Docs
Packagessumologic.CseFirstSeenRule
Explore with Pulumi AI
Provides a Sumo Logic CSE First Seen Rule.
Example Usage
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using SumoLogic = Pulumi.SumoLogic;
return await Deployment.RunAsync(() =>
{
var firstSeenRule = new SumoLogic.CseFirstSeenRule("firstSeenRule", new()
{
BaselineType = "PER_ENTITY",
BaselineWindowSize = "35000",
DescriptionExpression = "First User Login - {{ user_username }}",
Enabled = true,
EntitySelectors = new[]
{
new SumoLogic.Inputs.CseFirstSeenRuleEntitySelectorArgs
{
EntityType = "_username",
Expression = "user_username",
},
new SumoLogic.Inputs.CseFirstSeenRuleEntitySelectorArgs
{
EntityType = "_hostname",
Expression = "dstDevice_hostname",
},
},
FilterExpression = "objectType=\"Network\"",
GroupByFields = new[]
{
"user_username",
},
IsPrototype = false,
NameExpression = "First User Login - {{ user_username }}",
RetentionWindowSize = "86400000",
Severity = 1,
ValueFields = new[]
{
"dstDevice_hostname",
},
});
});
package main
import (
"github.com/pulumi/pulumi-sumologic/sdk/go/sumologic"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := sumologic.NewCseFirstSeenRule(ctx, "firstSeenRule", &sumologic.CseFirstSeenRuleArgs{
BaselineType: pulumi.String("PER_ENTITY"),
BaselineWindowSize: pulumi.String("35000"),
DescriptionExpression: pulumi.String("First User Login - {{ user_username }}"),
Enabled: pulumi.Bool(true),
EntitySelectors: sumologic.CseFirstSeenRuleEntitySelectorArray{
&sumologic.CseFirstSeenRuleEntitySelectorArgs{
EntityType: pulumi.String("_username"),
Expression: pulumi.String("user_username"),
},
&sumologic.CseFirstSeenRuleEntitySelectorArgs{
EntityType: pulumi.String("_hostname"),
Expression: pulumi.String("dstDevice_hostname"),
},
},
FilterExpression: pulumi.String("objectType=\"Network\""),
GroupByFields: pulumi.StringArray{
pulumi.String("user_username"),
},
IsPrototype: pulumi.Bool(false),
NameExpression: pulumi.String("First User Login - {{ user_username }}"),
RetentionWindowSize: pulumi.String("86400000"),
Severity: pulumi.Int(1),
ValueFields: pulumi.StringArray{
pulumi.String("dstDevice_hostname"),
},
})
if err != nil {
return err
}
return nil
})
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.sumologic.CseFirstSeenRule;
import com.pulumi.sumologic.CseFirstSeenRuleArgs;
import com.pulumi.sumologic.inputs.CseFirstSeenRuleEntitySelectorArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var firstSeenRule = new CseFirstSeenRule("firstSeenRule", CseFirstSeenRuleArgs.builder()
.baselineType("PER_ENTITY")
.baselineWindowSize("35000")
.descriptionExpression("First User Login - {{ user_username }}")
.enabled(true)
.entitySelectors(
CseFirstSeenRuleEntitySelectorArgs.builder()
.entityType("_username")
.expression("user_username")
.build(),
CseFirstSeenRuleEntitySelectorArgs.builder()
.entityType("_hostname")
.expression("dstDevice_hostname")
.build())
.filterExpression("objectType=\"Network\"")
.groupByFields("user_username")
.isPrototype(false)
.nameExpression("First User Login - {{ user_username }}")
.retentionWindowSize("86400000")
.severity(1)
.valueFields("dstDevice_hostname")
.build());
}
}
import pulumi
import pulumi_sumologic as sumologic
first_seen_rule = sumologic.CseFirstSeenRule("firstSeenRule",
baseline_type="PER_ENTITY",
baseline_window_size="35000",
description_expression="First User Login - {{ user_username }}",
enabled=True,
entity_selectors=[
sumologic.CseFirstSeenRuleEntitySelectorArgs(
entity_type="_username",
expression="user_username",
),
sumologic.CseFirstSeenRuleEntitySelectorArgs(
entity_type="_hostname",
expression="dstDevice_hostname",
),
],
filter_expression="objectType=\"Network\"",
group_by_fields=["user_username"],
is_prototype=False,
name_expression="First User Login - {{ user_username }}",
retention_window_size="86400000",
severity=1,
value_fields=["dstDevice_hostname"])
import * as pulumi from "@pulumi/pulumi";
import * as sumologic from "@pulumi/sumologic";
const firstSeenRule = new sumologic.CseFirstSeenRule("firstSeenRule", {
baselineType: "PER_ENTITY",
baselineWindowSize: "35000",
descriptionExpression: "First User Login - {{ user_username }}",
enabled: true,
entitySelectors: [
{
entityType: "_username",
expression: "user_username",
},
{
entityType: "_hostname",
expression: "dstDevice_hostname",
},
],
filterExpression: "objectType=\"Network\"",
groupByFields: ["user_username"],
isPrototype: false,
nameExpression: "First User Login - {{ user_username }}",
