@pulumi/azure-native 2.1.1 → 2.1.2-alpha.1690874037

package/types/enums/securityinsights/v20230701preview/index.d.ts

@@ -0,0 +1,1229 @@
+export declare const ActionType: {
+    /**
+     * Modify an object's properties
+     */
+    readonly ModifyProperties: "ModifyProperties";
+    /**
+     * Run a playbook on an object
+     */
+    readonly RunPlaybook: "RunPlaybook";
+    /**
+     * Add a task to an incident object
+     */
+    readonly AddIncidentTask: "AddIncidentTask";
+};
+/**
+ * The type of the automation rule action.
+ */
+export type ActionType = (typeof ActionType)[keyof typeof ActionType];
+export declare const AlertDetail: {
+    /**
+     * Alert display name
+     */
+    readonly DisplayName: "DisplayName";
+    /**
+     * Alert severity
+     */
+    readonly Severity: "Severity";
+};
+/**
+ * Alert detail
+ */
+export type AlertDetail = (typeof AlertDetail)[keyof typeof AlertDetail];
+export declare const AlertProperty: {
+    /**
+     * Alert's link
+     */
+    readonly AlertLink: "AlertLink";
+    /**
+     * Confidence level property
+     */
+    readonly ConfidenceLevel: "ConfidenceLevel";
+    /**
+     * Confidence score
+     */
+    readonly ConfidenceScore: "ConfidenceScore";
+    /**
+     * Extended links to the alert
+     */
+    readonly ExtendedLinks: "ExtendedLinks";
+    /**
+     * Product name alert property
+     */
+    readonly ProductName: "ProductName";
+    /**
+     * Provider name alert property
+     */
+    readonly ProviderName: "ProviderName";
+    /**
+     * Product component name alert property
+     */
+    readonly ProductComponentName: "ProductComponentName";
+    /**
+     * Remediation steps alert property
+     */
+    readonly RemediationSteps: "RemediationSteps";
+    /**
+     * Techniques alert property
+     */
+    readonly Techniques: "Techniques";
+};
+/**
+ * The V3 alert property
+ */
+export type AlertProperty = (typeof AlertProperty)[keyof typeof AlertProperty];
+export declare const AlertRuleKind: {
+    readonly Scheduled: "Scheduled";
+    readonly MicrosoftSecurityIncidentCreation: "MicrosoftSecurityIncidentCreation";
+    readonly Fusion: "Fusion";
+    readonly MLBehaviorAnalytics: "MLBehaviorAnalytics";
+    readonly ThreatIntelligence: "ThreatIntelligence";
+    readonly NRT: "NRT";
+};
+/**
+ * The kind of the alert rule
+ */
+export type AlertRuleKind = (typeof AlertRuleKind)[keyof typeof AlertRuleKind];
+export declare const AlertSeverity: {
+    /**
+     * High severity
+     */
+    readonly High: "High";
+    /**
+     * Medium severity
+     */
+    readonly Medium: "Medium";
+    /**
+     * Low severity
+     */
+    readonly Low: "Low";
+    /**
+     * Informational severity
+     */
+    readonly Informational: "Informational";
+};
+/**
+ * The severity for alerts created by this alert rule.
+ */
+export type AlertSeverity = (typeof AlertSeverity)[keyof typeof AlertSeverity];
+export declare const AttackTactic: {
+    readonly Reconnaissance: "Reconnaissance";
+    readonly ResourceDevelopment: "ResourceDevelopment";
+    readonly InitialAccess: "InitialAccess";
+    readonly Execution: "Execution";
+    readonly Persistence: "Persistence";
+    readonly PrivilegeEscalation: "PrivilegeEscalation";
+    readonly DefenseEvasion: "DefenseEvasion";
+    readonly CredentialAccess: "CredentialAccess";
+    readonly Discovery: "Discovery";
+    readonly LateralMovement: "LateralMovement";
+    readonly Collection: "Collection";
+    readonly Exfiltration: "Exfiltration";
+    readonly CommandAndControl: "CommandAndControl";
+    readonly Impact: "Impact";
+    readonly PreAttack: "PreAttack";
+    readonly ImpairProcessControl: "ImpairProcessControl";
+    readonly InhibitResponseFunction: "InhibitResponseFunction";
+};
+/**
+ * The severity for alerts created by this alert rule.
