security_detection_rule

package

Go to main page

Versions in this module

v0

v0.12.2

Nov 19, 2025

v0.12.1

Oct 23, 2025

v0.12.0

Oct 15, 2025

v0.11.19

Oct 23, 2025

Changes in this version

type CommonCreateProps

+ Threat **kbapi.SecurityDetectionsAPIThreatArray

+ TimelineId **kbapi.SecurityDetectionsAPITimelineTemplateId

+ TimelineTitle **kbapi.SecurityDetectionsAPITimelineTemplateTitle

type CommonUpdateProps

+ Threat **kbapi.SecurityDetectionsAPIThreatArray

+ TimelineId **kbapi.SecurityDetectionsAPITimelineTemplateId

+ TimelineTitle **kbapi.SecurityDetectionsAPITimelineTemplateTitle

+ type ThreatModel struct

+ Framework types.String

+ Tactic types.Object

+ Technique types.List

+ type ThreatSubtechniqueModel struct

+ Id types.String

+ Name types.String

+ Reference types.String

+ type ThreatTacticModel struct

+ Id types.String

+ Name types.String

+ Reference types.String

+ type ThreatTechniqueModel struct

+ Id types.String

+ Name types.String

+ Reference types.String

+ Subtechnique types.List

v0.11.18

Oct 7, 2025

Changes in this version

+ var MinVersionResponseActions = version.Must(version.NewVersion("8.16.0"))

+ func GetSchema() schema.Schema

+ func NewSecurityDetectionRuleResource() resource.Resource

+ type ActionFrequencyModel struct

+ NotifyWhen types.String

+ Summary types.Bool

+ Throttle types.String

+ type ActionModel struct

+ ActionTypeId types.String

+ AlertsFilter types.Map

+ Frequency types.Object

+ Group types.String

+ Id types.String

+ Params types.Map

+ Uuid types.String

+ type AlertSuppressionModel struct

+ Duration customtypes.Duration

+ GroupBy types.List

+ MissingFieldsStrategy types.String

+ type CardinalityModel struct

+ Field types.String

+ Value types.Int64

+ type CommonCreateProps struct

+ Actions **[]kbapi.SecurityDetectionsAPIRuleAction

+ AlertSuppression **kbapi.SecurityDetectionsAPIAlertSuppression

+ Author **[]string

+ BuildingBlockType **kbapi.SecurityDetectionsAPIBuildingBlockType

+ DataViewId **kbapi.SecurityDetectionsAPIDataViewId

+ Enabled **kbapi.SecurityDetectionsAPIIsRuleEnabled

+ ExceptionsList **[]kbapi.SecurityDetectionsAPIRuleExceptionList

+ FalsePositives **[]string

+ Filters **kbapi.SecurityDetectionsAPIRuleFilterArray

+ From **kbapi.SecurityDetectionsAPIRuleIntervalFrom

+ Index **[]string

+ Interval **kbapi.SecurityDetectionsAPIRuleInterval

+ InvestigationFields **kbapi.SecurityDetectionsAPIInvestigationFields

+ License **kbapi.SecurityDetectionsAPIRuleLicense

+ MaxSignals **kbapi.SecurityDetectionsAPIMaxSignals

+ Namespace **kbapi.SecurityDetectionsAPIAlertsIndexNamespace

+ Note **kbapi.SecurityDetectionsAPIInvestigationGuide

+ References **[]string

+ RelatedIntegrations **kbapi.SecurityDetectionsAPIRelatedIntegrationArray

+ RequiredFields **[]kbapi.SecurityDetectionsAPIRequiredFieldInput

+ ResponseActions **[]kbapi.SecurityDetectionsAPIResponseAction

+ RiskScoreMapping **kbapi.SecurityDetectionsAPIRiskScoreMapping

+ RuleId **kbapi.SecurityDetectionsAPIRuleSignatureId

+ RuleNameOverride **kbapi.SecurityDetectionsAPIRuleNameOverride

+ Setup **kbapi.SecurityDetectionsAPISetupGuide

+ SeverityMapping **kbapi.SecurityDetectionsAPISeverityMapping

+ Tags **[]string

+ TimestampOverride **kbapi.SecurityDetectionsAPITimestampOverride

+ TimestampOverrideFallbackDisabled **kbapi.SecurityDetectionsAPITimestampOverrideFallbackDisabled

+ To **kbapi.SecurityDetectionsAPIRuleIntervalTo

+ Version **kbapi.SecurityDetectionsAPIRuleVersion

+ type CommonUpdateProps struct

+ Actions **[]kbapi.SecurityDetectionsAPIRuleAction

+ AlertSuppression **kbapi.SecurityDetectionsAPIAlertSuppression

+ Author **[]string

+ BuildingBlockType **kbapi.SecurityDetectionsAPIBuildingBlockType

+ DataViewId **kbapi.SecurityDetectionsAPIDataViewId

+ Enabled **kbapi.SecurityDetectionsAPIIsRuleEnabled

+ ExceptionsList **[]kbapi.SecurityDetectionsAPIRuleExceptionList

+ FalsePositives **[]string

+ Filters **kbapi.SecurityDetectionsAPIRuleFilterArray

+ From **kbapi.SecurityDetectionsAPIRuleIntervalFrom

+ Index **[]string

+ Interval **kbapi.SecurityDetectionsAPIRuleInterval

+ InvestigationFields **kbapi.SecurityDetectionsAPIInvestigationFields

+ License **kbapi.SecurityDetectionsAPIRuleLicense

+ MaxSignals **kbapi.SecurityDetectionsAPIMaxSignals

+ Namespace **kbapi.SecurityDetectionsAPIAlertsIndexNamespace

+ Note **kbapi.SecurityDetectionsAPIInvestigationGuide

+ References **[]string

+ RelatedIntegrations **kbapi.SecurityDetectionsAPIRelatedIntegrationArray

+ RequiredFields **[]kbapi.SecurityDetectionsAPIRequiredFieldInput

+ ResponseActions **[]kbapi.SecurityDetectionsAPIResponseAction

+ RiskScoreMapping **kbapi.SecurityDetectionsAPIRiskScoreMapping

+ RuleId **kbapi.SecurityDetectionsAPIRuleSignatureId

+ RuleNameOverride **kbapi.SecurityDetectionsAPIRuleNameOverride

+ Setup **kbapi.SecurityDetectionsAPISetupGuide

+ SeverityMapping **kbapi.SecurityDetectionsAPISeverityMapping

+ Tags **[]string

+ TimestampOverride **kbapi.SecurityDetectionsAPITimestampOverride

+ TimestampOverrideFallbackDisabled **kbapi.SecurityDetectionsAPITimestampOverrideFallbackDisabled

+ To **kbapi.SecurityDetectionsAPIRuleIntervalTo

+ Version **kbapi.SecurityDetectionsAPIRuleVersion

+ type EndpointProcessConfigModel struct

+ Field types.String

+ Overwrite types.Bool

+ type EqlRuleProcessor struct

+ func (e EqlRuleProcessor) ExtractId(response any) (string, diag.Diagnostics)

+ func (e EqlRuleProcessor) HandlesAPIRuleResponse(rule any) bool

+ func (e EqlRuleProcessor) HandlesRuleType(t string) bool

+ func (e EqlRuleProcessor) ToCreateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleCreateProps, diag.Diagnostics)

+ func (e EqlRuleProcessor) ToUpdateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleUpdateProps, diag.Diagnostics)

+ func (e EqlRuleProcessor) UpdateFromResponse(ctx context.Context, rule any, d *SecurityDetectionRuleData) diag.Diagnostics

+ type EsqlRuleProcessor struct

+ func (e EsqlRuleProcessor) ExtractId(response any) (string, diag.Diagnostics)

+ func (e EsqlRuleProcessor) HandlesAPIRuleResponse(rule any) bool

+ func (e EsqlRuleProcessor) HandlesRuleType(t string) bool

+ func (e EsqlRuleProcessor) ToCreateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleCreateProps, diag.Diagnostics)

+ func (e EsqlRuleProcessor) ToUpdateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleUpdateProps, diag.Diagnostics)

+ func (e EsqlRuleProcessor) UpdateFromResponse(ctx context.Context, rule any, d *SecurityDetectionRuleData) diag.Diagnostics

+ type ExceptionsListModel struct

+ Id types.String

+ ListId types.String

+ NamespaceType types.String

+ Type types.String

+ type MachineLearningRuleProcessor struct

+ func (m MachineLearningRuleProcessor) ExtractId(response any) (string, diag.Diagnostics)

+ func (m MachineLearningRuleProcessor) HandlesAPIRuleResponse(rule any) bool

+ func (m MachineLearningRuleProcessor) HandlesRuleType(t string) bool

+ func (m MachineLearningRuleProcessor) ToCreateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleCreateProps, diag.Diagnostics)

+ func (m MachineLearningRuleProcessor) ToUpdateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleUpdateProps, diag.Diagnostics)

+ func (m MachineLearningRuleProcessor) UpdateFromResponse(ctx context.Context, rule any, d *SecurityDetectionRuleData) diag.Diagnostics

+ type NewTermsRuleProcessor struct

+ func (n NewTermsRuleProcessor) ExtractId(response any) (string, diag.Diagnostics)

+ func (n NewTermsRuleProcessor) HandlesAPIRuleResponse(rule any) bool

+ func (n NewTermsRuleProcessor) HandlesRuleType(t string) bool

+ func (n NewTermsRuleProcessor) ToCreateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleCreateProps, diag.Diagnostics)

+ func (n NewTermsRuleProcessor) ToUpdateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleUpdateProps, diag.Diagnostics)

+ func (n NewTermsRuleProcessor) UpdateFromResponse(ctx context.Context, rule any, d *SecurityDetectionRuleData) diag.Diagnostics

+ type OsqueryQueryModel struct

+ EcsMapping types.Map

+ Id types.String

+ Platform types.String

+ Query types.String

+ Removed types.Bool

+ Snapshot types.Bool

+ Version types.String

+ type QueryRuleProcessor struct

+ func (q QueryRuleProcessor) ExtractId(response any) (string, diag.Diagnostics)

+ func (q QueryRuleProcessor) HandlesAPIRuleResponse(rule any) bool

+ func (q QueryRuleProcessor) HandlesRuleType(t string) bool

+ func (q QueryRuleProcessor) ToCreateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleCreateProps, diag.Diagnostics)

+ func (q QueryRuleProcessor) ToUpdateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleUpdateProps, diag.Diagnostics)

+ func (q QueryRuleProcessor) UpdateFromResponse(ctx context.Context, rule any, d *SecurityDetectionRuleData) diag.Diagnostics

+ type RelatedIntegrationModel struct

+ Integration types.String

+ Package types.String

+ Version types.String

+ type RequiredFieldModel struct

+ Ecs types.Bool

+ Name types.String

+ Type types.String

+ type ResponseActionModel struct

+ ActionTypeId types.String

+ Params types.Object

+ type ResponseActionParamsModel struct

+ Command types.String

+ Comment types.String

+ Config types.Object

+ EcsMapping types.Map

+ PackId types.String

+ Queries types.List

+ Query types.String

+ SavedQueryId types.String

+ Timeout types.Int64

+ type RiskScoreMappingModel struct

+ Field types.String

+ Operator types.String

+ RiskScore types.Int64

+ Value types.String

+ type SavedQueryRuleProcessor struct

+ func (s SavedQueryRuleProcessor) ExtractId(response any) (string, diag.Diagnostics)

+ func (s SavedQueryRuleProcessor) HandlesAPIRuleResponse(rule any) bool

+ func (s SavedQueryRuleProcessor) HandlesRuleType(t string) bool

+ func (s SavedQueryRuleProcessor) ToCreateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleCreateProps, diag.Diagnostics)

+ func (s SavedQueryRuleProcessor) ToUpdateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleUpdateProps, diag.Diagnostics)

+ func (s SavedQueryRuleProcessor) UpdateFromResponse(ctx context.Context, rule any, d *SecurityDetectionRuleData) diag.Diagnostics