retentionWindowSize: "86400000",
severity: 1,
valueFields: ["dstDevice_hostname"],
});
resources:
firstSeenRule:
type: sumologic:CseFirstSeenRule
properties:
baselineType: PER_ENTITY
baselineWindowSize: '35000'
descriptionExpression: First User Login - {{ user_username }}
enabled: true
entitySelectors:
- entityType: _username
expression: user_username
- entityType: _hostname
expression: dstDevice_hostname
filterExpression: objectType="Network"
groupByFields:
- user_username
isPrototype: false
nameExpression: First User Login - {{ user_username }}
retentionWindowSize: '86400000'
severity: 1
valueFields:
- dstDevice_hostname
Create CseFirstSeenRule Resource
new CseFirstSeenRule(name: string, args: CseFirstSeenRuleArgs, opts?: CustomResourceOptions);@overload
def CseFirstSeenRule(resource_name: str,
opts: Optional[ResourceOptions] = None,
baseline_type: Optional[str] = None,
baseline_window_size: Optional[str] = None,
description_expression: Optional[str] = None,
enabled: Optional[bool] = None,
entity_selectors: Optional[Sequence[CseFirstSeenRuleEntitySelectorArgs]] = None,
filter_expression: Optional[str] = None,
group_by_fields: Optional[Sequence[str]] = None,
is_prototype: Optional[bool] = None,
name: Optional[str] = None,
name_expression: Optional[str] = None,
retention_window_size: Optional[str] = None,
severity: Optional[int] = None,
summary_expression: Optional[str] = None,
tags: Optional[Sequence[str]] = None,
value_fields: Optional[Sequence[str]] = None)
@overload
def CseFirstSeenRule(resource_name: str,
args: CseFirstSeenRuleArgs,
opts: Optional[ResourceOptions] = None)func NewCseFirstSeenRule(ctx *Context, name string, args CseFirstSeenRuleArgs, opts ...ResourceOption) (*CseFirstSeenRule, error)public CseFirstSeenRule(string name, CseFirstSeenRuleArgs args, CustomResourceOptions? opts = null)
public CseFirstSeenRule(String name, CseFirstSeenRuleArgs args)
public CseFirstSeenRule(String name, CseFirstSeenRuleArgs args, CustomResourceOptions options)
type: sumologic:CseFirstSeenRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args CseFirstSeenRuleArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args CseFirstSeenRuleArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args CseFirstSeenRuleArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args CseFirstSeenRuleArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args CseFirstSeenRuleArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
CseFirstSeenRule Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
The CseFirstSeenRule resource accepts the following input properties:
- Baseline
Type string The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
- Baseline
Window stringSize The baseline window size in milliseconds
- Description
Expression string The description of the generated Signals
- Enabled bool
Whether the rule should generate Signals
- Entity
Selectors List<Pulumi.Sumo Logic. Inputs. Cse First Seen Rule Entity Selector> The entities to generate Signals on
- Filter
Expression string The expression for which records to match on
- Name
Expression string The name of the generated Signals
- Retention
Window stringSize The retention window size in milliseconds
- Severity int
The severity of the generated Signals
- Value
Fields List<string> The value fields
The following attributes are exported:
- Group
By List<string>Fields A list of fields to group records by
- Is
Prototype bool Whether the generated Signals should be prototype Signals
- Name string
The name of the Rule
- Summary
Expression string The summary of the generated Signals
- List<string>
The tags of the generated Signals
- Baseline
Type string The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
- Baseline
Window stringSize The baseline window size in milliseconds
- Description
Expression string The description of the generated Signals
- Enabled bool
Whether the rule should generate Signals
- Entity
Selectors []CseFirst Seen Rule Entity Selector Args The entities to generate Signals on
- Filter
Expression string The expression for which records to match on
- Name
Expression string The name of the generated Signals
- Retention
Window stringSize The retention window size in milliseconds
- Severity int
The severity of the generated Signals
- Value
Fields []string The value fields
The following attributes are exported:
- Group
By []stringFields A list of fields to group records by
- Is
Prototype bool Whether the generated Signals should be prototype Signals
- Name string
The name of the Rule
- Summary
Expression string The summary of the generated Signals
- []string
The tags of the generated Signals
- baseline
Type String The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
- baseline
Window StringSize The baseline window size in milliseconds
- description
Expression String The description of the generated Signals
- enabled Boolean
Whether the rule should generate Signals
- entity
Selectors List<CseFirst Seen Rule Entity Selector> The entities to generate Signals on
- filter
Expression String The expression for which records to match on
- name
Expression String The name of the generated Signals
- retention
Window StringSize The retention window size in milliseconds
- severity Integer
The severity of the generated Signals
- value
Fields List<String> The value fields
The following attributes are exported:
- group
By List<String>Fields A list of fields to group records by
- is
Prototype Boolean Whether the generated Signals should be prototype Signals
- name String
The name of the Rule
- summary
Expression String The summary of the generated Signals
- List<String>
The tags of the generated Signals
- baseline
Type string The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
- baseline
Window stringSize The baseline window size in milliseconds
- description
Expression string The description of the generated Signals
- enabled boolean
Whether the rule should generate Signals
- entity
Selectors CseFirst Seen Rule Entity Selector[] The entities to generate Signals on
- filter
Expression string The expression for which records to match on
- name
Expression string The name of the generated Signals
- retention
Window stringSize The retention window size in milliseconds
- severity number
The severity of the generated Signals
- value
Fields string[] The value fields
The following attributes are exported:
- group
By string[]Fields A list of fields to group records by
- is
Prototype boolean Whether the generated Signals should be prototype Signals
- name string
The name of the Rule
- summary
Expression string The summary of the generated Signals
- string[]
The tags of the generated Signals
- baseline_
type str The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
- baseline_
window_ strsize The baseline window size in milliseconds
- description_
expression str The description of the generated Signals
- enabled bool
Whether the rule should generate Signals
- entity_
selectors Sequence[CseFirst Seen Rule Entity Selector Args] The entities to generate Signals on
- filter_
expression str The expression for which records to match on
- name_
expression str The name of the generated Signals
- retention_
window_ strsize The retention window size in milliseconds
- severity int
The severity of the generated Signals
- value_
fields Sequence[str] The value fields
The following attributes are exported:
- group_
by_ Sequence[str]fields A list of fields to group records by
- is_
prototype bool Whether the generated Signals should be prototype Signals
- name str
The name of the Rule
- summary_
expression str The summary of the generated Signals
- Sequence[str]
The tags of the generated Signals
- baseline
Type String The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
- baseline
Window StringSize The baseline window size in milliseconds
- description
Expression String The description of the generated Signals
- enabled Boolean
Whether the rule should generate Signals
- entity
Selectors List<Property Map> The entities to generate Signals on
- filter
Expression String The expression for which records to match on
- name
Expression String The name of the generated Signals
- retention
Window StringSize The retention window size in milliseconds
- severity Number
The severity of the generated Signals
- value
Fields List<String> The value fields
The following attributes are exported:
- group
By List<String>Fields A list of fields to group records by
- is
Prototype Boolean Whether the generated Signals should be prototype Signals
- name String
The name of the Rule
- summary
Expression String The summary of the generated Signals
- List<String>
The tags of the generated Signals
Outputs
All input properties are implicitly available as output properties. Additionally, the CseFirstSeenRule resource produces the following output properties:
- Id string
The provider-assigned unique ID for this managed resource.
