# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from .. import _utilities

__all__ = [
    'AlertRuleScheduledEventGroupingArgs',
    'AlertRuleScheduledIncidentConfigurationArgs',
    'AlertRuleScheduledIncidentConfigurationGroupingArgs',
]

@pulumi.input_type
class AlertRuleScheduledEventGroupingArgs:
    def __init__(__self__, *,
                 aggregation_method: pulumi.Input[str]):
        """
        :param pulumi.Input[str] aggregation_method: The aggregation type of grouping the events.
        """
        pulumi.set(__self__, "aggregation_method", aggregation_method)

    @property
    @pulumi.getter(name="aggregationMethod")
    def aggregation_method(self) -> pulumi.Input[str]:
        """
        The aggregation type of grouping the events.
        """
        return pulumi.get(self, "aggregation_method")

    @aggregation_method.setter
    def aggregation_method(self, value: pulumi.Input[str]):
        pulumi.set(self, "aggregation_method", value)


@pulumi.input_type
class AlertRuleScheduledIncidentConfigurationArgs:
    def __init__(__self__, *,
                 create_incident: pulumi.Input[bool],
                 grouping: pulumi.Input['AlertRuleScheduledIncidentConfigurationGroupingArgs']):
        """
        :param pulumi.Input[bool] create_incident: Whether to create an incident from alerts triggered by this Sentinel Scheduled Alert Rule?
        :param pulumi.Input['AlertRuleScheduledIncidentConfigurationGroupingArgs'] grouping: A `grouping` block as defined below.
        """
        pulumi.set(__self__, "create_incident", create_incident)
        pulumi.set(__self__, "grouping", grouping)

    @property
    @pulumi.getter(name="createIncident")
    def create_incident(self) -> pulumi.Input[bool]:
        """
        Whether to create an incident from alerts triggered by this Sentinel Scheduled Alert Rule?
        """
        return pulumi.get(self, "create_incident")

    @create_incident.setter
    def create_incident(self, value: pulumi.Input[bool]):
        pulumi.set(self, "create_incident", value)

    @property
    @pulumi.getter
    def grouping(self) -> pulumi.Input['AlertRuleScheduledIncidentConfigurationGroupingArgs']:
        """
        A `grouping` block as defined below.
        """
        return pulumi.get(self, "grouping")

    @grouping.setter
    def grouping(self, value: pulumi.Input['AlertRuleScheduledIncidentConfigurationGroupingArgs']):
        pulumi.set(self, "grouping", value)


@pulumi.input_type
class AlertRuleScheduledIncidentConfigurationGroupingArgs:
    def __init__(__self__, *,
                 enabled: Optional[pulumi.Input[bool]] = None,
                 entity_matching_method: Optional[pulumi.Input[str]] = None,
                 group_bies: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 lookback_duration: Optional[pulumi.Input[str]] = None,
                 reopen_closed_incidents: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[bool] enabled: Enable grouping incidents created from alerts triggered by this Sentinel Scheduled Alert Rule. Defaults to `true`.
        :param pulumi.Input[str] entity_matching_method: The method used to group incidents. Possible values are `All`, `Custom` and `None`. Defaults to `None`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] group_bies: A list of entity types to group by, only when the `entity_matching_method` is `Custom`. Possible values are `Account`, `Host`, `Url`, `Ip`.
        :param pulumi.Input[str] lookback_duration: Limit the group to alerts created within the lookback duration (in ISO 8601 duration format). Defaults to `PT5M`.
        :param pulumi.Input[bool] reopen_closed_incidents: Whether to re-open closed matching incidents? Defaults to `false`.
        """
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if entity_matching_method is not None:
            pulumi.set(__self__, "entity_matching_method", entity_matching_method)
        if group_bies is not None:
            pulumi.set(__self__, "group_bies", group_bies)
        if lookback_duration is not None:
            pulumi.set(__self__, "lookback_duration", lookback_duration)
        if reopen_closed_incidents is not None:
            pulumi.set(__self__, "reopen_closed_incidents", reopen_closed_incidents)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Enable grouping incidents created from alerts triggered by this Sentinel Scheduled Alert Rule. Defaults to `true`.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter(name="entityMatchingMethod")
    def entity_matching_method(self) -> Optional[pulumi.Input[str]]:
        """
        The method used to group incidents. Possible values are `All`, `Custom` and `None`. Defaults to `None`.
        """
        return pulumi.get(self, "entity_matching_method")

    @entity_matching_method.setter
    def entity_matching_method(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "entity_matching_method", value)

    @property
    @pulumi.getter(name="groupBies")
    def group_bies(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of entity types to group by, only when the `entity_matching_method` is `Custom`. Possible values are `Account`, `Host`, `Url`, `Ip`.
        """
        return pulumi.get(self, "group_bies")

    @group_bies.setter
    def group_bies(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "group_bies", value)

    @property
    @pulumi.getter(name="lookbackDuration")
    def lookback_duration(self) -> Optional[pulumi.Input[str]]:
        """
        Limit the group to alerts created within the lookback duration (in ISO 8601 duration format). Defaults to `PT5M`.
        """
        return pulumi.get(self, "lookback_duration")

    @lookback_duration.setter
    def lookback_duration(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "lookback_duration", value)

    @property
    @pulumi.getter(name="reopenClosedIncidents")
    def reopen_closed_incidents(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether to re-open closed matching incidents? Defaults to `false`.
        """
        return pulumi.get(self, "reopen_closed_incidents")

    @reopen_closed_incidents.setter
    def reopen_closed_incidents(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "reopen_closed_incidents", value)