+ type SecurityDetectionRuleData struct

+ Actions types.List

+ AlertSuppression types.Object

+ AnomalyThreshold types.Int64

+ Author types.List

+ BuildingBlockType types.String

+ ConcurrentSearches types.Int64

+ CreatedAt types.String

+ CreatedBy types.String

+ DataViewId types.String

+ Description types.String

+ Enabled types.Bool

+ ExceptionsList types.List

+ FalsePositives types.List

+ Filters jsontypes.Normalized

+ From types.String

+ HistoryWindowStart types.String

+ Id types.String

+ Index types.List

+ Interval types.String

+ InvestigationFields types.List

+ ItemsPerSearch types.Int64

+ Language types.String

+ License types.String

+ MachineLearningJobId types.List

+ MaxSignals types.Int64

+ Name types.String

+ Namespace types.String

+ NewTermsFields types.List

+ Note types.String

+ Query types.String

+ References types.List

+ RelatedIntegrations types.List

+ RequiredFields types.List

+ ResponseActions types.List

+ Revision types.Int64

+ RiskScore types.Int64

+ RiskScoreMapping types.List

+ RuleId types.String

+ RuleNameOverride types.String

+ SavedId types.String

+ Setup types.String

+ Severity types.String

+ SeverityMapping types.List

+ SpaceId types.String

+ Tags types.List

+ Threat types.List

+ ThreatFilters types.List

+ ThreatIndex types.List

+ ThreatIndicatorPath types.String

+ ThreatMapping types.List

+ ThreatQuery types.String

+ Threshold types.Object

+ TiebreakerField types.String

+ TimelineId types.String

+ TimelineTitle types.String

+ TimestampOverride types.String

+ TimestampOverrideFallbackDisabled types.Bool

+ To types.String

+ Type types.String

+ UpdatedAt types.String

+ UpdatedBy types.String

+ Version types.Int64

+ type SecurityDetectionRuleTfData struct

+ ThreatMapping types.List

+ type SecurityDetectionRuleTfDataItem struct

+ Entries types.List

+ type SecurityDetectionRuleTfDataItemEntry struct

+ Field types.String

+ Type types.String

+ Value types.String

+ type SeverityMappingModel struct

+ Field types.String

+ Operator types.String

+ Severity types.String

+ Value types.String

+ type ThreatMatchRuleProcessor struct

+ func (t ThreatMatchRuleProcessor) ExtractId(response any) (string, diag.Diagnostics)

+ func (t ThreatMatchRuleProcessor) HandlesAPIRuleResponse(rule any) bool

+ func (t ThreatMatchRuleProcessor) HandlesRuleType(ruleType string) bool

+ func (t ThreatMatchRuleProcessor) ToCreateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleCreateProps, diag.Diagnostics)

+ func (t ThreatMatchRuleProcessor) ToUpdateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleUpdateProps, diag.Diagnostics)

+ func (t ThreatMatchRuleProcessor) UpdateFromResponse(ctx context.Context, rule any, d *SecurityDetectionRuleData) diag.Diagnostics

+ type ThresholdModel struct

+ Cardinality types.List

+ Field types.List

+ Value types.Int64

+ type ThresholdRuleProcessor struct

+ func (th ThresholdRuleProcessor) ExtractId(response any) (string, diag.Diagnostics)

+ func (th ThresholdRuleProcessor) HandlesAPIRuleResponse(rule any) bool

+ func (th ThresholdRuleProcessor) HandlesRuleType(t string) bool

+ func (th ThresholdRuleProcessor) ToCreateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleCreateProps, diag.Diagnostics)

+ func (th ThresholdRuleProcessor) ToUpdateProps(ctx context.Context, client clients.MinVersionEnforceable, ...) (kbapi.SecurityDetectionsAPIRuleUpdateProps, diag.Diagnostics)

+ func (th ThresholdRuleProcessor) UpdateFromResponse(ctx context.Context, rule any, d *SecurityDetectionRuleData) diag.Diagnostics

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL