security_detection_rule

package

Go to main page

Versions in this module

v0

v0.11.19

Oct 23, 2025

Changes in this version

type CommonCreateProps

+ Threat **kbapi.SecurityDetectionsAPIThreatArray

+ TimelineId **kbapi.SecurityDetectionsAPITimelineTemplateId

+ TimelineTitle **kbapi.SecurityDetectionsAPITimelineTemplateTitle

type CommonUpdateProps

+ Threat **kbapi.SecurityDetectionsAPIThreatArray

+ TimelineId **kbapi.SecurityDetectionsAPITimelineTemplateId

+ TimelineTitle **kbapi.SecurityDetectionsAPITimelineTemplateTitle

+ type ThreatModel struct

+ Framework types.String

+ Tactic types.Object

+ Technique types.List

+ type ThreatSubtechniqueModel struct

+ Id types.String

+ Name types.String

+ Reference types.String

+ type ThreatTacticModel struct

+ Id types.String

+ Name types.String

+ Reference types.String

+ type ThreatTechniqueModel struct

+ Id types.String

+ Name types.String

+ Reference types.String

+ Subtechnique types.List

v0.11.18

Oct 7, 2025

Changes in this version

+ var MinVersionResponseActions = version.Must(version.NewVersion("8.16.0"))

+ func GetSchema() schema.Schema

+ func NewSecurityDetectionRuleResource() resource.Resource

+ type ActionFrequencyModel struct

+ NotifyWhen types.String

+ Summary types.Bool

+ Throttle types.String

+ type ActionModel struct

+ ActionTypeId types.String

+ AlertsFilter types.Map

+ Frequency types.Object

+ Group types.String

+ Id types.String

+ Params types.Map

+ Uuid types.String

+ type AlertSuppressionModel struct

+ Duration customtypes.Duration

+ GroupBy types.List

+ MissingFieldsStrategy types.String

+ type CardinalityModel struct

+ Field types.String

+ Value types.Int64

+ type CommonCreateProps struct

+ Actions **[]kbapi.SecurityDetectionsAPIRuleAction

+ AlertSuppression **kbapi.SecurityDetectionsAPIAlertSuppression

+ Author **[]string

+ BuildingBlockType **kbapi.SecurityDetectionsAPIBuildingBlockType

+ DataViewId **kbapi.SecurityDetectionsAPIDataViewId

+ Enabled **kbapi.SecurityDetectionsAPIIsRuleEnabled

+ ExceptionsList **[]kbapi.SecurityDetectionsAPIRuleExceptionList

+ FalsePositives **[]string

+ Filters **kbapi.SecurityDetectionsAPIRuleFilterArray

+ From **kbapi.SecurityDetectionsAPIRuleIntervalFrom

+ Index **[]string

+ Interval **kbapi.SecurityDetectionsAPIRuleInterval

+ InvestigationFields **kbapi.SecurityDetectionsAPIInvestigationFields

+ License **kbapi.SecurityDetectionsAPIRuleLicense

+ MaxSignals **kbapi.SecurityDetectionsAPIMaxSignals

+ Namespace **kbapi.SecurityDetectionsAPIAlertsIndexNamespace

+ Note **kbapi.SecurityDetectionsAPIInvestigationGuide

+ References **[]string

+ RelatedIntegrations **kbapi.SecurityDetectionsAPIRelatedIntegrationArray

+ RequiredFields **[]kbapi.SecurityDetectionsAPIRequiredFieldInput

+ ResponseActions **[]kbapi.SecurityDetectionsAPIResponseAction

+ RiskScoreMapping **kbapi.SecurityDetectionsAPIRiskScoreMapping

+ RuleId **kbapi.SecurityDetectionsAPIRuleSignatureId

+ RuleNameOverride **kbapi.SecurityDetectionsAPIRuleNameOverride

+ Setup **kbapi.SecurityDetectionsAPISetupGuide

+ SeverityMapping **kbapi.SecurityDetectionsAPISeverityMapping

+ Tags **[]string

+ TimestampOverride **kbapi.SecurityDetectionsAPITimestampOverride

+ TimestampOverrideFallbackDisabled **kbapi.SecurityDetectionsAPITimestampOverrideFallbackDisabled

