kibanaSecurityDetectionRule.ts

// *** WARNING: this file was generated by pulumi-language-nodejs. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***

import * as pulumi from "@pulumi/pulumi";
import * as inputs from "./types/input";
import * as outputs from "./types/output";
import * as utilities from "./utilities";

export class KibanaSecurityDetectionRule extends pulumi.CustomResource {
    /**
     * Get an existing KibanaSecurityDetectionRule resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: KibanaSecurityDetectionRuleState, opts?: pulumi.CustomResourceOptions): KibanaSecurityDetectionRule {
        return new KibanaSecurityDetectionRule(name, <any>state, { ...opts, id: id });
    }

    /** @internal */
    public static readonly __pulumiType = 'elasticstack:index/kibanaSecurityDetectionRule:KibanaSecurityDetectionRule';

    /**
     * Returns true if the given object is an instance of KibanaSecurityDetectionRule.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    public static isInstance(obj: any): obj is KibanaSecurityDetectionRule {
        if (obj === undefined || obj === null) {
            return false;
        }
        return obj['__pulumiType'] === KibanaSecurityDetectionRule.__pulumiType;
    }

    /**
     * Array of automated actions taken when alerts are generated by the rule.
     */
    declare public readonly actions: pulumi.Output<outputs.KibanaSecurityDetectionRuleAction[] | undefined>;
    /**
     * Defines alert suppression configuration to reduce duplicate alerts.
     */
    declare public readonly alertSuppression: pulumi.Output<outputs.KibanaSecurityDetectionRuleAlertSuppression | undefined>;
    /**
     * Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100. Required for
     * machine_learning rules.
     */
    declare public readonly anomalyThreshold: pulumi.Output<number | undefined>;
    /**
     * The rule's author.
     */
    declare public readonly authors: pulumi.Output<string[]>;
    /**
     * Determines if the rule acts as a building block. If set, value must be `default`. Building-block alerts are not
     * displayed in the UI by default and are used as a foundation for other rules.
     */
    declare public readonly buildingBlockType: pulumi.Output<string | undefined>;
    /**
     * Number of concurrent searches for threat intelligence. Optional for threat_match rules.
     */
    declare public readonly concurrentSearches: pulumi.Output<number | undefined>;
    /**
     * The time the rule was created.
     */
    declare public /*out*/ readonly createdAt: pulumi.Output<string>;
    /**
     * The user who created the rule.
     */
    declare public /*out*/ readonly createdBy: pulumi.Output<string>;
    /**
     * Data view ID for the rule. Not supported for esql and machine_learning rule types.
     */
    declare public readonly dataViewId: pulumi.Output<string | undefined>;
    /**
     * The rule's description.
     */
    declare public readonly description: pulumi.Output<string>;
    /**
     * Determines whether the rule is enabled.
     */
    declare public readonly enabled: pulumi.Output<boolean>;
    /**
     * Array of exception containers to prevent the rule from generating alerts.
     */
    declare public readonly exceptionsLists: pulumi.Output<outputs.KibanaSecurityDetectionRuleExceptionsList[] | undefined>;
    /**
     * String array used to describe common reasons why the rule may issue false-positive alerts.
     */
    declare public readonly falsePositives: pulumi.Output<string[]>;
    /**
     * Query and filter context array to define alert conditions as JSON. Supports complex filter structures including bool
     * queries, term filters, range filters, etc. Available for all rule types.
     */
    declare public readonly filters: pulumi.Output<string | undefined>;
    /**
     * Time from which data is analyzed each time the rule runs, using a date math range.
     */
    declare public readonly from: pulumi.Output<string>;
    /**
     * Start date to use when checking if a term has been seen before. Supports relative dates like 'now-30d'. Required for
     * new_terms rules.
     */
    declare public readonly historyWindowStart: pulumi.Output<string | undefined>;
    /**
     * Indices on which the rule functions.
     */
    declare public readonly indices: pulumi.Output<string[]>;
    /**
     * Frequency of rule execution, using a date math range.
     */
    declare public readonly interval: pulumi.Output<string>;
    /**
     * Array of field names to include in alert investigation. Available for all rule types.
     */
    declare public readonly investigationFields: pulumi.Output<string[] | undefined>;
    /**
     * Number of items to search for in each concurrent search. Optional for threat_match rules.
     */
    declare public readonly itemsPerSearch: pulumi.Output<number | undefined>;
    /**
     * The query language (KQL or Lucene).