- Id string
The provider-assigned unique ID for this managed resource.
- id String
The provider-assigned unique ID for this managed resource.
- id string
The provider-assigned unique ID for this managed resource.
- id str
The provider-assigned unique ID for this managed resource.
- id String
The provider-assigned unique ID for this managed resource.
Look up Existing CseFirstSeenRule Resource
Get an existing CseFirstSeenRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: CseFirstSeenRuleState, opts?: CustomResourceOptions): CseFirstSeenRule@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
baseline_type: Optional[str] = None,
baseline_window_size: Optional[str] = None,
description_expression: Optional[str] = None,
enabled: Optional[bool] = None,
entity_selectors: Optional[Sequence[CseFirstSeenRuleEntitySelectorArgs]] = None,
filter_expression: Optional[str] = None,
group_by_fields: Optional[Sequence[str]] = None,
is_prototype: Optional[bool] = None,
name: Optional[str] = None,
name_expression: Optional[str] = None,
retention_window_size: Optional[str] = None,
severity: Optional[int] = None,
summary_expression: Optional[str] = None,
tags: Optional[Sequence[str]] = None,
value_fields: Optional[Sequence[str]] = None) -> CseFirstSeenRulefunc GetCseFirstSeenRule(ctx *Context, name string, id IDInput, state *CseFirstSeenRuleState, opts ...ResourceOption) (*CseFirstSeenRule, error)public static CseFirstSeenRule Get(string name, Input<string> id, CseFirstSeenRuleState? state, CustomResourceOptions? opts = null)public static CseFirstSeenRule get(String name, Output<String> id, CseFirstSeenRuleState state, CustomResourceOptions options)Resource lookup is not supported in YAML- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Baseline
Type string The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
- Baseline
Window stringSize The baseline window size in milliseconds
- Description
Expression string The description of the generated Signals
- Enabled bool
Whether the rule should generate Signals
- Entity
Selectors List<Pulumi.Sumo Logic. Inputs. Cse First Seen Rule Entity Selector> The entities to generate Signals on
- Filter
Expression string The expression for which records to match on
- Group
By List<string>Fields A list of fields to group records by
- Is
Prototype bool Whether the generated Signals should be prototype Signals
- Name string
The name of the Rule
- Name
Expression string The name of the generated Signals
- Retention
Window stringSize The retention window size in milliseconds
- Severity int
The severity of the generated Signals
- Summary
Expression string The summary of the generated Signals
- List<string>
The tags of the generated Signals
- Value
Fields List<string> The value fields
The following attributes are exported:
- Baseline
Type string The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
- Baseline
Window stringSize The baseline window size in milliseconds
- Description
Expression string The description of the generated Signals
- Enabled bool
Whether the rule should generate Signals
- Entity
Selectors []CseFirst Seen Rule Entity Selector Args The entities to generate Signals on
- Filter
Expression string The expression for which records to match on
- Group
By []stringFields A list of fields to group records by
- Is
Prototype bool Whether the generated Signals should be prototype Signals
- Name string
The name of the Rule
- Name
Expression string The name of the generated Signals
- Retention
Window stringSize The retention window size in milliseconds
- Severity int
The severity of the generated Signals
- Summary
Expression string The summary of the generated Signals
- []string
The tags of the generated Signals
- Value
Fields []string The value fields
The following attributes are exported:
- baseline
Type String The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
- baseline
Window StringSize The baseline window size in milliseconds
- description
Expression String The description of the generated Signals
- enabled Boolean
Whether the rule should generate Signals
- entity
Selectors List<CseFirst Seen Rule Entity Selector> The entities to generate Signals on
- filter
Expression String The expression for which records to match on
- group
By List<String>Fields A list of fields to group records by
- is
Prototype Boolean Whether the generated Signals should be prototype Signals
