alertruletemplates

package
v0.20230503.1121530 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: May 3, 2023 License: MPL-2.0 Imports: 12 Imported by: 1

README

github.com/hashicorp/go-azure-sdk/resource-manager/securityinsights/2023-02-01/alertruletemplates Documentation

The alertruletemplates SDK allows for interaction with the Azure Resource Manager Service securityinsights (API Version 2023-02-01).

This readme covers example usages, but further information on using this SDK can be found in the project root.

Import Path

import "github.com/hashicorp/go-azure-sdk/resource-manager/securityinsights/2023-02-01/alertruletemplates"

Client Initialization

client := alertruletemplates.NewAlertRuleTemplatesClientWithBaseURI("https://management.azure.com")
client.Client.Authorizer = authorizer

Example Usage: AlertRuleTemplatesClient.AlertRuleTemplatesGet

ctx := context.TODO()
id := alertruletemplates.NewAlertRuleTemplateID("12345678-1234-9876-4563-123456789012", "example-resource-group", "workspaceValue", "alertRuleTemplateIdValue")

read, err := client.AlertRuleTemplatesGet(ctx, id)
if err != nil {
	// handle the error
}
if model := read.Model; model != nil {
	// do something with the model/response object
}

Example Usage: AlertRuleTemplatesClient.AlertRuleTemplatesList

ctx := context.TODO()
id := alertruletemplates.NewWorkspaceID("12345678-1234-9876-4563-123456789012", "example-resource-group", "workspaceValue")

// alternatively `client.AlertRuleTemplatesList(ctx, id)` can be used to do batched pagination
items, err := client.AlertRuleTemplatesListComplete(ctx, id)
if err != nil {
	// handle the error
}
for _, item := range items {
	// do something
}

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func PossibleValuesForAlertProperty

func PossibleValuesForAlertProperty() []string

func PossibleValuesForAlertRuleKind

func PossibleValuesForAlertRuleKind() []string

func PossibleValuesForAlertSeverity

func PossibleValuesForAlertSeverity() []string

func PossibleValuesForAttackTactic

func PossibleValuesForAttackTactic() []string

func PossibleValuesForEntityMappingType

func PossibleValuesForEntityMappingType() []string

func PossibleValuesForEventGroupingAggregationKind

func PossibleValuesForEventGroupingAggregationKind() []string

func PossibleValuesForMicrosoftSecurityProductName

func PossibleValuesForMicrosoftSecurityProductName() []string

func PossibleValuesForTemplateStatus

func PossibleValuesForTemplateStatus() []string

func PossibleValuesForTriggerOperator

func PossibleValuesForTriggerOperator() []string

func ValidateAlertRuleTemplateID

func ValidateAlertRuleTemplateID(input interface{}, key string) (warnings []string, errors []error)

ValidateAlertRuleTemplateID checks that 'input' can be parsed as a Alert Rule Template ID

func ValidateWorkspaceID

func ValidateWorkspaceID(input interface{}, key string) (warnings []string, errors []error)

ValidateWorkspaceID checks that 'input' can be parsed as a Workspace ID

Types

type AlertDetailsOverride

type AlertDetailsOverride struct {
	AlertDescriptionFormat  *string                 `json:"alertDescriptionFormat,omitempty"`
	AlertDisplayNameFormat  *string                 `json:"alertDisplayNameFormat,omitempty"`
	AlertDynamicProperties  *[]AlertPropertyMapping `json:"alertDynamicProperties,omitempty"`
	AlertSeverityColumnName *string                 `json:"alertSeverityColumnName,omitempty"`
	AlertTacticsColumnName  *string                 `json:"alertTacticsColumnName,omitempty"`
}

