PyPI - pulumi-azure-native - Versions diffs - 2.82.0__py3-none-any.whl → 2.82.0a1736432194__py3-none-any.whl - Mend - Supply Chain Defender

pulumi-azure-native 2.82.0py3-none-any.whl → 2.82.0a1736432194py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of pulumi-azure-native might be problematic. Click here for more details.

Files changed (940) hide show

pulumi_azure_native/securityinsights/v20241001preview/nrt_alert_rule.py DELETED Viewed

@@ -1,774 +0,0 @@
-# coding=utf-8
-# *** WARNING: this file was generated by pulumi-language-python. ***
-# *** Do not edit by hand unless you're certain you know what you are doing! ***
-import copy
-import warnings
-import sys
-import pulumi
-import pulumi.runtime
-from typing import Any, Mapping, Optional, Sequence, Union, overload
-if sys.version_info >= (3, 11):
-    from typing import NotRequired, TypedDict, TypeAlias
-else:
-    from typing_extensions import NotRequired, TypedDict, TypeAlias
-from ... import _utilities
-from . import outputs
-from ._enums import *
-from ._inputs import *
-__all__ = ['NrtAlertRuleArgs', 'NrtAlertRule']
-@pulumi.input_type
-class NrtAlertRuleArgs:
-    def __init__(__self__, *,
-                 display_name: pulumi.Input[str],
-                 enabled: pulumi.Input[bool],
-                 kind: pulumi.Input[str],
-                 query: pulumi.Input[str],
-                 resource_group_name: pulumi.Input[str],
-                 severity: pulumi.Input[Union[str, 'AlertSeverity']],
-                 suppression_duration: pulumi.Input[str],
-                 suppression_enabled: pulumi.Input[bool],
-                 workspace_name: pulumi.Input[str],
-                 alert_details_override: Optional[pulumi.Input['AlertDetailsOverrideArgs']] = None,
-                 alert_rule_template_name: Optional[pulumi.Input[str]] = None,
-                 custom_details: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
-                 description: Optional[pulumi.Input[str]] = None,
-                 entity_mappings: Optional[pulumi.Input[Sequence[pulumi.Input['EntityMappingArgs']]]] = None,
-                 event_grouping_settings: Optional[pulumi.Input['EventGroupingSettingsArgs']] = None,
-                 incident_configuration: Optional[pulumi.Input['IncidentConfigurationArgs']] = None,
-                 rule_id: Optional[pulumi.Input[str]] = None,
-                 sentinel_entities_mappings: Optional[pulumi.Input[Sequence[pulumi.Input['SentinelEntityMappingArgs']]]] = None,
-                 sub_techniques: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 tactics: Optional[pulumi.Input[Sequence[pulumi.Input[Union[str, 'AttackTactic']]]]] = None,
-                 techniques: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 template_version: Optional[pulumi.Input[str]] = None):
-        """
-        The set of arguments for constructing a NrtAlertRule resource.
-        :param pulumi.Input[str] display_name: The display name for alerts created by this alert rule.
-        :param pulumi.Input[bool] enabled: Determines whether this alert rule is enabled or disabled.
-        :param pulumi.Input[str] kind: The kind of the alert rule
-               Expected value is 'NRT'.
-        :param pulumi.Input[str] query: The query that creates alerts for this rule.
-        :param pulumi.Input[str] resource_group_name: The name of the resource group. The name is case insensitive.
-        :param pulumi.Input[Union[str, 'AlertSeverity']] severity: The severity for alerts created by this alert rule.
-        :param pulumi.Input[str] suppression_duration: The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.
-        :param pulumi.Input[bool] suppression_enabled: Determines whether the suppression for this alert rule is enabled or disabled.
-        :param pulumi.Input[str] workspace_name: The name of the workspace.
-        :param pulumi.Input['AlertDetailsOverrideArgs'] alert_details_override: The alert details override settings
-        :param pulumi.Input[str] alert_rule_template_name: The Name of the alert rule template used to create this rule.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] custom_details: Dictionary of string key-value pairs of columns to be attached to the alert
-        :param pulumi.Input[str] description: The description of the alert rule.
-        :param pulumi.Input[Sequence[pulumi.Input['EntityMappingArgs']]] entity_mappings: Array of the entity mappings of the alert rule
-        :param pulumi.Input['EventGroupingSettingsArgs'] event_grouping_settings: The event grouping settings.
