chronicle_rule_deployment.html.markdown

subcategory	description
Chronicle	The RuleDeployment resource represents the deployment state of a Rule.

google_chronicle_rule_deployment

The RuleDeployment resource represents the deployment state of a Rule.

~> Warning: This resource is in beta, and should be used with the terraform-provider-google-beta provider. See Provider Versions for more details on beta resources.

To get more information about RuleDeployment, see:

• API documentation
• How-to Guides
  • Google SecOps Guides

Example Usage - Chronicle Ruledeployment Basic

resource "google_chronicle_rule" "my-rule" {
 provider = "google-beta"
 location = "us"
 instance = "00000000-0000-0000-0000-000000000000"
 text = <<-EOT
             rule test_rule { meta: events:  $userid = $e.principal.user.userid  match: $userid over 10m condition: $e }
         EOT
}

resource "google_chronicle_rule_deployment" "example" {
 provider = "google-beta"
 location = "us"
 instance = "00000000-0000-0000-0000-000000000000"
 rule = element(split("/", resource.google_chronicle_rule.my-rule.name), length(split("/", resource.google_chronicle_rule.my-rule.name)) - 1)
 enabled = true
 alerting = true
 archived = false
 run_frequency = "DAILY"
}

Example Usage - Chronicle Ruledeployment Disabled

resource "google_chronicle_rule" "my-rule" {
 provider = "google-beta"
 location = "us"
 instance = "00000000-0000-0000-0000-000000000000"
 text = <<-EOT
             rule test_rule { meta: events:  $userid = $e.principal.user.userid  match: $userid over 10m condition: $e }
         EOT
}

resource "google_chronicle_rule_deployment" "example" {
 provider = "google-beta"
 location = "us"
 instance = "00000000-0000-0000-0000-000000000000"
 rule = element(split("/", resource.google_chronicle_rule.my-rule.name), length(split("/", resource.google_chronicle_rule.my-rule.name)) - 1)
 enabled = false
 run_frequency = "LIVE"
}

Argument Reference

The following arguments are supported:

• location - (Required) The location of the resource. This is the geographical region where the Chronicle instance resides, such as "us" or "europe-west2".

• instance - (Required) The unique identifier for the Chronicle instance, which is the same as the customer ID.

• rule - (Required) The Rule ID of the rule.

---

• enabled - (Optional) Whether the rule is currently deployed continuously against incoming data.

• alerting - (Optional) Whether detections resulting from this deployment should be considered alerts.

• archived - (Optional) The archive state of the rule deployment. Cannot be set to true unless enabled is set to false i.e. archiving requires a two-step process: first, disable the rule by setting 'enabled' to false, then set 'archive' to true. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and run_frequency cannot be updated.

• run_frequency - (Optional) The run frequency of the rule deployment. Possible values: LIVE HOURLY DAILY

• project - (Optional) The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

• id - an identifier for the resource with format projects/{{project}}/locations/{{location}}/instances/{{instance}}/rules/{{rule}}/deployment

• name - The resource name of the rule deployment. Note that RuleDeployment is a child of the overall Rule, not any individual revision, so the resource ID segment for the Rule resource must not reference a specific revision. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/deployment

• archive_time - Output only. The timestamp when the rule deployment archive state was last set to true. If the rule deployment's current archive state is not set to true, the field will be empty.

• execution_state - The execution state of the rule deployment. Possible values: DEFAULT LIMITED PAUSED

• producer_rules - Output only. The names of the associated/chained producer rules. Rules are considered producers for this rule if this rule explicitly filters on their ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}

• consumer_rules - Output only. The names of the associated/chained consumer rules. Rules are considered consumers of this rule if their rule text explicitly filters on this rule's ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}

• last_alert_status_change_time - Output only. The timestamp when the rule deployment alert state was lastly changed. This is filled regardless of the current alert state.E.g. if the current alert status is false, this timestamp will be the timestamp when the alert status was changed to false.

Timeouts

This resource provides the following Timeouts configuration options:

• create - Default is 20 minutes.
• update - Default is 20 minutes.
• delete - Default is 20 minutes.

Import

RuleDeployment can be imported using any of these accepted formats:

• projects/{{project}}/locations/{{location}}/instances/{{instance}}/rules/{{rule}}/deployment
• {{project}}/{{location}}/{{instance}}/{{rule}}
• {{location}}/{{instance}}/{{rule}}

In Terraform v1.5.0 and later, use an import block to import RuleDeployment using one of the formats above. For example:

import {
  id = "projects/{{project}}/locations/{{location}}/instances/{{instance}}/rules/{{rule}}/deployment"
  to = google_chronicle_rule_deployment.default
}

When using the terraform import command, RuleDeployment can be imported using one of the formats above. For example:

$ terraform import google_chronicle_rule_deployment.default projects/{{project}}/locations/{{location}}/instances/{{instance}}/rules/{{rule}}/deployment
$ terraform import google_chronicle_rule_deployment.default {{project}}/{{location}}/{{instance}}/{{rule}}
$ terraform import google_chronicle_rule_deployment.default {{location}}/{{instance}}/{{rule}}

User Project Overrides

This resource supports User Project Overrides.