score to use when the field matches the value (0-100). If omitted, uses the rule's default risk_score.
    field String
    Source event field used to override the default risk_score.
    operator String
    Operator to use for field value matching. Currently only 'equals' is supported.
    value String
    Value to match against the field.
    riskScore Double
    Risk score to use when the field matches the value (0-100). If omitted, uses the rule's default risk_score.
    field string
    Source event field used to override the default risk_score.
    operator string
    Operator to use for field value matching. Currently only 'equals' is supported.
    value string
    Value to match against the field.
    riskScore number
    Risk score to use when the field matches the value (0-100). If omitted, uses the rule's default risk_score.
    field str
    Source event field used to override the default risk_score.
    operator str
    Operator to use for field value matching. Currently only 'equals' is supported.
    value str
    Value to match against the field.
    risk_score float
    Risk score to use when the field matches the value (0-100). If omitted, uses the rule's default risk_score.
    field String
    Source event field used to override the default risk_score.
    operator String
    Operator to use for field value matching. Currently only 'equals' is supported.
    value String
    Value to match against the field.
    riskScore Number
    Risk score to use when the field matches the value (0-100). If omitted, uses the rule's default risk_score.

    KibanaSecurityDetectionRuleSeverityMapping, KibanaSecurityDetectionRuleSeverityMappingArgs

    Field string
    Source event field used to override the default severity.
    Operator string
    Operator to use for field value matching. Currently only 'equals' is supported.
    Severity string
    Severity level to use when the field matches the value.
    Value string
    Value to match against the field.
    Field string
    Source event field used to override the default severity.
    Operator string
    Operator to use for field value matching. Currently only 'equals' is supported.
    Severity string
    Severity level to use when the field matches the value.
    Value string
    Value to match against the field.
    field String
    Source event field used to override the default severity.
    operator String
    Operator to use for field value matching. Currently only 'equals' is supported.
    severity String
    Severity level to use when the field matches the value.
    value String
    Value to match against the field.
    field string
    Source event field used to override the default severity.
    operator string
    Operator to use for field value matching. Currently only 'equals' is supported.
    severity string
    Severity level to use when the field matches the value.
    value string
    Value to match against the field.
    field str
    Source event field used to override the default severity.
    operator str
    Operator to use for field value matching. Currently only 'equals' is supported.
    severity str
    Severity level to use when the field matches the value.
    value str
    Value to match against the field.
    field String
    Source event field used to override the default severity.
    operator String
    Operator to use for field value matching. Currently only 'equals' is supported.
    severity String
    Severity level to use when the field matches the value.
    value String
    Value to match against the field.

    KibanaSecurityDetectionRuleThreat, KibanaSecurityDetectionRuleThreatArgs

    Framework string
    Threat framework (typically 'MITRE ATT&CK').
    Tactic KibanaSecurityDetectionRuleThreatTactic
    MITRE ATT&CK tactic information.
    Techniques List<KibanaSecurityDetectionRuleThreatTechnique>
    MITRE ATT&CK technique information.
    Framework string
    Threat framework (typically 'MITRE ATT&CK').
    Tactic KibanaSecurityDetectionRuleThreatTactic
    MITRE ATT&CK tactic information.
    Techniques []KibanaSecurityDetectionRuleThreatTechnique
    MITRE ATT&CK technique information.
    framework String
    Threat framework (typically 'MITRE ATT&CK').
    tactic KibanaSecurityDetectionRuleThreatTactic
    MITRE ATT&CK tactic information.
    techniques List<KibanaSecurityDetectionRuleThreatTechnique>
    MITRE ATT&CK technique information.
    framework string
    Threat framework (typically 'MITRE ATT&CK').
    tactic KibanaSecurityDetectionRuleThreatTactic
    MITRE ATT&CK tactic information.
    techniques KibanaSecurityDetectionRuleThreatTechnique[]
    MITRE ATT&CK technique information.
    framework str
    Threat framework (typically 'MITRE ATT&CK').
    tactic KibanaSecurityDetectionRuleThreatTactic
    MITRE ATT&CK tactic information.
    techniques Sequence[KibanaSecurityDetectionRuleThreatTechnique]
    MITRE ATT&CK technique information.
    framework String
    Threat framework (typically 'MITRE ATT&CK').
    tactic Property Map
    MITRE ATT&CK tactic information.
    techniques List<Property Map>
    MITRE ATT&CK technique information.

    KibanaSecurityDetectionRuleThreatMapping, KibanaSecurityDetectionRuleThreatMappingArgs

    entries List<Property Map>
    Array of mapping entries.

    KibanaSecurityDetectionRuleThreatMappingEntry, KibanaSecurityDetectionRuleThreatMappingEntryArgs

    Field string
    Event field to match.
    Type string
    Type of match (mapping).
    Value string
    Threat intelligence field to match against.
    Field string
    Event field to match.
    Type string
    Type of match (mapping).
    Value string
    Threat intelligence field to match against.
    field String
    Event field to match.
    type String
    Type of match (mapping).
    value String
    Threat intelligence field to match against.
    field string
    Event field to match.
    type string
    Type of match (mapping).
    value string
    Threat intelligence field to match against.
    field str
    Event field to match.
    type str
    Type of match (mapping).
    value str
    Threat intelligence field to match against.
    field String
    Event field to match.
    type String
    Type of match (mapping).
    value String
    Threat intelligence field to match against.

    KibanaSecurityDetectionRuleThreatTactic, KibanaSecurityDetectionRuleThreatTacticArgs

    Id string
    MITRE ATT&CK tactic ID.
    Name string
    MITRE ATT&CK tactic name.
    Reference string
    MITRE ATT&CK tactic reference URL.
    Id string
    MITRE ATT&CK tactic ID.
    Name string
    MITRE ATT&CK tactic name.
    Reference string
    MITRE ATT&CK tactic reference URL.
    id String
    MITRE ATT&CK tactic ID.
    name String
    MITRE ATT&CK tactic name.
    reference String
    MITRE ATT&CK tactic reference URL.
    id string
    MITRE ATT&CK tactic ID.
    name string
    MITRE ATT&CK tactic name.
    reference string
    MITRE ATT&CK tactic reference URL.
    id str
    MITRE ATT&CK tactic ID.
    name str
    MITRE ATT&CK tactic name.
    reference str
    MITRE ATT&CK tactic reference URL.
    id String
    MITRE ATT&CK tactic ID.
    name String
    MITRE ATT&CK tactic name.
    reference String
    MITRE ATT&CK tactic reference URL.

    KibanaSecurityDetectionRuleThreatTechnique, KibanaSecurityDetectionRuleThreatTechniqueArgs

    Id string
    MITRE ATT&CK technique ID.
    Name string
    MITRE ATT&CK technique name.
    Reference string
    MITRE ATT&CK technique reference URL.
    Subtechniques List<KibanaSecurityDetectionRuleThreatTechniqueSubtechnique>
    MITRE ATT&CK sub-technique information.
    Id string
    MITRE ATT&CK technique ID.
    Name string
    MITRE ATT&CK technique name.
    Reference string
    MITRE ATT&CK technique reference URL.
    Subtechniques []KibanaSecurityDetectionRuleThreatTechniqueSubtechnique
    MITRE ATT&CK sub-technique information.
    id String
    MITRE ATT&CK technique ID.
    name String
    MITRE ATT&CK technique name.
    reference String
    MITRE ATT&CK technique reference URL.
    subtechniques List<KibanaSecurityDetectionRuleThreatTechniqueSubtechnique>
    MITRE ATT&CK sub-technique information.
    id string
    MITRE ATT&CK technique ID.
    name string
    MITRE ATT&CK technique name.
    reference string
    MITRE ATT&CK technique reference URL.
    subtechniques KibanaSecurityDetectionRuleThreatTechniqueSubtechnique[]
    MITRE ATT&CK sub-technique information.
    id str
    MITRE ATT&CK technique ID.
    name str
    MITRE ATT&CK technique name.
    reference str
    MITRE ATT&CK technique reference URL.
    subtechniques Sequence[KibanaSecurityDetectionRuleThreatTechniqueSubtechnique]
    MITRE ATT&CK sub-technique information.
    id String
    MITRE ATT&CK technique ID.
    name String
    MITRE ATT&CK technique name.
    reference String
    MITRE ATT&CK technique reference URL.
    subtechniques List<Property Map>
    MITRE ATT&CK sub-technique information.

    KibanaSecurityDetectionRuleThreatTechniqueSubtechnique, KibanaSecurityDetectionRuleThreatTechniqueSubtechniqueArgs

    Id string
    MITRE ATT&CK sub-technique ID.
    Name string
    MITRE ATT&CK sub-technique name.
    Reference string
    MITRE ATT&CK sub-technique reference URL.
    Id string
    MITRE ATT&CK sub-technique ID.
    Name string
    MITRE ATT&CK sub-technique name.
    Reference string
    MITRE ATT&CK sub-technique reference URL.
    id String
    MITRE ATT&CK sub-technique ID.
    name String
    MITRE ATT&CK sub-technique name.
    reference String
    MITRE ATT&CK sub-technique reference URL.
    id string
    MITRE ATT&CK sub-technique ID.
    name string
    MITRE ATT&CK sub-technique name.
    reference string
    MITRE ATT&CK sub-technique reference URL.
    id str
    MITRE ATT&CK sub-technique ID.
    name str
    MITRE ATT&CK sub-technique name.
    reference str
    MITRE ATT&CK sub-technique reference URL.
    id String
    MITRE ATT&CK sub-technique ID.
    name String
    MITRE ATT&CK sub-technique name.
    reference String
    MITRE ATT&CK sub-technique reference URL.

    KibanaSecurityDetectionRuleThreshold, KibanaSecurityDetectionRuleThresholdArgs

    Value double
    The threshold value from which an alert is generated.
    Cardinalities List<KibanaSecurityDetectionRuleThresholdCardinality>
    Cardinality settings for threshold rule.
    Fields List<string>
    Field(s) to use for threshold aggregation.
    Value float64
    The threshold value from which an alert is generated.
    Cardinalities []KibanaSecurityDetectionRuleThresholdCardinality
    Cardinality settings for threshold rule.
    Fields []string
    Field(s) to use for threshold aggregation.
    value Double
    The threshold value from which an alert is generated.
    cardinalities List<KibanaSecurityDetectionRuleThresholdCardinality>
    Cardinality settings for threshold rule.
    fields List<String>
    Field(s) to use for threshold aggregation.
    value number
    The threshold value from which an alert is generated.
    cardinalities KibanaSecurityDetectionRuleThresholdCardinality[]
    Cardinality settings for threshold rule.
    fields string[]
    Field(s) to use for threshold aggregation.
    value float
    The threshold value from which an alert is generated.
    cardinalities Sequence[KibanaSecurityDetectionRuleThresholdCardinality]
    Cardinality settings for threshold rule.
    fields Sequence[str]
    Field(s) to use for threshold aggregation.
    value Number
    The threshold value from which an alert is generated.
    cardinalities List<Property Map>
    Cardinality settings for threshold rule.
    fields List<String>
    Field(s) to use for threshold aggregation.

    KibanaSecurityDetectionRuleThresholdCardinality, KibanaSecurityDetectionRuleThresholdCardinalityArgs

    Field string
    The field on which to calculate and compare the cardinality.
    Value double
    The threshold cardinality value.
    Field string
    The field on which to calculate and compare the cardinality.
    Value float64
    The threshold cardinality value.
    field String
    The field on which to calculate and compare the cardinality.
    value Double
    The threshold cardinality value.
    field string
    The field on which to calculate and compare the cardinality.
    value number
    The threshold cardinality value.
    field str
    The field on which to calculate and compare the cardinality.
    value float
    The threshold cardinality value.
    field String
    The field on which to calculate and compare the cardinality.
    value Number
    The threshold cardinality value.

    Import

    The pulumi import command can be used, for example:

    $ pulumi import elasticstack:index/kibanaSecurityDetectionRule:KibanaSecurityDetectionRule example default/12345678-1234-1234-1234-123456789abc

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    elasticstack elastic/terraform-provider-elasticstack
    License
    Notes
    This Pulumi package is based on the elasticstack Terraform Provider.
    elasticstack logo
    elasticstack 0.12.1 published on Thursday, Oct 23, 2025 by elastic
    elastic/terraform-provider-elasticstack
      Meet Neo: Your AI Platform Teammate