+ To **kbapi.SecurityDetectionsAPIRuleIntervalTo

+ Version **kbapi.SecurityDetectionsAPIRuleVersion

+ type CommonUpdateProps struct

+ Actions **[]kbapi.SecurityDetectionsAPIRuleAction

+ AlertSuppression **kbapi.SecurityDetectionsAPIAlertSuppression

+ Author **[]string

+ BuildingBlockType **kbapi.SecurityDetectionsAPIBuildingBlockType

+ DataViewId **kbapi.SecurityDetectionsAPIDataViewId

+ Enabled **kbapi.SecurityDetectionsAPIIsRuleEnabled

+ ExceptionsList **[]kbapi.SecurityDetectionsAPIRuleExceptionList

+ FalsePositives **[]string

+ Filters **kbapi.SecurityDetectionsAPIRuleFilterArray

+ From **kbapi.SecurityDetectionsAPIRuleIntervalFrom

+ Index **[]string

+ Interval **kbapi.SecurityDetectionsAPIRuleInterval

+ InvestigationFields **kbapi.SecurityDetectionsAPIInvestigationFields

+ License **kbapi.SecurityDetectionsAPIRuleLicense

+ MaxSignals **kbapi.SecurityDetectionsAPIMaxSignals

+ Namespace **kbapi.SecurityDetectionsAPIAlertsIndexNamespace

+ Note **kbapi.SecurityDetectionsAPIInvestigationGuide

+ References **[]string

+ RelatedIntegrations **kbapi.SecurityDetectionsAPIRelatedIntegrationArray

+ RequiredFields **[]kbapi.SecurityDetectionsAPIRequiredFieldInput

+ ResponseActions **[]kbapi.SecurityDetectionsAPIResponseAction

+ RiskScoreMapping **kbapi.SecurityDetectionsAPIRiskScoreMapping

+ RuleId **kbapi.SecurityDetectionsAPIRuleSignatureId

+ RuleNameOverride **kbapi.SecurityDetectionsAPIRuleNameOverride

+ Setup **kbapi.SecurityDetectionsAPISetupGuide

+ SeverityMapping **kbapi.SecurityDetectionsAPISeverityMapping

+ Tags **[]string

+ TimestampOverride **kbapi.SecurityDetectionsAPITimestampOverride

+ TimestampOverrideFallbackDisabled **kbapi.SecurityDetectionsAPITimestampOverrideFallbackDisabled

+ To **kbapi.SecurityDetectionsAPIRuleIntervalTo

+ Version **kbapi.SecurityDetectionsAPIRuleVersion

+ type EndpointProcessConfigModel struct

+ Field types.String

+ Overwrite types.Bool

+ type EqlRuleProcessor struct

+ func (e EqlRuleProcessor) ExtractId(response any) (string, diag.Diagnostics)

+ func (e EqlRuleProcessor) HandlesAPIRuleResponse(rule any) bool

+ func (e EqlRuleProcessor) HandlesRuleType(t string) bool

+ func (e EqlRuleProcessor) ToCreateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleCreateProps, diag.Diagnostics)

+ func (e EqlRuleProcessor) ToUpdateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleUpdateProps, diag.Diagnostics)

+ func (e EqlRuleProcessor) UpdateFromResponse(ctx context.Context, rule any, d *SecurityDetectionRuleData) diag.Diagnostics

+ type EsqlRuleProcessor struct

+ func (e EsqlRuleProcessor) ExtractId(response any) (string, diag.Diagnostics)

+ func (e EsqlRuleProcessor) HandlesAPIRuleResponse(rule any) bool

+ func (e EsqlRuleProcessor) HandlesRuleType(t string) bool

+ func (e EsqlRuleProcessor) ToCreateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleCreateProps, diag.Diagnostics)

