alertRuleScheduled.go

// Code generated by the Pulumi Terraform Bridge (tfgen) Tool DO NOT EDIT.
// *** WARNING: Do not edit by hand unless you're certain you know what you are doing! ***

package sentinel

import (
	"context"
	"reflect"

	"errors"
	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/internal"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

// Manages a Sentinel Scheduled Alert Rule.
//
// ## Example Usage
//
// ```go
// package main
//
// import (
//
//	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/core"
//	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/operationalinsights"
//	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/sentinel"
//	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
//
// )
//
//	func main() {
//		pulumi.Run(func(ctx *pulumi.Context) error {
//			example, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
//				Name:     pulumi.String("example-resources"),
//				Location: pulumi.String("West Europe"),
//			})
//			if err != nil {
//				return err
//			}
//			exampleAnalyticsWorkspace, err := operationalinsights.NewAnalyticsWorkspace(ctx, "example", &operationalinsights.AnalyticsWorkspaceArgs{
//				Name:              pulumi.String("example-workspace"),
//				Location:          example.Location,
//				ResourceGroupName: example.Name,
//				Sku:               pulumi.String("PerGB2018"),
//			})
//			if err != nil {
//				return err
//			}
//			exampleLogAnalyticsWorkspaceOnboarding, err := sentinel.NewLogAnalyticsWorkspaceOnboarding(ctx, "example", &sentinel.LogAnalyticsWorkspaceOnboardingArgs{
//				WorkspaceId: exampleAnalyticsWorkspace.ID(),
//			})
//			if err != nil {
//				return err
//			}
//			_, err = sentinel.NewAlertRuleScheduled(ctx, "example", &sentinel.AlertRuleScheduledArgs{
//				Name:                    pulumi.String("example"),
//				LogAnalyticsWorkspaceId: exampleLogAnalyticsWorkspaceOnboarding.WorkspaceId,
//				DisplayName:             pulumi.String("example"),
//				Severity:                pulumi.String("High"),
//				Query:                   pulumi.String("AzureActivity |\n  where OperationName == \"Create or Update Virtual Machine\" or OperationName ==\"Create Deployment\" |\n  where ActivityStatus == \"Succeeded\" |\n  make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller\n"),
//			})
//			if err != nil {
//				return err
//			}
//			return nil
//		})
//	}
//
// ```
//
// ## Import
//
// Sentinel Scheduled Alert Rules can be imported using the `resource id`, e.g.
//
// ```sh
// $ pulumi import azure:sentinel/alertRuleScheduled:AlertRuleScheduled example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.OperationalInsights/workspaces/workspace1/providers/Microsoft.SecurityInsights/alertRules/rule1
// ```
type AlertRuleScheduled struct {
	pulumi.CustomResourceState