type AlertProperty

type AlertProperty string
const (
	AlertPropertyAlertLink            AlertProperty = "AlertLink"
	AlertPropertyConfidenceLevel      AlertProperty = "ConfidenceLevel"
	AlertPropertyConfidenceScore      AlertProperty = "ConfidenceScore"
	AlertPropertyExtendedLinks        AlertProperty = "ExtendedLinks"
	AlertPropertyProductComponentName AlertProperty = "ProductComponentName"
	AlertPropertyProductName          AlertProperty = "ProductName"
	AlertPropertyProviderName         AlertProperty = "ProviderName"
	AlertPropertyRemediationSteps     AlertProperty = "RemediationSteps"
	AlertPropertyTechniques           AlertProperty = "Techniques"
)

type AlertPropertyMapping

type AlertPropertyMapping struct {
	AlertProperty *AlertProperty `json:"alertProperty,omitempty"`
	Value         *string        `json:"value,omitempty"`
}

type AlertRuleKind

type AlertRuleKind string
const (
	AlertRuleKindFusion                            AlertRuleKind = "Fusion"
	AlertRuleKindMicrosoftSecurityIncidentCreation AlertRuleKind = "MicrosoftSecurityIncidentCreation"
	AlertRuleKindScheduled                         AlertRuleKind = "Scheduled"
)

type AlertRuleTemplate

type AlertRuleTemplate interface {
}

type AlertRuleTemplateDataSource

type AlertRuleTemplateDataSource struct {
	ConnectorId *string   `json:"connectorId,omitempty"`
	DataTypes   *[]string `json:"dataTypes,omitempty"`
}

type AlertRuleTemplateId

type AlertRuleTemplateId struct {
	SubscriptionId      string
	ResourceGroupName   string
	WorkspaceName       string
	AlertRuleTemplateId string
}

AlertRuleTemplateId is a struct representing the Resource ID for a Alert Rule Template

func NewAlertRuleTemplateID

func NewAlertRuleTemplateID(subscriptionId string, resourceGroupName string, workspaceName string, alertRuleTemplateId string) AlertRuleTemplateId

NewAlertRuleTemplateID returns a new AlertRuleTemplateId struct

func ParseAlertRuleTemplateID

func ParseAlertRuleTemplateID(input string) (*AlertRuleTemplateId, error)

ParseAlertRuleTemplateID parses 'input' into a AlertRuleTemplateId

func ParseAlertRuleTemplateIDInsensitively

func ParseAlertRuleTemplateIDInsensitively(input string) (*AlertRuleTemplateId, error)

ParseAlertRuleTemplateIDInsensitively parses 'input' case-insensitively into a AlertRuleTemplateId note: this method should only be used for API response data and not user input

func (AlertRuleTemplateId) ID

func (id AlertRuleTemplateId) ID() string

ID returns the formatted Alert Rule Template ID

func (AlertRuleTemplateId) Segments

func (id AlertRuleTemplateId) Segments() []resourceids.Segment

Segments returns a slice of Resource ID Segments which comprise this Alert Rule Template ID

func (AlertRuleTemplateId) String

func (id AlertRuleTemplateId) String() string

String returns a human-readable description of this Alert Rule Template ID

type AlertRuleTemplateOperationPredicate

type AlertRuleTemplateOperationPredicate struct {
}

func (AlertRuleTemplateOperationPredicate) Matches

type AlertRuleTemplatesClient

type AlertRuleTemplatesClient struct {
	Client autorest.Client
	// contains filtered or unexported fields
}

func NewAlertRuleTemplatesClientWithBaseURI

func NewAlertRuleTemplatesClientWithBaseURI(endpoint string) AlertRuleTemplatesClient

func (AlertRuleTemplatesClient) AlertRuleTemplatesGet

AlertRuleTemplatesGet ...

func (AlertRuleTemplatesClient) AlertRuleTemplatesList

AlertRuleTemplatesList ...

