@atensec/pulumi-thoth 0.1.3 → 0.1.5

package/governance/packAssignment.ts

@@ -48,10 +48,22 @@ export class PackAssignment extends pulumi.CustomResource {
      * Approval policy ID for pack application.
      */
     declare public readonly approvalPolicyId: pulumi.Output<string | undefined>;
+    /**
+     * Force at least STEP_UP when normalized risk meets/exceeds this threshold (0-1).
+     */
+    declare public readonly criticalThreshold: pulumi.Output<number | undefined>;
+    /**
+     * Deterministic boost for delegation risk signals (0-100).
+     */
+    declare public readonly delegationBoost: pulumi.Output<number | undefined>;
     /**
      * Environment: dev or prod.
      */
     declare public readonly environment: pulumi.Output<string | undefined>;
+    /**
+     * Deterministic boost for purpose/sensitivity mismatch signals (0-100).
+     */
+    declare public readonly mismatchBoost: pulumi.Output<number | undefined>;
     /**
      * Pack override JSON object.
      */
@@ -80,6 +92,10 @@ export class PackAssignment extends pulumi.CustomResource {
      * Tenant ID from provider configuration.
      */
     declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+    /**
+     * Ignore low-confidence purpose/delegation signals below this floor (0-1).
+     */
+    declare public readonly trustFloor: pulumi.Output<number | undefined>;
 
     /**
      * Create a PackAssignment resource with the given unique name, arguments, and options.
@@ -98,7 +114,10 @@ export class PackAssignment extends pulumi.CustomResource {
             resourceInputs["appliedAt"] = state?.appliedAt;
             resourceInputs["appliedBy"] = state?.appliedBy;
             resourceInputs["approvalPolicyId"] = state?.approvalPolicyId;
+            resourceInputs["criticalThreshold"] = state?.criticalThreshold;
+            resourceInputs["delegationBoost"] = state?.delegationBoost;
             resourceInputs["environment"] = state?.environment;
+            resourceInputs["mismatchBoost"] = state?.mismatchBoost;
             resourceInputs["overridesJson"] = state?.overridesJson;
             resourceInputs["packId"] = state?.packId;
             resourceInputs["regulation"] = state?.regulation;
@@ -106,6 +125,7 @@ export class PackAssignment extends pulumi.CustomResource {
             resourceInputs["ruleVersion"] = state?.ruleVersion;
             resourceInputs["status"] = state?.status;
             resourceInputs["tenantId"] = state?.tenantId;
+            resourceInputs["trustFloor"] = state?.trustFloor;
         } else {
             const args = argsOrState as PackAssignmentArgs | undefined;
             if (args?.agentId === undefined && !opts.urn) {
@@ -116,9 +136,13 @@ export class PackAssignment extends pulumi.CustomResource {
             }
             resourceInputs["agentId"] = args?.agentId;
             resourceInputs["approvalPolicyId"] = args?.approvalPolicyId;
+            resourceInputs["criticalThreshold"] = args?.criticalThreshold;
+            resourceInputs["delegationBoost"] = args?.delegationBoost;
             resourceInputs["environment"] = args?.environment;
+            resourceInputs["mismatchBoost"] = args?.mismatchBoost;
             resourceInputs["overridesJson"] = args?.overridesJson;
             resourceInputs["packId"] = args?.packId;
+            resourceInputs["trustFloor"] = args?.trustFloor;
             resourceInputs["appliedAt"] = undefined /*out*/;
             resourceInputs["appliedBy"] = undefined /*out*/;
             resourceInputs["regulation"] = undefined /*out*/;
@@ -152,10 +176,22 @@ export interface PackAssignmentState {
      * Approval policy ID for pack application.
      */
     approvalPolicyId?: pulumi.Input<string | undefined>;
+    /**
+     * Force at least STEP_UP when normalized risk meets/exceeds this threshold (0-1).
+     */
+    criticalThreshold?: pulumi.Input<number | undefined>;
+    /**
+     * Deterministic boost for delegation risk signals (0-100).
+     */
+    delegationBoost?: pulumi.Input<number | undefined>;
     /**
      * Environment: dev or prod.
      */
     environment?: pulumi.Input<string | undefined>;
+    /**
+     * Deterministic boost for purpose/sensitivity mismatch signals (0-100).
+     */
+    mismatchBoost?: pulumi.Input<number | undefined>;
     /**
      * Pack override JSON object.
      */
@@ -184,6 +220,10 @@ export interface PackAssignmentState {
      * Tenant ID from provider configuration.
      */
     tenantId?: pulumi.Input<string | undefined>;
+    /**
+     * Ignore low-confidence purpose/delegation signals below this floor (0-1).
+     */
+    trustFloor?: pulumi.Input<number | undefined>;
 }
 
