Skip to content

Commit

Permalink
Add google_chronicle_rule_deployment resource to chronicle (#12729) (#…
Browse files Browse the repository at this point in the history
…20888)

[upstream:7d808d92fa8b8aab4dbdf706b1f97caf6edae3c3]

Signed-off-by: Modular Magician <[email protected]>
  • Loading branch information
modular-magician authored Jan 11, 2025
1 parent bcd1b6f commit 2cc9635
Show file tree
Hide file tree
Showing 3 changed files with 192 additions and 0 deletions.
3 changes: 3 additions & 0 deletions .changelog/12729.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:new-resource
`google_chronicle_rule_deployment`
```
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
// Copyright (c) HashiCorp, Inc.
// SPDX-License-Identifier: MPL-2.0
package chronicle_test
186 changes: 186 additions & 0 deletions website/docs/r/chronicle_rule_deployment.html.markdown
Original file line number Diff line number Diff line change
@@ -0,0 +1,186 @@
---
# ----------------------------------------------------------------------------
#
# *** AUTO GENERATED CODE *** Type: MMv1 ***
#
# ----------------------------------------------------------------------------
#
# This file is automatically generated by Magic Modules and manual
# changes will be clobbered when the file is regenerated.
#
# Please read more about how to change this file in
# .github/CONTRIBUTING.md.
#
# ----------------------------------------------------------------------------
subcategory: "Chronicle"
description: |-
The RuleDeployment resource represents the deployment state of a Rule.
---

# google_chronicle_rule_deployment

The RuleDeployment resource represents the deployment state of a Rule.

~> **Warning:** This resource is in beta, and should be used with the terraform-provider-google-beta provider.
See [Provider Versions](https://terraform.io/docs/providers/google/guides/provider_versions.html) for more details on beta resources.

To get more information about RuleDeployment, see:

* [API documentation](https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/RuleDeployment)
* How-to Guides
* [Google SecOps Guides](https://cloud.google.com/chronicle/docs/secops/secops-overview)

## Example Usage - Chronicle Ruledeployment Basic


```hcl
resource "google_chronicle_rule" "my-rule" {
provider = "google-beta"
location = "us"
instance = "00000000-0000-0000-0000-000000000000"
text = <<-EOT
rule test_rule { meta: events: $userid = $e.principal.user.userid match: $userid over 10m condition: $e }
EOT
}
resource "google_chronicle_rule_deployment" "example" {
provider = "google-beta"
location = "us"
instance = "00000000-0000-0000-0000-000000000000"
rule = element(split("/", resource.google_chronicle_rule.my-rule.name), length(split("/", resource.google_chronicle_rule.my-rule.name)) - 1)
enabled = true
alerting = true
archived = false
run_frequency = "DAILY"
}
```

## Argument Reference

The following arguments are supported:


* `location` -
(Required)
The location of the resource. This is the geographical region where the Chronicle instance resides, such as "us" or "europe-west2".

* `instance` -
(Required)
The unique identifier for the Chronicle instance, which is the same as the customer ID.

* `rule` -
(Required)
The Rule ID of the rule.


- - -


* `enabled` -
(Optional)
Whether the rule is currently deployed continuously against incoming data.

* `alerting` -
(Optional)
Whether detections resulting from this deployment should be considered
alerts.

* `archived` -
(Optional)
The archive state of the rule deployment.
Cannot be set to true unless enabled is set to false.
If set to true, alerting will automatically be set to false.
If currently set to true, enabled, alerting, and run_frequency cannot be
updated.

* `run_frequency` -
(Optional)
The run frequency of the rule deployment.
Possible values:
LIVE
HOURLY
DAILY

* `project` - (Optional) The ID of the project in which the resource belongs.
If it is not provided, the provider project is used.


## Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

* `id` - an identifier for the resource with format `projects/{{project}}/locations/{{location}}/instances/{{instance}}/rules/{{rule}}/deployment`

* `name` -
The resource name of the rule deployment.
Note that RuleDeployment is a child of the overall Rule, not any individual
revision, so the resource ID segment for the Rule resource must not
reference a specific revision.
Format:
projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/deployment

* `archive_time` -
Output only. The timestamp when the rule deployment archive state was last set to true. If the rule deployment's current archive state is not set to true, the field will be empty.

* `execution_state` -
The execution state of the rule deployment.
Possible values:
DEFAULT
LIMITED
PAUSED

* `producer_rules` -
Output only. The names of the associated/chained producer rules. Rules are considered
producers for this rule if this rule explicitly filters on their ruleid.
Format:
projects/{project}/locations/{location}/instances/{instance}/rules/{rule}

* `consumer_rules` -
Output only. The names of the associated/chained consumer rules. Rules are considered
consumers of this rule if their rule text explicitly filters on this rule's ruleid.
Format:
projects/{project}/locations/{location}/instances/{instance}/rules/{rule}

* `last_alert_status_change_time` -
Output only. The timestamp when the rule deployment alert state was lastly changed. This is filled regardless of the current alert state.E.g. if the current alert status is false, this timestamp will be the timestamp when the alert status was changed to false.


## Timeouts

This resource provides the following
[Timeouts](https://developer.hashicorp.com/terraform/plugin/sdkv2/resources/retries-and-customizable-timeouts) configuration options:

- `create` - Default is 20 minutes.
- `update` - Default is 20 minutes.
- `delete` - Default is 20 minutes.

## Import


RuleDeployment can be imported using any of these accepted formats:

* `projects/{{project}}/locations/{{location}}/instances/{{instance}}/rules/{{rule}}/deployment`
* `{{project}}/{{location}}/{{instance}}/{{rule}}`
* `{{location}}/{{instance}}/{{rule}}`


In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RuleDeployment using one of the formats above. For example:

```tf
import {
id = "projects/{{project}}/locations/{{location}}/instances/{{instance}}/rules/{{rule}}/deployment"
to = google_chronicle_rule_deployment.default
}
```

When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), RuleDeployment can be imported using one of the formats above. For example:

```
$ terraform import google_chronicle_rule_deployment.default projects/{{project}}/locations/{{location}}/instances/{{instance}}/rules/{{rule}}/deployment
$ terraform import google_chronicle_rule_deployment.default {{project}}/{{location}}/{{instance}}/{{rule}}
$ terraform import google_chronicle_rule_deployment.default {{location}}/{{instance}}/{{rule}}
```

## User Project Overrides

This resource supports [User Project Overrides](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference#user_project_override).

0 comments on commit 2cc9635

Please sign in to comment.