Skip to content

Commit 695f452

Browse files
modular-magicianmodular-magician
authored
Add google_chronicle_rule resource to chronicle (#12720) (#20868)
[upstream:b60c43026dc2f875697194bd92c32e742692a88b] Signed-off-by: Modular Magician <magic-modules@google.com>
1 parent 8db8356 commit 695f452

File tree

3 files changed

+314
-0
lines changed

3 files changed

+314
-0
lines changed

‎.changelog/12720.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:new-resource
2+
`google_chronicle_rule`
3+
```

‎google/services/chronicle/resource_chronicle_rule_test.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
// Copyright (c) HashiCorp, Inc.
2+
// SPDX-License-Identifier: MPL-2.0
3+
package chronicle_test

‎website/docs/r/chronicle_rule.html.markdown

Lines changed: 308 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,308 @@
1+
---
2+
# ----------------------------------------------------------------------------
3+
#
4+
# *** AUTO GENERATED CODE *** Type: MMv1 ***
5+
#
6+
# ----------------------------------------------------------------------------
7+
#
8+
# This file is automatically generated by Magic Modules and manual
9+
# changes will be clobbered when the file is regenerated.
10+
#
11+
# Please read more about how to change this file in
12+
# .github/CONTRIBUTING.md.
13+
#
14+
# ----------------------------------------------------------------------------
15+
subcategory: "Chronicle"
16+
description: |-
17+
The Rule resource represents a user-created rule.
18+
---
19+
20+
# google_chronicle_rule
21+
22+
The Rule resource represents a user-created rule.
23+
24+
~> **Warning:** This resource is in beta, and should be used with the terraform-provider-google-beta provider.
25+
See [Provider Versions](https://terraform.io/docs/providers/google/guides/provider_versions.html) for more details on beta resources.
26+
27+
To get more information about Rule, see:
28+
29+
* [API documentation](https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.rules)
30+
* How-to Guides
31+
* [Google SecOps Guides](https://cloud.google.com/chronicle/docs/secops/secops-overview)
32+
33+
## Example Usage - Chronicle Rule Basic
34+
35+
36+
```hcl
37+
resource "google_chronicle_rule" "example" {
38+
provider = "google-beta"
39+
location = "us"
40+
instance = "00000000-0000-0000-0000-000000000000"
41+
deletion_policy = "DEFAULT"
42+
text = <<-EOT
43+
rule test_rule { meta: events: $userid = $e.principal.user.userid match: $userid over 10m condition: $e }
44+
EOT
45+
}
46+
```
47+
## Example Usage - Chronicle Rule With Force Deletion
48+
49+
50+
```hcl
51+
resource "google_chronicle_rule" "example" {
52+
provider = "google-beta"
53+
location = "us"
54+
instance = "00000000-0000-0000-0000-000000000000"
55+
deletion_policy = "FORCE"
56+
text = <<-EOT
57+
rule test_rule { meta: events: $userid = $e.principal.user.userid match: $userid over 10m condition: $e }
58+
EOT
59+
}
60+
```
61+
## Example Usage - Chronicle Rule With Data Access Scope
62+
63+
64+
```hcl
65+
resource "google_chronicle_data_access_scope" "data_access_scope_test" {
66+
provider = "google-beta"
67+
location = "us"
68+
instance = "00000000-0000-0000-0000-000000000000"
69+
data_access_scope_id = "scope-name"
70+
description = "scope-description"
71+
allowed_data_access_labels {
72+
log_type = "GCP_CLOUDAUDIT"
73+
}
74+
}
75+
76+
resource "google_chronicle_rule" "example" {
77+
provider = "google-beta"
78+
location = "us"
79+
instance = "00000000-0000-0000-0000-000000000000"
80+
scope = resource.google_chronicle_data_access_scope.data_access_scope_test.name
81+
text = <<-EOT
82+
rule test_rule { meta: events: $userid = $e.principal.user.userid match: $userid over 10m condition: $e }
83+
EOT
84+
}
85+
```
86+
87+
## Argument Reference
88+
89+
The following arguments are supported:
90+
91+
92+
* `location` -
93+
(Required)
94+
