sumologic logo
Sumo Logic v0.14.0, May 25 23

sumologic.CseChainRule

Explore with Pulumi AI

Provides a Sumo Logic CSE Chain Rule.

Example Usage

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using SumoLogic = Pulumi.SumoLogic;

return await Deployment.RunAsync(() => 
{
    var chainRule = new SumoLogic.CseChainRule("chainRule", new()
    {
        Description = "Signal description",
        Enabled = true,
        EntitySelectors = new[]
        {
            new SumoLogic.Inputs.CseChainRuleEntitySelectorArgs
            {
                EntityType = "_username",
                Expression = "user_username",
            },
        },
        ExpressionsAndLimits = new[]
        {
            new SumoLogic.Inputs.CseChainRuleExpressionsAndLimitArgs
            {
                Expression = "success = false",
                Limit = 5,
            },
            new SumoLogic.Inputs.CseChainRuleExpressionsAndLimitArgs
            {
                Expression = "success = true",
                Limit = 1,
            },
        },
        GroupByFields = new[] {},
        IsPrototype = false,
        Ordered = true,
        Severity = 5,
        SummaryExpression = "Signal summary",
        Tags = new[]
        {
            "_mitreAttackTactic:TA0009",
        },
        WindowSize = "T30M",
    });

});
package main

import (
	"github.com/pulumi/pulumi-sumologic/sdk/go/sumologic"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := sumologic.NewCseChainRule(ctx, "chainRule", &sumologic.CseChainRuleArgs{
			Description: pulumi.String("Signal description"),
			Enabled:     pulumi.Bool(true),
			EntitySelectors: sumologic.CseChainRuleEntitySelectorArray{
				&sumologic.CseChainRuleEntitySelectorArgs{
					EntityType: pulumi.String("_username"),
					Expression: pulumi.String("user_username"),
				},
			},
			ExpressionsAndLimits: sumologic.CseChainRuleExpressionsAndLimitArray{
				&sumologic.CseChainRuleExpressionsAndLimitArgs{
					Expression: pulumi.String("success = false"),
					Limit:      pulumi.Int(5),
				},
				&sumologic.CseChainRuleExpressionsAndLimitArgs{
					Expression: pulumi.String("success = true"),
					Limit:      pulumi.Int(1),
				},
			},
			GroupByFields:     pulumi.StringArray{},
			IsPrototype:       pulumi.Bool(false),
			Ordered:           pulumi.Bool(true),
			Severity:          pulumi.Int(5),
			SummaryExpression: pulumi.String("Signal summary"),
			Tags: pulumi.StringArray{
				pulumi.String("_mitreAttackTactic:TA0009"),
			},
			WindowSize: pulumi.String("T30M"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.sumologic.CseChainRule;
import com.pulumi.sumologic.CseChainRuleArgs;
import com.pulumi.sumologic.inputs.CseChainRuleEntitySelectorArgs;
import com.pulumi.sumologic.inputs.CseChainRuleExpressionsAndLimitArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var chainRule = new CseChainRule("chainRule", CseChainRuleArgs.builder()        
            .description("Signal description")
            .enabled(true)
            .entitySelectors(CseChainRuleEntitySelectorArgs.builder()
                .entityType("_username")
                .expression("user_username")
                .build())
            .expressionsAndLimits(            
                CseChainRuleExpressionsAndLimitArgs.builder()
                    .expression("success = false")
                    .limit(5)
                    .build(),
                CseChainRuleExpressionsAndLimitArgs.builder()
                    .expression("success = true")
                    .limit(1)
                    .build())
            .groupByFields()
            .isPrototype(false)
            .ordered(true)
            .severity(5)
            .summaryExpression("Signal summary")
            .tags("_mitreAttackTactic:TA0009")
            .windowSize("T30M")
            .build());