+ func (e EsqlRuleProcessor) ToUpdateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleUpdateProps, diag.Diagnostics)

+ func (e EsqlRuleProcessor) UpdateFromResponse(ctx context.Context, rule any, d *SecurityDetectionRuleData) diag.Diagnostics

+ type ExceptionsListModel struct

+ Id types.String

+ ListId types.String

+ NamespaceType types.String

+ Type types.String

+ type MachineLearningRuleProcessor struct

+ func (m MachineLearningRuleProcessor) ExtractId(response any) (string, diag.Diagnostics)

+ func (m MachineLearningRuleProcessor) HandlesAPIRuleResponse(rule any) bool

+ func (m MachineLearningRuleProcessor) HandlesRuleType(t string) bool

+ func (m MachineLearningRuleProcessor) ToCreateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleCreateProps, diag.Diagnostics)

+ func (m MachineLearningRuleProcessor) ToUpdateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleUpdateProps, diag.Diagnostics)

+ func (m MachineLearningRuleProcessor) UpdateFromResponse(ctx context.Context, rule any, d *SecurityDetectionRuleData) diag.Diagnostics

+ type NewTermsRuleProcessor struct

+ func (n NewTermsRuleProcessor) ExtractId(response any) (string, diag.Diagnostics)

+ func (n NewTermsRuleProcessor) HandlesAPIRuleResponse(rule any) bool

+ func (n NewTermsRuleProcessor) HandlesRuleType(t string) bool

+ func (n NewTermsRuleProcessor) ToCreateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleCreateProps, diag.Diagnostics)

+ func (n NewTermsRuleProcessor) ToUpdateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleUpdateProps, diag.Diagnostics)

+ func (n NewTermsRuleProcessor) UpdateFromResponse(ctx context.Context, rule any, d *SecurityDetectionRuleData) diag.Diagnostics

+ type OsqueryQueryModel struct

+ EcsMapping types.Map

+ Id types.String

+ Platform types.String

+ Query types.String

+ Removed types.Bool

+ Snapshot types.Bool

+ Version types.String

+ type QueryRuleProcessor struct

+ func (q QueryRuleProcessor) ExtractId(response any) (string, diag.Diagnostics)

+ func (q QueryRuleProcessor) HandlesAPIRuleResponse(rule any) bool

+ func (q QueryRuleProcessor) HandlesRuleType(t string) bool

+ func (q QueryRuleProcessor) ToCreateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleCreateProps, diag.Diagnostics)

+ func (q QueryRuleProcessor) ToUpdateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleUpdateProps, diag.Diagnostics)

+ func (q QueryRuleProcessor) UpdateFromResponse(ctx context.Context, rule any, d *SecurityDetectionRuleData) diag.Diagnostics

+ type RelatedIntegrationModel struct

+ Integration types.String

+ Package types.String

+ Version types.String

+ type RequiredFieldModel struct

+ Ecs types.Bool

+ Name types.String

+ Type types.String

+ type ResponseActionModel struct

+ ActionTypeId types.String

+ Params types.Object

+ type ResponseActionParamsModel struct

+ Command types.String

+ Comment types.String

+ Config types.Object

+ EcsMapping types.Map

+ PackId types.String

+ Queries types.List

+ Query types.String

+ SavedQueryId types.String

+ Timeout types.Int64

+ type RiskScoreMappingModel struct

+ Field types.String

+ Operator types.String

+ RiskScore types.Int64

+ Value types.String

+ type SavedQueryRuleProcessor struct

+ func (s SavedQueryRuleProcessor) ExtractId(response any) (string, diag.Diagnostics)

+ func (s SavedQueryRuleProcessor) HandlesAPIRuleResponse(rule any) bool

+ func (s SavedQueryRuleProcessor) HandlesRuleType(t string) bool

+ func (s SavedQueryRuleProcessor) ToCreateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleCreateProps, diag.Diagnostics)

+ func (s SavedQueryRuleProcessor) ToUpdateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleUpdateProps, diag.Diagnostics)