-        :param pulumi.Input['IncidentConfigurationArgs'] incident_configuration: The settings of the incidents that created from alerts triggered by this analytics rule
-        :param pulumi.Input[str] rule_id: Alert rule ID
-        :param pulumi.Input[Sequence[pulumi.Input['SentinelEntityMappingArgs']]] sentinel_entities_mappings: Array of the sentinel entity mappings of the alert rule
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] sub_techniques: The sub-techniques of the alert rule
-        :param pulumi.Input[Sequence[pulumi.Input[Union[str, 'AttackTactic']]]] tactics: The tactics of the alert rule
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] techniques: The techniques of the alert rule
-        :param pulumi.Input[str] template_version: The version of the alert rule template used to create this rule - in format <a.b.c>, where all are numbers, for example 0 <1.0.2>
-        """
-        pulumi.set(__self__, "display_name", display_name)
-        pulumi.set(__self__, "enabled", enabled)
-        pulumi.set(__self__, "kind", 'NRT')
-        pulumi.set(__self__, "query", query)
-        pulumi.set(__self__, "resource_group_name", resource_group_name)
-        pulumi.set(__self__, "severity", severity)
-        pulumi.set(__self__, "suppression_duration", suppression_duration)
-        pulumi.set(__self__, "suppression_enabled", suppression_enabled)
-        pulumi.set(__self__, "workspace_name", workspace_name)
-        if alert_details_override is not None:
-            pulumi.set(__self__, "alert_details_override", alert_details_override)
-        if alert_rule_template_name is not None:
-            pulumi.set(__self__, "alert_rule_template_name", alert_rule_template_name)
-        if custom_details is not None:
-            pulumi.set(__self__, "custom_details", custom_details)
-        if description is not None:
-            pulumi.set(__self__, "description", description)
-        if entity_mappings is not None:
-            pulumi.set(__self__, "entity_mappings", entity_mappings)
-        if event_grouping_settings is not None:
-            pulumi.set(__self__, "event_grouping_settings", event_grouping_settings)
-        if incident_configuration is not None:
-            pulumi.set(__self__, "incident_configuration", incident_configuration)
-        if rule_id is not None:
-            pulumi.set(__self__, "rule_id", rule_id)
-        if sentinel_entities_mappings is not None:
-            pulumi.set(__self__, "sentinel_entities_mappings", sentinel_entities_mappings)
-        if sub_techniques is not None:
-            pulumi.set(__self__, "sub_techniques", sub_techniques)
-        if tactics is not None:
-            pulumi.set(__self__, "tactics", tactics)
-        if techniques is not None:
-            pulumi.set(__self__, "techniques", techniques)
-        if template_version is not None:
-            pulumi.set(__self__, "template_version", template_version)
-    @property
-    @pulumi.getter(name="displayName")
-    def display_name(self) -> pulumi.Input[str]:
-        """
-        The display name for alerts created by this alert rule.
-        """
-        return pulumi.get(self, "display_name")
-    @display_name.setter
-    def display_name(self, value: pulumi.Input[str]):
-        pulumi.set(self, "display_name", value)
-    @property
-    @pulumi.getter
-    def enabled(self) -> pulumi.Input[bool]:
-        """
-        Determines whether this alert rule is enabled or disabled.
-        """
-        return pulumi.get(self, "enabled")
-    @enabled.setter
-    def enabled(self, value: pulumi.Input[bool]):
-        pulumi.set(self, "enabled", value)
-    @property
-    @pulumi.getter
-    def kind(self) -> pulumi.Input[str]:
-        """
-        The kind of the alert rule
-        Expected value is 'NRT'.
-        """
-        return pulumi.get(self, "kind")
-    @kind.setter
-    def kind(self, value: pulumi.Input[str]):
-        pulumi.set(self, "kind", value)
-    @property
-    @pulumi.getter
-    def query(self) -> pulumi.Input[str]:
-        """
-        The query that creates alerts for this rule.
-        """
-        return pulumi.get(self, "query")
-    @query.setter
-    def query(self, value: pulumi.Input[str]):
-        pulumi.set(self, "query", value)
-    @property
-    @pulumi.getter(name="resourceGroupName")
-    def resource_group_name(self) -> pulumi.Input[str]:
-        """
-        The name of the resource group. The name is case insensitive.