	// An `alertDetailsOverride` block as defined below.
	AlertDetailsOverrides AlertRuleScheduledAlertDetailsOverrideArrayOutput `pulumi:"alertDetailsOverrides"`
	// The GUID of the alert rule template which is used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	AlertRuleTemplateGuid pulumi.StringPtrOutput `pulumi:"alertRuleTemplateGuid"`
	// The version of the alert rule template which is used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	AlertRuleTemplateVersion pulumi.StringPtrOutput `pulumi:"alertRuleTemplateVersion"`
	// A map of string key-value pairs of columns to be attached to this Sentinel Scheduled Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
	CustomDetails pulumi.StringMapOutput `pulumi:"customDetails"`
	// The description of this Sentinel Scheduled Alert Rule.
	Description pulumi.StringPtrOutput `pulumi:"description"`
	// The friendly name of this Sentinel Scheduled Alert Rule.
	DisplayName pulumi.StringOutput `pulumi:"displayName"`
	// Should the Sentinel Scheduled Alert Rule be enabled? Defaults to `true`.
	Enabled pulumi.BoolPtrOutput `pulumi:"enabled"`
	// A list of `entityMapping` blocks as defined below.
	EntityMappings AlertRuleScheduledEntityMappingArrayOutput `pulumi:"entityMappings"`
	// A `eventGrouping` block as defined below.
	EventGrouping AlertRuleScheduledEventGroupingPtrOutput `pulumi:"eventGrouping"`
	// A `incidentConfiguration` block as defined below.
	IncidentConfiguration AlertRuleScheduledIncidentConfigurationOutput `pulumi:"incidentConfiguration"`
	// The ID of the Log Analytics Workspace this Sentinel Scheduled Alert Rule belongs to. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	LogAnalyticsWorkspaceId pulumi.StringOutput `pulumi:"logAnalyticsWorkspaceId"`
	// The name which should be used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	Name pulumi.StringOutput `pulumi:"name"`
	// The query of this Sentinel Scheduled Alert Rule.
	Query pulumi.StringOutput `pulumi:"query"`
	// The ISO 8601 timespan duration between two consecutive queries. Defaults to `PT5H`.
	QueryFrequency pulumi.StringPtrOutput `pulumi:"queryFrequency"`
	// The ISO 8601 timespan duration, which determine the time period of the data covered by the query. For example, it can query the past 10 minutes of data, or the past 6 hours of data. Defaults to `PT5H`.
	//
	// > **NOTE** `queryPeriod` must larger than or equal to `queryFrequency`, which ensures there is no gaps in the overall query coverage.
	QueryPeriod pulumi.StringPtrOutput `pulumi:"queryPeriod"`
	// A list of `sentinelEntityMapping` blocks as defined below.
	//
	// > **NOTE:** `entityMapping` and `sentinelEntityMapping` together can't exceed 5.
	SentinelEntityMappings AlertRuleScheduledSentinelEntityMappingArrayOutput `pulumi:"sentinelEntityMappings"`
	// The alert severity of this Sentinel Scheduled Alert Rule. Possible values are `High`, `Medium`, `Low` and `Informational`.
	Severity pulumi.StringOutput `pulumi:"severity"`
	// If `suppressionEnabled` is `true`, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to `PT5H`.
	//
	// > **NOTE** `suppressionDuration` must larger than or equal to `queryFrequency`, otherwise the suppression has no actual effect since no query will happen during the suppression duration.
	SuppressionDuration pulumi.StringPtrOutput `pulumi:"suppressionDuration"`
	// Should the Sentinel Scheduled Alert Rulea stop running query after alert is generated? Defaults to `false`.
	SuppressionEnabled pulumi.BoolPtrOutput `pulumi:"suppressionEnabled"`
	// A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `ImpairProcessControl`, `InhibitResponseFunction`, `Impact`, `InitialAccess`, `LateralMovement`, `Persistence`, `PrivilegeEscalation`, `PreAttack`, `Reconnaissance` and `ResourceDevelopment`.
	Tactics pulumi.StringArrayOutput `pulumi:"tactics"`
	// A list of techniques of attacks by which to classify the rule.
	Techniques pulumi.StringArrayOutput `pulumi:"techniques"`
	// The alert trigger operator, combined with `triggerThreshold`, setting alert threshold of this Sentinel Scheduled Alert Rule. Possible values are `Equal`, `GreaterThan`, `LessThan`, `NotEqual`. Defaults to `GreaterThan`.
	TriggerOperator pulumi.StringPtrOutput `pulumi:"triggerOperator"`
	// The baseline number of query results generated, combined with `triggerOperator`, setting alert threshold of this Sentinel Scheduled Alert Rule. Defaults to `0`.
	TriggerThreshold pulumi.IntPtrOutput `pulumi:"triggerThreshold"`
}

// NewAlertRuleScheduled registers a new resource with the given unique name, arguments, and options.
func NewAlertRuleScheduled(ctx *pulumi.Context,
	name string, args *AlertRuleScheduledArgs, opts ...pulumi.ResourceOption) (*AlertRuleScheduled, error) {
	if args == nil {
		return nil, errors.New("missing one or more required arguments")
	}

	if args.DisplayName == nil {
		return nil, errors.New("invalid value for required argument 'DisplayName'")
	}
	if args.LogAnalyticsWorkspaceId == nil {
		return nil, errors.New("invalid value for required argument 'LogAnalyticsWorkspaceId'")
	}
	if args.Query == nil {
		return nil, errors.New("invalid value for required argument 'Query'")
	}
	if args.Severity == nil {
		return nil, errors.New("invalid value for required argument 'Severity'")
	}
	opts = internal.PkgResourceDefaultOpts(opts)
	var resource AlertRuleScheduled
	err := ctx.RegisterResource("azure:sentinel/alertRuleScheduled:AlertRuleScheduled", name, args, &resource, opts...)
	if err != nil {
		return nil, err
	}
	return &resource, nil
}

// GetAlertRuleScheduled gets an existing AlertRuleScheduled resource's state with the given name, ID, and optional
// state properties that are used to uniquely qualify the lookup (nil if not required).
func GetAlertRuleScheduled(ctx *pulumi.Context,
	name string, id pulumi.IDInput, state *AlertRuleScheduledState, opts ...pulumi.ResourceOption) (*AlertRuleScheduled, error) {
	var resource AlertRuleScheduled
	err := ctx.ReadResource("azure:sentinel/alertRuleScheduled:AlertRuleScheduled", name, id, state, &resource, opts...)
	if err != nil {
		return nil, err
	}
	return &resource, nil
}