The location of the resource. This is the geographical region where the Chronicle instance resides, such as "us" or "europe-west2".
95+
96+
* `instance` -
97+
(Required)
98+
The unique identifier for the Chronicle instance, which is the same as the customer ID.
99+
100+
101+
- - -
102+
103+
104+
* `text` -
105+
(Optional)
106+
The YARA-L content of the rule.
107+
Populated in FULL view.
108+
109+
* `scope` -
110+
(Optional)
111+
Resource name of the DataAccessScope bound to this rule.
112+
Populated in BASIC view and FULL view.
113+
If reference lists are used in the rule, validations will be performed
114+
against this scope to ensure that the reference lists are compatible with
115+
both the user's and the rule's scopes.
116+
The scope should be in the format:
117+
"projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}".
118+
119+
* `etag` -
120+
(Optional)
121+
The etag for this rule.
122+
If this is provided on update, the request will succeed if and only if it
123+
matches the server-computed value, and will fail with an ABORTED error
124+
otherwise.
125+
Populated in BASIC view and FULL view.
126+
127+
* `project` - (Optional) The ID of the project in which the resource belongs.
128+
If it is not provided, the provider project is used.
129+
130+
* `deletion_policy` - (Optional) Policy to determine if the rule should be deleted forcefully.
131+
If deletion_policy = "FORCE", any retrohunts and any detections associated with the rule
132+
will also be deleted. If deletion_policy = "DEFAULT", the call will only succeed if the
133+
rule has no associated retrohunts, including completed retrohunts, and no
134+
associated detections. Regardless of this field's value, the rule
135+
deployment associated with this rule will also be deleted.
136+
Possible values: DEFAULT, FORCE
137+
138+
139+
## Attributes Reference
140+
141+
In addition to the arguments listed above, the following computed attributes are exported:
142+
143+
* `id` - an identifier for the resource with format `projects/{{project}}/locations/{{location}}/instances/{{instance}}/rules/{{rule_id}}`
144+
145+
* `name` -
146+
Full resource name for the rule. This unique identifier is generated using values provided for the URL parameters.
147+
Format:
148+
projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
149+
150+
* `rule_id` -
151+
Rule Id is the ID of the Rule.
152+
153+
* `metadata` -
154+
Output only. Additional metadata specified in the meta section of text.
155+
Populated in FULL view.
156+
157+
* `near_real_time_live_rule_eligible` -
158+
Output only. Indicate the rule can run in near real time live rule.
159+
If this is true, the rule uses the near real time live rule when the run
160+
frequency is set to LIVE.
161+
162+
* `revision_id` -
163+
Output only. The revision ID of the rule.
164+
A new revision is created whenever the rule text is changed in any way.
165+
Format: v_{10 digits}_{9 digits}
166+
Populated in REVISION_METADATA_ONLY view and FULL view.
167+
168+
* `severity` -
169+
Severity represents the severity level of the rule.
170+
Structure is [documented below](#nested_severity).
171+
172+
* `revision_create_time` -
173+
Output only. The timestamp of when the rule revision was created.
174+
Populated in FULL, REVISION_METADATA_ONLY views.
175+
176+
* `compilation_state` -
177+
Output only. The current compilation state of the rule.
178+
Populated in FULL view.
179+
Possible values:
180+
COMPILATION_STATE_UNSPECIFIED
181+
SUCCEEDED
182+
FAILED
183+
184+
* `type` -
185+
Possible values:
186+
RULE_TYPE_UNSPECIFIED
187+
SINGLE_EVENT
188+
MULTI_EVENT
189+
190+
* `reference_lists` -
191+
Output only. Resource names of the reference lists used in this rule.
192+
Populated in FULL view.
193+
194+
* `display_name` -
195+
Output only. Display name of the rule.
196+
Populated in BASIC view and FULL view.
197+
198+
* `create_time` -