-        """
-        return pulumi.get(self, "resource_group_name")
-    @resource_group_name.setter
-    def resource_group_name(self, value: pulumi.Input[str]):
-        pulumi.set(self, "resource_group_name", value)
-    @property
-    @pulumi.getter
-    def severity(self) -> pulumi.Input[Union[str, 'AlertSeverity']]:
-        """
-        The severity for alerts created by this alert rule.
-        """
-        return pulumi.get(self, "severity")
-    @severity.setter
-    def severity(self, value: pulumi.Input[Union[str, 'AlertSeverity']]):
-        pulumi.set(self, "severity", value)
-    @property
-    @pulumi.getter(name="suppressionDuration")
-    def suppression_duration(self) -> pulumi.Input[str]:
-        """
-        The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.
-        """
-        return pulumi.get(self, "suppression_duration")
-    @suppression_duration.setter
-    def suppression_duration(self, value: pulumi.Input[str]):
-        pulumi.set(self, "suppression_duration", value)
-    @property
-    @pulumi.getter(name="suppressionEnabled")
-    def suppression_enabled(self) -> pulumi.Input[bool]:
-        """
-        Determines whether the suppression for this alert rule is enabled or disabled.
-        """
-        return pulumi.get(self, "suppression_enabled")
-    @suppression_enabled.setter
-    def suppression_enabled(self, value: pulumi.Input[bool]):
-        pulumi.set(self, "suppression_enabled", value)
-    @property
-    @pulumi.getter(name="workspaceName")
-    def workspace_name(self) -> pulumi.Input[str]:
-        """
-        The name of the workspace.
-        """
-        return pulumi.get(self, "workspace_name")
-    @workspace_name.setter
-    def workspace_name(self, value: pulumi.Input[str]):
-        pulumi.set(self, "workspace_name", value)
-    @property
-    @pulumi.getter(name="alertDetailsOverride")
-    def alert_details_override(self) -> Optional[pulumi.Input['AlertDetailsOverrideArgs']]:
-        """
-        The alert details override settings
-        """
-        return pulumi.get(self, "alert_details_override")
-    @alert_details_override.setter
-    def alert_details_override(self, value: Optional[pulumi.Input['AlertDetailsOverrideArgs']]):
-        pulumi.set(self, "alert_details_override", value)
-    @property
-    @pulumi.getter(name="alertRuleTemplateName")
-    def alert_rule_template_name(self) -> Optional[pulumi.Input[str]]:
-        """
-        The Name of the alert rule template used to create this rule.
-        """
-        return pulumi.get(self, "alert_rule_template_name")
-    @alert_rule_template_name.setter
-    def alert_rule_template_name(self, value: Optional[pulumi.Input[str]]):
-        pulumi.set(self, "alert_rule_template_name", value)
-    @property
-    @pulumi.getter(name="customDetails")
-    def custom_details(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
-        """
-        Dictionary of string key-value pairs of columns to be attached to the alert
-        """
-        return pulumi.get(self, "custom_details")
-    @custom_details.setter
-    def custom_details(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
-        pulumi.set(self, "custom_details", value)
-    @property
-    @pulumi.getter
-    def description(self) -> Optional[pulumi.Input[str]]:
-        """
-        The description of the alert rule.
-        """
-        return pulumi.get(self, "description")
-    @description.setter
-    def description(self, value: Optional[pulumi.Input[str]]):
-        pulumi.set(self, "description", value)
-    @property
-    @pulumi.getter(name="entityMappings")
-    def entity_mappings(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['EntityMappingArgs']]]]:
-        """
-        Array of the entity mappings of the alert rule
-        """
-        return pulumi.get(self, "entity_mappings")
-    @entity_mappings.setter
-    def entity_mappings(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['EntityMappingArgs']]]]):
-        pulumi.set(self, "entity_mappings", value)
-    @property
-    @pulumi.getter(name="eventGroupingSettings")
-    def event_grouping_settings(self) -> Optional[pulumi.Input['EventGroupingSettingsArgs']]:
-        """
-        The event grouping settings.
