@pulumi/sumologic

import * as pulumi from "@pulumi/pulumi"; import * as inputs from "./types/input"; import * as outputs from "./types/output"; /** * Provides a Sumo Logic CSE [Aggregation Rule](https://help.sumologic.com/Cloud_SIEM_Enterprise/CSE_Rules/09_Write_an_Aggregation_Rule). * * ## Example Usage * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as sumologic from "@pulumi/sumologic"; * * const aggregationRule = new sumologic.CseAggregationRule("aggregation_rule", { * aggregationFunctions: [{ * name: "distinct_eventid_count", * "function": "count_distinct", * arguments: ["metadata_deviceEventId"], * }], * descriptionExpression: "Signal description", * enabled: true, * entitySelectors: [{ * entityType: "_ip", * expression: "srcDevice_ip", * }], * groupByEntity: true, * groupByFields: ["dstDevice_hostname"], * matchExpression: "objectType = \"Network\"", * isPrototype: false, * name: "Aggregation Rule Example", * nameExpression: "Signal name", * severityMapping: { * type: "constant", * "default": 5, * }, * summaryExpression: "Signal summary", * tags: ["_mitreAttackTactic:TA0009"], * triggerExpression: "distinct_eventid_count > 5", * windowSize: "T30M", * suppressionWindowSize: 2100000, * }); * ``` * * ## Import * * Aggregation Rules can be imported using the field id, e.g.: * * hcl * * ```sh * $ pulumi import sumologic:index/cseAggregationRule:CseAggregationRule aggregation_rule id * ``` */ export declare class CseAggregationRule extends pulumi.CustomResource { /** * Get an existing CseAggregationRule resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input<pulumi.ID>, state?: CseAggregationRuleState, opts?: pulumi.CustomResourceOptions): CseAggregationRule; /** * Returns true if the given object is an instance of CseAggregationRule. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is CseAggregationRule; /** * One or more named aggregation functions */ readonly aggregationFunctions: pulumi.Output<outputs.CseAggregationRuleAggregationFunction[]>; /** * The description of the generated Signals */ readonly descriptionExpression: pulumi.Output<string>; /** * Whether the rule should generate Signals */ readonly enabled: pulumi.Output<boolean>; /** * The entities to generate Signals on * + `entityType` - (Required) The type of the entity to generate the Signal on. */ readonly entitySelectors: pulumi.Output<outputs.CseAggregationRuleEntitySelector[]>; /** * Whether to group records by the specified entity fields */ readonly groupByEntity: pulumi.Output<boolean | undefined>; /** * A list of fields to group records by */ readonly groupByFields: pulumi.Output<string[] | undefined>; /** * Whether the generated Signals should be prototype Signals */ readonly isPrototype: pulumi.Output<boolean | undefined>; /** * The expression for which records to match on */ readonly matchExpression: pulumi.Output<string>; /** * The name of the Rule */ readonly name: pulumi.Output<string>; /** * The name of the generated Signals */ readonly nameExpression: pulumi.Output<string>; /** * The configuration of how the severity of the Signals should be mapped from the Records */ readonly severityMapping: pulumi.Output<outputs.CseAggregationRuleSeverityMapping>; /** * The summary of the generated Signals */ readonly summaryExpression: pulumi.Output<string | undefined>; /** * For how long to suppress Signal generation, in milliseconds. Must be greater than `windowSize` and less than the global limit of 7 days. * * The following attributes are exported: */ readonly suppressionWindowSize: pulumi.Output<number | undefined>; /** * The tags of the generated Signals */ readonly tags: pulumi.Output<string[] | undefined>; /** * The expression to determine whether a Signal should be created based on the aggregation results */ readonly triggerExpression: pulumi.Output<string>; /** * How long of a window to aggregate records for. Current acceptable values are T05M, T10M, T30M, T60M, T24H, T12H, T05D or CUSTOM */ readonly windowSize: pulumi.Output<string>; readonly windowSizeMillis: pulumi.Output<string | undefined>; /** * Create a CseAggregationRule resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args: CseAggregationRuleArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering CseAggregationRule resources. */ export interface CseAggregationRuleState { /** * One or more named aggregation functions */ aggregationFunctions?: pulumi.Input<pulumi.Input<inputs.CseAggregationRuleAggregationFunction>[]>; /** * The description of the generated Signals */ descriptionExpression?: pulumi.Input<string>; /** * Whether the rule should generate Signals */ enabled?: pulumi.Input<boolean>; /** * The entities to generate Signals on * + `entityType` - (Required) The type of the entity to generate the Signal on. */ entitySelectors?: pulumi.Input<pulumi.Input<inputs.CseAggregationRuleEntitySelector>[]>; /** * Whether to group records by the specified entity fields */ groupByEntity?: pulumi.Input<boolean>; /** * A list of fields to group records by */ groupByFields?: pulumi.Input<pulumi.Input<string>[]>; /** * Whether the generated Signals should be prototype Signals */ isPrototype?: pulumi.Input<boolean>; /** * The expression for which records to match on */ matchExpression?: pulumi.Input<string>; /** * The name of the Rule */ name?: pulumi.Input<string>; /** * The name of the generated Signals */ nameExpression?: pulumi.Input<string>; /** * The configuration of how the severity of the Signals should be mapped from the Records */ severityMapping?: pulumi.Input<inputs.CseAggregationRuleSeverityMapping>; /** * The summary of the generated Signals */ summaryExpression?: pulumi.Input<string>; /** * For how long to suppress Signal generation, in milliseconds. Must be greater than `windowSize` and less than the global limit of 7 days. * * The following attributes are exported: */ suppressionWindowSize?: pulumi.Input<number>; /** * The tags of the generated Signals */ tags?: pulumi.Input<pulumi.Input<string>[]>; /** * The expression to determine whether a Signal should be created based on the aggregation results */ triggerExpression?: pulumi.Input<string>; /** * How long of a window to aggregate records for. Current acceptable values are T05M, T10M, T30M, T60M, T24H, T12H, T05D or CUSTOM */ windowSize?: pulumi.Input<string>; windowSizeMillis?: pulumi.Input<string>; } /** * The set of arguments for constructing a CseAggregationRule resource. */ export interface CseAggregationRuleArgs { /** * One or more named aggregation functions */ aggregationFunctions: pulumi.Input<pulumi.Input<inputs.CseAggregationRuleAggregationFunction>[]>; /** * The description of the generated Signals */ descriptionExpression: pulumi.Input<string>; /** * Whether the rule should generate Signals */ enabled: pulumi.Input<boolean>; /** * The entities to generate Signals on * + `entityType` - (Required) The type of the entity to generate the Signal on. */ entitySelectors: pulumi.Input<pulumi.Input<inputs.CseAggregationRuleEntitySelector>[]>; /** * Whether to group records by the specified entity fields */ groupByEntity?: pulumi.Input<boolean>; /** * A list of fields to group records by */ groupByFields?: pulumi.Input<pulumi.Input<string>[]>; /** * Whether the generated Signals should be prototype Signals */ isPrototype?: pulumi.Input<boolean>; /** * The expression for which records to match on */ matchExpression: pulumi.Input<string>; /** * The name of the Rule */ name?: pulumi.Input<string>; /** * The name of the generated Signals */ nameExpression: pulumi.Input<string>; /** * The configuration of how the severity of the Signals should be mapped from the Records */ severityMapping: pulumi.Input<inputs.CseAggregationRuleSeverityMapping>; /** * The summary of the generated Signals */ summaryExpression?: pulumi.Input<string>; /** * For how long to suppress Signal generation, in milliseconds. Must be greater than `windowSize` and less than the global limit of 7 days. * * The following attributes are exported: */ suppressionWindowSize?: pulumi.Input<number>; /** * The tags of the generated Signals */ tags?: pulumi.Input<pulumi.Input<string>[]>; /** * The expression to determine whether a Signal should be created based on the aggregation results */ triggerExpression: pulumi.Input<string>; /** * How long of a window to aggregate records for. Current acceptable values are T05M, T10M, T30M, T60M, T24H, T12H, T05D or CUSTOM */ windowSize: pulumi.Input<string>; windowSizeMillis?: pulumi.Input<string>; }