@pulumi/sumologic
Version:
A Pulumi package for creating and managing sumologic cloud resources.
286 lines (285 loc) • 9.2 kB
TypeScript
import * as pulumi from "@pulumi/pulumi";
import * as inputs from "./types/input";
import * as outputs from "./types/output";
/**
* Provides a Sumo Logic CSE [First Seen Rule](https://help.sumologic.com/docs/cse/rules/write-first-seen-rule/).
*
* ## Example Usage
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as sumologic from "@pulumi/sumologic";
*
* const firstSeenRule = new sumologic.CseFirstSeenRule("first_seen_rule", {
* baselineType: "PER_ENTITY",
* baselineWindowSize: "35000",
* descriptionExpression: "First User Login - {{ user_username }}",
* enabled: true,
* entitySelectors: [
* {
* entityType: "_username",
* expression: "user_username",
* },
* {
* entityType: "_hostname",
* expression: "dstDevice_hostname",
* },
* ],
* filterExpression: "objectType=\"Network\"",
* groupByFields: ["user_username"],
* isPrototype: false,
* name: "First User Login",
* nameExpression: "First User Login - {{ user_username }}",
* retentionWindowSize: "86400000",
* severity: 1,
* valueFields: ["dstDevice_hostname"],
* suppressionWindowSize: 2100000,
* });
* ```
*
* ## Import
*
* First Seen Rules can be imported using the field id, e.g.:
*
* hcl
*
* ```sh
* $ pulumi import sumologic:index/cseFirstSeenRule:CseFirstSeenRule first_seen_rule id
* ```
*/
export declare class CseFirstSeenRule extends pulumi.CustomResource {
/**
* Get an existing CseFirstSeenRule resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name: string, id: pulumi.Input<pulumi.ID>, state?: CseFirstSeenRuleState, opts?: pulumi.CustomResourceOptions): CseFirstSeenRule;
/**
* Returns true if the given object is an instance of CseFirstSeenRule. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj: any): obj is CseFirstSeenRule;
/**
* The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
*/
readonly baselineType: pulumi.Output<string>;
/**
* The baseline window size in milliseconds
*/
readonly baselineWindowSize: pulumi.Output<string>;
/**
* The description of the generated Signals
*/
readonly descriptionExpression: pulumi.Output<string>;
/**
* Whether the rule should generate Signals
*/
readonly enabled: pulumi.Output<boolean>;
/**
* The entities to generate Signals on
* + `entityType` - (Required) The type of the entity to generate the Signal on
*/
readonly entitySelectors: pulumi.Output<outputs.CseFirstSeenRuleEntitySelector[]>;
/**
* The expression for which records to match on
*/
readonly filterExpression: pulumi.Output<string>;
/**
* A list of fields to group records by
*/
readonly groupByFields: pulumi.Output<string[] | undefined>;
/**
* Whether the generated Signals should be prototype Signals
*/
readonly isPrototype: pulumi.Output<boolean | undefined>;
/**
* The name of the Rule
*/
readonly name: pulumi.Output<string>;
/**
* The name of the generated Signals
*/
readonly nameExpression: pulumi.Output<string>;
/**
* The retention window size in milliseconds
*/
readonly retentionWindowSize: pulumi.Output<string>;
/**
* The severity of the generated Signals
*/
readonly severity: pulumi.Output<number>;
/**
* The summary of the generated Signals
*/
readonly summaryExpression: pulumi.Output<string | undefined>;
/**
* For how long to suppress Signal generation, in milliseconds. Must be greater than 0 and less than the global limit of 7 days.
*
* The following attributes are exported:
*/
readonly suppressionWindowSize: pulumi.Output<number | undefined>;
/**
* The tags of the generated Signals
*/
readonly tags: pulumi.Output<string[] | undefined>;
/**
* The value fields
*/
readonly valueFields: pulumi.Output<string[]>;
/**
* Create a CseFirstSeenRule resource with the given unique name, arguments, and options.
*
* @param name The _unique_ name of the resource.
* @param args The arguments to use to populate this resource's properties.
* @param opts A bag of options that control this resource's behavior.