 /**
@@ -198,10 +238,22 @@ export interface PackAssignmentArgs {
      * Approval policy ID for pack application.
      */
     approvalPolicyId?: pulumi.Input<string | undefined>;
+    /**
+     * Force at least STEP_UP when normalized risk meets/exceeds this threshold (0-1).
+     */
+    criticalThreshold?: pulumi.Input<number | undefined>;
+    /**
+     * Deterministic boost for delegation risk signals (0-100).
+     */
+    delegationBoost?: pulumi.Input<number | undefined>;
     /**
      * Environment: dev or prod.
      */
     environment?: pulumi.Input<string | undefined>;
+    /**
+     * Deterministic boost for purpose/sensitivity mismatch signals (0-100).
+     */
+    mismatchBoost?: pulumi.Input<number | undefined>;
     /**
      * Pack override JSON object.
      */
@@ -210,4 +262,8 @@ export interface PackAssignmentArgs {
      * Compliance pack identifier.
      */
     packId: pulumi.Input<string>;
+    /**
+     * Ignore low-confidence purpose/delegation signals below this floor (0-1).
+     */
+    trustFloor?: pulumi.Input<number | undefined>;
 }

package/governance/packAssignmentBulk.ts

@@ -48,6 +48,14 @@ export class PackAssignmentBulk extends pulumi.CustomResource {
      * Approval policy ID for pack application (defaults to 'default').
      */
     declare public readonly approvalPolicyId: pulumi.Output<string | undefined>;
+    /**
+     * Force at least STEP_UP when normalized risk meets/exceeds this threshold (0-1). Applied to selected pack_ids.
+     */
+    declare public readonly criticalThreshold: pulumi.Output<number | undefined>;
+    /**
+     * Deterministic boost for delegation risk signals (0-100). Applied to selected pack_ids.
+     */
+    declare public readonly delegationBoost: pulumi.Output<number | undefined>;
     /**
      * Endpoint IDs whose agents should receive the selected packs.
      */
@@ -68,6 +76,10 @@ export class PackAssignmentBulk extends pulumi.CustomResource {
      * Timestamp of the most recent apply operation.
      */
     declare public /*out*/ readonly lastAppliedAt: pulumi.Output<string>;
+    /**
+     * Deterministic boost for purpose/sensitivity mismatch signals (0-100). Applied to selected pack_ids.
+     */
+    declare public readonly mismatchBoost: pulumi.Output<number | undefined>;
     /**
      * JSON map keyed by<span pulumi-lang-nodejs=" packId " pulumi-lang-dotnet=" PackId " pulumi-lang-go=" packId " pulumi-lang-python=" pack_id " pulumi-lang-yaml=" packId " pulumi-lang-java=" packId "> packId </span>with per-pack overrides.
      */
@@ -96,6 +108,10 @@ export class PackAssignmentBulk extends pulumi.CustomResource {
      * Change this value to force a fresh apply run.
      */
     declare public readonly trigger: pulumi.Output<string | undefined>;
+    /**
+     * Ignore low-confidence purpose/delegation signals below this floor (0-1). Applied to selected pack_ids.
+     */
+    declare public readonly trustFloor: pulumi.Output<number | undefined>;
 
     /**
      * Create a PackAssignmentBulk resource with the given unique name, arguments, and options.
@@ -114,11 +130,14 @@ export class PackAssignmentBulk extends pulumi.CustomResource {
             resourceInputs["allAgents"] = state?.allAgents;
             resourceInputs["appliedCount"] = state?.appliedCount;
             resourceInputs["approvalPolicyId"] = state?.approvalPolicyId;
+            resourceInputs["criticalThreshold"] = state?.criticalThreshold;
+            resourceInputs["delegationBoost"] = state?.delegationBoost;
             resourceInputs["endpointIds"] = state?.endpointIds;
             resourceInputs["environment"] = state?.environment;
             resourceInputs["failedCount"] = state?.failedCount;
             resourceInputs["fleetIds"] = state?.fleetIds;
             resourceInputs["lastAppliedAt"] = state?.lastAppliedAt;
+            resourceInputs["mismatchBoost"] = state?.mismatchBoost;
             resourceInputs["overridesByPackJson"] = state?.overridesByPackJson;
             resourceInputs["packIds"] = state?.packIds;
             resourceInputs["resultsJson"] = state?.resultsJson;
@@ -126,6 +145,7 @@ export class PackAssignmentBulk extends pulumi.CustomResource {
             resourceInputs["tenantId"] = state?.tenantId;
             resourceInputs["totalOps"] = state?.totalOps;
             resourceInputs["trigger"] = state?.trigger;
+            resourceInputs["trustFloor"] = state?.trustFloor;
         } else {
             const args = argsOrState as PackAssignmentBulkArgs | undefined;
             if (args?.packIds === undefined && !opts.urn) {
@@ -134,12 +154,16 @@ export class PackAssignmentBulk extends pulumi.CustomResource {
             resourceInputs["agentIds"] = args?.agentIds;
             resourceInputs["allAgents"] = args?.allAgents;
             resourceInputs["approvalPolicyId"] = args?.approvalPolicyId;
+            resourceInputs["criticalThreshold"] = args?.criticalThreshold;
+            resourceInputs["delegationBoost"] = args?.delegationBoost;
             resourceInputs["endpointIds"] = args?.endpointIds;
             resourceInputs["environment"] = args?.environment;
             resourceInputs["fleetIds"] = args?.fleetIds;
+            resourceInputs["mismatchBoost"] = args?.mismatchBoost;
             resourceInputs["overridesByPackJson"] = args?.overridesByPackJson;
             resourceInputs["packIds"] = args?.packIds;
             resourceInputs["trigger"] = args?.trigger;
+            resourceInputs["trustFloor"] = args?.trustFloor;
             resourceInputs["appliedCount"] = undefined /*out*/;
             resourceInputs["failedCount"] = undefined /*out*/;
             resourceInputs["lastAppliedAt"] = undefined /*out*/;
@@ -173,6 +197,14 @@ export interface PackAssignmentBulkState {
      * Approval policy ID for pack application (defaults to 'default').
      */
     approvalPolicyId?: pulumi.Input<string | undefined>;
+    /**
+     * Force at least STEP_UP when normalized risk meets/exceeds this threshold (0-1). Applied to selected pack_ids.
+     */
+    criticalThreshold?: pulumi.Input<number | undefined>;
+    /**
+     * Deterministic boost for delegation risk signals (0-100). Applied to selected pack_ids.
+     */
+    delegationBoost?: pulumi.Input<number | undefined>;
     /**
      * Endpoint IDs whose agents should receive the selected packs.
      */
@@ -193,6 +225,10 @@ export interface PackAssignmentBulkState {
      * Timestamp of the most recent apply operation.
      */
     lastAppliedAt?: pulumi.Input<string | undefined>;
+    /**
+     * Deterministic boost for purpose/sensitivity mismatch signals (0-100). Applied to selected pack_ids.
+     */
+    mismatchBoost?: pulumi.Input<number | undefined>;
     /**
      * JSON map keyed by<span pulumi-lang-nodejs=" packId " pulumi-lang-dotnet=" PackId " pulumi-lang-go=" packId " pulumi-lang-python=" pack_id " pulumi-lang-yaml=" packId " pulumi-lang-java=" packId "> packId </span>with per-pack overrides.
      */
@@ -221,6 +257,10 @@ export interface PackAssignmentBulkState {
      * Change this value to force a fresh apply run.
      */
     trigger?: pulumi.Input<string | undefined>;
+    /**
+     * Ignore low-confidence purpose/delegation signals below this floor (0-1). Applied to selected pack_ids.
+     */
+    trustFloor?: pulumi.Input<number | undefined>;
 }
 
