Microsoft.SecurityInsights alertRules

Bicep-Ressourcendefinition

Der alertRules-Ressourcentyp kann mit Vorgängen bereitgestellt werden, die auf Folgendes abzielen:

Eine Liste der geänderten Eigenschaften in jeder API-Version finden Sie unter Änderungsprotokoll.

Ressourcenformat

Um eine Microsoft.SecurityInsights/alertRules-Ressource zu erstellen, fügen Sie ihrer Vorlage die folgende Bicep hinzu.

resource symbolicname 'Microsoft.SecurityInsights/alertRules@2025-09-01' = {
  etag: 'string'
  name: 'string'
  kind: 'string'
  // For remaining properties, see Microsoft.SecurityInsights/alertRules objects
}

Microsoft.SecurityInsights/alertRules-Objekte

Legen Sie die Art Eigenschaft fest, um den Objekttyp anzugeben.

Verwenden Sie für Fusion:

{
  kind: 'Fusion'
  properties: {
    alertRuleTemplateName: 'string'
    enabled: bool
  }
}

Verwenden Sie für MicrosoftSecurityIncidentCreation:

{
  kind: 'MicrosoftSecurityIncidentCreation'
  properties: {
    alertRuleTemplateName: 'string'
    description: 'string'
    displayName: 'string'
    displayNamesExcludeFilter: [
      'string'
    ]
    displayNamesFilter: [
      'string'
    ]
    enabled: bool
    productFilter: 'string'
    severitiesFilter: [
      'string'
    ]
  }
}

Verwenden Sie für geplantenFolgendes:

{
  kind: 'Scheduled'
  properties: {
    alertDetailsOverride: {
      alertDescriptionFormat: 'string'
      alertDisplayNameFormat: 'string'
      alertDynamicProperties: [
        {
          alertProperty: 'string'
          value: 'string'
        }
      ]
      alertSeverityColumnName: 'string'
      alertTacticsColumnName: 'string'
    }
    alertRuleTemplateName: 'string'
    customDetails: {
      {customized property}: 'string'
    }
    description: 'string'
    displayName: 'string'
    enabled: bool
    entityMappings: [
      {
        entityType: 'string'
        fieldMappings: [
          {
            columnName: 'string'
            identifier: 'string'
          }
        ]
      }
    ]
    eventGroupingSettings: {
      aggregationKind: 'string'
    }
    incidentConfiguration: {
      createIncident: bool
      groupingConfiguration: {
        enabled: bool
        groupByAlertDetails: [
          'string'
        ]
        groupByCustomDetails: [
          'string'
        ]
        groupByEntities: [
          'string'
        ]
        lookbackDuration: 'string'
        matchingMethod: 'string'
        reopenClosedIncident: bool
      }
    }
    query: 'string'
    queryFrequency: 'string'
    queryPeriod: 'string'
    severity: 'string'
    suppressionDuration: 'string'
    suppressionEnabled: bool
    tactics: [
      'string'
    ]
    techniques: [
      'string'
    ]
    templateVersion: 'string'
    triggerOperator: 'string'
    triggerThreshold: int
  }
}

Eigenschaftswerte

Microsoft.SecurityInsights/alertRules

AlertDetailsOverride

AlertPropertyMapping

Entitätszuordnung

EventGroupingEinstellungen

Feld-Mapping

FusionAlertRule

FusionAlertRule-Eigenschaften

GruppierungKonfiguration

IncidentConfiguration (Vorfall-Konfiguration)

MicrosoftSecurityIncidentCreationAlertRule

MicrosoftSecurityIncidentCreationAlertRuleEigenschaften

ScheduledAlertRule

ScheduledAlertRuleCommonPropertiesCustomDetails

ScheduledAlertRuleProperties

ARM-Vorlagenressourcendefinition

Der alertRules-Ressourcentyp kann mit Vorgängen bereitgestellt werden, die auf Folgendes abzielen:

Eine Liste der geänderten Eigenschaften in jeder API-Version finden Sie unter Änderungsprotokoll.

Ressourcenformat

Um eine Microsoft.SecurityInsights/alertRules-Ressource zu erstellen, fügen Sie der Vorlage den folgenden JSON-Code hinzu.

{
  "etag": "string",
  "name": "string",
  "kind": "string"
  // For remaining properties, see Microsoft.SecurityInsights/alertRules objects
}

Microsoft.SecurityInsights/alertRules-Objekte

Legen Sie die Art Eigenschaft fest, um den Objekttyp anzugeben.

