Skip to content

Commit 1afb9fc

Browse files
ankitgoyal0301anoopkverma-google
ankitgoyal0301
authored and
anoopkverma-google
committed
Add google_chronicle_rule_deployment resource to chronicle (GoogleCloudPlatform#12729)
1 parent 0a4a5dd commit 1afb9fc

File tree

3 files changed

+249
-0
lines changed

3 files changed

+249
-0
lines changed

‎mmv1/products/chronicle/RuleDeployment.yaml

+135
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
# Copyright 2025 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
---
15+
name: RuleDeployment
16+
description: The RuleDeployment resource represents the deployment state of a Rule.
17+
min_version: 'beta'
18+
references:
19+
guides:
20+
'Google SecOps Guides': 'https://cloud.google.com/chronicle/docs/secops/secops-overview'
21+
api: 'https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/RuleDeployment'
22+
base_url: projects/{{project}}/locations/{{location}}/instances/{{instance}}/rules/{{rules}}/deployments
23+
self_link: projects/{{project}}/locations/{{location}}/instances/{{instance}}/rules/{{rule}}/deployment
24+
create_url: projects/{{project}}/locations/{{location}}/instances/{{instance}}/rules/{{rule}}/deployment?updateMask=enabled,alerting,archived,runFrequency
25+
id_format: projects/{{project}}/locations/{{location}}/instances/{{instance}}/rules/{{rule}}/deployment
26+
import_format:
27+
- projects/{{project}}/locations/{{location}}/instances/{{instance}}/rules/{{rule}}/deployment
28+
create_verb: PATCH
29+
update_verb: PATCH
30+
update_mask: true
31+
exclude_delete: true
32+
33+
examples:
34+
- name: 'chronicle_ruledeployment_basic'
35+
primary_resource_id: 'example'
36+
min_version: 'beta'
37+
test_env_vars:
38+
chronicle_id: 'CHRONICLE_ID'
39+
40+
parameters:
41+
- name: location
42+
type: String
43+
description: The location of the resource. This is the geographical region where the Chronicle instance resides, such as "us" or "europe-west2".
44+
immutable: true
45+
url_param_only: true
46+
required: true
47+
- name: instance
48+
type: String
49+
description: The unique identifier for the Chronicle instance, which is the same as the customer ID.
50+
immutable: true
51+
url_param_only: true
52+
required: true
53+
- name: rule
54+
type: String
55+
description: The Rule ID of the rule.
56+
immutable: true
57+
url_param_only: true
58+
required: true
59+
properties:
60+
- name: name
61+
type: String
62+
description: |-
63+
The resource name of the rule deployment.
64+
Note that RuleDeployment is a child of the overall Rule, not any individual
65+
revision, so the resource ID segment for the Rule resource must not
66+
reference a specific revision.
67+
Format:
68+
projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/deployment
69+
output: true
70+
- name: enabled
71+
type: Boolean
72+
description: Whether the rule is currently deployed continuously against incoming data.
73+
- name: alerting
74+
type: Boolean
75+
description: |-
76+
Whether detections resulting from this deployment should be considered
77+
alerts.
78+
- name: archived
79+
type: Boolean
80+
description: |-
81+
The archive state of the rule deployment.
82+
Cannot be set to true unless enabled is set to false.
83+
If set to true, alerting will automatically be set to false.
84+
If currently set to true, enabled, alerting, and run_frequency cannot be
85+
updated.
86+
- name: archiveTime
87+
type: String
88+
description: Output only. The timestamp when the rule deployment archive state was last set to true.
89+
If the rule deployment's current archive state is not set to true, the field will be empty.
90+
output: true
91+
- name: runFrequency
92+
type: String
93+
description: |2-
94+
95+
The run frequency of the rule deployment.
96+
Possible values:
97+
LIVE
98+
HOURLY
99+
DAILY
100+
- name: executionState
101+
type: String
102+
description: |2-
103+
104+
The execution state of the rule deployment.
105+
Possible values:
106+
DEFAULT
107+
LIMITED
108+
PAUSED
109+
output: true
110+
- name: producerRules
111+
type: Array
112+
description: |2-
113+
Output only. The names of the associated/chained producer rules. Rules are considered
114+
producers for this rule if this rule explicitly filters on their ruleid.
115+
Format:
116+
projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
117+
output: true
118+
item_type:
119+
type: String
120+
- name: consumerRules
121+
type: Array
122+
description: |2-
123+
Output only. The names of the associated/chained consumer rules. Rules are considered
124+
consumers of this rule if their rule text explicitly filters on this rule's ruleid.
125+
Format:
126+
projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
127+
output: true
128+
item_type:
129+
type: String
130+
- name: lastAlertStatusChangeTime
131+
type: String
132+
description: Output only. The timestamp when the rule deployment alert state was lastly changed.
133+
This is filled regardless of the current alert state.E.g. if the current alert status is false,
134+
this timestamp will be the timestamp when the alert status was changed to false.
135+
output: true