 /**
@@ -239,6 +279,14 @@ export interface PackAssignmentBulkArgs {
      * Approval policy ID for pack application (defaults to 'default').
      */
     approvalPolicyId?: pulumi.Input<string | undefined>;
+    /**
+     * Force at least STEP_UP when normalized risk meets/exceeds this threshold (0-1). Applied to selected pack_ids.
+     */
+    criticalThreshold?: pulumi.Input<number | undefined>;
+    /**
+     * Deterministic boost for delegation risk signals (0-100). Applied to selected pack_ids.
+     */
+    delegationBoost?: pulumi.Input<number | undefined>;
     /**
      * Endpoint IDs whose agents should receive the selected packs.
      */
@@ -251,6 +299,10 @@ export interface PackAssignmentBulkArgs {
      * Fleet IDs whose agents should receive the selected packs.
      */
     fleetIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Deterministic boost for purpose/sensitivity mismatch signals (0-100). Applied to selected pack_ids.
+     */
+    mismatchBoost?: pulumi.Input<number | undefined>;
     /**
      * JSON map keyed by<span pulumi-lang-nodejs=" packId " pulumi-lang-dotnet=" PackId " pulumi-lang-go=" packId " pulumi-lang-python=" pack_id " pulumi-lang-yaml=" packId " pulumi-lang-java=" packId "> packId </span>with per-pack overrides.
      */
@@ -263,4 +315,8 @@ export interface PackAssignmentBulkArgs {
      * Change this value to force a fresh apply run.
      */
     trigger?: pulumi.Input<string | undefined>;
+    /**
+     * Ignore low-confidence purpose/delegation signals below this floor (0-1). Applied to selected pack_ids.
+     */
+    trustFloor?: pulumi.Input<number | undefined>;
 }