*/
constructor(name: string, args: CseFirstSeenRuleArgs, opts?: pulumi.CustomResourceOptions);
}
/**
* Input properties used for looking up and filtering CseFirstSeenRule resources.
*/
export interface CseFirstSeenRuleState {
/**
* The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
*/
baselineType?: pulumi.Input<string>;
/**
* The baseline window size in milliseconds
*/
baselineWindowSize?: pulumi.Input<string>;
/**
* The description of the generated Signals
*/
descriptionExpression?: pulumi.Input<string>;
/**
* Whether the rule should generate Signals
*/
enabled?: pulumi.Input<boolean>;
/**
* The entities to generate Signals on
* + `entityType` - (Required) The type of the entity to generate the Signal on
*/
entitySelectors?: pulumi.Input<pulumi.Input<inputs.CseFirstSeenRuleEntitySelector>[]>;
/**
* The expression for which records to match on
*/
filterExpression?: pulumi.Input<string>;
/**
* A list of fields to group records by
*/
groupByFields?: pulumi.Input<pulumi.Input<string>[]>;
/**
* Whether the generated Signals should be prototype Signals
*/
isPrototype?: pulumi.Input<boolean>;
/**
* The name of the Rule
*/
name?: pulumi.Input<string>;
/**
* The name of the generated Signals
*/
nameExpression?: pulumi.Input<string>;
/**
* The retention window size in milliseconds
*/
retentionWindowSize?: pulumi.Input<string>;
/**
* The severity of the generated Signals
*/
severity?: pulumi.Input<number>;
/**
* The summary of the generated Signals
*/
summaryExpression?: pulumi.Input<string>;
/**
* For how long to suppress Signal generation, in milliseconds. Must be greater than 0 and less than the global limit of 7 days.
*
* The following attributes are exported:
*/
suppressionWindowSize?: pulumi.Input<number>;
/**
* The tags of the generated Signals
*/
tags?: pulumi.Input<pulumi.Input<string>[]>;
/**
* The value fields
*/
valueFields?: pulumi.Input<pulumi.Input<string>[]>;
}
/**
* The set of arguments for constructing a CseFirstSeenRule resource.
*/
export interface CseFirstSeenRuleArgs {
/**
* The baseline type. Current acceptable values are GLOBAL or PER_ENTITY
*/
baselineType: pulumi.Input<string>;
/**
* The baseline window size in milliseconds
*/
baselineWindowSize: pulumi.Input<string>;
/**
* The description of the generated Signals
*/
descriptionExpression: pulumi.Input<string>;
/**
* Whether the rule should generate Signals
*/
enabled: pulumi.Input<boolean>;
/**
* The entities to generate Signals on
* + `entityType` - (Required) The type of the entity to generate the Signal on
*/
entitySelectors: pulumi.Input<pulumi.Input<inputs.CseFirstSeenRuleEntitySelector>[]>;
/**
* The expression for which records to match on
*/
filterExpression: pulumi.Input<string>;
/**
* A list of fields to group records by
*/
groupByFields?: pulumi.Input<pulumi.Input<string>[]>;
/**
* Whether the generated Signals should be prototype Signals
*/
isPrototype?: pulumi.Input<boolean>;
/**
* The name of the Rule
*/
name?: pulumi.Input<string>;
/**
* The name of the generated Signals
*/
nameExpression: pulumi.Input<string>;
/**
* The retention window size in milliseconds
*/
retentionWindowSize: pulumi.Input<string>;
/**
* The severity of the generated Signals
*/
severity: pulumi.Input<number>;
/**
* The summary of the generated Signals
*/
summaryExpression?: pulumi.Input<string>;
/**
* For how long to suppress Signal generation, in milliseconds. Must be greater than 0 and less than the global limit of 7 days.
*
* The following attributes are exported:
*/
suppressionWindowSize?: pulumi.Input<number>;
/**
* The tags of the generated Signals
*/
tags?: pulumi.Input<pulumi.Input<string>[]>;
/**
* The value fields
*/
valueFields: pulumi.Input<pulumi.Input<string>[]>;
}