alertRuleNrt.go

// Code generated by the Pulumi Terraform Bridge (tfgen) Tool DO NOT EDIT.
// *** WARNING: Do not edit by hand unless you're certain you know what you are doing! ***

package sentinel

import (
	"context"
	"reflect"

	"errors"
	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/internal"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

// Manages a Sentinel NRT Alert Rule.
//
// ## Example Usage
//
// ```go
// package main
//
// import (
//
//	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/core"
//	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/operationalinsights"
//	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/sentinel"
//	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
//
// )
//
//	func main() {
//		pulumi.Run(func(ctx *pulumi.Context) error {
//			example, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
//				Name:     pulumi.String("example-resources"),
//				Location: pulumi.String("West Europe"),
//			})
//			if err != nil {
//				return err
//			}
//			exampleAnalyticsWorkspace, err := operationalinsights.NewAnalyticsWorkspace(ctx, "example", &operationalinsights.AnalyticsWorkspaceArgs{
//				Name:              pulumi.String("example-workspace"),
//				Location:          example.Location,
//				ResourceGroupName: example.Name,
//				Sku:               pulumi.String("pergb2018"),
//			})
//			if err != nil {
//				return err
//			}
//			exampleLogAnalyticsWorkspaceOnboarding, err := sentinel.NewLogAnalyticsWorkspaceOnboarding(ctx, "example", &sentinel.LogAnalyticsWorkspaceOnboardingArgs{
//				WorkspaceId: exampleAnalyticsWorkspace.ID(),
//			})
//			if err != nil {
//				return err
//			}
//			_, err = sentinel.NewAlertRuleNrt(ctx, "example", &sentinel.AlertRuleNrtArgs{
//				Name:                    pulumi.String("example"),
//				LogAnalyticsWorkspaceId: exampleLogAnalyticsWorkspaceOnboarding.WorkspaceId,
//				DisplayName:             pulumi.String("example"),
//				Severity:                pulumi.String("High"),
//				Query:                   pulumi.String("AzureActivity |\n  where OperationName == \"Create or Update Virtual Machine\" or OperationName ==\"Create Deployment\" |\n  where ActivityStatus == \"Succeeded\" |\n  make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller\n"),
//			})
//			if err != nil {
//				return err
//			}
//			return nil
//		})
//	}
//
// ```
//
// ## Import
//
// Sentinel NRT Alert Rules can be imported using the `resource id`, e.g.
//
// ```sh
// $ pulumi import azure:sentinel/alertRuleNrt:AlertRuleNrt example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.OperationalInsights/workspaces/workspace1/providers/Microsoft.SecurityInsights/alertRules/rule1
// ```
type AlertRuleNrt struct {
	pulumi.CustomResourceState

