ScheduledAlertRuleTemplateProperties interface

Package:

@azure/arm-securityinsight

Scheduled alert rule template properties

Properties

alertDetailsOverride	The alert details override settings
alertRulesCreatedByTemplateCount	The number of alert rules that were created by this template
createdDateUTC	The time that this alert rule template has been added.
customDetails	Dictionary of string key-value pairs of columns to be attached to the alert
description	The description of the alert rule template.
displayName	The display name for alert rule template.
entityMappings	Array of the entity mappings of the alert rule
eventGroupingSettings	The event grouping settings.
lastUpdatedDateUTC	The time that this alert rule template was last updated.
query	The query that creates alerts for this rule.
queryFrequency	The frequency (in ISO 8601 duration format) for this alert rule to run.
queryPeriod	The period (in ISO 8601 duration format) that this alert rule looks at.
requiredDataConnectors	The required data connectors for this template
sentinelEntitiesMappings	Array of the sentinel entity mappings of the alert rule
severity	The severity for alerts created by this alert rule.
status	The alert rule template status.
subTechniques	The sub-techniques of the alert rule
tactics	The tactics of the alert rule template
techniques	The techniques of the alert rule
triggerOperator	The operation against the threshold that triggers alert rule.
triggerThreshold	The threshold triggers this alert rule.
version	The version of this template - in format <a.b.c>, where all are numbers. For example <1.0.2>.

Property Details

alertDetailsOverride

The alert details override settings

alertDetailsOverride?: AlertDetailsOverride

Property Value

AlertDetailsOverride

alertRulesCreatedByTemplateCount

The number of alert rules that were created by this template

alertRulesCreatedByTemplateCount?: number

Property Value

number

createdDateUTC

The time that this alert rule template has been added.

createdDateUTC?: Date

Property Value

Date

customDetails

Dictionary of string key-value pairs of columns to be attached to the alert

customDetails?: Record<string, string>

Property Value

Record<string, string>

description

The description of the alert rule template.

description?: string

Property Value

string

displayName

The display name for alert rule template.

displayName?: string

Property Value

string

entityMappings

Array of the entity mappings of the alert rule

entityMappings?: EntityMapping[]

Property Value

EntityMapping[]

eventGroupingSettings

The event grouping settings.

eventGroupingSettings?: EventGroupingSettings

Property Value

EventGroupingSettings

lastUpdatedDateUTC

The time that this alert rule template was last updated.

lastUpdatedDateUTC?: Date

Property Value

Date

query

The query that creates alerts for this rule.

query?: string

Property Value

string

queryFrequency

The frequency (in ISO 8601 duration format) for this alert rule to run.

queryFrequency?: string

Property Value

string

queryPeriod

The period (in ISO 8601 duration format) that this alert rule looks at.

queryPeriod?: string

Property Value

string

requiredDataConnectors

The required data connectors for this template

requiredDataConnectors?: AlertRuleTemplateDataSource[]

Property Value

AlertRuleTemplateDataSource[]

sentinelEntitiesMappings

Array of the sentinel entity mappings of the alert rule

sentinelEntitiesMappings?: SentinelEntityMapping[]

Property Value

SentinelEntityMapping[]

severity

The severity for alerts created by this alert rule.

severity?: string

Property Value

string

status

The alert rule template status.

status?: string

Property Value

string

subTechniques

The sub-techniques of the alert rule

subTechniques?: string[]

Property Value

string[]

tactics

The tactics of the alert rule template

tactics?: string[]

Property Value

string[]

techniques

The techniques of the alert rule

techniques?: string[]

Property Value

string[]

triggerOperator

The operation against the threshold that triggers alert rule.

triggerOperator?: TriggerOperator

Property Value

TriggerOperator

triggerThreshold

The threshold triggers this alert rule.

triggerThreshold?: number

Property Value

number

version

The version of this template - in format <a.b.c>, where all are numbers. For example <1.0.2>.

version?: string

Property Value

string