-        """
-        return pulumi.get(self, "event_grouping_settings")
-    @event_grouping_settings.setter
-    def event_grouping_settings(self, value: Optional[pulumi.Input['EventGroupingSettingsArgs']]):
-        pulumi.set(self, "event_grouping_settings", value)
-    @property
-    @pulumi.getter(name="incidentConfiguration")
-    def incident_configuration(self) -> Optional[pulumi.Input['IncidentConfigurationArgs']]:
-        """
-        The settings of the incidents that created from alerts triggered by this analytics rule
-        """
-        return pulumi.get(self, "incident_configuration")
-    @incident_configuration.setter
-    def incident_configuration(self, value: Optional[pulumi.Input['IncidentConfigurationArgs']]):
-        pulumi.set(self, "incident_configuration", value)
-    @property
-    @pulumi.getter(name="ruleId")
-    def rule_id(self) -> Optional[pulumi.Input[str]]:
-        """
-        Alert rule ID
-        """
-        return pulumi.get(self, "rule_id")
-    @rule_id.setter
-    def rule_id(self, value: Optional[pulumi.Input[str]]):
-        pulumi.set(self, "rule_id", value)
-    @property
-    @pulumi.getter(name="sentinelEntitiesMappings")
-    def sentinel_entities_mappings(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['SentinelEntityMappingArgs']]]]:
-        """
-        Array of the sentinel entity mappings of the alert rule
-        """
-        return pulumi.get(self, "sentinel_entities_mappings")
-    @sentinel_entities_mappings.setter
-    def sentinel_entities_mappings(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['SentinelEntityMappingArgs']]]]):
-        pulumi.set(self, "sentinel_entities_mappings", value)
-    @property
-    @pulumi.getter(name="subTechniques")
-    def sub_techniques(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
-        """
-        The sub-techniques of the alert rule
-        """
-        return pulumi.get(self, "sub_techniques")
-    @sub_techniques.setter
-    def sub_techniques(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
-        pulumi.set(self, "sub_techniques", value)
-    @property
-    @pulumi.getter
-    def tactics(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[Union[str, 'AttackTactic']]]]]:
-        """
-        The tactics of the alert rule
-        """
-        return pulumi.get(self, "tactics")
-    @tactics.setter
-    def tactics(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[Union[str, 'AttackTactic']]]]]):
-        pulumi.set(self, "tactics", value)
-    @property
-    @pulumi.getter
-    def techniques(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
-        """
-        The techniques of the alert rule
-        """
-        return pulumi.get(self, "techniques")
-    @techniques.setter
-    def techniques(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
-        pulumi.set(self, "techniques", value)
-    @property
-    @pulumi.getter(name="templateVersion")
-    def template_version(self) -> Optional[pulumi.Input[str]]:
-        """
-        The version of the alert rule template used to create this rule - in format <a.b.c>, where all are numbers, for example 0 <1.0.2>
-        """
-        return pulumi.get(self, "template_version")
-    @template_version.setter
-    def template_version(self, value: Optional[pulumi.Input[str]]):
-        pulumi.set(self, "template_version", value)
-class NrtAlertRule(pulumi.CustomResource):
-    @overload
-    def __init__(__self__,
-                 resource_name: str,
-                 opts: Optional[pulumi.ResourceOptions] = None,
-                 alert_details_override: Optional[pulumi.Input[Union['AlertDetailsOverrideArgs', 'AlertDetailsOverrideArgsDict']]] = None,
-                 alert_rule_template_name: Optional[pulumi.Input[str]] = None,
-                 custom_details: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
-                 description: Optional[pulumi.Input[str]] = None,
-                 display_name: Optional[pulumi.Input[str]] = None,
-                 enabled: Optional[pulumi.Input[bool]] = None,
-                 entity_mappings: Optional[pulumi.Input[Sequence[pulumi.Input[Union['EntityMappingArgs', 'EntityMappingArgsDict']]]]] = None,
-                 event_grouping_settings: Optional[pulumi.Input[Union['EventGroupingSettingsArgs', 'EventGroupingSettingsArgsDict']]] = None,
-                 incident_configuration: Optional[pulumi.Input[Union['IncidentConfigurationArgs', 'IncidentConfigurationArgsDict']]] = None,
-                 kind: Optional[pulumi.Input[str]] = None,
-                 query: Optional[pulumi.Input[str]] = None,
-                 resource_group_name: Optional[pulumi.Input[str]] = None,
-                 rule_id: Optional[pulumi.Input[str]] = None,
-                 sentinel_entities_mappings: Optional[pulumi.Input[Sequence[pulumi.Input[Union['SentinelEntityMappingArgs', 'SentinelEntityMappingArgsDict']]]]] = None,
-                 severity: Optional[pulumi.Input[Union[str, 'AlertSeverity']]] = None,
-                 sub_techniques: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 suppression_duration: Optional[pulumi.Input[str]] = None,
-                 suppression_enabled: Optional[pulumi.Input[bool]] = None,
-                 tactics: Optional[pulumi.Input[Sequence[pulumi.Input[Union[str, 'AttackTactic']]]]] = None,
-                 techniques: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 template_version: Optional[pulumi.Input[str]] = None,
-                 workspace_name: Optional[pulumi.Input[str]] = None,
-                 __props__=None):
-        """
-        Represents NRT alert rule.
