GroupingConfiguration interface

Package:

@azure/arm-securityinsight

Grouping configuration property bag.

Properties

enabled	Grouping enabled
groupByAlertDetails	A list of alert details to group by (when matchingMethod is Selected)
groupByCustomDetails	A list of custom details keys to group by (when matchingMethod is Selected). Only keys defined in the current alert rule may be used.
groupByEntities	A list of entity types to group by (when matchingMethod is Selected). Only entities defined in the current alert rule may be used.
lookbackDuration	Limit the group to alerts created within the lookback duration (in ISO 8601 duration format)
matchingMethod	Grouping matching method. When method is Selected at least one of groupByEntities, groupByAlertDetails, groupByCustomDetails must be provided and not empty.
reopenClosedIncident	Re-open closed matching incidents

Property Details

enabled

Grouping enabled

enabled: boolean

Property Value

boolean

groupByAlertDetails

A list of alert details to group by (when matchingMethod is Selected)

groupByAlertDetails?: string[]

Property Value

string[]

groupByCustomDetails

A list of custom details keys to group by (when matchingMethod is Selected). Only keys defined in the current alert rule may be used.

groupByCustomDetails?: string[]

Property Value

string[]

groupByEntities

A list of entity types to group by (when matchingMethod is Selected). Only entities defined in the current alert rule may be used.

groupByEntities?: string[]

Property Value

string[]

lookbackDuration

Limit the group to alerts created within the lookback duration (in ISO 8601 duration format)

lookbackDuration: string

Property Value

string

matchingMethod

Grouping matching method. When method is Selected at least one of groupByEntities, groupByAlertDetails, groupByCustomDetails must be provided and not empty.

matchingMethod: string

Property Value

string

reopenClosedIncident

Re-open closed matching incidents

reopenClosedIncident: boolean

Property Value

boolean