# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import copy
import warnings
import sys
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
if sys.version_info >= (3, 11):
    from typing import NotRequired, TypedDict, TypeAlias
else:
    from typing_extensions import NotRequired, TypedDict, TypeAlias
from .. import _utilities
from . import outputs

__all__ = [
    'AlertRuleAnomalyBuiltInMultiSelectObservation',
    'AlertRuleAnomalyBuiltInPrioritizedExcludeObservation',
    'AlertRuleAnomalyBuiltInRequiredDataConnector',
    'AlertRuleAnomalyBuiltInSingleSelectObservation',
    'AlertRuleAnomalyBuiltInThresholdObservation',
    'AlertRuleAnomalyDuplicateMultiSelectObservation',
    'AlertRuleAnomalyDuplicatePrioritizedExcludeObservation',
    'AlertRuleAnomalyDuplicateRequiredDataConnector',
    'AlertRuleAnomalyDuplicateSingleSelectObservation',
    'AlertRuleAnomalyDuplicateThresholdObservation',
    'AlertRuleFusionSource',
    'AlertRuleFusionSourceSubType',
    'AlertRuleNrtAlertDetailsOverride',
    'AlertRuleNrtAlertDetailsOverrideDynamicProperty',
    'AlertRuleNrtEntityMapping',
    'AlertRuleNrtEntityMappingFieldMapping',
    'AlertRuleNrtEventGrouping',
    'AlertRuleNrtIncident',
    'AlertRuleNrtIncidentGrouping',
    'AlertRuleNrtSentinelEntityMapping',
    'AlertRuleScheduledAlertDetailsOverride',
    'AlertRuleScheduledAlertDetailsOverrideDynamicProperty',
    'AlertRuleScheduledEntityMapping',
    'AlertRuleScheduledEntityMappingFieldMapping',
    'AlertRuleScheduledEventGrouping',
    'AlertRuleScheduledIncident',
    'AlertRuleScheduledIncidentGrouping',
    'AlertRuleScheduledSentinelEntityMapping',
    'AuthomationRuleActionIncident',
    'AuthomationRuleActionPlaybook',
    'AutomationRuleActionIncident',
    'AutomationRuleActionPlaybook',
    'MetadataAuthor',
    'MetadataCategory',
    'MetadataSource',
    'MetadataSupport',
    'ThreatIntelligenceIndicatorExternalReference',
    'ThreatIntelligenceIndicatorGranularMarking',
    'ThreatIntelligenceIndicatorKillChainPhase',
    'ThreatIntelligenceIndicatorParsedPattern',
    'ThreatIntelligenceIndicatorParsedPatternPatternTypeValue',
    'GetAlertRuleAnomalyMultiSelectObservationResult',
    'GetAlertRuleAnomalyPrioritizedExcludeObservationResult',
    'GetAlertRuleAnomalyRequiredDataConnectorResult',
    'GetAlertRuleAnomalySingleSelectObservationResult',
    'GetAlertRuleAnomalyThresholdObservationResult',
    'GetAlertRuleTemplateNrtTemplateResult',
    'GetAlertRuleTemplateScheduledTemplateResult',
    'GetAlertRuleTemplateSecurityIncidentTemplateResult',
]

@pulumi.output_type
class AlertRuleAnomalyBuiltInMultiSelectObservation(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "supportedValues":
            suggest = "supported_values"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleAnomalyBuiltInMultiSelectObservation. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleAnomalyBuiltInMultiSelectObservation.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleAnomalyBuiltInMultiSelectObservation.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 description: Optional[str] = None,
                 name: Optional[str] = None,
                 supported_values: Optional[Sequence[str]] = None,
                 values: Optional[Sequence[str]] = None):
        """
        :param str description: The description of the threshold observation.
        :param str name: The Name of the built-in Anomaly Alert Rule.
        :param Sequence[str] supported_values: A list of supported values of the single select observation.
        :param Sequence[str] values: A list of values of the single select observation.
        """
        if description is not None:
            pulumi.set(__self__, "description", description)
        if name is not None:
            pulumi.set(__self__, "name", name)
        if supported_values is not None:
            pulumi.set(__self__, "supported_values", supported_values)
        if values is not None:
            pulumi.set(__self__, "values", values)

    @property
    @pulumi.getter
    def description(self) -> Optional[str]:
        """
        The description of the threshold observation.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter
    def name(self) -> Optional[str]:
        """
        The Name of the built-in Anomaly Alert Rule.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter(name="supportedValues")
    def supported_values(self) -> Optional[Sequence[str]]:
        """
        A list of supported values of the single select observation.
        """
        return pulumi.get(self, "supported_values")

    @property
    @pulumi.getter
    def values(self) -> Optional[Sequence[str]]:
        """
        A list of values of the single select observation.
        """
        return pulumi.get(self, "values")


@pulumi.output_type
class AlertRuleAnomalyBuiltInPrioritizedExcludeObservation(dict):
    def __init__(__self__, *,
                 description: Optional[str] = None,
                 exclude: Optional[str] = None,
                 name: Optional[str] = None,
                 prioritize: Optional[str] = None):
        """
        :param str description: The description of the threshold observation.
        :param str exclude: The excluded value per `description`.
        :param str name: The Name of the built-in Anomaly Alert Rule.
        :param str prioritize: The prioritized value per `description`.
        """
        if description is not None:
            pulumi.set(__self__, "description", description)
        if exclude is not None:
            pulumi.set(__self__, "exclude", exclude)
        if name is not None:
            pulumi.set(__self__, "name", name)
        if prioritize is not None:
            pulumi.set(__self__, "prioritize", prioritize)

    @property
    @pulumi.getter
    def description(self) -> Optional[str]:
        """
        The description of the threshold observation.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter
    def exclude(self) -> Optional[str]:
        """
        The excluded value per `description`.
        """
        return pulumi.get(self, "exclude")

    @property
    @pulumi.getter
    def name(self) -> Optional[str]:
        """
        The Name of the built-in Anomaly Alert Rule.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def prioritize(self) -> Optional[str]:
        """
        The prioritized value per `description`.
        """
        return pulumi.get(self, "prioritize")


@pulumi.output_type
class AlertRuleAnomalyBuiltInRequiredDataConnector(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "connectorId":
            suggest = "connector_id"
        elif key == "dataTypes":
            suggest = "data_types"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleAnomalyBuiltInRequiredDataConnector. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleAnomalyBuiltInRequiredDataConnector.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleAnomalyBuiltInRequiredDataConnector.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 connector_id: Optional[str] = None,
                 data_types: Optional[Sequence[str]] = None):
        """
        :param str connector_id: The ID of the required Data Connector.
        :param Sequence[str] data_types: A list of data types of the required Data Connector.
        """
        if connector_id is not None:
            pulumi.set(__self__, "connector_id", connector_id)
        if data_types is not None:
            pulumi.set(__self__, "data_types", data_types)

    @property
    @pulumi.getter(name="connectorId")
    def connector_id(self) -> Optional[str]:
        """
        The ID of the required Data Connector.
        """
        return pulumi.get(self, "connector_id")

    @property
    @pulumi.getter(name="dataTypes")
    def data_types(self) -> Optional[Sequence[str]]:
        """
        A list of data types of the required Data Connector.
        """
        return pulumi.get(self, "data_types")


@pulumi.output_type
class AlertRuleAnomalyBuiltInSingleSelectObservation(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "supportedValues":
            suggest = "supported_values"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleAnomalyBuiltInSingleSelectObservation. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleAnomalyBuiltInSingleSelectObservation.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleAnomalyBuiltInSingleSelectObservation.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 description: Optional[str] = None,
                 name: Optional[str] = None,
                 supported_values: Optional[Sequence[str]] = None,
                 value: Optional[str] = None):
        """
        :param str description: The description of the threshold observation.
        :param str name: The Name of the built-in Anomaly Alert Rule.
        :param Sequence[str] supported_values: A list of supported values of the single select observation.
        :param str value: The value of the threshold observation.
        """
        if description is not None:
            pulumi.set(__self__, "description", description)
        if name is not None:
            pulumi.set(__self__, "name", name)
        if supported_values is not None:
            pulumi.set(__self__, "supported_values", supported_values)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[str]:
        """
        The description of the threshold observation.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter
    def name(self) -> Optional[str]:
        """
        The Name of the built-in Anomaly Alert Rule.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter(name="supportedValues")
    def supported_values(self) -> Optional[Sequence[str]]:
        """
        A list of supported values of the single select observation.
        """
        return pulumi.get(self, "supported_values")

    @property
    @pulumi.getter
    def value(self) -> Optional[str]:
        """
        The value of the threshold observation.
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class AlertRuleAnomalyBuiltInThresholdObservation(dict):
    def __init__(__self__, *,
                 description: Optional[str] = None,
                 max: Optional[str] = None,
                 min: Optional[str] = None,
                 name: Optional[str] = None,
                 value: Optional[str] = None):
        """
        :param str description: The description of the threshold observation.
        :param str max: The max value of the threshold observation.
        :param str min: The min value of the threshold observation.
        :param str name: The Name of the built-in Anomaly Alert Rule.
        :param str value: The value of the threshold observation.
        """
        if description is not None:
            pulumi.set(__self__, "description", description)
        if max is not None:
            pulumi.set(__self__, "max", max)
        if min is not None:
            pulumi.set(__self__, "min", min)
        if name is not None:
            pulumi.set(__self__, "name", name)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[str]:
        """
        The description of the threshold observation.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter
    def max(self) -> Optional[str]:
        """
        The max value of the threshold observation.
        """
        return pulumi.get(self, "max")

    @property
    @pulumi.getter
    def min(self) -> Optional[str]:
        """
        The min value of the threshold observation.
        """
        return pulumi.get(self, "min")