-        :param str resource_name: The name of the resource.
-        :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[Union['AlertDetailsOverrideArgs', 'AlertDetailsOverrideArgsDict']] alert_details_override: The alert details override settings
-        :param pulumi.Input[str] alert_rule_template_name: The Name of the alert rule template used to create this rule.
-        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] custom_details: Dictionary of string key-value pairs of columns to be attached to the alert
-        :param pulumi.Input[str] description: The description of the alert rule.
-        :param pulumi.Input[str] display_name: The display name for alerts created by this alert rule.
-        :param pulumi.Input[bool] enabled: Determines whether this alert rule is enabled or disabled.
-        :param pulumi.Input[Sequence[pulumi.Input[Union['EntityMappingArgs', 'EntityMappingArgsDict']]]] entity_mappings: Array of the entity mappings of the alert rule
-        :param pulumi.Input[Union['EventGroupingSettingsArgs', 'EventGroupingSettingsArgsDict']] event_grouping_settings: The event grouping settings.
-        :param pulumi.Input[Union['IncidentConfigurationArgs', 'IncidentConfigurationArgsDict']] incident_configuration: The settings of the incidents that created from alerts triggered by this analytics rule
-        :param pulumi.Input[str] kind: The kind of the alert rule
-               Expected value is 'NRT'.
-        :param pulumi.Input[str] query: The query that creates alerts for this rule.
-        :param pulumi.Input[str] resource_group_name: The name of the resource group. The name is case insensitive.
-        :param pulumi.Input[str] rule_id: Alert rule ID
-        :param pulumi.Input[Sequence[pulumi.Input[Union['SentinelEntityMappingArgs', 'SentinelEntityMappingArgsDict']]]] sentinel_entities_mappings: Array of the sentinel entity mappings of the alert rule
-        :param pulumi.Input[Union[str, 'AlertSeverity']] severity: The severity for alerts created by this alert rule.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] sub_techniques: The sub-techniques of the alert rule
-        :param pulumi.Input[str] suppression_duration: The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.
-        :param pulumi.Input[bool] suppression_enabled: Determines whether the suppression for this alert rule is enabled or disabled.
-        :param pulumi.Input[Sequence[pulumi.Input[Union[str, 'AttackTactic']]]] tactics: The tactics of the alert rule
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] techniques: The techniques of the alert rule
-        :param pulumi.Input[str] template_version: The version of the alert rule template used to create this rule - in format <a.b.c>, where all are numbers, for example 0 <1.0.2>
-        :param pulumi.Input[str] workspace_name: The name of the workspace.
-        """
-        ...
-    @overload
-    def __init__(__self__,
-                 resource_name: str,
-                 args: NrtAlertRuleArgs,
-                 opts: Optional[pulumi.ResourceOptions] = None):
-        """
-        Represents NRT alert rule.
-        :param str resource_name: The name of the resource.
-        :param NrtAlertRuleArgs args: The arguments to use to populate this resource's properties.
-        :param pulumi.ResourceOptions opts: Options for the resource.
-        """
-        ...
