Microsoft.SecurityInsights alertRules 2019-01-01-preview

  • Article

Bicep resource definition

The alertRules resource type is an extension resource, which means you can apply it to another resource.

Use the scope property on this resource to set the scope for this resource. See Set scope on extension resources in Bicep.

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.SecurityInsights/alertRules resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.SecurityInsights/alertRules@2019-01-01-preview' = {
  name: 'string'
  kind: 'string'
  scope: resourceSymbolicName
  etag: 'string'
}

Property values

alertRules

Name Description Value
name The resource name string (required)
kind The kind of the alert rule 'Fusion'
'MLBehaviorAnalytics'
'MicrosoftSecurityIncidentCreation'
'Scheduled'
'ThreatIntelligence' (required)
scope Use when creating an extension resource at a scope that is different than the deployment scope. Target resource

For Bicep, set this property to the symbolic name of the resource to apply the extension resource.
etag Etag of the azure resource string

Quickstart templates

The following quickstart templates deploy this resource type.

Template Description
Creates a new Microsoft Sentinel Scheduled Analytics Rule

Deploy to Azure		 This sample shows how to create a new scheduled analytics rule in Microsoft Sentinel

ARM template resource definition

The alertRules resource type is an extension resource, which means you can apply it to another resource.

Use the scope property on this resource to set the scope for this resource. See Set scope on extension resources in ARM templates.

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.SecurityInsights/alertRules resource, add the following JSON to your template.

{
  "type": "Microsoft.SecurityInsights/alertRules",
  "apiVersion": "2019-01-01-preview",
  "name": "string",
  "kind": "string",
  "scope": "string",
  "etag": "string"
}

Property values

alertRules

Name Description Value
type The resource type 'Microsoft.SecurityInsights/alertRules'
apiVersion The resource api version '2019-01-01-preview'
name The resource name string (required)
kind The kind of the alert rule 'Fusion'
'MLBehaviorAnalytics'
'MicrosoftSecurityIncidentCreation'
'Scheduled'
'ThreatIntelligence' (required)
scope Use when creating an extension resource at a scope that is different than the deployment scope. Target resource

For JSON, set the value to the full name of the resource to apply the extension resource to.
etag Etag of the azure resource string

Quickstart templates

The following quickstart templates deploy this resource type.

Template Description
Creates a new Microsoft Sentinel Scheduled Analytics Rule

Deploy to Azure		 This sample shows how to create a new scheduled analytics rule in Microsoft Sentinel

Terraform (AzAPI provider) resource definition

The alertRules resource type is an extension resource, which means you can apply it to another resource.

Use the parent_id property on this resource to set the scope for this resource.

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.SecurityInsights/alertRules resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.SecurityInsights/alertRules@2019-01-01-preview"
  name = "string"
  parent_id = "string"
  body = jsonencode({
    kind = "string"
    etag = "string"
  })
}

Property values

alertRules

Name Description Value
type The resource type "Microsoft.SecurityInsights/alertRules@2019-01-01-preview"
name The resource name string (required)
parent_id The ID of the resource to apply this extension resource to. string (required)
kind The kind of the alert rule "Fusion"
"MLBehaviorAnalytics"
"MicrosoftSecurityIncidentCreation"
"Scheduled"
"ThreatIntelligence" (required)
etag Etag of the azure resource string