    @property
    @pulumi.getter
    def name(self) -> Optional[str]:
        """
        The Name of the built-in Anomaly Alert Rule.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def value(self) -> Optional[str]:
        """
        The value of the threshold observation.
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class AlertRuleAnomalyDuplicateMultiSelectObservation(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "supportedValues":
            suggest = "supported_values"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleAnomalyDuplicateMultiSelectObservation. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleAnomalyDuplicateMultiSelectObservation.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleAnomalyDuplicateMultiSelectObservation.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 name: str,
                 values: Sequence[str],
                 description: Optional[str] = None,
                 supported_values: Optional[Sequence[str]] = None):
        """
        :param str name: The name of the multi select observation.
        :param Sequence[str] values: A list of values of the multi select observation.
        :param str description: The description of the multi select observation.
        :param Sequence[str] supported_values: A list of supported values of the multi select observation.
        """
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "values", values)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if supported_values is not None:
            pulumi.set(__self__, "supported_values", supported_values)

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The name of the multi select observation.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def values(self) -> Sequence[str]:
        """
        A list of values of the multi select observation.
        """
        return pulumi.get(self, "values")

    @property
    @pulumi.getter
    def description(self) -> Optional[str]:
        """
        The description of the multi select observation.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter(name="supportedValues")
    def supported_values(self) -> Optional[Sequence[str]]:
        """
        A list of supported values of the multi select observation.
        """
        return pulumi.get(self, "supported_values")


@pulumi.output_type
class AlertRuleAnomalyDuplicatePrioritizedExcludeObservation(dict):
    def __init__(__self__, *,
                 name: str,
                 description: Optional[str] = None,
                 exclude: Optional[str] = None,
                 prioritize: Optional[str] = None):
        """
        :param str name: The name of the prioritized exclude observation.
        :param str description: The description of the prioritized exclude observation.
        :param str exclude: The excluded value per `description`.
        :param str prioritize: The prioritized value per `description`.
        """
        pulumi.set(__self__, "name", name)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if exclude is not None:
            pulumi.set(__self__, "exclude", exclude)
        if prioritize is not None:
            pulumi.set(__self__, "prioritize", prioritize)

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The name of the prioritized exclude observation.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def description(self) -> Optional[str]:
        """
        The description of the prioritized exclude observation.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter
    def exclude(self) -> Optional[str]:
        """
        The excluded value per `description`.
        """
        return pulumi.get(self, "exclude")

    @property
    @pulumi.getter
    def prioritize(self) -> Optional[str]:
        """
        The prioritized value per `description`.
        """
        return pulumi.get(self, "prioritize")


@pulumi.output_type
class AlertRuleAnomalyDuplicateRequiredDataConnector(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "connectorId":
            suggest = "connector_id"
        elif key == "dataTypes":
            suggest = "data_types"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleAnomalyDuplicateRequiredDataConnector. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleAnomalyDuplicateRequiredDataConnector.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleAnomalyDuplicateRequiredDataConnector.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 connector_id: Optional[str] = None,
                 data_types: Optional[Sequence[str]] = None):
        """
        :param str connector_id: The ID of the required Data Connector.
        :param Sequence[str] data_types: A list of data types of the required Data Connector.
        """
        if connector_id is not None:
            pulumi.set(__self__, "connector_id", connector_id)
        if data_types is not None:
            pulumi.set(__self__, "data_types", data_types)

    @property
    @pulumi.getter(name="connectorId")
    def connector_id(self) -> Optional[str]:
        """
        The ID of the required Data Connector.
        """
        return pulumi.get(self, "connector_id")

    @property
    @pulumi.getter(name="dataTypes")
    def data_types(self) -> Optional[Sequence[str]]:
        """
        A list of data types of the required Data Connector.
        """
        return pulumi.get(self, "data_types")


@pulumi.output_type
class AlertRuleAnomalyDuplicateSingleSelectObservation(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "supportedValues":
            suggest = "supported_values"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleAnomalyDuplicateSingleSelectObservation. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleAnomalyDuplicateSingleSelectObservation.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleAnomalyDuplicateSingleSelectObservation.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 name: str,
                 value: str,
                 description: Optional[str] = None,
                 supported_values: Optional[Sequence[str]] = None):
        """
        :param str name: The name of the single select observation.
        :param str value: The value of the multi select observation.
        :param str description: The description of the single select observation.
        :param Sequence[str] supported_values: A list of supported values of the single select observation.
        """
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "value", value)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if supported_values is not None:
            pulumi.set(__self__, "supported_values", supported_values)

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The name of the single select observation.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def value(self) -> str:
        """
        The value of the multi select observation.
        """
        return pulumi.get(self, "value")

    @property
    @pulumi.getter
    def description(self) -> Optional[str]:
        """
        The description of the single select observation.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter(name="supportedValues")
    def supported_values(self) -> Optional[Sequence[str]]:
        """
        A list of supported values of the single select observation.
        """
        return pulumi.get(self, "supported_values")


@pulumi.output_type
class AlertRuleAnomalyDuplicateThresholdObservation(dict):
    def __init__(__self__, *,
                 name: str,
                 value: str,
                 description: Optional[str] = None,
                 max: Optional[str] = None,
                 min: Optional[str] = None):
        """
        :param str name: The name of the threshold observation.
        :param str value: The value of the threshold observation.
        :param str description: The description of the threshold observation.
        :param str max: The max value of the threshold observation.
        :param str min: The min value of the threshold observation.
        """
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "value", value)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if max is not None:
            pulumi.set(__self__, "max", max)
        if min is not None:
            pulumi.set(__self__, "min", min)

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The name of the threshold observation.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def value(self) -> str:
        """
        The value of the threshold observation.
        """
        return pulumi.get(self, "value")

    @property
    @pulumi.getter
    def description(self) -> Optional[str]:
        """
        The description of the threshold observation.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter
    def max(self) -> Optional[str]:
        """
        The max value of the threshold observation.
        """
        return pulumi.get(self, "max")

    @property
    @pulumi.getter
    def min(self) -> Optional[str]:
        """
        The min value of the threshold observation.
        """
        return pulumi.get(self, "min")


@pulumi.output_type
class AlertRuleFusionSource(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "subTypes":
            suggest = "sub_types"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleFusionSource. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleFusionSource.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleFusionSource.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 name: str,
                 enabled: Optional[bool] = None,
                 sub_types: Optional[Sequence['outputs.AlertRuleFusionSourceSubType']] = None):
        """
        :param str name: The name of the Fusion source signal. Refer to Fusion alert rule template for supported values.
        :param bool enabled: Whether this source signal is enabled or disabled in Fusion detection? Defaults to `true`.
        :param Sequence['AlertRuleFusionSourceSubTypeArgs'] sub_types: One or more `sub_type` blocks as defined below.
        """
        pulumi.set(__self__, "name", name)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if sub_types is not None:
            pulumi.set(__self__, "sub_types", sub_types)

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The name of the Fusion source signal. Refer to Fusion alert rule template for supported values.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def enabled(self) -> Optional[bool]:
        """
        Whether this source signal is enabled or disabled in Fusion detection? Defaults to `true`.
        """
        return pulumi.get(self, "enabled")

    @property
    @pulumi.getter(name="subTypes")
    def sub_types(self) -> Optional[Sequence['outputs.AlertRuleFusionSourceSubType']]:
        """
        One or more `sub_type` blocks as defined below.
        """
        return pulumi.get(self, "sub_types")


@pulumi.output_type
class AlertRuleFusionSourceSubType(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "severitiesAlloweds":
            suggest = "severities_alloweds"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleFusionSourceSubType. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleFusionSourceSubType.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleFusionSourceSubType.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 name: str,
                 severities_alloweds: Sequence[str],
                 enabled: Optional[bool] = None):
        """
        :param str name: The Name of the source subtype under a given source signal in Fusion detection. Refer to Fusion alert rule template for supported values.
        :param Sequence[str] severities_alloweds: A list of severities that are enabled for this source subtype consumed in Fusion detection. Possible values for each element are `High`, `Medium`, `Low`, `Informational`.
        :param bool enabled: Whether this source subtype under source signal is enabled or disabled in Fusion detection. Defaults to `true`.
        """
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "severities_alloweds", severities_alloweds)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The Name of the source subtype under a given source signal in Fusion detection. Refer to Fusion alert rule template for supported values.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter(name="severitiesAlloweds")
    def severities_alloweds(self) -> Sequence[str]:
        """
        A list of severities that are enabled for this source subtype consumed in Fusion detection. Possible values for each element are `High`, `Medium`, `Low`, `Informational`.
        """
        return pulumi.get(self, "severities_alloweds")

    @property
    @pulumi.getter
    def enabled(self) -> Optional[bool]:
        """
        Whether this source subtype under source signal is enabled or disabled in Fusion detection. Defaults to `true`.
        """
        return pulumi.get(self, "enabled")