-    def __init__(__self__, resource_name: str, *args, **kwargs):
-        resource_args, opts = _utilities.get_resource_args_opts(NrtAlertRuleArgs, pulumi.ResourceOptions, *args, **kwargs)
-        if resource_args is not None:
-            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
-        else:
-            __self__._internal_init(resource_name, *args, **kwargs)
-    def _internal_init(__self__,
-                 resource_name: str,
-                 opts: Optional[pulumi.ResourceOptions] = None,
-                 alert_details_override: Optional[pulumi.Input[Union['AlertDetailsOverrideArgs', 'AlertDetailsOverrideArgsDict']]] = None,
-                 alert_rule_template_name: Optional[pulumi.Input[str]] = None,
-                 custom_details: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
-                 description: Optional[pulumi.Input[str]] = None,
-                 display_name: Optional[pulumi.Input[str]] = None,
-                 enabled: Optional[pulumi.Input[bool]] = None,
-                 entity_mappings: Optional[pulumi.Input[Sequence[pulumi.Input[Union['EntityMappingArgs', 'EntityMappingArgsDict']]]]] = None,
-                 event_grouping_settings: Optional[pulumi.Input[Union['EventGroupingSettingsArgs', 'EventGroupingSettingsArgsDict']]] = None,
-                 incident_configuration: Optional[pulumi.Input[Union['IncidentConfigurationArgs', 'IncidentConfigurationArgsDict']]] = None,
-                 kind: Optional[pulumi.Input[str]] = None,
-                 query: Optional[pulumi.Input[str]] = None,
-                 resource_group_name: Optional[pulumi.Input[str]] = None,
-                 rule_id: Optional[pulumi.Input[str]] = None,
-                 sentinel_entities_mappings: Optional[pulumi.Input[Sequence[pulumi.Input[Union['SentinelEntityMappingArgs', 'SentinelEntityMappingArgsDict']]]]] = None,
-                 severity: Optional[pulumi.Input[Union[str, 'AlertSeverity']]] = None,
-                 sub_techniques: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 suppression_duration: Optional[pulumi.Input[str]] = None,
-                 suppression_enabled: Optional[pulumi.Input[bool]] = None,
-                 tactics: Optional[pulumi.Input[Sequence[pulumi.Input[Union[str, 'AttackTactic']]]]] = None,
-                 techniques: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 template_version: Optional[pulumi.Input[str]] = None,
-                 workspace_name: Optional[pulumi.Input[str]] = None,
-                 __props__=None):
-        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
-        if not isinstance(opts, pulumi.ResourceOptions):
-            raise TypeError('Expected resource options to be a ResourceOptions instance')
-        if opts.id is None:
-            if __props__ is not None:
-                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
-            __props__ = NrtAlertRuleArgs.__new__(NrtAlertRuleArgs)
-            __props__.__dict__["alert_details_override"] = alert_details_override
-            __props__.__dict__["alert_rule_template_name"] = alert_rule_template_name
-            __props__.__dict__["custom_details"] = custom_details
-            __props__.__dict__["description"] = description
-            if display_name is None and not opts.urn:
-                raise TypeError("Missing required property 'display_name'")
-            __props__.__dict__["display_name"] = display_name
-            if enabled is None and not opts.urn:
-                raise TypeError("Missing required property 'enabled'")
-            __props__.__dict__["enabled"] = enabled
-            __props__.__dict__["entity_mappings"] = entity_mappings
-            __props__.__dict__["event_grouping_settings"] = event_grouping_settings
-            __props__.__dict__["incident_configuration"] = incident_configuration
-            if kind is None and not opts.urn:
-                raise TypeError("Missing required property 'kind'")
-            __props__.__dict__["kind"] = 'NRT'
-            if query is None and not opts.urn:
-                raise TypeError("Missing required property 'query'")
-            __props__.__dict__["query"] = query
-            if resource_group_name is None and not opts.urn:
-                raise TypeError("Missing required property 'resource_group_name'")
-            __props__.__dict__["resource_group_name"] = resource_group_name
-            __props__.__dict__["rule_id"] = rule_id
-            __props__.__dict__["sentinel_entities_mappings"] = sentinel_entities_mappings
-            if severity is None and not opts.urn:
-                raise TypeError("Missing required property 'severity'")
-            __props__.__dict__["severity"] = severity
-            __props__.__dict__["sub_techniques"] = sub_techniques
-            if suppression_duration is None and not opts.urn:
-                raise TypeError("Missing required property 'suppression_duration'")
-            __props__.__dict__["suppression_duration"] = suppression_duration
-            if suppression_enabled is None and not opts.urn:
-                raise TypeError("Missing required property 'suppression_enabled'")
-            __props__.__dict__["suppression_enabled"] = suppression_enabled
-            __props__.__dict__["tactics"] = tactics
-            __props__.__dict__["techniques"] = techniques
-            __props__.__dict__["template_version"] = template_version
-            if workspace_name is None and not opts.urn:
-                raise TypeError("Missing required property 'workspace_name'")
-            __props__.__dict__["workspace_name"] = workspace_name
-            __props__.__dict__["etag"] = None
-            __props__.__dict__["last_modified_utc"] = None
-            __props__.__dict__["name"] = None
-            __props__.__dict__["system_data"] = None
-            __props__.__dict__["type"] = None
-        alias_opts = pulumi.ResourceOptions(aliases=[pulumi.Alias(type_="azure-native:securityinsights:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20190101preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20200101:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20210301preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20210901preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20211001:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20211001preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20220101preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20220401preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20220501preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20220601preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20220701preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20220801:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20220801preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20220901preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20221001preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20221101:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20221101preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20221201preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20230201:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20230201preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20230301preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20230401preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20230501preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20230601preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20230701preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20230801preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20230901preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20231001preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20231101:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20231201preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20240101preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20240301:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20240401preview:NrtAlertRule"), pulumi.Alias(type_="azure-native:securityinsights/v20240901:NrtAlertRule")])
-        opts = pulumi.ResourceOptions.merge(opts, alias_opts)
-        super(NrtAlertRule, __self__).__init__(
-            'azure-native:securityinsights/v20241001preview:NrtAlertRule',
-            resource_name,
-            __props__,
-            opts)
-    @staticmethod
-    def get(resource_name: str,
-            id: pulumi.Input[str],
-            opts: Optional[pulumi.ResourceOptions] = None) -> 'NrtAlertRule':
-        """
-        Get an existing NrtAlertRule resource's state with the given name, id, and optional extra
-        properties used to qualify the lookup.
