alertrules

package
v0.20230324.1144947 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Mar 24, 2023 License: MPL-2.0 Imports: 12 Imported by: 1

README

github.com/hashicorp/go-azure-sdk/resource-manager/securityinsights/2022-11-01/alertrules Documentation

The alertrules SDK allows for interaction with the Azure Resource Manager Service securityinsights (API Version 2022-11-01).

This readme covers example usages, but further information on using this SDK can be found in the project root.

Import Path

import "github.com/hashicorp/go-azure-sdk/resource-manager/securityinsights/2022-11-01/alertrules"

Client Initialization

client := alertrules.NewAlertRulesClientWithBaseURI("https://management.azure.com")
client.Client.Authorizer = authorizer

Example Usage: AlertRulesClient.AlertRulesCreateOrUpdate

ctx := context.TODO()
id := alertrules.NewAlertRuleID("12345678-1234-9876-4563-123456789012", "example-resource-group", "workspaceValue", "ruleIdValue")

payload := alertrules.AlertRule{
	// ...
}


read, err := client.AlertRulesCreateOrUpdate(ctx, id, payload)
if err != nil {
	// handle the error
}
if model := read.Model; model != nil {
	// do something with the model/response object
}

Example Usage: AlertRulesClient.AlertRulesDelete

ctx := context.TODO()
id := alertrules.NewAlertRuleID("12345678-1234-9876-4563-123456789012", "example-resource-group", "workspaceValue", "ruleIdValue")

read, err := client.AlertRulesDelete(ctx, id)
if err != nil {
	// handle the error
}
if model := read.Model; model != nil {
	// do something with the model/response object
}

Example Usage: AlertRulesClient.AlertRulesGet

ctx := context.TODO()
id := alertrules.NewAlertRuleID("12345678-1234-9876-4563-123456789012", "example-resource-group", "workspaceValue", "ruleIdValue")

read, err := client.AlertRulesGet(ctx, id)
if err != nil {
	// handle the error
}
if model := read.Model; model != nil {
	// do something with the model/response object
}

Example Usage: AlertRulesClient.AlertRulesList

ctx := context.TODO()
id := alertrules.NewWorkspaceID("12345678-1234-9876-4563-123456789012", "example-resource-group", "workspaceValue")

// alternatively `client.AlertRulesList(ctx, id)` can be used to do batched pagination
items, err := client.AlertRulesListComplete(ctx, id)
if err != nil {
	// handle the error
}
for _, item := range items {
	// do something
}

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func PossibleValuesForAlertDetail 

func PossibleValuesForAlertDetail() []string

func PossibleValuesForAlertRuleKind 

func PossibleValuesForAlertRuleKind() []string

func PossibleValuesForAlertSeverity 

func PossibleValuesForAlertSeverity() []string

func PossibleValuesForAttackTactic 

func PossibleValuesForAttackTactic() []string

func PossibleValuesForEntityMappingType 

func PossibleValuesForEntityMappingType() []string

func PossibleValuesForEventGroupingAggregationKind 

func PossibleValuesForEventGroupingAggregationKind() []string

func PossibleValuesForMatchingMethod 

func PossibleValuesForMatchingMethod() []string

func PossibleValuesForMicrosoftSecurityProductName 

func PossibleValuesForMicrosoftSecurityProductName() []string

func PossibleValuesForTriggerOperator 

func PossibleValuesForTriggerOperator() []string

func ValidateAlertRuleID 

func ValidateAlertRuleID(input interface{}, key string) (warnings []string, errors []error)

ValidateAlertRuleID checks that 'input' can be parsed as a Alert Rule ID

func ValidateWorkspaceID 

func ValidateWorkspaceID(input interface{}, key string) (warnings []string, errors []error)