+ func (s SavedQueryRuleProcessor) UpdateFromResponse(ctx context.Context, rule any, d *SecurityDetectionRuleData) diag.Diagnostics

+ type SecurityDetectionRuleData struct

+ Actions types.List

+ AlertSuppression types.Object

+ AnomalyThreshold types.Int64

+ Author types.List

+ BuildingBlockType types.String

+ ConcurrentSearches types.Int64

+ CreatedAt types.String

+ CreatedBy types.String

+ DataViewId types.String

+ Description types.String

+ Enabled types.Bool

+ ExceptionsList types.List

+ FalsePositives types.List

+ Filters jsontypes.Normalized

+ From types.String

+ HistoryWindowStart types.String

+ Id types.String

+ Index types.List

+ Interval types.String

+ InvestigationFields types.List

+ ItemsPerSearch types.Int64

+ Language types.String

+ License types.String

+ MachineLearningJobId types.List

+ MaxSignals types.Int64

+ Name types.String

+ Namespace types.String

+ NewTermsFields types.List

+ Note types.String

+ Query types.String

+ References types.List

+ RelatedIntegrations types.List

+ RequiredFields types.List

+ ResponseActions types.List

+ Revision types.Int64

+ RiskScore types.Int64

+ RiskScoreMapping types.List

+ RuleId types.String

+ RuleNameOverride types.String

+ SavedId types.String

+ Setup types.String

+ Severity types.String

+ SeverityMapping types.List

+ SpaceId types.String

+ Tags types.List

+ Threat types.List

+ ThreatFilters types.List

+ ThreatIndex types.List

+ ThreatIndicatorPath types.String

+ ThreatMapping types.List

+ ThreatQuery types.String

+ Threshold types.Object

+ TiebreakerField types.String

+ TimelineId types.String

+ TimelineTitle types.String

+ TimestampOverride types.String

+ TimestampOverrideFallbackDisabled types.Bool

+ To types.String

+ Type types.String

+ UpdatedAt types.String

+ UpdatedBy types.String

+ Version types.Int64

+ type SecurityDetectionRuleTfData struct

+ ThreatMapping types.List

+ type SecurityDetectionRuleTfDataItem struct

+ Entries types.List

+ type SecurityDetectionRuleTfDataItemEntry struct

+ Field types.String

+ Type types.String

+ Value types.String

+ type SeverityMappingModel struct

+ Field types.String

+ Operator types.String

+ Severity types.String

+ Value types.String

+ type ThreatMatchRuleProcessor struct

+ func (t ThreatMatchRuleProcessor) ExtractId(response any) (string, diag.Diagnostics)

+ func (t ThreatMatchRuleProcessor) HandlesAPIRuleResponse(rule any) bool

+ func (t ThreatMatchRuleProcessor) HandlesRuleType(ruleType string) bool

+ func (t ThreatMatchRuleProcessor) ToCreateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleCreateProps, diag.Diagnostics)

+ func (t ThreatMatchRuleProcessor) ToUpdateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleUpdateProps, diag.Diagnostics)

+ func (t ThreatMatchRuleProcessor) UpdateFromResponse(ctx context.Context, rule any, d *SecurityDetectionRuleData) diag.Diagnostics

+ type ThresholdModel struct

+ Cardinality types.List

+ Field types.List

+ Value types.Int64

+ type ThresholdRuleProcessor struct

+ func (th ThresholdRuleProcessor) ExtractId(response any) (string, diag.Diagnostics)

+ func (th ThresholdRuleProcessor) HandlesAPIRuleResponse(rule any) bool

+ func (th ThresholdRuleProcessor) HandlesRuleType(t string) bool

+ func (th ThresholdRuleProcessor) ToCreateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleCreateProps, diag.Diagnostics)

+ func (th ThresholdRuleProcessor) ToUpdateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleUpdateProps, diag.Diagnostics)

+ func (th ThresholdRuleProcessor) UpdateFromResponse(ctx context.Context, rule any, d *SecurityDetectionRuleData) diag.Diagnostics

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL