|
| 1 | +--- |
| 2 | +# generated by https://github.com/hashicorp/terraform-plugin-docs |
| 3 | +page_title: "elasticstack_kibana_security_detection_rule Resource - terraform-provider-elasticstack" |
| 4 | +subcategory: "" |
| 5 | +description: |- |
| 6 | + Creates or updates a Kibana security detection rule. See https://www.elastic.co/guide/en/security/current/rules-api-create.html |
| 7 | +--- |
| 8 | + |
| 9 | +# elasticstack_kibana_security_detection_rule (Resource) |
| 10 | + |
| 11 | +Creates or updates a Kibana security detection rule. See https://www.elastic.co/guide/en/security/current/rules-api-create.html |
| 12 | + |
| 13 | + |
| 14 | + |
| 15 | +<!-- schema generated by tfplugindocs --> |
| 16 | +## Schema |
| 17 | + |
| 18 | +### Required |
| 19 | + |
| 20 | +- `description` (String) The description of the detection rule. |
| 21 | +- `name` (String) The name of the detection rule. |
| 22 | +- `severity` (String) The severity of the rule. Valid values are: low, medium, high, critical. |
| 23 | +- `type` (String) The rule type. Valid values are: eql, query, machine_learning, threshold, threat_match, new_terms. |
| 24 | + |
| 25 | +### Optional |
| 26 | + |
| 27 | +- `author` (List of String) String array containing the rule's author(s). |
| 28 | +- `enabled` (Boolean) Determines whether the rule is enabled. |
| 29 | +- `exceptions_list` (List of String) List of exceptions that prevent alerts from being generated. |
| 30 | +- `false_positives` (List of String) String array describing common reasons why the rule may issue false-positive alerts. |
| 31 | +- `from` (String) Time from which data is analyzed each time the rule executes, using date math syntax. |
| 32 | +- `index` (List of String) A list of index patterns to search. |
| 33 | +- `interval` (String) How often the rule executes. |
| 34 | +- `kibana_connection` (Block List) Kibana connection configuration block. (see [below for nested schema](#nestedblock--kibana_connection)) |
| 35 | +- `language` (String) The query language. Valid values are: kuery, lucene, eql. |
| 36 | +- `license` (String) The rule's license. |
| 37 | +- `max_signals` (Number) Maximum number of alerts the rule can produce during a single execution. |
| 38 | +- `meta` (String) Optional metadata about the rule as a JSON string. |
| 39 | +- `note` (String) Notes to help investigate alerts produced by the rule. |
| 40 | +- `query` (String) The query that the rule will use to generate alerts. |
| 41 | +- `references` (List of String) String array containing notes about or references to relevant information about the rule. |
| 42 | +- `risk` (Number) A numerical representation of the alert's severity from 1-100. |
| 43 | +- `rule_id` (String) The identifier for the rule. If not provided, an ID is randomly generated. |
| 44 | +- `rule_name_override` (String) Sets the source field for the alert's rule name. |
| 45 | +- `space_id` (String) An identifier for the space. If space_id is not provided, the default space is used. |
| 46 | +- `tags` (List of String) String array containing words and phrases to help categorize, filter, and search rules. |
| 47 | +- `timestamp_override` (String) Sets the time field used to query indices. |
| 48 | +- `to` (String) Time to which data is analyzed each time the rule executes, using date math syntax. |
| 49 | +- `version` (Number) The rule's version number. |
| 50 | + |
| 51 | +### Read-Only |
| 52 | + |
| 53 | +- `id` (String) Internal identifier of the resource |
| 54 | + |
| 55 | +<a id="nestedblock--kibana_connection"></a> |
| 56 | +### Nested Schema for `kibana_connection` |
| 57 | + |
| 58 | +Optional: |
| 59 | + |
| 60 | +- `api_key` (String, Sensitive) API Key to use for authentication to Kibana |
| 61 | +- `ca_certs` (List of String) A list of paths to CA certificates to validate the certificate presented by the Kibana server. |
| 62 | +- `endpoints` (List of String, Sensitive) A comma-separated list of endpoints where the terraform provider will point to, this must include the http(s) schema and port number. |
| 63 | +- `insecure` (Boolean) Disable TLS certificate validation |
| 64 | +- `password` (String, Sensitive) Password to use for API authentication to Kibana. |
| 65 | +- `username` (String) Username to use for API authentication to Kibana. |
0 commit comments