pulumi-azure-native 2.32.1a1710772071__py3-none-any.whl → 2.32.1a1711107957__py3-none-any.whl

pulumi_azure_native/securityinsights/v20240301/outputs.py

@@ -0,0 +1,3268 @@
+# coding=utf-8
+# *** WARNING: this file was generated by pulumi-language-python. ***
+# *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import copy
+import warnings
+import pulumi
+import pulumi.runtime
+from typing import Any, Mapping, Optional, Sequence, Union, overload
+from ... import _utilities
+from . import outputs
+from ._enums import *
+
+__all__ = [
+    'AddIncidentTaskActionPropertiesResponse',
+    'AlertDetailsOverrideResponse',
+    'AlertPropertyMappingResponse',
+    'AlertsDataTypeOfDataConnectorResponse',
+    'AutomationRuleAddIncidentTaskActionResponse',
+    'AutomationRuleBooleanConditionResponse',
+    'AutomationRuleModifyPropertiesActionResponse',
+    'AutomationRulePropertyArrayChangedValuesConditionResponse',
+    'AutomationRulePropertyArrayValuesConditionResponse',
+    'AutomationRulePropertyValuesChangedConditionResponse',
+    'AutomationRulePropertyValuesConditionResponse',
+    'AutomationRuleRunPlaybookActionResponse',
+    'AutomationRuleTriggeringLogicResponse',
+    'AwsCloudTrailDataConnectorDataTypesResponse',
+    'AwsCloudTrailDataConnectorDataTypesResponseLogs',
+    'BooleanConditionPropertiesResponse',
+    'ClientInfoResponse',
+    'DataConnectorDataTypeCommonResponse',
+    'EntityMappingResponse',
+    'EventGroupingSettingsResponse',
+    'FieldMappingResponse',
+    'GroupingConfigurationResponse',
+    'IncidentAdditionalDataResponse',
+    'IncidentConfigurationResponse',
+    'IncidentInfoResponse',
+    'IncidentLabelResponse',
+    'IncidentOwnerInfoResponse',
+    'IncidentPropertiesActionResponse',
+    'MCASDataConnectorDataTypesResponse',
+    'MetadataAuthorResponse',
+    'MetadataCategoriesResponse',
+    'MetadataDependenciesResponse',
+    'MetadataSourceResponse',
+    'MetadataSupportResponse',
+    'OfficeDataConnectorDataTypesResponse',
+    'OfficeDataConnectorDataTypesResponseExchange',
+    'OfficeDataConnectorDataTypesResponseSharePoint',
+    'OfficeDataConnectorDataTypesResponseTeams',
+    'PlaybookActionPropertiesResponse',
+    'PropertyArrayChangedConditionPropertiesResponse',
+    'PropertyArrayConditionPropertiesResponse',
+    'PropertyChangedConditionPropertiesResponse',
+    'PropertyConditionPropertiesResponse',
+    'RepoResponse',
+    'SecurityMLAnalyticsSettingsDataSourceResponse',
+    'SystemDataResponse',
+    'TIDataConnectorDataTypesResponse',
+    'TIDataConnectorDataTypesResponseIndicators',
+    'TemplatePropertiesResponse',
+    'UserInfoResponse',
+    'WatchlistUserInfoResponse',
+]
+
+@pulumi.output_type
+class AddIncidentTaskActionPropertiesResponse(dict):
+    """
+    Describes an automation rule action to add a task to an incident.
+    """
+    def __init__(__self__, *,
+                 title: str,
+                 description: Optional[str] = None):
+        """
+        Describes an automation rule action to add a task to an incident.
+        :param str title: The title of the task.
+        :param str description: The description of the task.
+        """
+        pulumi.set(__self__, "title", title)
+        if description is not None:
+            pulumi.set(__self__, "description", description)
+
+    @property
+    @pulumi.getter
+    def title(self) -> str:
+        """
+        The title of the task.
+        """
+        return pulumi.get(self, "title")
+
+    @property
+    @pulumi.getter
+    def description(self) -> Optional[str]:
+        """
+        The description of the task.
+        """
+        return pulumi.get(self, "description")
+
+
+@pulumi.output_type
+class AlertDetailsOverrideResponse(dict):
+    """
+    Settings for how to dynamically override alert static details
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "alertDescriptionFormat":
+            suggest = "alert_description_format"
+        elif key == "alertDisplayNameFormat":
+            suggest = "alert_display_name_format"
+        elif key == "alertDynamicProperties":
+            suggest = "alert_dynamic_properties"
+        elif key == "alertSeverityColumnName":
+            suggest = "alert_severity_column_name"
+        elif key == "alertTacticsColumnName":
+            suggest = "alert_tactics_column_name"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in AlertDetailsOverrideResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        AlertDetailsOverrideResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        AlertDetailsOverrideResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 alert_description_format: Optional[str] = None,
+                 alert_display_name_format: Optional[str] = None,
+                 alert_dynamic_properties: Optional[Sequence['outputs.AlertPropertyMappingResponse']] = None,
+                 alert_severity_column_name: Optional[str] = None,
+                 alert_tactics_column_name: Optional[str] = None):
+        """
+        Settings for how to dynamically override alert static details
+        :param str alert_description_format: the format containing columns name(s) to override the alert description
+        :param str alert_display_name_format: the format containing columns name(s) to override the alert name
+        :param Sequence['AlertPropertyMappingResponse'] alert_dynamic_properties: List of additional dynamic properties to override
+        :param str alert_severity_column_name: the column name to take the alert severity from
+        :param str alert_tactics_column_name: the column name to take the alert tactics from
+        """
+        if alert_description_format is not None:
+            pulumi.set(__self__, "alert_description_format", alert_description_format)
+        if alert_display_name_format is not None:
+            pulumi.set(__self__, "alert_display_name_format", alert_display_name_format)
+        if alert_dynamic_properties is not None:
+            pulumi.set(__self__, "alert_dynamic_properties", alert_dynamic_properties)
+        if alert_severity_column_name is not None:
+            pulumi.set(__self__, "alert_severity_column_name", alert_severity_column_name)
+        if alert_tactics_column_name is not None:
+            pulumi.set(__self__, "alert_tactics_column_name", alert_tactics_column_name)
+
+    @property
+    @pulumi.getter(name="alertDescriptionFormat")
+    def alert_description_format(self) -> Optional[str]:
+        """
+        the format containing columns name(s) to override the alert description
+        """
+        return pulumi.get(self, "alert_description_format")
+
+    @property
+    @pulumi.getter(name="alertDisplayNameFormat")
+    def alert_display_name_format(self) -> Optional[str]:
+        """
+        the format containing columns name(s) to override the alert name
+        """
+        return pulumi.get(self, "alert_display_name_format")
+
+    @property
+    @pulumi.getter(name="alertDynamicProperties")
+    def alert_dynamic_properties(self) -> Optional[Sequence['outputs.AlertPropertyMappingResponse']]:
+        """
+        List of additional dynamic properties to override
+        """
+        return pulumi.get(self, "alert_dynamic_properties")
+
+    @property
+    @pulumi.getter(name="alertSeverityColumnName")
+    def alert_severity_column_name(self) -> Optional[str]:
+        """
+        the column name to take the alert severity from
+        """
+        return pulumi.get(self, "alert_severity_column_name")
+
+    @property
+    @pulumi.getter(name="alertTacticsColumnName")
+    def alert_tactics_column_name(self) -> Optional[str]:
+        """
+        the column name to take the alert tactics from
+        """
+        return pulumi.get(self, "alert_tactics_column_name")
+
+
+@pulumi.output_type
+class AlertPropertyMappingResponse(dict):
+    """
+    A single alert property mapping to override
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "alertProperty":
+            suggest = "alert_property"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in AlertPropertyMappingResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        AlertPropertyMappingResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        AlertPropertyMappingResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 alert_property: Optional[str] = None,
+                 value: Optional[str] = None):
+        """
+        A single alert property mapping to override
+        :param str alert_property: The V3 alert property
+        :param str value: the column name to use to override this property
+        """
+        if alert_property is not None:
+            pulumi.set(__self__, "alert_property", alert_property)
+        if value is not None:
+            pulumi.set(__self__, "value", value)
+
+    @property
+    @pulumi.getter(name="alertProperty")
+    def alert_property(self) -> Optional[str]:
+        """
+        The V3 alert property
+        """
+        return pulumi.get(self, "alert_property")
+
+    @property
+    @pulumi.getter
+    def value(self) -> Optional[str]:
+        """
+        the column name to use to override this property
+        """
+        return pulumi.get(self, "value")
+
+
+@pulumi.output_type
+class AlertsDataTypeOfDataConnectorResponse(dict):
+    """
+    Alerts data type for data connectors.
+    """
+    def __init__(__self__, *,
+                 alerts: Optional['outputs.DataConnectorDataTypeCommonResponse'] = None):
+        """
+        Alerts data type for data connectors.
+        :param 'DataConnectorDataTypeCommonResponse' alerts: Alerts data type connection.
+        """
+        if alerts is not None:
+            pulumi.set(__self__, "alerts", alerts)
+
+    @property
+    @pulumi.getter
+    def alerts(self) -> Optional['outputs.DataConnectorDataTypeCommonResponse']:
+        """
+        Alerts data type connection.
+        """
+        return pulumi.get(self, "alerts")
+
+
+@pulumi.output_type
+class AutomationRuleAddIncidentTaskActionResponse(dict):
+    """
+    Describes an automation rule action to add a task to an incident
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "actionType":
+            suggest = "action_type"
+        elif key == "actionConfiguration":
+            suggest = "action_configuration"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in AutomationRuleAddIncidentTaskActionResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        AutomationRuleAddIncidentTaskActionResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        AutomationRuleAddIncidentTaskActionResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 action_type: str,
+                 order: int,
+                 action_configuration: Optional['outputs.AddIncidentTaskActionPropertiesResponse'] = None):
+        """
+        Describes an automation rule action to add a task to an incident
+        :param str action_type: The type of the automation rule action.
+               Expected value is 'AddIncidentTask'.
+        :param 'AddIncidentTaskActionPropertiesResponse' action_configuration: Describes an automation rule action to add a task to an incident.
+        """
+        pulumi.set(__self__, "action_type", 'AddIncidentTask')
+        pulumi.set(__self__, "order", order)
+        if action_configuration is not None:
+            pulumi.set(__self__, "action_configuration", action_configuration)
+
+    @property
+    @pulumi.getter(name="actionType")
+    def action_type(self) -> str:
+        """
+        The type of the automation rule action.
+        Expected value is 'AddIncidentTask'.
+        """
+        return pulumi.get(self, "action_type")
+
+    @property
+    @pulumi.getter
+    def order(self) -> int:
+        return pulumi.get(self, "order")
+
+    @property
+    @pulumi.getter(name="actionConfiguration")
+    def action_configuration(self) -> Optional['outputs.AddIncidentTaskActionPropertiesResponse']:
+        """
+        Describes an automation rule action to add a task to an incident.
+        """
+        return pulumi.get(self, "action_configuration")
+
+
+@pulumi.output_type
+class AutomationRuleBooleanConditionResponse(dict):
+    """
+    Describes an automation rule condition with boolean operators.
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "innerConditions":
+            suggest = "inner_conditions"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in AutomationRuleBooleanConditionResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        AutomationRuleBooleanConditionResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        AutomationRuleBooleanConditionResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 inner_conditions: Optional[Sequence[Any]] = None,
+                 operator: Optional[str] = None):
+        """
+        Describes an automation rule condition with boolean operators.
+        :param str operator: Describes a boolean condition operator.
+        """
+        if inner_conditions is not None:
+            pulumi.set(__self__, "inner_conditions", inner_conditions)
+        if operator is not None:
+            pulumi.set(__self__, "operator", operator)
+
+    @property
+    @pulumi.getter(name="innerConditions")
+    def inner_conditions(self) -> Optional[Sequence[Any]]:
+        return pulumi.get(self, "inner_conditions")
+
+    @property
+    @pulumi.getter
+    def operator(self) -> Optional[str]:
+        """
+        Describes a boolean condition operator.
+        """
+        return pulumi.get(self, "operator")
+
+
+@pulumi.output_type
+class AutomationRuleModifyPropertiesActionResponse(dict):
+    """
+    Describes an automation rule action to modify an object's properties
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "actionType":
+            suggest = "action_type"
+        elif key == "actionConfiguration":
+            suggest = "action_configuration"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in AutomationRuleModifyPropertiesActionResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        AutomationRuleModifyPropertiesActionResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        AutomationRuleModifyPropertiesActionResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 action_type: str,
+                 order: int,
+                 action_configuration: Optional['outputs.IncidentPropertiesActionResponse'] = None):
+        """
+        Describes an automation rule action to modify an object's properties
+        :param str action_type: The type of the automation rule action.
+               Expected value is 'ModifyProperties'.
+        """
+        pulumi.set(__self__, "action_type", 'ModifyProperties')
+        pulumi.set(__self__, "order", order)
+        if action_configuration is not None:
+            pulumi.set(__self__, "action_configuration", action_configuration)
+
+    @property
+    @pulumi.getter(name="actionType")
+    def action_type(self) -> str:
+        """
+        The type of the automation rule action.
+        Expected value is 'ModifyProperties'.
+        """
+        return pulumi.get(self, "action_type")
+
+    @property
+    @pulumi.getter
+    def order(self) -> int:
+        return pulumi.get(self, "order")
+
+    @property
+    @pulumi.getter(name="actionConfiguration")
+    def action_configuration(self) -> Optional['outputs.IncidentPropertiesActionResponse']:
+        return pulumi.get(self, "action_configuration")
+
+
+@pulumi.output_type
+class AutomationRulePropertyArrayChangedValuesConditionResponse(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "arrayType":
+            suggest = "array_type"
+        elif key == "changeType":
+            suggest = "change_type"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in AutomationRulePropertyArrayChangedValuesConditionResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        AutomationRulePropertyArrayChangedValuesConditionResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        AutomationRulePropertyArrayChangedValuesConditionResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 array_type: Optional[str] = None,
+                 change_type: Optional[str] = None):
+        if array_type is not None:
+            pulumi.set(__self__, "array_type", array_type)
+        if change_type is not None:
+            pulumi.set(__self__, "change_type", change_type)
+
+    @property
+    @pulumi.getter(name="arrayType")
+    def array_type(self) -> Optional[str]:
+        return pulumi.get(self, "array_type")
+
+    @property
+    @pulumi.getter(name="changeType")
+    def change_type(self) -> Optional[str]:
+        return pulumi.get(self, "change_type")
+
+
+@pulumi.output_type
+class AutomationRulePropertyArrayValuesConditionResponse(dict):
+    """
+    Describes an automation rule condition on array properties.
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "arrayConditionType":
+            suggest = "array_condition_type"
+        elif key == "arrayType":
+            suggest = "array_type"
+        elif key == "itemConditions":
+            suggest = "item_conditions"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in AutomationRulePropertyArrayValuesConditionResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        AutomationRulePropertyArrayValuesConditionResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        AutomationRulePropertyArrayValuesConditionResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 array_condition_type: Optional[str] = None,
+                 array_type: Optional[str] = None,
+                 item_conditions: Optional[Sequence[Any]] = None):
+        """
+        Describes an automation rule condition on array properties.
+        :param str array_condition_type: Describes an array condition evaluation type.
+        :param str array_type: Describes an array condition evaluated array type.
+        """
+        if array_condition_type is not None:
+            pulumi.set(__self__, "array_condition_type", array_condition_type)
+        if array_type is not None:
+            pulumi.set(__self__, "array_type", array_type)
+        if item_conditions is not None:
+            pulumi.set(__self__, "item_conditions", item_conditions)
+
+    @property
+    @pulumi.getter(name="arrayConditionType")
+    def array_condition_type(self) -> Optional[str]:
+        """
+        Describes an array condition evaluation type.
+        """
+        return pulumi.get(self, "array_condition_type")
+
+    @property
+    @pulumi.getter(name="arrayType")
+    def array_type(self) -> Optional[str]:
+        """
+        Describes an array condition evaluated array type.
+        """
+        return pulumi.get(self, "array_type")
+
+    @property
+    @pulumi.getter(name="itemConditions")
+    def item_conditions(self) -> Optional[Sequence[Any]]:
+        return pulumi.get(self, "item_conditions")
+
+
+@pulumi.output_type
+class AutomationRulePropertyValuesChangedConditionResponse(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "changeType":
+            suggest = "change_type"
+        elif key == "propertyName":
+            suggest = "property_name"
+        elif key == "propertyValues":
+            suggest = "property_values"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in AutomationRulePropertyValuesChangedConditionResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        AutomationRulePropertyValuesChangedConditionResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        AutomationRulePropertyValuesChangedConditionResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 change_type: Optional[str] = None,
+                 operator: Optional[str] = None,
+                 property_name: Optional[str] = None,
+                 property_values: Optional[Sequence[str]] = None):
+        if change_type is not None:
+            pulumi.set(__self__, "change_type", change_type)
+        if operator is not None:
+            pulumi.set(__self__, "operator", operator)
+        if property_name is not None:
+            pulumi.set(__self__, "property_name", property_name)
+        if property_values is not None:
+            pulumi.set(__self__, "property_values", property_values)
+
+    @property
+    @pulumi.getter(name="changeType")
+    def change_type(self) -> Optional[str]:
+        return pulumi.get(self, "change_type")
+
+    @property
+    @pulumi.getter
+    def operator(self) -> Optional[str]:
+        return pulumi.get(self, "operator")
+
+    @property
+    @pulumi.getter(name="propertyName")
+    def property_name(self) -> Optional[str]:
+        return pulumi.get(self, "property_name")
+
+    @property
+    @pulumi.getter(name="propertyValues")
+    def property_values(self) -> Optional[Sequence[str]]:
+        return pulumi.get(self, "property_values")
+
+
+@pulumi.output_type
+class AutomationRulePropertyValuesConditionResponse(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "propertyName":
+            suggest = "property_name"
+        elif key == "propertyValues":
+            suggest = "property_values"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in AutomationRulePropertyValuesConditionResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        AutomationRulePropertyValuesConditionResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        AutomationRulePropertyValuesConditionResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 operator: Optional[str] = None,
+                 property_name: Optional[str] = None,
+                 property_values: Optional[Sequence[str]] = None):
+        """
+        :param str property_name: The property to evaluate in an automation rule property condition.
+        """
+        if operator is not None:
+            pulumi.set(__self__, "operator", operator)
+        if property_name is not None:
+            pulumi.set(__self__, "property_name", property_name)
+        if property_values is not None:
+            pulumi.set(__self__, "property_values", property_values)
+
+    @property
+    @pulumi.getter
+    def operator(self) -> Optional[str]:
+        return pulumi.get(self, "operator")
+
+    @property
+    @pulumi.getter(name="propertyName")
+    def property_name(self) -> Optional[str]:
+        """
+        The property to evaluate in an automation rule property condition.
+        """
+        return pulumi.get(self, "property_name")
+
+    @property
+    @pulumi.getter(name="propertyValues")
+    def property_values(self) -> Optional[Sequence[str]]:
+        return pulumi.get(self, "property_values")
+
+
+@pulumi.output_type
+class AutomationRuleRunPlaybookActionResponse(dict):
+    """
+    Describes an automation rule action to run a playbook
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "actionType":
+            suggest = "action_type"
+        elif key == "actionConfiguration":
+            suggest = "action_configuration"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in AutomationRuleRunPlaybookActionResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        AutomationRuleRunPlaybookActionResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        AutomationRuleRunPlaybookActionResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 action_type: str,
+                 order: int,
+                 action_configuration: Optional['outputs.PlaybookActionPropertiesResponse'] = None):
+        """
+        Describes an automation rule action to run a playbook
+        :param str action_type: The type of the automation rule action.
+               Expected value is 'RunPlaybook'.
+        """
+        pulumi.set(__self__, "action_type", 'RunPlaybook')
+        pulumi.set(__self__, "order", order)
+        if action_configuration is not None:
+            pulumi.set(__self__, "action_configuration", action_configuration)
+
+    @property
+    @pulumi.getter(name="actionType")
+    def action_type(self) -> str:
+        """
+        The type of the automation rule action.
+        Expected value is 'RunPlaybook'.
+        """
+        return pulumi.get(self, "action_type")
+
+    @property
+    @pulumi.getter
+    def order(self) -> int:
+        return pulumi.get(self, "order")
+
+    @property
+    @pulumi.getter(name="actionConfiguration")
+    def action_configuration(self) -> Optional['outputs.PlaybookActionPropertiesResponse']:
+        return pulumi.get(self, "action_configuration")
+
+
+@pulumi.output_type
+class AutomationRuleTriggeringLogicResponse(dict):
+    """
+    Describes automation rule triggering logic.
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "isEnabled":
+            suggest = "is_enabled"
+        elif key == "triggersOn":
+            suggest = "triggers_on"
+        elif key == "triggersWhen":
+            suggest = "triggers_when"
+        elif key == "expirationTimeUtc":
+            suggest = "expiration_time_utc"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in AutomationRuleTriggeringLogicResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        AutomationRuleTriggeringLogicResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        AutomationRuleTriggeringLogicResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 is_enabled: bool,
+                 triggers_on: str,
+                 triggers_when: str,
+                 conditions: Optional[Sequence[Any]] = None,
+                 expiration_time_utc: Optional[str] = None):
+        """
+        Describes automation rule triggering logic.
+        :param bool is_enabled: Determines whether the automation rule is enabled or disabled.
+        :param Sequence[Union['BooleanConditionPropertiesResponse', 'PropertyArrayChangedConditionPropertiesResponse', 'PropertyArrayConditionPropertiesResponse', 'PropertyChangedConditionPropertiesResponse', 'PropertyConditionPropertiesResponse']] conditions: The conditions to evaluate to determine if the automation rule should be triggered on a given object.
+        :param str expiration_time_utc: Determines when the automation rule should automatically expire and be disabled.
+        """
+        pulumi.set(__self__, "is_enabled", is_enabled)
+        pulumi.set(__self__, "triggers_on", triggers_on)
+        pulumi.set(__self__, "triggers_when", triggers_when)
+        if conditions is not None:
+            pulumi.set(__self__, "conditions", conditions)
+        if expiration_time_utc is not None:
+            pulumi.set(__self__, "expiration_time_utc", expiration_time_utc)
+
+    @property
+    @pulumi.getter(name="isEnabled")
+    def is_enabled(self) -> bool:
+        """
+        Determines whether the automation rule is enabled or disabled.
+        """
+        return pulumi.get(self, "is_enabled")
+
+    @property
+    @pulumi.getter(name="triggersOn")
+    def triggers_on(self) -> str:
+        return pulumi.get(self, "triggers_on")
+
+    @property
+    @pulumi.getter(name="triggersWhen")
+    def triggers_when(self) -> str:
+        return pulumi.get(self, "triggers_when")
+
+    @property
+    @pulumi.getter
+    def conditions(self) -> Optional[Sequence[Any]]:
+        """
+        The conditions to evaluate to determine if the automation rule should be triggered on a given object.
+        """
+        return pulumi.get(self, "conditions")
+
+    @property
+    @pulumi.getter(name="expirationTimeUtc")
+    def expiration_time_utc(self) -> Optional[str]:
+        """
+        Determines when the automation rule should automatically expire and be disabled.
+        """
+        return pulumi.get(self, "expiration_time_utc")
+
+
+@pulumi.output_type
+class AwsCloudTrailDataConnectorDataTypesResponse(dict):
+    """
+    The available data types for Amazon Web Services CloudTrail data connector.
+    """
+    def __init__(__self__, *,
+                 logs: Optional['outputs.AwsCloudTrailDataConnectorDataTypesResponseLogs'] = None):
+        """
+        The available data types for Amazon Web Services CloudTrail data connector.
+        :param 'AwsCloudTrailDataConnectorDataTypesResponseLogs' logs: Logs data type.
+        """
+        if logs is not None:
+            pulumi.set(__self__, "logs", logs)
+
+    @property
+    @pulumi.getter
+    def logs(self) -> Optional['outputs.AwsCloudTrailDataConnectorDataTypesResponseLogs']:
+        """
+        Logs data type.
+        """
+        return pulumi.get(self, "logs")
+
+
+@pulumi.output_type
+class AwsCloudTrailDataConnectorDataTypesResponseLogs(dict):
+    """
+    Logs data type.
+    """
+    def __init__(__self__, *,
+                 state: Optional[str] = None):
+        """
+        Logs data type.
+        :param str state: Describe whether this data type connection is enabled or not.
+        """
+        if state is not None:
+            pulumi.set(__self__, "state", state)
+
+    @property
+    @pulumi.getter
+    def state(self) -> Optional[str]:
+        """
+        Describe whether this data type connection is enabled or not.
+        """
+        return pulumi.get(self, "state")
+
+
+@pulumi.output_type
+class BooleanConditionPropertiesResponse(dict):
+    """
+    Describes an automation rule condition that applies a boolean operator (e.g AND, OR) to conditions
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "conditionType":
+            suggest = "condition_type"
+        elif key == "conditionProperties":
+            suggest = "condition_properties"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in BooleanConditionPropertiesResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        BooleanConditionPropertiesResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        BooleanConditionPropertiesResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 condition_type: str,
+                 condition_properties: Optional['outputs.AutomationRuleBooleanConditionResponse'] = None):
+        """
+        Describes an automation rule condition that applies a boolean operator (e.g AND, OR) to conditions
+        :param str condition_type: 
+               Expected value is 'Boolean'.
+        :param 'AutomationRuleBooleanConditionResponse' condition_properties: Describes an automation rule condition with boolean operators.
+        """
+        pulumi.set(__self__, "condition_type", 'Boolean')
+        if condition_properties is not None:
+            pulumi.set(__self__, "condition_properties", condition_properties)
+
+    @property
+    @pulumi.getter(name="conditionType")
+    def condition_type(self) -> str:
+        """
+
+        Expected value is 'Boolean'.
+        """
+        return pulumi.get(self, "condition_type")
+
+    @property
+    @pulumi.getter(name="conditionProperties")
+    def condition_properties(self) -> Optional['outputs.AutomationRuleBooleanConditionResponse']:
+        """
+        Describes an automation rule condition with boolean operators.
+        """
+        return pulumi.get(self, "condition_properties")
+
+
+@pulumi.output_type
+class ClientInfoResponse(dict):
+    """
+    Information on the client (user or application) that made some action
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "objectId":
+            suggest = "object_id"
+        elif key == "userPrincipalName":
+            suggest = "user_principal_name"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in ClientInfoResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        ClientInfoResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        ClientInfoResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 email: Optional[str] = None,
+                 name: Optional[str] = None,
+                 object_id: Optional[str] = None,
+                 user_principal_name: Optional[str] = None):
+        """
+        Information on the client (user or application) that made some action
+        :param str email: The email of the client.
+        :param str name: The name of the client.
+        :param str object_id: The object id of the client.
+        :param str user_principal_name: The user principal name of the client.
+        """
+        if email is not None:
+            pulumi.set(__self__, "email", email)
+        if name is not None:
+            pulumi.set(__self__, "name", name)
+        if object_id is not None:
+            pulumi.set(__self__, "object_id", object_id)
+        if user_principal_name is not None:
+            pulumi.set(__self__, "user_principal_name", user_principal_name)
+
+    @property
+    @pulumi.getter
+    def email(self) -> Optional[str]:
+        """
+        The email of the client.
+        """
+        return pulumi.get(self, "email")
+
+    @property
+    @pulumi.getter
+    def name(self) -> Optional[str]:
+        """
+        The name of the client.
+        """
+        return pulumi.get(self, "name")
+
+    @property
+    @pulumi.getter(name="objectId")
+    def object_id(self) -> Optional[str]:
+        """
+        The object id of the client.
+        """
+        return pulumi.get(self, "object_id")
+
+    @property
+    @pulumi.getter(name="userPrincipalName")
+    def user_principal_name(self) -> Optional[str]:
+        """
+        The user principal name of the client.
+        """
+        return pulumi.get(self, "user_principal_name")
+
+
+@pulumi.output_type
+class DataConnectorDataTypeCommonResponse(dict):
+    """
+    Common field for data type in data connectors.
+    """
+    def __init__(__self__, *,
+                 state: Optional[str] = None):
+        """
+        Common field for data type in data connectors.
+        :param str state: Describe whether this data type connection is enabled or not.
+        """
+        if state is not None:
+            pulumi.set(__self__, "state", state)
+
+    @property
+    @pulumi.getter
+    def state(self) -> Optional[str]:
+        """
+        Describe whether this data type connection is enabled or not.
+        """
+        return pulumi.get(self, "state")
+
+
+@pulumi.output_type
+class EntityMappingResponse(dict):
+    """
+    Single entity mapping for the alert rule
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "entityType":
+            suggest = "entity_type"
+        elif key == "fieldMappings":
+            suggest = "field_mappings"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in EntityMappingResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        EntityMappingResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        EntityMappingResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 entity_type: Optional[str] = None,
+                 field_mappings: Optional[Sequence['outputs.FieldMappingResponse']] = None):
+        """
+        Single entity mapping for the alert rule
+        :param str entity_type: The V3 type of the mapped entity
+        :param Sequence['FieldMappingResponse'] field_mappings: array of field mappings for the given entity mapping
+        """
+        if entity_type is not None:
+            pulumi.set(__self__, "entity_type", entity_type)
+        if field_mappings is not None:
+            pulumi.set(__self__, "field_mappings", field_mappings)
+
+    @property
+    @pulumi.getter(name="entityType")
+    def entity_type(self) -> Optional[str]:
+        """
+        The V3 type of the mapped entity
+        """
+        return pulumi.get(self, "entity_type")
+
+    @property
+    @pulumi.getter(name="fieldMappings")
+    def field_mappings(self) -> Optional[Sequence['outputs.FieldMappingResponse']]:
+        """
+        array of field mappings for the given entity mapping
+        """
+        return pulumi.get(self, "field_mappings")
+
+
+@pulumi.output_type
+class EventGroupingSettingsResponse(dict):
+    """
+    Event grouping settings property bag.
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "aggregationKind":
+            suggest = "aggregation_kind"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in EventGroupingSettingsResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        EventGroupingSettingsResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        EventGroupingSettingsResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 aggregation_kind: Optional[str] = None):
+        """
+        Event grouping settings property bag.
+        :param str aggregation_kind: The event grouping aggregation kinds
+        """
+        if aggregation_kind is not None:
+            pulumi.set(__self__, "aggregation_kind", aggregation_kind)
+
+    @property
+    @pulumi.getter(name="aggregationKind")
+    def aggregation_kind(self) -> Optional[str]:
+        """
+        The event grouping aggregation kinds
+        """
+        return pulumi.get(self, "aggregation_kind")
+
+
+@pulumi.output_type
+class FieldMappingResponse(dict):
+    """
+    A single field mapping of the mapped entity
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "columnName":
+            suggest = "column_name"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in FieldMappingResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        FieldMappingResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        FieldMappingResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 column_name: Optional[str] = None,
+                 identifier: Optional[str] = None):
+        """
+        A single field mapping of the mapped entity
+        :param str column_name: the column name to be mapped to the identifier
+        :param str identifier: the V3 identifier of the entity
+        """
+        if column_name is not None:
+            pulumi.set(__self__, "column_name", column_name)
+        if identifier is not None:
+            pulumi.set(__self__, "identifier", identifier)
+
+    @property
+    @pulumi.getter(name="columnName")
+    def column_name(self) -> Optional[str]:
+        """
+        the column name to be mapped to the identifier
+        """
+        return pulumi.get(self, "column_name")
+
+    @property
+    @pulumi.getter
+    def identifier(self) -> Optional[str]:
+        """
+        the V3 identifier of the entity
+        """
+        return pulumi.get(self, "identifier")
+
+
+@pulumi.output_type
+class GroupingConfigurationResponse(dict):
+    """
+    Grouping configuration property bag.
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "lookbackDuration":
+            suggest = "lookback_duration"
+        elif key == "matchingMethod":
+            suggest = "matching_method"
+        elif key == "reopenClosedIncident":
+            suggest = "reopen_closed_incident"
+        elif key == "groupByAlertDetails":
+            suggest = "group_by_alert_details"
+        elif key == "groupByCustomDetails":
+            suggest = "group_by_custom_details"
+        elif key == "groupByEntities":
+            suggest = "group_by_entities"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in GroupingConfigurationResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        GroupingConfigurationResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        GroupingConfigurationResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 enabled: bool,
+                 lookback_duration: str,
+                 matching_method: str,
+                 reopen_closed_incident: bool,
+                 group_by_alert_details: Optional[Sequence[str]] = None,
+                 group_by_custom_details: Optional[Sequence[str]] = None,
+                 group_by_entities: Optional[Sequence[str]] = None):
+        """
+        Grouping configuration property bag.
+        :param bool enabled: Grouping enabled
+        :param str lookback_duration: Limit the group to alerts created within the lookback duration (in ISO 8601 duration format)
+        :param str matching_method: Grouping matching method. When method is Selected at least one of groupByEntities, groupByAlertDetails, groupByCustomDetails must be provided and not empty.
+        :param bool reopen_closed_incident: Re-open closed matching incidents
+        :param Sequence[str] group_by_alert_details: A list of alert details to group by (when matchingMethod is Selected)
+        :param Sequence[str] group_by_custom_details: A list of custom details keys to group by (when matchingMethod is Selected). Only keys defined in the current alert rule may be used.
+        :param Sequence[str] group_by_entities: A list of entity types to group by (when matchingMethod is Selected). Only entities defined in the current alert rule may be used.
+        """
+        pulumi.set(__self__, "enabled", enabled)
+        pulumi.set(__self__, "lookback_duration", lookback_duration)
+        pulumi.set(__self__, "matching_method", matching_method)
+        pulumi.set(__self__, "reopen_closed_incident", reopen_closed_incident)
+        if group_by_alert_details is not None:
+            pulumi.set(__self__, "group_by_alert_details", group_by_alert_details)
+        if group_by_custom_details is not None:
+            pulumi.set(__self__, "group_by_custom_details", group_by_custom_details)
+        if group_by_entities is not None:
+            pulumi.set(__self__, "group_by_entities", group_by_entities)
+
+    @property
+    @pulumi.getter
+    def enabled(self) -> bool:
+        """
+        Grouping enabled
+        """
+        return pulumi.get(self, "enabled")
+
+    @property
+    @pulumi.getter(name="lookbackDuration")
+    def lookback_duration(self) -> str:
+        """
+        Limit the group to alerts created within the lookback duration (in ISO 8601 duration format)
+        """
+        return pulumi.get(self, "lookback_duration")
+
+    @property
+    @pulumi.getter(name="matchingMethod")
+    def matching_method(self) -> str:
+        """
+        Grouping matching method. When method is Selected at least one of groupByEntities, groupByAlertDetails, groupByCustomDetails must be provided and not empty.
+        """
+        return pulumi.get(self, "matching_method")
+
+    @property
+    @pulumi.getter(name="reopenClosedIncident")
+    def reopen_closed_incident(self) -> bool:
+        """
+        Re-open closed matching incidents
+        """
+        return pulumi.get(self, "reopen_closed_incident")
+
+    @property
+    @pulumi.getter(name="groupByAlertDetails")
+    def group_by_alert_details(self) -> Optional[Sequence[str]]:
+        """
+        A list of alert details to group by (when matchingMethod is Selected)
+        """
+        return pulumi.get(self, "group_by_alert_details")
+
+    @property
+    @pulumi.getter(name="groupByCustomDetails")
+    def group_by_custom_details(self) -> Optional[Sequence[str]]:
+        """
+        A list of custom details keys to group by (when matchingMethod is Selected). Only keys defined in the current alert rule may be used.
+        """
+        return pulumi.get(self, "group_by_custom_details")
+
+    @property
+    @pulumi.getter(name="groupByEntities")
+    def group_by_entities(self) -> Optional[Sequence[str]]:
+        """
+        A list of entity types to group by (when matchingMethod is Selected). Only entities defined in the current alert rule may be used.
+        """
+        return pulumi.get(self, "group_by_entities")
+
+
+@pulumi.output_type
+class IncidentAdditionalDataResponse(dict):
+    """
+    Incident additional data property bag.
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "alertProductNames":
+            suggest = "alert_product_names"
+        elif key == "alertsCount":
+            suggest = "alerts_count"
+        elif key == "bookmarksCount":
+            suggest = "bookmarks_count"
+        elif key == "commentsCount":
+            suggest = "comments_count"
+        elif key == "providerIncidentUrl":
+            suggest = "provider_incident_url"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in IncidentAdditionalDataResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        IncidentAdditionalDataResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        IncidentAdditionalDataResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 alert_product_names: Sequence[str],
+                 alerts_count: int,
+                 bookmarks_count: int,
+                 comments_count: int,
+                 provider_incident_url: str,
+                 tactics: Sequence[str]):
+        """
+        Incident additional data property bag.
+        :param Sequence[str] alert_product_names: List of product names of alerts in the incident
+        :param int alerts_count: The number of alerts in the incident
+        :param int bookmarks_count: The number of bookmarks in the incident
+        :param int comments_count: The number of comments in the incident
+        :param str provider_incident_url: The provider incident url to the incident in Microsoft 365 Defender portal
+        :param Sequence[str] tactics: The tactics associated with incident
+        """
+        pulumi.set(__self__, "alert_product_names", alert_product_names)
+        pulumi.set(__self__, "alerts_count", alerts_count)
+        pulumi.set(__self__, "bookmarks_count", bookmarks_count)
+        pulumi.set(__self__, "comments_count", comments_count)
+        pulumi.set(__self__, "provider_incident_url", provider_incident_url)
+        pulumi.set(__self__, "tactics", tactics)
+
+    @property
+    @pulumi.getter(name="alertProductNames")
+    def alert_product_names(self) -> Sequence[str]:
+        """
+        List of product names of alerts in the incident
+        """
+        return pulumi.get(self, "alert_product_names")
+
+    @property
+    @pulumi.getter(name="alertsCount")
+    def alerts_count(self) -> int:
+        """
+        The number of alerts in the incident
+        """
+        return pulumi.get(self, "alerts_count")
+
+    @property
+    @pulumi.getter(name="bookmarksCount")
+    def bookmarks_count(self) -> int:
+        """
+        The number of bookmarks in the incident
+        """
+        return pulumi.get(self, "bookmarks_count")
+
+    @property
+    @pulumi.getter(name="commentsCount")
+    def comments_count(self) -> int:
+        """
+        The number of comments in the incident
+        """
+        return pulumi.get(self, "comments_count")
+
+    @property
+    @pulumi.getter(name="providerIncidentUrl")
+    def provider_incident_url(self) -> str:
+        """
+        The provider incident url to the incident in Microsoft 365 Defender portal
+        """
+        return pulumi.get(self, "provider_incident_url")
+
+    @property
+    @pulumi.getter
+    def tactics(self) -> Sequence[str]:
+        """
+        The tactics associated with incident
+        """
+        return pulumi.get(self, "tactics")
+
+
+@pulumi.output_type
+class IncidentConfigurationResponse(dict):
+    """
+    Incident Configuration property bag.
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "createIncident":
+            suggest = "create_incident"
+        elif key == "groupingConfiguration":
+            suggest = "grouping_configuration"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in IncidentConfigurationResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        IncidentConfigurationResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        IncidentConfigurationResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 create_incident: bool,
+                 grouping_configuration: Optional['outputs.GroupingConfigurationResponse'] = None):
+        """
+        Incident Configuration property bag.
+        :param bool create_incident: Create incidents from alerts triggered by this analytics rule
+        :param 'GroupingConfigurationResponse' grouping_configuration: Set how the alerts that are triggered by this analytics rule, are grouped into incidents
+        """
+        pulumi.set(__self__, "create_incident", create_incident)
+        if grouping_configuration is not None:
+            pulumi.set(__self__, "grouping_configuration", grouping_configuration)
+
+    @property
+    @pulumi.getter(name="createIncident")
+    def create_incident(self) -> bool:
+        """
+        Create incidents from alerts triggered by this analytics rule
+        """
+        return pulumi.get(self, "create_incident")
+
+    @property
+    @pulumi.getter(name="groupingConfiguration")
+    def grouping_configuration(self) -> Optional['outputs.GroupingConfigurationResponse']:
+        """
+        Set how the alerts that are triggered by this analytics rule, are grouped into incidents
+        """
+        return pulumi.get(self, "grouping_configuration")
+
+
+@pulumi.output_type
+class IncidentInfoResponse(dict):
+    """
+    Describes related incident information for the bookmark
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "incidentId":
+            suggest = "incident_id"
+        elif key == "relationName":
+            suggest = "relation_name"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in IncidentInfoResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        IncidentInfoResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        IncidentInfoResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 incident_id: Optional[str] = None,
+                 relation_name: Optional[str] = None,
+                 severity: Optional[str] = None,
+                 title: Optional[str] = None):
+        """
+        Describes related incident information for the bookmark
+        :param str incident_id: Incident Id
+        :param str relation_name: Relation Name
+        :param str severity: The severity of the incident
+        :param str title: The title of the incident
+        """
+        if incident_id is not None:
+            pulumi.set(__self__, "incident_id", incident_id)
+        if relation_name is not None:
+            pulumi.set(__self__, "relation_name", relation_name)
+        if severity is not None:
+            pulumi.set(__self__, "severity", severity)
+        if title is not None:
+            pulumi.set(__self__, "title", title)
+
+    @property
+    @pulumi.getter(name="incidentId")
+    def incident_id(self) -> Optional[str]:
+        """
+        Incident Id
+        """
+        return pulumi.get(self, "incident_id")
+
+    @property
+    @pulumi.getter(name="relationName")
+    def relation_name(self) -> Optional[str]:
+        """
+        Relation Name
+        """
+        return pulumi.get(self, "relation_name")
+
+    @property
+    @pulumi.getter
+    def severity(self) -> Optional[str]:
+        """
+        The severity of the incident
+        """
+        return pulumi.get(self, "severity")
+
+    @property
+    @pulumi.getter
+    def title(self) -> Optional[str]:
+        """
+        The title of the incident
+        """
+        return pulumi.get(self, "title")
+
+
+@pulumi.output_type
+class IncidentLabelResponse(dict):
+    """
+    Represents an incident label
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "labelName":
+            suggest = "label_name"
+        elif key == "labelType":
+            suggest = "label_type"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in IncidentLabelResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        IncidentLabelResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        IncidentLabelResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 label_name: str,
+                 label_type: str):
+        """
+        Represents an incident label
+        :param str label_name: The name of the label
+        :param str label_type: The type of the label
+        """
+        pulumi.set(__self__, "label_name", label_name)
+        pulumi.set(__self__, "label_type", label_type)
+
+    @property
+    @pulumi.getter(name="labelName")
+    def label_name(self) -> str:
+        """
+        The name of the label
+        """
+        return pulumi.get(self, "label_name")
+
+    @property
+    @pulumi.getter(name="labelType")
+    def label_type(self) -> str:
+        """
+        The type of the label
+        """
+        return pulumi.get(self, "label_type")
+
+
+@pulumi.output_type
+class IncidentOwnerInfoResponse(dict):
+    """
+    Information on the user an incident is assigned to
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "assignedTo":
+            suggest = "assigned_to"
+        elif key == "objectId":
+            suggest = "object_id"
+        elif key == "ownerType":
+            suggest = "owner_type"
+        elif key == "userPrincipalName":
+            suggest = "user_principal_name"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in IncidentOwnerInfoResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        IncidentOwnerInfoResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        IncidentOwnerInfoResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 assigned_to: Optional[str] = None,
+                 email: Optional[str] = None,
+                 object_id: Optional[str] = None,
+                 owner_type: Optional[str] = None,
+                 user_principal_name: Optional[str] = None):
+        """
+        Information on the user an incident is assigned to
+        :param str assigned_to: The name of the user the incident is assigned to.
+        :param str email: The email of the user the incident is assigned to.
+        :param str object_id: The object id of the user the incident is assigned to.
+        :param str owner_type: The type of the owner the incident is assigned to.
+        :param str user_principal_name: The user principal name of the user the incident is assigned to.
+        """
+        if assigned_to is not None:
+            pulumi.set(__self__, "assigned_to", assigned_to)
+        if email is not None:
+            pulumi.set(__self__, "email", email)
+        if object_id is not None:
+            pulumi.set(__self__, "object_id", object_id)
+        if owner_type is not None:
+            pulumi.set(__self__, "owner_type", owner_type)
+        if user_principal_name is not None:
+            pulumi.set(__self__, "user_principal_name", user_principal_name)
+
+    @property
+    @pulumi.getter(name="assignedTo")
+    def assigned_to(self) -> Optional[str]:
+        """
+        The name of the user the incident is assigned to.
+        """
+        return pulumi.get(self, "assigned_to")
+
+    @property
+    @pulumi.getter
+    def email(self) -> Optional[str]:
+        """
+        The email of the user the incident is assigned to.
+        """
+        return pulumi.get(self, "email")
+
+    @property
+    @pulumi.getter(name="objectId")
+    def object_id(self) -> Optional[str]:
+        """
+        The object id of the user the incident is assigned to.
+        """
+        return pulumi.get(self, "object_id")
+
+    @property
+    @pulumi.getter(name="ownerType")
+    def owner_type(self) -> Optional[str]:
+        """
+        The type of the owner the incident is assigned to.
+        """
+        return pulumi.get(self, "owner_type")
+
+    @property
+    @pulumi.getter(name="userPrincipalName")
+    def user_principal_name(self) -> Optional[str]:
+        """
+        The user principal name of the user the incident is assigned to.
