# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from .. import _utilities
from . import outputs

__all__ = [
    'AlertRuleScheduledEventGrouping',
    'AlertRuleScheduledIncidentConfiguration',
    'AlertRuleScheduledIncidentConfigurationGrouping',
    'GetAlertRuleTemplateScheduledTemplateResult',
    'GetAlertRuleTemplateSecurityIncidentTemplateResult',
]

@pulumi.output_type
class AlertRuleScheduledEventGrouping(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "aggregationMethod":
            suggest = "aggregation_method"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleScheduledEventGrouping. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleScheduledEventGrouping.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleScheduledEventGrouping.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 aggregation_method: str):
        """
        :param str aggregation_method: The aggregation type of grouping the events.
        """
        pulumi.set(__self__, "aggregation_method", aggregation_method)

    @property
    @pulumi.getter(name="aggregationMethod")
    def aggregation_method(self) -> str:
        """
        The aggregation type of grouping the events.
        """
        return pulumi.get(self, "aggregation_method")


@pulumi.output_type
class AlertRuleScheduledIncidentConfiguration(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "createIncident":
            suggest = "create_incident"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleScheduledIncidentConfiguration. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleScheduledIncidentConfiguration.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleScheduledIncidentConfiguration.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 create_incident: bool,
                 grouping: 'outputs.AlertRuleScheduledIncidentConfigurationGrouping'):
        """
        :param bool create_incident: Whether to create an incident from alerts triggered by this Sentinel Scheduled Alert Rule?
        :param 'AlertRuleScheduledIncidentConfigurationGroupingArgs' grouping: A `grouping` block as defined below.
        """
        pulumi.set(__self__, "create_incident", create_incident)
        pulumi.set(__self__, "grouping", grouping)

    @property
    @pulumi.getter(name="createIncident")
    def create_incident(self) -> bool:
        """
        Whether to create an incident from alerts triggered by this Sentinel Scheduled Alert Rule?
        """
        return pulumi.get(self, "create_incident")

    @property
    @pulumi.getter
    def grouping(self) -> 'outputs.AlertRuleScheduledIncidentConfigurationGrouping':
        """
        A `grouping` block as defined below.
        """
        return pulumi.get(self, "grouping")


@pulumi.output_type
class AlertRuleScheduledIncidentConfigurationGrouping(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "entityMatchingMethod":
            suggest = "entity_matching_method"
        elif key == "groupBies":
            suggest = "group_bies"
        elif key == "lookbackDuration":
            suggest = "lookback_duration"
        elif key == "reopenClosedIncidents":
            suggest = "reopen_closed_incidents"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleScheduledIncidentConfigurationGrouping. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleScheduledIncidentConfigurationGrouping.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleScheduledIncidentConfigurationGrouping.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 enabled: Optional[bool] = None,
                 entity_matching_method: Optional[str] = None,
                 group_bies: Optional[Sequence[str]] = None,
                 lookback_duration: Optional[str] = None,
                 reopen_closed_incidents: Optional[bool] = None):
        """
        :param bool enabled: Enable grouping incidents created from alerts triggered by this Sentinel Scheduled Alert Rule. Defaults to `true`.
        :param str entity_matching_method: The method used to group incidents. Possible values are `All`, `Custom` and `None`. Defaults to `None`.
        :param Sequence[str] group_bies: A list of entity types to group by, only when the `entity_matching_method` is `Custom`. Possible values are `Account`, `Host`, `Url`, `Ip`.
        :param str lookback_duration: Limit the group to alerts created within the lookback duration (in ISO 8601 duration format). Defaults to `PT5M`.
        :param bool reopen_closed_incidents: Whether to re-open closed matching incidents? Defaults to `false`.
        """
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if entity_matching_method is not None:
            pulumi.set(__self__, "entity_matching_method", entity_matching_method)
        if group_bies is not None:
            pulumi.set(__self__, "group_bies", group_bies)
        if lookback_duration is not None:
            pulumi.set(__self__, "lookback_duration", lookback_duration)
        if reopen_closed_incidents is not None:
            pulumi.set(__self__, "reopen_closed_incidents", reopen_closed_incidents)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[bool]:
        """
        Enable grouping incidents created from alerts triggered by this Sentinel Scheduled Alert Rule. Defaults to `true`.
        """
        return pulumi.get(self, "enabled")

    @property
    @pulumi.getter(name="entityMatchingMethod")
    def entity_matching_method(self) -> Optional[str]:
        """
        The method used to group incidents. Possible values are `All`, `Custom` and `None`. Defaults to `None`.
        """
        return pulumi.get(self, "entity_matching_method")

    @property
    @pulumi.getter(name="groupBies")
    def group_bies(self) -> Optional[Sequence[str]]:
        """
        A list of entity types to group by, only when the `entity_matching_method` is `Custom`. Possible values are `Account`, `Host`, `Url`, `Ip`.
        """
        return pulumi.get(self, "group_bies")

