getAlertRuleAnomaly.go

// Code generated by the Pulumi Terraform Bridge (tfgen) Tool DO NOT EDIT.
// *** WARNING: Do not edit by hand unless you're certain you know what you are doing! ***

package sentinel

import (
	"context"
	"reflect"

	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/internal"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

// Use this data source to access information about an existing Anomaly Alert Rule.
//
// ## Example Usage
//
// ```go
// package main
//
// import (
//
//	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/core"
//	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/operationalinsights"
//	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/sentinel"
//	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
//
// )
//
//	func main() {
//		pulumi.Run(func(ctx *pulumi.Context) error {
//			exampleResourceGroup, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
//				Name:     pulumi.String("example-resources"),
//				Location: pulumi.String("West Europe"),
//			})
//			if err != nil {
//				return err
//			}
//			exampleAnalyticsWorkspace, err := operationalinsights.NewAnalyticsWorkspace(ctx, "example", &operationalinsights.AnalyticsWorkspaceArgs{
//				Name:              pulumi.String("example-law"),
//				Location:          exampleResourceGroup.Location,
//				ResourceGroupName: exampleResourceGroup.Name,
//				Sku:               pulumi.String("PerGB2018"),
//			})
//			if err != nil {
//				return err
//			}
//			exampleLogAnalyticsWorkspaceOnboarding, err := sentinel.NewLogAnalyticsWorkspaceOnboarding(ctx, "example", &sentinel.LogAnalyticsWorkspaceOnboardingArgs{
//				WorkspaceId:               exampleAnalyticsWorkspace.ID(),
//				CustomerManagedKeyEnabled: pulumi.Bool(false),
//			})
//			if err != nil {
//				return err
//			}
//			example := sentinel.GetAlertRuleAnomalyOutput(ctx, sentinel.GetAlertRuleAnomalyOutputArgs{
//				LogAnalyticsWorkspaceId: exampleLogAnalyticsWorkspaceOnboarding.WorkspaceId,
//				DisplayName:             pulumi.String("Potential data staging"),
//			}, nil)
//			ctx.Export("id", example.ApplyT(func(example sentinel.GetAlertRuleAnomalyResult) (*string, error) {
//				return &example.Id, nil
//			}).(pulumi.StringPtrOutput))
//			return nil
//		})
//	}
//
// ```
func GetAlertRuleAnomaly(ctx *pulumi.Context, args *GetAlertRuleAnomalyArgs, opts ...pulumi.InvokeOption) (*GetAlertRuleAnomalyResult, error) {
	opts = internal.PkgInvokeDefaultOpts(opts)
	var rv GetAlertRuleAnomalyResult
	err := ctx.Invoke("azure:sentinel/getAlertRuleAnomaly:getAlertRuleAnomaly", args, &rv, opts...)
	if err != nil {
		return nil, err
	}
	return &rv, nil
}

// A collection of arguments for invoking getAlertRuleAnomaly.
type GetAlertRuleAnomalyArgs struct {
	// The display name of this Sentinel Alert Rule Template. Either `displayName` or `name` have to be specified.
	//
	// > **NOTE** One of `name` or `displayName` must be specified.
	DisplayName *string `pulumi:"displayName"`
	// The ID of the Log Analytics Workspace.
	LogAnalyticsWorkspaceId string `pulumi:"logAnalyticsWorkspaceId"`
	// The guid of this Sentinel Alert Rule Template. Either `displayName` or `name` have to be specified.
	Name *string `pulumi:"name"`
}

// A collection of values returned by getAlertRuleAnomaly.
type GetAlertRuleAnomalyResult struct {
	// The version of the Anomaly Security ML Analytics Settings.
	AnomalySettingsVersion int `pulumi:"anomalySettingsVersion"`
	// The anomaly version of the Anomaly Alert Rule.
	AnomalyVersion string `pulumi:"anomalyVersion"`
	// The description of the threshold observation.
	Description string `pulumi:"description"`
	DisplayName string `pulumi:"displayName"`
	// Is the Anomaly Alert Rule enabled?
	Enabled bool `pulumi:"enabled"`
	// The frequency the Anomaly Alert Rule will be run.
	Frequency string `pulumi:"frequency"`
	// The provider-assigned unique ID for this managed resource.
	Id                      string `pulumi:"id"`
	LogAnalyticsWorkspaceId string `pulumi:"logAnalyticsWorkspaceId"`
	Mode                    string `pulumi:"mode"`
	// A list of `multiSelectObservation` blocks as defined below.
	MultiSelectObservations []GetAlertRuleAnomalyMultiSelectObservation `pulumi:"multiSelectObservations"`
	// The name of the threshold observation.
	Name string `pulumi:"name"`
	// A list of `prioritizedExcludeObservation` blocks as defined below.
	PrioritizedExcludeObservations []GetAlertRuleAnomalyPrioritizedExcludeObservation `pulumi:"prioritizedExcludeObservations"`
	// A `requiredDataConnector` block as defined below.
	RequiredDataConnectors []GetAlertRuleAnomalyRequiredDataConnector `pulumi:"requiredDataConnectors"`
	// The ID of the anomaly settings definition Id.
	SettingsDefinitionId string `pulumi:"settingsDefinitionId"`
	// A list of `singleSelectObservation` blocks as defined below.
	SingleSelectObservations []GetAlertRuleAnomalySingleSelectObservation `pulumi:"singleSelectObservations"`
	// A list of categories of attacks by which to classify the rule.
	Tactics []string `pulumi:"tactics"`
	// A list of techniques of attacks by which to classify the rule.
	Techniques []string `pulumi:"techniques"`
	// A list of `thresholdObservation` blocks as defined below.
	ThresholdObservations []GetAlertRuleAnomalyThresholdObservation `pulumi:"thresholdObservations"`
}

func GetAlertRuleAnomalyOutput(ctx *pulumi.Context, args GetAlertRuleAnomalyOutputArgs, opts ...pulumi.InvokeOption) GetAlertRuleAnomalyResultOutput {
	return pulumi.ToOutputWithContext(context.Background(), args).
		ApplyT(func(v interface{}) (GetAlertRuleAnomalyResult, error) {
			args := v.(GetAlertRuleAnomalyArgs)
			r, err := GetAlertRuleAnomaly(ctx, &args, opts...)
			var s GetAlertRuleAnomalyResult
			if r != nil {
				s = *r
			}
			return s, err
		}).(GetAlertRuleAnomalyResultOutput)
}

// A collection of arguments for invoking getAlertRuleAnomaly.
type GetAlertRuleAnomalyOutputArgs struct {
	// The display name of this Sentinel Alert Rule Template. Either `displayName` or `name` have to be specified.
	//
	// > **NOTE** One of `name` or `displayName` must be specified.
	DisplayName pulumi.StringPtrInput `pulumi:"displayName"`
	// The ID of the Log Analytics Workspace.
	LogAnalyticsWorkspaceId pulumi.StringInput `pulumi:"logAnalyticsWorkspaceId"`
	// The guid of this Sentinel Alert Rule Template. Either `displayName` or `name` have to be specified.
	Name pulumi.StringPtrInput `pulumi:"name"`
}

func (GetAlertRuleAnomalyOutputArgs) ElementType() reflect.Type {
	return reflect.TypeOf((*GetAlertRuleAnomalyArgs)(nil)).Elem()
}

// A collection of values returned by getAlertRuleAnomaly.
type GetAlertRuleAnomalyResultOutput struct{ *pulumi.OutputState }

func (GetAlertRuleAnomalyResultOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*GetAlertRuleAnomalyResult)(nil)).Elem()
}

func (o GetAlertRuleAnomalyResultOutput) ToGetAlertRuleAnomalyResultOutput() GetAlertRuleAnomalyResultOutput {
	return o
}

func (o GetAlertRuleAnomalyResultOutput) ToGetAlertRuleAnomalyResultOutputWithContext(ctx context.Context) GetAlertRuleAnomalyResultOutput {
	return o
}

// The version of the Anomaly Security ML Analytics Settings.
func (o GetAlertRuleAnomalyResultOutput) AnomalySettingsVersion() pulumi.IntOutput {
	return o.ApplyT(func(v GetAlertRuleAnomalyResult) int { return v.AnomalySettingsVersion }).(pulumi.IntOutput)
}

// The anomaly version of the Anomaly Alert Rule.
func (o GetAlertRuleAnomalyResultOutput) AnomalyVersion() pulumi.StringOutput {
	return o.ApplyT(func(v GetAlertRuleAnomalyResult) string { return v.AnomalyVersion }).(pulumi.StringOutput)
}

// The description of the threshold observation.
func (o GetAlertRuleAnomalyResultOutput) Description() pulumi.StringOutput {
	return o.ApplyT(func(v GetAlertRuleAnomalyResult) string { return v.Description }).(pulumi.StringOutput)
}

func (o GetAlertRuleAnomalyResultOutput) DisplayName() pulumi.StringOutput {
	return o.ApplyT(func(v GetAlertRuleAnomalyResult) string { return v.DisplayName }).(pulumi.StringOutput)
}

// Is the Anomaly Alert Rule enabled?
func (o GetAlertRuleAnomalyResultOutput) Enabled() pulumi.BoolOutput {
	return o.ApplyT(func(v GetAlertRuleAnomalyResult) bool { return v.Enabled }).(pulumi.BoolOutput)
}

// The frequency the Anomaly Alert Rule will be run.
func (o GetAlertRuleAnomalyResultOutput) Frequency() pulumi.StringOutput {
	return o.ApplyT(func(v GetAlertRuleAnomalyResult) string { return v.Frequency }).(pulumi.StringOutput)
}

// The provider-assigned unique ID for this managed resource.
func (o GetAlertRuleAnomalyResultOutput) Id() pulumi.StringOutput {
	return o.ApplyT(func(v GetAlertRuleAnomalyResult) string { return v.Id }).(pulumi.StringOutput)
}

func (o GetAlertRuleAnomalyResultOutput) LogAnalyticsWorkspaceId() pulumi.StringOutput {
	return o.ApplyT(func(v GetAlertRuleAnomalyResult) string { return v.LogAnalyticsWorkspaceId }).(pulumi.StringOutput)
}

func (o GetAlertRuleAnomalyResultOutput) Mode() pulumi.StringOutput {
	return o.ApplyT(func(v GetAlertRuleAnomalyResult) string { return v.Mode }).(pulumi.StringOutput)
}

// A list of `multiSelectObservation` blocks as defined below.
func (o GetAlertRuleAnomalyResultOutput) MultiSelectObservations() GetAlertRuleAnomalyMultiSelectObservationArrayOutput {
	return o.ApplyT(func(v GetAlertRuleAnomalyResult) []GetAlertRuleAnomalyMultiSelectObservation {
		return v.MultiSelectObservations
	}).(GetAlertRuleAnomalyMultiSelectObservationArrayOutput)
}

// The name of the threshold observation.
func (o GetAlertRuleAnomalyResultOutput) Name() pulumi.StringOutput {
	return o.ApplyT(func(v GetAlertRuleAnomalyResult) string { return v.Name }).(pulumi.StringOutput)
}

// A list of `prioritizedExcludeObservation` blocks as defined below.
func (o GetAlertRuleAnomalyResultOutput) PrioritizedExcludeObservations() GetAlertRuleAnomalyPrioritizedExcludeObservationArrayOutput {
	return o.ApplyT(func(v GetAlertRuleAnomalyResult) []GetAlertRuleAnomalyPrioritizedExcludeObservation {
		return v.PrioritizedExcludeObservations
	}).(GetAlertRuleAnomalyPrioritizedExcludeObservationArrayOutput)
}

// A `requiredDataConnector` block as defined below.
func (o GetAlertRuleAnomalyResultOutput) RequiredDataConnectors() GetAlertRuleAnomalyRequiredDataConnectorArrayOutput {
	return o.ApplyT(func(v GetAlertRuleAnomalyResult) []GetAlertRuleAnomalyRequiredDataConnector {
		return v.RequiredDataConnectors
	}).(GetAlertRuleAnomalyRequiredDataConnectorArrayOutput)
}

// The ID of the anomaly settings definition Id.
func (o GetAlertRuleAnomalyResultOutput) SettingsDefinitionId() pulumi.StringOutput {
	return o.ApplyT(func(v GetAlertRuleAnomalyResult) string { return v.SettingsDefinitionId }).(pulumi.StringOutput)
}

// A list of `singleSelectObservation` blocks as defined below.
func (o GetAlertRuleAnomalyResultOutput) SingleSelectObservations() GetAlertRuleAnomalySingleSelectObservationArrayOutput {
	return o.ApplyT(func(v GetAlertRuleAnomalyResult) []GetAlertRuleAnomalySingleSelectObservation {
		return v.SingleSelectObservations
	}).(GetAlertRuleAnomalySingleSelectObservationArrayOutput)
}

// A list of categories of attacks by which to classify the rule.
func (o GetAlertRuleAnomalyResultOutput) Tactics() pulumi.StringArrayOutput {
	return o.ApplyT(func(v GetAlertRuleAnomalyResult) []string { return v.Tactics }).(pulumi.StringArrayOutput)
}

// A list of techniques of attacks by which to classify the rule.
func (o GetAlertRuleAnomalyResultOutput) Techniques() pulumi.StringArrayOutput {
	return o.ApplyT(func(v GetAlertRuleAnomalyResult) []string { return v.Techniques }).(pulumi.StringArrayOutput)
}

// A list of `thresholdObservation` blocks as defined below.
func (o GetAlertRuleAnomalyResultOutput) ThresholdObservations() GetAlertRuleAnomalyThresholdObservationArrayOutput {
	return o.ApplyT(func(v GetAlertRuleAnomalyResult) []GetAlertRuleAnomalyThresholdObservation {
		return v.ThresholdObservations
	}).(GetAlertRuleAnomalyThresholdObservationArrayOutput)
}

func init() {
	pulumi.RegisterOutputType(GetAlertRuleAnomalyResultOutput{})
}