DET-383: Added docs.

Author: pwardecki-sumo

sumologic/resource_sumologic_cse_custom_insight_test.go

@@ -157,11 +157,11 @@ resource "sumologic_cse_custom_insight" "custom_insight2" {
     name = "Dynamic severity insight"
     severity = "LOW"
     dynamic_severity {
-        minimum_signal_severity = "%d"
+        minimum_signal_severity = %d
         insight_severity = "%s"
     }
     dynamic_severity {
-        minimum_signal_severity = "%d"
+        minimum_signal_severity = %d
         insight_severity = "%s"
     }
     tags = ["test tag"]
@@ -203,7 +203,7 @@ func testCheckCustomInsightValues(t *testing.T, CustomInsight *CSECustomInsight,
 		assert.Equal(t, severity, CustomInsight.Severity)
 		assert.Equal(t, signalName1, CustomInsight.SignalNames[0])
 		assert.Equal(t, signalName2, CustomInsight.SignalNames[1])
-		assert.Equal(t, tag, CustomInsight.Tags[0]) 
+		assert.Equal(t, tag, CustomInsight.Tags[0])
 		return nil
 	}
 }

website/docs/r/cse_custom_insight.html.markdown

@@ -17,6 +17,10 @@ resource "sumologic_cse_custom_insight" "custom_insight" {
   name = "Custom Insight Example"
   rule_ids = ["MATCH-S00001", "THRESHOLD-U00005"]
   severity = "HIGH"
+  dynamic_severity {
+    minimum_signal_severity = 8
+    insight_severity = "CRITICAL"
+  }
   signal_names = ["Some Signal Name", "Wildcard Signal Name *"]
   tags = ["_mitreAttackTactic:TA0009"]
 }
@@ -31,7 +35,10 @@ The following arguments are supported:
 - `ordered` - (Required) Whether the signals matching the rule IDs/signal names must be in the same chronological order as they are listed in the Custom Insight
 - `name` - (Required) The name of the Custom Insight and the generated Insights
 - `rule_ids` - (Optional) The Rule IDs to match to generate an Insight (exactly one of rule_ids or signal_names must be specified)
-- `severity` - (Required) The severity of the generated Insights (HIGH, MEDIUM, or LOW)
+- `severity` - (Required) The severity of the generated Insights (CRITICAL, HIGH, MEDIUM, or LOW)
+- `dynamic_severity` - (Optional) The severity of the generated Insight that is based on the severity of the Signals that trigger the Insight.
+  + `minimum_signal_severity` - (Required) minimum Signal severity as the threshold for an Insight severity level
+  + `insight_severity` - (Required) The severity of the generated Insight (CRITICAL, HIGH, MEDIUM, or LOW)
 - `signal_names` - (Optional) The Signal names to match to generate an Insight (exactly one of rule_ids or signal_names must be specified)
 - `tags` - (Required) The tags of the generated Insights