199+
Output only. The timestamp of when the rule was created.
200+
Populated in FULL view.
201+
202+
* `author` -
203+
Output only. The author of the rule. Extracted from the meta section of text.
204+
Populated in BASIC view and FULL view.
205+
206+
* `allowed_run_frequencies` -
207+
Output only. The run frequencies that are allowed for the rule.
208+
Populated in BASIC view and FULL view.
209+
210+
* `compilation_diagnostics` -
211+
Output only. A list of a rule's corresponding compilation diagnostic messages
212+
such as compilation errors and compilation warnings.
213+
Populated in FULL view.
214+
Structure is [documented below](#nested_compilation_diagnostics).
215+
216+
* `data_tables` -
217+
Output only. Resource names of the data tables used in this rule.
218+
219+
220+
<a name="nested_severity"></a>The `severity` block contains:
221+
222+
* `display_name` -
223+
(Optional)
224+
The display name of the severity level. Extracted from the meta section of
225+
the rule text.
226+
227+
<a name="nested_compilation_diagnostics"></a>The `compilation_diagnostics` block contains:
228+
229+
* `message` -
230+
(Output)
231+
Output only. The diagnostic message.
232+
233+
* `position` -
234+
(Optional)
235+
CompilationPosition represents the location of a compilation diagnostic in
236+
rule text.
237+
Structure is [documented below](#nested_compilation_diagnostics_compilation_diagnostics_position).
238+
239+
* `severity` -
240+
(Output)
241+
Output only. The severity of a rule's compilation diagnostic.
242+
Possible values:
243+
SEVERITY_UNSPECIFIED
244+
WARNING
245+
ERROR
246+
247+
* `uri` -
248+
(Output)
249+
Output only. Link to documentation that describes a diagnostic in more detail.
250+
251+
252+
<a name="nested_compilation_diagnostics_compilation_diagnostics_position"></a>The `position` block supports:
253+
254+
* `start_line` -
255+
(Output)
256+
Output only. Start line number, beginning at 1.
257+
258+
* `start_column` -
259+
(Output)
260+
Output only. Start column number, beginning at 1.
261+
262+
* `end_line` -
263+
(Output)
264+
Output only. End line number, beginning at 1.
265+
266+
* `end_column` -
267+
(Output)
268+
Output only. End column number, beginning at 1.
269+
270+
## Timeouts
271+
272+
This resource provides the following
273+
[Timeouts](https://developer.hashicorp.com/terraform/plugin/sdkv2/resources/retries-and-customizable-timeouts) configuration options:
274+
275+
- `create` - Default is 20 minutes.
276+
- `update` - Default is 20 minutes.
277+
- `delete` - Default is 20 minutes.
278+
279+
## Import
280+
281+
282+
Rule can be imported using any of these accepted formats:
283+
284+
* `projects/{{project}}/locations/{{location}}/instances/{{instance}}/rules/{{rule_id}}`
285+
* `{{project}}/{{location}}/{{instance}}/{{rule_id}}`
286+
* `{{location}}/{{instance}}/{{rule_id}}`
287+
288+
289+
In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Rule using one of the formats above. For example:
290+
291+
```tf
292+
import {
293+
id = "projects/{{project}}/locations/{{location}}/instances/{{instance}}/rules/{{rule_id}}"
294+
to = google_chronicle_rule.default
295+
}
296+
```
297+
298+
When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Rule can be imported using one of the formats above. For example:
299+
300+
```
301+
$ terraform import google_chronicle_rule.default projects/{{project}}/locations/{{location}}/instances/{{instance}}/rules/{{rule_id}}
302+
$ terraform import google_chronicle_rule.default {{project}}/{{location}}/{{instance}}/{{rule_id}}
303+
$ terraform import google_chronicle_rule.default {{location}}/{{instance}}/{{rule_id}}
304+
```
305+
306+
## User Project Overrides
307+
308+
This resource supports [User Project Overrides](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference#user_project_override).

0 commit comments

Comments
 (0)