package/governance/pamSettings.ts

@@ -0,0 +1,187 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class PamSettings extends pulumi.CustomResource {
+    /**
+     * Get an existing PamSettings resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: PamSettingsState, opts?: pulumi.CustomResourceOptions): PamSettings {
+        return new PamSettings(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:governance/pamSettings:PamSettings';
+
+    /**
+     * Returns true if the given object is an instance of PamSettings.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is PamSettings {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === PamSettings.__pulumiType;
+    }
+
+    /**
+     * Shared secret for PAM callback validation.
+     */
+    declare public readonly pamCallbackSecret: pulumi.Output<string | undefined>;
+    /**
+     * Enable PAM step-up callback integration.
+     */
+    declare public readonly pamEnabled: pulumi.Output<boolean | undefined>;
+    /**
+     * PAM provider slug.
+     */
+    declare public readonly pamProvider: pulumi.Output<string | undefined>;
+    /**
+     * Outbound PAM auth token.
+     */
+    declare public readonly pamRequestAuthToken: pulumi.Output<string | undefined>;
+    /**
+     * Outbound PAM request secret.
+     */
+    declare public readonly pamRequestSecret: pulumi.Output<string | undefined>;
+    /**
+     * Outbound PAM request timeout in seconds.
+     */
+    declare public readonly pamRequestTimeoutSeconds: pulumi.Output<number | undefined>;
+    /**
+     * Outbound PAM request URL.
+     */
+    declare public readonly pamRequestUrl: pulumi.Output<string | undefined>;
+    /**
+     * Tenant ID resolved from provider configuration.
+     */
+    declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+    /**
+     * Last update timestamp returned by GovAPI.
+     */
+    declare public /*out*/ readonly updatedAt: pulumi.Output<string>;
+
+    /**
+     * Create a PamSettings resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args?: PamSettingsArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: PamSettingsArgs | PamSettingsState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as PamSettingsState | undefined;
+            resourceInputs["pamCallbackSecret"] = state?.pamCallbackSecret;
+            resourceInputs["pamEnabled"] = state?.pamEnabled;
+            resourceInputs["pamProvider"] = state?.pamProvider;
+            resourceInputs["pamRequestAuthToken"] = state?.pamRequestAuthToken;
+            resourceInputs["pamRequestSecret"] = state?.pamRequestSecret;
+            resourceInputs["pamRequestTimeoutSeconds"] = state?.pamRequestTimeoutSeconds;
+            resourceInputs["pamRequestUrl"] = state?.pamRequestUrl;
+            resourceInputs["tenantId"] = state?.tenantId;
+            resourceInputs["updatedAt"] = state?.updatedAt;
+        } else {
+            const args = argsOrState as PamSettingsArgs | undefined;
+            resourceInputs["pamCallbackSecret"] = args?.pamCallbackSecret ? pulumi.secret(args.pamCallbackSecret) : undefined;
+            resourceInputs["pamEnabled"] = args?.pamEnabled;
+            resourceInputs["pamProvider"] = args?.pamProvider;
+            resourceInputs["pamRequestAuthToken"] = args?.pamRequestAuthToken ? pulumi.secret(args.pamRequestAuthToken) : undefined;
+            resourceInputs["pamRequestSecret"] = args?.pamRequestSecret ? pulumi.secret(args.pamRequestSecret) : undefined;
+            resourceInputs["pamRequestTimeoutSeconds"] = args?.pamRequestTimeoutSeconds;
+            resourceInputs["pamRequestUrl"] = args?.pamRequestUrl;
+            resourceInputs["tenantId"] = undefined /*out*/;
+            resourceInputs["updatedAt"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        const secretOpts = { additionalSecretOutputs: ["pamCallbackSecret", "pamRequestAuthToken", "pamRequestSecret"] };
+        opts = pulumi.mergeOptions(opts, secretOpts);
+        super(PamSettings.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering PamSettings resources.
+ */
+export interface PamSettingsState {
+    /**
+     * Shared secret for PAM callback validation.
+     */
+    pamCallbackSecret?: pulumi.Input<string | undefined>;
+    /**
+     * Enable PAM step-up callback integration.
+     */
+    pamEnabled?: pulumi.Input<boolean | undefined>;
+    /**
+     * PAM provider slug.
+     */
+    pamProvider?: pulumi.Input<string | undefined>;
+    /**
+     * Outbound PAM auth token.
+     */
+    pamRequestAuthToken?: pulumi.Input<string | undefined>;
+    /**
+     * Outbound PAM request secret.
+     */
+    pamRequestSecret?: pulumi.Input<string | undefined>;
+    /**
+     * Outbound PAM request timeout in seconds.
+     */
+    pamRequestTimeoutSeconds?: pulumi.Input<number | undefined>;
+    /**
+     * Outbound PAM request URL.
+     */
+    pamRequestUrl?: pulumi.Input<string | undefined>;
+    /**
+     * Tenant ID resolved from provider configuration.
+     */
+    tenantId?: pulumi.Input<string | undefined>;
+    /**
+     * Last update timestamp returned by GovAPI.
+     */
+    updatedAt?: pulumi.Input<string | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a PamSettings resource.
+ */
+export interface PamSettingsArgs {
+    /**
+     * Shared secret for PAM callback validation.
+     */
+    pamCallbackSecret?: pulumi.Input<string | undefined>;
+    /**
+     * Enable PAM step-up callback integration.
+     */
+    pamEnabled?: pulumi.Input<boolean | undefined>;
+    /**
+     * PAM provider slug.
+     */
+    pamProvider?: pulumi.Input<string | undefined>;
+    /**
+     * Outbound PAM auth token.
+     */
+    pamRequestAuthToken?: pulumi.Input<string | undefined>;
+    /**
+     * Outbound PAM request secret.
+     */
+    pamRequestSecret?: pulumi.Input<string | undefined>;
+    /**
+     * Outbound PAM request timeout in seconds.
+     */
+    pamRequestTimeoutSeconds?: pulumi.Input<number | undefined>;
+    /**
+     * Outbound PAM request URL.
+     */
+    pamRequestUrl?: pulumi.Input<string | undefined>;
+}

