sumologic.CseOutlierRule
Explore with Pulumi AI
layout: “sumologic”
page_title: “SumoLogic: sumologic.CseOutlierRule” description: |- Provides a CSE Outlier Rule
sumologic.CseOutlierRule
Provides a Sumo Logic CSE Outlier Rule.
Example Usage
Coming soon!
Coming soon!
Coming soon!
Coming soon!
Coming soon!
resources:
  firstSeenRule:
    type: sumologic:CseFirstSeenRule
    name: first_seen_rule
    properties:
      aggregationFunctions:
        - name: total
          function: count
          arguments:
            - 'true'
      baselineWindowSize: '1209600000'
      descriptionExpression: Spike in Login Failures - {{ user_username }}
      enabled: true
      entitySelectors:
        - entityType: _username
          expression: user_username
      floorValue: 0
      deviationThreshold: 3
      groupByFields:
        - user_username
      isPrototype: false
      matchExpression: objectType="Authentication" AND success=false
      name: Spike in Login Failures
      nameExpression: Spike in Login Failures - {{ user_username }}
      retentionWindowSize: '7776000000'
      severity: 1
      summaryExpression: Spike in Login Failures - {{ user_username }}
      windowSize: T24H
      suppressionWindowSize: 9e+07
Create CseOutlierRule Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new CseOutlierRule(name: string, args: CseOutlierRuleArgs, opts?: CustomResourceOptions);@overload
def CseOutlierRule(resource_name: str,
                   args: CseOutlierRuleArgs,
                   opts: Optional[ResourceOptions] = None)
@overload
def CseOutlierRule(resource_name: str,
                   opts: Optional[ResourceOptions] = None,
                   retention_window_size: Optional[str] = None,
                   severity: Optional[int] = None,
                   description_expression: Optional[str] = None,
                   deviation_threshold: Optional[int] = None,
                   enabled: Optional[bool] = None,
                   entity_selectors: Optional[Sequence[CseOutlierRuleEntitySelectorArgs]] = None,
                   floor_value: Optional[int] = None,
                   window_size: Optional[str] = None,
                   baseline_window_size: Optional[str] = None,
                   aggregation_functions: Optional[CseOutlierRuleAggregationFunctionsArgs] = None,
                   match_expression: Optional[str] = None,
                   name_expression: Optional[str] = None,
                   name: Optional[str] = None,
                   is_prototype: Optional[bool] = None,
                   summary_expression: Optional[str] = None,
                   suppression_window_size: Optional[int] = None,
                   tags: Optional[Sequence[str]] = None,
                   group_by_fields: Optional[Sequence[str]] = None)func NewCseOutlierRule(ctx *Context, name string, args CseOutlierRuleArgs, opts ...ResourceOption) (*CseOutlierRule, error)public CseOutlierRule(string name, CseOutlierRuleArgs args, CustomResourceOptions? opts = null)
public CseOutlierRule(String name, CseOutlierRuleArgs args)
public CseOutlierRule(String name, CseOutlierRuleArgs args, CustomResourceOptions options)
type: sumologic:CseOutlierRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args CseOutlierRuleArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args CseOutlierRuleArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args CseOutlierRuleArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args CseOutlierRuleArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args CseOutlierRuleArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var cseOutlierRuleResource = new SumoLogic.CseOutlierRule("cseOutlierRuleResource", new()
{
    RetentionWindowSize = "string",
    Severity = 0,
    DescriptionExpression = "string",
    DeviationThreshold = 0,
    Enabled = false,
    EntitySelectors = new[]
    {
        new SumoLogic.Inputs.CseOutlierRuleEntitySelectorArgs
        {
            EntityType = "string",
            Expression = "string",
        },
    },
    FloorValue = 0,
    WindowSize = "string",
    BaselineWindowSize = "string",
    AggregationFunctions = new SumoLogic.Inputs.CseOutlierRuleAggregationFunctionsArgs
    {
        Arguments = new[]
        {
            "string",
        },
        Function = "string",
        Name = "string",
    },
    MatchExpression = "string",
    NameExpression = "string",
    Name = "string",
    IsPrototype = false,
    SummaryExpression = "string",
    SuppressionWindowSize = 0,
    Tags = new[]
    {
        "string",
    },
    GroupByFields = new[]
    {
        "string",
    },
});
example, err := sumologic.NewCseOutlierRule(ctx, "cseOutlierRuleResource", &sumologic.CseOutlierRuleArgs{
	RetentionWindowSize:   pulumi.String("string"),
	Severity:              pulumi.Int(0),
	DescriptionExpression: pulumi.String("string"),
	DeviationThreshold:    pulumi.Int(0),
	Enabled:               pulumi.Bool(false),
	EntitySelectors: sumologic.CseOutlierRuleEntitySelectorArray{
		&sumologic.CseOutlierRuleEntitySelectorArgs{
			EntityType: pulumi.String("string"),
			Expression: pulumi.String("string"),
		},
	},
	FloorValue:         pulumi.Int(0),
	WindowSize:         pulumi.String("string"),
	BaselineWindowSize: pulumi.String("string"),
	AggregationFunctions: &sumologic.CseOutlierRuleAggregationFunctionsArgs{
		Arguments: pulumi.StringArray{
			pulumi.String("string"),
		},
		Function: pulumi.String("string"),
		Name:     pulumi.String("string"),
	},
	MatchExpression:       pulumi.String("string"),
	NameExpression:        pulumi.String("string"),
	Name:                  pulumi.String("string"),
	IsPrototype:           pulumi.Bool(false),
	SummaryExpression:     pulumi.String("string"),
	SuppressionWindowSize: pulumi.Int(0),
	Tags: pulumi.StringArray{
		pulumi.String("string"),
	},
	GroupByFields: pulumi.StringArray{
		pulumi.String("string"),
	},
})
var cseOutlierRuleResource = new CseOutlierRule("cseOutlierRuleResource", CseOutlierRuleArgs.builder()
    .retentionWindowSize("string")
    .severity(0)
    .descriptionExpression("string")
    .deviationThreshold(0)
    .enabled(false)
    .entitySelectors(CseOutlierRuleEntitySelectorArgs.builder()
        .entityType("string")
        .expression("string")
        .build())
    .floorValue(0)
    .windowSize("string")
    .baselineWindowSize("string")
    .aggregationFunctions(CseOutlierRuleAggregationFunctionsArgs.builder()
        .arguments("string")
        .function("string")
        .name("string")
        .build())
    .matchExpression("string")
    .nameExpression("string")
    .name("string")
    .isPrototype(false)
    .summaryExpression("string")
    .suppressionWindowSize(0)
    .tags("string")
    .groupByFields("string")
    .build());
cse_outlier_rule_resource = sumologic.CseOutlierRule("cseOutlierRuleResource",
    retention_window_size="string",
    severity=0,
    description_expression="string",
    deviation_threshold=0,
    enabled=False,
    entity_selectors=[{
        "entity_type": "string",
        "expression": "string",
    }],
    floor_value=0,
    window_size="string",
    baseline_window_size="string",
    aggregation_functions={
        "arguments": ["string"],
        "function": "string",
        "name": "string",
    },
    match_expression="string",
    name_expression="string",
    name="string",
    is_prototype=False,
    summary_expression="string",
    suppression_window_size=0,
    tags=["string"],
    group_by_fields=["string"])
const cseOutlierRuleResource = new sumologic.CseOutlierRule("cseOutlierRuleResource", {
    retentionWindowSize: "string",
    severity: 0,
    descriptionExpression: "string",
    deviationThreshold: 0,
    enabled: false,
    entitySelectors: [{
        entityType: "string",
        expression: "string",
    }],
    floorValue: 0,
    windowSize: "string",
    baselineWindowSize: "string",
    aggregationFunctions: {
        arguments: ["string"],
        "function": "string",
        name: "string",
    },
    matchExpression: "string",
    nameExpression: "string",
    name: "string",
    isPrototype: false,
    summaryExpression: "string",
    suppressionWindowSize: 0,
    tags: ["string"],
    groupByFields: ["string"],
});
type: sumologic:CseOutlierRule
properties:
    aggregationFunctions:
        arguments:
            - string
        function: string
        name: string
    baselineWindowSize: string
    descriptionExpression: string
    deviationThreshold: 0
    enabled: false
    entitySelectors:
        - entityType: string
          expression: string
    floorValue: 0
    groupByFields:
        - string
    isPrototype: false
    matchExpression: string
    name: string
    nameExpression: string
    retentionWindowSize: string
    severity: 0
    summaryExpression: string
    suppressionWindowSize: 0
    tags:
        - string
    windowSize: string
CseOutlierRule Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The CseOutlierRule resource accepts the following input properties:
- AggregationFunctions Pulumi.Sumo Logic. Inputs. Cse Outlier Rule Aggregation Functions 
- BaselineWindow stringSize 
- The baseline window size in milliseconds
- DescriptionExpression string
- The description of the generated Signals
- DeviationThreshold int
- The deviation threshold used to calculate the threshold to trigger signals
- Enabled bool
- Whether the rule should generate Signals
- EntitySelectors List<Pulumi.Sumo Logic. Inputs. Cse Outlier Rule Entity Selector> 
- The entities to generate Signals on- entityType- (Required) The type of the entity to generate the Signal on
 
- FloorValue int
- The minimum threshold to trigger signals
- MatchExpression string
- The expression for which records to match on
- NameExpression string
- The name of the generated Signals
- RetentionWindow stringSize 
- The retention window size in milliseconds
- Severity int
- The severity of the generated Signals
- WindowSize string
- The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
- GroupBy List<string>Fields 
- A list of fields to group records by
- IsPrototype bool
- Whether the generated Signals should be prototype Signals
- Name string
- The name of the Rule
- SummaryExpression string
- The summary of the generated Signals
- SuppressionWindow intSize 
- For how long to suppress Signal generation, in milliseconds. Must be greater than - window_sizeand less than the global limit of 7 days.- The following attributes are exported: 
- List<string>
- The tags of the generated Signals
- AggregationFunctions CseOutlier Rule Aggregation Functions Args 
- BaselineWindow stringSize 
- The baseline window size in milliseconds
- DescriptionExpression string
- The description of the generated Signals
- DeviationThreshold int
- The deviation threshold used to calculate the threshold to trigger signals
- Enabled bool
- Whether the rule should generate Signals
- EntitySelectors []CseOutlier Rule Entity Selector Args 
- The entities to generate Signals on- entityType- (Required) The type of the entity to generate the Signal on
 
- FloorValue int
- The minimum threshold to trigger signals
- MatchExpression string
- The expression for which records to match on
- NameExpression string
- The name of the generated Signals
- RetentionWindow stringSize 
- The retention window size in milliseconds
- Severity int
- The severity of the generated Signals
- WindowSize string
- The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
- GroupBy []stringFields 
- A list of fields to group records by
- IsPrototype bool
- Whether the generated Signals should be prototype Signals
- Name string
- The name of the Rule
- SummaryExpression string
- The summary of the generated Signals
- SuppressionWindow intSize 
- For how long to suppress Signal generation, in milliseconds. Must be greater than - window_sizeand less than the global limit of 7 days.- The following attributes are exported: 
- []string
- The tags of the generated Signals
- aggregationFunctions CseOutlier Rule Aggregation Functions 
- baselineWindow StringSize 
- The baseline window size in milliseconds
- descriptionExpression String
- The description of the generated Signals
- deviationThreshold Integer
- The deviation threshold used to calculate the threshold to trigger signals
- enabled Boolean
- Whether the rule should generate Signals
- entitySelectors List<CseOutlier Rule Entity Selector> 
- The entities to generate Signals on- entityType- (Required) The type of the entity to generate the Signal on
 
- floorValue Integer
- The minimum threshold to trigger signals
- matchExpression String
- The expression for which records to match on
- nameExpression String
- The name of the generated Signals
- retentionWindow StringSize 
- The retention window size in milliseconds
- severity Integer
- The severity of the generated Signals
- windowSize String
- The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
- groupBy List<String>Fields 
- A list of fields to group records by
- isPrototype Boolean
- Whether the generated Signals should be prototype Signals
- name String
- The name of the Rule
- summaryExpression String
- The summary of the generated Signals
- suppressionWindow IntegerSize 
- For how long to suppress Signal generation, in milliseconds. Must be greater than - window_sizeand less than the global limit of 7 days.- The following attributes are exported: 
- List<String>
- The tags of the generated Signals
- aggregationFunctions CseOutlier Rule Aggregation Functions 
- baselineWindow stringSize 
- The baseline window size in milliseconds
- descriptionExpression string
- The description of the generated Signals
- deviationThreshold number
- The deviation threshold used to calculate the threshold to trigger signals
- enabled boolean
- Whether the rule should generate Signals
- entitySelectors CseOutlier Rule Entity Selector[] 
- The entities to generate Signals on- entityType- (Required) The type of the entity to generate the Signal on
 