+        """
+        return pulumi.get(self, "user_principal_name")
+
+
+@pulumi.output_type
+class IncidentPropertiesActionResponse(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "classificationComment":
+            suggest = "classification_comment"
+        elif key == "classificationReason":
+            suggest = "classification_reason"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in IncidentPropertiesActionResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        IncidentPropertiesActionResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        IncidentPropertiesActionResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 classification: Optional[str] = None,
+                 classification_comment: Optional[str] = None,
+                 classification_reason: Optional[str] = None,
+                 labels: Optional[Sequence['outputs.IncidentLabelResponse']] = None,
+                 owner: Optional['outputs.IncidentOwnerInfoResponse'] = None,
+                 severity: Optional[str] = None,
+                 status: Optional[str] = None):
+        """
+        :param str classification: The reason the incident was closed
+        :param str classification_comment: Describes the reason the incident was closed.
+        :param str classification_reason: The classification reason the incident was closed with
+        :param Sequence['IncidentLabelResponse'] labels: List of labels to add to the incident.
+        :param 'IncidentOwnerInfoResponse' owner: Information on the user an incident is assigned to
+        :param str severity: The severity of the incident
+        :param str status: The status of the incident
+        """
+        if classification is not None:
+            pulumi.set(__self__, "classification", classification)
+        if classification_comment is not None:
+            pulumi.set(__self__, "classification_comment", classification_comment)
+        if classification_reason is not None:
+            pulumi.set(__self__, "classification_reason", classification_reason)
+        if labels is not None:
+            pulumi.set(__self__, "labels", labels)
+        if owner is not None:
+            pulumi.set(__self__, "owner", owner)
+        if severity is not None:
+            pulumi.set(__self__, "severity", severity)
+        if status is not None:
+            pulumi.set(__self__, "status", status)
+
+    @property
+    @pulumi.getter
+    def classification(self) -> Optional[str]:
+        """
+        The reason the incident was closed
+        """
+        return pulumi.get(self, "classification")
+
+    @property
+    @pulumi.getter(name="classificationComment")
+    def classification_comment(self) -> Optional[str]:
+        """
+        Describes the reason the incident was closed.
+        """
+        return pulumi.get(self, "classification_comment")
+
+    @property
+    @pulumi.getter(name="classificationReason")
+    def classification_reason(self) -> Optional[str]:
+        """
+        The classification reason the incident was closed with
+        """
+        return pulumi.get(self, "classification_reason")
+
+    @property
+    @pulumi.getter
+    def labels(self) -> Optional[Sequence['outputs.IncidentLabelResponse']]:
+        """
+        List of labels to add to the incident.
+        """
+        return pulumi.get(self, "labels")
+
+    @property
+    @pulumi.getter
+    def owner(self) -> Optional['outputs.IncidentOwnerInfoResponse']:
+        """
+        Information on the user an incident is assigned to
+        """
+        return pulumi.get(self, "owner")
+
+    @property
+    @pulumi.getter
+    def severity(self) -> Optional[str]:
+        """
+        The severity of the incident
+        """
+        return pulumi.get(self, "severity")
+
+    @property
+    @pulumi.getter
+    def status(self) -> Optional[str]:
+        """
+        The status of the incident
+        """
+        return pulumi.get(self, "status")
+
+
+@pulumi.output_type
+class MCASDataConnectorDataTypesResponse(dict):
+    """
+    The available data types for MCAS (Microsoft Cloud App Security) data connector.
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "discoveryLogs":
+            suggest = "discovery_logs"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in MCASDataConnectorDataTypesResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        MCASDataConnectorDataTypesResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        MCASDataConnectorDataTypesResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 alerts: Optional['outputs.DataConnectorDataTypeCommonResponse'] = None,
+                 discovery_logs: Optional['outputs.DataConnectorDataTypeCommonResponse'] = None):
+        """
+        The available data types for MCAS (Microsoft Cloud App Security) data connector.
+        :param 'DataConnectorDataTypeCommonResponse' alerts: Alerts data type connection.
+        :param 'DataConnectorDataTypeCommonResponse' discovery_logs: Discovery log data type connection.
+        """
+        if alerts is not None:
+            pulumi.set(__self__, "alerts", alerts)
+        if discovery_logs is not None:
+            pulumi.set(__self__, "discovery_logs", discovery_logs)
+
+    @property
+    @pulumi.getter
+    def alerts(self) -> Optional['outputs.DataConnectorDataTypeCommonResponse']:
+        """
+        Alerts data type connection.
+        """
+        return pulumi.get(self, "alerts")
+
+    @property
+    @pulumi.getter(name="discoveryLogs")
+    def discovery_logs(self) -> Optional['outputs.DataConnectorDataTypeCommonResponse']:
+        """
+        Discovery log data type connection.
+        """
+        return pulumi.get(self, "discovery_logs")
+
+
+@pulumi.output_type
+class MetadataAuthorResponse(dict):
+    """
+    Publisher or creator of the content item.
+    """
+    def __init__(__self__, *,
+                 email: Optional[str] = None,
+                 link: Optional[str] = None,
+                 name: Optional[str] = None):
+        """
+        Publisher or creator of the content item.
+        :param str email: Email of author contact
+        :param str link: Link for author/vendor page
+        :param str name: Name of the author. Company or person.
+        """
+        if email is not None:
+            pulumi.set(__self__, "email", email)
+        if link is not None:
+            pulumi.set(__self__, "link", link)
+        if name is not None:
+            pulumi.set(__self__, "name", name)
+
+    @property
+    @pulumi.getter
+    def email(self) -> Optional[str]:
+        """
+        Email of author contact
+        """
+        return pulumi.get(self, "email")
+
+    @property
+    @pulumi.getter
+    def link(self) -> Optional[str]:
+        """
+        Link for author/vendor page
+        """
+        return pulumi.get(self, "link")
+
+    @property
+    @pulumi.getter
+    def name(self) -> Optional[str]:
+        """
+        Name of the author. Company or person.
+        """
+        return pulumi.get(self, "name")
+
+
+@pulumi.output_type
+class MetadataCategoriesResponse(dict):
+    """
+    ies for the solution content item
+    """
+    def __init__(__self__, *,
+                 domains: Optional[Sequence[str]] = None,
+                 verticals: Optional[Sequence[str]] = None):
+        """
+        ies for the solution content item
+        :param Sequence[str] domains: domain for the solution content item
+        :param Sequence[str] verticals: Industry verticals for the solution content item
+        """
+        if domains is not None:
+            pulumi.set(__self__, "domains", domains)
+        if verticals is not None:
+            pulumi.set(__self__, "verticals", verticals)
+
+    @property
+    @pulumi.getter
+    def domains(self) -> Optional[Sequence[str]]:
+        """
+        domain for the solution content item
+        """
+        return pulumi.get(self, "domains")
+
+    @property
+    @pulumi.getter
+    def verticals(self) -> Optional[Sequence[str]]:
+        """
+        Industry verticals for the solution content item
+        """
+        return pulumi.get(self, "verticals")
+
+
+@pulumi.output_type
+class MetadataDependenciesResponse(dict):
+    """
+    Dependencies for the content item, what other content items it requires to work.  Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex dependencies.
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "contentId":
+            suggest = "content_id"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in MetadataDependenciesResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        MetadataDependenciesResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        MetadataDependenciesResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 content_id: Optional[str] = None,
+                 criteria: Optional[Sequence['outputs.MetadataDependenciesResponse']] = None,
+                 kind: Optional[str] = None,
+                 name: Optional[str] = None,
+                 operator: Optional[str] = None,
+                 version: Optional[str] = None):
+        """
+        Dependencies for the content item, what other content items it requires to work.  Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex dependencies.
+        :param str content_id: Id of the content item we depend on
+        :param Sequence['MetadataDependenciesResponse'] criteria: This is the list of dependencies we must fulfill, according to the AND/OR operator
+        :param str kind: Type of the content item we depend on
+        :param str name: Name of the content item
+        :param str operator: Operator used for list of dependencies in criteria array.
+        :param str version: Version of the the content item we depend on.  Can be blank, * or missing to indicate any version fulfills the dependency.  If version does not match our defined numeric format then an exact match is required.
+        """
+        if content_id is not None:
+            pulumi.set(__self__, "content_id", content_id)
+        if criteria is not None:
+            pulumi.set(__self__, "criteria", criteria)
+        if kind is not None:
+            pulumi.set(__self__, "kind", kind)
+        if name is not None:
+            pulumi.set(__self__, "name", name)
+        if operator is not None:
+            pulumi.set(__self__, "operator", operator)
+        if version is not None:
+            pulumi.set(__self__, "version", version)
+
+    @property
+    @pulumi.getter(name="contentId")
+    def content_id(self) -> Optional[str]:
+        """
+        Id of the content item we depend on
+        """
+        return pulumi.get(self, "content_id")
+
+    @property
+    @pulumi.getter
+    def criteria(self) -> Optional[Sequence['outputs.MetadataDependenciesResponse']]:
+        """
+        This is the list of dependencies we must fulfill, according to the AND/OR operator
+        """
+        return pulumi.get(self, "criteria")
+
+    @property
+    @pulumi.getter
+    def kind(self) -> Optional[str]:
+        """
+        Type of the content item we depend on
+        """
+        return pulumi.get(self, "kind")
+
+    @property
+    @pulumi.getter
+    def name(self) -> Optional[str]:
+        """
+        Name of the content item
+        """
+        return pulumi.get(self, "name")
+
+    @property
+    @pulumi.getter
+    def operator(self) -> Optional[str]:
+        """
+        Operator used for list of dependencies in criteria array.
+        """
+        return pulumi.get(self, "operator")
+
+    @property
+    @pulumi.getter
+    def version(self) -> Optional[str]:
+        """
+        Version of the the content item we depend on.  Can be blank, * or missing to indicate any version fulfills the dependency.  If version does not match our defined numeric format then an exact match is required.
+        """
+        return pulumi.get(self, "version")
+
+
+@pulumi.output_type
+class MetadataSourceResponse(dict):
+    """
+    The original source of the content item, where it comes from.
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "sourceId":
+            suggest = "source_id"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in MetadataSourceResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        MetadataSourceResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        MetadataSourceResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 kind: str,
+                 name: Optional[str] = None,
+                 source_id: Optional[str] = None):
+        """
+        The original source of the content item, where it comes from.
+        :param str kind: Source type of the content
+        :param str name: Name of the content source.  The repo name, solution name, LA workspace name etc.
+        :param str source_id: ID of the content source.  The solution ID, workspace ID, etc
+        """
+        pulumi.set(__self__, "kind", kind)
+        if name is not None:
+            pulumi.set(__self__, "name", name)
+        if source_id is not None:
+            pulumi.set(__self__, "source_id", source_id)
+
+    @property
+    @pulumi.getter
+    def kind(self) -> str:
+        """
+        Source type of the content
+        """
+        return pulumi.get(self, "kind")
+
+    @property
+    @pulumi.getter
+    def name(self) -> Optional[str]:
+        """
+        Name of the content source.  The repo name, solution name, LA workspace name etc.
+        """
+        return pulumi.get(self, "name")
+
+    @property
+    @pulumi.getter(name="sourceId")
+    def source_id(self) -> Optional[str]:
+        """
+        ID of the content source.  The solution ID, workspace ID, etc
+        """
+        return pulumi.get(self, "source_id")
+
+
+@pulumi.output_type
+class MetadataSupportResponse(dict):
+    """
+    Support information for the content item.
+    """
+    def __init__(__self__, *,
+                 tier: str,
+                 email: Optional[str] = None,
+                 link: Optional[str] = None,
+                 name: Optional[str] = None):
+        """
+        Support information for the content item.
+        :param str tier: Type of support for content item
+        :param str email: Email of support contact
+        :param str link: Link for support help, like to support page to open a ticket etc.
+        :param str name: Name of the support contact. Company or person.
+        """
+        pulumi.set(__self__, "tier", tier)
+        if email is not None:
+            pulumi.set(__self__, "email", email)
+        if link is not None:
+            pulumi.set(__self__, "link", link)
+        if name is not None:
+            pulumi.set(__self__, "name", name)
+
+    @property
+    @pulumi.getter
+    def tier(self) -> str:
+        """
+        Type of support for content item
+        """
+        return pulumi.get(self, "tier")
+
+    @property
+    @pulumi.getter
+    def email(self) -> Optional[str]:
+        """
+        Email of support contact
+        """
+        return pulumi.get(self, "email")
+
+    @property
+    @pulumi.getter
+    def link(self) -> Optional[str]:
+        """
+        Link for support help, like to support page to open a ticket etc.
+        """
+        return pulumi.get(self, "link")
+
+    @property
+    @pulumi.getter
+    def name(self) -> Optional[str]:
+        """
+        Name of the support contact. Company or person.
+        """
+        return pulumi.get(self, "name")
+
+
+@pulumi.output_type
+class OfficeDataConnectorDataTypesResponse(dict):
+    """
+    The available data types for office data connector.
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "sharePoint":
+            suggest = "share_point"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in OfficeDataConnectorDataTypesResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        OfficeDataConnectorDataTypesResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        OfficeDataConnectorDataTypesResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 exchange: Optional['outputs.OfficeDataConnectorDataTypesResponseExchange'] = None,
+                 share_point: Optional['outputs.OfficeDataConnectorDataTypesResponseSharePoint'] = None,
+                 teams: Optional['outputs.OfficeDataConnectorDataTypesResponseTeams'] = None):
+        """
+        The available data types for office data connector.
+        :param 'OfficeDataConnectorDataTypesResponseExchange' exchange: Exchange data type connection.
+        :param 'OfficeDataConnectorDataTypesResponseSharePoint' share_point: SharePoint data type connection.
+        :param 'OfficeDataConnectorDataTypesResponseTeams' teams: Teams data type connection.
+        """
+        if exchange is not None:
+            pulumi.set(__self__, "exchange", exchange)
+        if share_point is not None:
+            pulumi.set(__self__, "share_point", share_point)
+        if teams is not None:
+            pulumi.set(__self__, "teams", teams)
+
+    @property
+    @pulumi.getter
+    def exchange(self) -> Optional['outputs.OfficeDataConnectorDataTypesResponseExchange']:
+        """
+        Exchange data type connection.
+        """
+        return pulumi.get(self, "exchange")
+
+    @property
+    @pulumi.getter(name="sharePoint")
+    def share_point(self) -> Optional['outputs.OfficeDataConnectorDataTypesResponseSharePoint']:
+        """
+        SharePoint data type connection.
+        """
+        return pulumi.get(self, "share_point")
+
+    @property
+    @pulumi.getter
+    def teams(self) -> Optional['outputs.OfficeDataConnectorDataTypesResponseTeams']:
+        """
+        Teams data type connection.
+        """
+        return pulumi.get(self, "teams")
+
+
+@pulumi.output_type
+class OfficeDataConnectorDataTypesResponseExchange(dict):
+    """
+    Exchange data type connection.
+    """
+    def __init__(__self__, *,
+                 state: Optional[str] = None):
+        """
+        Exchange data type connection.
+        :param str state: Describe whether this data type connection is enabled or not.
+        """
+        if state is not None:
+            pulumi.set(__self__, "state", state)
+
+    @property
+    @pulumi.getter
+    def state(self) -> Optional[str]:
+        """
+        Describe whether this data type connection is enabled or not.
+        """
+        return pulumi.get(self, "state")
+
+
+@pulumi.output_type
+class OfficeDataConnectorDataTypesResponseSharePoint(dict):
+    """
+    SharePoint data type connection.
+    """
+    def __init__(__self__, *,
+                 state: Optional[str] = None):
+        """
+        SharePoint data type connection.
+        :param str state: Describe whether this data type connection is enabled or not.
+        """
+        if state is not None:
+            pulumi.set(__self__, "state", state)
+
+    @property
+    @pulumi.getter
+    def state(self) -> Optional[str]:
+        """
+        Describe whether this data type connection is enabled or not.
+        """
+        return pulumi.get(self, "state")
+
+
+@pulumi.output_type
+class OfficeDataConnectorDataTypesResponseTeams(dict):
+    """
+    Teams data type connection.
+    """
+    def __init__(__self__, *,
+                 state: Optional[str] = None):
+        """
+        Teams data type connection.
+        :param str state: Describe whether this data type connection is enabled or not.
+        """
+        if state is not None:
+            pulumi.set(__self__, "state", state)
+
+    @property
+    @pulumi.getter
+    def state(self) -> Optional[str]:
+        """
+        Describe whether this data type connection is enabled or not.
+        """
+        return pulumi.get(self, "state")
+
+
+@pulumi.output_type
+class PlaybookActionPropertiesResponse(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "logicAppResourceId":
+            suggest = "logic_app_resource_id"
+        elif key == "tenantId":
+            suggest = "tenant_id"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in PlaybookActionPropertiesResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        PlaybookActionPropertiesResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        PlaybookActionPropertiesResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 logic_app_resource_id: str,
+                 tenant_id: Optional[str] = None):
+        """
+        :param str logic_app_resource_id: The resource id of the playbook resource.
+        :param str tenant_id: The tenant id of the playbook resource.
+        """
+        pulumi.set(__self__, "logic_app_resource_id", logic_app_resource_id)
+        if tenant_id is not None:
+            pulumi.set(__self__, "tenant_id", tenant_id)
+
+    @property
+    @pulumi.getter(name="logicAppResourceId")
+    def logic_app_resource_id(self) -> str:
+        """
+        The resource id of the playbook resource.
+        """
+        return pulumi.get(self, "logic_app_resource_id")
+
+    @property
+    @pulumi.getter(name="tenantId")
+    def tenant_id(self) -> Optional[str]:
+        """
+        The tenant id of the playbook resource.
+        """
+        return pulumi.get(self, "tenant_id")
+
+
+@pulumi.output_type
+class PropertyArrayChangedConditionPropertiesResponse(dict):
+    """
+    Describes an automation rule condition that evaluates an array property's value change
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "conditionType":
+            suggest = "condition_type"
+        elif key == "conditionProperties":
+            suggest = "condition_properties"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in PropertyArrayChangedConditionPropertiesResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        PropertyArrayChangedConditionPropertiesResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        PropertyArrayChangedConditionPropertiesResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 condition_type: str,
+                 condition_properties: Optional['outputs.AutomationRulePropertyArrayChangedValuesConditionResponse'] = None):
+        """
+        Describes an automation rule condition that evaluates an array property's value change
+        :param str condition_type: 
+               Expected value is 'PropertyArrayChanged'.
+        """
+        pulumi.set(__self__, "condition_type", 'PropertyArrayChanged')
+        if condition_properties is not None:
+            pulumi.set(__self__, "condition_properties", condition_properties)
+
+    @property
+    @pulumi.getter(name="conditionType")
+    def condition_type(self) -> str:
+        """
+
+        Expected value is 'PropertyArrayChanged'.
+        """
+        return pulumi.get(self, "condition_type")
+
+    @property
+    @pulumi.getter(name="conditionProperties")
+    def condition_properties(self) -> Optional['outputs.AutomationRulePropertyArrayChangedValuesConditionResponse']:
+        return pulumi.get(self, "condition_properties")
+
+
+@pulumi.output_type
+class PropertyArrayConditionPropertiesResponse(dict):
+    """
+    Describes an automation rule condition that evaluates an array property's value
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "conditionType":
+            suggest = "condition_type"
+        elif key == "conditionProperties":
+            suggest = "condition_properties"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in PropertyArrayConditionPropertiesResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        PropertyArrayConditionPropertiesResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        PropertyArrayConditionPropertiesResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 condition_type: str,
+                 condition_properties: Optional['outputs.AutomationRulePropertyArrayValuesConditionResponse'] = None):
+        """
+        Describes an automation rule condition that evaluates an array property's value
+        :param str condition_type: 
+               Expected value is 'PropertyArray'.
+        :param 'AutomationRulePropertyArrayValuesConditionResponse' condition_properties: Describes an automation rule condition on array properties.
+        """
+        pulumi.set(__self__, "condition_type", 'PropertyArray')
+        if condition_properties is not None:
+            pulumi.set(__self__, "condition_properties", condition_properties)
+
+    @property
+    @pulumi.getter(name="conditionType")
+    def condition_type(self) -> str:
+        """
+
+        Expected value is 'PropertyArray'.
+        """
+        return pulumi.get(self, "condition_type")
+
+    @property
+    @pulumi.getter(name="conditionProperties")
+    def condition_properties(self) -> Optional['outputs.AutomationRulePropertyArrayValuesConditionResponse']:
+        """
+        Describes an automation rule condition on array properties.
+        """
+        return pulumi.get(self, "condition_properties")
+
+
+@pulumi.output_type
+class PropertyChangedConditionPropertiesResponse(dict):
+    """
+    Describes an automation rule condition that evaluates a property's value change
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "conditionType":
+            suggest = "condition_type"
+        elif key == "conditionProperties":
+            suggest = "condition_properties"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in PropertyChangedConditionPropertiesResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        PropertyChangedConditionPropertiesResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        PropertyChangedConditionPropertiesResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 condition_type: str,
+                 condition_properties: Optional['outputs.AutomationRulePropertyValuesChangedConditionResponse'] = None):
+        """
+        Describes an automation rule condition that evaluates a property's value change
+        :param str condition_type: 
+               Expected value is 'PropertyChanged'.
+        """
+        pulumi.set(__self__, "condition_type", 'PropertyChanged')
+        if condition_properties is not None:
+            pulumi.set(__self__, "condition_properties", condition_properties)
+
+    @property
+    @pulumi.getter(name="conditionType")
+    def condition_type(self) -> str:
+        """
+
+        Expected value is 'PropertyChanged'.
+        """
+        return pulumi.get(self, "condition_type")
+
+    @property
+    @pulumi.getter(name="conditionProperties")
+    def condition_properties(self) -> Optional['outputs.AutomationRulePropertyValuesChangedConditionResponse']:
+        return pulumi.get(self, "condition_properties")
+
+
+@pulumi.output_type
+class PropertyConditionPropertiesResponse(dict):
+    """
+    Describes an automation rule condition that evaluates a property's value
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "conditionType":
+            suggest = "condition_type"
+        elif key == "conditionProperties":
+            suggest = "condition_properties"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in PropertyConditionPropertiesResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        PropertyConditionPropertiesResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        PropertyConditionPropertiesResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 condition_type: str,
+                 condition_properties: Optional['outputs.AutomationRulePropertyValuesConditionResponse'] = None):
+        """
+        Describes an automation rule condition that evaluates a property's value
+        :param str condition_type: 
+               Expected value is 'Property'.
+        """
+        pulumi.set(__self__, "condition_type", 'Property')
+        if condition_properties is not None:
+            pulumi.set(__self__, "condition_properties", condition_properties)
+
+    @property
+    @pulumi.getter(name="conditionType")
+    def condition_type(self) -> str:
+        """
+
+        Expected value is 'Property'.
+        """
+        return pulumi.get(self, "condition_type")
+
+    @property
+    @pulumi.getter(name="conditionProperties")
+    def condition_properties(self) -> Optional['outputs.AutomationRulePropertyValuesConditionResponse']:
+        return pulumi.get(self, "condition_properties")
+
+
+@pulumi.output_type
+class RepoResponse(dict):
+    """
+    Represents a repository.
+    """
+    def __init__(__self__, *,
+                 branches: Optional[Sequence[str]] = None,
+                 full_name: Optional[str] = None,
+                 installation_id: Optional[float] = None,
+                 url: Optional[str] = None):
+        """
+        Represents a repository.
+        :param Sequence[str] branches: Array of branches.
+        :param str full_name: The name of the repository.
+        :param float installation_id: The installation id of the repository.
+        :param str url: The url to access the repository.
+        """
+        if branches is not None:
+            pulumi.set(__self__, "branches", branches)
+        if full_name is not None:
+            pulumi.set(__self__, "full_name", full_name)
+        if installation_id is not None:
+            pulumi.set(__self__, "installation_id", installation_id)
+        if url is not None:
+            pulumi.set(__self__, "url", url)
+
+    @property
+    @pulumi.getter
+    def branches(self) -> Optional[Sequence[str]]:
+        """
+        Array of branches.
+        """
+        return pulumi.get(self, "branches")
+
+    @property
+    @pulumi.getter(name="fullName")
+    def full_name(self) -> Optional[str]:
+        """
+        The name of the repository.
+        """
+        return pulumi.get(self, "full_name")
+
+    @property
+    @pulumi.getter(name="installationId")
+    def installation_id(self) -> Optional[float]:
+        """
+        The installation id of the repository.
+        """
+        return pulumi.get(self, "installation_id")
+
+    @property
+    @pulumi.getter
+    def url(self) -> Optional[str]:
+        """
+        The url to access the repository.
+        """
+        return pulumi.get(self, "url")
+
+
+@pulumi.output_type
+class SecurityMLAnalyticsSettingsDataSourceResponse(dict):
+    """
+    security ml analytics settings data sources
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "connectorId":
+            suggest = "connector_id"
+        elif key == "dataTypes":
+            suggest = "data_types"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in SecurityMLAnalyticsSettingsDataSourceResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        SecurityMLAnalyticsSettingsDataSourceResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        SecurityMLAnalyticsSettingsDataSourceResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 connector_id: Optional[str] = None,
+                 data_types: Optional[Sequence[str]] = None):
+        """
+        security ml analytics settings data sources
+        :param str connector_id: The connector id that provides the following data types
+        :param Sequence[str] data_types: The data types used by the security ml analytics settings
+        """
+        if connector_id is not None:
+            pulumi.set(__self__, "connector_id", connector_id)
+        if data_types is not None:
+            pulumi.set(__self__, "data_types", data_types)
+
+    @property
+    @pulumi.getter(name="connectorId")
+    def connector_id(self) -> Optional[str]:
+        """
+        The connector id that provides the following data types
+        """
+        return pulumi.get(self, "connector_id")
+
+    @property
+    @pulumi.getter(name="dataTypes")
+    def data_types(self) -> Optional[Sequence[str]]:
+        """
+        The data types used by the security ml analytics settings
+        """
+        return pulumi.get(self, "data_types")
+
+
+@pulumi.output_type
+class SystemDataResponse(dict):
+    """
+    Metadata pertaining to creation and last modification of the resource.
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "createdAt":
+            suggest = "created_at"
+        elif key == "createdBy":
+            suggest = "created_by"
+        elif key == "createdByType":
+            suggest = "created_by_type"
+        elif key == "lastModifiedAt":
+            suggest = "last_modified_at"
+        elif key == "lastModifiedBy":
+            suggest = "last_modified_by"
+        elif key == "lastModifiedByType":
+            suggest = "last_modified_by_type"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in SystemDataResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        SystemDataResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        SystemDataResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 created_at: Optional[str] = None,
+                 created_by: Optional[str] = None,
+                 created_by_type: Optional[str] = None,
+                 last_modified_at: Optional[str] = None,
+                 last_modified_by: Optional[str] = None,
+                 last_modified_by_type: Optional[str] = None):
+        """
+        Metadata pertaining to creation and last modification of the resource.
+        :param str created_at: The timestamp of resource creation (UTC).
+        :param str created_by: The identity that created the resource.
+        :param str created_by_type: The type of identity that created the resource.
+        :param str last_modified_at: The timestamp of resource last modification (UTC)
+        :param str last_modified_by: The identity that last modified the resource.
+        :param str last_modified_by_type: The type of identity that last modified the resource.
+        """
+        if created_at is not None:
+            pulumi.set(__self__, "created_at", created_at)
+        if created_by is not None:
+            pulumi.set(__self__, "created_by", created_by)
+        if created_by_type is not None:
+            pulumi.set(__self__, "created_by_type", created_by_type)
+        if last_modified_at is not None:
+            pulumi.set(__self__, "last_modified_at", last_modified_at)
+        if last_modified_by is not None:
+            pulumi.set(__self__, "last_modified_by", last_modified_by)
+        if last_modified_by_type is not None:
+            pulumi.set(__self__, "last_modified_by_type", last_modified_by_type)
+
+    @property
+    @pulumi.getter(name="createdAt")
+    def created_at(self) -> Optional[str]:
+        """
+        The timestamp of resource creation (UTC).
+        """
+        return pulumi.get(self, "created_at")
+
+    @property
+    @pulumi.getter(name="createdBy")
+    def created_by(self) -> Optional[str]:
+        """
+        The identity that created the resource.
+        """
+        return pulumi.get(self, "created_by")
+
+    @property
+    @pulumi.getter(name="createdByType")
+    def created_by_type(self) -> Optional[str]:
+        """
+        The type of identity that created the resource.
+        """
+        return pulumi.get(self, "created_by_type")
+
+    @property
+    @pulumi.getter(name="lastModifiedAt")
+    def last_modified_at(self) -> Optional[str]:
+        """
+        The timestamp of resource last modification (UTC)
+        """
+        return pulumi.get(self, "last_modified_at")
+
+    @property
+    @pulumi.getter(name="lastModifiedBy")
+    def last_modified_by(self) -> Optional[str]:
+        """
+        The identity that last modified the resource.
+        """
+        return pulumi.get(self, "last_modified_by")
+
+    @property
+    @pulumi.getter(name="lastModifiedByType")
+    def last_modified_by_type(self) -> Optional[str]:
+        """
+        The type of identity that last modified the resource.
+        """
+        return pulumi.get(self, "last_modified_by_type")
+
+
+@pulumi.output_type
+class TIDataConnectorDataTypesResponse(dict):
+    """
+    The available data types for TI (Threat Intelligence) data connector.
+    """
+    def __init__(__self__, *,
+                 indicators: Optional['outputs.TIDataConnectorDataTypesResponseIndicators'] = None):
+        """
+        The available data types for TI (Threat Intelligence) data connector.
+        :param 'TIDataConnectorDataTypesResponseIndicators' indicators: Data type for indicators connection.
+        """
+        if indicators is not None:
+            pulumi.set(__self__, "indicators", indicators)
+
+    @property
+    @pulumi.getter
+    def indicators(self) -> Optional['outputs.TIDataConnectorDataTypesResponseIndicators']:
+        """
+        Data type for indicators connection.
+        """
+        return pulumi.get(self, "indicators")
+
+
+@pulumi.output_type
+class TIDataConnectorDataTypesResponseIndicators(dict):
+    """
+    Data type for indicators connection.
+    """
+    def __init__(__self__, *,
+                 state: Optional[str] = None):
+        """
+        Data type for indicators connection.
+        :param str state: Describe whether this data type connection is enabled or not.
+        """
+        if state is not None:
+            pulumi.set(__self__, "state", state)
+
+    @property
+    @pulumi.getter
+    def state(self) -> Optional[str]:
+        """
+        Describe whether this data type connection is enabled or not.
+        """
+        return pulumi.get(self, "state")
+
+
+@pulumi.output_type
+class TemplatePropertiesResponse(dict):
+    """
+    Template property bag.
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "contentId":
+            suggest = "content_id"
+        elif key == "contentKind":
+            suggest = "content_kind"
+        elif key == "contentProductId":
+            suggest = "content_product_id"
+        elif key == "dependantTemplates":
+            suggest = "dependant_templates"
+        elif key == "displayName":
+            suggest = "display_name"
+        elif key == "isDeprecated":
+            suggest = "is_deprecated"
+        elif key == "packageId":
+            suggest = "package_id"
+        elif key == "packageVersion":
+            suggest = "package_version"
+        elif key == "contentSchemaVersion":
+            suggest = "content_schema_version"
+        elif key == "customVersion":
+            suggest = "custom_version"
+        elif key == "firstPublishDate":
+            suggest = "first_publish_date"
+        elif key == "lastPublishDate":
+            suggest = "last_publish_date"
+        elif key == "mainTemplate":
+            suggest = "main_template"
+        elif key == "packageKind":
+            suggest = "package_kind"
+        elif key == "packageName":
+            suggest = "package_name"
+        elif key == "previewImages":
+            suggest = "preview_images"
+        elif key == "previewImagesDark":
+            suggest = "preview_images_dark"
+        elif key == "threatAnalysisTactics":
+            suggest = "threat_analysis_tactics"
+        elif key == "threatAnalysisTechniques":
+            suggest = "threat_analysis_techniques"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in TemplatePropertiesResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        TemplatePropertiesResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        TemplatePropertiesResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 content_id: str,
+                 content_kind: str,
+                 content_product_id: str,
+                 dependant_templates: Sequence['outputs.TemplatePropertiesResponse'],
+                 display_name: str,
+                 is_deprecated: str,
+                 package_id: str,
+                 package_version: str,
+                 source: 'outputs.MetadataSourceResponse',
+                 version: str,
+                 author: Optional['outputs.MetadataAuthorResponse'] = None,
+                 categories: Optional['outputs.MetadataCategoriesResponse'] = None,
+                 content_schema_version: Optional[str] = None,
+                 custom_version: Optional[str] = None,
+                 dependencies: Optional['outputs.MetadataDependenciesResponse'] = None,
+                 first_publish_date: Optional[str] = None,
+                 icon: Optional[str] = None,
+                 last_publish_date: Optional[str] = None,
+                 main_template: Optional[Any] = None,
+                 package_kind: Optional[str] = None,
+                 package_name: Optional[str] = None,
+                 preview_images: Optional[Sequence[str]] = None,
+                 preview_images_dark: Optional[Sequence[str]] = None,
+                 providers: Optional[Sequence[str]] = None,
+                 support: Optional['outputs.MetadataSupportResponse'] = None,
+                 threat_analysis_tactics: Optional[Sequence[str]] = None,
+                 threat_analysis_techniques: Optional[Sequence[str]] = None):
+        """
+        Template property bag.
+        :param str content_id: Static ID for the content.  Used to identify dependencies and content from solutions or community.  Hard-coded/static for out of the box content and solutions. Dynamic for user-created.  This is the resource name
+        :param str content_kind: The kind of content the template is for.
+        :param str content_product_id: Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template
+        :param Sequence['TemplatePropertiesResponse'] dependant_templates: Dependant templates. Expandable.
+        :param str display_name: The display name of the template
+        :param str is_deprecated: Flag indicates if this template is deprecated
+        :param str package_id: the package Id contains this template
+        :param str package_version: Version of the package.  Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices.  Can also be any string, but then we cannot guarantee any version checks
+        :param 'MetadataSourceResponse' source: Source of the content.  This is where/how it was created.
+        :param str version: Version of the content.  Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices.  Can also be any string, but then we cannot guarantee any version checks
+        :param 'MetadataAuthorResponse' author: The creator of the content item.
+        :param 'MetadataCategoriesResponse' categories: Categories for the item
+        :param str content_schema_version: Schema version of the content. Can be used to distinguish between different flow based on the schema version
+        :param str custom_version: The custom version of the content. A optional free text
+        :param 'MetadataDependenciesResponse' dependencies: Dependencies for the content item, what other content items it requires to work.  Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
+        :param str first_publish_date: first publish date content item
+        :param str icon: the icon identifier. this id can later be fetched from the content metadata
+        :param str last_publish_date: last publish date for the content item
+        :param Any main_template: The JSON of the ARM template to deploy active content. Expandable.