@pulumi.output_type
class AlertRuleNrtAlertDetailsOverride(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "descriptionFormat":
            suggest = "description_format"
        elif key == "displayNameFormat":
            suggest = "display_name_format"
        elif key == "dynamicProperties":
            suggest = "dynamic_properties"
        elif key == "severityColumnName":
            suggest = "severity_column_name"
        elif key == "tacticsColumnName":
            suggest = "tactics_column_name"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleNrtAlertDetailsOverride. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleNrtAlertDetailsOverride.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleNrtAlertDetailsOverride.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 description_format: Optional[str] = None,
                 display_name_format: Optional[str] = None,
                 dynamic_properties: Optional[Sequence['outputs.AlertRuleNrtAlertDetailsOverrideDynamicProperty']] = None,
                 severity_column_name: Optional[str] = None,
                 tactics_column_name: Optional[str] = None):
        """
        :param str description_format: The format containing columns name(s) to override the description of this Sentinel Alert Rule.
        :param str display_name_format: The format containing columns name(s) to override the name of this Sentinel Alert Rule.
        :param Sequence['AlertRuleNrtAlertDetailsOverrideDynamicPropertyArgs'] dynamic_properties: A list of `dynamic_property` blocks as defined below.
        :param str severity_column_name: The column name to take the alert severity from.
        :param str tactics_column_name: The column name to take the alert tactics from.
        """
        if description_format is not None:
            pulumi.set(__self__, "description_format", description_format)
        if display_name_format is not None:
            pulumi.set(__self__, "display_name_format", display_name_format)
        if dynamic_properties is not None:
            pulumi.set(__self__, "dynamic_properties", dynamic_properties)
        if severity_column_name is not None:
            pulumi.set(__self__, "severity_column_name", severity_column_name)
        if tactics_column_name is not None:
            pulumi.set(__self__, "tactics_column_name", tactics_column_name)

    @property
    @pulumi.getter(name="descriptionFormat")
    def description_format(self) -> Optional[str]:
        """
        The format containing columns name(s) to override the description of this Sentinel Alert Rule.
        """
        return pulumi.get(self, "description_format")

    @property
    @pulumi.getter(name="displayNameFormat")
    def display_name_format(self) -> Optional[str]:
        """
        The format containing columns name(s) to override the name of this Sentinel Alert Rule.
        """
        return pulumi.get(self, "display_name_format")

    @property
    @pulumi.getter(name="dynamicProperties")
    def dynamic_properties(self) -> Optional[Sequence['outputs.AlertRuleNrtAlertDetailsOverrideDynamicProperty']]:
        """
        A list of `dynamic_property` blocks as defined below.
        """
        return pulumi.get(self, "dynamic_properties")

    @property
    @pulumi.getter(name="severityColumnName")
    def severity_column_name(self) -> Optional[str]:
        """
        The column name to take the alert severity from.
        """
        return pulumi.get(self, "severity_column_name")

    @property
    @pulumi.getter(name="tacticsColumnName")
    def tactics_column_name(self) -> Optional[str]:
        """
        The column name to take the alert tactics from.
        """
        return pulumi.get(self, "tactics_column_name")


@pulumi.output_type
class AlertRuleNrtAlertDetailsOverrideDynamicProperty(dict):
    def __init__(__self__, *,
                 name: str,
                 value: str):
        """
        :param str name: The name of the dynamic property. Possible Values are `AlertLink`, `ConfidenceLevel`, `ConfidenceScore`, `ExtendedLinks`, `ProductComponentName`, `ProductName`, `ProviderName`, `RemediationSteps` and `Techniques`.
        :param str value: The value of the dynamic property. Pssible Values are `Caller`, `dcount_ResourceId` and `EventSubmissionTimestamp`.
        """
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The name of the dynamic property. Possible Values are `AlertLink`, `ConfidenceLevel`, `ConfidenceScore`, `ExtendedLinks`, `ProductComponentName`, `ProductName`, `ProviderName`, `RemediationSteps` and `Techniques`.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def value(self) -> str:
        """
        The value of the dynamic property. Pssible Values are `Caller`, `dcount_ResourceId` and `EventSubmissionTimestamp`.
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class AlertRuleNrtEntityMapping(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "entityType":
            suggest = "entity_type"
        elif key == "fieldMappings":
            suggest = "field_mappings"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleNrtEntityMapping. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleNrtEntityMapping.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleNrtEntityMapping.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 entity_type: str,
                 field_mappings: Sequence['outputs.AlertRuleNrtEntityMappingFieldMapping']):
        """
        :param str entity_type: The type of the entity. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        :param Sequence['AlertRuleNrtEntityMappingFieldMappingArgs'] field_mappings: A list of `field_mapping` blocks as defined below.
        """
        pulumi.set(__self__, "entity_type", entity_type)
        pulumi.set(__self__, "field_mappings", field_mappings)

    @property
    @pulumi.getter(name="entityType")
    def entity_type(self) -> str:
        """
        The type of the entity. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        """
        return pulumi.get(self, "entity_type")

    @property
    @pulumi.getter(name="fieldMappings")
    def field_mappings(self) -> Sequence['outputs.AlertRuleNrtEntityMappingFieldMapping']:
        """
        A list of `field_mapping` blocks as defined below.
        """
        return pulumi.get(self, "field_mappings")


@pulumi.output_type
class AlertRuleNrtEntityMappingFieldMapping(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "columnName":
            suggest = "column_name"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleNrtEntityMappingFieldMapping. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleNrtEntityMappingFieldMapping.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleNrtEntityMappingFieldMapping.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 column_name: str,
                 identifier: str):
        """
        :param str column_name: The column name to be mapped to the identifier.
        :param str identifier: The identifier of the entity.
        """
        pulumi.set(__self__, "column_name", column_name)
        pulumi.set(__self__, "identifier", identifier)

    @property
    @pulumi.getter(name="columnName")
    def column_name(self) -> str:
        """
        The column name to be mapped to the identifier.
        """
        return pulumi.get(self, "column_name")

    @property
    @pulumi.getter
    def identifier(self) -> str:
        """
        The identifier of the entity.
        """
        return pulumi.get(self, "identifier")


@pulumi.output_type
class AlertRuleNrtEventGrouping(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "aggregationMethod":
            suggest = "aggregation_method"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleNrtEventGrouping. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleNrtEventGrouping.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleNrtEventGrouping.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 aggregation_method: str):
        """
        :param str aggregation_method: The aggregation type of grouping the events. Possible values are `AlertPerResult` and `SingleAlert`.
        """
        pulumi.set(__self__, "aggregation_method", aggregation_method)

    @property
    @pulumi.getter(name="aggregationMethod")
    def aggregation_method(self) -> str:
        """
        The aggregation type of grouping the events. Possible values are `AlertPerResult` and `SingleAlert`.
        """
        return pulumi.get(self, "aggregation_method")


@pulumi.output_type
class AlertRuleNrtIncident(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "createIncidentEnabled":
            suggest = "create_incident_enabled"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleNrtIncident. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleNrtIncident.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleNrtIncident.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 create_incident_enabled: bool,
                 grouping: 'outputs.AlertRuleNrtIncidentGrouping'):
        """
        :param bool create_incident_enabled: Whether to create an incident from alerts triggered by this Sentinel NRT Alert Rule?
        :param 'AlertRuleNrtIncidentGroupingArgs' grouping: A `grouping` block as defined below.
        """
        pulumi.set(__self__, "create_incident_enabled", create_incident_enabled)
        pulumi.set(__self__, "grouping", grouping)

    @property
    @pulumi.getter(name="createIncidentEnabled")
    def create_incident_enabled(self) -> bool:
        """
        Whether to create an incident from alerts triggered by this Sentinel NRT Alert Rule?
        """
        return pulumi.get(self, "create_incident_enabled")

    @property
    @pulumi.getter
    def grouping(self) -> 'outputs.AlertRuleNrtIncidentGrouping':
        """
        A `grouping` block as defined below.
        """
        return pulumi.get(self, "grouping")


@pulumi.output_type
class AlertRuleNrtIncidentGrouping(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "byAlertDetails":
            suggest = "by_alert_details"
        elif key == "byCustomDetails":
            suggest = "by_custom_details"
        elif key == "byEntities":
            suggest = "by_entities"
        elif key == "entityMatchingMethod":
            suggest = "entity_matching_method"
        elif key == "lookbackDuration":
            suggest = "lookback_duration"
        elif key == "reopenClosedIncidents":
            suggest = "reopen_closed_incidents"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleNrtIncidentGrouping. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleNrtIncidentGrouping.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleNrtIncidentGrouping.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 by_alert_details: Optional[Sequence[str]] = None,
                 by_custom_details: Optional[Sequence[str]] = None,
                 by_entities: Optional[Sequence[str]] = None,
                 enabled: Optional[bool] = None,
                 entity_matching_method: Optional[str] = None,
                 lookback_duration: Optional[str] = None,
                 reopen_closed_incidents: Optional[bool] = None):
        """
        :param Sequence[str] by_alert_details: A list of alert details to group by, only when the `entity_matching_method` is `Selected`. Possible values are `DisplayName` and `Severity`.
        :param Sequence[str] by_custom_details: A list of custom details keys to group by, only when the `entity_matching_method` is `Selected`. Only keys defined in the `custom_details` may be used.
        :param Sequence[str] by_entities: A list of entity types to group by, only when the `entity_matching_method` is `Selected`. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        :param bool enabled: Enable grouping incidents created from alerts triggered by this Sentinel NRT Alert Rule. Defaults to `true`.
        :param str entity_matching_method: The method used to group incidents. Possible values are `AnyAlert`, `Selected` and `AllEntities`. Defaults to `AnyAlert`.
        :param str lookback_duration: Limit the group to alerts created within the lookback duration (in ISO 8601 duration format). Defaults to `PT5M`.
        :param bool reopen_closed_incidents: Whether to re-open closed matching incidents? Defaults to `false`.
        """
        if by_alert_details is not None:
            pulumi.set(__self__, "by_alert_details", by_alert_details)
        if by_custom_details is not None:
            pulumi.set(__self__, "by_custom_details", by_custom_details)
        if by_entities is not None:
            pulumi.set(__self__, "by_entities", by_entities)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if entity_matching_method is not None:
            pulumi.set(__self__, "entity_matching_method", entity_matching_method)
        if lookback_duration is not None:
            pulumi.set(__self__, "lookback_duration", lookback_duration)
        if reopen_closed_incidents is not None:
            pulumi.set(__self__, "reopen_closed_incidents", reopen_closed_incidents)