-        :param str resource_name: The unique name of the resulting resource.
-        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
-        :param pulumi.ResourceOptions opts: Options for the resource.
-        """
-        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
-        __props__ = NrtAlertRuleArgs.__new__(NrtAlertRuleArgs)
-        __props__.__dict__["alert_details_override"] = None
-        __props__.__dict__["alert_rule_template_name"] = None
-        __props__.__dict__["custom_details"] = None
-        __props__.__dict__["description"] = None
-        __props__.__dict__["display_name"] = None
-        __props__.__dict__["enabled"] = None
-        __props__.__dict__["entity_mappings"] = None
-        __props__.__dict__["etag"] = None
-        __props__.__dict__["event_grouping_settings"] = None
-        __props__.__dict__["incident_configuration"] = None
-        __props__.__dict__["kind"] = None
-        __props__.__dict__["last_modified_utc"] = None
-        __props__.__dict__["name"] = None
-        __props__.__dict__["query"] = None
-        __props__.__dict__["sentinel_entities_mappings"] = None
-        __props__.__dict__["severity"] = None
-        __props__.__dict__["sub_techniques"] = None
-        __props__.__dict__["suppression_duration"] = None
-        __props__.__dict__["suppression_enabled"] = None
-        __props__.__dict__["system_data"] = None
-        __props__.__dict__["tactics"] = None
-        __props__.__dict__["techniques"] = None
-        __props__.__dict__["template_version"] = None
-        __props__.__dict__["type"] = None
-        return NrtAlertRule(resource_name, opts=opts, __props__=__props__)
-    @property
-    @pulumi.getter(name="alertDetailsOverride")
-    def alert_details_override(self) -> pulumi.Output[Optional['outputs.AlertDetailsOverrideResponse']]:
-        """
-        The alert details override settings
-        """
-        return pulumi.get(self, "alert_details_override")
-    @property
-    @pulumi.getter(name="alertRuleTemplateName")
-    def alert_rule_template_name(self) -> pulumi.Output[Optional[str]]:
-        """
-        The Name of the alert rule template used to create this rule.
-        """
-        return pulumi.get(self, "alert_rule_template_name")
-    @property
-    @pulumi.getter(name="customDetails")
-    def custom_details(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
-        """
-        Dictionary of string key-value pairs of columns to be attached to the alert
-        """
-        return pulumi.get(self, "custom_details")
-    @property
-    @pulumi.getter
-    def description(self) -> pulumi.Output[Optional[str]]:
-        """
-        The description of the alert rule.
-        """
-        return pulumi.get(self, "description")
-    @property
-    @pulumi.getter(name="displayName")
-    def display_name(self) -> pulumi.Output[str]:
-        """
-        The display name for alerts created by this alert rule.
-        """
-        return pulumi.get(self, "display_name")
-    @property
-    @pulumi.getter
-    def enabled(self) -> pulumi.Output[bool]:
-        """
-        Determines whether this alert rule is enabled or disabled.