    }
}
import pulumi
import pulumi_sumologic as sumologic

chain_rule = sumologic.CseChainRule("chainRule",
    description="Signal description",
    enabled=True,
    entity_selectors=[sumologic.CseChainRuleEntitySelectorArgs(
        entity_type="_username",
        expression="user_username",
    )],
    expressions_and_limits=[
        sumologic.CseChainRuleExpressionsAndLimitArgs(
            expression="success = false",
            limit=5,
        ),
        sumologic.CseChainRuleExpressionsAndLimitArgs(
            expression="success = true",
            limit=1,
        ),
    ],
    group_by_fields=[],
    is_prototype=False,
    ordered=True,
    severity=5,
    summary_expression="Signal summary",
    tags=["_mitreAttackTactic:TA0009"],
    window_size="T30M")
import * as pulumi from "@pulumi/pulumi";
import * as sumologic from "@pulumi/sumologic";

const chainRule = new sumologic.CseChainRule("chainRule", {
    description: "Signal description",
    enabled: true,
    entitySelectors: [{
        entityType: "_username",
        expression: "user_username",
    }],
    expressionsAndLimits: [
        {
            expression: "success = false",
            limit: 5,
        },
        {
            expression: "success = true",
            limit: 1,
        },
    ],
    groupByFields: [],
    isPrototype: false,
    ordered: true,
    severity: 5,
    summaryExpression: "Signal summary",
    tags: ["_mitreAttackTactic:TA0009"],
    windowSize: "T30M",
});
resources:
  chainRule:
    type: sumologic:CseChainRule
    properties:
      description: Signal description
      enabled: true
      entitySelectors:
        - entityType: _username
          expression: user_username
      expressionsAndLimits:
        - expression: success = false
          limit: 5
        - expression: success = true
          limit: 1
      groupByFields: []
      isPrototype: false
      ordered: true
      severity: 5
      summaryExpression: Signal summary
      tags:
        - _mitreAttackTactic:TA0009
      windowSize: T30M

Create CseChainRule Resource

new CseChainRule(name: string, args: CseChainRuleArgs, opts?: CustomResourceOptions);
@overload
def CseChainRule(resource_name: str,
                 opts: Optional[ResourceOptions] = None,
                 description: Optional[str] = None,
                 enabled: Optional[bool] = None,
                 entity_selectors: Optional[Sequence[CseChainRuleEntitySelectorArgs]] = None,
                 expressions_and_limits: Optional[Sequence[CseChainRuleExpressionsAndLimitArgs]] = None,
                 group_by_fields: Optional[Sequence[str]] = None,
                 is_prototype: Optional[bool] = None,
                 name: Optional[str] = None,
                 ordered: Optional[bool] = None,
                 severity: Optional[int] = None,
                 summary_expression: Optional[str] = None,
                 tags: Optional[Sequence[str]] = None,
                 window_size: Optional[str] = None)
@overload
def CseChainRule(resource_name: str,
                 args: CseChainRuleArgs,
                 opts: Optional[ResourceOptions] = None)
func NewCseChainRule(ctx *Context, name string, args CseChainRuleArgs, opts ...ResourceOption) (*CseChainRule, error)
public CseChainRule(string name, CseChainRuleArgs args, CustomResourceOptions? opts = null)
public CseChainRule(String name, CseChainRuleArgs args)
public CseChainRule(String name, CseChainRuleArgs args, CustomResourceOptions options)
type: sumologic:CseChainRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

name string
The unique name of the resource.
args CseChainRuleArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name str
The unique name of the resource.
args CseChainRuleArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name string
The unique name of the resource.
args CseChainRuleArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name string
The unique name of the resource.
args CseChainRuleArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name String
The unique name of the resource.
args CseChainRuleArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

CseChainRule Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The CseChainRule resource accepts the following input properties:

Description string

The description of the generated Signals

Enabled bool

Whether the rule should generate Signals

EntitySelectors List<Pulumi.SumoLogic.Inputs.CseChainRuleEntitySelectorArgs>

The entities to generate Signals on

ExpressionsAndLimits List<Pulumi.SumoLogic.Inputs.CseChainRuleExpressionsAndLimitArgs>

The list of expressions and associated limits to make up the conditions of the chain rule

Severity int

The severity of the generated Signals

WindowSize string

How long of a window to aggregate records for. Current acceptable values are T05M, T10M, T30M, T60M, T24H, T12H, or T05D.

The following attributes are exported:

GroupByFields List<string>

A list of fields to group records by

IsPrototype bool

Whether the generated Signals should be prototype Signals

Name string

The name of the Rule and the generated SignalS

Ordered bool

Whether the records matching the expressions must be in the same chronological order as the expressions are listed in the rule

SummaryExpression string

The summary of the generated Signals

Tags List<string>

The tags of the generated Signals

Description string

The description of the generated Signals

Enabled bool

Whether the rule should generate Signals

EntitySelectors []CseChainRuleEntitySelectorArgs

The entities to generate Signals on

ExpressionsAndLimits []CseChainRuleExpressionsAndLimitArgs

The list of expressions and associated limits to make up the conditions of the chain rule

Severity int

The severity of the generated Signals

WindowSize string

How long of a window to aggregate records for. Current acceptable values are T05M, T10M, T30M, T60M, T24H, T12H, or T05D.

The following attributes are exported:

GroupByFields []string

A list of fields to group records by

IsPrototype bool

Whether the generated Signals should be prototype Signals

Name string

The name of the Rule and the generated SignalS

Ordered bool

Whether the records matching the expressions must be in the same chronological order as the expressions are listed in the rule

SummaryExpression string

The summary of the generated Signals

Tags []string

The tags of the generated Signals

description String

The description of the generated Signals

enabled Boolean

Whether the rule should generate Signals

entitySelectors List<CseChainRuleEntitySelectorArgs>

The entities to generate Signals on

expressionsAndLimits List<CseChainRuleExpressionsAndLimitArgs>

The list of expressions and associated limits to make up the conditions of the chain rule

severity Integer

The severity of the generated Signals

windowSize String

How long of a window to aggregate records for. Current acceptable values are T05M, T10M, T30M, T60M, T24H, T12H, or T05D.

The following attributes are exported:

groupByFields List<String>

A list of fields to group records by

isPrototype Boolean

Whether the generated Signals should be prototype Signals

name String

The name of the Rule and the generated SignalS

ordered Boolean

Whether the records matching the expressions must be in the same chronological order as the expressions are listed in the rule

summaryExpression String

The summary of the generated Signals

tags List<String>

The tags of the generated Signals

description string

The description of the generated Signals

enabled boolean

Whether the rule should generate Signals

entitySelectors CseChainRuleEntitySelectorArgs[]

The entities to generate Signals on

expressionsAndLimits CseChainRuleExpressionsAndLimitArgs[]

The list of expressions and associated limits to make up the conditions of the chain rule

severity number

The severity of the generated Signals

windowSize string

How long of a window to aggregate records for. Current acceptable values are T05M, T10M, T30M, T60M, T24H, T12H, or T05D.

The following attributes are exported:

groupByFields string[]

A list of fields to group records by

isPrototype boolean

Whether the generated Signals should be prototype Signals

name string

The name of the Rule and the generated SignalS

ordered boolean

Whether the records matching the expressions must be in the same chronological order as the expressions are listed in the rule

summaryExpression string

The summary of the generated Signals

tags string[]

The tags of the generated Signals

description str

The description of the generated Signals

enabled bool

Whether the rule should generate Signals

entity_selectors Sequence[CseChainRuleEntitySelectorArgs]

The entities to generate Signals on

expressions_and_limits Sequence[CseChainRuleExpressionsAndLimitArgs]

The list of expressions and associated limits to make up the conditions of the chain rule

severity int

The severity of the generated Signals

window_size str

How long of a window to aggregate records for. Current acceptable values are T05M, T10M, T30M, T60M, T24H, T12H, or T05D.

The following attributes are exported:

group_by_fields Sequence[str]

A list of fields to group records by

is_prototype bool

Whether the generated Signals should be prototype Signals

name str

The name of the Rule and the generated SignalS

ordered bool

Whether the records matching the expressions must be in the same chronological order as the expressions are listed in the rule

summary_expression str

The summary of the generated Signals

tags Sequence[str]

The tags of the generated Signals

description String

The description of the generated Signals

enabled Boolean

Whether the rule should generate Signals

entitySelectors List<Property Map>

The entities to generate Signals on

expressionsAndLimits List<Property Map>

The list of expressions and associated limits to make up the conditions of the chain rule

severity Number

The severity of the generated Signals

windowSize String

How long of a window to aggregate records for. Current acceptable values are T05M, T10M, T30M, T60M, T24H, T12H, or T05D.

The following attributes are exported:

groupByFields List<String>

A list of fields to group records by

isPrototype Boolean

Whether the generated Signals should be prototype Signals

name String

The name of the Rule and the generated SignalS

ordered Boolean

Whether the records matching the expressions must be in the same chronological order as the expressions are listed in the rule

summaryExpression String

The summary of the generated Signals

tags List<String>

The tags of the generated Signals

Outputs

All input properties are implicitly available as output properties. Additionally, the CseChainRule resource produces the following output properties:

Id string

The provider-assigned unique ID for this managed resource.

Id string

The provider-assigned unique ID for this managed resource.

id String

The provider-assigned unique ID for this managed resource.

id string

The provider-assigned unique ID for this managed resource.

id str

The provider-assigned unique ID for this managed resource.

id String

The provider-assigned unique ID for this managed resource.

Look up Existing CseChainRule Resource

Get an existing CseChainRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: CseChainRuleState, opts?: CustomResourceOptions): CseChainRule
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        description: Optional[str] = None,
        enabled: Optional[bool] = None,
        entity_selectors: Optional[Sequence[CseChainRuleEntitySelectorArgs]] = None,
        expressions_and_limits: Optional[Sequence[CseChainRuleExpressionsAndLimitArgs]] = None,
        group_by_fields: Optional[Sequence[str]] = None,
        is_prototype: Optional[bool] = None,
        name: Optional[str] = None,
        ordered: Optional[bool] = None,
        severity: Optional[int] = None,
        summary_expression: Optional[str] = None,
        tags: Optional[Sequence[str]] = None,
        window_size: Optional[str] = None) -> CseChainRule
func GetCseChainRule(ctx *Context, name string, id IDInput, state *CseChainRuleState, opts ...ResourceOption) (*CseChainRule, error)
public static CseChainRule Get(string name, Input<string> id, CseChainRuleState? state, CustomResourceOptions? opts = null)
public static CseChainRule get(String name, Output<String> id, CseChainRuleState state, CustomResourceOptions options)
Resource lookup is not supported in YAML
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
The following state arguments are supported:
Description string

The description of the generated Signals

Enabled bool

Whether the rule should generate Signals

EntitySelectors List<Pulumi.SumoLogic.Inputs.CseChainRuleEntitySelectorArgs>

The entities to generate Signals on

ExpressionsAndLimits List<Pulumi.SumoLogic.Inputs.CseChainRuleExpressionsAndLimitArgs>

The list of expressions and associated limits to make up the conditions of the chain rule

GroupByFields List<string>

A list of fields to group records by

IsPrototype bool

Whether the generated Signals should be prototype Signals

Name string

The name of the Rule and the generated SignalS

Ordered bool

Whether the records matching the expressions must be in the same chronological order as the expressions are listed in the rule

Severity int

The severity of the generated Signals

SummaryExpression string

The summary of the generated Signals

Tags List<string>

The tags of the generated Signals

WindowSize string

How long of a window to aggregate records for. Current acceptable values are T05M, T10M, T30M, T60M, T24H, T12H, or T05D.

The following attributes are exported:

Description string

The description of the generated Signals

Enabled bool

Whether the rule should generate Signals

EntitySelectors []CseChainRuleEntitySelectorArgs

The entities to generate Signals on

ExpressionsAndLimits []CseChainRuleExpressionsAndLimitArgs

The list of expressions and associated limits to make up the conditions of the chain rule

GroupByFields []string

A list of fields to group records by

IsPrototype bool

Whether the generated Signals should be prototype Signals

Name string

The name of the Rule and the generated SignalS

Ordered bool

Whether the records matching the expressions must be in the same chronological order as the expressions are listed in the rule

Severity int

The severity of the generated Signals

SummaryExpression string

The summary of the generated Signals

Tags []string

The tags of the generated Signals

WindowSize string

How long of a window to aggregate records for. Current acceptable values are T05M, T10M, T30M, T60M, T24H, T12H, or T05D.

The following attributes are exported:

description String

The description of the generated Signals

enabled Boolean

Whether the rule should generate Signals

entitySelectors List<CseChainRuleEntitySelectorArgs>

The entities to generate Signals on

expressionsAndLimits List<CseChainRuleExpressionsAndLimitArgs>

The list of expressions and associated limits to make up the conditions of the chain rule

groupByFields List<String>

A list of fields to group records by

isPrototype Boolean

Whether the generated Signals should be prototype Signals

name String

The name of the Rule and the generated SignalS

ordered Boolean

Whether the records matching the expressions must be in the same chronological order as the expressions are listed in the rule

severity Integer

The severity of the generated Signals

summaryExpression String

The summary of the generated Signals

tags List<String>

The tags of the generated Signals

windowSize String

How long of a window to aggregate records for. Current acceptable values are T05M, T10M, T30M, T60M, T24H, T12H, or T05D.

The following attributes are exported:

description string

The description of the generated Signals

enabled boolean

Whether the rule should generate Signals

entitySelectors CseChainRuleEntitySelectorArgs[]

The entities to generate Signals on

expressionsAndLimits CseChainRuleExpressionsAndLimitArgs[]

The list of expressions and associated limits to make up the conditions of the chain rule

groupByFields string[]

A list of fields to group records by

isPrototype boolean

Whether the generated Signals should be prototype Signals

name string

The name of the Rule and the generated SignalS

ordered boolean

Whether the records matching the expressions must be in the same chronological order as the expressions are listed in the rule

severity number

The severity of the generated Signals

summaryExpression string

The summary of the generated Signals

tags string[]

The tags of the generated Signals

windowSize string

How long of a window to aggregate records for. Current acceptable values are T05M, T10M, T30M, T60M, T24H, T12H, or T05D.

The following attributes are exported:

description str

The description of the generated Signals

enabled bool

Whether the rule should generate Signals

entity_selectors Sequence[CseChainRuleEntitySelectorArgs]

The entities to generate Signals on

expressions_and_limits Sequence[CseChainRuleExpressionsAndLimitArgs]

The list of expressions and associated limits to make up the conditions of the chain rule

group_by_fields Sequence[str]

A list of fields to group records by

is_prototype bool

Whether the generated Signals should be prototype Signals

name str

The name of the Rule and the generated SignalS

ordered bool

Whether the records matching the expressions must be in the same chronological order as the expressions are listed in the rule

severity int

The severity of the generated Signals

summary_expression str

The summary of the generated Signals

tags Sequence[str]

The tags of the generated Signals

window_size str

How long of a window to aggregate records for. Current acceptable values are T05M, T10M, T30M, T60M, T24H, T12H, or T05D.

The following attributes are exported:

description String

The description of the generated Signals

enabled Boolean

Whether the rule should generate Signals

entitySelectors List<Property Map>

The entities to generate Signals on

expressionsAndLimits List<Property Map>

The list of expressions and associated limits to make up the conditions of the chain rule

groupByFields List<String>

A list of fields to group records by

isPrototype Boolean

Whether the generated Signals should be prototype Signals

name String

The name of the Rule and the generated SignalS

ordered Boolean

Whether the records matching the expressions must be in the same chronological order as the expressions are listed in the rule

severity Number

The severity of the generated Signals

summaryExpression String

The summary of the generated Signals

tags List<String>

The tags of the generated Signals

windowSize String

How long of a window to aggregate records for. Current acceptable values are T05M, T10M, T30M, T60M, T24H, T12H, or T05D.

The following attributes are exported:

Supporting Types

CseChainRuleEntitySelector

EntityType string
Expression string

The expression for which records to match on

EntityType string
Expression string

The expression for which records to match on

entityType String
expression String

The expression for which records to match on

entityType string
expression string

The expression for which records to match on

entity_type str
expression str

The expression for which records to match on

entityType String
expression String

The expression for which records to match on

CseChainRuleExpressionsAndLimit

Expression string

The expression for which records to match on

Limit int

How many times this expression must match for the Signal to fire

Expression string

The expression for which records to match on

Limit int

How many times this expression must match for the Signal to fire

expression String

The expression for which records to match on

limit Integer

How many times this expression must match for the Signal to fire

expression string

The expression for which records to match on

limit number

How many times this expression must match for the Signal to fire

expression str

The expression for which records to match on

limit int

How many times this expression must match for the Signal to fire

expression String

The expression for which records to match on

limit Number

How many times this expression must match for the Signal to fire

Import

Chain Rules can be imported using the field id, e.g.hcl

 $ pulumi import sumologic:index/cseChainRule:CseChainRule chain_rule id

Package Details

Repository
Sumo Logic pulumi/pulumi-sumologic
License
Apache-2.0
Notes

This Pulumi package is based on the sumologic Terraform Provider.