DET-841: add support for strict custom insights

Author: m25n

CHANGELOG.md

@@ -1,6 +1,9 @@
 ## X.Y.Z (Unreleased)
 * Add new change notes here
 
+FEATURES:
+* Add support for CSE strict custom insights
+
 ## 3.0.5 (March 3, 2025)
 
 ENHANCEMENTS:

sumologic/resource_sumologic_cse_custom_insight.go

@@ -45,6 +45,12 @@ func resourceSumologicCSECustomInsight() *schema.Resource {
 				Required:     true,
 				ValidateFunc: validation.StringInSlice([]string{"HIGH", "MEDIUM", "LOW", "CRITICAL"}, false),
 			},
+			"signal_match_strategy": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Default:      "ENTITY",
+				ValidateFunc: validation.StringInSlice([]string{"ENTITY", "STRICT"}, false),
+			},
 			"dynamic_severity": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -103,6 +109,7 @@ func resourceSumologicCSECustomInsightRead(d *schema.ResourceData, meta interfac
 	d.Set("ordered", CSECustomInsightGet.Ordered)
 	d.Set("rule_ids", CSECustomInsightGet.RuleIds)
 	d.Set("severity", CSECustomInsightGet.Severity)
+	d.Set("signal_match_strategy", CSECustomInsightGet.SignalMatchStrategy)
 	d.Set("dynamic_severity", dynamicSeverityArrayToResource(CSECustomInsightGet.DynamicSeverity))
 	d.Set("signal_names", CSECustomInsightGet.SignalNames)
 	d.Set("tags", CSECustomInsightGet.Tags)
@@ -121,15 +128,16 @@ func resourceSumologicCSECustomInsightCreate(d *schema.ResourceData, meta interf
 
 	if d.Id() == "" {
 		id, err := c.CreateCSECustomInsight(CSECustomInsight{
-			Description:     d.Get("description").(string),
-			Enabled:         d.Get("enabled").(bool),
-			RuleIds:         resourceToStringArray(d.Get("rule_ids").([]interface{})),
-			Name:            d.Get("name").(string),
-			Ordered:         d.Get("ordered").(bool),
-			Severity:        d.Get("severity").(string),
-			DynamicSeverity: resourceToDynamicSeverityArray(d.Get("dynamic_severity").([]interface{})),
-			SignalNames:     resourceToStringArray(d.Get("signal_names").([]interface{})),
-			Tags:            resourceToStringArray(d.Get("tags").([]interface{})),
+			Description:         d.Get("description").(string),
+			Enabled:             d.Get("enabled").(bool),
+			RuleIds:             resourceToStringArray(d.Get("rule_ids").([]interface{})),
+			Name:                d.Get("name").(string),
+			Ordered:             d.Get("ordered").(bool),
+			Severity:            d.Get("severity").(string),
+			SignalMatchStrategy: resourceToSignalMatchStrategy(d.Get("signal_match_strategy")),
+			DynamicSeverity:     resourceToDynamicSeverityArray(d.Get("dynamic_severity").([]interface{})),
+			SignalNames:         resourceToStringArray(d.Get("signal_names").([]interface{})),
+			Tags:                resourceToStringArray(d.Get("tags").([]interface{})),
 		})
 
 		if err != nil {
@@ -162,16 +170,17 @@ func resourceToCSECustomInsight(d *schema.ResourceData) (CSECustomInsight, error
 	}
 
 	return CSECustomInsight{
-		ID:              id,
-		Description:     d.Get("description").(string),
-		Enabled:         d.Get("enabled").(bool),
-		RuleIds:         resourceToStringArray(d.Get("rule_ids").([]interface{})),
-		Name:            d.Get("name").(string),
-		Ordered:         d.Get("ordered").(bool),
-		Severity:        d.Get("severity").(string),
-		DynamicSeverity: resourceToDynamicSeverityArray(d.Get("dynamic_severity").([]interface{})),
-		SignalNames:     resourceToStringArray(d.Get("signal_names").([]interface{})),
-		Tags:            resourceToStringArray(d.Get("tags").([]interface{})),
+		ID:                  id,
+		Description:         d.Get("description").(string),
+		Enabled:             d.Get("enabled").(bool),
+		RuleIds:             resourceToStringArray(d.Get("rule_ids").([]interface{})),
+		Name:                d.Get("name").(string),
+		Ordered:             d.Get("ordered").(bool),
+		Severity:            d.Get("severity").(string),
+		SignalMatchStrategy: resourceToSignalMatchStrategy(d.Get("signal_match_strategy")),
+		DynamicSeverity:     resourceToDynamicSeverityArray(d.Get("dynamic_severity").([]interface{})),
+		SignalNames:         resourceToStringArray(d.Get("signal_names").([]interface{})),
+		Tags:                resourceToStringArray(d.Get("tags").([]interface{})),
 	}, nil
 }
 