ValidateWorkspaceID checks that 'input' can be parsed as a Workspace ID

Types

type AlertDetail 

type AlertDetail string
const (
	AlertDetailDisplayName AlertDetail = "DisplayName"
	AlertDetailSeverity    AlertDetail = "Severity"
)

type AlertDetailsOverride 

type AlertDetailsOverride struct {
	AlertDescriptionFormat  *string `json:"alertDescriptionFormat,omitempty"`
	AlertDisplayNameFormat  *string `json:"alertDisplayNameFormat,omitempty"`
	AlertSeverityColumnName *string `json:"alertSeverityColumnName,omitempty"`
	AlertTacticsColumnName  *string `json:"alertTacticsColumnName,omitempty"`
}

type AlertRule 

type AlertRule interface {
}

type AlertRuleId 

type AlertRuleId struct {
	SubscriptionId    string
	ResourceGroupName string
	WorkspaceName     string
	RuleId            string
}

AlertRuleId is a struct representing the Resource ID for a Alert Rule

func NewAlertRuleID 

func NewAlertRuleID(subscriptionId string, resourceGroupName string, workspaceName string, ruleId string) AlertRuleId

NewAlertRuleID returns a new AlertRuleId struct

func ParseAlertRuleID 

func ParseAlertRuleID(input string) (*AlertRuleId, error)

ParseAlertRuleID parses 'input' into a AlertRuleId

func ParseAlertRuleIDInsensitively 

func ParseAlertRuleIDInsensitively(input string) (*AlertRuleId, error)

ParseAlertRuleIDInsensitively parses 'input' case-insensitively into a AlertRuleId note: this method should only be used for API response data and not user input

func (AlertRuleId) ID 

func (id AlertRuleId) ID() string

ID returns the formatted Alert Rule ID

func (AlertRuleId) Segments 

func (id AlertRuleId) Segments() []resourceids.Segment

Segments returns a slice of Resource ID Segments which comprise this Alert Rule ID

func (AlertRuleId) String 

func (id AlertRuleId) String() string

String returns a human-readable description of this Alert Rule ID

type AlertRuleKind 

type AlertRuleKind string
const (
	AlertRuleKindFusion                            AlertRuleKind = "Fusion"
	AlertRuleKindMicrosoftSecurityIncidentCreation AlertRuleKind = "MicrosoftSecurityIncidentCreation"
	AlertRuleKindScheduled                         AlertRuleKind = "Scheduled"
)

type AlertRuleOperationPredicate 

type AlertRuleOperationPredicate struct {
}

func (AlertRuleOperationPredicate) Matches 

func (p AlertRuleOperationPredicate) Matches(input AlertRule) bool

type AlertRulesClient 

type AlertRulesClient struct {
	Client autorest.Client
	// contains filtered or unexported fields
}

func NewAlertRulesClientWithBaseURI 

func NewAlertRulesClientWithBaseURI(endpoint string) AlertRulesClient

func (AlertRulesClient) AlertRulesCreateOrUpdate 

func (c AlertRulesClient) AlertRulesCreateOrUpdate(ctx context.Context, id AlertRuleId, input AlertRule) (result AlertRulesCreateOrUpdateOperationResponse, err error)

AlertRulesCreateOrUpdate ...

func (AlertRulesClient) AlertRulesDelete 

func (c AlertRulesClient) AlertRulesDelete(ctx context.Context, id AlertRuleId) (result AlertRulesDeleteOperationResponse, err error)

AlertRulesDelete ...

func (AlertRulesClient) AlertRulesGet 

func (c AlertRulesClient) AlertRulesGet(ctx context.Context, id AlertRuleId) (result AlertRulesGetOperationResponse, err error)

AlertRulesGet ...

func (AlertRulesClient) AlertRulesList 

func (c AlertRulesClient) AlertRulesList(ctx context.Context, id WorkspaceId) (resp AlertRulesListOperationResponse, err error)

AlertRulesList ...

func (AlertRulesClient) AlertRulesListComplete 

func (c AlertRulesClient) AlertRulesListComplete(ctx context.Context, id WorkspaceId) (AlertRulesListCompleteResult, error)

AlertRulesListComplete retrieves all of the results into a single object

func (AlertRulesClient) AlertRulesListCompleteMatchingPredicate 

func (c AlertRulesClient) AlertRulesListCompleteMatchingPredicate(ctx context.Context, id WorkspaceId, predicate AlertRuleOperationPredicate) (resp AlertRulesListCompleteResult, err error)

AlertRulesListCompleteMatchingPredicate retrieves all of the results and then applied the predicate

type AlertRulesCreateOrUpdateOperationResponse 

type AlertRulesCreateOrUpdateOperationResponse struct {
	HttpResponse *http.Response
	Model        *AlertRule
}

type AlertRulesDeleteOperationResponse 

type AlertRulesDeleteOperationResponse struct {
	HttpResponse *http.Response
}

type AlertRulesGetOperationResponse 

type AlertRulesGetOperationResponse struct {
	HttpResponse *http.Response
	Model        *AlertRule
}

type AlertRulesListCompleteResult 

type AlertRulesListCompleteResult struct {
	Items []AlertRule
}

type AlertRulesListOperationResponse 

type AlertRulesListOperationResponse struct {
	HttpResponse *http.Response
	Model        *[]AlertRule
	// contains filtered or unexported fields
}

func (AlertRulesListOperationResponse) HasMore 

func (r AlertRulesListOperationResponse) HasMore() bool

func (AlertRulesListOperationResponse) LoadMore 

func (r AlertRulesListOperationResponse) LoadMore(ctx context.Context) (resp AlertRulesListOperationResponse, err error)

type AlertSeverity 

type AlertSeverity string
const (
	AlertSeverityHigh          AlertSeverity = "High"
	AlertSeverityInformational AlertSeverity = "Informational"
	AlertSeverityLow           AlertSeverity = "Low"
	AlertSeverityMedium        AlertSeverity = "Medium"
)

type AttackTactic 

type AttackTactic string
const (
	AttackTacticCollection              AttackTactic = "Collection"
	AttackTacticCommandAndControl       AttackTactic = "CommandAndControl"
	AttackTacticCredentialAccess        AttackTactic = "CredentialAccess"
	AttackTacticDefenseEvasion          AttackTactic = "DefenseEvasion"
	AttackTacticDiscovery               AttackTactic = "Discovery"
	AttackTacticExecution               AttackTactic = "Execution"
	AttackTacticExfiltration            AttackTactic = "Exfiltration"
	AttackTacticImpact                  AttackTactic = "Impact"
	AttackTacticImpairProcessControl    AttackTactic = "ImpairProcessControl"
	AttackTacticInhibitResponseFunction AttackTactic = "InhibitResponseFunction"
	AttackTacticInitialAccess           AttackTactic = "InitialAccess"
	AttackTacticLateralMovement         AttackTactic = "LateralMovement"
	AttackTacticPersistence             AttackTactic = "Persistence"
	AttackTacticPreAttack               AttackTactic = "PreAttack"
	AttackTacticPrivilegeEscalation     AttackTactic = "PrivilegeEscalation"
	AttackTacticReconnaissance          AttackTactic = "Reconnaissance"
	AttackTacticResourceDevelopment     AttackTactic = "ResourceDevelopment"
)

type EntityMapping 

type EntityMapping struct {
	EntityType    *EntityMappingType `json:"entityType,omitempty"`
	FieldMappings *[]FieldMapping    `json:"fieldMappings,omitempty"`
}