Verwenden Sie für Fusion:

{
  "kind": "Fusion",
  "properties": {
    "alertRuleTemplateName": "string",
    "enabled": "bool"
  }
}

Verwenden Sie für MicrosoftSecurityIncidentCreation:

{
  "kind": "MicrosoftSecurityIncidentCreation",
  "properties": {
    "alertRuleTemplateName": "string",
    "description": "string",
    "displayName": "string",
    "displayNamesExcludeFilter": [ "string" ],
    "displayNamesFilter": [ "string" ],
    "enabled": "bool",
    "productFilter": "string",
    "severitiesFilter": [ "string" ]
  }
}

Verwenden Sie für geplantenFolgendes:

{
  "kind": "Scheduled",
  "properties": {
    "alertDetailsOverride": {
      "alertDescriptionFormat": "string",
      "alertDisplayNameFormat": "string",
      "alertDynamicProperties": [
        {
          "alertProperty": "string",
          "value": "string"
        }
      ],
      "alertSeverityColumnName": "string",
      "alertTacticsColumnName": "string"
    },
    "alertRuleTemplateName": "string",
    "customDetails": {
      "{customized property}": "string"
    },
    "description": "string",
    "displayName": "string",
    "enabled": "bool",
    "entityMappings": [
      {
        "entityType": "string",
        "fieldMappings": [
          {
            "columnName": "string",
            "identifier": "string"
          }
        ]
      }
    ],
    "eventGroupingSettings": {
      "aggregationKind": "string"
    },
    "incidentConfiguration": {
      "createIncident": "bool",
      "groupingConfiguration": {
        "enabled": "bool",
        "groupByAlertDetails": [ "string" ],
        "groupByCustomDetails": [ "string" ],
        "groupByEntities": [ "string" ],
        "lookbackDuration": "string",
        "matchingMethod": "string",
        "reopenClosedIncident": "bool"
      }
    },
    "query": "string",
    "queryFrequency": "string",
    "queryPeriod": "string",
    "severity": "string",
    "suppressionDuration": "string",
    "suppressionEnabled": "bool",
    "tactics": [ "string" ],
    "techniques": [ "string" ],
    "templateVersion": "string",
    "triggerOperator": "string",
    "triggerThreshold": "int"
  }
}

Eigenschaftswerte

Microsoft.SecurityInsights/alertRules

AlertDetailsOverride

AlertPropertyMapping

Entitätszuordnung

EventGroupingEinstellungen

Feld-Mapping

FusionAlertRule

FusionAlertRule-Eigenschaften

GruppierungKonfiguration

IncidentConfiguration (Vorfall-Konfiguration)

MicrosoftSecurityIncidentCreationAlertRule

MicrosoftSecurityIncidentCreationAlertRuleEigenschaften

ScheduledAlertRule

ScheduledAlertRuleCommonPropertiesCustomDetails

ScheduledAlertRuleProperties

Verwendungsbeispiele

Azure-Schnellstartvorlagen

Die folgenden Azure-Schnellstartvorlagen diesen Ressourcentyp bereitstellen.

Schablone	Beschreibung
Erstellt eine neue geplante Microsoft Sentinel-Analyseregel	In diesem Beispiel wird gezeigt, wie Sie eine neue geplante Analyseregel in Microsoft Sentinel erstellen.

Terraform -Ressourcendefinition (AzAPI-Anbieter)

Der alertRules-Ressourcentyp kann mit Vorgängen bereitgestellt werden, die auf Folgendes abzielen:

Eine Liste der geänderten Eigenschaften in jeder API-Version finden Sie unter Änderungsprotokoll.

Ressourcenformat

Um eine Microsoft.SecurityInsights/alertRules-Ressource zu erstellen, fügen Sie Ihrer Vorlage die folgende Terraform hinzu.

resource "azapi_resource" "symbolicname" {
  etag = "string"
  name = "string"
  kind = "string"
  // For remaining properties, see Microsoft.SecurityInsights/alertRules objects
}

Microsoft.SecurityInsights/alertRules-Objekte

Legen Sie die Art Eigenschaft fest, um den Objekttyp anzugeben.

Verwenden Sie für Fusion:

{
  kind = "Fusion"
  properties = {
    alertRuleTemplateName = "string"
    enabled = bool
  }
}

Verwenden Sie für MicrosoftSecurityIncidentCreation:

{
  kind = "MicrosoftSecurityIncidentCreation"
  properties = {
    alertRuleTemplateName = "string"
    description = "string"
    displayName = "string"
    displayNamesExcludeFilter = [
      "string"
    ]
    displayNamesFilter = [
      "string"
    ]
    enabled = bool
    productFilter = "string"
    severitiesFilter = [
      "string"
    ]
  }
}

Verwenden Sie für geplantenFolgendes:

{
  kind = "Scheduled"
  properties = {
    alertDetailsOverride = {
      alertDescriptionFormat = "string"
      alertDisplayNameFormat = "string"
      alertDynamicProperties = [
        {
          alertProperty = "string"
          value = "string"
        }
      ]
      alertSeverityColumnName = "string"
      alertTacticsColumnName = "string"
    }
    alertRuleTemplateName = "string"
    customDetails = {
      {customized property} = "string"
    }
    description = "string"
    displayName = "string"
    enabled = bool
    entityMappings = [
      {
        entityType = "string"
        fieldMappings = [
          {
            columnName = "string"
            identifier = "string"
          }
        ]
      }
    ]
    eventGroupingSettings = {
      aggregationKind = "string"
    }
    incidentConfiguration = {
      createIncident = bool
      groupingConfiguration = {
        enabled = bool
        groupByAlertDetails = [
          "string"
        ]
        groupByCustomDetails = [
          "string"
        ]
        groupByEntities = [
          "string"
        ]
        lookbackDuration = "string"
        matchingMethod = "string"
        reopenClosedIncident = bool
      }
    }
    query = "string"
    queryFrequency = "string"
    queryPeriod = "string"
    severity = "string"
    suppressionDuration = "string"
    suppressionEnabled = bool
    tactics = [
      "string"
    ]
    techniques = [
      "string"
    ]
    templateVersion = "string"
    triggerOperator = "string"
    triggerThreshold = int
  }
}

Eigenschaftswerte

Microsoft.SecurityInsights/alertRules

AlertDetailsOverride

AlertPropertyMapping

Entitätszuordnung

EventGroupingEinstellungen

Feld-Mapping

FusionAlertRule

FusionAlertRule-Eigenschaften

GruppierungKonfiguration

IncidentConfiguration (Vorfall-Konfiguration)

MicrosoftSecurityIncidentCreationAlertRule

MicrosoftSecurityIncidentCreationAlertRuleEigenschaften

ScheduledAlertRule

ScheduledAlertRuleCommonPropertiesCustomDetails

ScheduledAlertRuleProperties

Verwendungsbeispiele

Terraform-Beispiele

Ein grundlegendes Beispiel für die Bereitstellung der Sentinel-Warnregel.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "workspace" {
  type      = "Microsoft.OperationalInsights/workspaces@2022-10-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    properties = {
      features = {
        disableLocalAuth                            = false
        enableLogAccessUsingOnlyResourcePermissions = true
      }
      publicNetworkAccessForIngestion = "Enabled"
      publicNetworkAccessForQuery     = "Enabled"
      retentionInDays                 = 30
      sku = {
        name = "PerGB2018"
      }
      workspaceCapping = {
        dailyQuotaGb = -1
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "onboardingState" {
  type      = "Microsoft.SecurityInsights/onboardingStates@2023-06-01-preview"
  parent_id = azapi_resource.workspace.id
  name      = "default"
  body = {
    properties = {
      customerManagedKey = false
    }
  }
}

resource "azapi_resource" "alertRule" {
  type      = "Microsoft.SecurityInsights/alertRules@2022-10-01-preview"
  parent_id = azapi_resource.workspace.id
  name      = var.resource_name
  body = {
    kind = "NRT"
    properties = {
      description         = ""
      displayName         = "Some Rule"
      enabled             = true
      query               = "AzureActivity |\n  where OperationName == \"Create or Update Virtual Machine\" or OperationName ==\"Create Deployment\" |\n  where ActivityStatus == \"Succeeded\" |\n  make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller\n"
      severity            = "High"
      suppressionDuration = "PT5H"
      suppressionEnabled  = false
      tactics = [
      ]
      techniques = [
      ]
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
  depends_on                = [azapi_resource.onboardingState]
}