+ */
+export type AttackTactic = (typeof AttackTactic)[keyof typeof AttackTactic];
+export declare const AutomationRuleBooleanConditionSupportedOperator: {
+    /**
+     * Evaluates as true if all the item conditions are evaluated as true
+     */
+    readonly And: "And";
+    /**
+     * Evaluates as true if at least one of the item conditions are evaluated as true
+     */
+    readonly Or: "Or";
+};
+export type AutomationRuleBooleanConditionSupportedOperator = (typeof AutomationRuleBooleanConditionSupportedOperator)[keyof typeof AutomationRuleBooleanConditionSupportedOperator];
+export declare const AutomationRulePropertyArrayChangedConditionSupportedArrayType: {
+    /**
+     * Evaluate the condition on the alerts
+     */
+    readonly Alerts: "Alerts";
+    /**
+     * Evaluate the condition on the labels
+     */
+    readonly Labels: "Labels";
+    /**
+     * Evaluate the condition on the tactics
+     */
+    readonly Tactics: "Tactics";
+    /**
+     * Evaluate the condition on the comments
+     */
+    readonly Comments: "Comments";
+};
+export type AutomationRulePropertyArrayChangedConditionSupportedArrayType = (typeof AutomationRulePropertyArrayChangedConditionSupportedArrayType)[keyof typeof AutomationRulePropertyArrayChangedConditionSupportedArrayType];
+export declare const AutomationRulePropertyArrayChangedConditionSupportedChangeType: {
+    /**
+     * Evaluate the condition on items added to the array
+     */
+    readonly Added: "Added";
+};
+export type AutomationRulePropertyArrayChangedConditionSupportedChangeType = (typeof AutomationRulePropertyArrayChangedConditionSupportedChangeType)[keyof typeof AutomationRulePropertyArrayChangedConditionSupportedChangeType];
+export declare const AutomationRulePropertyArrayConditionSupportedArrayConditionType: {
+    /**
+     * Evaluate the condition as true if any item fulfills it
+     */
+    readonly AnyItem: "AnyItem";
+};
+export type AutomationRulePropertyArrayConditionSupportedArrayConditionType = (typeof AutomationRulePropertyArrayConditionSupportedArrayConditionType)[keyof typeof AutomationRulePropertyArrayConditionSupportedArrayConditionType];
+export declare const AutomationRulePropertyArrayConditionSupportedArrayType: {
+    /**
+     * Evaluate the condition on the custom detail keys
+     */
+    readonly CustomDetails: "CustomDetails";
+    /**
+     * Evaluate the condition on a custom detail's values
+     */
+    readonly CustomDetailValues: "CustomDetailValues";
+};
+export type AutomationRulePropertyArrayConditionSupportedArrayType = (typeof AutomationRulePropertyArrayConditionSupportedArrayType)[keyof typeof AutomationRulePropertyArrayConditionSupportedArrayType];
+export declare const AutomationRulePropertyChangedConditionSupportedChangedType: {
+    /**
+     * Evaluate the condition on the previous value of the property
+     */
+    readonly ChangedFrom: "ChangedFrom";
+    /**
+     * Evaluate the condition on the updated value of the property
+     */
+    readonly ChangedTo: "ChangedTo";
+};
+export type AutomationRulePropertyChangedConditionSupportedChangedType = (typeof AutomationRulePropertyChangedConditionSupportedChangedType)[keyof typeof AutomationRulePropertyChangedConditionSupportedChangedType];
+export declare const AutomationRulePropertyChangedConditionSupportedPropertyType: {
+    /**
+     * Evaluate the condition on the incident severity
+     */
+    readonly IncidentSeverity: "IncidentSeverity";
+    /**
+     * Evaluate the condition on the incident status
+     */
+    readonly IncidentStatus: "IncidentStatus";
+    /**
+     * Evaluate the condition on the incident owner
+     */
+    readonly IncidentOwner: "IncidentOwner";
+};
+export type AutomationRulePropertyChangedConditionSupportedPropertyType = (typeof AutomationRulePropertyChangedConditionSupportedPropertyType)[keyof typeof AutomationRulePropertyChangedConditionSupportedPropertyType];
+export declare const AutomationRulePropertyConditionSupportedOperator: {
+    /**
+     * Evaluates if the property equals at least one of the condition values
+     */
+    readonly Equals: "Equals";
+    /**
+     * Evaluates if the property does not equal any of the condition values
+     */
+    readonly NotEquals: "NotEquals";
+    /**
+     * Evaluates if the property contains at least one of the condition values
+     */
+    readonly Contains: "Contains";
+    /**
+     * Evaluates if the property does not contain any of the condition values
+     */
+    readonly NotContains: "NotContains";
+    /**
+     * Evaluates if the property starts with any of the condition values
+     */
+    readonly StartsWith: "StartsWith";
+    /**
+     * Evaluates if the property does not start with any of the condition values
+     */
+    readonly NotStartsWith: "NotStartsWith";
+    /**
+     * Evaluates if the property ends with any of the condition values
+     */
+    readonly EndsWith: "EndsWith";
+    /**
+     * Evaluates if the property does not end with any of the condition values
+     */
+    readonly NotEndsWith: "NotEndsWith";
+};
+export type AutomationRulePropertyConditionSupportedOperator = (typeof AutomationRulePropertyConditionSupportedOperator)[keyof typeof AutomationRulePropertyConditionSupportedOperator];
+export declare const AutomationRulePropertyConditionSupportedProperty: {
+    /**
+     * The title of the incident
+     */
+    readonly IncidentTitle: "IncidentTitle";
+    /**
+     * The description of the incident
+     */
+    readonly IncidentDescription: "IncidentDescription";
+    /**
+     * The severity of the incident
+     */
+    readonly IncidentSeverity: "IncidentSeverity";
+    /**
+     * The status of the incident
+     */
+    readonly IncidentStatus: "IncidentStatus";
+    /**
+     * The related Analytic rule ids of the incident
+     */
+    readonly IncidentRelatedAnalyticRuleIds: "IncidentRelatedAnalyticRuleIds";
+    /**
+     * The tactics of the incident
+     */
+    readonly IncidentTactics: "IncidentTactics";
+    /**
+     * The labels of the incident
+     */
+    readonly IncidentLabel: "IncidentLabel";
+    /**
+     * The provider name of the incident
+     */
+    readonly IncidentProviderName: "IncidentProviderName";
+    /**
+     * The update source of the incident
+     */
+    readonly IncidentUpdatedBySource: "IncidentUpdatedBySource";
+    /**
+     * The incident custom detail key
+     */
+    readonly IncidentCustomDetailsKey: "IncidentCustomDetailsKey";
+    /**
+     * The incident custom detail value
+     */
+    readonly IncidentCustomDetailsValue: "IncidentCustomDetailsValue";
+    /**
+     * The account Azure Active Directory tenant id
+     */
+    readonly AccountAadTenantId: "AccountAadTenantId";
+    /**
+     * The account Azure Active Directory user id
+     */
+    readonly AccountAadUserId: "AccountAadUserId";
+    /**
+     * The account name
+     */
+    readonly AccountName: "AccountName";
+    /**
+     * The account NetBIOS domain name
+     */
+    readonly AccountNTDomain: "AccountNTDomain";
+    /**
+     * The account Azure Active Directory Passport User ID
+     */
+    readonly AccountPUID: "AccountPUID";
+    /**
+     * The account security identifier
+     */
+    readonly AccountSid: "AccountSid";
+    /**
+     * The account unique identifier
+     */
+    readonly AccountObjectGuid: "AccountObjectGuid";
+    /**
+     * The account user principal name suffix
+     */
+    readonly AccountUPNSuffix: "AccountUPNSuffix";
+    /**
+     * The name of the product of the alert
+     */
+    readonly AlertProductNames: "AlertProductNames";
+    /**
+     * The analytic rule ids of the alert
+     */
+    readonly AlertAnalyticRuleIds: "AlertAnalyticRuleIds";
+    /**
+     * The Azure resource id
+     */
+    readonly AzureResourceResourceId: "AzureResourceResourceId";
+    /**
+     * The Azure resource subscription id
+     */
+    readonly AzureResourceSubscriptionId: "AzureResourceSubscriptionId";
+    /**
+     * The cloud application identifier
+     */
+    readonly CloudApplicationAppId: "CloudApplicationAppId";
+    /**
+     * The cloud application name
+     */
+    readonly CloudApplicationAppName: "CloudApplicationAppName";
+    /**
+     * The dns record domain name
+     */
+    readonly DNSDomainName: "DNSDomainName";
+    /**
+     * The file directory full path
+     */
+    readonly FileDirectory: "FileDirectory";
+    /**
+     * The file name without path
+     */
+    readonly FileName: "FileName";
+    /**
+     * The file hash value
+     */
+    readonly FileHashValue: "FileHashValue";
+    /**
+     * The host Azure resource id
+     */
+    readonly HostAzureID: "HostAzureID";
+    /**
+     * The host name without domain
+     */
+    readonly HostName: "HostName";
+    /**
+     * The host NetBIOS name
+     */
+    readonly HostNetBiosName: "HostNetBiosName";
+    /**
+     * The host NT domain
+     */
+    readonly HostNTDomain: "HostNTDomain";
+    /**
+     * The host operating system
+     */
+    readonly HostOSVersion: "HostOSVersion";
+    /**
+     * "The IoT device id
+     */
+    readonly IoTDeviceId: "IoTDeviceId";
+    /**
+     * The IoT device name
+     */
+    readonly IoTDeviceName: "IoTDeviceName";
+    /**
+     * The IoT device type
+     */
+    readonly IoTDeviceType: "IoTDeviceType";
+    /**
+     * The IoT device vendor
+     */
+    readonly IoTDeviceVendor: "IoTDeviceVendor";
+    /**
+     * The IoT device model
+     */
+    readonly IoTDeviceModel: "IoTDeviceModel";
+    /**
+     * The IoT device operating system
+     */
+    readonly IoTDeviceOperatingSystem: "IoTDeviceOperatingSystem";
+    /**
+     * The IP address
+     */
+    readonly IPAddress: "IPAddress";
+    /**
+     * The mailbox display name
+     */
+    readonly MailboxDisplayName: "MailboxDisplayName";
+    /**
+     * The mailbox primary address
+     */
+    readonly MailboxPrimaryAddress: "MailboxPrimaryAddress";
+    /**
+     * The mailbox user principal name
+     */
+    readonly MailboxUPN: "MailboxUPN";
+    /**
+     * The mail message delivery action
+     */
+    readonly MailMessageDeliveryAction: "MailMessageDeliveryAction";
+    /**
+     * The mail message delivery location
+     */
+    readonly MailMessageDeliveryLocation: "MailMessageDeliveryLocation";
+    /**
+     * The mail message recipient
+     */
+    readonly MailMessageRecipient: "MailMessageRecipient";
+    /**
+     * The mail message sender IP address
+     */
+    readonly MailMessageSenderIP: "MailMessageSenderIP";
+    /**
+     * The mail message subject
+     */
+    readonly MailMessageSubject: "MailMessageSubject";
+    /**
+     * The mail message P1 sender
+     */
+    readonly MailMessageP1Sender: "MailMessageP1Sender";
+    /**
+     * The mail message P2 sender
+     */
+    readonly MailMessageP2Sender: "MailMessageP2Sender";
+    /**
+     * The malware category
+     */
+    readonly MalwareCategory: "MalwareCategory";
+    /**
+     * The malware name
+     */
+    readonly MalwareName: "MalwareName";
+    /**
+     * The process execution command line
+     */
+    readonly ProcessCommandLine: "ProcessCommandLine";
+    /**
+     * The process id
+     */
+    readonly ProcessId: "ProcessId";
+    /**
+     * The registry key path
+     */
+    readonly RegistryKey: "RegistryKey";
+    /**
+     * The registry key value in string formatted representation
+     */
+    readonly RegistryValueData: "RegistryValueData";
+    /**
+     * The url
+     */
+    readonly Url: "Url";
+};
+/**
+ * The property to evaluate in an automation rule property condition.
+ */
+export type AutomationRulePropertyConditionSupportedProperty = (typeof AutomationRulePropertyConditionSupportedProperty)[keyof typeof AutomationRulePropertyConditionSupportedProperty];
+export declare const ConditionType: {
+    /**
+     * Evaluate an object property value
+     */
+    readonly Property: "Property";
+    /**
+     * Evaluate an object array property value
+     */
+    readonly PropertyArray: "PropertyArray";
+    /**
+     * Evaluate an object property changed value
+     */
+    readonly PropertyChanged: "PropertyChanged";
+    /**
+     * Evaluate an object array property changed value
+     */
+    readonly PropertyArrayChanged: "PropertyArrayChanged";
+    /**
+     * Apply a boolean operator (e.g AND, OR) to conditions
+     */
+    readonly Boolean: "Boolean";
+};
+export type ConditionType = (typeof ConditionType)[keyof typeof ConditionType];
+export declare const ConnectivityType: {
+    readonly IsConnectedQuery: "IsConnectedQuery";
+};
+/**
+ * type of connectivity
+ */
+export type ConnectivityType = (typeof ConnectivityType)[keyof typeof ConnectivityType];
+export declare const CustomEntityQueryKind: {
+    readonly Activity: "Activity";
+};
+/**
+ * the entity query kind
+ */
+export type CustomEntityQueryKind = (typeof CustomEntityQueryKind)[keyof typeof CustomEntityQueryKind];
+export declare const DataConnectorDefinitionKind: {
+    readonly Customizable: "Customizable";
+};
+/**
+ * The data connector kind
+ */
+export type DataConnectorDefinitionKind = (typeof DataConnectorDefinitionKind)[keyof typeof DataConnectorDefinitionKind];
+export declare const DataConnectorKind: {
+    readonly AzureActiveDirectory: "AzureActiveDirectory";
+    readonly AzureSecurityCenter: "AzureSecurityCenter";
+    readonly MicrosoftCloudAppSecurity: "MicrosoftCloudAppSecurity";
+    readonly ThreatIntelligence: "ThreatIntelligence";
+    readonly ThreatIntelligenceTaxii: "ThreatIntelligenceTaxii";
+    readonly Office365: "Office365";
+    readonly OfficeATP: "OfficeATP";
+    readonly OfficeIRM: "OfficeIRM";
+    readonly Office365Project: "Office365Project";
+    readonly MicrosoftPurviewInformationProtection: "MicrosoftPurviewInformationProtection";
+    readonly OfficePowerBI: "OfficePowerBI";
+    readonly AmazonWebServicesCloudTrail: "AmazonWebServicesCloudTrail";
+    readonly AmazonWebServicesS3: "AmazonWebServicesS3";
+    readonly AzureAdvancedThreatProtection: "AzureAdvancedThreatProtection";
+    readonly MicrosoftDefenderAdvancedThreatProtection: "MicrosoftDefenderAdvancedThreatProtection";
+    readonly Dynamics365: "Dynamics365";
+    readonly MicrosoftThreatProtection: "MicrosoftThreatProtection";
+    readonly MicrosoftThreatIntelligence: "MicrosoftThreatIntelligence";
+    readonly GenericUI: "GenericUI";
+    readonly APIPolling: "APIPolling";
+    readonly IOT: "IOT";
+    readonly GCP: "GCP";
+};
+/**
+ * The data connector kind
+ */
+export type DataConnectorKind = (typeof DataConnectorKind)[keyof typeof DataConnectorKind];
+export declare const DataTypeState: {
+    readonly Enabled: "Enabled";
+    readonly Disabled: "Disabled";
+};
+/**
+ * Describe whether this data type connection is enabled or not.
+ */
+export type DataTypeState = (typeof DataTypeState)[keyof typeof DataTypeState];
+export declare const EntityMappingType: {
+    /**
+     * User account entity type
+     */
+    readonly Account: "Account";
+    /**
+     * Host entity type
+     */
+    readonly Host: "Host";
+    /**
+     * IP address entity type
+     */
+    readonly IP: "IP";
+    /**
+     * Malware entity type
+     */
+    readonly Malware: "Malware";
+    /**
+     * System file entity type
+     */
+    readonly File: "File";
+    /**
+     * Process entity type
+     */
+    readonly Process: "Process";
+    /**
+     * Cloud app entity type
+     */
+    readonly CloudApplication: "CloudApplication";
+    /**
+     * DNS entity type
+     */
+    readonly DNS: "DNS";
+    /**
+     * Azure resource entity type
+     */
+    readonly AzureResource: "AzureResource";
+    /**
+     * File-hash entity type
+     */
+    readonly FileHash: "FileHash";
+    /**
+     * Registry key entity type
+     */
+    readonly RegistryKey: "RegistryKey";
+    /**
+     * Registry value entity type
+     */
+    readonly RegistryValue: "RegistryValue";
+    /**
+     * Security group entity type
+     */
+    readonly SecurityGroup: "SecurityGroup";
+    /**
+     * URL entity type
+     */
+    readonly URL: "URL";
+    /**
+     * Mailbox entity type
+     */
+    readonly Mailbox: "Mailbox";
+    /**
+     * Mail cluster entity type
+     */
+    readonly MailCluster: "MailCluster";
+    /**
+     * Mail message entity type
+     */
+    readonly MailMessage: "MailMessage";
+    /**
+     * Submission mail entity type
+     */
+    readonly SubmissionMail: "SubmissionMail";
+};
+/**
+ * The V3 type of the mapped entity
+ */
+export type EntityMappingType = (typeof EntityMappingType)[keyof typeof EntityMappingType];
+export declare const EntityProviders: {
+    readonly ActiveDirectory: "ActiveDirectory";
+    readonly AzureActiveDirectory: "AzureActiveDirectory";
+};
+/**
+ * The entity provider that is synced.
+ */
+export type EntityProviders = (typeof EntityProviders)[keyof typeof EntityProviders];
+export declare const EntityTimelineKind: {
+    /**
+     * activity
+     */
+    readonly Activity: "Activity";
+    /**
+     * bookmarks
+     */
+    readonly Bookmark: "Bookmark";
+    /**
+     * security alerts
+     */
+    readonly SecurityAlert: "SecurityAlert";
+    /**
+     * anomaly
+     */
+    readonly Anomaly: "Anomaly";
+};
+/**
+ * The entity query kind
+ */
+export type EntityTimelineKind = (typeof EntityTimelineKind)[keyof typeof EntityTimelineKind];
+export declare const EntityType: {
+    /**
+     * Entity represents account in the system.
+     */
+    readonly Account: "Account";
+    /**
+     * Entity represents host in the system.
+     */
+    readonly Host: "Host";
+    /**
+     * Entity represents file in the system.
+     */
+    readonly File: "File";
+    /**
+     * Entity represents azure resource in the system.
+     */
+    readonly AzureResource: "AzureResource";
+    /**
+     * Entity represents cloud application in the system.
+     */
+    readonly CloudApplication: "CloudApplication";
+    /**
+     * Entity represents dns in the system.
+     */
+    readonly DNS: "DNS";
+    /**
+     * Entity represents file hash in the system.
+     */
+    readonly FileHash: "FileHash";
+    /**
+     * Entity represents ip in the system.
+     */
+    readonly IP: "IP";
+    /**
+     * Entity represents malware in the system.
+     */
+    readonly Malware: "Malware";
+    /**
+     * Entity represents process in the system.
+     */
+    readonly Process: "Process";
+    /**
+     * Entity represents registry key in the system.
+     */
+    readonly RegistryKey: "RegistryKey";
+    /**
+     * Entity represents registry value in the system.
+     */
+    readonly RegistryValue: "RegistryValue";
+    /**
+     * Entity represents security group in the system.
+     */
+    readonly SecurityGroup: "SecurityGroup";
+    /**
+     * Entity represents url in the system.
+     */
+    readonly URL: "URL";
+    /**
+     * Entity represents IoT device in the system.
+     */
+    readonly IoTDevice: "IoTDevice";
+    /**
+     * Entity represents security alert in the system.
+     */
+    readonly SecurityAlert: "SecurityAlert";
+    /**
+     * Entity represents HuntingBookmark in the system.
+     */
+    readonly HuntingBookmark: "HuntingBookmark";
+    /**
+     * Entity represents mail cluster in the system.
+     */
+    readonly MailCluster: "MailCluster";
+    /**
+     * Entity represents mail message in the system.
+     */
+    readonly MailMessage: "MailMessage";
+    /**
+     * Entity represents mailbox in the system.
+     */
+    readonly Mailbox: "Mailbox";
+    /**
+     * Entity represents submission mail in the system.
+     */
+    readonly SubmissionMail: "SubmissionMail";
+    /**
+     * Entity represents network interface in the system.
+     */
+    readonly Nic: "Nic";
+};
+/**
+ * The type of the query's source entity
+ */
+export type EntityType = (typeof EntityType)[keyof typeof EntityType];
+export declare const EventGroupingAggregationKind: {
+    readonly SingleAlert: "SingleAlert";
+    readonly AlertPerResult: "AlertPerResult";
+};
+/**
+ * The event grouping aggregation kinds
+ */
+export type EventGroupingAggregationKind = (typeof EventGroupingAggregationKind)[keyof typeof EventGroupingAggregationKind];
+export declare const FileFormat: {
+    /**
+     * A CSV file.
+     */
+    readonly CSV: "CSV";
+    /**
+     * A JSON file.
+     */
+    readonly JSON: "JSON";
+    /**
+     * A file of other format.