     */
    declare public readonly language: pulumi.Output<string>;
    /**
     * The rule's license.
     */
    declare public readonly license: pulumi.Output<string | undefined>;
    /**
     * Machine learning job ID(s) the rule monitors for anomaly scores. Required for machine_learning rules.
     */
    declare public readonly machineLearningJobIds: pulumi.Output<string[] | undefined>;
    /**
     * Maximum number of alerts the rule can create during a single run.
     */
    declare public readonly maxSignals: pulumi.Output<number>;
    /**
     * A human-readable name for the rule.
     */
    declare public readonly name: pulumi.Output<string>;
    /**
     * Alerts index namespace. Available for all rule types.
     */
    declare public readonly namespace: pulumi.Output<string | undefined>;
    /**
     * Field names containing the new terms. Required for new_terms rules.
     */
    declare public readonly newTermsFields: pulumi.Output<string[] | undefined>;
    /**
     * Notes to help investigate alerts produced by the rule.
     */
    declare public readonly note: pulumi.Output<string | undefined>;
    /**
     * The query language definition.
     */
    declare public readonly query: pulumi.Output<string>;
    /**
     * String array containing references and URLs to sources of additional information.
     */
    declare public readonly references: pulumi.Output<string[]>;
    /**
     * Array of related integrations that provide additional context for the rule.
     */
    declare public readonly relatedIntegrations: pulumi.Output<outputs.KibanaSecurityDetectionRuleRelatedIntegration[] | undefined>;
    /**
     * Array of Elasticsearch fields and types that must be present in source indices for the rule to function properly.
     */
    declare public readonly requiredFields: pulumi.Output<outputs.KibanaSecurityDetectionRuleRequiredField[] | undefined>;
    /**
     * Array of response actions to take when alerts are generated by the rule.
     */
    declare public readonly responseActions: pulumi.Output<outputs.KibanaSecurityDetectionRuleResponseAction[] | undefined>;
    /**
     * The rule's revision number.
     */
    declare public /*out*/ readonly revision: pulumi.Output<number>;
    /**
     * A numerical representation of the alert's severity from 0 to 100.
     */
    declare public readonly riskScore: pulumi.Output<number>;
    /**
     * Array of risk score mappings to override the default risk score based on source event field values.
     */
    declare public readonly riskScoreMappings: pulumi.Output<outputs.KibanaSecurityDetectionRuleRiskScoreMapping[] | undefined>;
    /**
     * A stable unique identifier for the rule object. If omitted, a UUID is generated.
     */
    declare public readonly ruleId: pulumi.Output<string>;
    /**
     * Override the rule name in Kibana. Available for all rule types.
     */
    declare public readonly ruleNameOverride: pulumi.Output<string | undefined>;
    /**
     * Identifier of the saved query used for the rule. Required for saved_query rules.
     */
    declare public readonly savedId: pulumi.Output<string | undefined>;
    /**
     * Setup guide with instructions on rule prerequisites.
     */
    declare public readonly setup: pulumi.Output<string | undefined>;
    /**
     * Severity level of alerts produced by the rule.
     */
    declare public readonly severity: pulumi.Output<string>;
    /**
     * Array of severity mappings to override the default severity based on source event field values.
     */
    declare public readonly severityMappings: pulumi.Output<outputs.KibanaSecurityDetectionRuleSeverityMapping[] | undefined>;
    /**
     * An identifier for the space. If space_id is not provided, the default space is used.
     */
    declare public readonly spaceId: pulumi.Output<string>;
    /**
     * String array containing words and phrases to help categorize, filter, and search rules.
     */
    declare public readonly tags: pulumi.Output<string[]>;
    /**
     * Additional filters for threat intelligence data. Optional for threat_match rules.
     */
    declare public readonly threatFilters: pulumi.Output<string[] | undefined>;
    /**
     * Path to the threat indicator in the indicator documents. Optional for threat_match rules.
     */
    declare public readonly threatIndicatorPath: pulumi.Output<string>;
    /**
     * Array of index patterns for the threat intelligence indices. Required for threat_match rules.
     */
    declare public readonly threatIndices: pulumi.Output<string[] | undefined>;
    /**
     * Array of threat mappings that specify how to match events with threat intelligence. Required for threat_match rules.
     */
    declare public readonly threatMappings: pulumi.Output<outputs.KibanaSecurityDetectionRuleThreatMapping[] | undefined>;
    /**
     * Query used to filter threat intelligence data. Optional for threat_match rules.
     */
    declare public readonly threatQuery: pulumi.Output<string>;
    /**
     * MITRE ATT&CK framework threat information.
     */
    declare public readonly threats: pulumi.Output<outputs.KibanaSecurityDetectionRuleThreat[] | undefined>;
    /**
     * Threshold settings for the rule. Required for threshold rules.
     */
    declare public readonly threshold: pulumi.Output<outputs.KibanaSecurityDetectionRuleThreshold | undefined>;
    /**
     * Sets the tiebreaker field. Required for EQL rules when event.dataset is not provided.
     */
    declare public readonly tiebreakerField: pulumi.Output<string | undefined>;
    /**
     * Timeline template ID for the rule.
     */
    declare public readonly timelineId: pulumi.Output<string | undefined>;
    /**
     * Timeline template title for the rule.
     */
    declare public readonly timelineTitle: pulumi.Output<string | undefined>;
    /**
     * Field name to use for timestamp override. Available for all rule types.
     */
    declare public readonly timestampOverride: pulumi.Output<string | undefined>;
    /**
     * Disables timestamp override fallback. Available for all rule types.
     */
    declare public readonly timestampOverrideFallbackDisabled: pulumi.Output<boolean | undefined>;
    /**
     * Time to which data is analyzed each time the rule runs, using a date math range.
     */
    declare public readonly to: pulumi.Output<string>;
    /**
     * Rule type. Supported types: query, eql, esql, machine_learning, new_terms, saved_query, threat_match, threshold.
     */
    declare public readonly type: pulumi.Output<string>;
    /**
     * The time the rule was last updated.
     */
    declare public /*out*/ readonly updatedAt: pulumi.Output<string>;
    /**
     * The user who last updated the rule.
     */
    declare public /*out*/ readonly updatedBy: pulumi.Output<string>;
    /**
     * The rule's version number.
     */
    declare public readonly version: pulumi.Output<number>;

    /**
     * Create a KibanaSecurityDetectionRule resource with the given unique name, arguments, and options.
     *
     * @param name The _unique_ name of the resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param opts A bag of options that control this resource's behavior.
     */
    constructor(name: string, args: KibanaSecurityDetectionRuleArgs, opts?: pulumi.CustomResourceOptions)
    constructor(name: string, argsOrState?: KibanaSecurityDetectionRuleArgs | KibanaSecurityDetectionRuleState, opts?: pulumi.CustomResourceOptions) {
        let resourceInputs: pulumi.Inputs = {};
        opts = opts || {};
        if (opts.id) {
            const state = argsOrState as KibanaSecurityDetectionRuleState | undefined;
            resourceInputs["actions"] = state?.actions;
            resourceInputs["alertSuppression"] = state?.alertSuppression;
            resourceInputs["anomalyThreshold"] = state?.anomalyThreshold;
            resourceInputs["authors"] = state?.authors;
            resourceInputs["buildingBlockType"] = state?.buildingBlockType;
            resourceInputs["concurrentSearches"] = state?.concurrentSearches;
            resourceInputs["createdAt"] = state?.createdAt;
            resourceInputs["createdBy"] = state?.createdBy;
            resourceInputs["dataViewId"] = state?.dataViewId;
            resourceInputs["description"] = state?.description;
            resourceInputs["enabled"] = state?.enabled;
            resourceInputs["exceptionsLists"] = state?.exceptionsLists;
            resourceInputs["falsePositives"] = state?.falsePositives;
            resourceInputs["filters"] = state?.filters;
            resourceInputs["from"] = state?.from;
            resourceInputs["historyWindowStart"] = state?.historyWindowStart;
            resourceInputs["indices"] = state?.indices;
            resourceInputs["interval"] = state?.interval;
            resourceInputs["investigationFields"] = state?.investigationFields;
            resourceInputs["itemsPerSearch"] = state?.itemsPerSearch;
            resourceInputs["language"] = state?.language;
            resourceInputs["license"] = state?.license;
            resourceInputs["machineLearningJobIds"] = state?.machineLearningJobIds;
            resourceInputs["maxSignals"] = state?.maxSignals;
            resourceInputs["name"] = state?.name;
            resourceInputs["namespace"] = state?.namespace;
            resourceInputs["newTermsFields"] = state?.newTermsFields;
            resourceInputs["note"] = state?.note;
            resourceInputs["query"] = state?.query;
            resourceInputs["references"] = state?.references;
            resourceInputs["relatedIntegrations"] = state?.relatedIntegrations;
            resourceInputs["requiredFields"] = state?.requiredFields;
            resourceInputs["responseActions"] = state?.responseActions;
            resourceInputs["revision"] = state?.revision;
            resourceInputs["riskScore"] = state?.riskScore;
            resourceInputs["riskScoreMappings"] = state?.riskScoreMappings;
            resourceInputs["ruleId"] = state?.ruleId;
            resourceInputs["ruleNameOverride"] = state?.ruleNameOverride;
            resourceInputs["savedId"] = state?.savedId;
            resourceInputs["setup"] = state?.setup;
            resourceInputs["severity"] = state?.severity;
            resourceInputs["severityMappings"] = state?.severityMappings;
            resourceInputs["spaceId"] = state?.spaceId;
            resourceInputs["tags"] = state?.tags;
            resourceInputs["threatFilters"] = state?.threatFilters;
            resourceInputs["threatIndicatorPath"] = state?.threatIndicatorPath;
            resourceInputs["threatIndices"] = state?.threatIndices;
            resourceInputs["threatMappings"] = state?.threatMappings;
            resourceInputs["threatQuery"] = state?.threatQuery;
            resourceInputs["threats"] = state?.threats;
            resourceInputs["threshold"] = state?.threshold;
            resourceInputs["tiebreakerField"] = state?.tiebreakerField;
            resourceInputs["timelineId"] = state?.timelineId;
            resourceInputs["timelineTitle"] = state?.timelineTitle;
            resourceInputs["timestampOverride"] = state?.timestampOverride;
            resourceInputs["timestampOverrideFallbackDisabled"] = state?.timestampOverrideFallbackDisabled;
            resourceInputs["to"] = state?.to;
            resourceInputs["type"] = state?.type;
            resourceInputs["updatedAt"] = state?.updatedAt;
            resourceInputs["updatedBy"] = state?.updatedBy;
            resourceInputs["version"] = state?.version;
        } else {
            const args = argsOrState as KibanaSecurityDetectionRuleArgs | undefined;
            if (args?.description === undefined && !opts.urn) {
                throw new Error("Missing required property 'description'");
            }
            if (args?.type === undefined && !opts.urn) {
                throw new Error("Missing required property 'type'");
            }
            resourceInputs["actions"] = args?.actions;
            resourceInputs["alertSuppression"] = args?.alertSuppression;
            resourceInputs["anomalyThreshold"] = args?.anomalyThreshold;
            resourceInputs["authors"] = args?.authors;
            resourceInputs["buildingBlockType"] = args?.buildingBlockType;
            resourceInputs["concurrentSearches"] = args?.concurrentSearches;
            resourceInputs["dataViewId"] = args?.dataViewId;
            resourceInputs["description"] = args?.description;
            resourceInputs["enabled"] = args?.enabled;
            resourceInputs["exceptionsLists"] = args?.exceptionsLists;
            resourceInputs["falsePositives"] = args?.falsePositives;
            resourceInputs["filters"] = args?.filters;
            resourceInputs["from"] = args?.from;
            resourceInputs["historyWindowStart"] = args?.historyWindowStart;
            resourceInputs["indices"] = args?.indices;
            resourceInputs["interval"] = args?.interval;
            resourceInputs["investigationFields"] = args?.investigationFields;
            resourceInputs["itemsPerSearch"] = args?.itemsPerSearch;
            resourceInputs["language"] = args?.language;
            resourceInputs["license"] = args?.license;
            resourceInputs["machineLearningJobIds"] = args?.machineLearningJobIds;
            resourceInputs["maxSignals"] = args?.maxSignals;
            resourceInputs["name"] = args?.name;
            resourceInputs["namespace"] = args?.namespace;
            resourceInputs["newTermsFields"] = args?.newTermsFields;
            resourceInputs["note"] = args?.note;
            resourceInputs["query"] = args?.query;
            resourceInputs["references"] = args?.references;
            resourceInputs["relatedIntegrations"] = args?.relatedIntegrations;
            resourceInputs["requiredFields"] = args?.requiredFields;
            resourceInputs["responseActions"] = args?.responseActions;
            resourceInputs["riskScore"] = args?.riskScore;
            resourceInputs["riskScoreMappings"] = args?.riskScoreMappings;
            resourceInputs["ruleId"] = args?.ruleId;
            resourceInputs["ruleNameOverride"] = args?.ruleNameOverride;
            resourceInputs["savedId"] = args?.savedId;
            resourceInputs["setup"] = args?.setup;
            resourceInputs["severity"] = args?.severity;
            resourceInputs["severityMappings"] = args?.severityMappings;
            resourceInputs["spaceId"] = args?.spaceId;
            resourceInputs["tags"] = args?.tags;
            resourceInputs["threatFilters"] = args?.threatFilters;
            resourceInputs["threatIndicatorPath"] = args?.threatIndicatorPath;
            resourceInputs["threatIndices"] = args?.threatIndices;
            resourceInputs["threatMappings"] = args?.threatMappings;
            resourceInputs["threatQuery"] = args?.threatQuery;
            resourceInputs["threats"] = args?.threats;
            resourceInputs["threshold"] = args?.threshold;
            resourceInputs["tiebreakerField"] = args?.tiebreakerField;
            resourceInputs["timelineId"] = args?.timelineId;
            resourceInputs["timelineTitle"] = args?.timelineTitle;
            resourceInputs["timestampOverride"] = args?.timestampOverride;
            resourceInputs["timestampOverrideFallbackDisabled"] = args?.timestampOverrideFallbackDisabled;
            resourceInputs["to"] = args?.to;
            resourceInputs["type"] = args?.type;
            resourceInputs["version"] = args?.version;
            resourceInputs["createdAt"] = undefined /*out*/;
            resourceInputs["createdBy"] = undefined /*out*/;
            resourceInputs["revision"] = undefined /*out*/;
            resourceInputs["updatedAt"] = undefined /*out*/;
            resourceInputs["updatedBy"] = undefined /*out*/;
        }
        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
        super(KibanaSecurityDetectionRule.__pulumiType, name, resourceInputs, opts, false /*dependency*/, utilities.getPackage());
    }
}

/**
 * Input properties used for looking up and filtering KibanaSecurityDetectionRule resources.
 */
export interface KibanaSecurityDetectionRuleState {
    /**
     * Array of automated actions taken when alerts are generated by the rule.
     */
    actions?: pulumi.Input<pulumi.Input<inputs.KibanaSecurityDetectionRuleAction>[]>;
    /**
     * Defines alert suppression configuration to reduce duplicate alerts.
     */
    alertSuppression?: pulumi.Input<inputs.KibanaSecurityDetectionRuleAlertSuppression>;
    /**
     * Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100. Required for
     * machine_learning rules.
     */
    anomalyThreshold?: pulumi.Input<number>;
    /**
     * The rule's author.
     */
    authors?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Determines if the rule acts as a building block. If set, value must be `default`. Building-block alerts are not
     * displayed in the UI by default and are used as a foundation for other rules.
     */
    buildingBlockType?: pulumi.Input<string>;
    /**
     * Number of concurrent searches for threat intelligence. Optional for threat_match rules.
     */
    concurrentSearches?: pulumi.Input<number>;
    /**
     * The time the rule was created.
     */
    createdAt?: pulumi.Input<string>;
    /**
     * The user who created the rule.
     */
    createdBy?: pulumi.Input<string>;
    /**
     * Data view ID for the rule. Not supported for esql and machine_learning rule types.
     */
    dataViewId?: pulumi.Input<string>;
    /**
     * The rule's description.
     */
    description?: pulumi.Input<string>;
    /**
     * Determines whether the rule is enabled.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Array of exception containers to prevent the rule from generating alerts.
     */
    exceptionsLists?: pulumi.Input<pulumi.Input<inputs.KibanaSecurityDetectionRuleExceptionsList>[]>;
    /**
     * String array used to describe common reasons why the rule may issue false-positive alerts.
     */
    falsePositives?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Query and filter context array to define alert conditions as JSON. Supports complex filter structures including bool
     * queries, term filters, range filters, etc. Available for all rule types.
     */
    filters?: pulumi.Input<string>;
    /**
     * Time from which data is analyzed each time the rule runs, using a date math range.
     */
    from?: pulumi.Input<string>;
    /**
     * Start date to use when checking if a term has been seen before. Supports relative dates like 'now-30d'. Required for
     * new_terms rules.
     */
    historyWindowStart?: pulumi.Input<string>;
    /**
     * Indices on which the rule functions.
     */
    indices?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Frequency of rule execution, using a date math range.
     */
    interval?: pulumi.Input<string>;
    /**
     * Array of field names to include in alert investigation. Available for all rule types.
     */
    investigationFields?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Number of items to search for in each concurrent search. Optional for threat_match rules.
     */
    itemsPerSearch?: pulumi.Input<number>;
    /**
     * The query language (KQL or Lucene).
     */
    language?: pulumi.Input<string>;
    /**
     * The rule's license.
     */
    license?: pulumi.Input<string>;
    /**
     * Machine learning job ID(s) the rule monitors for anomaly scores. Required for machine_learning rules.
     */
    machineLearningJobIds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Maximum number of alerts the rule can create during a single run.
     */
    maxSignals?: pulumi.Input<number>;
    /**
     * A human-readable name for the rule.
     */
    name?: pulumi.Input<string>;
    /**
     * Alerts index namespace. Available for all rule types.
     */
    namespace?: pulumi.Input<string>;
    /**
     * Field names containing the new terms. Required for new_terms rules.
     */
    newTermsFields?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Notes to help investigate alerts produced by the rule.
     */
    note?: pulumi.Input<string>;
    /**
     * The query language definition.
     */
    query?: pulumi.Input<string>;
    /**
     * String array containing references and URLs to sources of additional information.
     */
    references?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Array of related integrations that provide additional context for the rule.
     */
    relatedIntegrations?: pulumi.Input<pulumi.Input<inputs.KibanaSecurityDetectionRuleRelatedIntegration>[]>;
    /**
     * Array of Elasticsearch fields and types that must be present in source indices for the rule to function properly.
     */
    requiredFields?: pulumi.Input<pulumi.Input<inputs.KibanaSecurityDetectionRuleRequiredField>[]>;
    /**
     * Array of response actions to take when alerts are generated by the rule.
     */
    responseActions?: pulumi.Input<pulumi.Input<inputs.KibanaSecurityDetectionRuleResponseAction>[]>;
    /**
     * The rule's revision number.
     */
    revision?: pulumi.Input<number>;
    /**
     * A numerical representation of the alert's severity from 0 to 100.
     */
    riskScore?: pulumi.Input<number>;
    /**
     * Array of risk score mappings to override the default risk score based on source event field values.
     */
    riskScoreMappings?: pulumi.Input<pulumi.Input<inputs.KibanaSecurityDetectionRuleRiskScoreMapping>[]>;
    /**
     * A stable unique identifier for the rule object. If omitted, a UUID is generated.
     */
    ruleId?: pulumi.Input<string>;
    /**
     * Override the rule name in Kibana. Available for all rule types.
     */
    ruleNameOverride?: pulumi.Input<string>;
    /**
     * Identifier of the saved query used for the rule. Required for saved_query rules.
     */
    savedId?: pulumi.Input<string>;
    /**
     * Setup guide with instructions on rule prerequisites.
     */
    setup?: pulumi.Input<string>;
    /**
     * Severity level of alerts produced by the rule.
     */
    severity?: pulumi.Input<string>;
    /**
     * Array of severity mappings to override the default severity based on source event field values.
     */
    severityMappings?: pulumi.Input<pulumi.Input<inputs.KibanaSecurityDetectionRuleSeverityMapping>[]>;
    /**
     * An identifier for the space. If space_id is not provided, the default space is used.
     */
    spaceId?: pulumi.Input<string>;
    /**
     * String array containing words and phrases to help categorize, filter, and search rules.
     */
    tags?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Additional filters for threat intelligence data. Optional for threat_match rules.
     */
    threatFilters?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Path to the threat indicator in the indicator documents. Optional for threat_match rules.
     */
    threatIndicatorPath?: pulumi.Input<string>;
    /**
     * Array of index patterns for the threat intelligence indices. Required for threat_match rules.
     */
    threatIndices?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Array of threat mappings that specify how to match events with threat intelligence. Required for threat_match rules.
     */
    threatMappings?: pulumi.Input<pulumi.Input<inputs.KibanaSecurityDetectionRuleThreatMapping>[]>;
    /**
     * Query used to filter threat intelligence data. Optional for threat_match rules.
     */
    threatQuery?: pulumi.Input<string>;
    /**
     * MITRE ATT&CK framework threat information.
     */
    threats?: pulumi.Input<pulumi.Input<inputs.KibanaSecurityDetectionRuleThreat>[]>;
    /**
     * Threshold settings for the rule. Required for threshold rules.
     */
    threshold?: pulumi.Input<inputs.KibanaSecurityDetectionRuleThreshold>;
    /**
     * Sets the tiebreaker field. Required for EQL rules when event.dataset is not provided.
     */
    tiebreakerField?: pulumi.Input<string>;
    /**
     * Timeline template ID for the rule.
     */
    timelineId?: pulumi.Input<string>;
    /**
     * Timeline template title for the rule.
     */
    timelineTitle?: pulumi.Input<string>;
    /**
     * Field name to use for timestamp override. Available for all rule types.
     */
    timestampOverride?: pulumi.Input<string>;
    /**
     * Disables timestamp override fallback. Available for all rule types.
     */
    timestampOverrideFallbackDisabled?: pulumi.Input<boolean>;
    /**
     * Time to which data is analyzed each time the rule runs, using a date math range.
     */
    to?: pulumi.Input<string>;
    /**
     * Rule type. Supported types: query, eql, esql, machine_learning, new_terms, saved_query, threat_match, threshold.
     */
    type?: pulumi.Input<string>;
    /**
     * The time the rule was last updated.
     */
    updatedAt?: pulumi.Input<string>;
    /**
     * The user who last updated the rule.
     */
    updatedBy?: pulumi.Input<string>;
    /**
     * The rule's version number.
     */
    version?: pulumi.Input<number>;
}

/**
 * The set of arguments for constructing a KibanaSecurityDetectionRule resource.
 */
export interface KibanaSecurityDetectionRuleArgs {
    /**
     * Array of automated actions taken when alerts are generated by the rule.
     */
    actions?: pulumi.Input<pulumi.Input<inputs.KibanaSecurityDetectionRuleAction>[]>;
    /**
     * Defines alert suppression configuration to reduce duplicate alerts.
     */
    alertSuppression?: pulumi.Input<inputs.KibanaSecurityDetectionRuleAlertSuppression>;
    /**
     * Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100. Required for
     * machine_learning rules.
     */
    anomalyThreshold?: pulumi.Input<number>;
    /**
     * The rule's author.
     */
    authors?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Determines if the rule acts as a building block. If set, value must be `default`. Building-block alerts are not
     * displayed in the UI by default and are used as a foundation for other rules.
     */
    buildingBlockType?: pulumi.Input<string>;
    /**
     * Number of concurrent searches for threat intelligence. Optional for threat_match rules.
     */
    concurrentSearches?: pulumi.Input<number>;
    /**
     * Data view ID for the rule. Not supported for esql and machine_learning rule types.
     */
    dataViewId?: pulumi.Input<string>;
    /**
     * The rule's description.
     */
    description: pulumi.Input<string>;
    /**
     * Determines whether the rule is enabled.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Array of exception containers to prevent the rule from generating alerts.
     */
    exceptionsLists?: pulumi.Input<pulumi.Input<inputs.KibanaSecurityDetectionRuleExceptionsList>[]>;
    /**
     * String array used to describe common reasons why the rule may issue false-positive alerts.
     */
    falsePositives?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Query and filter context array to define alert conditions as JSON. Supports complex filter structures including bool
     * queries, term filters, range filters, etc. Available for all rule types.
     */
    filters?: pulumi.Input<string>;
    /**
     * Time from which data is analyzed each time the rule runs, using a date math range.
     */
    from?: pulumi.Input<string>;
    /**
     * Start date to use when checking if a term has been seen before. Supports relative dates like 'now-30d'. Required for
     * new_terms rules.
     */
    historyWindowStart?: pulumi.Input<string>;
    /**
     * Indices on which the rule functions.
     */
    indices?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Frequency of rule execution, using a date math range.
     */
    interval?: pulumi.Input<string>;
    /**
     * Array of field names to include in alert investigation. Available for all rule types.
     */
    investigationFields?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Number of items to search for in each concurrent search. Optional for threat_match rules.
     */
    itemsPerSearch?: pulumi.Input<number>;
    /**
     * The query language (KQL or Lucene).
     */
    language?: pulumi.Input<string>;
    /**
     * The rule's license.
     */
    license?: pulumi.Input<string>;
    /**
     * Machine learning job ID(s) the rule monitors for anomaly scores. Required for machine_learning rules.
     */
    machineLearningJobIds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Maximum number of alerts the rule can create during a single run.
     */
    maxSignals?: pulumi.Input<number>;
    /**
     * A human-readable name for the rule.
     */
    name?: pulumi.Input<string>;
    /**
     * Alerts index namespace. Available for all rule types.
     */
    namespace?: pulumi.Input<string>;
    /**
     * Field names containing the new terms. Required for new_terms rules.
     */
    newTermsFields?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Notes to help investigate alerts produced by the rule.
     */
    note?: pulumi.Input<string>;
    /**
     * The query language definition.
     */
    query?: pulumi.Input<string>;
    /**
     * String array containing references and URLs to sources of additional information.
     */
    references?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Array of related integrations that provide additional context for the rule.
     */
    relatedIntegrations?: pulumi.Input<pulumi.Input<inputs.KibanaSecurityDetectionRuleRelatedIntegration>[]>;
    /**
     * Array of Elasticsearch fields and types that must be present in source indices for the rule to function properly.
     */
    requiredFields?: pulumi.Input<pulumi.Input<inputs.KibanaSecurityDetectionRuleRequiredField>[]>;
    /**
     * Array of response actions to take when alerts are generated by the rule.
     */
    responseActions?: pulumi.Input<pulumi.Input<inputs.KibanaSecurityDetectionRuleResponseAction>[]>;
    /**
     * A numerical representation of the alert's severity from 0 to 100.
     */
    riskScore?: pulumi.Input<number>;
    /**
     * Array of risk score mappings to override the default risk score based on source event field values.
     */
    riskScoreMappings?: pulumi.Input<pulumi.Input<inputs.KibanaSecurityDetectionRuleRiskScoreMapping>[]>;
    /**
     * A stable unique identifier for the rule object. If omitted, a UUID is generated.
     */
    ruleId?: pulumi.Input<string>;
    /**
     * Override the rule name in Kibana. Available for all rule types.
     */
    ruleNameOverride?: pulumi.Input<string>;
    /**
     * Identifier of the saved query used for the rule. Required for saved_query rules.
     */
    savedId?: pulumi.Input<string>;
    /**
     * Setup guide with instructions on rule prerequisites.
     */
    setup?: pulumi.Input<string>;
    /**
     * Severity level of alerts produced by the rule.
     */
    severity?: pulumi.Input<string>;
    /**
     * Array of severity mappings to override the default severity based on source event field values.
     */
    severityMappings?: pulumi.Input<pulumi.Input<inputs.KibanaSecurityDetectionRuleSeverityMapping>[]>;
    /**
     * An identifier for the space. If space_id is not provided, the default space is used.
     */
    spaceId?: pulumi.Input<string>;
    /**
     * String array containing words and phrases to help categorize, filter, and search rules.
     */
    tags?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Additional filters for threat intelligence data. Optional for threat_match rules.
     */
    threatFilters?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Path to the threat indicator in the indicator documents. Optional for threat_match rules.
     */
    threatIndicatorPath?: pulumi.Input<string>;
    /**
     * Array of index patterns for the threat intelligence indices. Required for threat_match rules.
     */
    threatIndices?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Array of threat mappings that specify how to match events with threat intelligence. Required for threat_match rules.
     */
    threatMappings?: pulumi.Input<pulumi.Input<inputs.KibanaSecurityDetectionRuleThreatMapping>[]>;
    /**
     * Query used to filter threat intelligence data. Optional for threat_match rules.
     */
    threatQuery?: pulumi.Input<string>;
    /**
     * MITRE ATT&CK framework threat information.
     */
    threats?: pulumi.Input<pulumi.Input<inputs.KibanaSecurityDetectionRuleThreat>[]>;
    /**
     * Threshold settings for the rule. Required for threshold rules.
     */
    threshold?: pulumi.Input<inputs.KibanaSecurityDetectionRuleThreshold>;
    /**
     * Sets the tiebreaker field. Required for EQL rules when event.dataset is not provided.
     */
    tiebreakerField?: pulumi.Input<string>;
    /**
     * Timeline template ID for the rule.
     */
    timelineId?: pulumi.Input<string>;
    /**
     * Timeline template title for the rule.
     */
    timelineTitle?: pulumi.Input<string>;
    /**
     * Field name to use for timestamp override. Available for all rule types.
     */
    timestampOverride?: pulumi.Input<string>;
    /**
     * Disables timestamp override fallback. Available for all rule types.
     */
    timestampOverrideFallbackDisabled?: pulumi.Input<boolean>;
    /**
     * Time to which data is analyzed each time the rule runs, using a date math range.
     */
    to?: pulumi.Input<string>;
    /**
     * Rule type. Supported types: query, eql, esql, machine_learning, new_terms, saved_query, threat_match, threshold.
     */
    type: pulumi.Input<string>;
    /**
     * The rule's version number.
     */
    version?: pulumi.Input<number>;
}