type EntityMappingType 

type EntityMappingType string
const (
	EntityMappingTypeAccount          EntityMappingType = "Account"
	EntityMappingTypeAzureResource    EntityMappingType = "AzureResource"
	EntityMappingTypeCloudApplication EntityMappingType = "CloudApplication"
	EntityMappingTypeDNS              EntityMappingType = "DNS"
	EntityMappingTypeFile             EntityMappingType = "File"
	EntityMappingTypeFileHash         EntityMappingType = "FileHash"
	EntityMappingTypeHost             EntityMappingType = "Host"
	EntityMappingTypeIP               EntityMappingType = "IP"
	EntityMappingTypeMailCluster      EntityMappingType = "MailCluster"
	EntityMappingTypeMailMessage      EntityMappingType = "MailMessage"
	EntityMappingTypeMailbox          EntityMappingType = "Mailbox"
	EntityMappingTypeMalware          EntityMappingType = "Malware"
	EntityMappingTypeProcess          EntityMappingType = "Process"
	EntityMappingTypeRegistryKey      EntityMappingType = "RegistryKey"
	EntityMappingTypeRegistryValue    EntityMappingType = "RegistryValue"
	EntityMappingTypeSecurityGroup    EntityMappingType = "SecurityGroup"
	EntityMappingTypeSubmissionMail   EntityMappingType = "SubmissionMail"
	EntityMappingTypeURL              EntityMappingType = "URL"
)

type EventGroupingAggregationKind 

type EventGroupingAggregationKind string
const (
	EventGroupingAggregationKindAlertPerResult EventGroupingAggregationKind = "AlertPerResult"
	EventGroupingAggregationKindSingleAlert    EventGroupingAggregationKind = "SingleAlert"
)

type EventGroupingSettings 

type EventGroupingSettings struct {
	AggregationKind *EventGroupingAggregationKind `json:"aggregationKind,omitempty"`
}

type FieldMapping 

type FieldMapping struct {
	ColumnName *string `json:"columnName,omitempty"`
	Identifier *string `json:"identifier,omitempty"`
}

type FusionAlertRule 

type FusionAlertRule struct {
	Properties *FusionAlertRuleProperties `json:"properties,omitempty"`

	// Fields inherited from AlertRule
	Etag       *string                `json:"etag,omitempty"`
	Id         *string                `json:"id,omitempty"`
	Name       *string                `json:"name,omitempty"`
	SystemData *systemdata.SystemData `json:"systemData,omitempty"`
	Type       *string                `json:"type,omitempty"`
}

func (FusionAlertRule) MarshalJSON 

func (s FusionAlertRule) MarshalJSON() ([]byte, error)

type FusionAlertRuleProperties 

type FusionAlertRuleProperties struct {
	AlertRuleTemplateName string          `json:"alertRuleTemplateName"`
	Description           *string         `json:"description,omitempty"`
	DisplayName           *string         `json:"displayName,omitempty"`
	Enabled               bool            `json:"enabled"`
	LastModifiedUtc       *string         `json:"lastModifiedUtc,omitempty"`
	Severity              *AlertSeverity  `json:"severity,omitempty"`
	Tactics               *[]AttackTactic `json:"tactics,omitempty"`
	Techniques            *[]string       `json:"techniques,omitempty"`
}

func (*FusionAlertRuleProperties) GetLastModifiedUtcAsTime 

func (o *FusionAlertRuleProperties) GetLastModifiedUtcAsTime() (*time.Time, error)

func (*FusionAlertRuleProperties) SetLastModifiedUtcAsTime 

func (o *FusionAlertRuleProperties) SetLastModifiedUtcAsTime(input time.Time)

type GroupingConfiguration 

type GroupingConfiguration struct {
	Enabled              bool                 `json:"enabled"`
	GroupByAlertDetails  *[]AlertDetail       `json:"groupByAlertDetails,omitempty"`
	GroupByCustomDetails *[]string            `json:"groupByCustomDetails,omitempty"`
	GroupByEntities      *[]EntityMappingType `json:"groupByEntities,omitempty"`
	LookbackDuration     string               `json:"lookbackDuration"`
	MatchingMethod       MatchingMethod       `json:"matchingMethod"`
	ReopenClosedIncident bool                 `json:"reopenClosedIncident"`
}

type IncidentConfiguration 

type IncidentConfiguration struct {
	CreateIncident        bool                   `json:"createIncident"`
	GroupingConfiguration *GroupingConfiguration `json:"groupingConfiguration,omitempty"`
}

type MatchingMethod 

type MatchingMethod string
const (
	MatchingMethodAllEntities MatchingMethod = "AllEntities"
	MatchingMethodAnyAlert    MatchingMethod = "AnyAlert"
	MatchingMethodSelected    MatchingMethod = "Selected"
)

type MicrosoftSecurityIncidentCreationAlertRule 

type MicrosoftSecurityIncidentCreationAlertRule struct {
	Properties *MicrosoftSecurityIncidentCreationAlertRuleProperties `json:"properties,omitempty"`

	// Fields inherited from AlertRule
	Etag       *string                `json:"etag,omitempty"`
	Id         *string                `json:"id,omitempty"`
	Name       *string                `json:"name,omitempty"`
	SystemData *systemdata.SystemData `json:"systemData,omitempty"`
	Type       *string                `json:"type,omitempty"`
}

func (MicrosoftSecurityIncidentCreationAlertRule) MarshalJSON 

func (s MicrosoftSecurityIncidentCreationAlertRule) MarshalJSON() ([]byte, error)

type MicrosoftSecurityIncidentCreationAlertRuleProperties 

type MicrosoftSecurityIncidentCreationAlertRuleProperties struct {
	AlertRuleTemplateName     *string                      `json:"alertRuleTemplateName,omitempty"`
	Description               *string                      `json:"description,omitempty"`
	DisplayName               string                       `json:"displayName"`
	DisplayNamesExcludeFilter *[]string                    `json:"displayNamesExcludeFilter,omitempty"`
	DisplayNamesFilter        *[]string                    `json:"displayNamesFilter,omitempty"`
	Enabled                   bool                         `json:"enabled"`
	LastModifiedUtc           *string                      `json:"lastModifiedUtc,omitempty"`
	ProductFilter             MicrosoftSecurityProductName `json:"productFilter"`
	SeveritiesFilter          *[]AlertSeverity             `json:"severitiesFilter,omitempty"`
}

func (*MicrosoftSecurityIncidentCreationAlertRuleProperties) GetLastModifiedUtcAsTime 

func (o *MicrosoftSecurityIncidentCreationAlertRuleProperties) GetLastModifiedUtcAsTime() (*time.Time, error)

func (*MicrosoftSecurityIncidentCreationAlertRuleProperties) SetLastModifiedUtcAsTime 

func (o *MicrosoftSecurityIncidentCreationAlertRuleProperties) SetLastModifiedUtcAsTime(input time.Time)

type MicrosoftSecurityProductName 

type MicrosoftSecurityProductName string
const (
	MicrosoftSecurityProductNameAzureActiveDirectoryIdentityProtection MicrosoftSecurityProductName = "Azure Active Directory Identity Protection"
	MicrosoftSecurityProductNameAzureAdvancedThreatProtection          MicrosoftSecurityProductName = "Azure Advanced Threat Protection"
	MicrosoftSecurityProductNameAzureSecurityCenter                    MicrosoftSecurityProductName = "Azure Security Center"
	MicrosoftSecurityProductNameAzureSecurityCenterForIoT              MicrosoftSecurityProductName = "Azure Security Center for IoT"
	MicrosoftSecurityProductNameMicrosoftCloudAppSecurity              MicrosoftSecurityProductName = "Microsoft Cloud App Security"
)

type ScheduledAlertRule 

type ScheduledAlertRule struct {
	Properties *ScheduledAlertRuleProperties `json:"properties,omitempty"`

	// Fields inherited from AlertRule
	Etag       *string                `json:"etag,omitempty"`
	Id         *string                `json:"id,omitempty"`
	Name       *string                `json:"name,omitempty"`
	SystemData *systemdata.SystemData `json:"systemData,omitempty"`
	Type       *string                `json:"type,omitempty"`
}

func (ScheduledAlertRule) MarshalJSON 

func (s ScheduledAlertRule) MarshalJSON() ([]byte, error)

type ScheduledAlertRuleProperties 

type ScheduledAlertRuleProperties struct {
	AlertDetailsOverride  *AlertDetailsOverride  `json:"alertDetailsOverride,omitempty"`
	AlertRuleTemplateName *string                `json:"alertRuleTemplateName,omitempty"`
	CustomDetails         *map[string]string     `json:"customDetails,omitempty"`
	Description           *string                `json:"description,omitempty"`
	DisplayName           string                 `json:"displayName"`
	Enabled               bool                   `json:"enabled"`
	EntityMappings        *[]EntityMapping       `json:"entityMappings,omitempty"`
	EventGroupingSettings *EventGroupingSettings `json:"eventGroupingSettings,omitempty"`
	IncidentConfiguration *IncidentConfiguration `json:"incidentConfiguration,omitempty"`
	LastModifiedUtc       *string                `json:"lastModifiedUtc,omitempty"`
	Query                 string                 `json:"query"`
	QueryFrequency        string                 `json:"queryFrequency"`
	QueryPeriod           string                 `json:"queryPeriod"`
	Severity              AlertSeverity          `json:"severity"`
	SuppressionDuration   string                 `json:"suppressionDuration"`
	SuppressionEnabled    bool                   `json:"suppressionEnabled"`
	Tactics               *[]AttackTactic        `json:"tactics,omitempty"`
	Techniques            *[]string              `json:"techniques,omitempty"`
	TemplateVersion       *string                `json:"templateVersion,omitempty"`
	TriggerOperator       TriggerOperator        `json:"triggerOperator"`
	TriggerThreshold      int64                  `json:"triggerThreshold"`
}

func (*ScheduledAlertRuleProperties) GetLastModifiedUtcAsTime 

func (o *ScheduledAlertRuleProperties) GetLastModifiedUtcAsTime() (*time.Time, error)

func (*ScheduledAlertRuleProperties) SetLastModifiedUtcAsTime 

func (o *ScheduledAlertRuleProperties) SetLastModifiedUtcAsTime(input time.Time)

type TriggerOperator 

type TriggerOperator string
const (
	TriggerOperatorEqual       TriggerOperator = "Equal"
	TriggerOperatorGreaterThan TriggerOperator = "GreaterThan"
	TriggerOperatorLessThan    TriggerOperator = "LessThan"
	TriggerOperatorNotEqual    TriggerOperator = "NotEqual"
)

type WorkspaceId 

type WorkspaceId struct {
	SubscriptionId    string
	ResourceGroupName string
	WorkspaceName     string
}

WorkspaceId is a struct representing the Resource ID for a Workspace

func NewWorkspaceID 

func NewWorkspaceID(subscriptionId string, resourceGroupName string, workspaceName string) WorkspaceId

NewWorkspaceID returns a new WorkspaceId struct

func ParseWorkspaceID 

func ParseWorkspaceID(input string) (*WorkspaceId, error)

ParseWorkspaceID parses 'input' into a WorkspaceId

func ParseWorkspaceIDInsensitively 

func ParseWorkspaceIDInsensitively(input string) (*WorkspaceId, error)

ParseWorkspaceIDInsensitively parses 'input' case-insensitively into a WorkspaceId note: this method should only be used for API response data and not user input

func (WorkspaceId) ID 

func (id WorkspaceId) ID() string

ID returns the formatted Workspace ID

func (WorkspaceId) Segments 

func (id WorkspaceId) Segments() []resourceids.Segment

Segments returns a slice of Resource ID Segments which comprise this Workspace ID

func (WorkspaceId) String 

func (id WorkspaceId) String() string

String returns a human-readable description of this Workspace ID

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.