@@ -200,3 +209,10 @@ func dynamicSeverityArrayToResource(dynamicSeverities []DynamicSeverity) []map[s
 
 	return result
 }
+
+func resourceToSignalMatchStrategy(value any) string {
+	if v, ok := value.(string); ok {
+		return v
+	}
+	return ""
+}

sumologic/resource_sumologic_cse_custom_insight_test.go

@@ -107,6 +107,39 @@ func TestAccSumologicCSECustomInsight_createAndUpdateWithDynamicSeverity(t *test
 	})
 }
 
+func TestAccSumologicCSECustomInsight_createAndUpdateWithSignalMatchStrategy(t *testing.T) {
+	SkipCseTest(t)
+
+	var CustomInsight CSECustomInsight
+	resourceName := "sumologic_cse_custom_insight.custom_insight_signal_match_strategy"
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCSECustomInsightDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testCreateCSECustomInsightConfigWithSignalMatchStrategy("STRICT"),
+				Check: resource.ComposeTestCheckFunc(
+					testCheckCSECustomInsightExists(resourceName, &CustomInsight),
+					testCheckCustomInsightSignalMatchStrategy(t, &CustomInsight, "STRICT"),
+				),
+			},
+			{
+				Config: testCreateCSECustomInsightConfigWithSignalMatchStrategy("ENTITY"),
+				Check: resource.ComposeTestCheckFunc(
+					testCheckCSECustomInsightExists(resourceName, &CustomInsight),
+					testCheckCustomInsightSignalMatchStrategy(t, &CustomInsight, "ENTITY"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func testAccCSECustomInsightDestroy(s *terraform.State) error {
 	client := testAccProvider.Meta().(*Client)
 
@@ -219,3 +252,25 @@ func testCheckCustomInsightDynamicSeverity(t *testing.T, CustomInsight *CSECusto
 		return nil
 	}
 }
+
+func testCreateCSECustomInsightConfigWithSignalMatchStrategy(signalMatchStrategy string) string {
+	const config = `
+resource "sumologic_cse_custom_insight" "custom_insight_signal_match_strategy" {
+	description = "Signal match strategy insight"
+    enabled = true
+    ordered = true
+    name = "Signal match strategy insight"
+    severity = "LOW"
+	signal_match_strategy = "%s"
+	tags = ["test tag"]
+}
+`
+	return fmt.Sprintf(config, signalMatchStrategy)
+}
+
+func testCheckCustomInsightSignalMatchStrategy(t *testing.T, customInsight *CSECustomInsight, expectedSignalMatchStrategy string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		assert.Equal(t, expectedSignalMatchStrategy, customInsight.SignalMatchStrategy)
+		return nil
+	}
+}

sumologic/sumologic_cse_custom_insight.go

@@ -78,14 +78,15 @@ type DynamicSeverity struct {
 }
 
 type CSECustomInsight struct {
-	ID              string            `json:"id,omitempty"`
-	Description     string            `json:"description"`
-	Enabled         bool              `json:"enabled"`
-	Name            string            `json:"name"`
-	Ordered         bool              `json:"ordered"`
-	RuleIds         []string          `json:"ruleIds"`
-	Severity        string            `json:"severity"`
-	DynamicSeverity []DynamicSeverity `json:"dynamicSeverity"`
-	SignalNames     []string          `json:"signalNames"`
-	Tags            []string          `json:"tags"`
+	ID                  string            `json:"id,omitempty"`
+	Description         string            `json:"description"`
+	Enabled             bool              `json:"enabled"`
+	Name                string            `json:"name"`
+	Ordered             bool              `json:"ordered"`
+	RuleIds             []string          `json:"ruleIds"`
+	Severity            string            `json:"severity"`
+	DynamicSeverity     []DynamicSeverity `json:"dynamicSeverity"`
+	SignalNames         []string          `json:"signalNames"`
+	Tags                []string          `json:"tags"`
+	SignalMatchStrategy string            `json:"signalMatchStrategy,omitempty"`
 }

website/docs/r/cse_custom_insight.html.markdown

@@ -17,6 +17,7 @@ resource "sumologic_cse_custom_insight" "custom_insight" {
   name = "Custom Insight Example"
   rule_ids = ["MATCH-S00001", "THRESHOLD-U00005"]
   severity = "HIGH"
+  signal_match_strategy = "ENTITY"
   dynamic_severity {
     minimum_signal_severity = 8
     insight_severity = "CRITICAL"
@@ -36,6 +37,7 @@ The following arguments are supported:
 - `name` - (Required) The name of the Custom Insight and the generated Insights
 - `rule_ids` - (Optional) The Rule IDs to match to generate an Insight (exactly one of rule_ids or signal_names must be specified)
 - `severity` - (Required) The severity of the generated Insights (CRITICAL, HIGH, MEDIUM, or LOW)
+- `signal_match_strategy` - (Optional) The signal match strategy to use when generating insights (ENTITY, STRICT)
 - `dynamic_severity` - (Optional) The severity of the generated Insight that is based on the severity of the Signals that trigger the Insight.
   + `minimum_signal_severity` - (Required) minimum Signal severity as the threshold for an Insight severity level
   + `insight_severity` - (Required) The severity of the generated Insight (CRITICAL, HIGH, MEDIUM, or LOW)