	// An `alertDetailsOverride` block as defined below.
	AlertDetailsOverrides AlertRuleNrtAlertDetailsOverrideArrayOutput `pulumi:"alertDetailsOverrides"`
	// The GUID of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
	AlertRuleTemplateGuid pulumi.StringPtrOutput `pulumi:"alertRuleTemplateGuid"`
	// The version of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
	AlertRuleTemplateVersion pulumi.StringPtrOutput `pulumi:"alertRuleTemplateVersion"`
	// A map of string key-value pairs of columns to be attached to this Sentinel NRT Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
	CustomDetails pulumi.StringMapOutput `pulumi:"customDetails"`
	// The description of this Sentinel NRT Alert Rule.
	Description pulumi.StringPtrOutput `pulumi:"description"`
	// The friendly name of this Sentinel NRT Alert Rule.
	DisplayName pulumi.StringOutput `pulumi:"displayName"`
	// Should the Sentinel NRT Alert Rule be enabled? Defaults to `true`.
	Enabled pulumi.BoolPtrOutput `pulumi:"enabled"`
	// A list of `entityMapping` blocks as defined below.
	EntityMappings AlertRuleNrtEntityMappingArrayOutput `pulumi:"entityMappings"`
	// A `eventGrouping` block as defined below.
	//
	// > **NOTE:** `eventGrouping` will be required in the next major version of the AzureRM Provider.
	EventGrouping AlertRuleNrtEventGroupingOutput `pulumi:"eventGrouping"`
	// A `incident` block as defined below.
	Incident AlertRuleNrtIncidentOutput `pulumi:"incident"`
	// The ID of the Log Analytics Workspace this Sentinel NRT Alert Rule belongs to. Changing this forces a new Sentinel NRT Alert Rule to be created.
	LogAnalyticsWorkspaceId pulumi.StringOutput `pulumi:"logAnalyticsWorkspaceId"`
	// The name which should be used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
	Name pulumi.StringOutput `pulumi:"name"`
	// The query of this Sentinel NRT Alert Rule.
	Query pulumi.StringOutput `pulumi:"query"`
	// A list of `sentinelEntityMapping` blocks as defined below.
	//
	// > **NOTE:** `entityMapping` and `sentinelEntityMapping` together can't exceed 5.
	SentinelEntityMappings AlertRuleNrtSentinelEntityMappingArrayOutput `pulumi:"sentinelEntityMappings"`
	// The alert severity of this Sentinel NRT Alert Rule. Possible values are `High`, `Medium`, `Low` and `Informational`.
	Severity pulumi.StringOutput `pulumi:"severity"`
	// If `suppressionEnabled` is `true`, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to `PT5H`.
	SuppressionDuration pulumi.StringPtrOutput `pulumi:"suppressionDuration"`
	// Should the Sentinel NRT Alert Rulea stop running query after alert is generated? Defaults to `false`.
	SuppressionEnabled pulumi.BoolPtrOutput `pulumi:"suppressionEnabled"`
	// A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `Impact`, `ImpairProcessControl`, `InhibitResponseFunction`, `InitialAccess`, `LateralMovement`, `Persistence`, `PreAttack`, `PrivilegeEscalation`, `Reconnaissance` and `ResourceDevelopment`.
	Tactics pulumi.StringArrayOutput `pulumi:"tactics"`
	// A list of techniques of attacks by which to classify the rule.
	Techniques pulumi.StringArrayOutput `pulumi:"techniques"`
}

// NewAlertRuleNrt registers a new resource with the given unique name, arguments, and options.
func NewAlertRuleNrt(ctx *pulumi.Context,
	name string, args *AlertRuleNrtArgs, opts ...pulumi.ResourceOption) (*AlertRuleNrt, error) {
	if args == nil {
		return nil, errors.New("missing one or more required arguments")
	}

	if args.DisplayName == nil {
		return nil, errors.New("invalid value for required argument 'DisplayName'")
	}
	if args.LogAnalyticsWorkspaceId == nil {
		return nil, errors.New("invalid value for required argument 'LogAnalyticsWorkspaceId'")
	}
	if args.Query == nil {
		return nil, errors.New("invalid value for required argument 'Query'")
	}
	if args.Severity == nil {
		return nil, errors.New("invalid value for required argument 'Severity'")
	}
	opts = internal.PkgResourceDefaultOpts(opts)
	var resource AlertRuleNrt
	err := ctx.RegisterResource("azure:sentinel/alertRuleNrt:AlertRuleNrt", name, args, &resource, opts...)
	if err != nil {
		return nil, err
	}
	return &resource, nil
}

// GetAlertRuleNrt gets an existing AlertRuleNrt resource's state with the given name, ID, and optional
// state properties that are used to uniquely qualify the lookup (nil if not required).
func GetAlertRuleNrt(ctx *pulumi.Context,
	name string, id pulumi.IDInput, state *AlertRuleNrtState, opts ...pulumi.ResourceOption) (*AlertRuleNrt, error) {
	var resource AlertRuleNrt
	err := ctx.ReadResource("azure:sentinel/alertRuleNrt:AlertRuleNrt", name, id, state, &resource, opts...)
	if err != nil {
		return nil, err
	}
	return &resource, nil
}