+     */
+    readonly Unspecified: "Unspecified";
+};
+/**
+ * The format of the file
+ */
+export type FileFormat = (typeof FileFormat)[keyof typeof FileFormat];
+export declare const FileImportContentType: {
+    /**
+     * File containing records with the core fields of an indicator, plus the observables to construct the STIX pattern.
+     */
+    readonly BasicIndicator: "BasicIndicator";
+    /**
+     * File containing STIX indicators.
+     */
+    readonly StixIndicator: "StixIndicator";
+    /**
+     * File containing other records.
+     */
+    readonly Unspecified: "Unspecified";
+};
+/**
+ * The content type of this file.
+ */
+export type FileImportContentType = (typeof FileImportContentType)[keyof typeof FileImportContentType];
+export declare const Flag: {
+    readonly True: "true";
+    readonly False: "false";
+};
+/**
+ * Flag indicates if this package is in preview.
+ */
+export type Flag = (typeof Flag)[keyof typeof Flag];
+export declare const HypothesisStatus: {
+    readonly Unknown: "Unknown";
+    readonly Invalidated: "Invalidated";
+    readonly Validated: "Validated";
+};
+/**
+ * The hypothesis status of the hunt.
+ */
+export type HypothesisStatus = (typeof HypothesisStatus)[keyof typeof HypothesisStatus];
+export declare const IncidentClassification: {
+    /**
+     * Incident classification was undetermined
+     */
+    readonly Undetermined: "Undetermined";
+    /**
+     * Incident was true positive
+     */
+    readonly TruePositive: "TruePositive";
+    /**
+     * Incident was benign positive
+     */
+    readonly BenignPositive: "BenignPositive";
+    /**
+     * Incident was false positive
+     */
+    readonly FalsePositive: "FalsePositive";
+};
+/**
+ * The reason the incident was closed
+ */
+export type IncidentClassification = (typeof IncidentClassification)[keyof typeof IncidentClassification];
+export declare const IncidentClassificationReason: {
+    /**
+     * Classification reason was suspicious activity
+     */
+    readonly SuspiciousActivity: "SuspiciousActivity";
+    /**
+     * Classification reason was suspicious but expected
+     */
+    readonly SuspiciousButExpected: "SuspiciousButExpected";
+    /**
+     * Classification reason was incorrect alert logic
+     */
+    readonly IncorrectAlertLogic: "IncorrectAlertLogic";
+    /**
+     * Classification reason was inaccurate data
+     */
+    readonly InaccurateData: "InaccurateData";
+};
+/**
+ * The classification reason the incident was closed with
+ */
+export type IncidentClassificationReason = (typeof IncidentClassificationReason)[keyof typeof IncidentClassificationReason];
+export declare const IncidentSeverity: {
+    /**
+     * High severity
+     */
+    readonly High: "High";
+    /**
+     * Medium severity
+     */
+    readonly Medium: "Medium";
+    /**
+     * Low severity
+     */
+    readonly Low: "Low";
+    /**
+     * Informational severity
+     */
+    readonly Informational: "Informational";
+};
+/**
+ * The severity of the incident
+ */
+export type IncidentSeverity = (typeof IncidentSeverity)[keyof typeof IncidentSeverity];
+export declare const IncidentStatus: {
+    /**
+     * An active incident which isn't being handled currently
+     */
+    readonly New: "New";
+    /**
+     * An active incident which is being handled
+     */
+    readonly Active: "Active";
+    /**
+     * A non-active incident
+     */
+    readonly Closed: "Closed";
+};
+/**
+ * The status of the incident
+ */
+export type IncidentStatus = (typeof IncidentStatus)[keyof typeof IncidentStatus];
+export declare const IncidentTaskStatus: {
+    /**
+     * A new task
+     */
+    readonly New: "New";
+    /**
+     * A completed task
+     */
+    readonly Completed: "Completed";
+};
+export type IncidentTaskStatus = (typeof IncidentTaskStatus)[keyof typeof IncidentTaskStatus];
+export declare const IngestionMode: {
+    /**
+     * No records should be ingested when invalid records are detected.
+     */
+    readonly IngestOnlyIfAllAreValid: "IngestOnlyIfAllAreValid";
+    /**
+     * Valid records should still be ingested when invalid records are detected.
+     */
+    readonly IngestAnyValidRecords: "IngestAnyValidRecords";
+    /**
+     * Unspecified
+     */
+    readonly Unspecified: "Unspecified";
+};
+/**
+ * Describes how to ingest the records in the file.
+ */
+export type IngestionMode = (typeof IngestionMode)[keyof typeof IngestionMode];
+export declare const Kind: {
+    readonly DataConnector: "DataConnector";
+    readonly DataType: "DataType";
+    readonly Workbook: "Workbook";
+    readonly WorkbookTemplate: "WorkbookTemplate";
+    readonly Playbook: "Playbook";
+    readonly PlaybookTemplate: "PlaybookTemplate";
+    readonly AnalyticsRuleTemplate: "AnalyticsRuleTemplate";
+    readonly AnalyticsRule: "AnalyticsRule";
+    readonly HuntingQuery: "HuntingQuery";
+    readonly InvestigationQuery: "InvestigationQuery";
+    readonly Parser: "Parser";
+    readonly Watchlist: "Watchlist";
+    readonly WatchlistTemplate: "WatchlistTemplate";
+    readonly Solution: "Solution";
+    readonly AzureFunction: "AzureFunction";
+    readonly LogicAppsCustomConnector: "LogicAppsCustomConnector";
+    readonly AutomationRule: "AutomationRule";
+};
+/**
+ * Type of the content item we depend on
+ */
+export type Kind = (typeof Kind)[keyof typeof Kind];
+export declare const MatchingMethod: {
+    /**
+     * Grouping alerts into a single incident if all the entities match
+     */
+    readonly AllEntities: "AllEntities";
+    /**
+     * Grouping any alerts triggered by this rule into a single incident
+     */
+    readonly AnyAlert: "AnyAlert";
+    /**
+     * Grouping alerts into a single incident if the selected entities, custom details and alert details match
+     */
+    readonly Selected: "Selected";
+};
+/**
+ * Grouping matching method. When method is Selected at least one of groupByEntities, groupByAlertDetails, groupByCustomDetails must be provided and not empty.
+ */
+export type MatchingMethod = (typeof MatchingMethod)[keyof typeof MatchingMethod];
+export declare const MicrosoftSecurityProductName: {
+    readonly Microsoft_Cloud_App_Security: "Microsoft Cloud App Security";
+    readonly Azure_Security_Center: "Azure Security Center";
+    readonly Azure_Advanced_Threat_Protection: "Azure Advanced Threat Protection";
+    readonly Azure_Active_Directory_Identity_Protection: "Azure Active Directory Identity Protection";
+    readonly Azure_Security_Center_for_IoT: "Azure Security Center for IoT";
+    readonly Office_365_Advanced_Threat_Protection: "Office 365 Advanced Threat Protection";
+    readonly Microsoft_Defender_Advanced_Threat_Protection: "Microsoft Defender Advanced Threat Protection";
+};
+/**
+ * The alerts' productName on which the cases will be generated
+ */
+export type MicrosoftSecurityProductName = (typeof MicrosoftSecurityProductName)[keyof typeof MicrosoftSecurityProductName];
+export declare const Mode: {
+    /**
+     * The workspace manager configuration is enabled
+     */
+    readonly Enabled: "Enabled";
+    /**
+     * The workspace manager configuration is disabled
+     */
+    readonly Disabled: "Disabled";
+};
+/**
+ * The current mode of the workspace manager configuration
+ */
+export type Mode = (typeof Mode)[keyof typeof Mode];
+export declare const MtpProvider: {
+    readonly MicrosoftDefenderForCloudApps: "microsoftDefenderForCloudApps";
+    readonly MicrosoftDefenderForIdentity: "microsoftDefenderForIdentity";
+};
+/**
+ * The available data providers.
+ */
+export type MtpProvider = (typeof MtpProvider)[keyof typeof MtpProvider];
+export declare const Operator: {
+    readonly AND: "AND";
+    readonly OR: "OR";
+};
+/**
+ * Operator used for list of dependencies in criteria array.
+ */
+export type Operator = (typeof Operator)[keyof typeof Operator];
+export declare const OwnerType: {
+    /**
+     * The incident owner type is unknown
+     */
+    readonly Unknown: "Unknown";
+    /**
+     * The incident owner type is an AAD user
+     */
+    readonly User: "User";
+    /**
+     * The incident owner type is an AAD group
+     */
+    readonly Group: "Group";
+};
+/**
+ * The type of the owner the incident is assigned to.
+ */
+export type OwnerType = (typeof OwnerType)[keyof typeof OwnerType];
+export declare const PackageKind: {
+    readonly Solution: "Solution";
+    readonly Standalone: "Standalone";
+};
+/**
+ * the packageKind of the package contains this template
+ */
+export type PackageKind = (typeof PackageKind)[keyof typeof PackageKind];
+export declare const PermissionProviderScope: {
+    readonly ResourceGroup: "ResourceGroup";
+    readonly Subscription: "Subscription";
+    readonly Workspace: "Workspace";
+};
+/**
+ * Permission provider scope
+ */
+export type PermissionProviderScope = (typeof PermissionProviderScope)[keyof typeof PermissionProviderScope];
+export declare const PollingFrequency: {
+    /**
+     * Once a minute
+     */
+    readonly OnceAMinute: "OnceAMinute";
+    /**
+     * Once an hour
+     */
+    readonly OnceAnHour: "OnceAnHour";
+    /**
+     * Once a day
+     */
+    readonly OnceADay: "OnceADay";
+};
+/**
+ * The polling frequency for the TAXII server.
+ */
+export type PollingFrequency = (typeof PollingFrequency)[keyof typeof PollingFrequency];
+export declare const ProviderName: {
+    readonly Microsoft_OperationalInsights_solutions: "Microsoft.OperationalInsights/solutions";
+    readonly Microsoft_OperationalInsights_workspaces: "Microsoft.OperationalInsights/workspaces";
+    readonly Microsoft_OperationalInsights_workspaces_datasources: "Microsoft.OperationalInsights/workspaces/datasources";
+    readonly Microsoft_aadiam_diagnosticSettings: "microsoft.aadiam/diagnosticSettings";
+    readonly Microsoft_OperationalInsights_workspaces_sharedKeys: "Microsoft.OperationalInsights/workspaces/sharedKeys";
+    readonly Microsoft_Authorization_policyAssignments: "Microsoft.Authorization/policyAssignments";
+};
+/**
+ * Provider name
+ */
+export type ProviderName = (typeof ProviderName)[keyof typeof ProviderName];
+export declare const ProviderPermissionsScope: {
+    readonly Subscription: "Subscription";
+    readonly ResourceGroup: "ResourceGroup";
+    readonly Workspace: "Workspace";
+};
+/**
+ * The scope on which the user should have permissions, in order to be able to create connections.
+ */
+export type ProviderPermissionsScope = (typeof ProviderPermissionsScope)[keyof typeof ProviderPermissionsScope];
+export declare const SecurityMLAnalyticsSettingsKind: {
+    readonly Anomaly: "Anomaly";
+};
+/**
+ * The kind of security ML Analytics Settings
+ */
+export type SecurityMLAnalyticsSettingsKind = (typeof SecurityMLAnalyticsSettingsKind)[keyof typeof SecurityMLAnalyticsSettingsKind];
+export declare const SettingKind: {
+    readonly Anomalies: "Anomalies";
+    readonly EyesOn: "EyesOn";
+    readonly EntityAnalytics: "EntityAnalytics";
+    readonly Ueba: "Ueba";
+};
+/**
+ * The kind of the setting
+ */
+export type SettingKind = (typeof SettingKind)[keyof typeof SettingKind];
+export declare const SettingType: {
+    readonly CopyableLabel: "CopyableLabel";
+    readonly InstructionStepsGroup: "InstructionStepsGroup";
+    readonly InfoMessage: "InfoMessage";
+};
+/**
+ * The kind of the setting
+ */
+export type SettingType = (typeof SettingType)[keyof typeof SettingType];
+export declare const SettingsStatus: {
+    /**
+     * Anomaly settings status in Production mode
+     */
+    readonly Production: "Production";
+    /**
+     * Anomaly settings status in Flighting mode
+     */
+    readonly Flighting: "Flighting";
+};
+/**
+ * The anomaly SecurityMLAnalyticsSettings status
+ */
+export type SettingsStatus = (typeof SettingsStatus)[keyof typeof SettingsStatus];
+export declare const SourceKind: {
+    readonly LocalWorkspace: "LocalWorkspace";
+    readonly Community: "Community";
+    readonly Solution: "Solution";
+    readonly SourceRepository: "SourceRepository";
+};
+/**
+ * Source type of the content
+ */
+export type SourceKind = (typeof SourceKind)[keyof typeof SourceKind];
+export declare const SourceType: {
+    readonly Local_file: "Local file";
+    readonly Remote_storage: "Remote storage";
+};
+/**
+ * The sourceType of the watchlist
+ */
+export type SourceType = (typeof SourceType)[keyof typeof SourceType];
+export declare const Status: {
+    readonly New: "New";
+    readonly Active: "Active";
+    readonly Closed: "Closed";
+    readonly Backlog: "Backlog";
+    readonly Approved: "Approved";
+};
+/**
+ * The status of the hunt.
+ */
+export type Status = (typeof Status)[keyof typeof Status];
+export declare const SupportTier: {
+    readonly Microsoft: "Microsoft";
+    readonly Partner: "Partner";
+    readonly Community: "Community";
+};
+/**
+ * Type of support for content item
+ */
+export type SupportTier = (typeof SupportTier)[keyof typeof SupportTier];
+export declare const ThreatIntelligenceResourceInnerKind: {
+    /**
+     * Entity represents threat intelligence indicator in the system.
+     */
+    readonly Indicator: "indicator";
+};
+/**
+ * The kind of the entity.
+ */
+export type ThreatIntelligenceResourceInnerKind = (typeof ThreatIntelligenceResourceInnerKind)[keyof typeof ThreatIntelligenceResourceInnerKind];
+export declare const TriggerOperator: {
+    readonly GreaterThan: "GreaterThan";
+    readonly LessThan: "LessThan";
+    readonly Equal: "Equal";
+    readonly NotEqual: "NotEqual";
+};
+/**
+ * The operation against the threshold that triggers alert rule.
+ */
+export type TriggerOperator = (typeof TriggerOperator)[keyof typeof TriggerOperator];
+export declare const TriggersOn: {
+    /**
+     * Trigger on Incidents
+     */
+    readonly Incidents: "Incidents";
+    /**
+     * Trigger on Alerts
+     */
+    readonly Alerts: "Alerts";
+};
+export type TriggersOn = (typeof TriggersOn)[keyof typeof TriggersOn];
+export declare const TriggersWhen: {
+    /**
+     * Trigger on created objects
+     */
+    readonly Created: "Created";
+    /**
+     * Trigger on updated objects
+     */
+    readonly Updated: "Updated";
+};
+export type TriggersWhen = (typeof TriggersWhen)[keyof typeof TriggersWhen];
+export declare const UebaDataSources: {
+    readonly AuditLogs: "AuditLogs";
+    readonly AzureActivity: "AzureActivity";
+    readonly SecurityEvent: "SecurityEvent";
+    readonly SigninLogs: "SigninLogs";
+};
+/**
+ * The data source that enriched by ueba.
+ */
+export type UebaDataSources = (typeof UebaDataSources)[keyof typeof UebaDataSources];