    @property
    @pulumi.getter(name="byAlertDetails")
    def by_alert_details(self) -> Optional[Sequence[str]]:
        """
        A list of alert details to group by, only when the `entity_matching_method` is `Selected`. Possible values are `DisplayName` and `Severity`.
        """
        return pulumi.get(self, "by_alert_details")

    @property
    @pulumi.getter(name="byCustomDetails")
    def by_custom_details(self) -> Optional[Sequence[str]]:
        """
        A list of custom details keys to group by, only when the `entity_matching_method` is `Selected`. Only keys defined in the `custom_details` may be used.
        """
        return pulumi.get(self, "by_custom_details")

    @property
    @pulumi.getter(name="byEntities")
    def by_entities(self) -> Optional[Sequence[str]]:
        """
        A list of entity types to group by, only when the `entity_matching_method` is `Selected`. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        """
        return pulumi.get(self, "by_entities")

    @property
    @pulumi.getter
    def enabled(self) -> Optional[bool]:
        """
        Enable grouping incidents created from alerts triggered by this Sentinel NRT Alert Rule. Defaults to `true`.
        """
        return pulumi.get(self, "enabled")

    @property
    @pulumi.getter(name="entityMatchingMethod")
    def entity_matching_method(self) -> Optional[str]:
        """
        The method used to group incidents. Possible values are `AnyAlert`, `Selected` and `AllEntities`. Defaults to `AnyAlert`.
        """
        return pulumi.get(self, "entity_matching_method")

    @property
    @pulumi.getter(name="lookbackDuration")
    def lookback_duration(self) -> Optional[str]:
        """
        Limit the group to alerts created within the lookback duration (in ISO 8601 duration format). Defaults to `PT5M`.
        """
        return pulumi.get(self, "lookback_duration")

    @property
    @pulumi.getter(name="reopenClosedIncidents")
    def reopen_closed_incidents(self) -> Optional[bool]:
        """
        Whether to re-open closed matching incidents? Defaults to `false`.
        """
        return pulumi.get(self, "reopen_closed_incidents")


@pulumi.output_type
class AlertRuleNrtSentinelEntityMapping(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "columnName":
            suggest = "column_name"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleNrtSentinelEntityMapping. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleNrtSentinelEntityMapping.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleNrtSentinelEntityMapping.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 column_name: str):
        """
        :param str column_name: The column name to be mapped to the identifier.
        """
        pulumi.set(__self__, "column_name", column_name)

    @property
    @pulumi.getter(name="columnName")
    def column_name(self) -> str:
        """
        The column name to be mapped to the identifier.
        """
        return pulumi.get(self, "column_name")


@pulumi.output_type
class AlertRuleScheduledAlertDetailsOverride(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "descriptionFormat":
            suggest = "description_format"
        elif key == "displayNameFormat":
            suggest = "display_name_format"
        elif key == "dynamicProperties":
            suggest = "dynamic_properties"
        elif key == "severityColumnName":
            suggest = "severity_column_name"
        elif key == "tacticsColumnName":
            suggest = "tactics_column_name"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleScheduledAlertDetailsOverride. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleScheduledAlertDetailsOverride.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleScheduledAlertDetailsOverride.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 description_format: Optional[str] = None,
                 display_name_format: Optional[str] = None,
                 dynamic_properties: Optional[Sequence['outputs.AlertRuleScheduledAlertDetailsOverrideDynamicProperty']] = None,
                 severity_column_name: Optional[str] = None,
                 tactics_column_name: Optional[str] = None):
        """
        :param str description_format: The format containing columns name(s) to override the description of this Sentinel Alert Rule.
        :param str display_name_format: The format containing columns name(s) to override the name of this Sentinel Alert Rule.
        :param Sequence['AlertRuleScheduledAlertDetailsOverrideDynamicPropertyArgs'] dynamic_properties: A list of `dynamic_property` blocks as defined below.
        :param str severity_column_name: The column name to take the alert severity from.
        :param str tactics_column_name: The column name to take the alert tactics from.
        """
        if description_format is not None:
            pulumi.set(__self__, "description_format", description_format)
        if display_name_format is not None:
            pulumi.set(__self__, "display_name_format", display_name_format)
        if dynamic_properties is not None:
            pulumi.set(__self__, "dynamic_properties", dynamic_properties)
        if severity_column_name is not None:
            pulumi.set(__self__, "severity_column_name", severity_column_name)
        if tactics_column_name is not None:
            pulumi.set(__self__, "tactics_column_name", tactics_column_name)

    @property
    @pulumi.getter(name="descriptionFormat")
    def description_format(self) -> Optional[str]:
        """
        The format containing columns name(s) to override the description of this Sentinel Alert Rule.
        """
        return pulumi.get(self, "description_format")

    @property
    @pulumi.getter(name="displayNameFormat")
    def display_name_format(self) -> Optional[str]:
        """
        The format containing columns name(s) to override the name of this Sentinel Alert Rule.
        """
        return pulumi.get(self, "display_name_format")

    @property
    @pulumi.getter(name="dynamicProperties")
    def dynamic_properties(self) -> Optional[Sequence['outputs.AlertRuleScheduledAlertDetailsOverrideDynamicProperty']]:
        """
        A list of `dynamic_property` blocks as defined below.
        """
        return pulumi.get(self, "dynamic_properties")

    @property
    @pulumi.getter(name="severityColumnName")
    def severity_column_name(self) -> Optional[str]:
        """
        The column name to take the alert severity from.
        """
        return pulumi.get(self, "severity_column_name")

    @property
    @pulumi.getter(name="tacticsColumnName")
    def tactics_column_name(self) -> Optional[str]:
        """
        The column name to take the alert tactics from.
        """
        return pulumi.get(self, "tactics_column_name")


@pulumi.output_type
class AlertRuleScheduledAlertDetailsOverrideDynamicProperty(dict):
    def __init__(__self__, *,
                 name: str,
                 value: str):
        """
        :param str name: The name of the dynamic property. Possible Values are `AlertLink`, `ConfidenceLevel`, `ConfidenceScore`, `ExtendedLinks`, `ProductComponentName`, `ProductName`, `ProviderName`, `RemediationSteps` and `Techniques`.
        :param str value: The value of the dynamic property. Pssible Values are `Caller`, `dcount_ResourceId` and `EventSubmissionTimestamp`.
        """
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The name of the dynamic property. Possible Values are `AlertLink`, `ConfidenceLevel`, `ConfidenceScore`, `ExtendedLinks`, `ProductComponentName`, `ProductName`, `ProviderName`, `RemediationSteps` and `Techniques`.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def value(self) -> str:
        """
        The value of the dynamic property. Pssible Values are `Caller`, `dcount_ResourceId` and `EventSubmissionTimestamp`.
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class AlertRuleScheduledEntityMapping(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "entityType":
            suggest = "entity_type"
        elif key == "fieldMappings":
            suggest = "field_mappings"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleScheduledEntityMapping. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleScheduledEntityMapping.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleScheduledEntityMapping.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 entity_type: str,
                 field_mappings: Sequence['outputs.AlertRuleScheduledEntityMappingFieldMapping']):
        """
        :param str entity_type: The type of the entity. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        :param Sequence['AlertRuleScheduledEntityMappingFieldMappingArgs'] field_mappings: A list of `field_mapping` blocks as defined below.
        """
        pulumi.set(__self__, "entity_type", entity_type)
        pulumi.set(__self__, "field_mappings", field_mappings)

    @property
    @pulumi.getter(name="entityType")
    def entity_type(self) -> str:
        """
        The type of the entity. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        """
        return pulumi.get(self, "entity_type")

    @property
    @pulumi.getter(name="fieldMappings")
    def field_mappings(self) -> Sequence['outputs.AlertRuleScheduledEntityMappingFieldMapping']:
        """
        A list of `field_mapping` blocks as defined below.
        """
        return pulumi.get(self, "field_mappings")


@pulumi.output_type
class AlertRuleScheduledEntityMappingFieldMapping(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "columnName":
            suggest = "column_name"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleScheduledEntityMappingFieldMapping. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleScheduledEntityMappingFieldMapping.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleScheduledEntityMappingFieldMapping.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 column_name: str,
                 identifier: str):
        """
        :param str column_name: The column name to be mapped to the identifier.
        :param str identifier: The identifier of the entity.
        """
        pulumi.set(__self__, "column_name", column_name)
        pulumi.set(__self__, "identifier", identifier)

    @property
    @pulumi.getter(name="columnName")
    def column_name(self) -> str:
        """
        The column name to be mapped to the identifier.
        """
        return pulumi.get(self, "column_name")

    @property
    @pulumi.getter
    def identifier(self) -> str:
        """
        The identifier of the entity.
        """
        return pulumi.get(self, "identifier")


@pulumi.output_type
class AlertRuleScheduledEventGrouping(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "aggregationMethod":
            suggest = "aggregation_method"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleScheduledEventGrouping. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleScheduledEventGrouping.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleScheduledEventGrouping.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 aggregation_method: str):
        """
        :param str aggregation_method: The aggregation type of grouping the events. Possible values are `AlertPerResult` and `SingleAlert`.
        """
        pulumi.set(__self__, "aggregation_method", aggregation_method)

    @property
    @pulumi.getter(name="aggregationMethod")
    def aggregation_method(self) -> str:
        """
        The aggregation type of grouping the events. Possible values are `AlertPerResult` and `SingleAlert`.
        """
        return pulumi.get(self, "aggregation_method")


@pulumi.output_type
class AlertRuleScheduledIncident(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "createIncidentEnabled":
            suggest = "create_incident_enabled"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleScheduledIncident. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleScheduledIncident.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleScheduledIncident.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 create_incident_enabled: bool,
                 grouping: 'outputs.AlertRuleScheduledIncidentGrouping'):
        """
        :param bool create_incident_enabled: Whether to create an incident from alerts triggered by this Sentinel Scheduled Alert Rule?
        :param 'AlertRuleScheduledIncidentGroupingArgs' grouping: A `grouping` block as defined below.
        """
        pulumi.set(__self__, "create_incident_enabled", create_incident_enabled)
        pulumi.set(__self__, "grouping", grouping)

    @property
    @pulumi.getter(name="createIncidentEnabled")
    def create_incident_enabled(self) -> bool:
        """
        Whether to create an incident from alerts triggered by this Sentinel Scheduled Alert Rule?
        """
        return pulumi.get(self, "create_incident_enabled")

    @property
    @pulumi.getter
    def grouping(self) -> 'outputs.AlertRuleScheduledIncidentGrouping':
        """
        A `grouping` block as defined below.
        """
        return pulumi.get(self, "grouping")


@pulumi.output_type
class AlertRuleScheduledIncidentGrouping(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "byAlertDetails":
            suggest = "by_alert_details"
        elif key == "byCustomDetails":
            suggest = "by_custom_details"
        elif key == "byEntities":
            suggest = "by_entities"
        elif key == "entityMatchingMethod":
            suggest = "entity_matching_method"
        elif key == "lookbackDuration":
            suggest = "lookback_duration"
        elif key == "reopenClosedIncidents":
            suggest = "reopen_closed_incidents"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleScheduledIncidentGrouping. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleScheduledIncidentGrouping.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleScheduledIncidentGrouping.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 by_alert_details: Optional[Sequence[str]] = None,
                 by_custom_details: Optional[Sequence[str]] = None,
                 by_entities: Optional[Sequence[str]] = None,
                 enabled: Optional[bool] = None,
                 entity_matching_method: Optional[str] = None,
                 lookback_duration: Optional[str] = None,
                 reopen_closed_incidents: Optional[bool] = None):
        """
        :param Sequence[str] by_alert_details: A list of alert details to group by, only when the `entity_matching_method` is `Selected`. Possible values are `DisplayName` and `Severity`.
        :param Sequence[str] by_custom_details: A list of custom details keys to group by, only when the `entity_matching_method` is `Selected`. Only keys defined in the `custom_details` may be used.
        :param Sequence[str] by_entities: A list of entity types to group by, only when the `entity_matching_method` is `Selected`. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        :param bool enabled: Enable grouping incidents created from alerts triggered by this Sentinel Scheduled Alert Rule. Defaults to `true`.
        :param str entity_matching_method: The method used to group incidents. Possible values are `AnyAlert`, `Selected` and `AllEntities`. Defaults to `AnyAlert`.
        :param str lookback_duration: Limit the group to alerts created within the lookback duration (in ISO 8601 duration format). Defaults to `PT5M`.
        :param bool reopen_closed_incidents: Whether to re-open closed matching incidents? Defaults to `false`.
        """
        if by_alert_details is not None:
            pulumi.set(__self__, "by_alert_details", by_alert_details)
        if by_custom_details is not None:
            pulumi.set(__self__, "by_custom_details", by_custom_details)
        if by_entities is not None:
            pulumi.set(__self__, "by_entities", by_entities)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if entity_matching_method is not None:
            pulumi.set(__self__, "entity_matching_method", entity_matching_method)
        if lookback_duration is not None:
            pulumi.set(__self__, "lookback_duration", lookback_duration)
        if reopen_closed_incidents is not None:
            pulumi.set(__self__, "reopen_closed_incidents", reopen_closed_incidents)

    @property
    @pulumi.getter(name="byAlertDetails")
    def by_alert_details(self) -> Optional[Sequence[str]]:
        """
        A list of alert details to group by, only when the `entity_matching_method` is `Selected`. Possible values are `DisplayName` and `Severity`.
        """
        return pulumi.get(self, "by_alert_details")

    @property
    @pulumi.getter(name="byCustomDetails")
    def by_custom_details(self) -> Optional[Sequence[str]]:
        """
        A list of custom details keys to group by, only when the `entity_matching_method` is `Selected`. Only keys defined in the `custom_details` may be used.
        """
        return pulumi.get(self, "by_custom_details")

    @property
    @pulumi.getter(name="byEntities")
    def by_entities(self) -> Optional[Sequence[str]]:
        """
        A list of entity types to group by, only when the `entity_matching_method` is `Selected`. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        """
        return pulumi.get(self, "by_entities")

    @property
    @pulumi.getter
    def enabled(self) -> Optional[bool]:
        """
        Enable grouping incidents created from alerts triggered by this Sentinel Scheduled Alert Rule. Defaults to `true`.
        """
        return pulumi.get(self, "enabled")

    @property
    @pulumi.getter(name="entityMatchingMethod")
    def entity_matching_method(self) -> Optional[str]:
        """
        The method used to group incidents. Possible values are `AnyAlert`, `Selected` and `AllEntities`. Defaults to `AnyAlert`.
        """
        return pulumi.get(self, "entity_matching_method")

    @property
    @pulumi.getter(name="lookbackDuration")
    def lookback_duration(self) -> Optional[str]:
        """
        Limit the group to alerts created within the lookback duration (in ISO 8601 duration format). Defaults to `PT5M`.
        """
        return pulumi.get(self, "lookback_duration")

    @property
    @pulumi.getter(name="reopenClosedIncidents")
    def reopen_closed_incidents(self) -> Optional[bool]:
        """
        Whether to re-open closed matching incidents? Defaults to `false`.
        """
        return pulumi.get(self, "reopen_closed_incidents")


@pulumi.output_type
class AlertRuleScheduledSentinelEntityMapping(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "columnName":
            suggest = "column_name"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AlertRuleScheduledSentinelEntityMapping. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AlertRuleScheduledSentinelEntityMapping.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AlertRuleScheduledSentinelEntityMapping.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 column_name: str):
        """
        :param str column_name: The column name to be mapped to the identifier.
        """
        pulumi.set(__self__, "column_name", column_name)

    @property
    @pulumi.getter(name="columnName")
    def column_name(self) -> str:
        """
        The column name to be mapped to the identifier.
        """
        return pulumi.get(self, "column_name")


@pulumi.output_type
class AuthomationRuleActionIncident(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "classificationComment":
            suggest = "classification_comment"
        elif key == "ownerId":
            suggest = "owner_id"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthomationRuleActionIncident. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthomationRuleActionIncident.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthomationRuleActionIncident.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 order: int,
                 classification: Optional[str] = None,
                 classification_comment: Optional[str] = None,
                 labels: Optional[Sequence[str]] = None,
                 owner_id: Optional[str] = None,
                 severity: Optional[str] = None,
                 status: Optional[str] = None):
        """
        :param int order: The execution order of this action.
        :param str classification: The classification of the incident, when closing it. Possible values are: `BenignPositive_SuspiciousButExpected`, `FalsePositive_InaccurateData`, `FalsePositive_IncorrectAlertLogic`, `TruePositive_SuspiciousActivity` and `Undetermined`.
               
               > **Note:** The `classification` is required when `status` is `Closed`.
        :param str classification_comment: The comment why the incident is to be closed.
               
               > **Note:** The `classification_comment` is allowed to set only when `status` is `Closed`.
        :param Sequence[str] labels: Specifies a list of labels to add to the incident.
        :param str owner_id: The object ID of the entity this incident is assigned to.
        :param str severity: The severity to add to the incident. Possible values are `High`, `Informational`, `Low` and `Medium`.
               
               > **Note:**: At least one of `status`, `labels`, `owner_id` and `severity` has to be set.
        :param str status: The status to set to the incident. Possible values are: `Active`, `Closed`, `New`.
        """
        pulumi.set(__self__, "order", order)
        if classification is not None:
            pulumi.set(__self__, "classification", classification)
        if classification_comment is not None:
            pulumi.set(__self__, "classification_comment", classification_comment)
        if labels is not None:
            pulumi.set(__self__, "labels", labels)
        if owner_id is not None:
            pulumi.set(__self__, "owner_id", owner_id)
        if severity is not None:
            pulumi.set(__self__, "severity", severity)
        if status is not None:
            pulumi.set(__self__, "status", status)

    @property
    @pulumi.getter
    def order(self) -> int:
        """
        The execution order of this action.
        """
        return pulumi.get(self, "order")

    @property
    @pulumi.getter
    def classification(self) -> Optional[str]:
        """
        The classification of the incident, when closing it. Possible values are: `BenignPositive_SuspiciousButExpected`, `FalsePositive_InaccurateData`, `FalsePositive_IncorrectAlertLogic`, `TruePositive_SuspiciousActivity` and `Undetermined`.

        > **Note:** The `classification` is required when `status` is `Closed`.
        """
        return pulumi.get(self, "classification")

    @property
    @pulumi.getter(name="classificationComment")
    def classification_comment(self) -> Optional[str]:
        """
        The comment why the incident is to be closed.

        > **Note:** The `classification_comment` is allowed to set only when `status` is `Closed`.
        """
        return pulumi.get(self, "classification_comment")

    @property
    @pulumi.getter
    def labels(self) -> Optional[Sequence[str]]:
        """
        Specifies a list of labels to add to the incident.
        """
        return pulumi.get(self, "labels")

    @property
    @pulumi.getter(name="ownerId")
    def owner_id(self) -> Optional[str]:
        """
        The object ID of the entity this incident is assigned to.
        """
        return pulumi.get(self, "owner_id")

    @property
    @pulumi.getter
    def severity(self) -> Optional[str]:
        """
        The severity to add to the incident. Possible values are `High`, `Informational`, `Low` and `Medium`.

        > **Note:**: At least one of `status`, `labels`, `owner_id` and `severity` has to be set.
        """
        return pulumi.get(self, "severity")

    @property
    @pulumi.getter
    def status(self) -> Optional[str]:
        """
        The status to set to the incident. Possible values are: `Active`, `Closed`, `New`.
        """
        return pulumi.get(self, "status")


@pulumi.output_type
class AuthomationRuleActionPlaybook(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "logicAppId":
            suggest = "logic_app_id"
        elif key == "tenantId":
            suggest = "tenant_id"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthomationRuleActionPlaybook. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthomationRuleActionPlaybook.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthomationRuleActionPlaybook.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 logic_app_id: str,
                 order: int,
                 tenant_id: Optional[str] = None):
        """
        :param str logic_app_id: The ID of the Logic App that defines the playbook's logic.
        :param int order: The execution order of this action.
        :param str tenant_id: The ID of the Tenant that owns the playbook.
        """
        pulumi.set(__self__, "logic_app_id", logic_app_id)
        pulumi.set(__self__, "order", order)
        if tenant_id is not None:
            pulumi.set(__self__, "tenant_id", tenant_id)

    @property
    @pulumi.getter(name="logicAppId")
    def logic_app_id(self) -> str:
        """
        The ID of the Logic App that defines the playbook's logic.
        """
        return pulumi.get(self, "logic_app_id")

    @property
    @pulumi.getter
    def order(self) -> int:
        """
        The execution order of this action.
        """
        return pulumi.get(self, "order")

    @property
    @pulumi.getter(name="tenantId")
    def tenant_id(self) -> Optional[str]:
        """
        The ID of the Tenant that owns the playbook.
        """
        return pulumi.get(self, "tenant_id")


@pulumi.output_type
class AutomationRuleActionIncident(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "classificationComment":
            suggest = "classification_comment"
        elif key == "ownerId":
            suggest = "owner_id"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AutomationRuleActionIncident. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AutomationRuleActionIncident.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AutomationRuleActionIncident.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 order: int,
                 classification: Optional[str] = None,
                 classification_comment: Optional[str] = None,
                 labels: Optional[Sequence[str]] = None,
                 owner_id: Optional[str] = None,
                 severity: Optional[str] = None,
                 status: Optional[str] = None):
        """
        :param int order: The execution order of this action.
        :param str classification: The classification of the incident, when closing it. Possible values are: `BenignPositive_SuspiciousButExpected`, `FalsePositive_InaccurateData`, `FalsePositive_IncorrectAlertLogic`, `TruePositive_SuspiciousActivity` and `Undetermined`.
               
               > **Note:** The `classification` is required when `status` is `Closed`.
        :param str classification_comment: The comment why the incident is to be closed.
               
               > **Note:** The `classification_comment` is allowed to set only when `status` is `Closed`.
        :param Sequence[str] labels: Specifies a list of labels to add to the incident.
        :param str owner_id: The object ID of the entity this incident is assigned to.
        :param str severity: The severity to add to the incident. Possible values are `High`, `Informational`, `Low` and `Medium`.
               
               > **Note:**: At least one of `status`, `labels`, `owner_id` and `severity` has to be set.
        :param str status: The status to set to the incident. Possible values are: `Active`, `Closed`, `New`.
        """
        pulumi.set(__self__, "order", order)
        if classification is not None:
            pulumi.set(__self__, "classification", classification)
        if classification_comment is not None:
            pulumi.set(__self__, "classification_comment", classification_comment)
        if labels is not None:
            pulumi.set(__self__, "labels", labels)
        if owner_id is not None:
            pulumi.set(__self__, "owner_id", owner_id)
        if severity is not None:
            pulumi.set(__self__, "severity", severity)
        if status is not None:
            pulumi.set(__self__, "status", status)

    @property
    @pulumi.getter
    def order(self) -> int:
        """
        The execution order of this action.
        """
        return pulumi.get(self, "order")

    @property
    @pulumi.getter
    def classification(self) -> Optional[str]:
        """
        The classification of the incident, when closing it. Possible values are: `BenignPositive_SuspiciousButExpected`, `FalsePositive_InaccurateData`, `FalsePositive_IncorrectAlertLogic`, `TruePositive_SuspiciousActivity` and `Undetermined`.

        > **Note:** The `classification` is required when `status` is `Closed`.
        """
        return pulumi.get(self, "classification")

    @property
    @pulumi.getter(name="classificationComment")
    def classification_comment(self) -> Optional[str]:
        """
        The comment why the incident is to be closed.

        > **Note:** The `classification_comment` is allowed to set only when `status` is `Closed`.
        """
        return pulumi.get(self, "classification_comment")

    @property
    @pulumi.getter
    def labels(self) -> Optional[Sequence[str]]:
        """
        Specifies a list of labels to add to the incident.
        """
        return pulumi.get(self, "labels")

    @property
    @pulumi.getter(name="ownerId")
    def owner_id(self) -> Optional[str]:
        """
        The object ID of the entity this incident is assigned to.
        """
        return pulumi.get(self, "owner_id")

    @property
    @pulumi.getter
    def severity(self) -> Optional[str]:
        """
        The severity to add to the incident. Possible values are `High`, `Informational`, `Low` and `Medium`.

        > **Note:**: At least one of `status`, `labels`, `owner_id` and `severity` has to be set.
        """
        return pulumi.get(self, "severity")

    @property
    @pulumi.getter
    def status(self) -> Optional[str]:
        """
        The status to set to the incident. Possible values are: `Active`, `Closed`, `New`.
        """
        return pulumi.get(self, "status")


@pulumi.output_type
class AutomationRuleActionPlaybook(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "logicAppId":
            suggest = "logic_app_id"
        elif key == "tenantId":
            suggest = "tenant_id"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AutomationRuleActionPlaybook. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AutomationRuleActionPlaybook.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AutomationRuleActionPlaybook.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 logic_app_id: str,
                 order: int,
                 tenant_id: Optional[str] = None):
        """
        :param str logic_app_id: The ID of the Logic App that defines the playbook's logic.
        :param int order: The execution order of this action.
        :param str tenant_id: The ID of the Tenant that owns the playbook.
        """
        pulumi.set(__self__, "logic_app_id", logic_app_id)
        pulumi.set(__self__, "order", order)
        if tenant_id is not None:
            pulumi.set(__self__, "tenant_id", tenant_id)

    @property
    @pulumi.getter(name="logicAppId")
    def logic_app_id(self) -> str:
        """
        The ID of the Logic App that defines the playbook's logic.
        """
        return pulumi.get(self, "logic_app_id")

    @property
    @pulumi.getter
    def order(self) -> int:
        """
        The execution order of this action.
        """
        return pulumi.get(self, "order")

    @property
    @pulumi.getter(name="tenantId")
    def tenant_id(self) -> Optional[str]:
        """
        The ID of the Tenant that owns the playbook.
        """
        return pulumi.get(self, "tenant_id")


@pulumi.output_type
class MetadataAuthor(dict):
    def __init__(__self__, *,
                 email: Optional[str] = None,
                 link: Optional[str] = None,
                 name: Optional[str] = None):
        """
        :param str email: The email address of the author contact.
        :param str link: The link for author/vendor page.
        :param str name: The name of the author, company or person.
        """
        if email is not None:
            pulumi.set(__self__, "email", email)
        if link is not None:
            pulumi.set(__self__, "link", link)
        if name is not None:
            pulumi.set(__self__, "name", name)

    @property
    @pulumi.getter
    def email(self) -> Optional[str]:
        """
        The email address of the author contact.
        """
        return pulumi.get(self, "email")

    @property
    @pulumi.getter
    def link(self) -> Optional[str]:
        """
        The link for author/vendor page.
        """
        return pulumi.get(self, "link")

    @property
    @pulumi.getter
    def name(self) -> Optional[str]:
        """
        The name of the author, company or person.
        """
        return pulumi.get(self, "name")


@pulumi.output_type
class MetadataCategory(dict):
    def __init__(__self__, *,
                 domains: Optional[Sequence[str]] = None,
                 verticals: Optional[Sequence[str]] = None):
        """
        :param Sequence[str] domains: Specifies a list of domains for the solution content item.
        :param Sequence[str] verticals: Specifies a list of industry verticals for the solution content item.
        """
        if domains is not None:
            pulumi.set(__self__, "domains", domains)
        if verticals is not None:
            pulumi.set(__self__, "verticals", verticals)

    @property
    @pulumi.getter
    def domains(self) -> Optional[Sequence[str]]:
        """
        Specifies a list of domains for the solution content item.
        """
        return pulumi.get(self, "domains")

    @property
    @pulumi.getter
    def verticals(self) -> Optional[Sequence[str]]:
        """
        Specifies a list of industry verticals for the solution content item.
        """
        return pulumi.get(self, "verticals")


@pulumi.output_type
class MetadataSource(dict):
    def __init__(__self__, *,
                 kind: str,
                 id: Optional[str] = None,
                 name: Optional[str] = None):
        """
        :param str kind: The kind of the content source. Possible values are `Community`, `LocalWorkspace`, `Solution` and `SourceRepository`.
        :param str id: The id of the content source, the solution ID, Log Analytics Workspace name etc.
        :param str name: The name of the content source, repo name, solution name, Log Analytics Workspace name, etc.
        """
        pulumi.set(__self__, "kind", kind)
        if id is not None:
            pulumi.set(__self__, "id", id)
        if name is not None:
            pulumi.set(__self__, "name", name)

    @property
    @pulumi.getter
    def kind(self) -> str:
        """
        The kind of the content source. Possible values are `Community`, `LocalWorkspace`, `Solution` and `SourceRepository`.
        """
        return pulumi.get(self, "kind")

    @property
    @pulumi.getter
    def id(self) -> Optional[str]:
        """
        The id of the content source, the solution ID, Log Analytics Workspace name etc.
        """
        return pulumi.get(self, "id")

    @property
    @pulumi.getter
    def name(self) -> Optional[str]:
        """
        The name of the content source, repo name, solution name, Log Analytics Workspace name, etc.
        """
        return pulumi.get(self, "name")


@pulumi.output_type
class MetadataSupport(dict):
    def __init__(__self__, *,
                 tier: str,
                 email: Optional[str] = None,
                 link: Optional[str] = None,
                 name: Optional[str] = None):
        """
        :param str tier: The type of support for content item. Possible values are `Microsoft`, `Partner` and `Community`.
        :param str email: The email address of the support contact.
        :param str link: The link for support help.
        :param str name: The name of the support contact.
        """
        pulumi.set(__self__, "tier", tier)
        if email is not None:
            pulumi.set(__self__, "email", email)
        if link is not None:
            pulumi.set(__self__, "link", link)
        if name is not None:
            pulumi.set(__self__, "name", name)

    @property
    @pulumi.getter
    def tier(self) -> str:
        """
        The type of support for content item. Possible values are `Microsoft`, `Partner` and `Community`.
        """
        return pulumi.get(self, "tier")

    @property
    @pulumi.getter
    def email(self) -> Optional[str]:
        """
        The email address of the support contact.
        """
        return pulumi.get(self, "email")

    @property
    @pulumi.getter
    def link(self) -> Optional[str]:
        """
        The link for support help.
        """
        return pulumi.get(self, "link")

    @property
    @pulumi.getter
    def name(self) -> Optional[str]:
        """
        The name of the support contact.
        """
        return pulumi.get(self, "name")


@pulumi.output_type
class ThreatIntelligenceIndicatorExternalReference(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "sourceName":
            suggest = "source_name"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ThreatIntelligenceIndicatorExternalReference. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ThreatIntelligenceIndicatorExternalReference.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ThreatIntelligenceIndicatorExternalReference.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 description: Optional[str] = None,
                 hashes: Optional[Mapping[str, str]] = None,
                 id: Optional[str] = None,
                 source_name: Optional[str] = None,
                 url: Optional[str] = None):
        """
        :param str description: The description of the external reference of the Threat Intelligence Indicator.
        :param Mapping[str, str] hashes: The list of hashes of the external reference of the Threat Intelligence Indicator.
        :param str id: The ID of the Sentinel Threat Intelligence Indicator.
        :param str source_name: The source name of the external reference of the Threat Intelligence Indicator.
        :param str url: The url of the external reference of the Threat Intelligence Indicator.
        """
        if description is not None:
            pulumi.set(__self__, "description", description)
        if hashes is not None:
            pulumi.set(__self__, "hashes", hashes)
        if id is not None:
            pulumi.set(__self__, "id", id)
        if source_name is not None:
            pulumi.set(__self__, "source_name", source_name)
        if url is not None:
            pulumi.set(__self__, "url", url)

    @property
    @pulumi.getter
    def description(self) -> Optional[str]:
        """
        The description of the external reference of the Threat Intelligence Indicator.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter
    def hashes(self) -> Optional[Mapping[str, str]]:
        """
        The list of hashes of the external reference of the Threat Intelligence Indicator.
        """
        return pulumi.get(self, "hashes")

    @property
    @pulumi.getter
    def id(self) -> Optional[str]:
        """
        The ID of the Sentinel Threat Intelligence Indicator.
        """
        return pulumi.get(self, "id")

    @property
    @pulumi.getter(name="sourceName")
    def source_name(self) -> Optional[str]:
        """
        The source name of the external reference of the Threat Intelligence Indicator.
        """
        return pulumi.get(self, "source_name")

    @property
    @pulumi.getter
    def url(self) -> Optional[str]:
        """
        The url of the external reference of the Threat Intelligence Indicator.
        """
        return pulumi.get(self, "url")


@pulumi.output_type
class ThreatIntelligenceIndicatorGranularMarking(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "markingRef":
            suggest = "marking_ref"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ThreatIntelligenceIndicatorGranularMarking. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ThreatIntelligenceIndicatorGranularMarking.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ThreatIntelligenceIndicatorGranularMarking.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 language: Optional[str] = None,
                 marking_ref: Optional[str] = None,
                 selectors: Optional[Sequence[str]] = None):
        """
        :param str language: The language of granular marking of the Threat Intelligence Indicator.
        :param str marking_ref: The reference of the granular marking of the Threat Intelligence Indicator.
        :param Sequence[str] selectors: A list of selectors of the granular marking of the Threat Intelligence Indicator.
        """
        if language is not None:
            pulumi.set(__self__, "language", language)
        if marking_ref is not None:
            pulumi.set(__self__, "marking_ref", marking_ref)
        if selectors is not None:
            pulumi.set(__self__, "selectors", selectors)

    @property
    @pulumi.getter
    def language(self) -> Optional[str]:
        """
        The language of granular marking of the Threat Intelligence Indicator.
        """
        return pulumi.get(self, "language")

    @property
    @pulumi.getter(name="markingRef")
    def marking_ref(self) -> Optional[str]:
        """
        The reference of the granular marking of the Threat Intelligence Indicator.
        """
        return pulumi.get(self, "marking_ref")

    @property
    @pulumi.getter
    def selectors(self) -> Optional[Sequence[str]]:
        """
        A list of selectors of the granular marking of the Threat Intelligence Indicator.
        """
        return pulumi.get(self, "selectors")


@pulumi.output_type
class ThreatIntelligenceIndicatorKillChainPhase(dict):
    def __init__(__self__, *,
                 name: Optional[str] = None):
        """
        :param str name: The name which should be used for the Lockheed Martin cyber kill chain phase.
        """
        if name is not None:
            pulumi.set(__self__, "name", name)

    @property
    @pulumi.getter
    def name(self) -> Optional[str]:
        """
        The name which should be used for the Lockheed Martin cyber kill chain phase.
        """
        return pulumi.get(self, "name")


@pulumi.output_type
class ThreatIntelligenceIndicatorParsedPattern(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "patternTypeKey":
            suggest = "pattern_type_key"
        elif key == "patternTypeValues":
            suggest = "pattern_type_values"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ThreatIntelligenceIndicatorParsedPattern. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ThreatIntelligenceIndicatorParsedPattern.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ThreatIntelligenceIndicatorParsedPattern.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 pattern_type_key: Optional[str] = None,
                 pattern_type_values: Optional[Sequence['outputs.ThreatIntelligenceIndicatorParsedPatternPatternTypeValue']] = None):
        """
        :param str pattern_type_key: The type key of parsed pattern.
        :param Sequence['ThreatIntelligenceIndicatorParsedPatternPatternTypeValueArgs'] pattern_type_values: A `pattern_type_values` block as defined below.
        """
        if pattern_type_key is not None:
            pulumi.set(__self__, "pattern_type_key", pattern_type_key)
        if pattern_type_values is not None:
            pulumi.set(__self__, "pattern_type_values", pattern_type_values)

    @property
    @pulumi.getter(name="patternTypeKey")
    def pattern_type_key(self) -> Optional[str]:
        """
        The type key of parsed pattern.
        """
        return pulumi.get(self, "pattern_type_key")

    @property
    @pulumi.getter(name="patternTypeValues")
    def pattern_type_values(self) -> Optional[Sequence['outputs.ThreatIntelligenceIndicatorParsedPatternPatternTypeValue']]:
        """
        A `pattern_type_values` block as defined below.
        """
        return pulumi.get(self, "pattern_type_values")


@pulumi.output_type
class ThreatIntelligenceIndicatorParsedPatternPatternTypeValue(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "valueType":
            suggest = "value_type"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ThreatIntelligenceIndicatorParsedPatternPatternTypeValue. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ThreatIntelligenceIndicatorParsedPatternPatternTypeValue.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ThreatIntelligenceIndicatorParsedPatternPatternTypeValue.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 value: Optional[str] = None,
                 value_type: Optional[str] = None):
        """
        :param str value: The value of the parsed pattern type.
        :param str value_type: The type of the value of the parsed pattern type value.
        """
        if value is not None:
            pulumi.set(__self__, "value", value)
        if value_type is not None:
            pulumi.set(__self__, "value_type", value_type)

    @property
    @pulumi.getter
    def value(self) -> Optional[str]:
        """
        The value of the parsed pattern type.
        """
        return pulumi.get(self, "value")

    @property
    @pulumi.getter(name="valueType")
    def value_type(self) -> Optional[str]:
        """
        The type of the value of the parsed pattern type value.
        """
        return pulumi.get(self, "value_type")


@pulumi.output_type
class GetAlertRuleAnomalyMultiSelectObservationResult(dict):
    def __init__(__self__, *,
                 description: str,
                 name: str,
                 supported_values: Sequence[str],
                 values: Sequence[str]):
        """
        :param str description: The description of the threshold observation.
        :param str name: The guid of this Sentinel Alert Rule Template. Either `display_name` or `name` have to be specified.
        :param Sequence[str] supported_values: A list of supported values of the single select observation.
        :param Sequence[str] values: A list of values of the single select observation.
        """
        pulumi.set(__self__, "description", description)
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "supported_values", supported_values)
        pulumi.set(__self__, "values", values)

    @property
    @pulumi.getter
    def description(self) -> str:
        """
        The description of the threshold observation.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The guid of this Sentinel Alert Rule Template. Either `display_name` or `name` have to be specified.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter(name="supportedValues")
    def supported_values(self) -> Sequence[str]:
        """
        A list of supported values of the single select observation.
        """
        return pulumi.get(self, "supported_values")

    @property
    @pulumi.getter
    def values(self) -> Sequence[str]:
        """
        A list of values of the single select observation.
        """
        return pulumi.get(self, "values")


@pulumi.output_type
class GetAlertRuleAnomalyPrioritizedExcludeObservationResult(dict):
    def __init__(__self__, *,
                 description: str,
                 exclude: str,
                 name: str,
                 prioritize: str):
        """
        :param str description: The description of the threshold observation.
        :param str exclude: The excluded value per `description`.
        :param str name: The guid of this Sentinel Alert Rule Template. Either `display_name` or `name` have to be specified.
        :param str prioritize: The prioritized value per `description`.
        """
        pulumi.set(__self__, "description", description)
        pulumi.set(__self__, "exclude", exclude)
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "prioritize", prioritize)

    @property
    @pulumi.getter
    def description(self) -> str:
        """
        The description of the threshold observation.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter
    def exclude(self) -> str:
        """
        The excluded value per `description`.
        """
        return pulumi.get(self, "exclude")

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The guid of this Sentinel Alert Rule Template. Either `display_name` or `name` have to be specified.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def prioritize(self) -> str:
        """
        The prioritized value per `description`.
        """
        return pulumi.get(self, "prioritize")


@pulumi.output_type
class GetAlertRuleAnomalyRequiredDataConnectorResult(dict):
    def __init__(__self__, *,
                 connector_id: str,
                 data_types: Sequence[str]):
        """
        :param str connector_id: The ID of the required Data Connector.
        :param Sequence[str] data_types: A list of data types of the required Data Connector.
        """
        pulumi.set(__self__, "connector_id", connector_id)
        pulumi.set(__self__, "data_types", data_types)

    @property
    @pulumi.getter(name="connectorId")
    def connector_id(self) -> str:
        """
        The ID of the required Data Connector.
        """
        return pulumi.get(self, "connector_id")

    @property
    @pulumi.getter(name="dataTypes")
    def data_types(self) -> Sequence[str]:
        """
        A list of data types of the required Data Connector.
        """
        return pulumi.get(self, "data_types")


@pulumi.output_type
class GetAlertRuleAnomalySingleSelectObservationResult(dict):
    def __init__(__self__, *,
                 description: str,
                 name: str,
                 supported_values: Sequence[str],
                 value: str):
        """
        :param str description: The description of the threshold observation.
        :param str name: The guid of this Sentinel Alert Rule Template. Either `display_name` or `name` have to be specified.
        :param Sequence[str] supported_values: A list of supported values of the single select observation.
        :param str value: The value of the threshold observation.
        """
        pulumi.set(__self__, "description", description)
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "supported_values", supported_values)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def description(self) -> str:
        """
        The description of the threshold observation.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The guid of this Sentinel Alert Rule Template. Either `display_name` or `name` have to be specified.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter(name="supportedValues")
    def supported_values(self) -> Sequence[str]:
        """
        A list of supported values of the single select observation.
        """
        return pulumi.get(self, "supported_values")

    @property
    @pulumi.getter
    def value(self) -> str:
        """
        The value of the threshold observation.
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class GetAlertRuleAnomalyThresholdObservationResult(dict):
    def __init__(__self__, *,
                 description: str,
                 max: str,
                 min: str,
                 name: str,
                 value: str):
        """
        :param str description: The description of the threshold observation.
        :param str max: The max value of the threshold observation.
        :param str min: The min value of the threshold observation.
        :param str name: The guid of this Sentinel Alert Rule Template. Either `display_name` or `name` have to be specified.
        :param str value: The value of the threshold observation.
        """
        pulumi.set(__self__, "description", description)
        pulumi.set(__self__, "max", max)
        pulumi.set(__self__, "min", min)
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def description(self) -> str:
        """
        The description of the threshold observation.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter
    def max(self) -> str:
        """
        The max value of the threshold observation.
        """
        return pulumi.get(self, "max")

    @property
    @pulumi.getter
    def min(self) -> str:
        """
        The min value of the threshold observation.
        """
        return pulumi.get(self, "min")

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The guid of this Sentinel Alert Rule Template. Either `display_name` or `name` have to be specified.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def value(self) -> str:
        """
        The value of the threshold observation.
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class GetAlertRuleTemplateNrtTemplateResult(dict):
    def __init__(__self__, *,
                 description: str,
                 query: str,
                 severity: str,
                 tactics: Sequence[str]):
        """
        :param str description: The description of this Sentinel Scheduled Alert Rule Template.
        :param str query: The query of this Sentinel Scheduled Alert Rule Template.
        :param str severity: The alert severity of this Sentinel Scheduled Alert Rule Template.
        :param Sequence[str] tactics: A list of categories of attacks by which to classify the rule.
        """
        pulumi.set(__self__, "description", description)
        pulumi.set(__self__, "query", query)
        pulumi.set(__self__, "severity", severity)
        pulumi.set(__self__, "tactics", tactics)

    @property
    @pulumi.getter
    def description(self) -> str:
        """
        The description of this Sentinel Scheduled Alert Rule Template.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter
    def query(self) -> str:
        """
        The query of this Sentinel Scheduled Alert Rule Template.
        """
        return pulumi.get(self, "query")

    @property
    @pulumi.getter
    def severity(self) -> str:
        """
        The alert severity of this Sentinel Scheduled Alert Rule Template.
        """
        return pulumi.get(self, "severity")

    @property
    @pulumi.getter
    def tactics(self) -> Sequence[str]:
        """
        A list of categories of attacks by which to classify the rule.
        """
        return pulumi.get(self, "tactics")


@pulumi.output_type
class GetAlertRuleTemplateScheduledTemplateResult(dict):
    def __init__(__self__, *,
                 description: str,
                 query: str,
                 query_frequency: str,
                 query_period: str,
                 severity: str,
                 tactics: Sequence[str],
                 trigger_operator: str,
                 trigger_threshold: int):
        """
        :param str description: The description of this Sentinel Scheduled Alert Rule Template.
        :param str query: The query of this Sentinel Scheduled Alert Rule Template.
        :param str query_frequency: The ISO 8601 timespan duration between two consecutive queries.
        :param str query_period: The ISO 8601 timespan duration, which determine the time period of the data covered by the query.
        :param str severity: The alert severity of this Sentinel Scheduled Alert Rule Template.
        :param Sequence[str] tactics: A list of categories of attacks by which to classify the rule.
        :param str trigger_operator: The alert trigger operator, combined with `trigger_threshold`, setting alert threshold of this Sentinel Scheduled Alert Rule Template.
        :param int trigger_threshold: The baseline number of query results generated, combined with `trigger_operator`, setting alert threshold of this Sentinel Scheduled Alert Rule Template.
        """
        pulumi.set(__self__, "description", description)
        pulumi.set(__self__, "query", query)
        pulumi.set(__self__, "query_frequency", query_frequency)
        pulumi.set(__self__, "query_period", query_period)
        pulumi.set(__self__, "severity", severity)
        pulumi.set(__self__, "tactics", tactics)
        pulumi.set(__self__, "trigger_operator", trigger_operator)
        pulumi.set(__self__, "trigger_threshold", trigger_threshold)

    @property
    @pulumi.getter
    def description(self) -> str:
        """
        The description of this Sentinel Scheduled Alert Rule Template.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter
    def query(self) -> str:
        """
        The query of this Sentinel Scheduled Alert Rule Template.
        """
        return pulumi.get(self, "query")

    @property
    @pulumi.getter(name="queryFrequency")
    def query_frequency(self) -> str:
        """
        The ISO 8601 timespan duration between two consecutive queries.
        """
        return pulumi.get(self, "query_frequency")

    @property
    @pulumi.getter(name="queryPeriod")
    def query_period(self) -> str:
        """
        The ISO 8601 timespan duration, which determine the time period of the data covered by the query.
        """
        return pulumi.get(self, "query_period")

    @property
    @pulumi.getter
    def severity(self) -> str:
        """
        The alert severity of this Sentinel Scheduled Alert Rule Template.
        """
        return pulumi.get(self, "severity")

    @property
    @pulumi.getter
    def tactics(self) -> Sequence[str]:
        """
        A list of categories of attacks by which to classify the rule.
        """
        return pulumi.get(self, "tactics")

    @property
    @pulumi.getter(name="triggerOperator")
    def trigger_operator(self) -> str:
        """
        The alert trigger operator, combined with `trigger_threshold`, setting alert threshold of this Sentinel Scheduled Alert Rule Template.
        """
        return pulumi.get(self, "trigger_operator")

    @property
    @pulumi.getter(name="triggerThreshold")
    def trigger_threshold(self) -> int:
        """
        The baseline number of query results generated, combined with `trigger_operator`, setting alert threshold of this Sentinel Scheduled Alert Rule Template.
        """
        return pulumi.get(self, "trigger_threshold")


@pulumi.output_type
class GetAlertRuleTemplateSecurityIncidentTemplateResult(dict):
    def __init__(__self__, *,
                 description: str,
                 product_filter: str):
        """
        :param str description: The description of this Sentinel Scheduled Alert Rule Template.
        :param str product_filter: The Microsoft Security Service from where the alert will be generated.
        """
        pulumi.set(__self__, "description", description)
        pulumi.set(__self__, "product_filter", product_filter)

    @property
    @pulumi.getter
    def description(self) -> str:
        """
        The description of this Sentinel Scheduled Alert Rule Template.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter(name="productFilter")
    def product_filter(self) -> str:
        """
        The Microsoft Security Service from where the alert will be generated.
        """
        return pulumi.get(self, "product_filter")