-        """
-        return pulumi.get(self, "enabled")
-    @property
-    @pulumi.getter(name="entityMappings")
-    def entity_mappings(self) -> pulumi.Output[Optional[Sequence['outputs.EntityMappingResponse']]]:
-        """
-        Array of the entity mappings of the alert rule
-        """
-        return pulumi.get(self, "entity_mappings")
-    @property
-    @pulumi.getter
-    def etag(self) -> pulumi.Output[Optional[str]]:
-        """
-        Etag of the azure resource
-        """
-        return pulumi.get(self, "etag")
-    @property
-    @pulumi.getter(name="eventGroupingSettings")
-    def event_grouping_settings(self) -> pulumi.Output[Optional['outputs.EventGroupingSettingsResponse']]:
-        """
-        The event grouping settings.
-        """
-        return pulumi.get(self, "event_grouping_settings")
-    @property
-    @pulumi.getter(name="incidentConfiguration")
-    def incident_configuration(self) -> pulumi.Output[Optional['outputs.IncidentConfigurationResponse']]:
-        """
-        The settings of the incidents that created from alerts triggered by this analytics rule
-        """
-        return pulumi.get(self, "incident_configuration")
-    @property
-    @pulumi.getter
-    def kind(self) -> pulumi.Output[str]:
-        """
-        The kind of the alert rule
-        Expected value is 'NRT'.
-        """
-        return pulumi.get(self, "kind")
-    @property
-    @pulumi.getter(name="lastModifiedUtc")
-    def last_modified_utc(self) -> pulumi.Output[str]:
-        """
-        The last time that this alert rule has been modified.
-        """
-        return pulumi.get(self, "last_modified_utc")
-    @property
-    @pulumi.getter
-    def name(self) -> pulumi.Output[str]:
-        """
-        The name of the resource
-        """
-        return pulumi.get(self, "name")
-    @property
-    @pulumi.getter
-    def query(self) -> pulumi.Output[str]:
-        """
-        The query that creates alerts for this rule.
-        """
-        return pulumi.get(self, "query")
-    @property
-    @pulumi.getter(name="sentinelEntitiesMappings")
-    def sentinel_entities_mappings(self) -> pulumi.Output[Optional[Sequence['outputs.SentinelEntityMappingResponse']]]:
-        """
-        Array of the sentinel entity mappings of the alert rule
-        """
-        return pulumi.get(self, "sentinel_entities_mappings")
-    @property
-    @pulumi.getter
-    def severity(self) -> pulumi.Output[str]:
-        """
-        The severity for alerts created by this alert rule.
-        """
-        return pulumi.get(self, "severity")
-    @property
-    @pulumi.getter(name="subTechniques")
-    def sub_techniques(self) -> pulumi.Output[Optional[Sequence[str]]]:
-        """
-        The sub-techniques of the alert rule
-        """
-        return pulumi.get(self, "sub_techniques")
-    @property
-    @pulumi.getter(name="suppressionDuration")
-    def suppression_duration(self) -> pulumi.Output[str]:
-        """
-        The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.
-        """
-        return pulumi.get(self, "suppression_duration")
-    @property
-    @pulumi.getter(name="suppressionEnabled")
-    def suppression_enabled(self) -> pulumi.Output[bool]:
-        """
-        Determines whether the suppression for this alert rule is enabled or disabled.
-        """
-        return pulumi.get(self, "suppression_enabled")
-    @property
-    @pulumi.getter(name="systemData")
-    def system_data(self) -> pulumi.Output['outputs.SystemDataResponse']:
-        """
-        Azure Resource Manager metadata containing createdBy and modifiedBy information.
-        """
-        return pulumi.get(self, "system_data")
-    @property
-    @pulumi.getter
-    def tactics(self) -> pulumi.Output[Optional[Sequence[str]]]:
-        """
-        The tactics of the alert rule
-        """
-        return pulumi.get(self, "tactics")
-    @property
-    @pulumi.getter
-    def techniques(self) -> pulumi.Output[Optional[Sequence[str]]]:
-        """
-        The techniques of the alert rule
-        """
-        return pulumi.get(self, "techniques")
-    @property
-    @pulumi.getter(name="templateVersion")
-    def template_version(self) -> pulumi.Output[Optional[str]]:
-        """
-        The version of the alert rule template used to create this rule - in format <a.b.c>, where all are numbers, for example 0 <1.0.2>
-        """
-        return pulumi.get(self, "template_version")
-    @property
-    @pulumi.getter
-    def type(self) -> pulumi.Output[str]:
-        """
-        The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
-        """
-        return pulumi.get(self, "type")