‎mmv1/templates/terraform/examples/chronicle_ruledeployment_basic.tf.tmpl

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
resource "google_chronicle_rule" "my-rule" {
2+
provider = "google-beta"
3+
location = "us"
4+
instance = "{{index $.TestEnvVars "chronicle_id"}}"
5+
text = <<-EOT
6+
rule test_rule { meta: events: $userid = $e.principal.user.userid match: $userid over 10m condition: $e }
7+
EOT
8+
}
9+
10+
resource "google_chronicle_rule_deployment" "{{$.PrimaryResourceId}}" {
11+
provider = "google-beta"
12+
location = "us"
13+
instance = "{{index $.TestEnvVars "chronicle_id"}}"
14+
rule = element(split("/", resource.google_chronicle_rule.my-rule.name), length(split("/", resource.google_chronicle_rule.my-rule.name)) - 1)
15+
enabled = true
16+
alerting = true
17+
archived = false
18+
run_frequency = "DAILY"
19+
}

‎mmv1/third_party/terraform/services/chronicle/resource_chronicle_rule_deployment_test.go.tmpl

+95
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
package chronicle_test
2+
3+
{{- if ne $.TargetVersionName "ga" }}
4+
5+
import (
6+
"testing"
7+
8+
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
9+
10+
"github.com/hashicorp/terraform-provider-google/google/acctest"
11+
"github.com/hashicorp/terraform-provider-google/google/envvar"
12+
)
13+
14+
func TestAccChronicleRuleDeployment_chronicleRuledeploymentBasicExample_update(t *testing.T) {
15+
t.Parallel()
16+
17+
context := map[string]interface{}{
18+
"chronicle_id": envvar.GetTestChronicleInstanceIdFromEnv(t),
19+
"random_suffix": acctest.RandString(t, 10),
20+
}
21+
22+
acctest.VcrTest(t, resource.TestCase{
23+
PreCheck: func() { acctest.AccTestPreCheck(t) },
24+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
25+
Steps: []resource.TestStep{
26+
{
27+
Config: testAccChronicleRuleDeployment_chronicleRuledeploymentBasicExample_basic(context),
28+
},
29+
{
30+
ResourceName: "google_chronicle_rule_deployment.example",
31+
ImportState: true,
32+
ImportStateVerify: true,
33+
ImportStateVerifyIgnore: []string{"instance", "location", "rule"},
34+
},
35+
{
36+
Config: testAccChronicleRuleDeployment_chronicleRuledeploymentBasicExample_update(context),
37+
},
38+
{
39+
ResourceName: "google_chronicle_rule_deployment.example",
40+
ImportState: true,
41+
ImportStateVerify: true,
42+
ImportStateVerifyIgnore: []string{"instance", "location", "rule"},
43+
},
44+
},
45+
})
46+
}
47+
48+
func testAccChronicleRuleDeployment_chronicleRuledeploymentBasicExample_basic(context map[string]interface{}) string {
49+
return acctest.Nprintf(`
50+
resource "google_chronicle_rule" "my-rule" {
51+
provider = "google-beta"
52+
location = "us"
53+
instance = "%{chronicle_id}"
54+
text = <<-EOT
55+
rule test_rule { meta: events: $userid = $e.principal.user.userid match: $userid over 10m condition: $e }
56+
EOT
57+
}
58+
59+
resource "google_chronicle_rule_deployment" "example" {
60+
provider = "google-beta"
61+
location = "us"
62+
instance = "%{chronicle_id}"
63+
rule = element(split("/", resource.google_chronicle_rule.my-rule.name), length(split("/", resource.google_chronicle_rule.my-rule.name)) - 1)
64+
enabled = true
65+
alerting = true
66+
archived = false
67+
run_frequency = "DAILY"
68+
}
69+
`, context)
70+
}
71+
72+
func testAccChronicleRuleDeployment_chronicleRuledeploymentBasicExample_update(context map[string]interface{}) string {
73+
return acctest.Nprintf(`
74+
resource "google_chronicle_rule" "my-rule" {
75+
provider = "google-beta"
76+
location = "us"
77+
instance = "%{chronicle_id}"
78+
text = <<-EOT
79+
rule test_rule { meta: events: $userid = $e.principal.user.userid match: $userid over 10m condition: $e }
80+
EOT
81+
}
82+
83+
resource "google_chronicle_rule_deployment" "example" {
84+
provider = "google-beta"
85+
location = "us"
86+
instance = "%{chronicle_id}"
87+
rule = element(split("/", resource.google_chronicle_rule.my-rule.name), length(split("/", resource.google_chronicle_rule.my-rule.name)) - 1)
88+
enabled = false
89+
alerting = false
90+
archived = false
91+
run_frequency = "HOURLY"
92+
}
93+
`, context)
94+
}
95+
{{- end }}

0 commit comments

Comments
 (0)