import * as pulumi from "@pulumi/pulumi"; import * as inputs from "./types/input"; import * as outputs from "./types/output"; /** * Provides a Sumo Logic CSE [First Seen Rule](https://help.sumologic.com/docs/cse/rules/write-first-seen-rule/). * * ## Example Usage * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as sumologic from "@pulumi/sumologic"; * * const firstSeenRule = new sumologic.CseFirstSeenRule("first_seen_rule", { * baselineType: "PER_ENTITY", * baselineWindowSize: "35000", * descriptionExpression: "First User Login - {{ user_username }}", * enabled: true, * entitySelectors: [ * { * entityType: "_username", * expression: "user_username", * }, * { * entityType: "_hostname", * expression: "dstDevice_hostname", * }, * ], * filterExpression: "objectType=\"Network\"", * groupByFields: ["user_username"], * isPrototype: false, * name: "First User Login", * nameExpression: "First User Login - {{ user_username }}", * retentionWindowSize: "86400000", * severity: 1, * valueFields: ["dstDevice_hostname"], * suppressionWindowSize: 2100000, * }); * ``` * * ## Import * * First Seen Rules can be imported using the field id, e.g.: * * hcl * * ```sh * $ pulumi import sumologic:index/cseFirstSeenRule:CseFirstSeenRule first_seen_rule id * ``` */ export declare class CseFirstSeenRule extends pulumi.CustomResource { /** * Get an existing CseFirstSeenRule resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input, state?: CseFirstSeenRuleState, opts?: pulumi.CustomResourceOptions): CseFirstSeenRule; /** * Returns true if the given object is an instance of CseFirstSeenRule. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is CseFirstSeenRule; /** * The baseline type. Current acceptable values are GLOBAL or PER_ENTITY */ readonly baselineType: pulumi.Output; /** * The baseline window size in milliseconds */ readonly baselineWindowSize: pulumi.Output; /** * The description of the generated Signals */ readonly descriptionExpression: pulumi.Output; /** * Whether the rule should generate Signals */ readonly enabled: pulumi.Output; /** * The entities to generate Signals on * + `entityType` - (Required) The type of the entity to generate the Signal on */ readonly entitySelectors: pulumi.Output; /** * The expression for which records to match on */ readonly filterExpression: pulumi.Output; /** * A list of fields to group records by */ readonly groupByFields: pulumi.Output; /** * Whether the generated Signals should be prototype Signals */ readonly isPrototype: pulumi.Output; /** * The name of the Rule */ readonly name: pulumi.Output; /** * The name of the generated Signals */ readonly nameExpression: pulumi.Output; /** * The retention window size in milliseconds */ readonly retentionWindowSize: pulumi.Output; /** * The severity of the generated Signals */ readonly severity: pulumi.Output; /** * The summary of the generated Signals */ readonly summaryExpression: pulumi.Output; /** * For how long to suppress Signal generation, in milliseconds. Must be greater than 0 and less than the global limit of 7 days. * * The following attributes are exported: */ readonly suppressionWindowSize: pulumi.Output; /** * The tags of the generated Signals */ readonly tags: pulumi.Output; /** * The value fields */ readonly valueFields: pulumi.Output; /** * Create a CseFirstSeenRule resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args: CseFirstSeenRuleArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering CseFirstSeenRule resources. */ export interface CseFirstSeenRuleState { /** * The baseline type. Current acceptable values are GLOBAL or PER_ENTITY */ baselineType?: pulumi.Input; /** * The baseline window size in milliseconds */ baselineWindowSize?: pulumi.Input; /** * The description of the generated Signals */ descriptionExpression?: pulumi.Input; /** * Whether the rule should generate Signals */ enabled?: pulumi.Input; /** * The entities to generate Signals on * + `entityType` - (Required) The type of the entity to generate the Signal on */ entitySelectors?: pulumi.Input[]>; /** * The expression for which records to match on */ filterExpression?: pulumi.Input; /** * A list of fields to group records by */ groupByFields?: pulumi.Input[]>; /** * Whether the generated Signals should be prototype Signals */ isPrototype?: pulumi.Input; /** * The name of the Rule */ name?: pulumi.Input; /** * The name of the generated Signals */ nameExpression?: pulumi.Input; /** * The retention window size in milliseconds */ retentionWindowSize?: pulumi.Input; /** * The severity of the generated Signals */ severity?: pulumi.Input; /** * The summary of the generated Signals */ summaryExpression?: pulumi.Input; /** * For how long to suppress Signal generation, in milliseconds. Must be greater than 0 and less than the global limit of 7 days. * * The following attributes are exported: */ suppressionWindowSize?: pulumi.Input; /** * The tags of the generated Signals */ tags?: pulumi.Input[]>; /** * The value fields */ valueFields?: pulumi.Input[]>; } /** * The set of arguments for constructing a CseFirstSeenRule resource. */ export interface CseFirstSeenRuleArgs { /** * The baseline type. Current acceptable values are GLOBAL or PER_ENTITY */ baselineType: pulumi.Input; /** * The baseline window size in milliseconds */ baselineWindowSize: pulumi.Input; /** * The description of the generated Signals */ descriptionExpression: pulumi.Input; /** * Whether the rule should generate Signals */ enabled: pulumi.Input; /** * The entities to generate Signals on * + `entityType` - (Required) The type of the entity to generate the Signal on */ entitySelectors: pulumi.Input[]>; /** * The expression for which records to match on */ filterExpression: pulumi.Input; /** * A list of fields to group records by */ groupByFields?: pulumi.Input[]>; /** * Whether the generated Signals should be prototype Signals */ isPrototype?: pulumi.Input; /** * The name of the Rule */ name?: pulumi.Input; /** * The name of the generated Signals */ nameExpression: pulumi.Input; /** * The retention window size in milliseconds */ retentionWindowSize: pulumi.Input; /** * The severity of the generated Signals */ severity: pulumi.Input; /** * The summary of the generated Signals */ summaryExpression?: pulumi.Input; /** * For how long to suppress Signal generation, in milliseconds. Must be greater than 0 and less than the global limit of 7 days. * * The following attributes are exported: */ suppressionWindowSize?: pulumi.Input; /** * The tags of the generated Signals */ tags?: pulumi.Input[]>; /** * The value fields */ valueFields: pulumi.Input[]>; }