func (AlertRuleTemplatesClient) AlertRuleTemplatesListComplete

AlertRuleTemplatesListComplete retrieves all of the results into a single object

func (AlertRuleTemplatesClient) AlertRuleTemplatesListCompleteMatchingPredicate

func (c AlertRuleTemplatesClient) AlertRuleTemplatesListCompleteMatchingPredicate(ctx context.Context, id WorkspaceId, predicate AlertRuleTemplateOperationPredicate) (resp AlertRuleTemplatesListCompleteResult, err error)

AlertRuleTemplatesListCompleteMatchingPredicate retrieves all of the results and then applied the predicate

type AlertRuleTemplatesGetOperationResponse

type AlertRuleTemplatesGetOperationResponse struct {
	HttpResponse *http.Response
	Model        *AlertRuleTemplate
}

type AlertRuleTemplatesListCompleteResult

type AlertRuleTemplatesListCompleteResult struct {
	Items []AlertRuleTemplate
}

type AlertRuleTemplatesListOperationResponse

type AlertRuleTemplatesListOperationResponse struct {
	HttpResponse *http.Response
	Model        *[]AlertRuleTemplate
	// contains filtered or unexported fields
}

func (AlertRuleTemplatesListOperationResponse) HasMore

func (AlertRuleTemplatesListOperationResponse) LoadMore

type AlertSeverity

type AlertSeverity string
const (
	AlertSeverityHigh          AlertSeverity = "High"
	AlertSeverityInformational AlertSeverity = "Informational"
	AlertSeverityLow           AlertSeverity = "Low"
	AlertSeverityMedium        AlertSeverity = "Medium"
)

type AttackTactic

type AttackTactic string
const (
	AttackTacticCollection              AttackTactic = "Collection"
	AttackTacticCommandAndControl       AttackTactic = "CommandAndControl"
	AttackTacticCredentialAccess        AttackTactic = "CredentialAccess"
	AttackTacticDefenseEvasion          AttackTactic = "DefenseEvasion"
	AttackTacticDiscovery               AttackTactic = "Discovery"
	AttackTacticExecution               AttackTactic = "Execution"
	AttackTacticExfiltration            AttackTactic = "Exfiltration"
	AttackTacticImpact                  AttackTactic = "Impact"
	AttackTacticImpairProcessControl    AttackTactic = "ImpairProcessControl"
	AttackTacticInhibitResponseFunction AttackTactic = "InhibitResponseFunction"
	AttackTacticInitialAccess           AttackTactic = "InitialAccess"
	AttackTacticLateralMovement         AttackTactic = "LateralMovement"
	AttackTacticPersistence             AttackTactic = "Persistence"
	AttackTacticPreAttack               AttackTactic = "PreAttack"
	AttackTacticPrivilegeEscalation     AttackTactic = "PrivilegeEscalation"
	AttackTacticReconnaissance          AttackTactic = "Reconnaissance"
	AttackTacticResourceDevelopment     AttackTactic = "ResourceDevelopment"
)

type EntityMapping

type EntityMapping struct {
	EntityType    *EntityMappingType `json:"entityType,omitempty"`
	FieldMappings *[]FieldMapping    `json:"fieldMappings,omitempty"`
}

type EntityMappingType

type EntityMappingType string
const (
	EntityMappingTypeAccount          EntityMappingType = "Account"
	EntityMappingTypeAzureResource    EntityMappingType = "AzureResource"
	EntityMappingTypeCloudApplication EntityMappingType = "CloudApplication"
	EntityMappingTypeDNS              EntityMappingType = "DNS"
	EntityMappingTypeFile             EntityMappingType = "File"
	EntityMappingTypeFileHash         EntityMappingType = "FileHash"
	EntityMappingTypeHost             EntityMappingType = "Host"
	EntityMappingTypeIP               EntityMappingType = "IP"
	EntityMappingTypeMailCluster      EntityMappingType = "MailCluster"
	EntityMappingTypeMailMessage      EntityMappingType = "MailMessage"
	EntityMappingTypeMailbox          EntityMappingType = "Mailbox"
	EntityMappingTypeMalware          EntityMappingType = "Malware"
	EntityMappingTypeProcess          EntityMappingType = "Process"
	EntityMappingTypeRegistryKey      EntityMappingType = "RegistryKey"
	EntityMappingTypeRegistryValue    EntityMappingType = "RegistryValue"
	EntityMappingTypeSecurityGroup    EntityMappingType = "SecurityGroup"
	EntityMappingTypeSubmissionMail   EntityMappingType = "SubmissionMail"
	EntityMappingTypeURL              EntityMappingType = "URL"
)

type EventGroupingAggregationKind

type EventGroupingAggregationKind string
const (
	EventGroupingAggregationKindAlertPerResult EventGroupingAggregationKind = "AlertPerResult"
	EventGroupingAggregationKindSingleAlert    EventGroupingAggregationKind = "SingleAlert"
)

type EventGroupingSettings

type EventGroupingSettings struct {
	AggregationKind *EventGroupingAggregationKind `json:"aggregationKind,omitempty"`
}

type FieldMapping

type FieldMapping struct {
	ColumnName *string `json:"columnName,omitempty"`
	Identifier *string `json:"identifier,omitempty"`
}

type FusionAlertRuleTemplate

type FusionAlertRuleTemplate struct {
	Properties *FusionAlertRuleTemplateProperties `json:"properties,omitempty"`

	// Fields inherited from AlertRuleTemplate
	Id         *string                `json:"id,omitempty"`
	Name       *string                `json:"name,omitempty"`
	SystemData *systemdata.SystemData `json:"systemData,omitempty"`
	Type       *string                `json:"type,omitempty"`
}

func (FusionAlertRuleTemplate) MarshalJSON

func (s FusionAlertRuleTemplate) MarshalJSON() ([]byte, error)

type FusionAlertRuleTemplateProperties

type FusionAlertRuleTemplateProperties struct {
	AlertRulesCreatedByTemplateCount *int64                         `json:"alertRulesCreatedByTemplateCount,omitempty"`
	CreatedDateUTC                   *string                        `json:"createdDateUTC,omitempty"`
	Description                      *string                        `json:"description,omitempty"`
	DisplayName                      *string                        `json:"displayName,omitempty"`
	LastUpdatedDateUTC               *string                        `json:"lastUpdatedDateUTC,omitempty"`
	RequiredDataConnectors           *[]AlertRuleTemplateDataSource `json:"requiredDataConnectors,omitempty"`
	Severity                         *AlertSeverity                 `json:"severity,omitempty"`
	Status                           *TemplateStatus                `json:"status,omitempty"`
	Tactics                          *[]AttackTactic                `json:"tactics,omitempty"`
	Techniques                       *[]string                      `json:"techniques,omitempty"`
}

func (*FusionAlertRuleTemplateProperties) GetCreatedDateUTCAsTime

func (o *FusionAlertRuleTemplateProperties) GetCreatedDateUTCAsTime() (*time.Time, error)

func (*FusionAlertRuleTemplateProperties) GetLastUpdatedDateUTCAsTime

func (o *FusionAlertRuleTemplateProperties) GetLastUpdatedDateUTCAsTime() (*time.Time, error)

func (*FusionAlertRuleTemplateProperties) SetCreatedDateUTCAsTime

func (o *FusionAlertRuleTemplateProperties) SetCreatedDateUTCAsTime(input time.Time)

func (*FusionAlertRuleTemplateProperties) SetLastUpdatedDateUTCAsTime

func (o *FusionAlertRuleTemplateProperties) SetLastUpdatedDateUTCAsTime(input time.Time)

type MicrosoftSecurityIncidentCreationAlertRuleTemplate

type MicrosoftSecurityIncidentCreationAlertRuleTemplate struct {
	Properties *MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties `json:"properties,omitempty"`

	// Fields inherited from AlertRuleTemplate
	Id         *string                `json:"id,omitempty"`
	Name       *string                `json:"name,omitempty"`
	SystemData *systemdata.SystemData `json:"systemData,omitempty"`
	Type       *string                `json:"type,omitempty"`
}

func (MicrosoftSecurityIncidentCreationAlertRuleTemplate) MarshalJSON

type MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties

type MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties struct {
	AlertRulesCreatedByTemplateCount *int64                         `json:"alertRulesCreatedByTemplateCount,omitempty"`
	CreatedDateUTC                   *string                        `json:"createdDateUTC,omitempty"`
	Description                      *string                        `json:"description,omitempty"`
	DisplayName                      *string                        `json:"displayName,omitempty"`
	DisplayNamesExcludeFilter        *[]string                      `json:"displayNamesExcludeFilter,omitempty"`
	DisplayNamesFilter               *[]string                      `json:"displayNamesFilter,omitempty"`
	LastUpdatedDateUTC               *string                        `json:"lastUpdatedDateUTC,omitempty"`
	ProductFilter                    MicrosoftSecurityProductName   `json:"productFilter"`
	RequiredDataConnectors           *[]AlertRuleTemplateDataSource `json:"requiredDataConnectors,omitempty"`
	SeveritiesFilter                 *[]AlertSeverity               `json:"severitiesFilter,omitempty"`
	Status                           *TemplateStatus                `json:"status,omitempty"`
}

func (*MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties) GetCreatedDateUTCAsTime

func (*MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties) GetLastUpdatedDateUTCAsTime

func (o *MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties) GetLastUpdatedDateUTCAsTime() (*time.Time, error)

func (*MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties) SetCreatedDateUTCAsTime

func (*MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties) SetLastUpdatedDateUTCAsTime

func (o *MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties) SetLastUpdatedDateUTCAsTime(input time.Time)

type MicrosoftSecurityProductName

type MicrosoftSecurityProductName string
const (
	MicrosoftSecurityProductNameAzureActiveDirectoryIdentityProtection MicrosoftSecurityProductName = "Azure Active Directory Identity Protection"
	MicrosoftSecurityProductNameAzureAdvancedThreatProtection          MicrosoftSecurityProductName = "Azure Advanced Threat Protection"
	MicrosoftSecurityProductNameAzureSecurityCenter                    MicrosoftSecurityProductName = "Azure Security Center"
	MicrosoftSecurityProductNameAzureSecurityCenterForIoT              MicrosoftSecurityProductName = "Azure Security Center for IoT"
	MicrosoftSecurityProductNameMicrosoftCloudAppSecurity              MicrosoftSecurityProductName = "Microsoft Cloud App Security"
)

type ScheduledAlertRuleTemplate

type ScheduledAlertRuleTemplate struct {
	Properties *ScheduledAlertRuleTemplateProperties `json:"properties,omitempty"`

	// Fields inherited from AlertRuleTemplate
	Id         *string                `json:"id,omitempty"`
	Name       *string                `json:"name,omitempty"`
	SystemData *systemdata.SystemData `json:"systemData,omitempty"`
	Type       *string                `json:"type,omitempty"`
}

func (ScheduledAlertRuleTemplate) MarshalJSON

func (s ScheduledAlertRuleTemplate) MarshalJSON() ([]byte, error)