// Input properties used for looking up and filtering AlertRuleScheduled resources.
type alertRuleScheduledState struct {
	// An `alertDetailsOverride` block as defined below.
	AlertDetailsOverrides []AlertRuleScheduledAlertDetailsOverride `pulumi:"alertDetailsOverrides"`
	// The GUID of the alert rule template which is used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	AlertRuleTemplateGuid *string `pulumi:"alertRuleTemplateGuid"`
	// The version of the alert rule template which is used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	AlertRuleTemplateVersion *string `pulumi:"alertRuleTemplateVersion"`
	// A map of string key-value pairs of columns to be attached to this Sentinel Scheduled Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
	CustomDetails map[string]string `pulumi:"customDetails"`
	// The description of this Sentinel Scheduled Alert Rule.
	Description *string `pulumi:"description"`
	// The friendly name of this Sentinel Scheduled Alert Rule.
	DisplayName *string `pulumi:"displayName"`
	// Should the Sentinel Scheduled Alert Rule be enabled? Defaults to `true`.
	Enabled *bool `pulumi:"enabled"`
	// A list of `entityMapping` blocks as defined below.
	EntityMappings []AlertRuleScheduledEntityMapping `pulumi:"entityMappings"`
	// A `eventGrouping` block as defined below.
	EventGrouping *AlertRuleScheduledEventGrouping `pulumi:"eventGrouping"`
	// A `incidentConfiguration` block as defined below.
	IncidentConfiguration *AlertRuleScheduledIncidentConfiguration `pulumi:"incidentConfiguration"`
	// The ID of the Log Analytics Workspace this Sentinel Scheduled Alert Rule belongs to. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	LogAnalyticsWorkspaceId *string `pulumi:"logAnalyticsWorkspaceId"`
	// The name which should be used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	Name *string `pulumi:"name"`
	// The query of this Sentinel Scheduled Alert Rule.
	Query *string `pulumi:"query"`
	// The ISO 8601 timespan duration between two consecutive queries. Defaults to `PT5H`.
	QueryFrequency *string `pulumi:"queryFrequency"`
	// The ISO 8601 timespan duration, which determine the time period of the data covered by the query. For example, it can query the past 10 minutes of data, or the past 6 hours of data. Defaults to `PT5H`.
	//
	// > **NOTE** `queryPeriod` must larger than or equal to `queryFrequency`, which ensures there is no gaps in the overall query coverage.
	QueryPeriod *string `pulumi:"queryPeriod"`
	// A list of `sentinelEntityMapping` blocks as defined below.
	//
	// > **NOTE:** `entityMapping` and `sentinelEntityMapping` together can't exceed 5.
	SentinelEntityMappings []AlertRuleScheduledSentinelEntityMapping `pulumi:"sentinelEntityMappings"`
	// The alert severity of this Sentinel Scheduled Alert Rule. Possible values are `High`, `Medium`, `Low` and `Informational`.
	Severity *string `pulumi:"severity"`
	// If `suppressionEnabled` is `true`, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to `PT5H`.
	//
	// > **NOTE** `suppressionDuration` must larger than or equal to `queryFrequency`, otherwise the suppression has no actual effect since no query will happen during the suppression duration.
	SuppressionDuration *string `pulumi:"suppressionDuration"`
	// Should the Sentinel Scheduled Alert Rulea stop running query after alert is generated? Defaults to `false`.
	SuppressionEnabled *bool `pulumi:"suppressionEnabled"`
	// A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `ImpairProcessControl`, `InhibitResponseFunction`, `Impact`, `InitialAccess`, `LateralMovement`, `Persistence`, `PrivilegeEscalation`, `PreAttack`, `Reconnaissance` and `ResourceDevelopment`.
	Tactics []string `pulumi:"tactics"`
	// A list of techniques of attacks by which to classify the rule.
	Techniques []string `pulumi:"techniques"`
	// The alert trigger operator, combined with `triggerThreshold`, setting alert threshold of this Sentinel Scheduled Alert Rule. Possible values are `Equal`, `GreaterThan`, `LessThan`, `NotEqual`. Defaults to `GreaterThan`.
	TriggerOperator *string `pulumi:"triggerOperator"`
	// The baseline number of query results generated, combined with `triggerOperator`, setting alert threshold of this Sentinel Scheduled Alert Rule. Defaults to `0`.
	TriggerThreshold *int `pulumi:"triggerThreshold"`
}

type AlertRuleScheduledState struct {
	// An `alertDetailsOverride` block as defined below.
	AlertDetailsOverrides AlertRuleScheduledAlertDetailsOverrideArrayInput
	// The GUID of the alert rule template which is used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	AlertRuleTemplateGuid pulumi.StringPtrInput
	// The version of the alert rule template which is used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	AlertRuleTemplateVersion pulumi.StringPtrInput
	// A map of string key-value pairs of columns to be attached to this Sentinel Scheduled Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
	CustomDetails pulumi.StringMapInput
	// The description of this Sentinel Scheduled Alert Rule.
	Description pulumi.StringPtrInput
	// The friendly name of this Sentinel Scheduled Alert Rule.
	DisplayName pulumi.StringPtrInput
	// Should the Sentinel Scheduled Alert Rule be enabled? Defaults to `true`.
	Enabled pulumi.BoolPtrInput
	// A list of `entityMapping` blocks as defined below.
	EntityMappings AlertRuleScheduledEntityMappingArrayInput
	// A `eventGrouping` block as defined below.
	EventGrouping AlertRuleScheduledEventGroupingPtrInput
	// A `incidentConfiguration` block as defined below.
	IncidentConfiguration AlertRuleScheduledIncidentConfigurationPtrInput
	// The ID of the Log Analytics Workspace this Sentinel Scheduled Alert Rule belongs to. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	LogAnalyticsWorkspaceId pulumi.StringPtrInput
	// The name which should be used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	Name pulumi.StringPtrInput
	// The query of this Sentinel Scheduled Alert Rule.
	Query pulumi.StringPtrInput
	// The ISO 8601 timespan duration between two consecutive queries. Defaults to `PT5H`.
	QueryFrequency pulumi.StringPtrInput
	// The ISO 8601 timespan duration, which determine the time period of the data covered by the query. For example, it can query the past 10 minutes of data, or the past 6 hours of data. Defaults to `PT5H`.
	//
	// > **NOTE** `queryPeriod` must larger than or equal to `queryFrequency`, which ensures there is no gaps in the overall query coverage.
	QueryPeriod pulumi.StringPtrInput
	// A list of `sentinelEntityMapping` blocks as defined below.
	//
	// > **NOTE:** `entityMapping` and `sentinelEntityMapping` together can't exceed 5.
	SentinelEntityMappings AlertRuleScheduledSentinelEntityMappingArrayInput
	// The alert severity of this Sentinel Scheduled Alert Rule. Possible values are `High`, `Medium`, `Low` and `Informational`.
	Severity pulumi.StringPtrInput
	// If `suppressionEnabled` is `true`, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to `PT5H`.
	//
	// > **NOTE** `suppressionDuration` must larger than or equal to `queryFrequency`, otherwise the suppression has no actual effect since no query will happen during the suppression duration.
	SuppressionDuration pulumi.StringPtrInput
	// Should the Sentinel Scheduled Alert Rulea stop running query after alert is generated? Defaults to `false`.
	SuppressionEnabled pulumi.BoolPtrInput
	// A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `ImpairProcessControl`, `InhibitResponseFunction`, `Impact`, `InitialAccess`, `LateralMovement`, `Persistence`, `PrivilegeEscalation`, `PreAttack`, `Reconnaissance` and `ResourceDevelopment`.
	Tactics pulumi.StringArrayInput
	// A list of techniques of attacks by which to classify the rule.
	Techniques pulumi.StringArrayInput
	// The alert trigger operator, combined with `triggerThreshold`, setting alert threshold of this Sentinel Scheduled Alert Rule. Possible values are `Equal`, `GreaterThan`, `LessThan`, `NotEqual`. Defaults to `GreaterThan`.
	TriggerOperator pulumi.StringPtrInput
	// The baseline number of query results generated, combined with `triggerOperator`, setting alert threshold of this Sentinel Scheduled Alert Rule. Defaults to `0`.
	TriggerThreshold pulumi.IntPtrInput
}

func (AlertRuleScheduledState) ElementType() reflect.Type {
	return reflect.TypeOf((*alertRuleScheduledState)(nil)).Elem()
}

type alertRuleScheduledArgs struct {
	// An `alertDetailsOverride` block as defined below.
	AlertDetailsOverrides []AlertRuleScheduledAlertDetailsOverride `pulumi:"alertDetailsOverrides"`
	// The GUID of the alert rule template which is used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	AlertRuleTemplateGuid *string `pulumi:"alertRuleTemplateGuid"`
	// The version of the alert rule template which is used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	AlertRuleTemplateVersion *string `pulumi:"alertRuleTemplateVersion"`
	// A map of string key-value pairs of columns to be attached to this Sentinel Scheduled Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
	CustomDetails map[string]string `pulumi:"customDetails"`
	// The description of this Sentinel Scheduled Alert Rule.
	Description *string `pulumi:"description"`
	// The friendly name of this Sentinel Scheduled Alert Rule.
	DisplayName string `pulumi:"displayName"`
	// Should the Sentinel Scheduled Alert Rule be enabled? Defaults to `true`.
	Enabled *bool `pulumi:"enabled"`
	// A list of `entityMapping` blocks as defined below.
	EntityMappings []AlertRuleScheduledEntityMapping `pulumi:"entityMappings"`
	// A `eventGrouping` block as defined below.
	EventGrouping *AlertRuleScheduledEventGrouping `pulumi:"eventGrouping"`
	// A `incidentConfiguration` block as defined below.
	IncidentConfiguration *AlertRuleScheduledIncidentConfiguration `pulumi:"incidentConfiguration"`
	// The ID of the Log Analytics Workspace this Sentinel Scheduled Alert Rule belongs to. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	LogAnalyticsWorkspaceId string `pulumi:"logAnalyticsWorkspaceId"`
	// The name which should be used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	Name *string `pulumi:"name"`
	// The query of this Sentinel Scheduled Alert Rule.
	Query string `pulumi:"query"`
	// The ISO 8601 timespan duration between two consecutive queries. Defaults to `PT5H`.
	QueryFrequency *string `pulumi:"queryFrequency"`
	// The ISO 8601 timespan duration, which determine the time period of the data covered by the query. For example, it can query the past 10 minutes of data, or the past 6 hours of data. Defaults to `PT5H`.
	//
	// > **NOTE** `queryPeriod` must larger than or equal to `queryFrequency`, which ensures there is no gaps in the overall query coverage.
	QueryPeriod *string `pulumi:"queryPeriod"`
	// A list of `sentinelEntityMapping` blocks as defined below.
	//
	// > **NOTE:** `entityMapping` and `sentinelEntityMapping` together can't exceed 5.
	SentinelEntityMappings []AlertRuleScheduledSentinelEntityMapping `pulumi:"sentinelEntityMappings"`
	// The alert severity of this Sentinel Scheduled Alert Rule. Possible values are `High`, `Medium`, `Low` and `Informational`.
	Severity string `pulumi:"severity"`
	// If `suppressionEnabled` is `true`, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to `PT5H`.
	//
	// > **NOTE** `suppressionDuration` must larger than or equal to `queryFrequency`, otherwise the suppression has no actual effect since no query will happen during the suppression duration.
	SuppressionDuration *string `pulumi:"suppressionDuration"`
	// Should the Sentinel Scheduled Alert Rulea stop running query after alert is generated? Defaults to `false`.
	SuppressionEnabled *bool `pulumi:"suppressionEnabled"`
	// A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `ImpairProcessControl`, `InhibitResponseFunction`, `Impact`, `InitialAccess`, `LateralMovement`, `Persistence`, `PrivilegeEscalation`, `PreAttack`, `Reconnaissance` and `ResourceDevelopment`.
	Tactics []string `pulumi:"tactics"`
	// A list of techniques of attacks by which to classify the rule.
	Techniques []string `pulumi:"techniques"`
	// The alert trigger operator, combined with `triggerThreshold`, setting alert threshold of this Sentinel Scheduled Alert Rule. Possible values are `Equal`, `GreaterThan`, `LessThan`, `NotEqual`. Defaults to `GreaterThan`.
	TriggerOperator *string `pulumi:"triggerOperator"`
	// The baseline number of query results generated, combined with `triggerOperator`, setting alert threshold of this Sentinel Scheduled Alert Rule. Defaults to `0`.
	TriggerThreshold *int `pulumi:"triggerThreshold"`
}

// The set of arguments for constructing a AlertRuleScheduled resource.
type AlertRuleScheduledArgs struct {
	// An `alertDetailsOverride` block as defined below.
	AlertDetailsOverrides AlertRuleScheduledAlertDetailsOverrideArrayInput
	// The GUID of the alert rule template which is used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	AlertRuleTemplateGuid pulumi.StringPtrInput
	// The version of the alert rule template which is used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	AlertRuleTemplateVersion pulumi.StringPtrInput
	// A map of string key-value pairs of columns to be attached to this Sentinel Scheduled Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
	CustomDetails pulumi.StringMapInput
	// The description of this Sentinel Scheduled Alert Rule.
	Description pulumi.StringPtrInput
	// The friendly name of this Sentinel Scheduled Alert Rule.
	DisplayName pulumi.StringInput
	// Should the Sentinel Scheduled Alert Rule be enabled? Defaults to `true`.
	Enabled pulumi.BoolPtrInput
	// A list of `entityMapping` blocks as defined below.
	EntityMappings AlertRuleScheduledEntityMappingArrayInput
	// A `eventGrouping` block as defined below.
	EventGrouping AlertRuleScheduledEventGroupingPtrInput
	// A `incidentConfiguration` block as defined below.
	IncidentConfiguration AlertRuleScheduledIncidentConfigurationPtrInput
	// The ID of the Log Analytics Workspace this Sentinel Scheduled Alert Rule belongs to. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	LogAnalyticsWorkspaceId pulumi.StringInput
	// The name which should be used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
	Name pulumi.StringPtrInput
	// The query of this Sentinel Scheduled Alert Rule.
	Query pulumi.StringInput
	// The ISO 8601 timespan duration between two consecutive queries. Defaults to `PT5H`.
	QueryFrequency pulumi.StringPtrInput
	// The ISO 8601 timespan duration, which determine the time period of the data covered by the query. For example, it can query the past 10 minutes of data, or the past 6 hours of data. Defaults to `PT5H`.
	//
	// > **NOTE** `queryPeriod` must larger than or equal to `queryFrequency`, which ensures there is no gaps in the overall query coverage.
	QueryPeriod pulumi.StringPtrInput
	// A list of `sentinelEntityMapping` blocks as defined below.
	//
	// > **NOTE:** `entityMapping` and `sentinelEntityMapping` together can't exceed 5.
	SentinelEntityMappings AlertRuleScheduledSentinelEntityMappingArrayInput
	// The alert severity of this Sentinel Scheduled Alert Rule. Possible values are `High`, `Medium`, `Low` and `Informational`.
	Severity pulumi.StringInput
	// If `suppressionEnabled` is `true`, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to `PT5H`.
	//
	// > **NOTE** `suppressionDuration` must larger than or equal to `queryFrequency`, otherwise the suppression has no actual effect since no query will happen during the suppression duration.
	SuppressionDuration pulumi.StringPtrInput
	// Should the Sentinel Scheduled Alert Rulea stop running query after alert is generated? Defaults to `false`.
	SuppressionEnabled pulumi.BoolPtrInput
	// A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `ImpairProcessControl`, `InhibitResponseFunction`, `Impact`, `InitialAccess`, `LateralMovement`, `Persistence`, `PrivilegeEscalation`, `PreAttack`, `Reconnaissance` and `ResourceDevelopment`.
	Tactics pulumi.StringArrayInput
	// A list of techniques of attacks by which to classify the rule.
	Techniques pulumi.StringArrayInput
	// The alert trigger operator, combined with `triggerThreshold`, setting alert threshold of this Sentinel Scheduled Alert Rule. Possible values are `Equal`, `GreaterThan`, `LessThan`, `NotEqual`. Defaults to `GreaterThan`.
	TriggerOperator pulumi.StringPtrInput
	// The baseline number of query results generated, combined with `triggerOperator`, setting alert threshold of this Sentinel Scheduled Alert Rule. Defaults to `0`.
	TriggerThreshold pulumi.IntPtrInput
}

func (AlertRuleScheduledArgs) ElementType() reflect.Type {
	return reflect.TypeOf((*alertRuleScheduledArgs)(nil)).Elem()
}

type AlertRuleScheduledInput interface {
	pulumi.Input

	ToAlertRuleScheduledOutput() AlertRuleScheduledOutput
	ToAlertRuleScheduledOutputWithContext(ctx context.Context) AlertRuleScheduledOutput
}

func (*AlertRuleScheduled) ElementType() reflect.Type {
	return reflect.TypeOf((**AlertRuleScheduled)(nil)).Elem()
}

func (i *AlertRuleScheduled) ToAlertRuleScheduledOutput() AlertRuleScheduledOutput {
	return i.ToAlertRuleScheduledOutputWithContext(context.Background())
}

func (i *AlertRuleScheduled) ToAlertRuleScheduledOutputWithContext(ctx context.Context) AlertRuleScheduledOutput {
	return pulumi.ToOutputWithContext(ctx, i).(AlertRuleScheduledOutput)
}

// AlertRuleScheduledArrayInput is an input type that accepts AlertRuleScheduledArray and AlertRuleScheduledArrayOutput values.
// You can construct a concrete instance of `AlertRuleScheduledArrayInput` via:
//
//	AlertRuleScheduledArray{ AlertRuleScheduledArgs{...} }
type AlertRuleScheduledArrayInput interface {
	pulumi.Input

	ToAlertRuleScheduledArrayOutput() AlertRuleScheduledArrayOutput
	ToAlertRuleScheduledArrayOutputWithContext(context.Context) AlertRuleScheduledArrayOutput
}

type AlertRuleScheduledArray []AlertRuleScheduledInput

func (AlertRuleScheduledArray) ElementType() reflect.Type {
	return reflect.TypeOf((*[]*AlertRuleScheduled)(nil)).Elem()
}

func (i AlertRuleScheduledArray) ToAlertRuleScheduledArrayOutput() AlertRuleScheduledArrayOutput {
	return i.ToAlertRuleScheduledArrayOutputWithContext(context.Background())
}

func (i AlertRuleScheduledArray) ToAlertRuleScheduledArrayOutputWithContext(ctx context.Context) AlertRuleScheduledArrayOutput {
	return pulumi.ToOutputWithContext(ctx, i).(AlertRuleScheduledArrayOutput)
}

// AlertRuleScheduledMapInput is an input type that accepts AlertRuleScheduledMap and AlertRuleScheduledMapOutput values.
// You can construct a concrete instance of `AlertRuleScheduledMapInput` via:
//
//	AlertRuleScheduledMap{ "key": AlertRuleScheduledArgs{...} }
type AlertRuleScheduledMapInput interface {
	pulumi.Input

	ToAlertRuleScheduledMapOutput() AlertRuleScheduledMapOutput
	ToAlertRuleScheduledMapOutputWithContext(context.Context) AlertRuleScheduledMapOutput
}

type AlertRuleScheduledMap map[string]AlertRuleScheduledInput

func (AlertRuleScheduledMap) ElementType() reflect.Type {
	return reflect.TypeOf((*map[string]*AlertRuleScheduled)(nil)).Elem()
}

func (i AlertRuleScheduledMap) ToAlertRuleScheduledMapOutput() AlertRuleScheduledMapOutput {
	return i.ToAlertRuleScheduledMapOutputWithContext(context.Background())
}

func (i AlertRuleScheduledMap) ToAlertRuleScheduledMapOutputWithContext(ctx context.Context) AlertRuleScheduledMapOutput {
	return pulumi.ToOutputWithContext(ctx, i).(AlertRuleScheduledMapOutput)
}

type AlertRuleScheduledOutput struct{ *pulumi.OutputState }

func (AlertRuleScheduledOutput) ElementType() reflect.Type {
	return reflect.TypeOf((**AlertRuleScheduled)(nil)).Elem()
}

func (o AlertRuleScheduledOutput) ToAlertRuleScheduledOutput() AlertRuleScheduledOutput {
	return o
}

func (o AlertRuleScheduledOutput) ToAlertRuleScheduledOutputWithContext(ctx context.Context) AlertRuleScheduledOutput {
	return o
}

// An `alertDetailsOverride` block as defined below.
func (o AlertRuleScheduledOutput) AlertDetailsOverrides() AlertRuleScheduledAlertDetailsOverrideArrayOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) AlertRuleScheduledAlertDetailsOverrideArrayOutput {
		return v.AlertDetailsOverrides
	}).(AlertRuleScheduledAlertDetailsOverrideArrayOutput)
}

// The GUID of the alert rule template which is used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
func (o AlertRuleScheduledOutput) AlertRuleTemplateGuid() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) pulumi.StringPtrOutput { return v.AlertRuleTemplateGuid }).(pulumi.StringPtrOutput)
}

// The version of the alert rule template which is used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
func (o AlertRuleScheduledOutput) AlertRuleTemplateVersion() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) pulumi.StringPtrOutput { return v.AlertRuleTemplateVersion }).(pulumi.StringPtrOutput)
}

// A map of string key-value pairs of columns to be attached to this Sentinel Scheduled Alert Rule. The key will appear as the field name in alerts and the value is the event parameter you wish to surface in the alerts.
func (o AlertRuleScheduledOutput) CustomDetails() pulumi.StringMapOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) pulumi.StringMapOutput { return v.CustomDetails }).(pulumi.StringMapOutput)
}

// The description of this Sentinel Scheduled Alert Rule.
func (o AlertRuleScheduledOutput) Description() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) pulumi.StringPtrOutput { return v.Description }).(pulumi.StringPtrOutput)
}

// The friendly name of this Sentinel Scheduled Alert Rule.
func (o AlertRuleScheduledOutput) DisplayName() pulumi.StringOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) pulumi.StringOutput { return v.DisplayName }).(pulumi.StringOutput)
}

// Should the Sentinel Scheduled Alert Rule be enabled? Defaults to `true`.
func (o AlertRuleScheduledOutput) Enabled() pulumi.BoolPtrOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) pulumi.BoolPtrOutput { return v.Enabled }).(pulumi.BoolPtrOutput)
}

// A list of `entityMapping` blocks as defined below.
func (o AlertRuleScheduledOutput) EntityMappings() AlertRuleScheduledEntityMappingArrayOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) AlertRuleScheduledEntityMappingArrayOutput { return v.EntityMappings }).(AlertRuleScheduledEntityMappingArrayOutput)
}

// A `eventGrouping` block as defined below.
func (o AlertRuleScheduledOutput) EventGrouping() AlertRuleScheduledEventGroupingPtrOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) AlertRuleScheduledEventGroupingPtrOutput { return v.EventGrouping }).(AlertRuleScheduledEventGroupingPtrOutput)
}

// A `incidentConfiguration` block as defined below.
func (o AlertRuleScheduledOutput) IncidentConfiguration() AlertRuleScheduledIncidentConfigurationOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) AlertRuleScheduledIncidentConfigurationOutput {
		return v.IncidentConfiguration
	}).(AlertRuleScheduledIncidentConfigurationOutput)
}

// The ID of the Log Analytics Workspace this Sentinel Scheduled Alert Rule belongs to. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
func (o AlertRuleScheduledOutput) LogAnalyticsWorkspaceId() pulumi.StringOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) pulumi.StringOutput { return v.LogAnalyticsWorkspaceId }).(pulumi.StringOutput)
}

// The name which should be used for this Sentinel Scheduled Alert Rule. Changing this forces a new Sentinel Scheduled Alert Rule to be created.
func (o AlertRuleScheduledOutput) Name() pulumi.StringOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) pulumi.StringOutput { return v.Name }).(pulumi.StringOutput)
}

// The query of this Sentinel Scheduled Alert Rule.
func (o AlertRuleScheduledOutput) Query() pulumi.StringOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) pulumi.StringOutput { return v.Query }).(pulumi.StringOutput)
}

// The ISO 8601 timespan duration between two consecutive queries. Defaults to `PT5H`.
func (o AlertRuleScheduledOutput) QueryFrequency() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) pulumi.StringPtrOutput { return v.QueryFrequency }).(pulumi.StringPtrOutput)
}

// The ISO 8601 timespan duration, which determine the time period of the data covered by the query. For example, it can query the past 10 minutes of data, or the past 6 hours of data. Defaults to `PT5H`.
//
// > **NOTE** `queryPeriod` must larger than or equal to `queryFrequency`, which ensures there is no gaps in the overall query coverage.
func (o AlertRuleScheduledOutput) QueryPeriod() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) pulumi.StringPtrOutput { return v.QueryPeriod }).(pulumi.StringPtrOutput)
}

// A list of `sentinelEntityMapping` blocks as defined below.
//
// > **NOTE:** `entityMapping` and `sentinelEntityMapping` together can't exceed 5.
func (o AlertRuleScheduledOutput) SentinelEntityMappings() AlertRuleScheduledSentinelEntityMappingArrayOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) AlertRuleScheduledSentinelEntityMappingArrayOutput {
		return v.SentinelEntityMappings
	}).(AlertRuleScheduledSentinelEntityMappingArrayOutput)
}

// The alert severity of this Sentinel Scheduled Alert Rule. Possible values are `High`, `Medium`, `Low` and `Informational`.
func (o AlertRuleScheduledOutput) Severity() pulumi.StringOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) pulumi.StringOutput { return v.Severity }).(pulumi.StringOutput)
}