package/governance/siemSettings.ts

@@ -0,0 +1,159 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class SiemSettings extends pulumi.CustomResource {
+    /**
+     * Get an existing SiemSettings resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: SiemSettingsState, opts?: pulumi.CustomResourceOptions): SiemSettings {
+        return new SiemSettings(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:governance/siemSettings:SiemSettings';
+
+    /**
+     * Returns true if the given object is an instance of SiemSettings.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is SiemSettings {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === SiemSettings.__pulumiType;
+    }
+
+    /**
+     * SIEM provider slug.
+     */
+    declare public readonly siemProvider: pulumi.Output<string | undefined>;
+    /**
+     * Enable SIEM webhook delivery.
+     */
+    declare public readonly siemWebhookEnabled: pulumi.Output<boolean | undefined>;
+    /**
+     * SIEM webhook provider slug.
+     */
+    declare public readonly siemWebhookProvider: pulumi.Output<string | undefined>;
+    /**
+     * SIEM webhook signing secret.
+     */
+    declare public readonly siemWebhookSecret: pulumi.Output<string | undefined>;
+    /**
+     * SIEM webhook URL.
+     */
+    declare public readonly siemWebhookUrl: pulumi.Output<string | undefined>;
+    /**
+     * Tenant ID resolved from provider configuration.
+     */
+    declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+    /**
+     * Last update timestamp returned by GovAPI.
+     */
+    declare public /*out*/ readonly updatedAt: pulumi.Output<string>;
+
+    /**
+     * Create a SiemSettings resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args?: SiemSettingsArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: SiemSettingsArgs | SiemSettingsState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as SiemSettingsState | undefined;
+            resourceInputs["siemProvider"] = state?.siemProvider;
+            resourceInputs["siemWebhookEnabled"] = state?.siemWebhookEnabled;
+            resourceInputs["siemWebhookProvider"] = state?.siemWebhookProvider;
+            resourceInputs["siemWebhookSecret"] = state?.siemWebhookSecret;
+            resourceInputs["siemWebhookUrl"] = state?.siemWebhookUrl;
+            resourceInputs["tenantId"] = state?.tenantId;
+            resourceInputs["updatedAt"] = state?.updatedAt;
+        } else {
+            const args = argsOrState as SiemSettingsArgs | undefined;
+            resourceInputs["siemProvider"] = args?.siemProvider;
+            resourceInputs["siemWebhookEnabled"] = args?.siemWebhookEnabled;
+            resourceInputs["siemWebhookProvider"] = args?.siemWebhookProvider;
+            resourceInputs["siemWebhookSecret"] = args?.siemWebhookSecret ? pulumi.secret(args.siemWebhookSecret) : undefined;
+            resourceInputs["siemWebhookUrl"] = args?.siemWebhookUrl;
+            resourceInputs["tenantId"] = undefined /*out*/;
+            resourceInputs["updatedAt"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        const secretOpts = { additionalSecretOutputs: ["siemWebhookSecret"] };
+        opts = pulumi.mergeOptions(opts, secretOpts);
+        super(SiemSettings.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering SiemSettings resources.
+ */
+export interface SiemSettingsState {
+    /**
+     * SIEM provider slug.
+     */
+    siemProvider?: pulumi.Input<string | undefined>;
+    /**
+     * Enable SIEM webhook delivery.
+     */
+    siemWebhookEnabled?: pulumi.Input<boolean | undefined>;
+    /**
+     * SIEM webhook provider slug.
+     */
+    siemWebhookProvider?: pulumi.Input<string | undefined>;
+    /**
+     * SIEM webhook signing secret.
+     */
+    siemWebhookSecret?: pulumi.Input<string | undefined>;
+    /**
+     * SIEM webhook URL.
+     */
+    siemWebhookUrl?: pulumi.Input<string | undefined>;
+    /**
+     * Tenant ID resolved from provider configuration.
+     */
+    tenantId?: pulumi.Input<string | undefined>;
+    /**
+     * Last update timestamp returned by GovAPI.
+     */
+    updatedAt?: pulumi.Input<string | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a SiemSettings resource.
+ */
+export interface SiemSettingsArgs {
+    /**
+     * SIEM provider slug.
+     */
+    siemProvider?: pulumi.Input<string | undefined>;
+    /**
+     * Enable SIEM webhook delivery.
+     */
+    siemWebhookEnabled?: pulumi.Input<boolean | undefined>;
+    /**
+     * SIEM webhook provider slug.
+     */
+    siemWebhookProvider?: pulumi.Input<string | undefined>;
+    /**
+     * SIEM webhook signing secret.
+     */
+    siemWebhookSecret?: pulumi.Input<string | undefined>;
+    /**
+     * SIEM webhook URL.
+     */
+    siemWebhookUrl?: pulumi.Input<string | undefined>;
+}