@pulumi/gcp
Version:
A Pulumi package for creating and managing Google Cloud Platform resources.
247 lines • 10.6 kB
TypeScript
import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
import * as outputs from "../types/output";
/**
* Represents a set of logic conditions used to refine various types of findings such as curated rule detections.
*
* To get more information about FindingsRefinement, see:
*
* * [API documentation](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1/projects.locations.instances.findingsRefinements)
* * How-to Guides
* * [Google SecOps Guides](https://cloud.google.com/chronicle/docs/secops/secops-overview)
*
* ## Example Usage
*
* ### Chronicle Findings Refinement Basic
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const findingsRefinementExample = new gcp.chronicle.FindingsRefinement("findings_refinement_example", {
* location: "us",
* instance: "00000000-0000-0000-0000-000000000000",
* displayName: "findings_refinement_display_name",
* type: "DETECTION_EXCLUSION",
* query: "network.dns.response = true",
* outcomeFilters: [{
* outcomeVariable: "risk_score",
* outcomeFilterOperator: "EQUAL",
* outcomeValue: "value",
* }],
* });
* ```
* ### Chronicle Findings Refinement Full
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const findingsRefinementExample = new gcp.chronicle.FindingsRefinement("findings_refinement_example", {
* location: "us",
* instance: "00000000-0000-0000-0000-000000000000",
* displayName: "findings_refinement_display_name",
* type: "DETECTION_EXCLUSION",
* query: "network.dns.response = true",
* outcomeFilters: [{
* outcomeVariable: "network.dns.response = true",
* outcomeFilterOperator: "EQUAL",
* outcomeValue: "value1",
* }],
* });
* ```
*
* ## Import
*
* FindingsRefinement can be imported using any of these accepted formats:
*
* * `projects/{{project}}/locations/{{location}}/instances/{{instance}}/findingsRefinements/{{name}}`
* * `{{project}}/{{location}}/{{instance}}/{{name}}`
* * `{{location}}/{{instance}}/{{name}}`
*
* When using the `pulumi import` command, FindingsRefinement can be imported using one of the formats above. For example:
*
* ```sh
* $ pulumi import gcp:chronicle/findingsRefinement:FindingsRefinement default projects/{{project}}/locations/{{location}}/instances/{{instance}}/findingsRefinements/{{name}}
* $ pulumi import gcp:chronicle/findingsRefinement:FindingsRefinement default {{project}}/{{location}}/{{instance}}/{{name}}
* $ pulumi import gcp:chronicle/findingsRefinement:FindingsRefinement default {{location}}/{{instance}}/{{name}}
* ```
*/
export declare class FindingsRefinement extends pulumi.CustomResource {
/**
* Get an existing FindingsRefinement resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name: string, id: pulumi.Input<pulumi.ID>, state?: FindingsRefinementState, opts?: pulumi.CustomResourceOptions): FindingsRefinement;
/**
* Returns true if the given object is an instance of FindingsRefinement. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj: any): obj is FindingsRefinement;
/**
* The timestamp of when the findings refinement was created.
*/
readonly createTime: pulumi.Output<string>;
/**
* Display name of the findings refinement.
*/
readonly displayName: pulumi.Output<string | undefined>;
/**
* Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
*/
readonly instance: pulumi.Output<string>;
/**
* Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
*/
readonly location: pulumi.Output<string>;
/**
* Full resource name for the findings refinement.
* Format:
* projects/{project}/locations/{location}/instances/{instance}/findingsRefinements/{findings_refinement}
*/
readonly name: pulumi.Output<string>;
/**
* The outcome filters for the findings refinement. These allow you to specify
* filters that are applied to the outcome variables in the detection.
* All filters must be true for a detection to match the findings refinement.
* Structure is documented below.
*/
readonly outcomeFilters: pulumi.Output<outputs.chronicle.FindingsRefinementOutcomeFilter[] | undefined>;
/**
* The ID of the project in which the resource belongs.
* If it is not provided, the provider project is used.
*/
readonly project: pulumi.Output<string>;
/**
* The query for the findings refinement. Works in conjunction with the type
* field to determine the findings refinement behavior. The syntax of this
* query is the same as a UDM search string. See the following for more
* information:
* https://cloud.google.com/chronicle/docs/investigation/udm-search
*/
readonly query: pulumi.Output<string | undefined>;
/**
* DETECTION_EXCLUSION is the only supported type of findings refinement.
* Possible values:
* DETECTION_EXCLUSION
*/
readonly type: pulumi.Output<string | undefined>;
/**
* The timestamp of when the findings refinement was last updated.
*/
readonly updateTime: pulumi.Output<string>;
/**
* Create a FindingsRefinement resource with the given unique name, arguments, and options.
*
* @param name The _unique_ name of the resource.
* @param args The arguments to use to populate this resource's properties.
* @param opts A bag of options that control this resource's behavior.
*/
constructor(name: string, args: FindingsRefinementArgs, opts?: pulumi.CustomResourceOptions);
}
/**
* Input properties used for looking up and filtering FindingsRefinement resources.
*/
export interface FindingsRefinementState {
/**
* The timestamp of when the findings refinement was created.
*/
createTime?: pulumi.Input<string | undefined>;
/**
* Display name of the findings refinement.
*/
displayName?: pulumi.Input<string | undefined>;
/**
* Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
*/
instance?: pulumi.Input<string | undefined>;
/**
* Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
*/
location?: pulumi.Input<string | undefined>;
/**
* Full resource name for the findings refinement.
* Format:
* projects/{project}/locations/{location}/instances/{instance}/findingsRefinements/{findings_refinement}
*/
name?: pulumi.Input<string | undefined>;
/**
* The outcome filters for the findings refinement. These allow you to specify
* filters that are applied to the outcome variables in the detection.
* All filters must be true for a detection to match the findings refinement.
* Structure is documented below.
*/
outcomeFilters?: pulumi.Input<pulumi.Input<inputs.chronicle.FindingsRefinementOutcomeFilter>[] | undefined>;
/**
* The ID of the project in which the resource belongs.
* If it is not provided, the provider project is used.
*/
project?: pulumi.Input<string | undefined>;
/**
* The query for the findings refinement. Works in conjunction with the type
* field to determine the findings refinement behavior. The syntax of this
* query is the same as a UDM search string. See the following for more
* information:
* https://cloud.google.com/chronicle/docs/investigation/udm-search
*/
query?: pulumi.Input<string | undefined>;
/**
* DETECTION_EXCLUSION is the only supported type of findings refinement.
* Possible values:
* DETECTION_EXCLUSION
*/
type?: pulumi.Input<string | undefined>;
/**
* The timestamp of when the findings refinement was last updated.
*/
updateTime?: pulumi.Input<string | undefined>;
}
/**
* The set of arguments for constructing a FindingsRefinement resource.
*/
export interface FindingsRefinementArgs {
/**
* Display name of the findings refinement.
*/
displayName?: pulumi.Input<string | undefined>;
/**
* Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
*/
instance: pulumi.Input<string>;
/**
* Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
*/
location: pulumi.Input<string>;
/**
* The outcome filters for the findings refinement. These allow you to specify
* filters that are applied to the outcome variables in the detection.
* All filters must be true for a detection to match the findings refinement.
* Structure is documented below.
*/
outcomeFilters?: pulumi.Input<pulumi.Input<inputs.chronicle.FindingsRefinementOutcomeFilter>[] | undefined>;
/**
* The ID of the project in which the resource belongs.
* If it is not provided, the provider project is used.
*/
project?: pulumi.Input<string | undefined>;
/**
* The query for the findings refinement. Works in conjunction with the type
* field to determine the findings refinement behavior. The syntax of this
* query is the same as a UDM search string. See the following for more
* information:
* https://cloud.google.com/chronicle/docs/investigation/udm-search
*/
query?: pulumi.Input<string | undefined>;
/**
* DETECTION_EXCLUSION is the only supported type of findings refinement.
* Possible values:
* DETECTION_EXCLUSION
*/
type?: pulumi.Input<string | undefined>;
}
//# sourceMappingURL=findingsRefinement.d.ts.map