// Input properties used for looking up and filtering AlertRuleNrt resources.
type alertRuleNrtState struct {
	// An `alertDetailsOverride` block as defined below.
	AlertDetailsOverrides []AlertRuleNrtAlertDetailsOverride `pulumi:"alertDetailsOverrides"`
	// The GUID of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
	AlertRuleTemplateGuid *string `pulumi:"alertRuleTemplateGuid"`
	// The version of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
	AlertRuleTemplateVersion *string `pulumi:"alertRuleTemplateVersion"`
	// A map of string key-value pairs of columns to be attached to this Sentinel NRT Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
	CustomDetails map[string]string `pulumi:"customDetails"`
	// The description of this Sentinel NRT Alert Rule.
	Description *string `pulumi:"description"`
	// The friendly name of this Sentinel NRT Alert Rule.
	DisplayName *string `pulumi:"displayName"`
	// Should the Sentinel NRT Alert Rule be enabled? Defaults to `true`.
	Enabled *bool `pulumi:"enabled"`
	// A list of `entityMapping` blocks as defined below.
	EntityMappings []AlertRuleNrtEntityMapping `pulumi:"entityMappings"`
	// A `eventGrouping` block as defined below.
	//
	// > **NOTE:** `eventGrouping` will be required in the next major version of the AzureRM Provider.
	EventGrouping *AlertRuleNrtEventGrouping `pulumi:"eventGrouping"`
	// A `incident` block as defined below.
	Incident *AlertRuleNrtIncident `pulumi:"incident"`
	// The ID of the Log Analytics Workspace this Sentinel NRT Alert Rule belongs to. Changing this forces a new Sentinel NRT Alert Rule to be created.
	LogAnalyticsWorkspaceId *string `pulumi:"logAnalyticsWorkspaceId"`
	// The name which should be used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
	Name *string `pulumi:"name"`
	// The query of this Sentinel NRT Alert Rule.
	Query *string `pulumi:"query"`
	// A list of `sentinelEntityMapping` blocks as defined below.
	//
	// > **NOTE:** `entityMapping` and `sentinelEntityMapping` together can't exceed 5.
	SentinelEntityMappings []AlertRuleNrtSentinelEntityMapping `pulumi:"sentinelEntityMappings"`
	// The alert severity of this Sentinel NRT Alert Rule. Possible values are `High`, `Medium`, `Low` and `Informational`.
	Severity *string `pulumi:"severity"`
	// If `suppressionEnabled` is `true`, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to `PT5H`.
	SuppressionDuration *string `pulumi:"suppressionDuration"`
	// Should the Sentinel NRT Alert Rulea stop running query after alert is generated? Defaults to `false`.
	SuppressionEnabled *bool `pulumi:"suppressionEnabled"`
	// A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `Impact`, `ImpairProcessControl`, `InhibitResponseFunction`, `InitialAccess`, `LateralMovement`, `Persistence`, `PreAttack`, `PrivilegeEscalation`, `Reconnaissance` and `ResourceDevelopment`.
	Tactics []string `pulumi:"tactics"`
	// A list of techniques of attacks by which to classify the rule.
	Techniques []string `pulumi:"techniques"`
}

type AlertRuleNrtState struct {
	// An `alertDetailsOverride` block as defined below.
	AlertDetailsOverrides AlertRuleNrtAlertDetailsOverrideArrayInput
	// The GUID of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
	AlertRuleTemplateGuid pulumi.StringPtrInput
	// The version of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
	AlertRuleTemplateVersion pulumi.StringPtrInput
	// A map of string key-value pairs of columns to be attached to this Sentinel NRT Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
	CustomDetails pulumi.StringMapInput
	// The description of this Sentinel NRT Alert Rule.
	Description pulumi.StringPtrInput
	// The friendly name of this Sentinel NRT Alert Rule.
	DisplayName pulumi.StringPtrInput
	// Should the Sentinel NRT Alert Rule be enabled? Defaults to `true`.
	Enabled pulumi.BoolPtrInput
	// A list of `entityMapping` blocks as defined below.
	EntityMappings AlertRuleNrtEntityMappingArrayInput
	// A `eventGrouping` block as defined below.
	//
	// > **NOTE:** `eventGrouping` will be required in the next major version of the AzureRM Provider.
	EventGrouping AlertRuleNrtEventGroupingPtrInput
	// A `incident` block as defined below.
	Incident AlertRuleNrtIncidentPtrInput
	// The ID of the Log Analytics Workspace this Sentinel NRT Alert Rule belongs to. Changing this forces a new Sentinel NRT Alert Rule to be created.
	LogAnalyticsWorkspaceId pulumi.StringPtrInput
	// The name which should be used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
	Name pulumi.StringPtrInput
	// The query of this Sentinel NRT Alert Rule.
	Query pulumi.StringPtrInput
	// A list of `sentinelEntityMapping` blocks as defined below.
	//
	// > **NOTE:** `entityMapping` and `sentinelEntityMapping` together can't exceed 5.
	SentinelEntityMappings AlertRuleNrtSentinelEntityMappingArrayInput
	// The alert severity of this Sentinel NRT Alert Rule. Possible values are `High`, `Medium`, `Low` and `Informational`.
	Severity pulumi.StringPtrInput
	// If `suppressionEnabled` is `true`, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to `PT5H`.
	SuppressionDuration pulumi.StringPtrInput
	// Should the Sentinel NRT Alert Rulea stop running query after alert is generated? Defaults to `false`.
	SuppressionEnabled pulumi.BoolPtrInput
	// A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `Impact`, `ImpairProcessControl`, `InhibitResponseFunction`, `InitialAccess`, `LateralMovement`, `Persistence`, `PreAttack`, `PrivilegeEscalation`, `Reconnaissance` and `ResourceDevelopment`.
	Tactics pulumi.StringArrayInput
	// A list of techniques of attacks by which to classify the rule.
	Techniques pulumi.StringArrayInput
}

func (AlertRuleNrtState) ElementType() reflect.Type {
	return reflect.TypeOf((*alertRuleNrtState)(nil)).Elem()
}

type alertRuleNrtArgs struct {
	// An `alertDetailsOverride` block as defined below.
	AlertDetailsOverrides []AlertRuleNrtAlertDetailsOverride `pulumi:"alertDetailsOverrides"`
	// The GUID of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
	AlertRuleTemplateGuid *string `pulumi:"alertRuleTemplateGuid"`
	// The version of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
	AlertRuleTemplateVersion *string `pulumi:"alertRuleTemplateVersion"`
	// A map of string key-value pairs of columns to be attached to this Sentinel NRT Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
	CustomDetails map[string]string `pulumi:"customDetails"`
	// The description of this Sentinel NRT Alert Rule.
	Description *string `pulumi:"description"`
	// The friendly name of this Sentinel NRT Alert Rule.
	DisplayName string `pulumi:"displayName"`
	// Should the Sentinel NRT Alert Rule be enabled? Defaults to `true`.
	Enabled *bool `pulumi:"enabled"`
	// A list of `entityMapping` blocks as defined below.
	EntityMappings []AlertRuleNrtEntityMapping `pulumi:"entityMappings"`
	// A `eventGrouping` block as defined below.
	//
	// > **NOTE:** `eventGrouping` will be required in the next major version of the AzureRM Provider.
	EventGrouping *AlertRuleNrtEventGrouping `pulumi:"eventGrouping"`
	// A `incident` block as defined below.
	Incident *AlertRuleNrtIncident `pulumi:"incident"`
	// The ID of the Log Analytics Workspace this Sentinel NRT Alert Rule belongs to. Changing this forces a new Sentinel NRT Alert Rule to be created.
	LogAnalyticsWorkspaceId string `pulumi:"logAnalyticsWorkspaceId"`
	// The name which should be used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
	Name *string `pulumi:"name"`
	// The query of this Sentinel NRT Alert Rule.
	Query string `pulumi:"query"`
	// A list of `sentinelEntityMapping` blocks as defined below.
	//
	// > **NOTE:** `entityMapping` and `sentinelEntityMapping` together can't exceed 5.
	SentinelEntityMappings []AlertRuleNrtSentinelEntityMapping `pulumi:"sentinelEntityMappings"`
	// The alert severity of this Sentinel NRT Alert Rule. Possible values are `High`, `Medium`, `Low` and `Informational`.
	Severity string `pulumi:"severity"`
	// If `suppressionEnabled` is `true`, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to `PT5H`.
	SuppressionDuration *string `pulumi:"suppressionDuration"`
	// Should the Sentinel NRT Alert Rulea stop running query after alert is generated? Defaults to `false`.
	SuppressionEnabled *bool `pulumi:"suppressionEnabled"`
	// A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `Impact`, `ImpairProcessControl`, `InhibitResponseFunction`, `InitialAccess`, `LateralMovement`, `Persistence`, `PreAttack`, `PrivilegeEscalation`, `Reconnaissance` and `ResourceDevelopment`.
	Tactics []string `pulumi:"tactics"`
	// A list of techniques of attacks by which to classify the rule.
	Techniques []string `pulumi:"techniques"`
}

// The set of arguments for constructing a AlertRuleNrt resource.
type AlertRuleNrtArgs struct {
	// An `alertDetailsOverride` block as defined below.
	AlertDetailsOverrides AlertRuleNrtAlertDetailsOverrideArrayInput
	// The GUID of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
	AlertRuleTemplateGuid pulumi.StringPtrInput
	// The version of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
	AlertRuleTemplateVersion pulumi.StringPtrInput
	// A map of string key-value pairs of columns to be attached to this Sentinel NRT Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
	CustomDetails pulumi.StringMapInput
	// The description of this Sentinel NRT Alert Rule.
	Description pulumi.StringPtrInput
	// The friendly name of this Sentinel NRT Alert Rule.
	DisplayName pulumi.StringInput
	// Should the Sentinel NRT Alert Rule be enabled? Defaults to `true`.
	Enabled pulumi.BoolPtrInput
	// A list of `entityMapping` blocks as defined below.
	EntityMappings AlertRuleNrtEntityMappingArrayInput
	// A `eventGrouping` block as defined below.
	//
	// > **NOTE:** `eventGrouping` will be required in the next major version of the AzureRM Provider.
	EventGrouping AlertRuleNrtEventGroupingPtrInput
	// A `incident` block as defined below.
	Incident AlertRuleNrtIncidentPtrInput
	// The ID of the Log Analytics Workspace this Sentinel NRT Alert Rule belongs to. Changing this forces a new Sentinel NRT Alert Rule to be created.
	LogAnalyticsWorkspaceId pulumi.StringInput
	// The name which should be used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
	Name pulumi.StringPtrInput
	// The query of this Sentinel NRT Alert Rule.
	Query pulumi.StringInput
	// A list of `sentinelEntityMapping` blocks as defined below.
	//
	// > **NOTE:** `entityMapping` and `sentinelEntityMapping` together can't exceed 5.
	SentinelEntityMappings AlertRuleNrtSentinelEntityMappingArrayInput
	// The alert severity of this Sentinel NRT Alert Rule. Possible values are `High`, `Medium`, `Low` and `Informational`.
	Severity pulumi.StringInput
	// If `suppressionEnabled` is `true`, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to `PT5H`.
	SuppressionDuration pulumi.StringPtrInput
	// Should the Sentinel NRT Alert Rulea stop running query after alert is generated? Defaults to `false`.
	SuppressionEnabled pulumi.BoolPtrInput
	// A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `Impact`, `ImpairProcessControl`, `InhibitResponseFunction`, `InitialAccess`, `LateralMovement`, `Persistence`, `PreAttack`, `PrivilegeEscalation`, `Reconnaissance` and `ResourceDevelopment`.
	Tactics pulumi.StringArrayInput
	// A list of techniques of attacks by which to classify the rule.
	Techniques pulumi.StringArrayInput
}

func (AlertRuleNrtArgs) ElementType() reflect.Type {
	return reflect.TypeOf((*alertRuleNrtArgs)(nil)).Elem()
}

type AlertRuleNrtInput interface {
	pulumi.Input

	ToAlertRuleNrtOutput() AlertRuleNrtOutput
	ToAlertRuleNrtOutputWithContext(ctx context.Context) AlertRuleNrtOutput
}

func (*AlertRuleNrt) ElementType() reflect.Type {
	return reflect.TypeOf((**AlertRuleNrt)(nil)).Elem()
}

func (i *AlertRuleNrt) ToAlertRuleNrtOutput() AlertRuleNrtOutput {
	return i.ToAlertRuleNrtOutputWithContext(context.Background())
}

func (i *AlertRuleNrt) ToAlertRuleNrtOutputWithContext(ctx context.Context) AlertRuleNrtOutput {
	return pulumi.ToOutputWithContext(ctx, i).(AlertRuleNrtOutput)
}

// AlertRuleNrtArrayInput is an input type that accepts AlertRuleNrtArray and AlertRuleNrtArrayOutput values.
// You can construct a concrete instance of `AlertRuleNrtArrayInput` via:
//
//	AlertRuleNrtArray{ AlertRuleNrtArgs{...} }
type AlertRuleNrtArrayInput interface {
	pulumi.Input

	ToAlertRuleNrtArrayOutput() AlertRuleNrtArrayOutput
	ToAlertRuleNrtArrayOutputWithContext(context.Context) AlertRuleNrtArrayOutput
}

type AlertRuleNrtArray []AlertRuleNrtInput

func (AlertRuleNrtArray) ElementType() reflect.Type {
	return reflect.TypeOf((*[]*AlertRuleNrt)(nil)).Elem()
}

func (i AlertRuleNrtArray) ToAlertRuleNrtArrayOutput() AlertRuleNrtArrayOutput {
	return i.ToAlertRuleNrtArrayOutputWithContext(context.Background())
}

func (i AlertRuleNrtArray) ToAlertRuleNrtArrayOutputWithContext(ctx context.Context) AlertRuleNrtArrayOutput {
	return pulumi.ToOutputWithContext(ctx, i).(AlertRuleNrtArrayOutput)
}

// AlertRuleNrtMapInput is an input type that accepts AlertRuleNrtMap and AlertRuleNrtMapOutput values.
// You can construct a concrete instance of `AlertRuleNrtMapInput` via:
//
//	AlertRuleNrtMap{ "key": AlertRuleNrtArgs{...} }
type AlertRuleNrtMapInput interface {
	pulumi.Input

	ToAlertRuleNrtMapOutput() AlertRuleNrtMapOutput
	ToAlertRuleNrtMapOutputWithContext(context.Context) AlertRuleNrtMapOutput
}

type AlertRuleNrtMap map[string]AlertRuleNrtInput

func (AlertRuleNrtMap) ElementType() reflect.Type {
	return reflect.TypeOf((*map[string]*AlertRuleNrt)(nil)).Elem()
}

func (i AlertRuleNrtMap) ToAlertRuleNrtMapOutput() AlertRuleNrtMapOutput {
	return i.ToAlertRuleNrtMapOutputWithContext(context.Background())
}

func (i AlertRuleNrtMap) ToAlertRuleNrtMapOutputWithContext(ctx context.Context) AlertRuleNrtMapOutput {
	return pulumi.ToOutputWithContext(ctx, i).(AlertRuleNrtMapOutput)
}

type AlertRuleNrtOutput struct{ *pulumi.OutputState }

func (AlertRuleNrtOutput) ElementType() reflect.Type {
	return reflect.TypeOf((**AlertRuleNrt)(nil)).Elem()
}

func (o AlertRuleNrtOutput) ToAlertRuleNrtOutput() AlertRuleNrtOutput {
	return o
}

func (o AlertRuleNrtOutput) ToAlertRuleNrtOutputWithContext(ctx context.Context) AlertRuleNrtOutput {
	return o
}

// An `alertDetailsOverride` block as defined below.
func (o AlertRuleNrtOutput) AlertDetailsOverrides() AlertRuleNrtAlertDetailsOverrideArrayOutput {
	return o.ApplyT(func(v *AlertRuleNrt) AlertRuleNrtAlertDetailsOverrideArrayOutput { return v.AlertDetailsOverrides }).(AlertRuleNrtAlertDetailsOverrideArrayOutput)
}

// The GUID of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
func (o AlertRuleNrtOutput) AlertRuleTemplateGuid() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *AlertRuleNrt) pulumi.StringPtrOutput { return v.AlertRuleTemplateGuid }).(pulumi.StringPtrOutput)
}

// The version of the alert rule template which is used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
func (o AlertRuleNrtOutput) AlertRuleTemplateVersion() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *AlertRuleNrt) pulumi.StringPtrOutput { return v.AlertRuleTemplateVersion }).(pulumi.StringPtrOutput)
}

// A map of string key-value pairs of columns to be attached to this Sentinel NRT Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
func (o AlertRuleNrtOutput) CustomDetails() pulumi.StringMapOutput {
	return o.ApplyT(func(v *AlertRuleNrt) pulumi.StringMapOutput { return v.CustomDetails }).(pulumi.StringMapOutput)
}

// The description of this Sentinel NRT Alert Rule.
func (o AlertRuleNrtOutput) Description() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *AlertRuleNrt) pulumi.StringPtrOutput { return v.Description }).(pulumi.StringPtrOutput)
}

// The friendly name of this Sentinel NRT Alert Rule.
func (o AlertRuleNrtOutput) DisplayName() pulumi.StringOutput {
	return o.ApplyT(func(v *AlertRuleNrt) pulumi.StringOutput { return v.DisplayName }).(pulumi.StringOutput)
}

// Should the Sentinel NRT Alert Rule be enabled? Defaults to `true`.
func (o AlertRuleNrtOutput) Enabled() pulumi.BoolPtrOutput {
	return o.ApplyT(func(v *AlertRuleNrt) pulumi.BoolPtrOutput { return v.Enabled }).(pulumi.BoolPtrOutput)
}

// A list of `entityMapping` blocks as defined below.
func (o AlertRuleNrtOutput) EntityMappings() AlertRuleNrtEntityMappingArrayOutput {
	return o.ApplyT(func(v *AlertRuleNrt) AlertRuleNrtEntityMappingArrayOutput { return v.EntityMappings }).(AlertRuleNrtEntityMappingArrayOutput)
}

// A `eventGrouping` block as defined below.
//
// > **NOTE:** `eventGrouping` will be required in the next major version of the AzureRM Provider.
func (o AlertRuleNrtOutput) EventGrouping() AlertRuleNrtEventGroupingOutput {
	return o.ApplyT(func(v *AlertRuleNrt) AlertRuleNrtEventGroupingOutput { return v.EventGrouping }).(AlertRuleNrtEventGroupingOutput)
}

// A `incident` block as defined below.
func (o AlertRuleNrtOutput) Incident() AlertRuleNrtIncidentOutput {
	return o.ApplyT(func(v *AlertRuleNrt) AlertRuleNrtIncidentOutput { return v.Incident }).(AlertRuleNrtIncidentOutput)
}

// The ID of the Log Analytics Workspace this Sentinel NRT Alert Rule belongs to. Changing this forces a new Sentinel NRT Alert Rule to be created.
func (o AlertRuleNrtOutput) LogAnalyticsWorkspaceId() pulumi.StringOutput {
	return o.ApplyT(func(v *AlertRuleNrt) pulumi.StringOutput { return v.LogAnalyticsWorkspaceId }).(pulumi.StringOutput)
}

// The name which should be used for this Sentinel NRT Alert Rule. Changing this forces a new Sentinel NRT Alert Rule to be created.
func (o AlertRuleNrtOutput) Name() pulumi.StringOutput {
	return o.ApplyT(func(v *AlertRuleNrt) pulumi.StringOutput { return v.Name }).(pulumi.StringOutput)
}

// The query of this Sentinel NRT Alert Rule.
func (o AlertRuleNrtOutput) Query() pulumi.StringOutput {
	return o.ApplyT(func(v *AlertRuleNrt) pulumi.StringOutput { return v.Query }).(pulumi.StringOutput)
}

// A list of `sentinelEntityMapping` blocks as defined below.
//
// > **NOTE:** `entityMapping` and `sentinelEntityMapping` together can't exceed 5.
func (o AlertRuleNrtOutput) SentinelEntityMappings() AlertRuleNrtSentinelEntityMappingArrayOutput {
	return o.ApplyT(func(v *AlertRuleNrt) AlertRuleNrtSentinelEntityMappingArrayOutput { return v.SentinelEntityMappings }).(AlertRuleNrtSentinelEntityMappingArrayOutput)
}

// The alert severity of this Sentinel NRT Alert Rule. Possible values are `High`, `Medium`, `Low` and `Informational`.
func (o AlertRuleNrtOutput) Severity() pulumi.StringOutput {
	return o.ApplyT(func(v *AlertRuleNrt) pulumi.StringOutput { return v.Severity }).(pulumi.StringOutput)
}

// If `suppressionEnabled` is `true`, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to `PT5H`.
func (o AlertRuleNrtOutput) SuppressionDuration() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *AlertRuleNrt) pulumi.StringPtrOutput { return v.SuppressionDuration }).(pulumi.StringPtrOutput)
}

// Should the Sentinel NRT Alert Rulea stop running query after alert is generated? Defaults to `false`.
func (o AlertRuleNrtOutput) SuppressionEnabled() pulumi.BoolPtrOutput {
	return o.ApplyT(func(v *AlertRuleNrt) pulumi.BoolPtrOutput { return v.SuppressionEnabled }).(pulumi.BoolPtrOutput)
}

// A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `Impact`, `ImpairProcessControl`, `InhibitResponseFunction`, `InitialAccess`, `LateralMovement`, `Persistence`, `PreAttack`, `PrivilegeEscalation`, `Reconnaissance` and `ResourceDevelopment`.
func (o AlertRuleNrtOutput) Tactics() pulumi.StringArrayOutput {
	return o.ApplyT(func(v *AlertRuleNrt) pulumi.StringArrayOutput { return v.Tactics }).(pulumi.StringArrayOutput)
}

// A list of techniques of attacks by which to classify the rule.
func (o AlertRuleNrtOutput) Techniques() pulumi.StringArrayOutput {
	return o.ApplyT(func(v *AlertRuleNrt) pulumi.StringArrayOutput { return v.Techniques }).(pulumi.StringArrayOutput)
}

type AlertRuleNrtArrayOutput struct{ *pulumi.OutputState }

func (AlertRuleNrtArrayOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*[]*AlertRuleNrt)(nil)).Elem()
}

func (o AlertRuleNrtArrayOutput) ToAlertRuleNrtArrayOutput() AlertRuleNrtArrayOutput {
	return o
}

func (o AlertRuleNrtArrayOutput) ToAlertRuleNrtArrayOutputWithContext(ctx context.Context) AlertRuleNrtArrayOutput {
	return o
}

func (o AlertRuleNrtArrayOutput) Index(i pulumi.IntInput) AlertRuleNrtOutput {
	return pulumi.All(o, i).ApplyT(func(vs []interface{}) *AlertRuleNrt {
		return vs[0].([]*AlertRuleNrt)[vs[1].(int)]
	}).(AlertRuleNrtOutput)
}

type AlertRuleNrtMapOutput struct{ *pulumi.OutputState }

func (AlertRuleNrtMapOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*map[string]*AlertRuleNrt)(nil)).Elem()
}

func (o AlertRuleNrtMapOutput) ToAlertRuleNrtMapOutput() AlertRuleNrtMapOutput {
	return o
}

func (o AlertRuleNrtMapOutput) ToAlertRuleNrtMapOutputWithContext(ctx context.Context) AlertRuleNrtMapOutput {
	return o
}

func (o AlertRuleNrtMapOutput) MapIndex(k pulumi.StringInput) AlertRuleNrtOutput {
	return pulumi.All(o, k).ApplyT(func(vs []interface{}) *AlertRuleNrt {
		return vs[0].(map[string]*AlertRuleNrt)[vs[1].(string)]
	}).(AlertRuleNrtOutput)
}

func init() {
	pulumi.RegisterInputType(reflect.TypeOf((*AlertRuleNrtInput)(nil)).Elem(), &AlertRuleNrt{})
	pulumi.RegisterInputType(reflect.TypeOf((*AlertRuleNrtArrayInput)(nil)).Elem(), AlertRuleNrtArray{})
	pulumi.RegisterInputType(reflect.TypeOf((*AlertRuleNrtMapInput)(nil)).Elem(), AlertRuleNrtMap{})
	pulumi.RegisterOutputType(AlertRuleNrtOutput{})
	pulumi.RegisterOutputType(AlertRuleNrtArrayOutput{})
	pulumi.RegisterOutputType(AlertRuleNrtMapOutput{})
}