// If `suppressionEnabled` is `true`, this is ISO 8601 timespan duration, which specifies the amount of time the query should stop running after alert is generated. Defaults to `PT5H`.
//
// > **NOTE** `suppressionDuration` must larger than or equal to `queryFrequency`, otherwise the suppression has no actual effect since no query will happen during the suppression duration.
func (o AlertRuleScheduledOutput) SuppressionDuration() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) pulumi.StringPtrOutput { return v.SuppressionDuration }).(pulumi.StringPtrOutput)
}

// Should the Sentinel Scheduled Alert Rulea stop running query after alert is generated? Defaults to `false`.
func (o AlertRuleScheduledOutput) SuppressionEnabled() pulumi.BoolPtrOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) pulumi.BoolPtrOutput { return v.SuppressionEnabled }).(pulumi.BoolPtrOutput)
}

// A list of categories of attacks by which to classify the rule. Possible values are `Collection`, `CommandAndControl`, `CredentialAccess`, `DefenseEvasion`, `Discovery`, `Execution`, `Exfiltration`, `ImpairProcessControl`, `InhibitResponseFunction`, `Impact`, `InitialAccess`, `LateralMovement`, `Persistence`, `PrivilegeEscalation`, `PreAttack`, `Reconnaissance` and `ResourceDevelopment`.
func (o AlertRuleScheduledOutput) Tactics() pulumi.StringArrayOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) pulumi.StringArrayOutput { return v.Tactics }).(pulumi.StringArrayOutput)
}

// A list of techniques of attacks by which to classify the rule.
func (o AlertRuleScheduledOutput) Techniques() pulumi.StringArrayOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) pulumi.StringArrayOutput { return v.Techniques }).(pulumi.StringArrayOutput)
}

// The alert trigger operator, combined with `triggerThreshold`, setting alert threshold of this Sentinel Scheduled Alert Rule. Possible values are `Equal`, `GreaterThan`, `LessThan`, `NotEqual`. Defaults to `GreaterThan`.
func (o AlertRuleScheduledOutput) TriggerOperator() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) pulumi.StringPtrOutput { return v.TriggerOperator }).(pulumi.StringPtrOutput)
}

// The baseline number of query results generated, combined with `triggerOperator`, setting alert threshold of this Sentinel Scheduled Alert Rule. Defaults to `0`.
func (o AlertRuleScheduledOutput) TriggerThreshold() pulumi.IntPtrOutput {
	return o.ApplyT(func(v *AlertRuleScheduled) pulumi.IntPtrOutput { return v.TriggerThreshold }).(pulumi.IntPtrOutput)
}

type AlertRuleScheduledArrayOutput struct{ *pulumi.OutputState }

func (AlertRuleScheduledArrayOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*[]*AlertRuleScheduled)(nil)).Elem()
}

func (o AlertRuleScheduledArrayOutput) ToAlertRuleScheduledArrayOutput() AlertRuleScheduledArrayOutput {
	return o
}

func (o AlertRuleScheduledArrayOutput) ToAlertRuleScheduledArrayOutputWithContext(ctx context.Context) AlertRuleScheduledArrayOutput {
	return o
}

func (o AlertRuleScheduledArrayOutput) Index(i pulumi.IntInput) AlertRuleScheduledOutput {
	return pulumi.All(o, i).ApplyT(func(vs []interface{}) *AlertRuleScheduled {
		return vs[0].([]*AlertRuleScheduled)[vs[1].(int)]
	}).(AlertRuleScheduledOutput)
}

type AlertRuleScheduledMapOutput struct{ *pulumi.OutputState }

func (AlertRuleScheduledMapOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*map[string]*AlertRuleScheduled)(nil)).Elem()
}

func (o AlertRuleScheduledMapOutput) ToAlertRuleScheduledMapOutput() AlertRuleScheduledMapOutput {
	return o
}

func (o AlertRuleScheduledMapOutput) ToAlertRuleScheduledMapOutputWithContext(ctx context.Context) AlertRuleScheduledMapOutput {
	return o
}

func (o AlertRuleScheduledMapOutput) MapIndex(k pulumi.StringInput) AlertRuleScheduledOutput {
	return pulumi.All(o, k).ApplyT(func(vs []interface{}) *AlertRuleScheduled {
		return vs[0].(map[string]*AlertRuleScheduled)[vs[1].(string)]
	}).(AlertRuleScheduledOutput)
}

func init() {
	pulumi.RegisterInputType(reflect.TypeOf((*AlertRuleScheduledInput)(nil)).Elem(), &AlertRuleScheduled{})
	pulumi.RegisterInputType(reflect.TypeOf((*AlertRuleScheduledArrayInput)(nil)).Elem(), AlertRuleScheduledArray{})
	pulumi.RegisterInputType(reflect.TypeOf((*AlertRuleScheduledMapInput)(nil)).Elem(), AlertRuleScheduledMap{})
	pulumi.RegisterOutputType(AlertRuleScheduledOutput{})
	pulumi.RegisterOutputType(AlertRuleScheduledArrayOutput{})
	pulumi.RegisterOutputType(AlertRuleScheduledMapOutput{})
}