- name String
The name of the Rule
- name
Expression String The name of the generated Signals
- retention
Window StringSize The retention window size in milliseconds
- severity Integer
The severity of the generated Signals
- summary
Expression String The summary of the generated Signals
- List<String>
The tags of the generated Signals
- value
Fields List<String> The value fields
The following attributes are exported:
- baseline
Type string The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
- baseline
Window stringSize The baseline window size in milliseconds
- description
Expression string The description of the generated Signals
- enabled boolean
Whether the rule should generate Signals
- entity
Selectors CseFirst Seen Rule Entity Selector[] The entities to generate Signals on
- filter
Expression string The expression for which records to match on
- group
By string[]Fields A list of fields to group records by
- is
Prototype boolean Whether the generated Signals should be prototype Signals
- name string
The name of the Rule
- name
Expression string The name of the generated Signals
- retention
Window stringSize The retention window size in milliseconds
- severity number
The severity of the generated Signals
- summary
Expression string The summary of the generated Signals
- string[]
The tags of the generated Signals
- value
Fields string[] The value fields
The following attributes are exported:
- baseline_
type str The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
- baseline_
window_ strsize The baseline window size in milliseconds
- description_
expression str The description of the generated Signals
- enabled bool
Whether the rule should generate Signals
- entity_
selectors Sequence[CseFirst Seen Rule Entity Selector Args] The entities to generate Signals on
- filter_
expression str The expression for which records to match on
- group_
by_ Sequence[str]fields A list of fields to group records by
- is_
prototype bool Whether the generated Signals should be prototype Signals
- name str
The name of the Rule
- name_
expression str The name of the generated Signals
- retention_
window_ strsize The retention window size in milliseconds
- severity int
The severity of the generated Signals
- summary_
expression str The summary of the generated Signals
- Sequence[str]
The tags of the generated Signals
- value_
fields Sequence[str] The value fields
The following attributes are exported:
- baseline
Type String The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
- baseline
Window StringSize The baseline window size in milliseconds
- description
Expression String The description of the generated Signals
- enabled Boolean
Whether the rule should generate Signals
- entity
Selectors List<Property Map> The entities to generate Signals on
- filter
Expression String The expression for which records to match on
- group
By List<String>Fields A list of fields to group records by
- is
Prototype Boolean Whether the generated Signals should be prototype Signals
- name String
The name of the Rule
- name
Expression String The name of the generated Signals
- retention
Window StringSize The retention window size in milliseconds
- severity Number
The severity of the generated Signals
- summary
Expression String The summary of the generated Signals
- List<String>
The tags of the generated Signals
- value
Fields List<String> The value fields
The following attributes are exported:
Supporting Types
CseFirstSeenRuleEntitySelector, CseFirstSeenRuleEntitySelectorArgs
- Entity
Type string - Expression string
The expression or field name to generate the Signal on
- Entity
Type string - Expression string
The expression or field name to generate the Signal on
- entity
Type String - expression String
The expression or field name to generate the Signal on
- entity
Type string - expression string
The expression or field name to generate the Signal on
- entity_
type str - expression str
The expression or field name to generate the Signal on
- entity
Type String - expression String
The expression or field name to generate the Signal on
Import
First Seen Rules can be imported using the field id, e.g.hcl
$ pulumi import sumologic:index/cseFirstSeenRule:CseFirstSeenRule first_seen_rule id
Package Details
- Repository
- Sumo Logic pulumi/pulumi-sumologic
- License
- Apache-2.0
- Notes
This Pulumi package is based on the
sumologicTerraform Provider.