    @property
    @pulumi.getter(name="lookbackDuration")
    def lookback_duration(self) -> Optional[str]:
        """
        Limit the group to alerts created within the lookback duration (in ISO 8601 duration format). Defaults to `PT5M`.
        """
        return pulumi.get(self, "lookback_duration")

    @property
    @pulumi.getter(name="reopenClosedIncidents")
    def reopen_closed_incidents(self) -> Optional[bool]:
        """
        Whether to re-open closed matching incidents? Defaults to `false`.
        """
        return pulumi.get(self, "reopen_closed_incidents")


@pulumi.output_type
class GetAlertRuleTemplateScheduledTemplateResult(dict):
    def __init__(__self__, *,
                 description: str,
                 query: str,
                 query_frequency: str,
                 query_period: str,
                 severity: str,
                 tactics: Sequence[str],
                 trigger_operator: str,
                 trigger_threshold: int):
        """
        :param str description: The description of this Sentinel Scheduled Alert Rule Template.
        :param str query: The query of this Sentinel Scheduled Alert Rule Template.
        :param str query_frequency: The ISO 8601 timespan duration between two consecutive queries.
        :param str query_period: The ISO 8601 timespan duration, which determine the time period of the data covered by the query.
        :param str severity: The alert severity of this Sentinel Scheduled Alert Rule Template.
        :param Sequence[str] tactics: A list of categories of attacks by which to classify the rule.
        :param str trigger_operator: The alert trigger operator, combined with `trigger_threshold`, setting alert threshold of this Sentinel Scheduled Alert Rule Template.
        :param int trigger_threshold: The baseline number of query results generated, combined with `trigger_operator`, setting alert threshold of this Sentinel Scheduled Alert Rule Template.
        """
        pulumi.set(__self__, "description", description)
        pulumi.set(__self__, "query", query)
        pulumi.set(__self__, "query_frequency", query_frequency)
        pulumi.set(__self__, "query_period", query_period)
        pulumi.set(__self__, "severity", severity)
        pulumi.set(__self__, "tactics", tactics)
        pulumi.set(__self__, "trigger_operator", trigger_operator)
        pulumi.set(__self__, "trigger_threshold", trigger_threshold)

    @property
    @pulumi.getter
    def description(self) -> str:
        """
        The description of this Sentinel Scheduled Alert Rule Template.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter
    def query(self) -> str:
        """
        The query of this Sentinel Scheduled Alert Rule Template.
        """
        return pulumi.get(self, "query")

    @property
    @pulumi.getter(name="queryFrequency")
    def query_frequency(self) -> str:
        """
        The ISO 8601 timespan duration between two consecutive queries.
        """
        return pulumi.get(self, "query_frequency")

    @property
    @pulumi.getter(name="queryPeriod")
    def query_period(self) -> str:
        """
        The ISO 8601 timespan duration, which determine the time period of the data covered by the query.
        """
        return pulumi.get(self, "query_period")

    @property
    @pulumi.getter
    def severity(self) -> str:
        """
        The alert severity of this Sentinel Scheduled Alert Rule Template.
        """
        return pulumi.get(self, "severity")

    @property
    @pulumi.getter
    def tactics(self) -> Sequence[str]:
        """
        A list of categories of attacks by which to classify the rule.
        """
        return pulumi.get(self, "tactics")

    @property
    @pulumi.getter(name="triggerOperator")
    def trigger_operator(self) -> str:
        """
        The alert trigger operator, combined with `trigger_threshold`, setting alert threshold of this Sentinel Scheduled Alert Rule Template.
        """
        return pulumi.get(self, "trigger_operator")

    @property
    @pulumi.getter(name="triggerThreshold")
    def trigger_threshold(self) -> int:
        """
        The baseline number of query results generated, combined with `trigger_operator`, setting alert threshold of this Sentinel Scheduled Alert Rule Template.
        """
        return pulumi.get(self, "trigger_threshold")


@pulumi.output_type
class GetAlertRuleTemplateSecurityIncidentTemplateResult(dict):
    def __init__(__self__, *,
                 description: str,
                 product_filter: str):
        """
        :param str description: The description of this Sentinel Scheduled Alert Rule Template.
        :param str product_filter: The Microsoft Security Service from where the alert will be generated.
        """
        pulumi.set(__self__, "description", description)
        pulumi.set(__self__, "product_filter", product_filter)

    @property
    @pulumi.getter
    def description(self) -> str:
        """
        The description of this Sentinel Scheduled Alert Rule Template.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter(name="productFilter")
    def product_filter(self) -> str:
        """
        The Microsoft Security Service from where the alert will be generated.
        """
        return pulumi.get(self, "product_filter")