- floorValue number
- The minimum threshold to trigger signals
- matchExpression string
- The expression for which records to match on
- nameExpression string
- The name of the generated Signals
- retentionWindow stringSize 
- The retention window size in milliseconds
- severity number
- The severity of the generated Signals
- windowSize string
- The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
- groupBy string[]Fields 
- A list of fields to group records by
- isPrototype boolean
- Whether the generated Signals should be prototype Signals
- name string
- The name of the Rule
- summaryExpression string
- The summary of the generated Signals
- suppressionWindow numberSize 
- For how long to suppress Signal generation, in milliseconds. Must be greater than - window_sizeand less than the global limit of 7 days.- The following attributes are exported: 
- string[]
- The tags of the generated Signals
- aggregation_functions CseOutlier Rule Aggregation Functions Args 
- baseline_window_ strsize 
- The baseline window size in milliseconds
- description_expression str
- The description of the generated Signals
- deviation_threshold int
- The deviation threshold used to calculate the threshold to trigger signals
- enabled bool
- Whether the rule should generate Signals
- entity_selectors Sequence[CseOutlier Rule Entity Selector Args] 
- The entities to generate Signals on- entityType- (Required) The type of the entity to generate the Signal on
 
- floor_value int
- The minimum threshold to trigger signals
- match_expression str
- The expression for which records to match on
- name_expression str
- The name of the generated Signals
- retention_window_ strsize 
- The retention window size in milliseconds
- severity int
- The severity of the generated Signals
- window_size str
- The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
- group_by_ Sequence[str]fields 
- A list of fields to group records by
- is_prototype bool
- Whether the generated Signals should be prototype Signals
- name str
- The name of the Rule
- summary_expression str
- The summary of the generated Signals
- suppression_window_ intsize 
- For how long to suppress Signal generation, in milliseconds. Must be greater than - window_sizeand less than the global limit of 7 days.- The following attributes are exported: 
- Sequence[str]
- The tags of the generated Signals
- aggregationFunctions Property Map
- baselineWindow StringSize 
- The baseline window size in milliseconds
- descriptionExpression String
- The description of the generated Signals
- deviationThreshold Number
- The deviation threshold used to calculate the threshold to trigger signals
- enabled Boolean
- Whether the rule should generate Signals
- entitySelectors List<Property Map>
- The entities to generate Signals on- entityType- (Required) The type of the entity to generate the Signal on
 
- floorValue Number
- The minimum threshold to trigger signals
- matchExpression String
- The expression for which records to match on
- nameExpression String
- The name of the generated Signals
- retentionWindow StringSize 
- The retention window size in milliseconds
- severity Number
- The severity of the generated Signals
- windowSize String
- The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
- groupBy List<String>Fields 
- A list of fields to group records by
- isPrototype Boolean
- Whether the generated Signals should be prototype Signals
- name String
- The name of the Rule
- summaryExpression String
- The summary of the generated Signals
- suppressionWindow NumberSize 
- For how long to suppress Signal generation, in milliseconds. Must be greater than - window_sizeand less than the global limit of 7 days.- The following attributes are exported: 
- List<String>
- The tags of the generated Signals
Outputs
All input properties are implicitly available as output properties. Additionally, the CseOutlierRule resource produces the following output properties:
- Id string
- The provider-assigned unique ID for this managed resource.
- Id string
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
- id string
- The provider-assigned unique ID for this managed resource.
- id str
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
Look up Existing CseOutlierRule Resource
Get an existing CseOutlierRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: CseOutlierRuleState, opts?: CustomResourceOptions): CseOutlierRule@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        aggregation_functions: Optional[CseOutlierRuleAggregationFunctionsArgs] = None,
        baseline_window_size: Optional[str] = None,
        description_expression: Optional[str] = None,
        deviation_threshold: Optional[int] = None,
        enabled: Optional[bool] = None,
        entity_selectors: Optional[Sequence[CseOutlierRuleEntitySelectorArgs]] = None,
        floor_value: Optional[int] = None,
        group_by_fields: Optional[Sequence[str]] = None,
        is_prototype: Optional[bool] = None,
        match_expression: Optional[str] = None,
        name: Optional[str] = None,
        name_expression: Optional[str] = None,
        retention_window_size: Optional[str] = None,
        severity: Optional[int] = None,
        summary_expression: Optional[str] = None,
        suppression_window_size: Optional[int] = None,
        tags: Optional[Sequence[str]] = None,
        window_size: Optional[str] = None) -> CseOutlierRulefunc GetCseOutlierRule(ctx *Context, name string, id IDInput, state *CseOutlierRuleState, opts ...ResourceOption) (*CseOutlierRule, error)public static CseOutlierRule Get(string name, Input<string> id, CseOutlierRuleState? state, CustomResourceOptions? opts = null)public static CseOutlierRule get(String name, Output<String> id, CseOutlierRuleState state, CustomResourceOptions options)resources:  _:    type: sumologic:CseOutlierRule    get:      id: ${id}- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- AggregationFunctions Pulumi.Sumo Logic. Inputs. Cse Outlier Rule Aggregation Functions 
- BaselineWindow stringSize 
- The baseline window size in milliseconds
- DescriptionExpression string
- The description of the generated Signals
- DeviationThreshold int
- The deviation threshold used to calculate the threshold to trigger signals
- Enabled bool
- Whether the rule should generate Signals
- EntitySelectors List<Pulumi.Sumo Logic. Inputs. Cse Outlier Rule Entity Selector> 
- The entities to generate Signals on- entityType- (Required) The type of the entity to generate the Signal on
 
- FloorValue int
- The minimum threshold to trigger signals
- GroupBy List<string>Fields 
- A list of fields to group records by
- IsPrototype bool
- Whether the generated Signals should be prototype Signals
- MatchExpression string
- The expression for which records to match on
- Name string
- The name of the Rule
- NameExpression string
- The name of the generated Signals
- RetentionWindow stringSize 
- The retention window size in milliseconds
- Severity int
- The severity of the generated Signals
- SummaryExpression string
- The summary of the generated Signals
- SuppressionWindow intSize 
- For how long to suppress Signal generation, in milliseconds. Must be greater than - window_sizeand less than the global limit of 7 days.- The following attributes are exported: 
- List<string>
- The tags of the generated Signals
- WindowSize string
- The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
- AggregationFunctions CseOutlier Rule Aggregation Functions Args 
- BaselineWindow stringSize 
- The baseline window size in milliseconds
- DescriptionExpression string
- The description of the generated Signals
- DeviationThreshold int
- The deviation threshold used to calculate the threshold to trigger signals
- Enabled bool
- Whether the rule should generate Signals
- EntitySelectors []CseOutlier Rule Entity Selector Args 
- The entities to generate Signals on- entityType- (Required) The type of the entity to generate the Signal on
 
- FloorValue int
- The minimum threshold to trigger signals
- GroupBy []stringFields 
- A list of fields to group records by
- IsPrototype bool
- Whether the generated Signals should be prototype Signals
- MatchExpression string
- The expression for which records to match on
- Name string
- The name of the Rule
- NameExpression string
- The name of the generated Signals
- RetentionWindow stringSize 
- The retention window size in milliseconds
- Severity int
- The severity of the generated Signals
- SummaryExpression string
- The summary of the generated Signals
- SuppressionWindow intSize 
- For how long to suppress Signal generation, in milliseconds. Must be greater than - window_sizeand less than the global limit of 7 days.- The following attributes are exported: 
- []string
- The tags of the generated Signals
- WindowSize string
- The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
- aggregationFunctions CseOutlier Rule Aggregation Functions 
- baselineWindow StringSize 
- The baseline window size in milliseconds
- descriptionExpression String
- The description of the generated Signals
- deviationThreshold Integer
- The deviation threshold used to calculate the threshold to trigger signals
- enabled Boolean
- Whether the rule should generate Signals
- entitySelectors List<CseOutlier Rule Entity Selector> 
- The entities to generate Signals on- entityType- (Required) The type of the entity to generate the Signal on
 
- floorValue Integer
- The minimum threshold to trigger signals
- groupBy List<String>Fields 
- A list of fields to group records by
- isPrototype Boolean
- Whether the generated Signals should be prototype Signals
- matchExpression String
- The expression for which records to match on
- name String
- The name of the Rule
- nameExpression String
- The name of the generated Signals
- retentionWindow StringSize 
- The retention window size in milliseconds
- severity Integer
- The severity of the generated Signals
- summaryExpression String
- The summary of the generated Signals
- suppressionWindow IntegerSize 
- For how long to suppress Signal generation, in milliseconds. Must be greater than - window_sizeand less than the global limit of 7 days.- The following attributes are exported: 
- List<String>
- The tags of the generated Signals
- windowSize String
- The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
- aggregationFunctions CseOutlier Rule Aggregation Functions 
- baselineWindow stringSize 
- The baseline window size in milliseconds
- descriptionExpression string
- The description of the generated Signals
- deviationThreshold number
- The deviation threshold used to calculate the threshold to trigger signals
- enabled boolean
- Whether the rule should generate Signals
- entitySelectors CseOutlier Rule Entity Selector[] 
- The entities to generate Signals on- entityType- (Required) The type of the entity to generate the Signal on
 
- floorValue number
- The minimum threshold to trigger signals
- groupBy string[]Fields 
- A list of fields to group records by
- isPrototype boolean
- Whether the generated Signals should be prototype Signals
- matchExpression string
- The expression for which records to match on
- name string
- The name of the Rule
- nameExpression string
- The name of the generated Signals
- retentionWindow stringSize 
- The retention window size in milliseconds
- severity number
- The severity of the generated Signals
- summaryExpression string
- The summary of the generated Signals
- suppressionWindow numberSize 
- For how long to suppress Signal generation, in milliseconds. Must be greater than - window_sizeand less than the global limit of 7 days.- The following attributes are exported: 
- string[]
- The tags of the generated Signals
- windowSize string
- The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
- aggregation_functions CseOutlier Rule Aggregation Functions Args 
- baseline_window_ strsize 
- The baseline window size in milliseconds
- description_expression str
- The description of the generated Signals
- deviation_threshold int
- The deviation threshold used to calculate the threshold to trigger signals
- enabled bool
- Whether the rule should generate Signals
- entity_selectors Sequence[CseOutlier Rule Entity Selector Args] 
- The entities to generate Signals on- entityType- (Required) The type of the entity to generate the Signal on
 
- floor_value int
- The minimum threshold to trigger signals
- group_by_ Sequence[str]fields 
- A list of fields to group records by
- is_prototype bool
- Whether the generated Signals should be prototype Signals
- match_expression str
- The expression for which records to match on
- name str
- The name of the Rule
- name_expression str
- The name of the generated Signals
- retention_window_ strsize 
- The retention window size in milliseconds
- severity int
- The severity of the generated Signals
- summary_expression str
- The summary of the generated Signals
- suppression_window_ intsize 
- For how long to suppress Signal generation, in milliseconds. Must be greater than - window_sizeand less than the global limit of 7 days.- The following attributes are exported: 
- Sequence[str]
- The tags of the generated Signals
- window_size str
- The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
- aggregationFunctions Property Map
- baselineWindow StringSize 
- The baseline window size in milliseconds
- descriptionExpression String
- The description of the generated Signals
- deviationThreshold Number
- The deviation threshold used to calculate the threshold to trigger signals
- enabled Boolean
- Whether the rule should generate Signals
- entitySelectors List<Property Map>
- The entities to generate Signals on- entityType- (Required) The type of the entity to generate the Signal on
 
- floorValue Number
- The minimum threshold to trigger signals
- groupBy List<String>Fields 
- A list of fields to group records by
- isPrototype Boolean
- Whether the generated Signals should be prototype Signals
- matchExpression String
- The expression for which records to match on
- name String
- The name of the Rule
- nameExpression String
- The name of the generated Signals
- retentionWindow StringSize 
- The retention window size in milliseconds
- severity Number
- The severity of the generated Signals
- summaryExpression String
- The summary of the generated Signals
- suppressionWindow NumberSize 
- For how long to suppress Signal generation, in milliseconds. Must be greater than - window_sizeand less than the global limit of 7 days.- The following attributes are exported: 
- List<String>
- The tags of the generated Signals
- windowSize String
- The window size. Current acceptable values are T60M (1 hr) or T24H (1 day)
Supporting Types
CseOutlierRuleAggregationFunctions, CseOutlierRuleAggregationFunctionsArgs          
CseOutlierRuleEntitySelector, CseOutlierRuleEntitySelectorArgs          
- EntityType string
- Expression string
- The expression or field name to generate the Signal on
- EntityType string
- Expression string
- The expression or field name to generate the Signal on
- entityType String
- expression String
- The expression or field name to generate the Signal on
- entityType string
- expression string
- The expression or field name to generate the Signal on
- entity_type str
- expression str
- The expression or field name to generate the Signal on
- entityType String
- expression String
- The expression or field name to generate the Signal on
Import
Outlier rules can be imported using the field id, e.g.:
hcl
$ pulumi import sumologic:index/cseOutlierRule:CseOutlierRule outlier_rule id
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- Sumo Logic pulumi/pulumi-sumologic
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the sumologicTerraform Provider.