azurerm_sentinel_threat_intelligence_indicator

Manages a Sentinel Threat Intelligence Indicator.

Example Usage

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "example" {
  name     = "example-rg"
  location = "east us"
}

resource "azurerm_log_analytics_workspace" "example" {
  name                = "example-law"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  sku                 = "PerGB2018"
  retention_in_days   = 30
}

resource "azurerm_sentinel_log_analytics_workspace_onboarding" "example" {
  resource_group_name = azurerm_resource_group.example.name
  workspace_name      = azurerm_log_analytics_workspace.example.name
}

resource "azurerm_sentinel_threat_intelligence_indicator" "example" {
  workspace_id      = azurerm_log_analytics_workspace.example.id
  pattern_type      = "domain-name"
  pattern           = "http://example.com"
  source            = "Microsoft Sentinel"
  validate_from_utc = "2022-12-14T16:00:00Z"
  display_name      = "example-indicator"

  depends_on = [azurerm_sentinel_log_analytics_workspace_onboarding.test]
}

Arguments Reference

The following arguments are supported:



A external_reference block supports the following:


A granular_marking block supports the following:


A kill_chain_phase block supports the following:

Attributes Reference

In addition to the Arguments listed above - the following Attributes are exported:


A parsed_pattern block exports the following:


A pattern_type_values block exports the following:

Timeouts

The timeouts block allows you to specify timeouts for certain actions:

Import

Sentinel Threat Intelligence Indicators can be imported using the resource id, e.g.

terraform import azurerm_sentinel_threat_intelligence_indicator.example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/resourcegroup1/providers/Microsoft.OperationalInsights/workspaces/workspace1/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators/indicator1