Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Azure Native v2
  3. API Docs
  4. securityinsights
  5. AutomationRule
These are the docs for Azure Native v2. We recommenend using the latest version, Azure Native v3.
Azure Native v2 v2.82.0 published on Friday, Jan 10, 2025 by Pulumi
pulumi/pulumi-azure-native

azure-native-v2.securityinsights.AutomationRule

Explore with Pulumi AI

These are the docs for Azure Native v2. We recommenend using the latest version, Azure Native v3.
Azure Native v2 v2.82.0 published on Friday, Jan 10, 2025 by Pulumi
pulumi/pulumi-azure-native

Azure REST API version: 2023-02-01. Prior API version in Azure Native 1.x: 2019-01-01-preview.

Other available API versions: 2019-01-01-preview, 2023-06-01-preview, 2023-07-01-preview, 2023-08-01-preview, 2023-09-01-preview, 2023-10-01-preview, 2023-11-01, 2023-12-01-preview, 2024-01-01-preview, 2024-03-01, 2024-04-01-preview, 2024-09-01, 2024-10-01-preview.

Example Usage

AutomationRules_CreateOrUpdate

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var automationRule = new AzureNative.SecurityInsights.AutomationRule("automationRule", new()
    {
        AutomationRuleId = "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
        ResourceGroupName = "myRg",
        WorkspaceName = "myWorkspace",
    });

});
Copy
package main

import (
	securityinsights "github.com/pulumi/pulumi-azure-native-sdk/securityinsights/v2"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := securityinsights.NewAutomationRule(ctx, "automationRule", &securityinsights.AutomationRuleArgs{
			AutomationRuleId:  pulumi.String("73e01a99-5cd7-4139-a149-9f2736ff2ab5"),
			ResourceGroupName: pulumi.String("myRg"),
			WorkspaceName:     pulumi.String("myWorkspace"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Copy
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.securityinsights.AutomationRule;
import com.pulumi.azurenative.securityinsights.AutomationRuleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var automationRule = new AutomationRule("automationRule", AutomationRuleArgs.builder()
            .automationRuleId("73e01a99-5cd7-4139-a149-9f2736ff2ab5")
            .resourceGroupName("myRg")
            .workspaceName("myWorkspace")
            .build());

    }
}
Copy
import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const automationRule = new azure_native.securityinsights.AutomationRule("automationRule", {
    automationRuleId: "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
    resourceGroupName: "myRg",
    workspaceName: "myWorkspace",
});
Copy
import pulumi
import pulumi_azure_native as azure_native

automation_rule = azure_native.securityinsights.AutomationRule("automationRule",
    automation_rule_id="73e01a99-5cd7-4139-a149-9f2736ff2ab5",
    resource_group_name="myRg",
    workspace_name="myWorkspace")
Copy
resources:
  automationRule:
    type: azure-native:securityinsights:AutomationRule
    properties:
      automationRuleId: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
      resourceGroupName: myRg
      workspaceName: myWorkspace
Copy

Create AutomationRule Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new AutomationRule(name: string, args: AutomationRuleArgs, opts?: CustomResourceOptions);
@overload
def AutomationRule(resource_name: str,
                   args: AutomationRuleArgs,
                   opts: Optional[ResourceOptions] = None)

@overload
def AutomationRule(resource_name: str,
                   opts: Optional[ResourceOptions] = None,
                   actions: Optional[Sequence[Union[AutomationRuleModifyPropertiesActionArgs, AutomationRuleRunPlaybookActionArgs]]] = None,
                   display_name: Optional[str] = None,
                   order: Optional[int] = None,
                   resource_group_name: Optional[str] = None,
                   triggering_logic: Optional[AutomationRuleTriggeringLogicArgs] = None,
                   workspace_name: Optional[str] = None,
                   automation_rule_id: Optional[str] = None)
func NewAutomationRule(ctx *Context, name string, args AutomationRuleArgs, opts ...ResourceOption) (*AutomationRule, error)
public AutomationRule(string name, AutomationRuleArgs args, CustomResourceOptions? opts = null)
public AutomationRule(String name, AutomationRuleArgs args)
public AutomationRule(String name, AutomationRuleArgs args, CustomResourceOptions options)

type: azure-native:securityinsights:AutomationRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name This property is required. string
The unique name of the resource.
args This property is required. AutomationRuleArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name This property is required. str
The unique name of the resource.
args This property is required. AutomationRuleArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name This property is required. string
The unique name of the resource.
args This property is required. AutomationRuleArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name This property is required. string
The unique name of the resource.
args This property is required. AutomationRuleArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name This property is required. String
The unique name of the resource.
args This property is required. AutomationRuleArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var automationRuleResource = new AzureNative.Securityinsights.AutomationRule("automationRuleResource", new()
{
    Actions = new[]
    {
        
        {
            { "actionType", "ModifyProperties" },
            { "order", 0 },
            { "actionConfiguration", 
            {
                { "classification", "string" },
                { "classificationComment", "string" },
                { "classificationReason", "string" },
                { "labels", new[]
                {
                    
                    {
                        { "labelName", "string" },
                    },
                } },
                { "owner", 
                {
                    { "assignedTo", "string" },
                    { "email", "string" },
                    { "objectId", "string" },
                    { "ownerType", "string" },
                    { "userPrincipalName", "string" },
                } },
                { "severity", "string" },
                { "status", "string" },
            } },
        },
    },
    DisplayName = "string",
    Order = 0,
    ResourceGroupName = "string",
    TriggeringLogic = 
    {
        { "isEnabled", false },
        { "triggersOn", "string" },
        { "triggersWhen", "string" },
        { "conditions", new[]
        {
            
            {
                { "conditionType", "PropertyArrayChanged" },
                { "conditionProperties", 
                {
                    { "arrayType", "string" },
                    { "changeType", "string" },
                } },
            },
        } },
        { "expirationTimeUtc", "string" },
    },
    WorkspaceName = "string",
    AutomationRuleId = "string",
});
Copy
example, err := securityinsights.NewAutomationRule(ctx, "automationRuleResource", &securityinsights.AutomationRuleArgs{
	Actions: []map[string]interface{}{
		map[string]interface{}{
			"actionType": "ModifyProperties",
			"order":      0,
			"actionConfiguration": map[string]interface{}{
				"classification":        "string",
				"classificationComment": "string",
				"classificationReason":  "string",
				"labels": []map[string]interface{}{
					map[string]interface{}{
						"labelName": "string",
					},
				},
				"owner": map[string]interface{}{
					"assignedTo":        "string",
					"email":             "string",
					"objectId":          "string",
					"ownerType":         "string",
					"userPrincipalName": "string",
				},
				"severity": "string",
				"status":   "string",
			},
		},
	},
	DisplayName:       "string",
	Order:             0,
	ResourceGroupName: "string",
	TriggeringLogic: map[string]interface{}{
		"isEnabled":    false,
		"triggersOn":   "string",
		"triggersWhen": "string",
		"conditions": []map[string]interface{}{
			map[string]interface{}{
				"conditionType": "PropertyArrayChanged",
				"conditionProperties": map[string]interface{}{
					"arrayType":  "string",
					"changeType": "string",
				},
			},
		},
		"expirationTimeUtc": "string",
	},
	WorkspaceName:    "string",
	AutomationRuleId: "string",
})
Copy
var automationRuleResource = new AutomationRule("automationRuleResource", AutomationRuleArgs.builder()
    .actions(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
    .displayName("string")
    .order(0)
    .resourceGroupName("string")
    .triggeringLogic(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
    .workspaceName("string")
    .automationRuleId("string")
    .build());
Copy
automation_rule_resource = azure_native.securityinsights.AutomationRule("automationRuleResource",
    actions=[{
        actionType: ModifyProperties,
        order: 0,
        actionConfiguration: {
            classification: string,
            classificationComment: string,
            classificationReason: string,
            labels: [{
                labelName: string,
            }],
            owner: {
                assignedTo: string,
                email: string,
                objectId: string,
                ownerType: string,
                userPrincipalName: string,
            },
            severity: string,
            status: string,
        },
    }],
    display_name=string,
    order=0,
    resource_group_name=string,
    triggering_logic={
        isEnabled: False,
        triggersOn: string,
        triggersWhen: string,
        conditions: [{
            conditionType: PropertyArrayChanged,
            conditionProperties: {
                arrayType: string,
                changeType: string,
            },
        }],
        expirationTimeUtc: string,
    },
    workspace_name=string,
    automation_rule_id=string)
Copy
const automationRuleResource = new azure_native.securityinsights.AutomationRule("automationRuleResource", {
    actions: [{
        actionType: "ModifyProperties",
        order: 0,
        actionConfiguration: {
            classification: "string",
            classificationComment: "string",
            classificationReason: "string",
            labels: [{
                labelName: "string",
            }],
            owner: {
                assignedTo: "string",
                email: "string",
                objectId: "string",
                ownerType: "string",
                userPrincipalName: "string",
            },
            severity: "string",
            status: "string",
        },
    }],
    displayName: "string",
    order: 0,
    resourceGroupName: "string",
    triggeringLogic: {
        isEnabled: false,
        triggersOn: "string",
        triggersWhen: "string",
        conditions: [{
            conditionType: "PropertyArrayChanged",
            conditionProperties: {
                arrayType: "string",
                changeType: "string",
            },
        }],
        expirationTimeUtc: "string",
    },
    workspaceName: "string",
    automationRuleId: "string",
});
Copy
type: azure-native:securityinsights:AutomationRule
properties:
    actions:
        - actionConfiguration:
            classification: string
            classificationComment: string
            classificationReason: string
            labels:
                - labelName: string
            owner:
                assignedTo: string
                email: string
                objectId: string
                ownerType: string
                userPrincipalName: string
            severity: string
            status: string
          actionType: ModifyProperties
          order: 0
    automationRuleId: string
    displayName: string
    order: 0
    resourceGroupName: string
    triggeringLogic:
        conditions:
            - conditionProperties:
                arrayType: string
                changeType: string
              conditionType: PropertyArrayChanged
        expirationTimeUtc: string
        isEnabled: false
        triggersOn: string
        triggersWhen: string
    workspaceName: string
Copy

AutomationRule Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The AutomationRule resource accepts the following input properties:

Actions This property is required. List<Union<Pulumi.AzureNative.SecurityInsights.Inputs.AutomationRuleModifyPropertiesAction, Pulumi.AzureNative.SecurityInsights.Inputs.AutomationRuleRunPlaybookActionArgs>>
The actions to execute when the automation rule is triggered.
DisplayName This property is required. string
The display name of the automation rule.
Order This property is required. int
The order of execution of the automation rule.
ResourceGroupName
This property is required.
Changes to this property will trigger replacement.
string
The name of the resource group. The name is case insensitive.
TriggeringLogic This property is required. Pulumi.AzureNative.SecurityInsights.Inputs.AutomationRuleTriggeringLogic
Describes automation rule triggering logic.
WorkspaceName
This property is required.
Changes to this property will trigger replacement.
string
The name of the workspace.
AutomationRuleId Changes to this property will trigger replacement. string
Automation rule ID
Actions This property is required. []interface{}
The actions to execute when the automation rule is triggered.
DisplayName This property is required. string
The display name of the automation rule.
Order This property is required. int
The order of execution of the automation rule.
ResourceGroupName
This property is required.
Changes to this property will trigger replacement.
string
The name of the resource group. The name is case insensitive.
TriggeringLogic This property is required. AutomationRuleTriggeringLogicArgs
Describes automation rule triggering logic.
WorkspaceName
This property is required.
Changes to this property will trigger replacement.
string
The name of the workspace.
AutomationRuleId Changes to this property will trigger replacement. string
Automation rule ID
actions This property is required. List<Either<AutomationRuleModifyPropertiesAction,AutomationRuleRunPlaybookActionArgs>>
The actions to execute when the automation rule is triggered.
displayName This property is required. String
The display name of the automation rule.
order This property is required. Integer
The order of execution of the automation rule.
resourceGroupName
This property is required.
Changes to this property will trigger replacement.
String
The name of the resource group. The name is case insensitive.
triggeringLogic This property is required. AutomationRuleTriggeringLogic
Describes automation rule triggering logic.
workspaceName
This property is required.
Changes to this property will trigger replacement.
String
The name of the workspace.
automationRuleId Changes to this property will trigger replacement. String
Automation rule ID
actions This property is required. (AutomationRuleModifyPropertiesAction | AutomationRuleRunPlaybookActionArgs)[]
The actions to execute when the automation rule is triggered.
displayName This property is required. string
The display name of the automation rule.
order This property is required. number
The order of execution of the automation rule.
resourceGroupName
This property is required.
Changes to this property will trigger replacement.
string
The name of the resource group. The name is case insensitive.
triggeringLogic This property is required. AutomationRuleTriggeringLogic
Describes automation rule triggering logic.
workspaceName
This property is required.
Changes to this property will trigger replacement.
string
The name of the workspace.
automationRuleId Changes to this property will trigger replacement. string
Automation rule ID
actions This property is required. Sequence[Union[AutomationRuleModifyPropertiesActionArgs, AutomationRuleRunPlaybookActionArgs]]
The actions to execute when the automation rule is triggered.
display_name This property is required. str
The display name of the automation rule.
order This property is required. int
The order of execution of the automation rule.
resource_group_name
This property is required.
Changes to this property will trigger replacement.
str
The name of the resource group. The name is case insensitive.
triggering_logic This property is required. AutomationRuleTriggeringLogicArgs
Describes automation rule triggering logic.
workspace_name
This property is required.
Changes to this property will trigger replacement.
str
The name of the workspace.
automation_rule_id Changes to this property will trigger replacement. str
Automation rule ID
actions This property is required. List<Property Map | Property Map>
The actions to execute when the automation rule is triggered.
displayName This property is required. String
The display name of the automation rule.
order This property is required. Number
The order of execution of the automation rule.
resourceGroupName
This property is required.
Changes to this property will trigger replacement.
String
The name of the resource group. The name is case insensitive.
triggeringLogic This property is required. Property Map
Describes automation rule triggering logic.
workspaceName
This property is required.
Changes to this property will trigger replacement.
String
The name of the workspace.
automationRuleId Changes to this property will trigger replacement. String
Automation rule ID

Outputs

All input properties are implicitly available as output properties. Additionally, the AutomationRule resource produces the following output properties:

CreatedBy Pulumi.AzureNative.SecurityInsights.Outputs.ClientInfoResponse
Information on the client (user or application) that made some action
CreatedTimeUtc string
The time the automation rule was created.
Id string
The provider-assigned unique ID for this managed resource.
LastModifiedBy Pulumi.AzureNative.SecurityInsights.Outputs.ClientInfoResponse
Information on the client (user or application) that made some action
LastModifiedTimeUtc string
The last time the automation rule was updated.
Name string
The name of the resource
SystemData Pulumi.AzureNative.SecurityInsights.Outputs.SystemDataResponse
Azure Resource Manager metadata containing createdBy and modifiedBy information.
Type string
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
Etag string
Etag of the azure resource
CreatedBy ClientInfoResponse
Information on the client (user or application) that made some action
CreatedTimeUtc string
The time the automation rule was created.
Id string
The provider-assigned unique ID for this managed resource.
LastModifiedBy ClientInfoResponse
Information on the client (user or application) that made some action
LastModifiedTimeUtc string
The last time the automation rule was updated.
Name string
The name of the resource
SystemData SystemDataResponse
Azure Resource Manager metadata containing createdBy and modifiedBy information.
Type string
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
Etag string
Etag of the azure resource
createdBy ClientInfoResponse
Information on the client (user or application) that made some action
createdTimeUtc String
The time the automation rule was created.
id String
The provider-assigned unique ID for this managed resource.
lastModifiedBy ClientInfoResponse
Information on the client (user or application) that made some action
lastModifiedTimeUtc String
The last time the automation rule was updated.
name String
The name of the resource
systemData SystemDataResponse
Azure Resource Manager metadata containing createdBy and modifiedBy information.
type String
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
etag String
Etag of the azure resource
createdBy ClientInfoResponse
Information on the client (user or application) that made some action
createdTimeUtc string
The time the automation rule was created.
id string
The provider-assigned unique ID for this managed resource.
lastModifiedBy ClientInfoResponse
Information on the client (user or application) that made some action
lastModifiedTimeUtc string
The last time the automation rule was updated.
name string
The name of the resource
systemData SystemDataResponse
Azure Resource Manager metadata containing createdBy and modifiedBy information.
type string
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
etag string
Etag of the azure resource
created_by ClientInfoResponse
Information on the client (user or application) that made some action
created_time_utc str
The time the automation rule was created.
id str
The provider-assigned unique ID for this managed resource.
last_modified_by ClientInfoResponse
Information on the client (user or application) that made some action
last_modified_time_utc str
The last time the automation rule was updated.
name str
The name of the resource
system_data SystemDataResponse
Azure Resource Manager metadata containing createdBy and modifiedBy information.
type str
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
etag str
Etag of the azure resource
createdBy Property Map
Information on the client (user or application) that made some action
createdTimeUtc String
The time the automation rule was created.
id String
The provider-assigned unique ID for this managed resource.
lastModifiedBy Property Map
Information on the client (user or application) that made some action
lastModifiedTimeUtc String
The last time the automation rule was updated.
name String
The name of the resource
systemData Property Map
Azure Resource Manager metadata containing createdBy and modifiedBy information.
type String
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
etag String
Etag of the azure resource

Supporting Types

AutomationRuleModifyPropertiesAction
, AutomationRuleModifyPropertiesActionArgs

Order This property is required. int
ActionConfiguration IncidentPropertiesAction
order This property is required. Integer
actionConfiguration IncidentPropertiesAction
order This property is required. number
actionConfiguration IncidentPropertiesAction
order This property is required. Number
actionConfiguration Property Map

AutomationRuleModifyPropertiesActionResponse
, AutomationRuleModifyPropertiesActionResponseArgs

order This property is required. Number
actionConfiguration Property Map

AutomationRulePropertyArrayChangedConditionSupportedArrayType
, AutomationRulePropertyArrayChangedConditionSupportedArrayTypeArgs

Alerts
AlertsEvaluate the condition on the alerts
Labels
LabelsEvaluate the condition on the labels
Tactics
TacticsEvaluate the condition on the tactics
Comments
CommentsEvaluate the condition on the comments
AutomationRulePropertyArrayChangedConditionSupportedArrayTypeAlerts
AlertsEvaluate the condition on the alerts
AutomationRulePropertyArrayChangedConditionSupportedArrayTypeLabels
LabelsEvaluate the condition on the labels
AutomationRulePropertyArrayChangedConditionSupportedArrayTypeTactics
TacticsEvaluate the condition on the tactics
AutomationRulePropertyArrayChangedConditionSupportedArrayTypeComments
CommentsEvaluate the condition on the comments
Alerts
AlertsEvaluate the condition on the alerts
Labels
LabelsEvaluate the condition on the labels
Tactics
TacticsEvaluate the condition on the tactics
Comments
CommentsEvaluate the condition on the comments
Alerts
AlertsEvaluate the condition on the alerts
Labels
LabelsEvaluate the condition on the labels
Tactics
TacticsEvaluate the condition on the tactics
Comments
CommentsEvaluate the condition on the comments
ALERTS
AlertsEvaluate the condition on the alerts
LABELS
LabelsEvaluate the condition on the labels
TACTICS
TacticsEvaluate the condition on the tactics
COMMENTS
CommentsEvaluate the condition on the comments
"Alerts"
AlertsEvaluate the condition on the alerts
"Labels"
LabelsEvaluate the condition on the labels
"Tactics"
TacticsEvaluate the condition on the tactics
"Comments"
CommentsEvaluate the condition on the comments

AutomationRulePropertyArrayChangedConditionSupportedChangeType
, AutomationRulePropertyArrayChangedConditionSupportedChangeTypeArgs

Added
AddedEvaluate the condition on items added to the array
AutomationRulePropertyArrayChangedConditionSupportedChangeTypeAdded
AddedEvaluate the condition on items added to the array
Added
AddedEvaluate the condition on items added to the array
Added
AddedEvaluate the condition on items added to the array
ADDED
AddedEvaluate the condition on items added to the array
"Added"
AddedEvaluate the condition on items added to the array

AutomationRulePropertyArrayChangedValuesCondition
, AutomationRulePropertyArrayChangedValuesConditionArgs

AutomationRulePropertyArrayChangedValuesConditionResponse
, AutomationRulePropertyArrayChangedValuesConditionResponseArgs

ArrayType string
ChangeType string
ArrayType string
ChangeType string
arrayType String
changeType String
arrayType string
changeType string
arrayType String
changeType String

AutomationRulePropertyChangedConditionSupportedChangedType
, AutomationRulePropertyChangedConditionSupportedChangedTypeArgs

ChangedFrom
ChangedFromEvaluate the condition on the previous value of the property
ChangedTo
ChangedToEvaluate the condition on the updated value of the property
AutomationRulePropertyChangedConditionSupportedChangedTypeChangedFrom
ChangedFromEvaluate the condition on the previous value of the property
AutomationRulePropertyChangedConditionSupportedChangedTypeChangedTo
ChangedToEvaluate the condition on the updated value of the property
ChangedFrom
ChangedFromEvaluate the condition on the previous value of the property
ChangedTo
ChangedToEvaluate the condition on the updated value of the property
ChangedFrom
ChangedFromEvaluate the condition on the previous value of the property
ChangedTo
ChangedToEvaluate the condition on the updated value of the property
CHANGED_FROM
ChangedFromEvaluate the condition on the previous value of the property
CHANGED_TO
ChangedToEvaluate the condition on the updated value of the property
"ChangedFrom"
ChangedFromEvaluate the condition on the previous value of the property
"ChangedTo"
ChangedToEvaluate the condition on the updated value of the property

AutomationRulePropertyChangedConditionSupportedPropertyType
, AutomationRulePropertyChangedConditionSupportedPropertyTypeArgs

IncidentSeverity
IncidentSeverityEvaluate the condition on the incident severity
IncidentStatus
IncidentStatusEvaluate the condition on the incident status
IncidentOwner
IncidentOwnerEvaluate the condition on the incident owner
AutomationRulePropertyChangedConditionSupportedPropertyTypeIncidentSeverity
IncidentSeverityEvaluate the condition on the incident severity
AutomationRulePropertyChangedConditionSupportedPropertyTypeIncidentStatus
IncidentStatusEvaluate the condition on the incident status
AutomationRulePropertyChangedConditionSupportedPropertyTypeIncidentOwner
IncidentOwnerEvaluate the condition on the incident owner
IncidentSeverity
IncidentSeverityEvaluate the condition on the incident severity
IncidentStatus
IncidentStatusEvaluate the condition on the incident status
IncidentOwner
IncidentOwnerEvaluate the condition on the incident owner
IncidentSeverity
IncidentSeverityEvaluate the condition on the incident severity
IncidentStatus
IncidentStatusEvaluate the condition on the incident status
IncidentOwner
IncidentOwnerEvaluate the condition on the incident owner
INCIDENT_SEVERITY
IncidentSeverityEvaluate the condition on the incident severity
INCIDENT_STATUS
IncidentStatusEvaluate the condition on the incident status
INCIDENT_OWNER
IncidentOwnerEvaluate the condition on the incident owner
"IncidentSeverity"
IncidentSeverityEvaluate the condition on the incident severity
"IncidentStatus"
IncidentStatusEvaluate the condition on the incident status
"IncidentOwner"
IncidentOwnerEvaluate the condition on the incident owner

AutomationRulePropertyConditionSupportedOperator
, AutomationRulePropertyConditionSupportedOperatorArgs

EqualsValue
EqualsEvaluates if the property equals at least one of the condition values
NotEquals
NotEqualsEvaluates if the property does not equal any of the condition values
Contains
ContainsEvaluates if the property contains at least one of the condition values
NotContains
NotContainsEvaluates if the property does not contain any of the condition values
StartsWith
StartsWithEvaluates if the property starts with any of the condition values
NotStartsWith
NotStartsWithEvaluates if the property does not start with any of the condition values
EndsWith
EndsWithEvaluates if the property ends with any of the condition values
NotEndsWith
NotEndsWithEvaluates if the property does not end with any of the condition values
AutomationRulePropertyConditionSupportedOperatorEquals
EqualsEvaluates if the property equals at least one of the condition values
AutomationRulePropertyConditionSupportedOperatorNotEquals
NotEqualsEvaluates if the property does not equal any of the condition values
AutomationRulePropertyConditionSupportedOperatorContains
ContainsEvaluates if the property contains at least one of the condition values
AutomationRulePropertyConditionSupportedOperatorNotContains
NotContainsEvaluates if the property does not contain any of the condition values
AutomationRulePropertyConditionSupportedOperatorStartsWith
StartsWithEvaluates if the property starts with any of the condition values
AutomationRulePropertyConditionSupportedOperatorNotStartsWith
NotStartsWithEvaluates if the property does not start with any of the condition values
AutomationRulePropertyConditionSupportedOperatorEndsWith
EndsWithEvaluates if the property ends with any of the condition values
AutomationRulePropertyConditionSupportedOperatorNotEndsWith
NotEndsWithEvaluates if the property does not end with any of the condition values
Equals
EqualsEvaluates if the property equals at least one of the condition values
NotEquals
NotEqualsEvaluates if the property does not equal any of the condition values
Contains
ContainsEvaluates if the property contains at least one of the condition values
NotContains
NotContainsEvaluates if the property does not contain any of the condition values
StartsWith
StartsWithEvaluates if the property starts with any of the condition values
NotStartsWith
NotStartsWithEvaluates if the property does not start with any of the condition values
EndsWith
EndsWithEvaluates if the property ends with any of the condition values
NotEndsWith
NotEndsWithEvaluates if the property does not end with any of the condition values
Equals
EqualsEvaluates if the property equals at least one of the condition values
NotEquals
NotEqualsEvaluates if the property does not equal any of the condition values
Contains
ContainsEvaluates if the property contains at least one of the condition values
NotContains
NotContainsEvaluates if the property does not contain any of the condition values
StartsWith
StartsWithEvaluates if the property starts with any of the condition values
NotStartsWith
NotStartsWithEvaluates if the property does not start with any of the condition values
EndsWith
EndsWithEvaluates if the property ends with any of the condition values
NotEndsWith
NotEndsWithEvaluates if the property does not end with any of the condition values
EQUALS
EqualsEvaluates if the property equals at least one of the condition values
NOT_EQUALS
NotEqualsEvaluates if the property does not equal any of the condition values
CONTAINS
ContainsEvaluates if the property contains at least one of the condition values
NOT_CONTAINS
NotContainsEvaluates if the property does not contain any of the condition values
STARTS_WITH
StartsWithEvaluates if the property starts with any of the condition values
NOT_STARTS_WITH
NotStartsWithEvaluates if the property does not start with any of the condition values
ENDS_WITH
EndsWithEvaluates if the property ends with any of the condition values
NOT_ENDS_WITH
NotEndsWithEvaluates if the property does not end with any of the condition values
"Equals"
EqualsEvaluates if the property equals at least one of the condition values
"NotEquals"
NotEqualsEvaluates if the property does not equal any of the condition values
"Contains"
ContainsEvaluates if the property contains at least one of the condition values
"NotContains"
NotContainsEvaluates if the property does not contain any of the condition values
"StartsWith"
StartsWithEvaluates if the property starts with any of the condition values
"NotStartsWith"
NotStartsWithEvaluates if the property does not start with any of the condition values
"EndsWith"
EndsWithEvaluates if the property ends with any of the condition values
"NotEndsWith"
NotEndsWithEvaluates if the property does not end with any of the condition values

AutomationRulePropertyConditionSupportedProperty
, AutomationRulePropertyConditionSupportedPropertyArgs

IncidentTitle
IncidentTitleThe title of the incident
IncidentDescription
IncidentDescriptionThe description of the incident
IncidentSeverity
IncidentSeverityThe severity of the incident
IncidentStatus
IncidentStatusThe status of the incident
IncidentRelatedAnalyticRuleIds
IncidentRelatedAnalyticRuleIdsThe related Analytic rule ids of the incident
IncidentTactics
IncidentTacticsThe tactics of the incident
IncidentLabel
IncidentLabelThe labels of the incident
IncidentProviderName
IncidentProviderNameThe provider name of the incident
IncidentUpdatedBySource
IncidentUpdatedBySourceThe update source of the incident
AccountAadTenantId
AccountAadTenantIdThe account Azure Active Directory tenant id
AccountAadUserId
AccountAadUserIdThe account Azure Active Directory user id
AccountName
AccountNameThe account name
AccountNTDomain
AccountNTDomainThe account NetBIOS domain name
AccountPUID
AccountPUIDThe account Azure Active Directory Passport User ID
AccountSid
AccountSidThe account security identifier
AccountObjectGuid
AccountObjectGuidThe account unique identifier
AccountUPNSuffix
AccountUPNSuffixThe account user principal name suffix
AlertProductNames
AlertProductNamesThe name of the product of the alert
AlertAnalyticRuleIds
AlertAnalyticRuleIdsThe analytic rule ids of the alert
AzureResourceResourceId
AzureResourceResourceIdThe Azure resource id
AzureResourceSubscriptionId
AzureResourceSubscriptionIdThe Azure resource subscription id
CloudApplicationAppId
CloudApplicationAppIdThe cloud application identifier
CloudApplicationAppName
CloudApplicationAppNameThe cloud application name
DNSDomainName
DNSDomainNameThe dns record domain name
FileDirectory
FileDirectoryThe file directory full path
FileName
FileNameThe file name without path
FileHashValue
FileHashValueThe file hash value
HostAzureID
HostAzureIDThe host Azure resource id
HostName
HostNameThe host name without domain
HostNetBiosName
HostNetBiosNameThe host NetBIOS name
HostNTDomain
HostNTDomainThe host NT domain
HostOSVersion
HostOSVersionThe host operating system
IoTDeviceId
IoTDeviceId"The IoT device id
IoTDeviceName
IoTDeviceNameThe IoT device name
IoTDeviceType
IoTDeviceTypeThe IoT device type
IoTDeviceVendor
IoTDeviceVendorThe IoT device vendor
IoTDeviceModel
IoTDeviceModelThe IoT device model
IoTDeviceOperatingSystem
IoTDeviceOperatingSystemThe IoT device operating system
IPAddress
IPAddressThe IP address
MailboxDisplayName
MailboxDisplayNameThe mailbox display name
MailboxPrimaryAddress
MailboxPrimaryAddressThe mailbox primary address
MailboxUPN
MailboxUPNThe mailbox user principal name
MailMessageDeliveryAction
MailMessageDeliveryActionThe mail message delivery action
MailMessageDeliveryLocation
MailMessageDeliveryLocationThe mail message delivery location
MailMessageRecipient
MailMessageRecipientThe mail message recipient
MailMessageSenderIP
MailMessageSenderIPThe mail message sender IP address
MailMessageSubject
MailMessageSubjectThe mail message subject
MailMessageP1Sender
MailMessageP1SenderThe mail message P1 sender
MailMessageP2Sender
MailMessageP2SenderThe mail message P2 sender
MalwareCategory
MalwareCategoryThe malware category
MalwareName
MalwareNameThe malware name
ProcessCommandLine
ProcessCommandLineThe process execution command line
ProcessId
ProcessIdThe process id
RegistryKey
RegistryKeyThe registry key path
RegistryValueData
RegistryValueDataThe registry key value in string formatted representation
Url
UrlThe url
AutomationRulePropertyConditionSupportedPropertyIncidentTitle
IncidentTitleThe title of the incident
AutomationRulePropertyConditionSupportedPropertyIncidentDescription
IncidentDescriptionThe description of the incident
AutomationRulePropertyConditionSupportedPropertyIncidentSeverity
IncidentSeverityThe severity of the incident
AutomationRulePropertyConditionSupportedPropertyIncidentStatus
IncidentStatusThe status of the incident
AutomationRulePropertyConditionSupportedPropertyIncidentRelatedAnalyticRuleIds
IncidentRelatedAnalyticRuleIdsThe related Analytic rule ids of the incident
AutomationRulePropertyConditionSupportedPropertyIncidentTactics
IncidentTacticsThe tactics of the incident
AutomationRulePropertyConditionSupportedPropertyIncidentLabel
IncidentLabelThe labels of the incident
AutomationRulePropertyConditionSupportedPropertyIncidentProviderName
IncidentProviderNameThe provider name of the incident
AutomationRulePropertyConditionSupportedPropertyIncidentUpdatedBySource
IncidentUpdatedBySourceThe update source of the incident
AutomationRulePropertyConditionSupportedPropertyAccountAadTenantId
AccountAadTenantIdThe account Azure Active Directory tenant id
AutomationRulePropertyConditionSupportedPropertyAccountAadUserId
AccountAadUserIdThe account Azure Active Directory user id
AutomationRulePropertyConditionSupportedPropertyAccountName
AccountNameThe account name
AutomationRulePropertyConditionSupportedPropertyAccountNTDomain
AccountNTDomainThe account NetBIOS domain name
AutomationRulePropertyConditionSupportedPropertyAccountPUID
AccountPUIDThe account Azure Active Directory Passport User ID
AutomationRulePropertyConditionSupportedPropertyAccountSid
AccountSidThe account security identifier
AutomationRulePropertyConditionSupportedPropertyAccountObjectGuid
AccountObjectGuidThe account unique identifier
AutomationRulePropertyConditionSupportedPropertyAccountUPNSuffix
AccountUPNSuffixThe account user principal name suffix
AutomationRulePropertyConditionSupportedPropertyAlertProductNames
AlertProductNamesThe name of the product of the alert
AutomationRulePropertyConditionSupportedPropertyAlertAnalyticRuleIds
AlertAnalyticRuleIdsThe analytic rule ids of the alert
AutomationRulePropertyConditionSupportedPropertyAzureResourceResourceId
AzureResourceResourceIdThe Azure resource id
AutomationRulePropertyConditionSupportedPropertyAzureResourceSubscriptionId
AzureResourceSubscriptionIdThe Azure resource subscription id
AutomationRulePropertyConditionSupportedPropertyCloudApplicationAppId
CloudApplicationAppIdThe cloud application identifier
AutomationRulePropertyConditionSupportedPropertyCloudApplicationAppName
CloudApplicationAppNameThe cloud application name
AutomationRulePropertyConditionSupportedPropertyDNSDomainName
DNSDomainNameThe dns record domain name
AutomationRulePropertyConditionSupportedPropertyFileDirectory
FileDirectoryThe file directory full path
AutomationRulePropertyConditionSupportedPropertyFileName
FileNameThe file name without path
AutomationRulePropertyConditionSupportedPropertyFileHashValue
FileHashValueThe file hash value
AutomationRulePropertyConditionSupportedPropertyHostAzureID
HostAzureIDThe host Azure resource id
AutomationRulePropertyConditionSupportedPropertyHostName
HostNameThe host name without domain
AutomationRulePropertyConditionSupportedPropertyHostNetBiosName
HostNetBiosNameThe host NetBIOS name
AutomationRulePropertyConditionSupportedPropertyHostNTDomain
HostNTDomainThe host NT domain
AutomationRulePropertyConditionSupportedPropertyHostOSVersion
HostOSVersionThe host operating system
AutomationRulePropertyConditionSupportedPropertyIoTDeviceId
IoTDeviceId"The IoT device id
AutomationRulePropertyConditionSupportedPropertyIoTDeviceName
IoTDeviceNameThe IoT device name
AutomationRulePropertyConditionSupportedPropertyIoTDeviceType
IoTDeviceTypeThe IoT device type
AutomationRulePropertyConditionSupportedPropertyIoTDeviceVendor
IoTDeviceVendorThe IoT device vendor
AutomationRulePropertyConditionSupportedPropertyIoTDeviceModel
IoTDeviceModelThe IoT device model
AutomationRulePropertyConditionSupportedPropertyIoTDeviceOperatingSystem
IoTDeviceOperatingSystemThe IoT device operating system
AutomationRulePropertyConditionSupportedPropertyIPAddress
IPAddressThe IP address
AutomationRulePropertyConditionSupportedPropertyMailboxDisplayName
MailboxDisplayNameThe mailbox display name
AutomationRulePropertyConditionSupportedPropertyMailboxPrimaryAddress
MailboxPrimaryAddressThe mailbox primary address
AutomationRulePropertyConditionSupportedPropertyMailboxUPN
MailboxUPNThe mailbox user principal name
AutomationRulePropertyConditionSupportedPropertyMailMessageDeliveryAction
MailMessageDeliveryActionThe mail message delivery action
AutomationRulePropertyConditionSupportedPropertyMailMessageDeliveryLocation
MailMessageDeliveryLocationThe mail message delivery location
AutomationRulePropertyConditionSupportedPropertyMailMessageRecipient
MailMessageRecipientThe mail message recipient
AutomationRulePropertyConditionSupportedPropertyMailMessageSenderIP
MailMessageSenderIPThe mail message sender IP address
AutomationRulePropertyConditionSupportedPropertyMailMessageSubject
MailMessageSubjectThe mail message subject
AutomationRulePropertyConditionSupportedPropertyMailMessageP1Sender
MailMessageP1SenderThe mail message P1 sender
AutomationRulePropertyConditionSupportedPropertyMailMessageP2Sender
MailMessageP2SenderThe mail message P2 sender
AutomationRulePropertyConditionSupportedPropertyMalwareCategory
MalwareCategoryThe malware category
AutomationRulePropertyConditionSupportedPropertyMalwareName
MalwareNameThe malware name
AutomationRulePropertyConditionSupportedPropertyProcessCommandLine
ProcessCommandLineThe process execution command line
AutomationRulePropertyConditionSupportedPropertyProcessId
ProcessIdThe process id
AutomationRulePropertyConditionSupportedPropertyRegistryKey
RegistryKeyThe registry key path
AutomationRulePropertyConditionSupportedPropertyRegistryValueData
RegistryValueDataThe registry key value in string formatted representation
AutomationRulePropertyConditionSupportedPropertyUrl
UrlThe url
IncidentTitle
IncidentTitleThe title of the incident
IncidentDescription
IncidentDescriptionThe description of the incident
IncidentSeverity
IncidentSeverityThe severity of the incident
IncidentStatus
IncidentStatusThe status of the incident
IncidentRelatedAnalyticRuleIds
IncidentRelatedAnalyticRuleIdsThe related Analytic rule ids of the incident
IncidentTactics
IncidentTacticsThe tactics of the incident
IncidentLabel
IncidentLabelThe labels of the incident
IncidentProviderName
IncidentProviderNameThe provider name of the incident
IncidentUpdatedBySource
IncidentUpdatedBySourceThe update source of the incident
AccountAadTenantId
AccountAadTenantIdThe account Azure Active Directory tenant id
AccountAadUserId
AccountAadUserIdThe account Azure Active Directory user id
AccountName
AccountNameThe account name
AccountNTDomain
AccountNTDomainThe account NetBIOS domain name
AccountPUID
AccountPUIDThe account Azure Active Directory Passport User ID
AccountSid
AccountSidThe account security identifier
AccountObjectGuid
AccountObjectGuidThe account unique identifier
AccountUPNSuffix
AccountUPNSuffixThe account user principal name suffix
AlertProductNames
AlertProductNamesThe name of the product of the alert
AlertAnalyticRuleIds
AlertAnalyticRuleIdsThe analytic rule ids of the alert
AzureResourceResourceId
AzureResourceResourceIdThe Azure resource id
AzureResourceSubscriptionId
AzureResourceSubscriptionIdThe Azure resource subscription id
CloudApplicationAppId
CloudApplicationAppIdThe cloud application identifier
CloudApplicationAppName
CloudApplicationAppNameThe cloud application name
DNSDomainName
DNSDomainNameThe dns record domain name
FileDirectory
FileDirectoryThe file directory full path
FileName
FileNameThe file name without path
FileHashValue
FileHashValueThe file hash value
HostAzureID
HostAzureIDThe host Azure resource id
HostName
HostNameThe host name without domain
HostNetBiosName
HostNetBiosNameThe host NetBIOS name
HostNTDomain
HostNTDomainThe host NT domain
HostOSVersion
HostOSVersionThe host operating system
IoTDeviceId
IoTDeviceId"The IoT device id
IoTDeviceName
IoTDeviceNameThe IoT device name
IoTDeviceType
IoTDeviceTypeThe IoT device type
IoTDeviceVendor
IoTDeviceVendorThe IoT device vendor
IoTDeviceModel
IoTDeviceModelThe IoT device model
IoTDeviceOperatingSystem
IoTDeviceOperatingSystemThe IoT device operating system
IPAddress
IPAddressThe IP address
MailboxDisplayName
MailboxDisplayNameThe mailbox display name
MailboxPrimaryAddress
MailboxPrimaryAddressThe mailbox primary address
MailboxUPN
MailboxUPNThe mailbox user principal name
MailMessageDeliveryAction
MailMessageDeliveryActionThe mail message delivery action
MailMessageDeliveryLocation
MailMessageDeliveryLocationThe mail message delivery location
MailMessageRecipient
MailMessageRecipientThe mail message recipient
MailMessageSenderIP
MailMessageSenderIPThe mail message sender IP address
MailMessageSubject
MailMessageSubjectThe mail message subject
MailMessageP1Sender
MailMessageP1SenderThe mail message P1 sender
MailMessageP2Sender
MailMessageP2SenderThe mail message P2 sender
MalwareCategory
MalwareCategoryThe malware category
MalwareName
MalwareNameThe malware name
ProcessCommandLine
ProcessCommandLineThe process execution command line
ProcessId
ProcessIdThe process id
RegistryKey
RegistryKeyThe registry key path
RegistryValueData
RegistryValueDataThe registry key value in string formatted representation
Url
UrlThe url
IncidentTitle
IncidentTitleThe title of the incident
IncidentDescription
IncidentDescriptionThe description of the incident
IncidentSeverity
IncidentSeverityThe severity of the incident
IncidentStatus
IncidentStatusThe status of the incident
IncidentRelatedAnalyticRuleIds
IncidentRelatedAnalyticRuleIdsThe related Analytic rule ids of the incident
IncidentTactics
IncidentTacticsThe tactics of the incident
IncidentLabel
IncidentLabelThe labels of the incident
IncidentProviderName
IncidentProviderNameThe provider name of the incident
IncidentUpdatedBySource
IncidentUpdatedBySourceThe update source of the incident
AccountAadTenantId
AccountAadTenantIdThe account Azure Active Directory tenant id
AccountAadUserId
AccountAadUserIdThe account Azure Active Directory user id
AccountName
AccountNameThe account name
AccountNTDomain
AccountNTDomainThe account NetBIOS domain name
AccountPUID
AccountPUIDThe account Azure Active Directory Passport User ID
AccountSid
AccountSidThe account security identifier
AccountObjectGuid
AccountObjectGuidThe account unique identifier
AccountUPNSuffix
AccountUPNSuffixThe account user principal name suffix
AlertProductNames
AlertProductNamesThe name of the product of the alert
AlertAnalyticRuleIds
AlertAnalyticRuleIdsThe analytic rule ids of the alert
AzureResourceResourceId
AzureResourceResourceIdThe Azure resource id
AzureResourceSubscriptionId
AzureResourceSubscriptionIdThe Azure resource subscription id
CloudApplicationAppId
CloudApplicationAppIdThe cloud application identifier
CloudApplicationAppName
CloudApplicationAppNameThe cloud application name
DNSDomainName
DNSDomainNameThe dns record domain name
FileDirectory
FileDirectoryThe file directory full path
FileName
FileNameThe file name without path
FileHashValue
FileHashValueThe file hash value
HostAzureID
HostAzureIDThe host Azure resource id
HostName
HostNameThe host name without domain
HostNetBiosName
HostNetBiosNameThe host NetBIOS name
HostNTDomain
HostNTDomainThe host NT domain
HostOSVersion
HostOSVersionThe host operating system
IoTDeviceId
IoTDeviceId"The IoT device id
IoTDeviceName
IoTDeviceNameThe IoT device name
IoTDeviceType
IoTDeviceTypeThe IoT device type
IoTDeviceVendor
IoTDeviceVendorThe IoT device vendor
IoTDeviceModel
IoTDeviceModelThe IoT device model
IoTDeviceOperatingSystem
IoTDeviceOperatingSystemThe IoT device operating system
IPAddress
IPAddressThe IP address
MailboxDisplayName
MailboxDisplayNameThe mailbox display name
MailboxPrimaryAddress
MailboxPrimaryAddressThe mailbox primary address
MailboxUPN
MailboxUPNThe mailbox user principal name
MailMessageDeliveryAction
MailMessageDeliveryActionThe mail message delivery action
MailMessageDeliveryLocation
MailMessageDeliveryLocationThe mail message delivery location
MailMessageRecipient
MailMessageRecipientThe mail message recipient
MailMessageSenderIP
MailMessageSenderIPThe mail message sender IP address
MailMessageSubject
MailMessageSubjectThe mail message subject
MailMessageP1Sender
MailMessageP1SenderThe mail message P1 sender
MailMessageP2Sender
MailMessageP2SenderThe mail message P2 sender
MalwareCategory
MalwareCategoryThe malware category
MalwareName
MalwareNameThe malware name
ProcessCommandLine
ProcessCommandLineThe process execution command line
ProcessId
ProcessIdThe process id
RegistryKey
RegistryKeyThe registry key path
RegistryValueData
RegistryValueDataThe registry key value in string formatted representation
Url
UrlThe url
INCIDENT_TITLE
IncidentTitleThe title of the incident
INCIDENT_DESCRIPTION
IncidentDescriptionThe description of the incident
INCIDENT_SEVERITY
IncidentSeverityThe severity of the incident
INCIDENT_STATUS
IncidentStatusThe status of the incident
INCIDENT_RELATED_ANALYTIC_RULE_IDS
IncidentRelatedAnalyticRuleIdsThe related Analytic rule ids of the incident
INCIDENT_TACTICS
IncidentTacticsThe tactics of the incident
INCIDENT_LABEL
IncidentLabelThe labels of the incident
INCIDENT_PROVIDER_NAME
IncidentProviderNameThe provider name of the incident
INCIDENT_UPDATED_BY_SOURCE
IncidentUpdatedBySourceThe update source of the incident
ACCOUNT_AAD_TENANT_ID
AccountAadTenantIdThe account Azure Active Directory tenant id
ACCOUNT_AAD_USER_ID
AccountAadUserIdThe account Azure Active Directory user id
ACCOUNT_NAME
AccountNameThe account name
ACCOUNT_NT_DOMAIN
AccountNTDomainThe account NetBIOS domain name
ACCOUNT_PUID
AccountPUIDThe account Azure Active Directory Passport User ID
ACCOUNT_SID
AccountSidThe account security identifier
ACCOUNT_OBJECT_GUID
AccountObjectGuidThe account unique identifier
ACCOUNT_UPN_SUFFIX
AccountUPNSuffixThe account user principal name suffix
ALERT_PRODUCT_NAMES
AlertProductNamesThe name of the product of the alert
ALERT_ANALYTIC_RULE_IDS
AlertAnalyticRuleIdsThe analytic rule ids of the alert
AZURE_RESOURCE_RESOURCE_ID
AzureResourceResourceIdThe Azure resource id
AZURE_RESOURCE_SUBSCRIPTION_ID
AzureResourceSubscriptionIdThe Azure resource subscription id
CLOUD_APPLICATION_APP_ID
CloudApplicationAppIdThe cloud application identifier
CLOUD_APPLICATION_APP_NAME
CloudApplicationAppNameThe cloud application name
DNS_DOMAIN_NAME
DNSDomainNameThe dns record domain name
FILE_DIRECTORY
FileDirectoryThe file directory full path
FILE_NAME
FileNameThe file name without path
FILE_HASH_VALUE
FileHashValueThe file hash value
HOST_AZURE_ID
HostAzureIDThe host Azure resource id
HOST_NAME
HostNameThe host name without domain
HOST_NET_BIOS_NAME
HostNetBiosNameThe host NetBIOS name
HOST_NT_DOMAIN
HostNTDomainThe host NT domain
HOST_OS_VERSION
HostOSVersionThe host operating system
IO_T_DEVICE_ID
IoTDeviceId"The IoT device id
IO_T_DEVICE_NAME
IoTDeviceNameThe IoT device name
IO_T_DEVICE_TYPE
IoTDeviceTypeThe IoT device type
IO_T_DEVICE_VENDOR
IoTDeviceVendorThe IoT device vendor
IO_T_DEVICE_MODEL
IoTDeviceModelThe IoT device model
IO_T_DEVICE_OPERATING_SYSTEM
IoTDeviceOperatingSystemThe IoT device operating system
IP_ADDRESS
IPAddressThe IP address
MAILBOX_DISPLAY_NAME
MailboxDisplayNameThe mailbox display name
MAILBOX_PRIMARY_ADDRESS
MailboxPrimaryAddressThe mailbox primary address
MAILBOX_UPN
MailboxUPNThe mailbox user principal name
MAIL_MESSAGE_DELIVERY_ACTION
MailMessageDeliveryActionThe mail message delivery action
MAIL_MESSAGE_DELIVERY_LOCATION
MailMessageDeliveryLocationThe mail message delivery location
MAIL_MESSAGE_RECIPIENT
MailMessageRecipientThe mail message recipient
MAIL_MESSAGE_SENDER_IP
MailMessageSenderIPThe mail message sender IP address
MAIL_MESSAGE_SUBJECT
MailMessageSubjectThe mail message subject
MAIL_MESSAGE_P1_SENDER
MailMessageP1SenderThe mail message P1 sender
MAIL_MESSAGE_P2_SENDER
MailMessageP2SenderThe mail message P2 sender
MALWARE_CATEGORY
MalwareCategoryThe malware category
MALWARE_NAME
MalwareNameThe malware name
PROCESS_COMMAND_LINE
ProcessCommandLineThe process execution command line
PROCESS_ID
ProcessIdThe process id
REGISTRY_KEY
RegistryKeyThe registry key path
REGISTRY_VALUE_DATA
RegistryValueDataThe registry key value in string formatted representation
URL
UrlThe url
"IncidentTitle"
IncidentTitleThe title of the incident
"IncidentDescription"
IncidentDescriptionThe description of the incident
"IncidentSeverity"
IncidentSeverityThe severity of the incident
"IncidentStatus"
IncidentStatusThe status of the incident
"IncidentRelatedAnalyticRuleIds"
IncidentRelatedAnalyticRuleIdsThe related Analytic rule ids of the incident
"IncidentTactics"
IncidentTacticsThe tactics of the incident
"IncidentLabel"
IncidentLabelThe labels of the incident
"IncidentProviderName"
IncidentProviderNameThe provider name of the incident
"IncidentUpdatedBySource"
IncidentUpdatedBySourceThe update source of the incident
"AccountAadTenantId"
AccountAadTenantIdThe account Azure Active Directory tenant id
"AccountAadUserId"
AccountAadUserIdThe account Azure Active Directory user id
"AccountName"
AccountNameThe account name
"AccountNTDomain"
AccountNTDomainThe account NetBIOS domain name
"AccountPUID"
AccountPUIDThe account Azure Active Directory Passport User ID
"AccountSid"
AccountSidThe account security identifier
"AccountObjectGuid"
AccountObjectGuidThe account unique identifier
"AccountUPNSuffix"
AccountUPNSuffixThe account user principal name suffix
"AlertProductNames"
AlertProductNamesThe name of the product of the alert
"AlertAnalyticRuleIds"
AlertAnalyticRuleIdsThe analytic rule ids of the alert
"AzureResourceResourceId"
AzureResourceResourceIdThe Azure resource id
"AzureResourceSubscriptionId"
AzureResourceSubscriptionIdThe Azure resource subscription id
"CloudApplicationAppId"
CloudApplicationAppIdThe cloud application identifier
"CloudApplicationAppName"
CloudApplicationAppNameThe cloud application name
"DNSDomainName"
DNSDomainNameThe dns record domain name
"FileDirectory"
FileDirectoryThe file directory full path
"FileName"
FileNameThe file name without path
"FileHashValue"
FileHashValueThe file hash value
"HostAzureID"
HostAzureIDThe host Azure resource id
"HostName"
HostNameThe host name without domain
"HostNetBiosName"
HostNetBiosNameThe host NetBIOS name
"HostNTDomain"
HostNTDomainThe host NT domain
"HostOSVersion"
HostOSVersionThe host operating system
"IoTDeviceId"
IoTDeviceId"The IoT device id
"IoTDeviceName"
IoTDeviceNameThe IoT device name
"IoTDeviceType"
IoTDeviceTypeThe IoT device type
"IoTDeviceVendor"
IoTDeviceVendorThe IoT device vendor
"IoTDeviceModel"
IoTDeviceModelThe IoT device model
"IoTDeviceOperatingSystem"
IoTDeviceOperatingSystemThe IoT device operating system
"IPAddress"
IPAddressThe IP address
"MailboxDisplayName"
MailboxDisplayNameThe mailbox display name
"MailboxPrimaryAddress"
MailboxPrimaryAddressThe mailbox primary address
"MailboxUPN"
MailboxUPNThe mailbox user principal name
"MailMessageDeliveryAction"
MailMessageDeliveryActionThe mail message delivery action
"MailMessageDeliveryLocation"
MailMessageDeliveryLocationThe mail message delivery location
"MailMessageRecipient"
MailMessageRecipientThe mail message recipient
"MailMessageSenderIP"
MailMessageSenderIPThe mail message sender IP address
"MailMessageSubject"
MailMessageSubjectThe mail message subject
"MailMessageP1Sender"
MailMessageP1SenderThe mail message P1 sender
"MailMessageP2Sender"
MailMessageP2SenderThe mail message P2 sender
"MalwareCategory"
MalwareCategoryThe malware category
"MalwareName"
MalwareNameThe malware name
"ProcessCommandLine"
ProcessCommandLineThe process execution command line
"ProcessId"
ProcessIdThe process id
"RegistryKey"
RegistryKeyThe registry key path
"RegistryValueData"
RegistryValueDataThe registry key value in string formatted representation
"Url"
UrlThe url

AutomationRulePropertyValuesChangedCondition
, AutomationRulePropertyValuesChangedConditionArgs

AutomationRulePropertyValuesChangedConditionResponse
, AutomationRulePropertyValuesChangedConditionResponseArgs

ChangeType string
Operator string
PropertyName string
PropertyValues List<string>
ChangeType string
Operator string
PropertyName string
PropertyValues []string
changeType String
operator String
propertyName String
propertyValues List<String>
changeType string
operator string
propertyName string
propertyValues string[]
changeType String
operator String
propertyName String
propertyValues List<String>

AutomationRulePropertyValuesCondition
, AutomationRulePropertyValuesConditionArgs

Operator string | AutomationRulePropertyConditionSupportedOperator
PropertyName string | AutomationRulePropertyConditionSupportedProperty
The property to evaluate in an automation rule property condition.
PropertyValues []string
operator String | AutomationRulePropertyConditionSupportedOperator
propertyName String | AutomationRulePropertyConditionSupportedProperty
The property to evaluate in an automation rule property condition.
propertyValues List<String>
operator string | AutomationRulePropertyConditionSupportedOperator
propertyName string | AutomationRulePropertyConditionSupportedProperty
The property to evaluate in an automation rule property condition.
propertyValues string[]
operator str | AutomationRulePropertyConditionSupportedOperator
property_name str | AutomationRulePropertyConditionSupportedProperty
The property to evaluate in an automation rule property condition.
property_values Sequence[str]
operator String | "Equals" | "NotEquals" | "Contains" | "NotContains" | "StartsWith" | "NotStartsWith" | "EndsWith" | "NotEndsWith"
propertyName String | "IncidentTitle" | "IncidentDescription" | "IncidentSeverity" | "IncidentStatus" | "IncidentRelatedAnalyticRuleIds" | "IncidentTactics" | "IncidentLabel" | "IncidentProviderName" | "IncidentUpdatedBySource" | "AccountAadTenantId" | "AccountAadUserId" | "AccountName" | "AccountNTDomain" | "AccountPUID" | "AccountSid" | "AccountObjectGuid" | "AccountUPNSuffix" | "AlertProductNames" | "AlertAnalyticRuleIds" | "AzureResourceResourceId" | "AzureResourceSubscriptionId" | "CloudApplicationAppId" | "CloudApplicationAppName" | "DNSDomainName" | "FileDirectory" | "FileName" | "FileHashValue" | "HostAzureID" | "HostName" | "HostNetBiosName" | "HostNTDomain" | "HostOSVersion" | "IoTDeviceId" | "IoTDeviceName" | "IoTDeviceType" | "IoTDeviceVendor" | "IoTDeviceModel" | "IoTDeviceOperatingSystem" | "IPAddress" | "MailboxDisplayName" | "MailboxPrimaryAddress" | "MailboxUPN" | "MailMessageDeliveryAction" | "MailMessageDeliveryLocation" | "MailMessageRecipient" | "MailMessageSenderIP" | "MailMessageSubject" | "MailMessageP1Sender" | "MailMessageP2Sender" | "MalwareCategory" | "MalwareName" | "ProcessCommandLine" | "ProcessId" | "RegistryKey" | "RegistryValueData" | "Url"
The property to evaluate in an automation rule property condition.
propertyValues List<String>

AutomationRulePropertyValuesConditionResponse
, AutomationRulePropertyValuesConditionResponseArgs

Operator string
PropertyName string
The property to evaluate in an automation rule property condition.
PropertyValues List<string>
Operator string
PropertyName string
The property to evaluate in an automation rule property condition.
PropertyValues []string
operator String
propertyName String
The property to evaluate in an automation rule property condition.
propertyValues List<String>
operator string
propertyName string
The property to evaluate in an automation rule property condition.
propertyValues string[]
operator str
property_name str
The property to evaluate in an automation rule property condition.
property_values Sequence[str]
operator String
propertyName String
The property to evaluate in an automation rule property condition.
propertyValues List<String>

AutomationRuleRunPlaybookAction
, AutomationRuleRunPlaybookActionArgs

Order This property is required. int
ActionConfiguration PlaybookActionProperties
order This property is required. Integer
actionConfiguration PlaybookActionProperties
order This property is required. number
actionConfiguration PlaybookActionProperties
order This property is required. Number
actionConfiguration Property Map

AutomationRuleRunPlaybookActionResponse
, AutomationRuleRunPlaybookActionResponseArgs

order This property is required. Number
actionConfiguration Property Map

AutomationRuleTriggeringLogic
, AutomationRuleTriggeringLogicArgs

IsEnabled This property is required. bool
Determines whether the automation rule is enabled or disabled.
TriggersOn This property is required. string | Pulumi.AzureNative.SecurityInsights.TriggersOn
TriggersWhen This property is required. string | Pulumi.AzureNative.SecurityInsights.TriggersWhen
Conditions List<object>
The conditions to evaluate to determine if the automation rule should be triggered on a given object.
ExpirationTimeUtc string
Determines when the automation rule should automatically expire and be disabled.
IsEnabled This property is required. bool
Determines whether the automation rule is enabled or disabled.
TriggersOn This property is required. string | TriggersOn
TriggersWhen This property is required. string | TriggersWhen
Conditions []interface{}
The conditions to evaluate to determine if the automation rule should be triggered on a given object.
ExpirationTimeUtc string
Determines when the automation rule should automatically expire and be disabled.
isEnabled This property is required. Boolean
Determines whether the automation rule is enabled or disabled.
triggersOn This property is required. String | TriggersOn
triggersWhen This property is required. String | TriggersWhen
conditions List<Object>
The conditions to evaluate to determine if the automation rule should be triggered on a given object.
expirationTimeUtc String
Determines when the automation rule should automatically expire and be disabled.
isEnabled This property is required. boolean
Determines whether the automation rule is enabled or disabled.
triggersOn This property is required. string | TriggersOn
triggersWhen This property is required. string | TriggersWhen
conditions (PropertyArrayChangedConditionProperties | PropertyChangedConditionProperties | PropertyConditionProperties)[]
The conditions to evaluate to determine if the automation rule should be triggered on a given object.
expirationTimeUtc string
Determines when the automation rule should automatically expire and be disabled.
is_enabled This property is required. bool
Determines whether the automation rule is enabled or disabled.
triggers_on This property is required. str | TriggersOn
triggers_when This property is required. str | TriggersWhen
conditions Sequence[Union[PropertyArrayChangedConditionProperties, PropertyChangedConditionProperties, PropertyConditionProperties]]
The conditions to evaluate to determine if the automation rule should be triggered on a given object.
expiration_time_utc str
Determines when the automation rule should automatically expire and be disabled.
isEnabled This property is required. Boolean
Determines whether the automation rule is enabled or disabled.
triggersOn This property is required. String | "Incidents" | "Alerts"
triggersWhen This property is required. String | "Created" | "Updated"
conditions List<Property Map | Property Map | Property Map>
The conditions to evaluate to determine if the automation rule should be triggered on a given object.
expirationTimeUtc String
Determines when the automation rule should automatically expire and be disabled.

AutomationRuleTriggeringLogicResponse
, AutomationRuleTriggeringLogicResponseArgs

IsEnabled This property is required. bool
Determines whether the automation rule is enabled or disabled.
TriggersOn This property is required. string
TriggersWhen This property is required. string
Conditions List<object>
The conditions to evaluate to determine if the automation rule should be triggered on a given object.
ExpirationTimeUtc string
Determines when the automation rule should automatically expire and be disabled.
IsEnabled This property is required. bool
Determines whether the automation rule is enabled or disabled.
TriggersOn This property is required. string
TriggersWhen This property is required. string
Conditions []interface{}
The conditions to evaluate to determine if the automation rule should be triggered on a given object.
ExpirationTimeUtc string
Determines when the automation rule should automatically expire and be disabled.
isEnabled This property is required. Boolean
Determines whether the automation rule is enabled or disabled.
triggersOn This property is required. String
triggersWhen This property is required. String
conditions List<Object>
The conditions to evaluate to determine if the automation rule should be triggered on a given object.
expirationTimeUtc String
Determines when the automation rule should automatically expire and be disabled.
isEnabled This property is required. boolean
Determines whether the automation rule is enabled or disabled.
triggersOn This property is required. string
triggersWhen This property is required. string
conditions (PropertyArrayChangedConditionPropertiesResponse | PropertyChangedConditionPropertiesResponse | PropertyConditionPropertiesResponse)[]
The conditions to evaluate to determine if the automation rule should be triggered on a given object.
expirationTimeUtc string
Determines when the automation rule should automatically expire and be disabled.
is_enabled This property is required. bool
Determines whether the automation rule is enabled or disabled.
triggers_on This property is required. str
triggers_when This property is required. str
conditions Sequence[Union[PropertyArrayChangedConditionPropertiesResponse, PropertyChangedConditionPropertiesResponse, PropertyConditionPropertiesResponse]]
The conditions to evaluate to determine if the automation rule should be triggered on a given object.
expiration_time_utc str
Determines when the automation rule should automatically expire and be disabled.
isEnabled This property is required. Boolean
Determines whether the automation rule is enabled or disabled.
triggersOn This property is required. String
triggersWhen This property is required. String
conditions List<Property Map | Property Map | Property Map>
The conditions to evaluate to determine if the automation rule should be triggered on a given object.
expirationTimeUtc String
Determines when the automation rule should automatically expire and be disabled.

ClientInfoResponse
, ClientInfoResponseArgs

Email string
The email of the client.
Name string
The name of the client.
ObjectId string
The object id of the client.
UserPrincipalName string
The user principal name of the client.
Email string
The email of the client.
Name string
The name of the client.
ObjectId string
The object id of the client.
UserPrincipalName string
The user principal name of the client.
email String
The email of the client.
name String
The name of the client.
objectId String
The object id of the client.
userPrincipalName String
The user principal name of the client.
email string
The email of the client.
name string
The name of the client.
objectId string
The object id of the client.
userPrincipalName string
The user principal name of the client.
email str
The email of the client.
name str
The name of the client.
object_id str
The object id of the client.
user_principal_name str
The user principal name of the client.
email String
The email of the client.
name String
The name of the client.
objectId String
The object id of the client.
userPrincipalName String
The user principal name of the client.

IncidentClassification
, IncidentClassificationArgs

Undetermined
UndeterminedIncident classification was undetermined
TruePositive
TruePositiveIncident was true positive
BenignPositive
BenignPositiveIncident was benign positive
FalsePositive
FalsePositiveIncident was false positive
IncidentClassificationUndetermined
UndeterminedIncident classification was undetermined
IncidentClassificationTruePositive
TruePositiveIncident was true positive
IncidentClassificationBenignPositive
BenignPositiveIncident was benign positive
IncidentClassificationFalsePositive
FalsePositiveIncident was false positive
Undetermined
UndeterminedIncident classification was undetermined
TruePositive
TruePositiveIncident was true positive
BenignPositive
BenignPositiveIncident was benign positive
FalsePositive
FalsePositiveIncident was false positive
Undetermined
UndeterminedIncident classification was undetermined
TruePositive
TruePositiveIncident was true positive
BenignPositive
BenignPositiveIncident was benign positive
FalsePositive
FalsePositiveIncident was false positive
UNDETERMINED
UndeterminedIncident classification was undetermined
TRUE_POSITIVE
TruePositiveIncident was true positive
BENIGN_POSITIVE
BenignPositiveIncident was benign positive
FALSE_POSITIVE
FalsePositiveIncident was false positive
"Undetermined"
UndeterminedIncident classification was undetermined
"TruePositive"
TruePositiveIncident was true positive
"BenignPositive"
BenignPositiveIncident was benign positive
"FalsePositive"
FalsePositiveIncident was false positive

IncidentClassificationReason
, IncidentClassificationReasonArgs

SuspiciousActivity
SuspiciousActivityClassification reason was suspicious activity
SuspiciousButExpected
SuspiciousButExpectedClassification reason was suspicious but expected
IncorrectAlertLogic
IncorrectAlertLogicClassification reason was incorrect alert logic
InaccurateData
InaccurateDataClassification reason was inaccurate data
IncidentClassificationReasonSuspiciousActivity
SuspiciousActivityClassification reason was suspicious activity
IncidentClassificationReasonSuspiciousButExpected
SuspiciousButExpectedClassification reason was suspicious but expected
IncidentClassificationReasonIncorrectAlertLogic
IncorrectAlertLogicClassification reason was incorrect alert logic
IncidentClassificationReasonInaccurateData
InaccurateDataClassification reason was inaccurate data
SuspiciousActivity
SuspiciousActivityClassification reason was suspicious activity
SuspiciousButExpected
SuspiciousButExpectedClassification reason was suspicious but expected
IncorrectAlertLogic
IncorrectAlertLogicClassification reason was incorrect alert logic
InaccurateData
InaccurateDataClassification reason was inaccurate data
SuspiciousActivity
SuspiciousActivityClassification reason was suspicious activity
SuspiciousButExpected
SuspiciousButExpectedClassification reason was suspicious but expected
IncorrectAlertLogic
IncorrectAlertLogicClassification reason was incorrect alert logic
InaccurateData
InaccurateDataClassification reason was inaccurate data
SUSPICIOUS_ACTIVITY
SuspiciousActivityClassification reason was suspicious activity
SUSPICIOUS_BUT_EXPECTED
SuspiciousButExpectedClassification reason was suspicious but expected
INCORRECT_ALERT_LOGIC
IncorrectAlertLogicClassification reason was incorrect alert logic
INACCURATE_DATA
InaccurateDataClassification reason was inaccurate data
"SuspiciousActivity"
SuspiciousActivityClassification reason was suspicious activity
"SuspiciousButExpected"
SuspiciousButExpectedClassification reason was suspicious but expected
"IncorrectAlertLogic"
IncorrectAlertLogicClassification reason was incorrect alert logic
"InaccurateData"
InaccurateDataClassification reason was inaccurate data

IncidentLabel
, IncidentLabelArgs

LabelName This property is required. string
The name of the label
LabelName This property is required. string
The name of the label
labelName This property is required. String
The name of the label
labelName This property is required. string
The name of the label
label_name This property is required. str
The name of the label
labelName This property is required. String
The name of the label

IncidentLabelResponse
, IncidentLabelResponseArgs

LabelName This property is required. string
The name of the label
LabelType This property is required. string
The type of the label
LabelName This property is required. string
The name of the label
LabelType This property is required. string
The type of the label
labelName This property is required. String
The name of the label
labelType This property is required. String
The type of the label
labelName This property is required. string
The name of the label
labelType This property is required. string
The type of the label
label_name This property is required. str
The name of the label
label_type This property is required. str
The type of the label
labelName This property is required. String
The name of the label
labelType This property is required. String
The type of the label

IncidentOwnerInfo
, IncidentOwnerInfoArgs

AssignedTo string
The name of the user the incident is assigned to.
Email string
The email of the user the incident is assigned to.
ObjectId string
The object id of the user the incident is assigned to.
OwnerType string | Pulumi.AzureNative.SecurityInsights.OwnerType
The type of the owner the incident is assigned to.
UserPrincipalName string
The user principal name of the user the incident is assigned to.
AssignedTo string
The name of the user the incident is assigned to.
Email string
The email of the user the incident is assigned to.
ObjectId string
The object id of the user the incident is assigned to.
OwnerType string | OwnerType
The type of the owner the incident is assigned to.
UserPrincipalName string
The user principal name of the user the incident is assigned to.
assignedTo String
The name of the user the incident is assigned to.
email String
The email of the user the incident is assigned to.
objectId String
The object id of the user the incident is assigned to.
ownerType String | OwnerType
The type of the owner the incident is assigned to.
userPrincipalName String
The user principal name of the user the incident is assigned to.
assignedTo string
The name of the user the incident is assigned to.
email string
The email of the user the incident is assigned to.
objectId string
The object id of the user the incident is assigned to.
ownerType string | OwnerType
The type of the owner the incident is assigned to.
userPrincipalName string
The user principal name of the user the incident is assigned to.
assigned_to str
The name of the user the incident is assigned to.
email str
The email of the user the incident is assigned to.
object_id str
The object id of the user the incident is assigned to.
owner_type str | OwnerType
The type of the owner the incident is assigned to.
user_principal_name str
The user principal name of the user the incident is assigned to.
assignedTo String
The name of the user the incident is assigned to.
email String
The email of the user the incident is assigned to.
objectId String
The object id of the user the incident is assigned to.
ownerType String | "Unknown" | "User" | "Group"
The type of the owner the incident is assigned to.
userPrincipalName String
The user principal name of the user the incident is assigned to.

IncidentOwnerInfoResponse
, IncidentOwnerInfoResponseArgs

AssignedTo string
The name of the user the incident is assigned to.
Email string
The email of the user the incident is assigned to.
ObjectId string
The object id of the user the incident is assigned to.
OwnerType string
The type of the owner the incident is assigned to.
UserPrincipalName string
The user principal name of the user the incident is assigned to.
AssignedTo string
The name of the user the incident is assigned to.
Email string
The email of the user the incident is assigned to.
ObjectId string
The object id of the user the incident is assigned to.
OwnerType string
The type of the owner the incident is assigned to.
UserPrincipalName string
The user principal name of the user the incident is assigned to.
assignedTo String
The name of the user the incident is assigned to.
email String
The email of the user the incident is assigned to.
objectId String
The object id of the user the incident is assigned to.
ownerType String
The type of the owner the incident is assigned to.
userPrincipalName String
The user principal name of the user the incident is assigned to.
assignedTo string
The name of the user the incident is assigned to.
email string
The email of the user the incident is assigned to.
objectId string
The object id of the user the incident is assigned to.
ownerType string
The type of the owner the incident is assigned to.
userPrincipalName string
The user principal name of the user the incident is assigned to.
assigned_to str
The name of the user the incident is assigned to.
email str
The email of the user the incident is assigned to.
object_id str
The object id of the user the incident is assigned to.
owner_type str
The type of the owner the incident is assigned to.
user_principal_name str
The user principal name of the user the incident is assigned to.
assignedTo String
The name of the user the incident is assigned to.
email String
The email of the user the incident is assigned to.
objectId String
The object id of the user the incident is assigned to.
ownerType String
The type of the owner the incident is assigned to.
userPrincipalName String
The user principal name of the user the incident is assigned to.

IncidentPropertiesAction
, IncidentPropertiesActionArgs

Classification string | Pulumi.AzureNative.SecurityInsights.IncidentClassification
The reason the incident was closed
ClassificationComment string
Describes the reason the incident was closed.
ClassificationReason string | Pulumi.AzureNative.SecurityInsights.IncidentClassificationReason
The classification reason the incident was closed with
Labels List<Pulumi.AzureNative.SecurityInsights.Inputs.IncidentLabel>
List of labels to add to the incident.
Owner Pulumi.AzureNative.SecurityInsights.Inputs.IncidentOwnerInfo
Information on the user an incident is assigned to
Severity string | Pulumi.AzureNative.SecurityInsights.IncidentSeverity
The severity of the incident
Status string | Pulumi.AzureNative.SecurityInsights.IncidentStatus
The status of the incident
Classification string | IncidentClassification
The reason the incident was closed
ClassificationComment string
Describes the reason the incident was closed.
ClassificationReason string | IncidentClassificationReason
The classification reason the incident was closed with
Labels []IncidentLabel
List of labels to add to the incident.
Owner IncidentOwnerInfo
Information on the user an incident is assigned to
Severity string | IncidentSeverity
The severity of the incident
Status string | IncidentStatus
The status of the incident
classification String | IncidentClassification
The reason the incident was closed
classificationComment String
Describes the reason the incident was closed.
classificationReason String | IncidentClassificationReason
The classification reason the incident was closed with
labels List<IncidentLabel>
List of labels to add to the incident.
owner IncidentOwnerInfo
Information on the user an incident is assigned to
severity String | IncidentSeverity
The severity of the incident
status String | IncidentStatus
The status of the incident
classification string | IncidentClassification
The reason the incident was closed
classificationComment string
Describes the reason the incident was closed.
classificationReason string | IncidentClassificationReason
The classification reason the incident was closed with
labels IncidentLabel[]
List of labels to add to the incident.
owner IncidentOwnerInfo
Information on the user an incident is assigned to
severity string | IncidentSeverity
The severity of the incident
status string | IncidentStatus
The status of the incident
classification str | IncidentClassification
The reason the incident was closed
classification_comment str
Describes the reason the incident was closed.
classification_reason str | IncidentClassificationReason
The classification reason the incident was closed with
labels Sequence[IncidentLabel]
List of labels to add to the incident.
owner IncidentOwnerInfo
Information on the user an incident is assigned to
severity str | IncidentSeverity
The severity of the incident
status str | IncidentStatus
The status of the incident
classification String | "Undetermined" | "TruePositive" | "BenignPositive" | "FalsePositive"
The reason the incident was closed
classificationComment String
Describes the reason the incident was closed.
classificationReason String | "SuspiciousActivity" | "SuspiciousButExpected" | "IncorrectAlertLogic" | "InaccurateData"
The classification reason the incident was closed with
labels List<Property Map>
List of labels to add to the incident.
owner Property Map
Information on the user an incident is assigned to
severity String | "High" | "Medium" | "Low" | "Informational"
The severity of the incident
status String | "New" | "Active" | "Closed"
The status of the incident

IncidentPropertiesActionResponse
, IncidentPropertiesActionResponseArgs

Classification string
The reason the incident was closed
ClassificationComment string
Describes the reason the incident was closed.
ClassificationReason string
The classification reason the incident was closed with
Labels List<Pulumi.AzureNative.SecurityInsights.Inputs.IncidentLabelResponse>
List of labels to add to the incident.
Owner Pulumi.AzureNative.SecurityInsights.Inputs.IncidentOwnerInfoResponse
Information on the user an incident is assigned to
Severity string
The severity of the incident
Status string
The status of the incident
Classification string
The reason the incident was closed
ClassificationComment string
Describes the reason the incident was closed.
ClassificationReason string
The classification reason the incident was closed with
Labels []IncidentLabelResponse
List of labels to add to the incident.
Owner IncidentOwnerInfoResponse
Information on the user an incident is assigned to
Severity string
The severity of the incident
Status string
The status of the incident
classification String
The reason the incident was closed
classificationComment String
Describes the reason the incident was closed.
classificationReason String
The classification reason the incident was closed with
labels List<IncidentLabelResponse>
List of labels to add to the incident.
owner IncidentOwnerInfoResponse
Information on the user an incident is assigned to
severity String
The severity of the incident
status String
The status of the incident
classification string
The reason the incident was closed
classificationComment string
Describes the reason the incident was closed.
classificationReason string
The classification reason the incident was closed with
labels IncidentLabelResponse[]
List of labels to add to the incident.
owner IncidentOwnerInfoResponse
Information on the user an incident is assigned to
severity string
The severity of the incident
status string
The status of the incident
classification str
The reason the incident was closed
classification_comment str
Describes the reason the incident was closed.
classification_reason str
The classification reason the incident was closed with
labels Sequence[IncidentLabelResponse]
List of labels to add to the incident.
owner IncidentOwnerInfoResponse
Information on the user an incident is assigned to
severity str
The severity of the incident
status str
The status of the incident
classification String
The reason the incident was closed
classificationComment String
Describes the reason the incident was closed.
classificationReason String
The classification reason the incident was closed with
labels List<Property Map>
List of labels to add to the incident.
owner Property Map
Information on the user an incident is assigned to
severity String
The severity of the incident
status String
The status of the incident

IncidentSeverity
, IncidentSeverityArgs

High
HighHigh severity
Medium
MediumMedium severity
Low
LowLow severity
Informational
InformationalInformational severity
IncidentSeverityHigh
HighHigh severity
IncidentSeverityMedium
MediumMedium severity
IncidentSeverityLow
LowLow severity
IncidentSeverityInformational
InformationalInformational severity
High
HighHigh severity
Medium
MediumMedium severity
Low
LowLow severity
Informational
InformationalInformational severity
High
HighHigh severity
Medium
MediumMedium severity
Low
LowLow severity
Informational
InformationalInformational severity
HIGH
HighHigh severity
MEDIUM
MediumMedium severity
LOW
LowLow severity
INFORMATIONAL
InformationalInformational severity
"High"
HighHigh severity
"Medium"
MediumMedium severity
"Low"
LowLow severity
"Informational"
InformationalInformational severity

IncidentStatus
, IncidentStatusArgs

New
NewAn active incident which isn't being handled currently
Active
ActiveAn active incident which is being handled
Closed
ClosedA non-active incident
IncidentStatusNew
NewAn active incident which isn't being handled currently
IncidentStatusActive
ActiveAn active incident which is being handled
IncidentStatusClosed
ClosedA non-active incident
New
NewAn active incident which isn't being handled currently
Active
ActiveAn active incident which is being handled
Closed
ClosedA non-active incident
New
NewAn active incident which isn't being handled currently
Active
ActiveAn active incident which is being handled
Closed
ClosedA non-active incident
NEW
NewAn active incident which isn't being handled currently
ACTIVE
ActiveAn active incident which is being handled
CLOSED
ClosedA non-active incident
"New"
NewAn active incident which isn't being handled currently
"Active"
ActiveAn active incident which is being handled
"Closed"
ClosedA non-active incident

OwnerType
, OwnerTypeArgs

Unknown
UnknownThe incident owner type is unknown
User
UserThe incident owner type is an AAD user
Group
GroupThe incident owner type is an AAD group
OwnerTypeUnknown
UnknownThe incident owner type is unknown
OwnerTypeUser
UserThe incident owner type is an AAD user
OwnerTypeGroup
GroupThe incident owner type is an AAD group
Unknown
UnknownThe incident owner type is unknown
User
UserThe incident owner type is an AAD user
Group
GroupThe incident owner type is an AAD group
Unknown
UnknownThe incident owner type is unknown
User
UserThe incident owner type is an AAD user
Group
GroupThe incident owner type is an AAD group
UNKNOWN
UnknownThe incident owner type is unknown
USER
UserThe incident owner type is an AAD user
GROUP
GroupThe incident owner type is an AAD group
"Unknown"
UnknownThe incident owner type is unknown
"User"
UserThe incident owner type is an AAD user
"Group"
GroupThe incident owner type is an AAD group

PlaybookActionProperties
, PlaybookActionPropertiesArgs

LogicAppResourceId This property is required. string
The resource id of the playbook resource.
TenantId string
The tenant id of the playbook resource.
LogicAppResourceId This property is required. string
The resource id of the playbook resource.
TenantId string
The tenant id of the playbook resource.
logicAppResourceId This property is required. String
The resource id of the playbook resource.
tenantId String
The tenant id of the playbook resource.
logicAppResourceId This property is required. string
The resource id of the playbook resource.
tenantId string
The tenant id of the playbook resource.
logic_app_resource_id This property is required. str
The resource id of the playbook resource.
tenant_id str
The tenant id of the playbook resource.
logicAppResourceId This property is required. String
The resource id of the playbook resource.
tenantId String
The tenant id of the playbook resource.

PlaybookActionPropertiesResponse
, PlaybookActionPropertiesResponseArgs

LogicAppResourceId This property is required. string
The resource id of the playbook resource.
TenantId string
The tenant id of the playbook resource.
LogicAppResourceId This property is required. string
The resource id of the playbook resource.
TenantId string
The tenant id of the playbook resource.
logicAppResourceId This property is required. String
The resource id of the playbook resource.
tenantId String
The tenant id of the playbook resource.
logicAppResourceId This property is required. string
The resource id of the playbook resource.
tenantId string
The tenant id of the playbook resource.
logic_app_resource_id This property is required. str
The resource id of the playbook resource.
tenant_id str
The tenant id of the playbook resource.
logicAppResourceId This property is required. String
The resource id of the playbook resource.
tenantId String
The tenant id of the playbook resource.

PropertyArrayChangedConditionProperties
, PropertyArrayChangedConditionPropertiesArgs

PropertyArrayChangedConditionPropertiesResponse
, PropertyArrayChangedConditionPropertiesResponseArgs

PropertyChangedConditionProperties
, PropertyChangedConditionPropertiesArgs

PropertyChangedConditionPropertiesResponse
, PropertyChangedConditionPropertiesResponseArgs

PropertyConditionProperties
, PropertyConditionPropertiesArgs

PropertyConditionPropertiesResponse
, PropertyConditionPropertiesResponseArgs

SystemDataResponse
, SystemDataResponseArgs

CreatedAt string
The timestamp of resource creation (UTC).
CreatedBy string
The identity that created the resource.
CreatedByType string
The type of identity that created the resource.
LastModifiedAt string
The timestamp of resource last modification (UTC)
LastModifiedBy string
The identity that last modified the resource.
LastModifiedByType string
The type of identity that last modified the resource.
CreatedAt string
The timestamp of resource creation (UTC).
CreatedBy string
The identity that created the resource.
CreatedByType string
The type of identity that created the resource.
LastModifiedAt string
The timestamp of resource last modification (UTC)
LastModifiedBy string
The identity that last modified the resource.
LastModifiedByType string
The type of identity that last modified the resource.
createdAt String
The timestamp of resource creation (UTC).
createdBy String
The identity that created the resource.
createdByType String
The type of identity that created the resource.
lastModifiedAt String
The timestamp of resource last modification (UTC)
lastModifiedBy String
The identity that last modified the resource.
lastModifiedByType String
The type of identity that last modified the resource.
createdAt string
The timestamp of resource creation (UTC).
createdBy string
The identity that created the resource.
createdByType string
The type of identity that created the resource.
lastModifiedAt string
The timestamp of resource last modification (UTC)
lastModifiedBy string
The identity that last modified the resource.
lastModifiedByType string
The type of identity that last modified the resource.
created_at str
The timestamp of resource creation (UTC).
created_by str
The identity that created the resource.
created_by_type str
The type of identity that created the resource.
last_modified_at str
The timestamp of resource last modification (UTC)
last_modified_by str
The identity that last modified the resource.
last_modified_by_type str
The type of identity that last modified the resource.
createdAt String
The timestamp of resource creation (UTC).
createdBy String
The identity that created the resource.
createdByType String
The type of identity that created the resource.
lastModifiedAt String
The timestamp of resource last modification (UTC)
lastModifiedBy String
The identity that last modified the resource.
lastModifiedByType String
The type of identity that last modified the resource.

TriggersOn
, TriggersOnArgs

Incidents
IncidentsTrigger on Incidents
Alerts
AlertsTrigger on Alerts
TriggersOnIncidents
IncidentsTrigger on Incidents
TriggersOnAlerts
AlertsTrigger on Alerts
Incidents
IncidentsTrigger on Incidents
Alerts
AlertsTrigger on Alerts
Incidents
IncidentsTrigger on Incidents
Alerts
AlertsTrigger on Alerts
INCIDENTS
IncidentsTrigger on Incidents
ALERTS
AlertsTrigger on Alerts
"Incidents"
IncidentsTrigger on Incidents
"Alerts"
AlertsTrigger on Alerts

TriggersWhen
, TriggersWhenArgs

Created
CreatedTrigger on created objects
Updated
UpdatedTrigger on updated objects
TriggersWhenCreated
CreatedTrigger on created objects
TriggersWhenUpdated
UpdatedTrigger on updated objects
Created
CreatedTrigger on created objects
Updated
UpdatedTrigger on updated objects
Created
CreatedTrigger on created objects
Updated
UpdatedTrigger on updated objects
CREATED
CreatedTrigger on created objects
UPDATED
UpdatedTrigger on updated objects
"Created"
CreatedTrigger on created objects
"Updated"
UpdatedTrigger on updated objects

Import

An existing resource can be imported using its type token, name, and identifier, e.g.

$ pulumi import azure-native:securityinsights:AutomationRule 73e01a99-5cd7-4139-a149-9f2736ff2ab5 /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/automationRules/{automationRuleId}
Copy

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository
azure-native-v2 pulumi/pulumi-azure-native
License
Apache-2.0
These are the docs for Azure Native v2. We recommenend using the latest version, Azure Native v3.
Azure Native v2 v2.82.0 published on Friday, Jan 10, 2025 by Pulumi
pulumi/pulumi-azure-native