# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import copy
import warnings
import sys
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
if sys.version_info >= (3, 11):
    from typing import NotRequired, TypedDict, TypeAlias
else:
    from typing_extensions import NotRequired, TypedDict, TypeAlias
from .. import _utilities

__all__ = [
    'AlertRuleAnomalyBuiltInMultiSelectObservationArgs',
    'AlertRuleAnomalyBuiltInMultiSelectObservationArgsDict',
    'AlertRuleAnomalyBuiltInPrioritizedExcludeObservationArgs',
    'AlertRuleAnomalyBuiltInPrioritizedExcludeObservationArgsDict',
    'AlertRuleAnomalyBuiltInRequiredDataConnectorArgs',
    'AlertRuleAnomalyBuiltInRequiredDataConnectorArgsDict',
    'AlertRuleAnomalyBuiltInSingleSelectObservationArgs',
    'AlertRuleAnomalyBuiltInSingleSelectObservationArgsDict',
    'AlertRuleAnomalyBuiltInThresholdObservationArgs',
    'AlertRuleAnomalyBuiltInThresholdObservationArgsDict',
    'AlertRuleAnomalyDuplicateMultiSelectObservationArgs',
    'AlertRuleAnomalyDuplicateMultiSelectObservationArgsDict',
    'AlertRuleAnomalyDuplicatePrioritizedExcludeObservationArgs',
    'AlertRuleAnomalyDuplicatePrioritizedExcludeObservationArgsDict',
    'AlertRuleAnomalyDuplicateRequiredDataConnectorArgs',
    'AlertRuleAnomalyDuplicateRequiredDataConnectorArgsDict',
    'AlertRuleAnomalyDuplicateSingleSelectObservationArgs',
    'AlertRuleAnomalyDuplicateSingleSelectObservationArgsDict',
    'AlertRuleAnomalyDuplicateThresholdObservationArgs',
    'AlertRuleAnomalyDuplicateThresholdObservationArgsDict',
    'AlertRuleFusionSourceArgs',
    'AlertRuleFusionSourceArgsDict',
    'AlertRuleFusionSourceSubTypeArgs',
    'AlertRuleFusionSourceSubTypeArgsDict',
    'AlertRuleNrtAlertDetailsOverrideArgs',
    'AlertRuleNrtAlertDetailsOverrideArgsDict',
    'AlertRuleNrtAlertDetailsOverrideDynamicPropertyArgs',
    'AlertRuleNrtAlertDetailsOverrideDynamicPropertyArgsDict',
    'AlertRuleNrtEntityMappingArgs',
    'AlertRuleNrtEntityMappingArgsDict',
    'AlertRuleNrtEntityMappingFieldMappingArgs',
    'AlertRuleNrtEntityMappingFieldMappingArgsDict',
    'AlertRuleNrtEventGroupingArgs',
    'AlertRuleNrtEventGroupingArgsDict',
    'AlertRuleNrtIncidentArgs',
    'AlertRuleNrtIncidentArgsDict',
    'AlertRuleNrtIncidentGroupingArgs',
    'AlertRuleNrtIncidentGroupingArgsDict',
    'AlertRuleNrtSentinelEntityMappingArgs',
    'AlertRuleNrtSentinelEntityMappingArgsDict',
    'AlertRuleScheduledAlertDetailsOverrideArgs',
    'AlertRuleScheduledAlertDetailsOverrideArgsDict',
    'AlertRuleScheduledAlertDetailsOverrideDynamicPropertyArgs',
    'AlertRuleScheduledAlertDetailsOverrideDynamicPropertyArgsDict',
    'AlertRuleScheduledEntityMappingArgs',
    'AlertRuleScheduledEntityMappingArgsDict',
    'AlertRuleScheduledEntityMappingFieldMappingArgs',
    'AlertRuleScheduledEntityMappingFieldMappingArgsDict',
    'AlertRuleScheduledEventGroupingArgs',
    'AlertRuleScheduledEventGroupingArgsDict',
    'AlertRuleScheduledIncidentArgs',
    'AlertRuleScheduledIncidentArgsDict',
    'AlertRuleScheduledIncidentGroupingArgs',
    'AlertRuleScheduledIncidentGroupingArgsDict',
    'AlertRuleScheduledSentinelEntityMappingArgs',
    'AlertRuleScheduledSentinelEntityMappingArgsDict',
    'AuthomationRuleActionIncidentArgs',
    'AuthomationRuleActionIncidentArgsDict',
    'AuthomationRuleActionPlaybookArgs',
    'AuthomationRuleActionPlaybookArgsDict',
    'AutomationRuleActionIncidentArgs',
    'AutomationRuleActionIncidentArgsDict',
    'AutomationRuleActionPlaybookArgs',
    'AutomationRuleActionPlaybookArgsDict',
    'MetadataAuthorArgs',
    'MetadataAuthorArgsDict',
    'MetadataCategoryArgs',
    'MetadataCategoryArgsDict',
    'MetadataSourceArgs',
    'MetadataSourceArgsDict',
    'MetadataSupportArgs',
    'MetadataSupportArgsDict',
    'ThreatIntelligenceIndicatorExternalReferenceArgs',
    'ThreatIntelligenceIndicatorExternalReferenceArgsDict',
    'ThreatIntelligenceIndicatorGranularMarkingArgs',
    'ThreatIntelligenceIndicatorGranularMarkingArgsDict',
    'ThreatIntelligenceIndicatorKillChainPhaseArgs',
    'ThreatIntelligenceIndicatorKillChainPhaseArgsDict',
    'ThreatIntelligenceIndicatorParsedPatternArgs',
    'ThreatIntelligenceIndicatorParsedPatternArgsDict',
    'ThreatIntelligenceIndicatorParsedPatternPatternTypeValueArgs',
    'ThreatIntelligenceIndicatorParsedPatternPatternTypeValueArgsDict',
]

MYPY = False

if not MYPY:
    class AlertRuleAnomalyBuiltInMultiSelectObservationArgsDict(TypedDict):
        description: NotRequired[pulumi.Input[str]]
        """
        The description of the threshold observation.
        """
        name: NotRequired[pulumi.Input[str]]
        """
        The Name of the built-in Anomaly Alert Rule.
        """
        supported_values: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of supported values of the single select observation.
        """
        values: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of values of the single select observation.
        """
elif False:
    AlertRuleAnomalyBuiltInMultiSelectObservationArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleAnomalyBuiltInMultiSelectObservationArgs:
    def __init__(__self__, *,
                 description: Optional[pulumi.Input[str]] = None,
                 name: Optional[pulumi.Input[str]] = None,
                 supported_values: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 values: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[str] description: The description of the threshold observation.
        :param pulumi.Input[str] name: The Name of the built-in Anomaly Alert Rule.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] supported_values: A list of supported values of the single select observation.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] values: A list of values of the single select observation.
        """
        if description is not None:
            pulumi.set(__self__, "description", description)
        if name is not None:
            pulumi.set(__self__, "name", name)
        if supported_values is not None:
            pulumi.set(__self__, "supported_values", supported_values)
        if values is not None:
            pulumi.set(__self__, "values", values)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        The description of the threshold observation.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter
    def name(self) -> Optional[pulumi.Input[str]]:
        """
        The Name of the built-in Anomaly Alert Rule.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter(name="supportedValues")
    def supported_values(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of supported values of the single select observation.
        """
        return pulumi.get(self, "supported_values")

    @supported_values.setter
    def supported_values(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "supported_values", value)

    @property
    @pulumi.getter
    def values(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of values of the single select observation.
        """
        return pulumi.get(self, "values")

    @values.setter
    def values(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "values", value)


if not MYPY:
    class AlertRuleAnomalyBuiltInPrioritizedExcludeObservationArgsDict(TypedDict):
        description: NotRequired[pulumi.Input[str]]
        """
        The description of the threshold observation.
        """
        exclude: NotRequired[pulumi.Input[str]]
        """
        The excluded value per `description`.
        """
        name: NotRequired[pulumi.Input[str]]
        """
        The Name of the built-in Anomaly Alert Rule.
        """
        prioritize: NotRequired[pulumi.Input[str]]
        """
        The prioritized value per `description`.
        """
elif False:
    AlertRuleAnomalyBuiltInPrioritizedExcludeObservationArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleAnomalyBuiltInPrioritizedExcludeObservationArgs:
    def __init__(__self__, *,
                 description: Optional[pulumi.Input[str]] = None,
                 exclude: Optional[pulumi.Input[str]] = None,
                 name: Optional[pulumi.Input[str]] = None,
                 prioritize: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] description: The description of the threshold observation.
        :param pulumi.Input[str] exclude: The excluded value per `description`.
        :param pulumi.Input[str] name: The Name of the built-in Anomaly Alert Rule.
        :param pulumi.Input[str] prioritize: The prioritized value per `description`.
        """
        if description is not None:
            pulumi.set(__self__, "description", description)
        if exclude is not None:
            pulumi.set(__self__, "exclude", exclude)
        if name is not None:
            pulumi.set(__self__, "name", name)
        if prioritize is not None:
            pulumi.set(__self__, "prioritize", prioritize)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        The description of the threshold observation.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter
    def exclude(self) -> Optional[pulumi.Input[str]]:
        """
        The excluded value per `description`.
        """
        return pulumi.get(self, "exclude")

    @exclude.setter
    def exclude(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "exclude", value)

    @property
    @pulumi.getter
    def name(self) -> Optional[pulumi.Input[str]]:
        """
        The Name of the built-in Anomaly Alert Rule.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter
    def prioritize(self) -> Optional[pulumi.Input[str]]:
        """
        The prioritized value per `description`.
        """
        return pulumi.get(self, "prioritize")

    @prioritize.setter
    def prioritize(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "prioritize", value)


if not MYPY:
    class AlertRuleAnomalyBuiltInRequiredDataConnectorArgsDict(TypedDict):
        connector_id: NotRequired[pulumi.Input[str]]
        """
        The ID of the required Data Connector.
        """
        data_types: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of data types of the required Data Connector.
        """
elif False:
    AlertRuleAnomalyBuiltInRequiredDataConnectorArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleAnomalyBuiltInRequiredDataConnectorArgs:
    def __init__(__self__, *,
                 connector_id: Optional[pulumi.Input[str]] = None,
                 data_types: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[str] connector_id: The ID of the required Data Connector.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] data_types: A list of data types of the required Data Connector.
        """
        if connector_id is not None:
            pulumi.set(__self__, "connector_id", connector_id)
        if data_types is not None:
            pulumi.set(__self__, "data_types", data_types)

    @property
    @pulumi.getter(name="connectorId")
    def connector_id(self) -> Optional[pulumi.Input[str]]:
        """
        The ID of the required Data Connector.
        """
        return pulumi.get(self, "connector_id")

    @connector_id.setter
    def connector_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "connector_id", value)

    @property
    @pulumi.getter(name="dataTypes")
    def data_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of data types of the required Data Connector.
        """
        return pulumi.get(self, "data_types")

    @data_types.setter
    def data_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "data_types", value)


if not MYPY:
    class AlertRuleAnomalyBuiltInSingleSelectObservationArgsDict(TypedDict):
        description: NotRequired[pulumi.Input[str]]
        """
        The description of the threshold observation.
        """
        name: NotRequired[pulumi.Input[str]]
        """
        The Name of the built-in Anomaly Alert Rule.
        """
        supported_values: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of supported values of the single select observation.
        """
        value: NotRequired[pulumi.Input[str]]
        """
        The value of the threshold observation.
        """
elif False:
    AlertRuleAnomalyBuiltInSingleSelectObservationArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleAnomalyBuiltInSingleSelectObservationArgs:
    def __init__(__self__, *,
                 description: Optional[pulumi.Input[str]] = None,
                 name: Optional[pulumi.Input[str]] = None,
                 supported_values: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 value: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] description: The description of the threshold observation.
        :param pulumi.Input[str] name: The Name of the built-in Anomaly Alert Rule.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] supported_values: A list of supported values of the single select observation.
        :param pulumi.Input[str] value: The value of the threshold observation.
        """
        if description is not None:
            pulumi.set(__self__, "description", description)
        if name is not None:
            pulumi.set(__self__, "name", name)
        if supported_values is not None:
            pulumi.set(__self__, "supported_values", supported_values)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        The description of the threshold observation.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter
    def name(self) -> Optional[pulumi.Input[str]]:
        """
        The Name of the built-in Anomaly Alert Rule.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter(name="supportedValues")
    def supported_values(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of supported values of the single select observation.
        """
        return pulumi.get(self, "supported_values")

    @supported_values.setter
    def supported_values(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "supported_values", value)

    @property
    @pulumi.getter
    def value(self) -> Optional[pulumi.Input[str]]:
        """
        The value of the threshold observation.
        """
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "value", value)


if not MYPY:
    class AlertRuleAnomalyBuiltInThresholdObservationArgsDict(TypedDict):
        description: NotRequired[pulumi.Input[str]]
        """
        The description of the threshold observation.
        """
        max: NotRequired[pulumi.Input[str]]
        """
        The max value of the threshold observation.
        """
        min: NotRequired[pulumi.Input[str]]
        """
        The min value of the threshold observation.
        """
        name: NotRequired[pulumi.Input[str]]
        """
        The Name of the built-in Anomaly Alert Rule.
        """
        value: NotRequired[pulumi.Input[str]]
        """
        The value of the threshold observation.
        """
elif False:
    AlertRuleAnomalyBuiltInThresholdObservationArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleAnomalyBuiltInThresholdObservationArgs:
    def __init__(__self__, *,
                 description: Optional[pulumi.Input[str]] = None,
                 max: Optional[pulumi.Input[str]] = None,
                 min: Optional[pulumi.Input[str]] = None,
                 name: Optional[pulumi.Input[str]] = None,
                 value: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] description: The description of the threshold observation.
        :param pulumi.Input[str] max: The max value of the threshold observation.
        :param pulumi.Input[str] min: The min value of the threshold observation.
        :param pulumi.Input[str] name: The Name of the built-in Anomaly Alert Rule.
        :param pulumi.Input[str] value: The value of the threshold observation.
        """
        if description is not None:
            pulumi.set(__self__, "description", description)
        if max is not None:
            pulumi.set(__self__, "max", max)
        if min is not None:
            pulumi.set(__self__, "min", min)
        if name is not None:
            pulumi.set(__self__, "name", name)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        The description of the threshold observation.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter
    def max(self) -> Optional[pulumi.Input[str]]:
        """
        The max value of the threshold observation.
        """
        return pulumi.get(self, "max")

    @max.setter
    def max(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "max", value)

    @property
    @pulumi.getter
    def min(self) -> Optional[pulumi.Input[str]]:
        """
        The min value of the threshold observation.
        """
        return pulumi.get(self, "min")

    @min.setter
    def min(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "min", value)

    @property
    @pulumi.getter
    def name(self) -> Optional[pulumi.Input[str]]:
        """
        The Name of the built-in Anomaly Alert Rule.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter
    def value(self) -> Optional[pulumi.Input[str]]:
        """
        The value of the threshold observation.
        """
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "value", value)


if not MYPY:
    class AlertRuleAnomalyDuplicateMultiSelectObservationArgsDict(TypedDict):
        name: pulumi.Input[str]
        """
        The name of the multi select observation.
        """
        values: pulumi.Input[Sequence[pulumi.Input[str]]]
        """
        A list of values of the multi select observation.
        """
        description: NotRequired[pulumi.Input[str]]
        """
        The description of the multi select observation.
        """
        supported_values: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of supported values of the multi select observation.
        """
elif False:
    AlertRuleAnomalyDuplicateMultiSelectObservationArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleAnomalyDuplicateMultiSelectObservationArgs:
    def __init__(__self__, *,
                 name: pulumi.Input[str],
                 values: pulumi.Input[Sequence[pulumi.Input[str]]],
                 description: Optional[pulumi.Input[str]] = None,
                 supported_values: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[str] name: The name of the multi select observation.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] values: A list of values of the multi select observation.
        :param pulumi.Input[str] description: The description of the multi select observation.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] supported_values: A list of supported values of the multi select observation.
        """
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "values", values)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if supported_values is not None:
            pulumi.set(__self__, "supported_values", supported_values)

    @property
    @pulumi.getter
    def name(self) -> pulumi.Input[str]:
        """
        The name of the multi select observation.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: pulumi.Input[str]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter
    def values(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        A list of values of the multi select observation.
        """
        return pulumi.get(self, "values")

    @values.setter
    def values(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "values", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        The description of the multi select observation.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter(name="supportedValues")
    def supported_values(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of supported values of the multi select observation.
        """
        return pulumi.get(self, "supported_values")

    @supported_values.setter
    def supported_values(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "supported_values", value)


if not MYPY:
    class AlertRuleAnomalyDuplicatePrioritizedExcludeObservationArgsDict(TypedDict):
        name: pulumi.Input[str]
        """
        The name of the prioritized exclude observation.
        """
        description: NotRequired[pulumi.Input[str]]
        """
        The description of the prioritized exclude observation.
        """
        exclude: NotRequired[pulumi.Input[str]]
        """
        The excluded value per `description`.
        """
        prioritize: NotRequired[pulumi.Input[str]]
        """
        The prioritized value per `description`.
        """
elif False:
    AlertRuleAnomalyDuplicatePrioritizedExcludeObservationArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleAnomalyDuplicatePrioritizedExcludeObservationArgs:
    def __init__(__self__, *,
                 name: pulumi.Input[str],
                 description: Optional[pulumi.Input[str]] = None,
                 exclude: Optional[pulumi.Input[str]] = None,
                 prioritize: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] name: The name of the prioritized exclude observation.
        :param pulumi.Input[str] description: The description of the prioritized exclude observation.
        :param pulumi.Input[str] exclude: The excluded value per `description`.
        :param pulumi.Input[str] prioritize: The prioritized value per `description`.
        """
        pulumi.set(__self__, "name", name)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if exclude is not None:
            pulumi.set(__self__, "exclude", exclude)
        if prioritize is not None:
            pulumi.set(__self__, "prioritize", prioritize)

    @property
    @pulumi.getter
    def name(self) -> pulumi.Input[str]:
        """
        The name of the prioritized exclude observation.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: pulumi.Input[str]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        The description of the prioritized exclude observation.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter
    def exclude(self) -> Optional[pulumi.Input[str]]:
        """
        The excluded value per `description`.
        """
        return pulumi.get(self, "exclude")

    @exclude.setter
    def exclude(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "exclude", value)

    @property
    @pulumi.getter
    def prioritize(self) -> Optional[pulumi.Input[str]]:
        """
        The prioritized value per `description`.
        """
        return pulumi.get(self, "prioritize")

    @prioritize.setter
    def prioritize(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "prioritize", value)


if not MYPY:
    class AlertRuleAnomalyDuplicateRequiredDataConnectorArgsDict(TypedDict):
        connector_id: NotRequired[pulumi.Input[str]]
        """
        The ID of the required Data Connector.
        """
        data_types: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of data types of the required Data Connector.
        """
elif False:
    AlertRuleAnomalyDuplicateRequiredDataConnectorArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleAnomalyDuplicateRequiredDataConnectorArgs:
    def __init__(__self__, *,
                 connector_id: Optional[pulumi.Input[str]] = None,
                 data_types: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[str] connector_id: The ID of the required Data Connector.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] data_types: A list of data types of the required Data Connector.
        """
        if connector_id is not None:
            pulumi.set(__self__, "connector_id", connector_id)
        if data_types is not None:
            pulumi.set(__self__, "data_types", data_types)

    @property
    @pulumi.getter(name="connectorId")
    def connector_id(self) -> Optional[pulumi.Input[str]]:
        """
        The ID of the required Data Connector.
        """
        return pulumi.get(self, "connector_id")

    @connector_id.setter
    def connector_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "connector_id", value)

    @property
    @pulumi.getter(name="dataTypes")
    def data_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of data types of the required Data Connector.
        """
        return pulumi.get(self, "data_types")

    @data_types.setter
    def data_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "data_types", value)


if not MYPY:
    class AlertRuleAnomalyDuplicateSingleSelectObservationArgsDict(TypedDict):
        name: pulumi.Input[str]
        """
        The name of the single select observation.
        """
        value: pulumi.Input[str]
        """
        The value of the multi select observation.
        """
        description: NotRequired[pulumi.Input[str]]
        """
        The description of the single select observation.
        """
        supported_values: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of supported values of the single select observation.
        """
elif False:
    AlertRuleAnomalyDuplicateSingleSelectObservationArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleAnomalyDuplicateSingleSelectObservationArgs:
    def __init__(__self__, *,
                 name: pulumi.Input[str],
                 value: pulumi.Input[str],
                 description: Optional[pulumi.Input[str]] = None,
                 supported_values: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[str] name: The name of the single select observation.
        :param pulumi.Input[str] value: The value of the multi select observation.
        :param pulumi.Input[str] description: The description of the single select observation.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] supported_values: A list of supported values of the single select observation.
        """
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "value", value)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if supported_values is not None:
            pulumi.set(__self__, "supported_values", supported_values)

    @property
    @pulumi.getter
    def name(self) -> pulumi.Input[str]:
        """
        The name of the single select observation.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: pulumi.Input[str]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter
    def value(self) -> pulumi.Input[str]:
        """
        The value of the multi select observation.
        """
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: pulumi.Input[str]):
        pulumi.set(self, "value", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        The description of the single select observation.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter(name="supportedValues")
    def supported_values(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of supported values of the single select observation.
        """
        return pulumi.get(self, "supported_values")

    @supported_values.setter
    def supported_values(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "supported_values", value)


if not MYPY:
    class AlertRuleAnomalyDuplicateThresholdObservationArgsDict(TypedDict):
        name: pulumi.Input[str]
        """
        The name of the threshold observation.
        """
        value: pulumi.Input[str]
        """
        The value of the threshold observation.
        """
        description: NotRequired[pulumi.Input[str]]
        """
        The description of the threshold observation.
        """
        max: NotRequired[pulumi.Input[str]]
        """
        The max value of the threshold observation.
        """
        min: NotRequired[pulumi.Input[str]]
        """
        The min value of the threshold observation.
        """
elif False:
    AlertRuleAnomalyDuplicateThresholdObservationArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleAnomalyDuplicateThresholdObservationArgs:
    def __init__(__self__, *,
                 name: pulumi.Input[str],
                 value: pulumi.Input[str],
                 description: Optional[pulumi.Input[str]] = None,
                 max: Optional[pulumi.Input[str]] = None,
                 min: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] name: The name of the threshold observation.
        :param pulumi.Input[str] value: The value of the threshold observation.
        :param pulumi.Input[str] description: The description of the threshold observation.
        :param pulumi.Input[str] max: The max value of the threshold observation.
        :param pulumi.Input[str] min: The min value of the threshold observation.
        """
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "value", value)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if max is not None:
            pulumi.set(__self__, "max", max)
        if min is not None:
            pulumi.set(__self__, "min", min)

    @property
    @pulumi.getter
    def name(self) -> pulumi.Input[str]:
        """
        The name of the threshold observation.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: pulumi.Input[str]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter
    def value(self) -> pulumi.Input[str]:
        """
        The value of the threshold observation.
        """
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: pulumi.Input[str]):
        pulumi.set(self, "value", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        The description of the threshold observation.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter
    def max(self) -> Optional[pulumi.Input[str]]:
        """
        The max value of the threshold observation.
        """
        return pulumi.get(self, "max")

    @max.setter
    def max(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "max", value)

    @property
    @pulumi.getter
    def min(self) -> Optional[pulumi.Input[str]]:
        """
        The min value of the threshold observation.
        """
        return pulumi.get(self, "min")

    @min.setter
    def min(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "min", value)


if not MYPY:
    class AlertRuleFusionSourceArgsDict(TypedDict):
        name: pulumi.Input[str]
        """
        The name of the Fusion source signal. Refer to Fusion alert rule template for supported values.
        """
        enabled: NotRequired[pulumi.Input[bool]]
        """
        Whether this source signal is enabled or disabled in Fusion detection? Defaults to `true`.
        """
        sub_types: NotRequired[pulumi.Input[Sequence[pulumi.Input['AlertRuleFusionSourceSubTypeArgsDict']]]]
        """
        One or more `sub_type` blocks as defined below.
        """
elif False:
    AlertRuleFusionSourceArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleFusionSourceArgs:
    def __init__(__self__, *,
                 name: pulumi.Input[str],
                 enabled: Optional[pulumi.Input[bool]] = None,
                 sub_types: Optional[pulumi.Input[Sequence[pulumi.Input['AlertRuleFusionSourceSubTypeArgs']]]] = None):
        """
        :param pulumi.Input[str] name: The name of the Fusion source signal. Refer to Fusion alert rule template for supported values.
        :param pulumi.Input[bool] enabled: Whether this source signal is enabled or disabled in Fusion detection? Defaults to `true`.
        :param pulumi.Input[Sequence[pulumi.Input['AlertRuleFusionSourceSubTypeArgs']]] sub_types: One or more `sub_type` blocks as defined below.
        """
        pulumi.set(__self__, "name", name)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if sub_types is not None:
            pulumi.set(__self__, "sub_types", sub_types)

    @property
    @pulumi.getter
    def name(self) -> pulumi.Input[str]:
        """
        The name of the Fusion source signal. Refer to Fusion alert rule template for supported values.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: pulumi.Input[str]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this source signal is enabled or disabled in Fusion detection? Defaults to `true`.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter(name="subTypes")
    def sub_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['AlertRuleFusionSourceSubTypeArgs']]]]:
        """
        One or more `sub_type` blocks as defined below.
        """
        return pulumi.get(self, "sub_types")

    @sub_types.setter
    def sub_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['AlertRuleFusionSourceSubTypeArgs']]]]):
        pulumi.set(self, "sub_types", value)


if not MYPY:
    class AlertRuleFusionSourceSubTypeArgsDict(TypedDict):
        name: pulumi.Input[str]
        """
        The Name of the source subtype under a given source signal in Fusion detection. Refer to Fusion alert rule template for supported values.
        """
        severities_alloweds: pulumi.Input[Sequence[pulumi.Input[str]]]
        """
        A list of severities that are enabled for this source subtype consumed in Fusion detection. Possible values for each element are `High`, `Medium`, `Low`, `Informational`.
        """
        enabled: NotRequired[pulumi.Input[bool]]
        """
        Whether this source subtype under source signal is enabled or disabled in Fusion detection. Defaults to `true`.
        """
elif False:
    AlertRuleFusionSourceSubTypeArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleFusionSourceSubTypeArgs:
    def __init__(__self__, *,
                 name: pulumi.Input[str],
                 severities_alloweds: pulumi.Input[Sequence[pulumi.Input[str]]],
                 enabled: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[str] name: The Name of the source subtype under a given source signal in Fusion detection. Refer to Fusion alert rule template for supported values.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] severities_alloweds: A list of severities that are enabled for this source subtype consumed in Fusion detection. Possible values for each element are `High`, `Medium`, `Low`, `Informational`.
        :param pulumi.Input[bool] enabled: Whether this source subtype under source signal is enabled or disabled in Fusion detection. Defaults to `true`.
        """
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "severities_alloweds", severities_alloweds)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)

    @property
    @pulumi.getter
    def name(self) -> pulumi.Input[str]:
        """
        The Name of the source subtype under a given source signal in Fusion detection. Refer to Fusion alert rule template for supported values.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: pulumi.Input[str]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter(name="severitiesAlloweds")
    def severities_alloweds(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        A list of severities that are enabled for this source subtype consumed in Fusion detection. Possible values for each element are `High`, `Medium`, `Low`, `Informational`.
        """
        return pulumi.get(self, "severities_alloweds")

    @severities_alloweds.setter
    def severities_alloweds(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "severities_alloweds", value)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this source subtype under source signal is enabled or disabled in Fusion detection. Defaults to `true`.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enabled", value)


if not MYPY:
    class AlertRuleNrtAlertDetailsOverrideArgsDict(TypedDict):
        description_format: NotRequired[pulumi.Input[str]]
        """
        The format containing columns name(s) to override the description of this Sentinel Alert Rule.
        """
        display_name_format: NotRequired[pulumi.Input[str]]
        """
        The format containing columns name(s) to override the name of this Sentinel Alert Rule.
        """
        dynamic_properties: NotRequired[pulumi.Input[Sequence[pulumi.Input['AlertRuleNrtAlertDetailsOverrideDynamicPropertyArgsDict']]]]
        """
        A list of `dynamic_property` blocks as defined below.
        """
        severity_column_name: NotRequired[pulumi.Input[str]]
        """
        The column name to take the alert severity from.
        """
        tactics_column_name: NotRequired[pulumi.Input[str]]
        """
        The column name to take the alert tactics from.
        """
elif False:
    AlertRuleNrtAlertDetailsOverrideArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleNrtAlertDetailsOverrideArgs:
    def __init__(__self__, *,
                 description_format: Optional[pulumi.Input[str]] = None,
                 display_name_format: Optional[pulumi.Input[str]] = None,
                 dynamic_properties: Optional[pulumi.Input[Sequence[pulumi.Input['AlertRuleNrtAlertDetailsOverrideDynamicPropertyArgs']]]] = None,
                 severity_column_name: Optional[pulumi.Input[str]] = None,
                 tactics_column_name: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] description_format: The format containing columns name(s) to override the description of this Sentinel Alert Rule.
        :param pulumi.Input[str] display_name_format: The format containing columns name(s) to override the name of this Sentinel Alert Rule.
        :param pulumi.Input[Sequence[pulumi.Input['AlertRuleNrtAlertDetailsOverrideDynamicPropertyArgs']]] dynamic_properties: A list of `dynamic_property` blocks as defined below.
        :param pulumi.Input[str] severity_column_name: The column name to take the alert severity from.
        :param pulumi.Input[str] tactics_column_name: The column name to take the alert tactics from.
        """
        if description_format is not None:
            pulumi.set(__self__, "description_format", description_format)
        if display_name_format is not None:
            pulumi.set(__self__, "display_name_format", display_name_format)
        if dynamic_properties is not None:
            pulumi.set(__self__, "dynamic_properties", dynamic_properties)
        if severity_column_name is not None:
            pulumi.set(__self__, "severity_column_name", severity_column_name)
        if tactics_column_name is not None:
            pulumi.set(__self__, "tactics_column_name", tactics_column_name)

    @property
    @pulumi.getter(name="descriptionFormat")
    def description_format(self) -> Optional[pulumi.Input[str]]:
        """
        The format containing columns name(s) to override the description of this Sentinel Alert Rule.
        """
        return pulumi.get(self, "description_format")

    @description_format.setter
    def description_format(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description_format", value)

    @property
    @pulumi.getter(name="displayNameFormat")
    def display_name_format(self) -> Optional[pulumi.Input[str]]:
        """
        The format containing columns name(s) to override the name of this Sentinel Alert Rule.
        """
        return pulumi.get(self, "display_name_format")

    @display_name_format.setter
    def display_name_format(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "display_name_format", value)

    @property
    @pulumi.getter(name="dynamicProperties")
    def dynamic_properties(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['AlertRuleNrtAlertDetailsOverrideDynamicPropertyArgs']]]]:
        """
        A list of `dynamic_property` blocks as defined below.
        """
        return pulumi.get(self, "dynamic_properties")

    @dynamic_properties.setter
    def dynamic_properties(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['AlertRuleNrtAlertDetailsOverrideDynamicPropertyArgs']]]]):
        pulumi.set(self, "dynamic_properties", value)

    @property
    @pulumi.getter(name="severityColumnName")
    def severity_column_name(self) -> Optional[pulumi.Input[str]]:
        """
        The column name to take the alert severity from.
        """
        return pulumi.get(self, "severity_column_name")

    @severity_column_name.setter
    def severity_column_name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "severity_column_name", value)

    @property
    @pulumi.getter(name="tacticsColumnName")
    def tactics_column_name(self) -> Optional[pulumi.Input[str]]:
        """
        The column name to take the alert tactics from.
        """
        return pulumi.get(self, "tactics_column_name")

    @tactics_column_name.setter
    def tactics_column_name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "tactics_column_name", value)


if not MYPY:
    class AlertRuleNrtAlertDetailsOverrideDynamicPropertyArgsDict(TypedDict):
        name: pulumi.Input[str]
        """
        The name of the dynamic property. Possible Values are `AlertLink`, `ConfidenceLevel`, `ConfidenceScore`, `ExtendedLinks`, `ProductComponentName`, `ProductName`, `ProviderName`, `RemediationSteps` and `Techniques`.
        """
        value: pulumi.Input[str]
        """
        The value of the dynamic property. Pssible Values are `Caller`, `dcount_ResourceId` and `EventSubmissionTimestamp`.
        """
elif False:
    AlertRuleNrtAlertDetailsOverrideDynamicPropertyArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleNrtAlertDetailsOverrideDynamicPropertyArgs:
    def __init__(__self__, *,
                 name: pulumi.Input[str],
                 value: pulumi.Input[str]):
        """
        :param pulumi.Input[str] name: The name of the dynamic property. Possible Values are `AlertLink`, `ConfidenceLevel`, `ConfidenceScore`, `ExtendedLinks`, `ProductComponentName`, `ProductName`, `ProviderName`, `RemediationSteps` and `Techniques`.
        :param pulumi.Input[str] value: The value of the dynamic property. Pssible Values are `Caller`, `dcount_ResourceId` and `EventSubmissionTimestamp`.
        """
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def name(self) -> pulumi.Input[str]:
        """
        The name of the dynamic property. Possible Values are `AlertLink`, `ConfidenceLevel`, `ConfidenceScore`, `ExtendedLinks`, `ProductComponentName`, `ProductName`, `ProviderName`, `RemediationSteps` and `Techniques`.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: pulumi.Input[str]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter
    def value(self) -> pulumi.Input[str]:
        """
        The value of the dynamic property. Pssible Values are `Caller`, `dcount_ResourceId` and `EventSubmissionTimestamp`.
        """
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: pulumi.Input[str]):
        pulumi.set(self, "value", value)


if not MYPY:
    class AlertRuleNrtEntityMappingArgsDict(TypedDict):
        entity_type: pulumi.Input[str]
        """
        The type of the entity. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        """
        field_mappings: pulumi.Input[Sequence[pulumi.Input['AlertRuleNrtEntityMappingFieldMappingArgsDict']]]
        """
        A list of `field_mapping` blocks as defined below.
        """
elif False:
    AlertRuleNrtEntityMappingArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleNrtEntityMappingArgs:
    def __init__(__self__, *,
                 entity_type: pulumi.Input[str],
                 field_mappings: pulumi.Input[Sequence[pulumi.Input['AlertRuleNrtEntityMappingFieldMappingArgs']]]):
        """
        :param pulumi.Input[str] entity_type: The type of the entity. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        :param pulumi.Input[Sequence[pulumi.Input['AlertRuleNrtEntityMappingFieldMappingArgs']]] field_mappings: A list of `field_mapping` blocks as defined below.
        """
        pulumi.set(__self__, "entity_type", entity_type)
        pulumi.set(__self__, "field_mappings", field_mappings)

    @property
    @pulumi.getter(name="entityType")
    def entity_type(self) -> pulumi.Input[str]:
        """
        The type of the entity. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        """
        return pulumi.get(self, "entity_type")

    @entity_type.setter
    def entity_type(self, value: pulumi.Input[str]):
        pulumi.set(self, "entity_type", value)

    @property
    @pulumi.getter(name="fieldMappings")
    def field_mappings(self) -> pulumi.Input[Sequence[pulumi.Input['AlertRuleNrtEntityMappingFieldMappingArgs']]]:
        """
        A list of `field_mapping` blocks as defined below.
        """
        return pulumi.get(self, "field_mappings")

    @field_mappings.setter
    def field_mappings(self, value: pulumi.Input[Sequence[pulumi.Input['AlertRuleNrtEntityMappingFieldMappingArgs']]]):
        pulumi.set(self, "field_mappings", value)


if not MYPY:
    class AlertRuleNrtEntityMappingFieldMappingArgsDict(TypedDict):
        column_name: pulumi.Input[str]
        """
        The column name to be mapped to the identifier.
        """
        identifier: pulumi.Input[str]
        """
        The identifier of the entity.
        """
elif False:
    AlertRuleNrtEntityMappingFieldMappingArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleNrtEntityMappingFieldMappingArgs:
    def __init__(__self__, *,
                 column_name: pulumi.Input[str],
                 identifier: pulumi.Input[str]):
        """
        :param pulumi.Input[str] column_name: The column name to be mapped to the identifier.
        :param pulumi.Input[str] identifier: The identifier of the entity.
        """
        pulumi.set(__self__, "column_name", column_name)
        pulumi.set(__self__, "identifier", identifier)

    @property
    @pulumi.getter(name="columnName")
    def column_name(self) -> pulumi.Input[str]:
        """
        The column name to be mapped to the identifier.
        """
        return pulumi.get(self, "column_name")

    @column_name.setter
    def column_name(self, value: pulumi.Input[str]):
        pulumi.set(self, "column_name", value)

    @property
    @pulumi.getter
    def identifier(self) -> pulumi.Input[str]:
        """
        The identifier of the entity.
        """
        return pulumi.get(self, "identifier")

    @identifier.setter
    def identifier(self, value: pulumi.Input[str]):
        pulumi.set(self, "identifier", value)


if not MYPY:
    class AlertRuleNrtEventGroupingArgsDict(TypedDict):
        aggregation_method: pulumi.Input[str]
        """
        The aggregation type of grouping the events. Possible values are `AlertPerResult` and `SingleAlert`.
        """
elif False:
    AlertRuleNrtEventGroupingArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleNrtEventGroupingArgs:
    def __init__(__self__, *,
                 aggregation_method: pulumi.Input[str]):
        """
        :param pulumi.Input[str] aggregation_method: The aggregation type of grouping the events. Possible values are `AlertPerResult` and `SingleAlert`.
        """
        pulumi.set(__self__, "aggregation_method", aggregation_method)

    @property
    @pulumi.getter(name="aggregationMethod")
    def aggregation_method(self) -> pulumi.Input[str]:
        """
        The aggregation type of grouping the events. Possible values are `AlertPerResult` and `SingleAlert`.
        """
        return pulumi.get(self, "aggregation_method")

    @aggregation_method.setter
    def aggregation_method(self, value: pulumi.Input[str]):
        pulumi.set(self, "aggregation_method", value)


if not MYPY:
    class AlertRuleNrtIncidentArgsDict(TypedDict):
        create_incident_enabled: pulumi.Input[bool]
        """
        Whether to create an incident from alerts triggered by this Sentinel NRT Alert Rule?
        """
        grouping: pulumi.Input['AlertRuleNrtIncidentGroupingArgsDict']
        """
        A `grouping` block as defined below.
        """
elif False:
    AlertRuleNrtIncidentArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleNrtIncidentArgs:
    def __init__(__self__, *,
                 create_incident_enabled: pulumi.Input[bool],
                 grouping: pulumi.Input['AlertRuleNrtIncidentGroupingArgs']):
        """
        :param pulumi.Input[bool] create_incident_enabled: Whether to create an incident from alerts triggered by this Sentinel NRT Alert Rule?
        :param pulumi.Input['AlertRuleNrtIncidentGroupingArgs'] grouping: A `grouping` block as defined below.
        """
        pulumi.set(__self__, "create_incident_enabled", create_incident_enabled)
        pulumi.set(__self__, "grouping", grouping)

    @property
    @pulumi.getter(name="createIncidentEnabled")
    def create_incident_enabled(self) -> pulumi.Input[bool]:
        """
        Whether to create an incident from alerts triggered by this Sentinel NRT Alert Rule?
        """
        return pulumi.get(self, "create_incident_enabled")

    @create_incident_enabled.setter
    def create_incident_enabled(self, value: pulumi.Input[bool]):
        pulumi.set(self, "create_incident_enabled", value)

    @property
    @pulumi.getter
    def grouping(self) -> pulumi.Input['AlertRuleNrtIncidentGroupingArgs']:
        """
        A `grouping` block as defined below.
        """
        return pulumi.get(self, "grouping")

    @grouping.setter
    def grouping(self, value: pulumi.Input['AlertRuleNrtIncidentGroupingArgs']):
        pulumi.set(self, "grouping", value)


if not MYPY:
    class AlertRuleNrtIncidentGroupingArgsDict(TypedDict):
        by_alert_details: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of alert details to group by, only when the `entity_matching_method` is `Selected`. Possible values are `DisplayName` and `Severity`.
        """
        by_custom_details: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of custom details keys to group by, only when the `entity_matching_method` is `Selected`. Only keys defined in the `custom_details` may be used.
        """
        by_entities: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of entity types to group by, only when the `entity_matching_method` is `Selected`. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        """
        enabled: NotRequired[pulumi.Input[bool]]
        """
        Enable grouping incidents created from alerts triggered by this Sentinel NRT Alert Rule. Defaults to `true`.
        """
        entity_matching_method: NotRequired[pulumi.Input[str]]
        """
        The method used to group incidents. Possible values are `AnyAlert`, `Selected` and `AllEntities`. Defaults to `AnyAlert`.
        """
        lookback_duration: NotRequired[pulumi.Input[str]]
        """
        Limit the group to alerts created within the lookback duration (in ISO 8601 duration format). Defaults to `PT5M`.
        """
        reopen_closed_incidents: NotRequired[pulumi.Input[bool]]
        """
        Whether to re-open closed matching incidents? Defaults to `false`.
        """
elif False:
    AlertRuleNrtIncidentGroupingArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleNrtIncidentGroupingArgs:
    def __init__(__self__, *,
                 by_alert_details: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 by_custom_details: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 by_entities: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 enabled: Optional[pulumi.Input[bool]] = None,
                 entity_matching_method: Optional[pulumi.Input[str]] = None,
                 lookback_duration: Optional[pulumi.Input[str]] = None,
                 reopen_closed_incidents: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] by_alert_details: A list of alert details to group by, only when the `entity_matching_method` is `Selected`. Possible values are `DisplayName` and `Severity`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] by_custom_details: A list of custom details keys to group by, only when the `entity_matching_method` is `Selected`. Only keys defined in the `custom_details` may be used.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] by_entities: A list of entity types to group by, only when the `entity_matching_method` is `Selected`. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        :param pulumi.Input[bool] enabled: Enable grouping incidents created from alerts triggered by this Sentinel NRT Alert Rule. Defaults to `true`.
        :param pulumi.Input[str] entity_matching_method: The method used to group incidents. Possible values are `AnyAlert`, `Selected` and `AllEntities`. Defaults to `AnyAlert`.
        :param pulumi.Input[str] lookback_duration: Limit the group to alerts created within the lookback duration (in ISO 8601 duration format). Defaults to `PT5M`.
        :param pulumi.Input[bool] reopen_closed_incidents: Whether to re-open closed matching incidents? Defaults to `false`.
        """
        if by_alert_details is not None:
            pulumi.set(__self__, "by_alert_details", by_alert_details)
        if by_custom_details is not None:
            pulumi.set(__self__, "by_custom_details", by_custom_details)
        if by_entities is not None:
            pulumi.set(__self__, "by_entities", by_entities)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if entity_matching_method is not None:
            pulumi.set(__self__, "entity_matching_method", entity_matching_method)
        if lookback_duration is not None:
            pulumi.set(__self__, "lookback_duration", lookback_duration)
        if reopen_closed_incidents is not None:
            pulumi.set(__self__, "reopen_closed_incidents", reopen_closed_incidents)

    @property
    @pulumi.getter(name="byAlertDetails")
    def by_alert_details(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of alert details to group by, only when the `entity_matching_method` is `Selected`. Possible values are `DisplayName` and `Severity`.
        """
        return pulumi.get(self, "by_alert_details")

    @by_alert_details.setter
    def by_alert_details(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "by_alert_details", value)

    @property
    @pulumi.getter(name="byCustomDetails")
    def by_custom_details(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of custom details keys to group by, only when the `entity_matching_method` is `Selected`. Only keys defined in the `custom_details` may be used.
        """
        return pulumi.get(self, "by_custom_details")

    @by_custom_details.setter
    def by_custom_details(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "by_custom_details", value)

    @property
    @pulumi.getter(name="byEntities")
    def by_entities(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of entity types to group by, only when the `entity_matching_method` is `Selected`. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        """
        return pulumi.get(self, "by_entities")

    @by_entities.setter
    def by_entities(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "by_entities", value)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Enable grouping incidents created from alerts triggered by this Sentinel NRT Alert Rule. Defaults to `true`.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter(name="entityMatchingMethod")
    def entity_matching_method(self) -> Optional[pulumi.Input[str]]:
        """
        The method used to group incidents. Possible values are `AnyAlert`, `Selected` and `AllEntities`. Defaults to `AnyAlert`.
        """
        return pulumi.get(self, "entity_matching_method")

    @entity_matching_method.setter
    def entity_matching_method(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "entity_matching_method", value)

    @property
    @pulumi.getter(name="lookbackDuration")
    def lookback_duration(self) -> Optional[pulumi.Input[str]]:
        """
        Limit the group to alerts created within the lookback duration (in ISO 8601 duration format). Defaults to `PT5M`.
        """
        return pulumi.get(self, "lookback_duration")

    @lookback_duration.setter
    def lookback_duration(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "lookback_duration", value)

    @property
    @pulumi.getter(name="reopenClosedIncidents")
    def reopen_closed_incidents(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether to re-open closed matching incidents? Defaults to `false`.
        """
        return pulumi.get(self, "reopen_closed_incidents")

    @reopen_closed_incidents.setter
    def reopen_closed_incidents(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "reopen_closed_incidents", value)


if not MYPY:
    class AlertRuleNrtSentinelEntityMappingArgsDict(TypedDict):
        column_name: pulumi.Input[str]
        """
        The column name to be mapped to the identifier.
        """
elif False:
    AlertRuleNrtSentinelEntityMappingArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleNrtSentinelEntityMappingArgs:
    def __init__(__self__, *,
                 column_name: pulumi.Input[str]):
        """
        :param pulumi.Input[str] column_name: The column name to be mapped to the identifier.
        """
        pulumi.set(__self__, "column_name", column_name)

    @property
    @pulumi.getter(name="columnName")
    def column_name(self) -> pulumi.Input[str]:
        """
        The column name to be mapped to the identifier.
        """
        return pulumi.get(self, "column_name")

    @column_name.setter
    def column_name(self, value: pulumi.Input[str]):
        pulumi.set(self, "column_name", value)


if not MYPY:
    class AlertRuleScheduledAlertDetailsOverrideArgsDict(TypedDict):
        description_format: NotRequired[pulumi.Input[str]]
        """
        The format containing columns name(s) to override the description of this Sentinel Alert Rule.
        """
        display_name_format: NotRequired[pulumi.Input[str]]
        """
        The format containing columns name(s) to override the name of this Sentinel Alert Rule.
        """
        dynamic_properties: NotRequired[pulumi.Input[Sequence[pulumi.Input['AlertRuleScheduledAlertDetailsOverrideDynamicPropertyArgsDict']]]]
        """
        A list of `dynamic_property` blocks as defined below.
        """
        severity_column_name: NotRequired[pulumi.Input[str]]
        """
        The column name to take the alert severity from.
        """
        tactics_column_name: NotRequired[pulumi.Input[str]]
        """
        The column name to take the alert tactics from.
        """
elif False:
    AlertRuleScheduledAlertDetailsOverrideArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleScheduledAlertDetailsOverrideArgs:
    def __init__(__self__, *,
                 description_format: Optional[pulumi.Input[str]] = None,
                 display_name_format: Optional[pulumi.Input[str]] = None,
                 dynamic_properties: Optional[pulumi.Input[Sequence[pulumi.Input['AlertRuleScheduledAlertDetailsOverrideDynamicPropertyArgs']]]] = None,
                 severity_column_name: Optional[pulumi.Input[str]] = None,
                 tactics_column_name: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] description_format: The format containing columns name(s) to override the description of this Sentinel Alert Rule.
        :param pulumi.Input[str] display_name_format: The format containing columns name(s) to override the name of this Sentinel Alert Rule.
        :param pulumi.Input[Sequence[pulumi.Input['AlertRuleScheduledAlertDetailsOverrideDynamicPropertyArgs']]] dynamic_properties: A list of `dynamic_property` blocks as defined below.
        :param pulumi.Input[str] severity_column_name: The column name to take the alert severity from.
        :param pulumi.Input[str] tactics_column_name: The column name to take the alert tactics from.
        """
        if description_format is not None:
            pulumi.set(__self__, "description_format", description_format)
        if display_name_format is not None:
            pulumi.set(__self__, "display_name_format", display_name_format)
        if dynamic_properties is not None:
            pulumi.set(__self__, "dynamic_properties", dynamic_properties)
        if severity_column_name is not None:
            pulumi.set(__self__, "severity_column_name", severity_column_name)
        if tactics_column_name is not None:
            pulumi.set(__self__, "tactics_column_name", tactics_column_name)

    @property
    @pulumi.getter(name="descriptionFormat")
    def description_format(self) -> Optional[pulumi.Input[str]]:
        """
        The format containing columns name(s) to override the description of this Sentinel Alert Rule.
        """
        return pulumi.get(self, "description_format")

    @description_format.setter
    def description_format(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description_format", value)

    @property
    @pulumi.getter(name="displayNameFormat")
    def display_name_format(self) -> Optional[pulumi.Input[str]]:
        """
        The format containing columns name(s) to override the name of this Sentinel Alert Rule.
        """
        return pulumi.get(self, "display_name_format")

    @display_name_format.setter
    def display_name_format(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "display_name_format", value)

    @property
    @pulumi.getter(name="dynamicProperties")
    def dynamic_properties(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['AlertRuleScheduledAlertDetailsOverrideDynamicPropertyArgs']]]]:
        """
        A list of `dynamic_property` blocks as defined below.
        """
        return pulumi.get(self, "dynamic_properties")

    @dynamic_properties.setter
    def dynamic_properties(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['AlertRuleScheduledAlertDetailsOverrideDynamicPropertyArgs']]]]):
        pulumi.set(self, "dynamic_properties", value)

    @property
    @pulumi.getter(name="severityColumnName")
    def severity_column_name(self) -> Optional[pulumi.Input[str]]:
        """
        The column name to take the alert severity from.
        """
        return pulumi.get(self, "severity_column_name")

    @severity_column_name.setter
    def severity_column_name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "severity_column_name", value)

    @property
    @pulumi.getter(name="tacticsColumnName")
    def tactics_column_name(self) -> Optional[pulumi.Input[str]]:
        """
        The column name to take the alert tactics from.
        """
        return pulumi.get(self, "tactics_column_name")

    @tactics_column_name.setter
    def tactics_column_name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "tactics_column_name", value)


if not MYPY:
    class AlertRuleScheduledAlertDetailsOverrideDynamicPropertyArgsDict(TypedDict):
        name: pulumi.Input[str]
        """
        The name of the dynamic property. Possible Values are `AlertLink`, `ConfidenceLevel`, `ConfidenceScore`, `ExtendedLinks`, `ProductComponentName`, `ProductName`, `ProviderName`, `RemediationSteps` and `Techniques`.
        """
        value: pulumi.Input[str]
        """
        The value of the dynamic property. Pssible Values are `Caller`, `dcount_ResourceId` and `EventSubmissionTimestamp`.
        """
elif False:
    AlertRuleScheduledAlertDetailsOverrideDynamicPropertyArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleScheduledAlertDetailsOverrideDynamicPropertyArgs:
    def __init__(__self__, *,
                 name: pulumi.Input[str],
                 value: pulumi.Input[str]):
        """
        :param pulumi.Input[str] name: The name of the dynamic property. Possible Values are `AlertLink`, `ConfidenceLevel`, `ConfidenceScore`, `ExtendedLinks`, `ProductComponentName`, `ProductName`, `ProviderName`, `RemediationSteps` and `Techniques`.
        :param pulumi.Input[str] value: The value of the dynamic property. Pssible Values are `Caller`, `dcount_ResourceId` and `EventSubmissionTimestamp`.
        """
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def name(self) -> pulumi.Input[str]:
        """
        The name of the dynamic property. Possible Values are `AlertLink`, `ConfidenceLevel`, `ConfidenceScore`, `ExtendedLinks`, `ProductComponentName`, `ProductName`, `ProviderName`, `RemediationSteps` and `Techniques`.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: pulumi.Input[str]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter
    def value(self) -> pulumi.Input[str]:
        """
        The value of the dynamic property. Pssible Values are `Caller`, `dcount_ResourceId` and `EventSubmissionTimestamp`.
        """
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: pulumi.Input[str]):
        pulumi.set(self, "value", value)


if not MYPY:
    class AlertRuleScheduledEntityMappingArgsDict(TypedDict):
        entity_type: pulumi.Input[str]
        """
        The type of the entity. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        """
        field_mappings: pulumi.Input[Sequence[pulumi.Input['AlertRuleScheduledEntityMappingFieldMappingArgsDict']]]
        """
        A list of `field_mapping` blocks as defined below.
        """
elif False:
    AlertRuleScheduledEntityMappingArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleScheduledEntityMappingArgs:
    def __init__(__self__, *,
                 entity_type: pulumi.Input[str],
                 field_mappings: pulumi.Input[Sequence[pulumi.Input['AlertRuleScheduledEntityMappingFieldMappingArgs']]]):
        """
        :param pulumi.Input[str] entity_type: The type of the entity. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        :param pulumi.Input[Sequence[pulumi.Input['AlertRuleScheduledEntityMappingFieldMappingArgs']]] field_mappings: A list of `field_mapping` blocks as defined below.
        """
        pulumi.set(__self__, "entity_type", entity_type)
        pulumi.set(__self__, "field_mappings", field_mappings)

    @property
    @pulumi.getter(name="entityType")
    def entity_type(self) -> pulumi.Input[str]:
        """
        The type of the entity. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        """
        return pulumi.get(self, "entity_type")

    @entity_type.setter
    def entity_type(self, value: pulumi.Input[str]):
        pulumi.set(self, "entity_type", value)

    @property
    @pulumi.getter(name="fieldMappings")
    def field_mappings(self) -> pulumi.Input[Sequence[pulumi.Input['AlertRuleScheduledEntityMappingFieldMappingArgs']]]:
        """
        A list of `field_mapping` blocks as defined below.
        """
        return pulumi.get(self, "field_mappings")

    @field_mappings.setter
    def field_mappings(self, value: pulumi.Input[Sequence[pulumi.Input['AlertRuleScheduledEntityMappingFieldMappingArgs']]]):
        pulumi.set(self, "field_mappings", value)


if not MYPY:
    class AlertRuleScheduledEntityMappingFieldMappingArgsDict(TypedDict):
        column_name: pulumi.Input[str]
        """
        The column name to be mapped to the identifier.
        """
        identifier: pulumi.Input[str]
        """
        The identifier of the entity.
        """
elif False:
    AlertRuleScheduledEntityMappingFieldMappingArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleScheduledEntityMappingFieldMappingArgs:
    def __init__(__self__, *,
                 column_name: pulumi.Input[str],
                 identifier: pulumi.Input[str]):
        """
        :param pulumi.Input[str] column_name: The column name to be mapped to the identifier.
        :param pulumi.Input[str] identifier: The identifier of the entity.
        """
        pulumi.set(__self__, "column_name", column_name)
        pulumi.set(__self__, "identifier", identifier)

    @property
    @pulumi.getter(name="columnName")
    def column_name(self) -> pulumi.Input[str]:
        """
        The column name to be mapped to the identifier.
        """
        return pulumi.get(self, "column_name")

    @column_name.setter
    def column_name(self, value: pulumi.Input[str]):
        pulumi.set(self, "column_name", value)

    @property
    @pulumi.getter
    def identifier(self) -> pulumi.Input[str]:
        """
        The identifier of the entity.
        """
        return pulumi.get(self, "identifier")

    @identifier.setter
    def identifier(self, value: pulumi.Input[str]):
        pulumi.set(self, "identifier", value)


if not MYPY:
    class AlertRuleScheduledEventGroupingArgsDict(TypedDict):
        aggregation_method: pulumi.Input[str]
        """
        The aggregation type of grouping the events. Possible values are `AlertPerResult` and `SingleAlert`.
        """
elif False:
    AlertRuleScheduledEventGroupingArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleScheduledEventGroupingArgs:
    def __init__(__self__, *,
                 aggregation_method: pulumi.Input[str]):
        """
        :param pulumi.Input[str] aggregation_method: The aggregation type of grouping the events. Possible values are `AlertPerResult` and `SingleAlert`.
        """
        pulumi.set(__self__, "aggregation_method", aggregation_method)

    @property
    @pulumi.getter(name="aggregationMethod")
    def aggregation_method(self) -> pulumi.Input[str]:
        """
        The aggregation type of grouping the events. Possible values are `AlertPerResult` and `SingleAlert`.
        """
        return pulumi.get(self, "aggregation_method")

    @aggregation_method.setter
    def aggregation_method(self, value: pulumi.Input[str]):
        pulumi.set(self, "aggregation_method", value)


if not MYPY:
    class AlertRuleScheduledIncidentArgsDict(TypedDict):
        create_incident_enabled: pulumi.Input[bool]
        """
        Whether to create an incident from alerts triggered by this Sentinel Scheduled Alert Rule?
        """
        grouping: pulumi.Input['AlertRuleScheduledIncidentGroupingArgsDict']
        """
        A `grouping` block as defined below.
        """
elif False:
    AlertRuleScheduledIncidentArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleScheduledIncidentArgs:
    def __init__(__self__, *,
                 create_incident_enabled: pulumi.Input[bool],
                 grouping: pulumi.Input['AlertRuleScheduledIncidentGroupingArgs']):
        """
        :param pulumi.Input[bool] create_incident_enabled: Whether to create an incident from alerts triggered by this Sentinel Scheduled Alert Rule?
        :param pulumi.Input['AlertRuleScheduledIncidentGroupingArgs'] grouping: A `grouping` block as defined below.
        """
        pulumi.set(__self__, "create_incident_enabled", create_incident_enabled)
        pulumi.set(__self__, "grouping", grouping)

    @property
    @pulumi.getter(name="createIncidentEnabled")
    def create_incident_enabled(self) -> pulumi.Input[bool]:
        """
        Whether to create an incident from alerts triggered by this Sentinel Scheduled Alert Rule?
        """
        return pulumi.get(self, "create_incident_enabled")

    @create_incident_enabled.setter
    def create_incident_enabled(self, value: pulumi.Input[bool]):
        pulumi.set(self, "create_incident_enabled", value)

    @property
    @pulumi.getter
    def grouping(self) -> pulumi.Input['AlertRuleScheduledIncidentGroupingArgs']:
        """
        A `grouping` block as defined below.
        """
        return pulumi.get(self, "grouping")

    @grouping.setter
    def grouping(self, value: pulumi.Input['AlertRuleScheduledIncidentGroupingArgs']):
        pulumi.set(self, "grouping", value)


if not MYPY:
    class AlertRuleScheduledIncidentGroupingArgsDict(TypedDict):
        by_alert_details: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of alert details to group by, only when the `entity_matching_method` is `Selected`. Possible values are `DisplayName` and `Severity`.
        """
        by_custom_details: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of custom details keys to group by, only when the `entity_matching_method` is `Selected`. Only keys defined in the `custom_details` may be used.
        """
        by_entities: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of entity types to group by, only when the `entity_matching_method` is `Selected`. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        """
        enabled: NotRequired[pulumi.Input[bool]]
        """
        Enable grouping incidents created from alerts triggered by this Sentinel Scheduled Alert Rule. Defaults to `true`.
        """
        entity_matching_method: NotRequired[pulumi.Input[str]]
        """
        The method used to group incidents. Possible values are `AnyAlert`, `Selected` and `AllEntities`. Defaults to `AnyAlert`.
        """
        lookback_duration: NotRequired[pulumi.Input[str]]
        """
        Limit the group to alerts created within the lookback duration (in ISO 8601 duration format). Defaults to `PT5M`.
        """
        reopen_closed_incidents: NotRequired[pulumi.Input[bool]]
        """
        Whether to re-open closed matching incidents? Defaults to `false`.
        """
elif False:
    AlertRuleScheduledIncidentGroupingArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleScheduledIncidentGroupingArgs:
    def __init__(__self__, *,
                 by_alert_details: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 by_custom_details: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 by_entities: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 enabled: Optional[pulumi.Input[bool]] = None,
                 entity_matching_method: Optional[pulumi.Input[str]] = None,
                 lookback_duration: Optional[pulumi.Input[str]] = None,
                 reopen_closed_incidents: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] by_alert_details: A list of alert details to group by, only when the `entity_matching_method` is `Selected`. Possible values are `DisplayName` and `Severity`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] by_custom_details: A list of custom details keys to group by, only when the `entity_matching_method` is `Selected`. Only keys defined in the `custom_details` may be used.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] by_entities: A list of entity types to group by, only when the `entity_matching_method` is `Selected`. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        :param pulumi.Input[bool] enabled: Enable grouping incidents created from alerts triggered by this Sentinel Scheduled Alert Rule. Defaults to `true`.
        :param pulumi.Input[str] entity_matching_method: The method used to group incidents. Possible values are `AnyAlert`, `Selected` and `AllEntities`. Defaults to `AnyAlert`.
        :param pulumi.Input[str] lookback_duration: Limit the group to alerts created within the lookback duration (in ISO 8601 duration format). Defaults to `PT5M`.
        :param pulumi.Input[bool] reopen_closed_incidents: Whether to re-open closed matching incidents? Defaults to `false`.
        """
        if by_alert_details is not None:
            pulumi.set(__self__, "by_alert_details", by_alert_details)
        if by_custom_details is not None:
            pulumi.set(__self__, "by_custom_details", by_custom_details)
        if by_entities is not None:
            pulumi.set(__self__, "by_entities", by_entities)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if entity_matching_method is not None:
            pulumi.set(__self__, "entity_matching_method", entity_matching_method)
        if lookback_duration is not None:
            pulumi.set(__self__, "lookback_duration", lookback_duration)
        if reopen_closed_incidents is not None:
            pulumi.set(__self__, "reopen_closed_incidents", reopen_closed_incidents)

    @property
    @pulumi.getter(name="byAlertDetails")
    def by_alert_details(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of alert details to group by, only when the `entity_matching_method` is `Selected`. Possible values are `DisplayName` and `Severity`.
        """
        return pulumi.get(self, "by_alert_details")

    @by_alert_details.setter
    def by_alert_details(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "by_alert_details", value)

    @property
    @pulumi.getter(name="byCustomDetails")
    def by_custom_details(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of custom details keys to group by, only when the `entity_matching_method` is `Selected`. Only keys defined in the `custom_details` may be used.
        """
        return pulumi.get(self, "by_custom_details")

    @by_custom_details.setter
    def by_custom_details(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "by_custom_details", value)

    @property
    @pulumi.getter(name="byEntities")
    def by_entities(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of entity types to group by, only when the `entity_matching_method` is `Selected`. Possible values are `Account`, `AzureResource`, `CloudApplication`, `DNS`, `File`, `FileHash`, `Host`, `IP`, `Mailbox`, `MailCluster`, `MailMessage`, `Malware`, `Process`, `RegistryKey`, `RegistryValue`, `SecurityGroup`, `SubmissionMail`, `URL`.
        """
        return pulumi.get(self, "by_entities")

    @by_entities.setter
    def by_entities(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "by_entities", value)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Enable grouping incidents created from alerts triggered by this Sentinel Scheduled Alert Rule. Defaults to `true`.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter(name="entityMatchingMethod")
    def entity_matching_method(self) -> Optional[pulumi.Input[str]]:
        """
        The method used to group incidents. Possible values are `AnyAlert`, `Selected` and `AllEntities`. Defaults to `AnyAlert`.
        """
        return pulumi.get(self, "entity_matching_method")

    @entity_matching_method.setter
    def entity_matching_method(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "entity_matching_method", value)

    @property
    @pulumi.getter(name="lookbackDuration")
    def lookback_duration(self) -> Optional[pulumi.Input[str]]:
        """
        Limit the group to alerts created within the lookback duration (in ISO 8601 duration format). Defaults to `PT5M`.
        """
        return pulumi.get(self, "lookback_duration")

    @lookback_duration.setter
    def lookback_duration(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "lookback_duration", value)

    @property
    @pulumi.getter(name="reopenClosedIncidents")
    def reopen_closed_incidents(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether to re-open closed matching incidents? Defaults to `false`.
        """
        return pulumi.get(self, "reopen_closed_incidents")

    @reopen_closed_incidents.setter
    def reopen_closed_incidents(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "reopen_closed_incidents", value)


if not MYPY:
    class AlertRuleScheduledSentinelEntityMappingArgsDict(TypedDict):
        column_name: pulumi.Input[str]
        """
        The column name to be mapped to the identifier.
        """
elif False:
    AlertRuleScheduledSentinelEntityMappingArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AlertRuleScheduledSentinelEntityMappingArgs:
    def __init__(__self__, *,
                 column_name: pulumi.Input[str]):
        """
        :param pulumi.Input[str] column_name: The column name to be mapped to the identifier.
        """
        pulumi.set(__self__, "column_name", column_name)

    @property
    @pulumi.getter(name="columnName")
    def column_name(self) -> pulumi.Input[str]:
        """
        The column name to be mapped to the identifier.
        """
        return pulumi.get(self, "column_name")

    @column_name.setter
    def column_name(self, value: pulumi.Input[str]):
        pulumi.set(self, "column_name", value)


if not MYPY:
    class AuthomationRuleActionIncidentArgsDict(TypedDict):
        order: pulumi.Input[int]
        """
        The execution order of this action.
        """
        classification: NotRequired[pulumi.Input[str]]
        """
        The classification of the incident, when closing it. Possible values are: `BenignPositive_SuspiciousButExpected`, `FalsePositive_InaccurateData`, `FalsePositive_IncorrectAlertLogic`, `TruePositive_SuspiciousActivity` and `Undetermined`.

        > **Note:** The `classification` is required when `status` is `Closed`.
        """
        classification_comment: NotRequired[pulumi.Input[str]]
        """
        The comment why the incident is to be closed.

        > **Note:** The `classification_comment` is allowed to set only when `status` is `Closed`.
        """
        labels: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        Specifies a list of labels to add to the incident.
        """
        owner_id: NotRequired[pulumi.Input[str]]
        """
        The object ID of the entity this incident is assigned to.
        """
        severity: NotRequired[pulumi.Input[str]]
        """
        The severity to add to the incident. Possible values are `High`, `Informational`, `Low` and `Medium`.

        > **Note:**: At least one of `status`, `labels`, `owner_id` and `severity` has to be set.
        """
        status: NotRequired[pulumi.Input[str]]
        """
        The status to set to the incident. Possible values are: `Active`, `Closed`, `New`.
        """
elif False:
    AuthomationRuleActionIncidentArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AuthomationRuleActionIncidentArgs:
    def __init__(__self__, *,
                 order: pulumi.Input[int],
                 classification: Optional[pulumi.Input[str]] = None,
                 classification_comment: Optional[pulumi.Input[str]] = None,
                 labels: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 owner_id: Optional[pulumi.Input[str]] = None,
                 severity: Optional[pulumi.Input[str]] = None,
                 status: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[int] order: The execution order of this action.
        :param pulumi.Input[str] classification: The classification of the incident, when closing it. Possible values are: `BenignPositive_SuspiciousButExpected`, `FalsePositive_InaccurateData`, `FalsePositive_IncorrectAlertLogic`, `TruePositive_SuspiciousActivity` and `Undetermined`.
               
               > **Note:** The `classification` is required when `status` is `Closed`.
        :param pulumi.Input[str] classification_comment: The comment why the incident is to be closed.
               
               > **Note:** The `classification_comment` is allowed to set only when `status` is `Closed`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] labels: Specifies a list of labels to add to the incident.
        :param pulumi.Input[str] owner_id: The object ID of the entity this incident is assigned to.
        :param pulumi.Input[str] severity: The severity to add to the incident. Possible values are `High`, `Informational`, `Low` and `Medium`.
               
               > **Note:**: At least one of `status`, `labels`, `owner_id` and `severity` has to be set.
        :param pulumi.Input[str] status: The status to set to the incident. Possible values are: `Active`, `Closed`, `New`.
        """
        pulumi.set(__self__, "order", order)
        if classification is not None:
            pulumi.set(__self__, "classification", classification)
        if classification_comment is not None:
            pulumi.set(__self__, "classification_comment", classification_comment)
        if labels is not None:
            pulumi.set(__self__, "labels", labels)
        if owner_id is not None:
            pulumi.set(__self__, "owner_id", owner_id)
        if severity is not None:
            pulumi.set(__self__, "severity", severity)
        if status is not None:
            pulumi.set(__self__, "status", status)

    @property
    @pulumi.getter
    def order(self) -> pulumi.Input[int]:
        """
        The execution order of this action.
        """
        return pulumi.get(self, "order")

    @order.setter
    def order(self, value: pulumi.Input[int]):
        pulumi.set(self, "order", value)

    @property
    @pulumi.getter
    def classification(self) -> Optional[pulumi.Input[str]]:
        """
        The classification of the incident, when closing it. Possible values are: `BenignPositive_SuspiciousButExpected`, `FalsePositive_InaccurateData`, `FalsePositive_IncorrectAlertLogic`, `TruePositive_SuspiciousActivity` and `Undetermined`.

        > **Note:** The `classification` is required when `status` is `Closed`.
        """
        return pulumi.get(self, "classification")

    @classification.setter
    def classification(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "classification", value)

    @property
    @pulumi.getter(name="classificationComment")
    def classification_comment(self) -> Optional[pulumi.Input[str]]:
        """
        The comment why the incident is to be closed.

        > **Note:** The `classification_comment` is allowed to set only when `status` is `Closed`.
        """
        return pulumi.get(self, "classification_comment")

    @classification_comment.setter
    def classification_comment(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "classification_comment", value)

    @property
    @pulumi.getter
    def labels(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        Specifies a list of labels to add to the incident.
        """
        return pulumi.get(self, "labels")

    @labels.setter
    def labels(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "labels", value)

    @property
    @pulumi.getter(name="ownerId")
    def owner_id(self) -> Optional[pulumi.Input[str]]:
        """
        The object ID of the entity this incident is assigned to.
        """
        return pulumi.get(self, "owner_id")

    @owner_id.setter
    def owner_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "owner_id", value)

    @property
    @pulumi.getter
    def severity(self) -> Optional[pulumi.Input[str]]:
        """
        The severity to add to the incident. Possible values are `High`, `Informational`, `Low` and `Medium`.

        > **Note:**: At least one of `status`, `labels`, `owner_id` and `severity` has to be set.
        """
        return pulumi.get(self, "severity")

    @severity.setter
    def severity(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "severity", value)

    @property
    @pulumi.getter
    def status(self) -> Optional[pulumi.Input[str]]:
        """
        The status to set to the incident. Possible values are: `Active`, `Closed`, `New`.
        """
        return pulumi.get(self, "status")

    @status.setter
    def status(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "status", value)


if not MYPY:
    class AuthomationRuleActionPlaybookArgsDict(TypedDict):
        logic_app_id: pulumi.Input[str]
        """
        The ID of the Logic App that defines the playbook's logic.
        """
        order: pulumi.Input[int]
        """
        The execution order of this action.
        """
        tenant_id: NotRequired[pulumi.Input[str]]
        """
        The ID of the Tenant that owns the playbook.
        """
elif False:
    AuthomationRuleActionPlaybookArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AuthomationRuleActionPlaybookArgs:
    def __init__(__self__, *,
                 logic_app_id: pulumi.Input[str],
                 order: pulumi.Input[int],
                 tenant_id: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] logic_app_id: The ID of the Logic App that defines the playbook's logic.
        :param pulumi.Input[int] order: The execution order of this action.
        :param pulumi.Input[str] tenant_id: The ID of the Tenant that owns the playbook.
        """
        pulumi.set(__self__, "logic_app_id", logic_app_id)
        pulumi.set(__self__, "order", order)
        if tenant_id is not None:
            pulumi.set(__self__, "tenant_id", tenant_id)

    @property
    @pulumi.getter(name="logicAppId")
    def logic_app_id(self) -> pulumi.Input[str]:
        """
        The ID of the Logic App that defines the playbook's logic.
        """
        return pulumi.get(self, "logic_app_id")

    @logic_app_id.setter
    def logic_app_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "logic_app_id", value)

    @property
    @pulumi.getter
    def order(self) -> pulumi.Input[int]:
        """
        The execution order of this action.
        """
        return pulumi.get(self, "order")

    @order.setter
    def order(self, value: pulumi.Input[int]):
        pulumi.set(self, "order", value)

    @property
    @pulumi.getter(name="tenantId")
    def tenant_id(self) -> Optional[pulumi.Input[str]]:
        """
        The ID of the Tenant that owns the playbook.
        """
        return pulumi.get(self, "tenant_id")

    @tenant_id.setter
    def tenant_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "tenant_id", value)


if not MYPY:
    class AutomationRuleActionIncidentArgsDict(TypedDict):
        order: pulumi.Input[int]
        """
        The execution order of this action.
        """
        classification: NotRequired[pulumi.Input[str]]
        """
        The classification of the incident, when closing it. Possible values are: `BenignPositive_SuspiciousButExpected`, `FalsePositive_InaccurateData`, `FalsePositive_IncorrectAlertLogic`, `TruePositive_SuspiciousActivity` and `Undetermined`.

        > **Note:** The `classification` is required when `status` is `Closed`.
        """
        classification_comment: NotRequired[pulumi.Input[str]]
        """
        The comment why the incident is to be closed.

        > **Note:** The `classification_comment` is allowed to set only when `status` is `Closed`.
        """
        labels: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        Specifies a list of labels to add to the incident.
        """
        owner_id: NotRequired[pulumi.Input[str]]
        """
        The object ID of the entity this incident is assigned to.
        """
        severity: NotRequired[pulumi.Input[str]]
        """
        The severity to add to the incident. Possible values are `High`, `Informational`, `Low` and `Medium`.

        > **Note:**: At least one of `status`, `labels`, `owner_id` and `severity` has to be set.
        """
        status: NotRequired[pulumi.Input[str]]
        """
        The status to set to the incident. Possible values are: `Active`, `Closed`, `New`.
        """
elif False:
    AutomationRuleActionIncidentArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AutomationRuleActionIncidentArgs:
    def __init__(__self__, *,
                 order: pulumi.Input[int],
                 classification: Optional[pulumi.Input[str]] = None,
                 classification_comment: Optional[pulumi.Input[str]] = None,
                 labels: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 owner_id: Optional[pulumi.Input[str]] = None,
                 severity: Optional[pulumi.Input[str]] = None,
                 status: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[int] order: The execution order of this action.
        :param pulumi.Input[str] classification: The classification of the incident, when closing it. Possible values are: `BenignPositive_SuspiciousButExpected`, `FalsePositive_InaccurateData`, `FalsePositive_IncorrectAlertLogic`, `TruePositive_SuspiciousActivity` and `Undetermined`.
               
               > **Note:** The `classification` is required when `status` is `Closed`.
        :param pulumi.Input[str] classification_comment: The comment why the incident is to be closed.
               
               > **Note:** The `classification_comment` is allowed to set only when `status` is `Closed`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] labels: Specifies a list of labels to add to the incident.
        :param pulumi.Input[str] owner_id: The object ID of the entity this incident is assigned to.
        :param pulumi.Input[str] severity: The severity to add to the incident. Possible values are `High`, `Informational`, `Low` and `Medium`.
               
               > **Note:**: At least one of `status`, `labels`, `owner_id` and `severity` has to be set.
        :param pulumi.Input[str] status: The status to set to the incident. Possible values are: `Active`, `Closed`, `New`.
        """
        pulumi.set(__self__, "order", order)
        if classification is not None:
            pulumi.set(__self__, "classification", classification)
        if classification_comment is not None:
            pulumi.set(__self__, "classification_comment", classification_comment)
        if labels is not None:
            pulumi.set(__self__, "labels", labels)
        if owner_id is not None:
            pulumi.set(__self__, "owner_id", owner_id)
        if severity is not None:
            pulumi.set(__self__, "severity", severity)
        if status is not None:
            pulumi.set(__self__, "status", status)

    @property
    @pulumi.getter
    def order(self) -> pulumi.Input[int]:
        """
        The execution order of this action.
        """
        return pulumi.get(self, "order")

    @order.setter
    def order(self, value: pulumi.Input[int]):
        pulumi.set(self, "order", value)

    @property
    @pulumi.getter
    def classification(self) -> Optional[pulumi.Input[str]]:
        """
        The classification of the incident, when closing it. Possible values are: `BenignPositive_SuspiciousButExpected`, `FalsePositive_InaccurateData`, `FalsePositive_IncorrectAlertLogic`, `TruePositive_SuspiciousActivity` and `Undetermined`.

        > **Note:** The `classification` is required when `status` is `Closed`.
        """
        return pulumi.get(self, "classification")

    @classification.setter
    def classification(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "classification", value)

    @property
    @pulumi.getter(name="classificationComment")
    def classification_comment(self) -> Optional[pulumi.Input[str]]:
        """
        The comment why the incident is to be closed.

        > **Note:** The `classification_comment` is allowed to set only when `status` is `Closed`.
        """
        return pulumi.get(self, "classification_comment")

    @classification_comment.setter
    def classification_comment(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "classification_comment", value)

    @property
    @pulumi.getter
    def labels(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        Specifies a list of labels to add to the incident.
        """
        return pulumi.get(self, "labels")

    @labels.setter
    def labels(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "labels", value)

    @property
    @pulumi.getter(name="ownerId")
    def owner_id(self) -> Optional[pulumi.Input[str]]:
        """
        The object ID of the entity this incident is assigned to.
        """
        return pulumi.get(self, "owner_id")

    @owner_id.setter
    def owner_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "owner_id", value)

    @property
    @pulumi.getter
    def severity(self) -> Optional[pulumi.Input[str]]:
        """
        The severity to add to the incident. Possible values are `High`, `Informational`, `Low` and `Medium`.

        > **Note:**: At least one of `status`, `labels`, `owner_id` and `severity` has to be set.
        """
        return pulumi.get(self, "severity")

    @severity.setter
    def severity(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "severity", value)

    @property
    @pulumi.getter
    def status(self) -> Optional[pulumi.Input[str]]:
        """
        The status to set to the incident. Possible values are: `Active`, `Closed`, `New`.
        """
        return pulumi.get(self, "status")

    @status.setter
    def status(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "status", value)


if not MYPY:
    class AutomationRuleActionPlaybookArgsDict(TypedDict):
        logic_app_id: pulumi.Input[str]
        """
        The ID of the Logic App that defines the playbook's logic.
        """
        order: pulumi.Input[int]
        """
        The execution order of this action.
        """
        tenant_id: NotRequired[pulumi.Input[str]]
        """
        The ID of the Tenant that owns the playbook.
        """
elif False:
    AutomationRuleActionPlaybookArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AutomationRuleActionPlaybookArgs:
    def __init__(__self__, *,
                 logic_app_id: pulumi.Input[str],
                 order: pulumi.Input[int],
                 tenant_id: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] logic_app_id: The ID of the Logic App that defines the playbook's logic.
        :param pulumi.Input[int] order: The execution order of this action.
        :param pulumi.Input[str] tenant_id: The ID of the Tenant that owns the playbook.
        """
        pulumi.set(__self__, "logic_app_id", logic_app_id)
        pulumi.set(__self__, "order", order)
        if tenant_id is not None:
            pulumi.set(__self__, "tenant_id", tenant_id)

    @property
    @pulumi.getter(name="logicAppId")
    def logic_app_id(self) -> pulumi.Input[str]:
        """
        The ID of the Logic App that defines the playbook's logic.
        """
        return pulumi.get(self, "logic_app_id")

    @logic_app_id.setter
    def logic_app_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "logic_app_id", value)

    @property
    @pulumi.getter
    def order(self) -> pulumi.Input[int]:
        """
        The execution order of this action.
        """
        return pulumi.get(self, "order")

    @order.setter
    def order(self, value: pulumi.Input[int]):
        pulumi.set(self, "order", value)

    @property
    @pulumi.getter(name="tenantId")
    def tenant_id(self) -> Optional[pulumi.Input[str]]:
        """
        The ID of the Tenant that owns the playbook.
        """
        return pulumi.get(self, "tenant_id")

    @tenant_id.setter
    def tenant_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "tenant_id", value)


if not MYPY:
    class MetadataAuthorArgsDict(TypedDict):
        email: NotRequired[pulumi.Input[str]]
        """
        The email address of the author contact.
        """
        link: NotRequired[pulumi.Input[str]]
        """
        The link for author/vendor page.
        """
        name: NotRequired[pulumi.Input[str]]
        """
        The name of the author, company or person.
        """
elif False:
    MetadataAuthorArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class MetadataAuthorArgs:
    def __init__(__self__, *,
                 email: Optional[pulumi.Input[str]] = None,
                 link: Optional[pulumi.Input[str]] = None,
                 name: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] email: The email address of the author contact.
        :param pulumi.Input[str] link: The link for author/vendor page.
        :param pulumi.Input[str] name: The name of the author, company or person.
        """
        if email is not None:
            pulumi.set(__self__, "email", email)
        if link is not None:
            pulumi.set(__self__, "link", link)
        if name is not None:
            pulumi.set(__self__, "name", name)

    @property
    @pulumi.getter
    def email(self) -> Optional[pulumi.Input[str]]:
        """
        The email address of the author contact.
        """
        return pulumi.get(self, "email")

    @email.setter
    def email(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "email", value)

    @property
    @pulumi.getter
    def link(self) -> Optional[pulumi.Input[str]]:
        """
        The link for author/vendor page.
        """
        return pulumi.get(self, "link")

    @link.setter
    def link(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "link", value)

    @property
    @pulumi.getter
    def name(self) -> Optional[pulumi.Input[str]]:
        """
        The name of the author, company or person.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "name", value)


if not MYPY:
    class MetadataCategoryArgsDict(TypedDict):
        domains: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        Specifies a list of domains for the solution content item.
        """
        verticals: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        Specifies a list of industry verticals for the solution content item.
        """
elif False:
    MetadataCategoryArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class MetadataCategoryArgs:
    def __init__(__self__, *,
                 domains: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 verticals: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] domains: Specifies a list of domains for the solution content item.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] verticals: Specifies a list of industry verticals for the solution content item.
        """
        if domains is not None:
            pulumi.set(__self__, "domains", domains)
        if verticals is not None:
            pulumi.set(__self__, "verticals", verticals)

    @property
    @pulumi.getter
    def domains(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        Specifies a list of domains for the solution content item.
        """
        return pulumi.get(self, "domains")

    @domains.setter
    def domains(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "domains", value)

    @property
    @pulumi.getter
    def verticals(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        Specifies a list of industry verticals for the solution content item.
        """
        return pulumi.get(self, "verticals")

    @verticals.setter
    def verticals(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "verticals", value)


if not MYPY:
    class MetadataSourceArgsDict(TypedDict):
        kind: pulumi.Input[str]
        """
        The kind of the content source. Possible values are `Community`, `LocalWorkspace`, `Solution` and `SourceRepository`.
        """
        id: NotRequired[pulumi.Input[str]]
        """
        The id of the content source, the solution ID, Log Analytics Workspace name etc.
        """
        name: NotRequired[pulumi.Input[str]]
        """
        The name of the content source, repo name, solution name, Log Analytics Workspace name, etc.
        """
elif False:
    MetadataSourceArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class MetadataSourceArgs:
    def __init__(__self__, *,
                 kind: pulumi.Input[str],
                 id: Optional[pulumi.Input[str]] = None,
                 name: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] kind: The kind of the content source. Possible values are `Community`, `LocalWorkspace`, `Solution` and `SourceRepository`.
        :param pulumi.Input[str] id: The id of the content source, the solution ID, Log Analytics Workspace name etc.
        :param pulumi.Input[str] name: The name of the content source, repo name, solution name, Log Analytics Workspace name, etc.
        """
        pulumi.set(__self__, "kind", kind)
        if id is not None:
            pulumi.set(__self__, "id", id)
        if name is not None:
            pulumi.set(__self__, "name", name)

    @property
    @pulumi.getter
    def kind(self) -> pulumi.Input[str]:
        """
        The kind of the content source. Possible values are `Community`, `LocalWorkspace`, `Solution` and `SourceRepository`.
        """
        return pulumi.get(self, "kind")

    @kind.setter
    def kind(self, value: pulumi.Input[str]):
        pulumi.set(self, "kind", value)

    @property
    @pulumi.getter
    def id(self) -> Optional[pulumi.Input[str]]:
        """
        The id of the content source, the solution ID, Log Analytics Workspace name etc.
        """
        return pulumi.get(self, "id")

    @id.setter
    def id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "id", value)

    @property
    @pulumi.getter
    def name(self) -> Optional[pulumi.Input[str]]:
        """
        The name of the content source, repo name, solution name, Log Analytics Workspace name, etc.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "name", value)


if not MYPY:
    class MetadataSupportArgsDict(TypedDict):
        tier: pulumi.Input[str]
        """
        The type of support for content item. Possible values are `Microsoft`, `Partner` and `Community`.
        """
        email: NotRequired[pulumi.Input[str]]
        """
        The email address of the support contact.
        """
        link: NotRequired[pulumi.Input[str]]
        """
        The link for support help.
        """
        name: NotRequired[pulumi.Input[str]]
        """
        The name of the support contact.
        """
elif False:
    MetadataSupportArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class MetadataSupportArgs:
    def __init__(__self__, *,
                 tier: pulumi.Input[str],
                 email: Optional[pulumi.Input[str]] = None,
                 link: Optional[pulumi.Input[str]] = None,
                 name: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] tier: The type of support for content item. Possible values are `Microsoft`, `Partner` and `Community`.
        :param pulumi.Input[str] email: The email address of the support contact.
        :param pulumi.Input[str] link: The link for support help.
        :param pulumi.Input[str] name: The name of the support contact.
        """
        pulumi.set(__self__, "tier", tier)
        if email is not None:
            pulumi.set(__self__, "email", email)
        if link is not None:
            pulumi.set(__self__, "link", link)
        if name is not None:
            pulumi.set(__self__, "name", name)

    @property
    @pulumi.getter
    def tier(self) -> pulumi.Input[str]:
        """
        The type of support for content item. Possible values are `Microsoft`, `Partner` and `Community`.
        """
        return pulumi.get(self, "tier")

    @tier.setter
    def tier(self, value: pulumi.Input[str]):
        pulumi.set(self, "tier", value)

    @property
    @pulumi.getter
    def email(self) -> Optional[pulumi.Input[str]]:
        """
        The email address of the support contact.
        """
        return pulumi.get(self, "email")

    @email.setter
    def email(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "email", value)

    @property
    @pulumi.getter
    def link(self) -> Optional[pulumi.Input[str]]:
        """
        The link for support help.
        """
        return pulumi.get(self, "link")

    @link.setter
    def link(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "link", value)

    @property
    @pulumi.getter
    def name(self) -> Optional[pulumi.Input[str]]:
        """
        The name of the support contact.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "name", value)


if not MYPY:
    class ThreatIntelligenceIndicatorExternalReferenceArgsDict(TypedDict):
        description: NotRequired[pulumi.Input[str]]
        """
        The description of the external reference of the Threat Intelligence Indicator.
        """
        hashes: NotRequired[pulumi.Input[Mapping[str, pulumi.Input[str]]]]
        """
        The list of hashes of the external reference of the Threat Intelligence Indicator.
        """
        id: NotRequired[pulumi.Input[str]]
        """
        The ID of the Sentinel Threat Intelligence Indicator.
        """
        source_name: NotRequired[pulumi.Input[str]]
        """
        The source name of the external reference of the Threat Intelligence Indicator.
        """
        url: NotRequired[pulumi.Input[str]]
        """
        The url of the external reference of the Threat Intelligence Indicator.
        """
elif False:
    ThreatIntelligenceIndicatorExternalReferenceArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ThreatIntelligenceIndicatorExternalReferenceArgs:
    def __init__(__self__, *,
                 description: Optional[pulumi.Input[str]] = None,
                 hashes: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                 id: Optional[pulumi.Input[str]] = None,
                 source_name: Optional[pulumi.Input[str]] = None,
                 url: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] description: The description of the external reference of the Threat Intelligence Indicator.
        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] hashes: The list of hashes of the external reference of the Threat Intelligence Indicator.
        :param pulumi.Input[str] id: The ID of the Sentinel Threat Intelligence Indicator.
        :param pulumi.Input[str] source_name: The source name of the external reference of the Threat Intelligence Indicator.
        :param pulumi.Input[str] url: The url of the external reference of the Threat Intelligence Indicator.
        """
        if description is not None:
            pulumi.set(__self__, "description", description)
        if hashes is not None:
            pulumi.set(__self__, "hashes", hashes)
        if id is not None:
            pulumi.set(__self__, "id", id)
        if source_name is not None:
            pulumi.set(__self__, "source_name", source_name)
        if url is not None:
            pulumi.set(__self__, "url", url)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        The description of the external reference of the Threat Intelligence Indicator.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter
    def hashes(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
        """
        The list of hashes of the external reference of the Threat Intelligence Indicator.
        """
        return pulumi.get(self, "hashes")

    @hashes.setter
    def hashes(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
        pulumi.set(self, "hashes", value)

    @property
    @pulumi.getter
    def id(self) -> Optional[pulumi.Input[str]]:
        """
        The ID of the Sentinel Threat Intelligence Indicator.
        """
        return pulumi.get(self, "id")

    @id.setter
    def id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "id", value)

    @property
    @pulumi.getter(name="sourceName")
    def source_name(self) -> Optional[pulumi.Input[str]]:
        """
        The source name of the external reference of the Threat Intelligence Indicator.
        """
        return pulumi.get(self, "source_name")

    @source_name.setter
    def source_name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "source_name", value)

    @property
    @pulumi.getter
    def url(self) -> Optional[pulumi.Input[str]]:
        """
        The url of the external reference of the Threat Intelligence Indicator.
        """
        return pulumi.get(self, "url")

    @url.setter
    def url(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "url", value)


if not MYPY:
    class ThreatIntelligenceIndicatorGranularMarkingArgsDict(TypedDict):
        language: NotRequired[pulumi.Input[str]]
        """
        The language of granular marking of the Threat Intelligence Indicator.
        """
        marking_ref: NotRequired[pulumi.Input[str]]
        """
        The reference of the granular marking of the Threat Intelligence Indicator.
        """
        selectors: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of selectors of the granular marking of the Threat Intelligence Indicator.
        """
elif False:
    ThreatIntelligenceIndicatorGranularMarkingArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ThreatIntelligenceIndicatorGranularMarkingArgs:
    def __init__(__self__, *,
                 language: Optional[pulumi.Input[str]] = None,
                 marking_ref: Optional[pulumi.Input[str]] = None,
                 selectors: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[str] language: The language of granular marking of the Threat Intelligence Indicator.
        :param pulumi.Input[str] marking_ref: The reference of the granular marking of the Threat Intelligence Indicator.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] selectors: A list of selectors of the granular marking of the Threat Intelligence Indicator.
        """
        if language is not None:
            pulumi.set(__self__, "language", language)
        if marking_ref is not None:
            pulumi.set(__self__, "marking_ref", marking_ref)
        if selectors is not None:
            pulumi.set(__self__, "selectors", selectors)

    @property
    @pulumi.getter
    def language(self) -> Optional[pulumi.Input[str]]:
        """
        The language of granular marking of the Threat Intelligence Indicator.
        """
        return pulumi.get(self, "language")

    @language.setter
    def language(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "language", value)

    @property
    @pulumi.getter(name="markingRef")
    def marking_ref(self) -> Optional[pulumi.Input[str]]:
        """
        The reference of the granular marking of the Threat Intelligence Indicator.
        """
        return pulumi.get(self, "marking_ref")

    @marking_ref.setter
    def marking_ref(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "marking_ref", value)

    @property
    @pulumi.getter
    def selectors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of selectors of the granular marking of the Threat Intelligence Indicator.
        """
        return pulumi.get(self, "selectors")

    @selectors.setter
    def selectors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "selectors", value)


if not MYPY:
    class ThreatIntelligenceIndicatorKillChainPhaseArgsDict(TypedDict):
        name: NotRequired[pulumi.Input[str]]
        """
        The name which should be used for the Lockheed Martin cyber kill chain phase.
        """
elif False:
    ThreatIntelligenceIndicatorKillChainPhaseArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ThreatIntelligenceIndicatorKillChainPhaseArgs:
    def __init__(__self__, *,
                 name: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] name: The name which should be used for the Lockheed Martin cyber kill chain phase.
        """
        if name is not None:
            pulumi.set(__self__, "name", name)

    @property
    @pulumi.getter
    def name(self) -> Optional[pulumi.Input[str]]:
        """
        The name which should be used for the Lockheed Martin cyber kill chain phase.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "name", value)


if not MYPY:
    class ThreatIntelligenceIndicatorParsedPatternArgsDict(TypedDict):
        pattern_type_key: NotRequired[pulumi.Input[str]]
        """
        The type key of parsed pattern.
        """
        pattern_type_values: NotRequired[pulumi.Input[Sequence[pulumi.Input['ThreatIntelligenceIndicatorParsedPatternPatternTypeValueArgsDict']]]]
        """
        A `pattern_type_values` block as defined below.
        """
elif False:
    ThreatIntelligenceIndicatorParsedPatternArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ThreatIntelligenceIndicatorParsedPatternArgs:
    def __init__(__self__, *,
                 pattern_type_key: Optional[pulumi.Input[str]] = None,
                 pattern_type_values: Optional[pulumi.Input[Sequence[pulumi.Input['ThreatIntelligenceIndicatorParsedPatternPatternTypeValueArgs']]]] = None):
        """
        :param pulumi.Input[str] pattern_type_key: The type key of parsed pattern.
        :param pulumi.Input[Sequence[pulumi.Input['ThreatIntelligenceIndicatorParsedPatternPatternTypeValueArgs']]] pattern_type_values: A `pattern_type_values` block as defined below.
        """
        if pattern_type_key is not None:
            pulumi.set(__self__, "pattern_type_key", pattern_type_key)
        if pattern_type_values is not None:
            pulumi.set(__self__, "pattern_type_values", pattern_type_values)

    @property
    @pulumi.getter(name="patternTypeKey")
    def pattern_type_key(self) -> Optional[pulumi.Input[str]]:
        """
        The type key of parsed pattern.
        """
        return pulumi.get(self, "pattern_type_key")

    @pattern_type_key.setter
    def pattern_type_key(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "pattern_type_key", value)

    @property
    @pulumi.getter(name="patternTypeValues")
    def pattern_type_values(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ThreatIntelligenceIndicatorParsedPatternPatternTypeValueArgs']]]]:
        """
        A `pattern_type_values` block as defined below.
        """
        return pulumi.get(self, "pattern_type_values")

    @pattern_type_values.setter
    def pattern_type_values(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['ThreatIntelligenceIndicatorParsedPatternPatternTypeValueArgs']]]]):
        pulumi.set(self, "pattern_type_values", value)


if not MYPY:
    class ThreatIntelligenceIndicatorParsedPatternPatternTypeValueArgsDict(TypedDict):
        value: NotRequired[pulumi.Input[str]]
        """
        The value of the parsed pattern type.
        """
        value_type: NotRequired[pulumi.Input[str]]
        """
        The type of the value of the parsed pattern type value.
        """
elif False:
    ThreatIntelligenceIndicatorParsedPatternPatternTypeValueArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ThreatIntelligenceIndicatorParsedPatternPatternTypeValueArgs:
    def __init__(__self__, *,
                 value: Optional[pulumi.Input[str]] = None,
                 value_type: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] value: The value of the parsed pattern type.
        :param pulumi.Input[str] value_type: The type of the value of the parsed pattern type value.
        """
        if value is not None:
            pulumi.set(__self__, "value", value)
        if value_type is not None:
            pulumi.set(__self__, "value_type", value_type)

    @property
    @pulumi.getter
    def value(self) -> Optional[pulumi.Input[str]]:
        """
        The value of the parsed pattern type.
        """
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "value", value)

    @property
    @pulumi.getter(name="valueType")
    def value_type(self) -> Optional[pulumi.Input[str]]:
        """
        The type of the value of the parsed pattern type value.
        """
        return pulumi.get(self, "value_type")

    @value_type.setter
    def value_type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "value_type", value)