type ScheduledAlertRuleTemplateProperties

type ScheduledAlertRuleTemplateProperties struct {
	AlertDetailsOverride             *AlertDetailsOverride          `json:"alertDetailsOverride,omitempty"`
	AlertRulesCreatedByTemplateCount *int64                         `json:"alertRulesCreatedByTemplateCount,omitempty"`
	CreatedDateUTC                   *string                        `json:"createdDateUTC,omitempty"`
	CustomDetails                    *map[string]string             `json:"customDetails,omitempty"`
	Description                      *string                        `json:"description,omitempty"`
	DisplayName                      *string                        `json:"displayName,omitempty"`
	EntityMappings                   *[]EntityMapping               `json:"entityMappings,omitempty"`
	EventGroupingSettings            *EventGroupingSettings         `json:"eventGroupingSettings,omitempty"`
	LastUpdatedDateUTC               *string                        `json:"lastUpdatedDateUTC,omitempty"`
	Query                            *string                        `json:"query,omitempty"`
	QueryFrequency                   *string                        `json:"queryFrequency,omitempty"`
	QueryPeriod                      *string                        `json:"queryPeriod,omitempty"`
	RequiredDataConnectors           *[]AlertRuleTemplateDataSource `json:"requiredDataConnectors,omitempty"`
	Severity                         *AlertSeverity                 `json:"severity,omitempty"`
	Status                           *TemplateStatus                `json:"status,omitempty"`
	Tactics                          *[]AttackTactic                `json:"tactics,omitempty"`
	Techniques                       *[]string                      `json:"techniques,omitempty"`
	TriggerOperator                  *TriggerOperator               `json:"triggerOperator,omitempty"`
	TriggerThreshold                 *int64                         `json:"triggerThreshold,omitempty"`
	Version                          *string                        `json:"version,omitempty"`
}

func (*ScheduledAlertRuleTemplateProperties) GetCreatedDateUTCAsTime

func (o *ScheduledAlertRuleTemplateProperties) GetCreatedDateUTCAsTime() (*time.Time, error)

func (*ScheduledAlertRuleTemplateProperties) GetLastUpdatedDateUTCAsTime

func (o *ScheduledAlertRuleTemplateProperties) GetLastUpdatedDateUTCAsTime() (*time.Time, error)

func (*ScheduledAlertRuleTemplateProperties) SetCreatedDateUTCAsTime

func (o *ScheduledAlertRuleTemplateProperties) SetCreatedDateUTCAsTime(input time.Time)

func (*ScheduledAlertRuleTemplateProperties) SetLastUpdatedDateUTCAsTime

func (o *ScheduledAlertRuleTemplateProperties) SetLastUpdatedDateUTCAsTime(input time.Time)

type TemplateStatus

type TemplateStatus string
const (
	TemplateStatusAvailable    TemplateStatus = "Available"
	TemplateStatusInstalled    TemplateStatus = "Installed"
	TemplateStatusNotAvailable TemplateStatus = "NotAvailable"
)

type TriggerOperator

type TriggerOperator string
const (
	TriggerOperatorEqual       TriggerOperator = "Equal"
	TriggerOperatorGreaterThan TriggerOperator = "GreaterThan"
	TriggerOperatorLessThan    TriggerOperator = "LessThan"
	TriggerOperatorNotEqual    TriggerOperator = "NotEqual"
)

type WorkspaceId

type WorkspaceId struct {
	SubscriptionId    string
	ResourceGroupName string
	WorkspaceName     string
}

WorkspaceId is a struct representing the Resource ID for a Workspace

func NewWorkspaceID

func NewWorkspaceID(subscriptionId string, resourceGroupName string, workspaceName string) WorkspaceId

NewWorkspaceID returns a new WorkspaceId struct

func ParseWorkspaceID

func ParseWorkspaceID(input string) (*WorkspaceId, error)

ParseWorkspaceID parses 'input' into a WorkspaceId

func ParseWorkspaceIDInsensitively

func ParseWorkspaceIDInsensitively(input string) (*WorkspaceId, error)

ParseWorkspaceIDInsensitively parses 'input' case-insensitively into a WorkspaceId note: this method should only be used for API response data and not user input

func (WorkspaceId) ID

func (id WorkspaceId) ID() string

ID returns the formatted Workspace ID

func (WorkspaceId) Segments

func (id WorkspaceId) Segments() []resourceids.Segment

Segments returns a slice of Resource ID Segments which comprise this Workspace ID

func (WorkspaceId) String

func (id WorkspaceId) String() string

String returns a human-readable description of this Workspace ID

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL