sumologic .Cse Sigma Rule

EntitySelectors List<CseSigmaRuleEntitySelector>

The description of the generated Signals. Defaults to the converted Sigma value.

The entities to generate Signals on. Defaults to the converted Sigma value.

Expression string

The expression for which records to match on. Defaults to the converted Sigma value.

IsPrototype bool

Whether the generated Signals should be prototype Signals. Defaults to the converted Sigma value.

Name string

The name of the Rule. Defaults to the name of the Sigma rule.

NameExpression string

The name of the generated Signals. Defaults to the converted Sigma value.

SeverityMapping CseSigmaRuleSeverityMapping

The configuration of how the severity of the Signals should be mapped from the Records. Defaults to the converted Sigma value.

The summary of the generated Signals. Defaults to the converted Sigma value.

SuppressionWindowSize double

For how long to suppress Signal generation, in milliseconds. Must be between 0 and the global limit of 7 days.

The following attributes are exported:

Tags List<string>

The tags of the generated Signals. Defaults to the converted Sigma value.

Enabled bool

Whether the rule should generate Signals

SigmaId string

The ID (UUID) of the Sigma rule to import. Changing this forces a new rule to be created.

CseSigmaRuleId string

The internal ID of the rule.

EntitySelectors []CseSigmaRuleEntitySelectorArgs

The description of the generated Signals. Defaults to the converted Sigma value.

The entities to generate Signals on. Defaults to the converted Sigma value.

Expression string

The expression for which records to match on. Defaults to the converted Sigma value.

IsPrototype bool

Whether the generated Signals should be prototype Signals. Defaults to the converted Sigma value.

Name string

The name of the Rule. Defaults to the name of the Sigma rule.

NameExpression string

The name of the generated Signals. Defaults to the converted Sigma value.

SeverityMapping CseSigmaRuleSeverityMappingArgs

The configuration of how the severity of the Signals should be mapped from the Records. Defaults to the converted Sigma value.

entity_selectors list(object)

The summary of the generated Signals. Defaults to the converted Sigma value.

SuppressionWindowSize float64

For how long to suppress Signal generation, in milliseconds. Must be between 0 and the global limit of 7 days.

The following attributes are exported:

Tags []string

The tags of the generated Signals. Defaults to the converted Sigma value.

enabled bool

Whether the rule should generate Signals

sigma_id string

The ID (UUID) of the Sigma rule to import. Changing this forces a new rule to be created.

cse_sigma_rule_id string

The internal ID of the rule.

description_expression string

The description of the generated Signals. Defaults to the converted Sigma value.

The entities to generate Signals on. Defaults to the converted Sigma value.

expression string

The expression for which records to match on. Defaults to the converted Sigma value.

severity_mapping object

Whether the generated Signals should be prototype Signals. Defaults to the converted Sigma value.

name string

The name of the Rule. Defaults to the name of the Sigma rule.

name_expression string

The name of the generated Signals. Defaults to the converted Sigma value.

The configuration of how the severity of the Signals should be mapped from the Records. Defaults to the converted Sigma value.

summary_expression string

The summary of the generated Signals. Defaults to the converted Sigma value.

suppression_window_size number

For how long to suppress Signal generation, in milliseconds. Must be between 0 and the global limit of 7 days.

The following attributes are exported:

tags list(string)

The tags of the generated Signals. Defaults to the converted Sigma value.

enabled Boolean

Whether the rule should generate Signals

sigmaId String

The ID (UUID) of the Sigma rule to import. Changing this forces a new rule to be created.

cseSigmaRuleId String

The internal ID of the rule.

entitySelectors List<CseSigmaRuleEntitySelector>

The description of the generated Signals. Defaults to the converted Sigma value.

The entities to generate Signals on. Defaults to the converted Sigma value.

expression String

The expression for which records to match on. Defaults to the converted Sigma value.

isPrototype Boolean

Whether the generated Signals should be prototype Signals. Defaults to the converted Sigma value.

name String

The name of the Rule. Defaults to the name of the Sigma rule.

nameExpression String

The name of the generated Signals. Defaults to the converted Sigma value.

The configuration of how the severity of the Signals should be mapped from the Records. Defaults to the converted Sigma value.

entitySelectors CseSigmaRuleEntitySelector[]

The summary of the generated Signals. Defaults to the converted Sigma value.

suppressionWindowSize Double

For how long to suppress Signal generation, in milliseconds. Must be between 0 and the global limit of 7 days.

The following attributes are exported:

tags List<String>

The tags of the generated Signals. Defaults to the converted Sigma value.

enabled boolean

Whether the rule should generate Signals

sigmaId string

The ID (UUID) of the Sigma rule to import. Changing this forces a new rule to be created.

cseSigmaRuleId string

The internal ID of the rule.

descriptionExpression string

The description of the generated Signals. Defaults to the converted Sigma value.

The entities to generate Signals on. Defaults to the converted Sigma value.

expression string

The expression for which records to match on. Defaults to the converted Sigma value.

isPrototype boolean

Whether the generated Signals should be prototype Signals. Defaults to the converted Sigma value.

name string

The name of the Rule. Defaults to the name of the Sigma rule.

nameExpression string

The name of the generated Signals. Defaults to the converted Sigma value.

entity_selectors Sequence[CseSigmaRuleEntitySelectorArgs]

The configuration of how the severity of the Signals should be mapped from the Records. Defaults to the converted Sigma value.

summaryExpression string

The summary of the generated Signals. Defaults to the converted Sigma value.

suppressionWindowSize number

For how long to suppress Signal generation, in milliseconds. Must be between 0 and the global limit of 7 days.

The following attributes are exported:

tags string[]

The tags of the generated Signals. Defaults to the converted Sigma value.

enabled bool

Whether the rule should generate Signals

sigma_id str

The ID (UUID) of the Sigma rule to import. Changing this forces a new rule to be created.

cse_sigma_rule_id str

The internal ID of the rule.

description_expression str

The description of the generated Signals. Defaults to the converted Sigma value.

The entities to generate Signals on. Defaults to the converted Sigma value.

expression str

The expression for which records to match on. Defaults to the converted Sigma value.

severity_mapping CseSigmaRuleSeverityMappingArgs

Whether the generated Signals should be prototype Signals. Defaults to the converted Sigma value.

name str

The name of the Rule. Defaults to the name of the Sigma rule.

name_expression str

The name of the generated Signals. Defaults to the converted Sigma value.

The configuration of how the severity of the Signals should be mapped from the Records. Defaults to the converted Sigma value.

summary_expression str

The summary of the generated Signals. Defaults to the converted Sigma value.

suppression_window_size float

For how long to suppress Signal generation, in milliseconds. Must be between 0 and the global limit of 7 days.

The following attributes are exported:

tags Sequence[str]

The tags of the generated Signals. Defaults to the converted Sigma value.

enabled Boolean

Whether the rule should generate Signals

sigmaId String

The ID (UUID) of the Sigma rule to import. Changing this forces a new rule to be created.

cseSigmaRuleId String

The internal ID of the rule.

entitySelectors List<Property Map>

The description of the generated Signals. Defaults to the converted Sigma value.

The entities to generate Signals on. Defaults to the converted Sigma value.

expression String

The expression for which records to match on. Defaults to the converted Sigma value.

isPrototype Boolean

Whether the generated Signals should be prototype Signals. Defaults to the converted Sigma value.

name String

The name of the Rule. Defaults to the name of the Sigma rule.

nameExpression String

The name of the generated Signals. Defaults to the converted Sigma value.

severityMapping Property Map

The configuration of how the severity of the Signals should be mapped from the Records. Defaults to the converted Sigma value.

The summary of the generated Signals. Defaults to the converted Sigma value.

suppressionWindowSize Number

For how long to suppress Signal generation, in milliseconds. Must be between 0 and the global limit of 7 days.

The following attributes are exported:

tags List<String>

The tags of the generated Signals. Defaults to the converted Sigma value.

Outputs

All input properties are implicitly available as output properties. Additionally, the CseSigmaRule resource produces the following output properties:

Category string: The category of the rule.
Id string: The provider-assigned unique ID for this managed resource.
OriginalSource string: The original source of the rule. Always sigma.

Category string: The category of the rule.
Id string: The provider-assigned unique ID for this managed resource.
OriginalSource string: The original source of the rule. Always sigma.

category string: The category of the rule.
id string: The provider-assigned unique ID for this managed resource.
original_source string: The original source of the rule. Always sigma.

category String: The category of the rule.
id String: The provider-assigned unique ID for this managed resource.
originalSource String: The original source of the rule. Always sigma.

category string: The category of the rule.
id string: The provider-assigned unique ID for this managed resource.
originalSource string: The original source of the rule. Always sigma.

category str: The category of the rule.
id str: The provider-assigned unique ID for this managed resource.
original_source str: The original source of the rule. Always sigma.

category String: The category of the rule.
id String: The provider-assigned unique ID for this managed resource.
originalSource String: The original source of the rule. Always sigma.

Look up Existing CseSigmaRule Resource

Get an existing CseSigmaRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: CseSigmaRuleState, opts?: CustomResourceOptions): CseSigmaRule

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        category: Optional[str] = None,
        cse_sigma_rule_id: Optional[str] = None,
        description_expression: Optional[str] = None,
        enabled: Optional[bool] = None,
        entity_selectors: Optional[Sequence[CseSigmaRuleEntitySelectorArgs]] = None,
        expression: Optional[str] = None,
        is_prototype: Optional[bool] = None,
        name: Optional[str] = None,
        name_expression: Optional[str] = None,
        original_source: Optional[str] = None,
        severity_mapping: Optional[CseSigmaRuleSeverityMappingArgs] = None,
        sigma_id: Optional[str] = None,
        summary_expression: Optional[str] = None,
        suppression_window_size: Optional[float] = None,
        tags: Optional[Sequence[str]] = None) -> CseSigmaRule

func GetCseSigmaRule(ctx *Context, name string, id IDInput, state *CseSigmaRuleState, opts ...ResourceOption) (*CseSigmaRule, error)

public static CseSigmaRule Get(string name, Input<string> id, CseSigmaRuleState? state, CustomResourceOptions? opts = null)

public static CseSigmaRule get(String name, Output<String> id, CseSigmaRuleState state, CustomResourceOptions options)

resources:  _:    type: sumologic:CseSigmaRule    get:      id: ${id}

import {
  to = sumologic_cse_sigma_rule.example
  id = "${id}"
}

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

Category string

The category of the rule.

CseSigmaRuleId string

The internal ID of the rule.

EntitySelectors List<CseSigmaRuleEntitySelector>

The description of the generated Signals. Defaults to the converted Sigma value.

Enabled bool

Whether the rule should generate Signals

The entities to generate Signals on. Defaults to the converted Sigma value.

Expression string

The expression for which records to match on. Defaults to the converted Sigma value.

IsPrototype bool

Whether the generated Signals should be prototype Signals. Defaults to the converted Sigma value.

Name string

The name of the Rule. Defaults to the name of the Sigma rule.

NameExpression string

The name of the generated Signals. Defaults to the converted Sigma value.

OriginalSource string

The original source of the rule. Always sigma.

SeverityMapping CseSigmaRuleSeverityMapping

The configuration of how the severity of the Signals should be mapped from the Records. Defaults to the converted Sigma value.

SigmaId string

The ID (UUID) of the Sigma rule to import. Changing this forces a new rule to be created.

The summary of the generated Signals. Defaults to the converted Sigma value.

SuppressionWindowSize double

For how long to suppress Signal generation, in milliseconds. Must be between 0 and the global limit of 7 days.

The following attributes are exported:

Tags List<string>

The tags of the generated Signals. Defaults to the converted Sigma value.

Category string

The category of the rule.

CseSigmaRuleId string

The internal ID of the rule.

EntitySelectors []CseSigmaRuleEntitySelectorArgs

The description of the generated Signals. Defaults to the converted Sigma value.

Enabled bool

Whether the rule should generate Signals

The entities to generate Signals on. Defaults to the converted Sigma value.

Expression string

The expression for which records to match on. Defaults to the converted Sigma value.

IsPrototype bool

Whether the generated Signals should be prototype Signals. Defaults to the converted Sigma value.

Name string

The name of the Rule. Defaults to the name of the Sigma rule.

NameExpression string

The name of the generated Signals. Defaults to the converted Sigma value.

OriginalSource string

The original source of the rule. Always sigma.

SeverityMapping CseSigmaRuleSeverityMappingArgs

The configuration of how the severity of the Signals should be mapped from the Records. Defaults to the converted Sigma value.

SigmaId string

The ID (UUID) of the Sigma rule to import. Changing this forces a new rule to be created.

entity_selectors list(object)

The summary of the generated Signals. Defaults to the converted Sigma value.

SuppressionWindowSize float64

For how long to suppress Signal generation, in milliseconds. Must be between 0 and the global limit of 7 days.

The following attributes are exported:

Tags []string

The tags of the generated Signals. Defaults to the converted Sigma value.

category string

The category of the rule.

cse_sigma_rule_id string

The internal ID of the rule.

description_expression string

The description of the generated Signals. Defaults to the converted Sigma value.

enabled bool

Whether the rule should generate Signals

The entities to generate Signals on. Defaults to the converted Sigma value.

expression string

The expression for which records to match on. Defaults to the converted Sigma value.

severity_mapping object

Whether the generated Signals should be prototype Signals. Defaults to the converted Sigma value.

name string

The name of the Rule. Defaults to the name of the Sigma rule.

name_expression string

The name of the generated Signals. Defaults to the converted Sigma value.

original_source string

The original source of the rule. Always sigma.

The configuration of how the severity of the Signals should be mapped from the Records. Defaults to the converted Sigma value.

sigma_id string

The ID (UUID) of the Sigma rule to import. Changing this forces a new rule to be created.

summary_expression string

The summary of the generated Signals. Defaults to the converted Sigma value.

suppression_window_size number

For how long to suppress Signal generation, in milliseconds. Must be between 0 and the global limit of 7 days.

The following attributes are exported:

tags list(string)

The tags of the generated Signals. Defaults to the converted Sigma value.

category String

The category of the rule.

cseSigmaRuleId String

The internal ID of the rule.

entitySelectors List<CseSigmaRuleEntitySelector>

The description of the generated Signals. Defaults to the converted Sigma value.

enabled Boolean

Whether the rule should generate Signals

The entities to generate Signals on. Defaults to the converted Sigma value.

expression String

The expression for which records to match on. Defaults to the converted Sigma value.

isPrototype Boolean

Whether the generated Signals should be prototype Signals. Defaults to the converted Sigma value.

name String

The name of the Rule. Defaults to the name of the Sigma rule.

nameExpression String

The name of the generated Signals. Defaults to the converted Sigma value.

originalSource String

The original source of the rule. Always sigma.

The configuration of how the severity of the Signals should be mapped from the Records. Defaults to the converted Sigma value.

sigmaId String

The ID (UUID) of the Sigma rule to import. Changing this forces a new rule to be created.

entitySelectors CseSigmaRuleEntitySelector[]

The summary of the generated Signals. Defaults to the converted Sigma value.

suppressionWindowSize Double

For how long to suppress Signal generation, in milliseconds. Must be between 0 and the global limit of 7 days.

The following attributes are exported:

tags List<String>

The tags of the generated Signals. Defaults to the converted Sigma value.

category string

The category of the rule.

cseSigmaRuleId string

The internal ID of the rule.

descriptionExpression string

The description of the generated Signals. Defaults to the converted Sigma value.

enabled boolean

Whether the rule should generate Signals

The entities to generate Signals on. Defaults to the converted Sigma value.

expression string

The expression for which records to match on. Defaults to the converted Sigma value.

isPrototype boolean

Whether the generated Signals should be prototype Signals. Defaults to the converted Sigma value.

name string

The name of the Rule. Defaults to the name of the Sigma rule.

nameExpression string

The name of the generated Signals. Defaults to the converted Sigma value.

originalSource string

The original source of the rule. Always sigma.

entity_selectors Sequence[CseSigmaRuleEntitySelectorArgs]

The configuration of how the severity of the Signals should be mapped from the Records. Defaults to the converted Sigma value.

sigmaId string

The ID (UUID) of the Sigma rule to import. Changing this forces a new rule to be created.

summaryExpression string

The summary of the generated Signals. Defaults to the converted Sigma value.

suppressionWindowSize number

For how long to suppress Signal generation, in milliseconds. Must be between 0 and the global limit of 7 days.

The following attributes are exported:

tags string[]

The tags of the generated Signals. Defaults to the converted Sigma value.

category str

The category of the rule.

cse_sigma_rule_id str

The internal ID of the rule.

description_expression str

The description of the generated Signals. Defaults to the converted Sigma value.

enabled bool

Whether the rule should generate Signals

The entities to generate Signals on. Defaults to the converted Sigma value.

expression str

The expression for which records to match on. Defaults to the converted Sigma value.

severity_mapping CseSigmaRuleSeverityMappingArgs

Whether the generated Signals should be prototype Signals. Defaults to the converted Sigma value.

name str

The name of the Rule. Defaults to the name of the Sigma rule.

name_expression str

The name of the generated Signals. Defaults to the converted Sigma value.

original_source str

The original source of the rule. Always sigma.

The configuration of how the severity of the Signals should be mapped from the Records. Defaults to the converted Sigma value.

sigma_id str

The ID (UUID) of the Sigma rule to import. Changing this forces a new rule to be created.

summary_expression str

The summary of the generated Signals. Defaults to the converted Sigma value.

suppression_window_size float

For how long to suppress Signal generation, in milliseconds. Must be between 0 and the global limit of 7 days.

The following attributes are exported:

tags Sequence[str]

The tags of the generated Signals. Defaults to the converted Sigma value.

category String

The category of the rule.

cseSigmaRuleId String

The internal ID of the rule.

entitySelectors List<Property Map>

The description of the generated Signals. Defaults to the converted Sigma value.

enabled Boolean

Whether the rule should generate Signals

The entities to generate Signals on. Defaults to the converted Sigma value.

expression String

The expression for which records to match on. Defaults to the converted Sigma value.

isPrototype Boolean

Whether the generated Signals should be prototype Signals. Defaults to the converted Sigma value.

name String

The name of the Rule. Defaults to the name of the Sigma rule.

nameExpression String

The name of the generated Signals. Defaults to the converted Sigma value.

originalSource String

The original source of the rule. Always sigma.

severityMapping Property Map

The configuration of how the severity of the Signals should be mapped from the Records. Defaults to the converted Sigma value.

sigmaId String

The ID (UUID) of the Sigma rule to import. Changing this forces a new rule to be created.