+        :param str package_kind: the packageKind of the package contains this template
+        :param str package_name: the name of the package contains this template
+        :param Sequence[str] preview_images: preview image file names. These will be taken from the solution artifacts
+        :param Sequence[str] preview_images_dark: preview image file names. These will be taken from the solution artifacts. used for dark theme support
+        :param Sequence[str] providers: Providers for the content item
+        :param 'MetadataSupportResponse' support: Support information for the template - type, name, contact information
+        :param Sequence[str] threat_analysis_tactics: the tactics the resource covers
+        :param Sequence[str] threat_analysis_techniques: the techniques the resource covers, these have to be aligned with the tactics being used
+        """
+        pulumi.set(__self__, "content_id", content_id)
+        pulumi.set(__self__, "content_kind", content_kind)
+        pulumi.set(__self__, "content_product_id", content_product_id)
+        pulumi.set(__self__, "dependant_templates", dependant_templates)
+        pulumi.set(__self__, "display_name", display_name)
+        pulumi.set(__self__, "is_deprecated", is_deprecated)
+        pulumi.set(__self__, "package_id", package_id)
+        pulumi.set(__self__, "package_version", package_version)
+        pulumi.set(__self__, "source", source)
+        pulumi.set(__self__, "version", version)
+        if author is not None:
+            pulumi.set(__self__, "author", author)
+        if categories is not None:
+            pulumi.set(__self__, "categories", categories)
+        if content_schema_version is not None:
+            pulumi.set(__self__, "content_schema_version", content_schema_version)
+        if custom_version is not None:
+            pulumi.set(__self__, "custom_version", custom_version)
+        if dependencies is not None:
+            pulumi.set(__self__, "dependencies", dependencies)
+        if first_publish_date is not None:
+            pulumi.set(__self__, "first_publish_date", first_publish_date)
+        if icon is not None:
+            pulumi.set(__self__, "icon", icon)
+        if last_publish_date is not None:
+            pulumi.set(__self__, "last_publish_date", last_publish_date)
+        if main_template is not None:
+            pulumi.set(__self__, "main_template", main_template)
+        if package_kind is not None:
+            pulumi.set(__self__, "package_kind", package_kind)
+        if package_name is not None:
+            pulumi.set(__self__, "package_name", package_name)
+        if preview_images is not None:
+            pulumi.set(__self__, "preview_images", preview_images)
+        if preview_images_dark is not None:
+            pulumi.set(__self__, "preview_images_dark", preview_images_dark)
+        if providers is not None:
+            pulumi.set(__self__, "providers", providers)
+        if support is not None:
+            pulumi.set(__self__, "support", support)
+        if threat_analysis_tactics is not None:
+            pulumi.set(__self__, "threat_analysis_tactics", threat_analysis_tactics)
+        if threat_analysis_techniques is not None:
+            pulumi.set(__self__, "threat_analysis_techniques", threat_analysis_techniques)
+
+    @property
+    @pulumi.getter(name="contentId")
+    def content_id(self) -> str:
+        """
+        Static ID for the content.  Used to identify dependencies and content from solutions or community.  Hard-coded/static for out of the box content and solutions. Dynamic for user-created.  This is the resource name
+        """
+        return pulumi.get(self, "content_id")
+
+    @property
+    @pulumi.getter(name="contentKind")
+    def content_kind(self) -> str:
+        """
+        The kind of content the template is for.
+        """
+        return pulumi.get(self, "content_kind")
+
+    @property
+    @pulumi.getter(name="contentProductId")
+    def content_product_id(self) -> str:
+        """
+        Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template
+        """
+        return pulumi.get(self, "content_product_id")
+
+    @property
+    @pulumi.getter(name="dependantTemplates")
+    def dependant_templates(self) -> Sequence['outputs.TemplatePropertiesResponse']:
+        """
+        Dependant templates. Expandable.
+        """
+        return pulumi.get(self, "dependant_templates")
+
+    @property
+    @pulumi.getter(name="displayName")
+    def display_name(self) -> str:
+        """
+        The display name of the template
+        """
+        return pulumi.get(self, "display_name")
+
+    @property
+    @pulumi.getter(name="isDeprecated")
+    def is_deprecated(self) -> str:
+        """
+        Flag indicates if this template is deprecated
+        """
+        return pulumi.get(self, "is_deprecated")
+
+    @property
+    @pulumi.getter(name="packageId")
+    def package_id(self) -> str:
+        """
+        the package Id contains this template
+        """
+        return pulumi.get(self, "package_id")
+
+    @property
+    @pulumi.getter(name="packageVersion")
+    def package_version(self) -> str:
+        """
+        Version of the package.  Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices.  Can also be any string, but then we cannot guarantee any version checks
+        """
+        return pulumi.get(self, "package_version")
+
+    @property
+    @pulumi.getter
+    def source(self) -> 'outputs.MetadataSourceResponse':
+        """
+        Source of the content.  This is where/how it was created.
+        """
+        return pulumi.get(self, "source")
+
+    @property
+    @pulumi.getter
+    def version(self) -> str:
+        """
+        Version of the content.  Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices.  Can also be any string, but then we cannot guarantee any version checks
+        """
+        return pulumi.get(self, "version")
+
+    @property
+    @pulumi.getter
+    def author(self) -> Optional['outputs.MetadataAuthorResponse']:
+        """
+        The creator of the content item.
+        """
+        return pulumi.get(self, "author")
+
+    @property
+    @pulumi.getter
+    def categories(self) -> Optional['outputs.MetadataCategoriesResponse']:
+        """
+        Categories for the item
+        """
+        return pulumi.get(self, "categories")
+
+    @property
+    @pulumi.getter(name="contentSchemaVersion")
+    def content_schema_version(self) -> Optional[str]:
+        """
+        Schema version of the content. Can be used to distinguish between different flow based on the schema version
+        """
+        return pulumi.get(self, "content_schema_version")
+
+    @property
+    @pulumi.getter(name="customVersion")
+    def custom_version(self) -> Optional[str]:
+        """
+        The custom version of the content. A optional free text
+        """
+        return pulumi.get(self, "custom_version")
+
+    @property
+    @pulumi.getter
+    def dependencies(self) -> Optional['outputs.MetadataDependenciesResponse']:
+        """
+        Dependencies for the content item, what other content items it requires to work.  Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
+        """
+        return pulumi.get(self, "dependencies")
+
+    @property
+    @pulumi.getter(name="firstPublishDate")
+    def first_publish_date(self) -> Optional[str]:
+        """
+        first publish date content item
+        """
+        return pulumi.get(self, "first_publish_date")
+
+    @property
+    @pulumi.getter
+    def icon(self) -> Optional[str]:
+        """
+        the icon identifier. this id can later be fetched from the content metadata
+        """
+        return pulumi.get(self, "icon")
+
+    @property
+    @pulumi.getter(name="lastPublishDate")
+    def last_publish_date(self) -> Optional[str]:
+        """
+        last publish date for the content item
+        """
+        return pulumi.get(self, "last_publish_date")
+
+    @property
+    @pulumi.getter(name="mainTemplate")
+    def main_template(self) -> Optional[Any]:
+        """
+        The JSON of the ARM template to deploy active content. Expandable.
+        """
+        return pulumi.get(self, "main_template")
+
+    @property
+    @pulumi.getter(name="packageKind")
+    def package_kind(self) -> Optional[str]:
+        """
+        the packageKind of the package contains this template
+        """
+        return pulumi.get(self, "package_kind")
+
+    @property
+    @pulumi.getter(name="packageName")
+    def package_name(self) -> Optional[str]:
+        """
+        the name of the package contains this template
+        """
+        return pulumi.get(self, "package_name")
+
+    @property
+    @pulumi.getter(name="previewImages")
+    def preview_images(self) -> Optional[Sequence[str]]:
+        """
+        preview image file names. These will be taken from the solution artifacts
+        """
+        return pulumi.get(self, "preview_images")
+
+    @property
+    @pulumi.getter(name="previewImagesDark")
+    def preview_images_dark(self) -> Optional[Sequence[str]]:
+        """
+        preview image file names. These will be taken from the solution artifacts. used for dark theme support
+        """
+        return pulumi.get(self, "preview_images_dark")
+
+    @property
+    @pulumi.getter
+    def providers(self) -> Optional[Sequence[str]]:
+        """
+        Providers for the content item
+        """
+        return pulumi.get(self, "providers")
+
+    @property
+    @pulumi.getter
+    def support(self) -> Optional['outputs.MetadataSupportResponse']:
+        """
+        Support information for the template - type, name, contact information
+        """
+        return pulumi.get(self, "support")
+
+    @property
+    @pulumi.getter(name="threatAnalysisTactics")
+    def threat_analysis_tactics(self) -> Optional[Sequence[str]]:
+        """
+        the tactics the resource covers
+        """
+        return pulumi.get(self, "threat_analysis_tactics")
+
+    @property
+    @pulumi.getter(name="threatAnalysisTechniques")
+    def threat_analysis_techniques(self) -> Optional[Sequence[str]]:
+        """
+        the techniques the resource covers, these have to be aligned with the tactics being used
+        """
+        return pulumi.get(self, "threat_analysis_techniques")
+
+
+@pulumi.output_type
+class UserInfoResponse(dict):
+    """
+    User information that made some action
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "objectId":
+            suggest = "object_id"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in UserInfoResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        UserInfoResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        UserInfoResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 email: str,
+                 name: str,
+                 object_id: Optional[str] = None):
+        """
+        User information that made some action
+        :param str email: The email of the user.
+        :param str name: The name of the user.
+        :param str object_id: The object id of the user.
+        """
+        pulumi.set(__self__, "email", email)
+        pulumi.set(__self__, "name", name)
+        if object_id is not None:
+            pulumi.set(__self__, "object_id", object_id)
+
+    @property
+    @pulumi.getter
+    def email(self) -> str:
+        """
+        The email of the user.
+        """
+        return pulumi.get(self, "email")
+
+    @property
+    @pulumi.getter
+    def name(self) -> str:
+        """
+        The name of the user.
+        """
+        return pulumi.get(self, "name")
+
+    @property
+    @pulumi.getter(name="objectId")
+    def object_id(self) -> Optional[str]:
+        """
+        The object id of the user.
+        """
+        return pulumi.get(self, "object_id")
+
+
+@pulumi.output_type
+class WatchlistUserInfoResponse(dict):
+    """
+    User information that made some action
+    """
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "objectId":
+            suggest = "object_id"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in WatchlistUserInfoResponse. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        WatchlistUserInfoResponse.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        WatchlistUserInfoResponse.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 email: str,
+                 name: str,
+                 object_id: Optional[str] = None):
+        """
+        User information that made some action
+        :param str email: The email of the user.
+        :param str name: The name of the user.
+        :param str object_id: The object id of the user.
+        """
+        pulumi.set(__self__, "email", email)
+        pulumi.set(__self__, "name", name)
+        if object_id is not None:
+            pulumi.set(__self__, "object_id", object_id)
+
+    @property
+    @pulumi.getter
+    def email(self) -> str:
+        """
+        The email of the user.
+        """
+        return pulumi.get(self, "email")
+
+    @property
+    @pulumi.getter
+    def name(self) -> str:
+        """
+        The name of the user.
+        """
+        return pulumi.get(self, "name")
+
+    @property
+    @pulumi.getter(name="objectId")
+    def object_id(self) -> Optional[str]:
+        """
+        The object id of the user.
+        """
+        return pulumi.get(self, "object_id")
+
+