Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Azure Native v2
  3. API Docs
  4. securityinsights
  5. ContentTemplate
These are the docs for Azure Native v2. We recommenend using the latest version, Azure Native v3.
Azure Native v2 v2.90.0 published on Thursday, Mar 27, 2025 by Pulumi
pulumi/pulumi-azure-native

azure-native-v2.securityinsights.ContentTemplate

Explore with Pulumi AI

These are the docs for Azure Native v2. We recommenend using the latest version, Azure Native v3.
Azure Native v2 v2.90.0 published on Thursday, Mar 27, 2025 by Pulumi
pulumi/pulumi-azure-native

Template resource definition. Azure REST API version: 2023-06-01-preview.

Other available API versions: 2023-07-01-preview, 2023-08-01-preview, 2023-09-01-preview, 2023-10-01-preview, 2023-11-01, 2023-12-01-preview, 2024-01-01-preview, 2024-03-01, 2024-04-01-preview, 2024-09-01, 2024-10-01-preview.

Example Usage

Get a template.

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var contentTemplate = new AzureNative.SecurityInsights.ContentTemplate("contentTemplate", new()
    {
        Author = new AzureNative.SecurityInsights.Inputs.MetadataAuthorArgs
        {
            Email = "support@microsoft.com",
            Name = "Microsoft",
        },
        ContentId = "8365ebfe-a381-45b7-ad08-7d818070e11f",
        ContentKind = AzureNative.SecurityInsights.Kind.AnalyticsRule,
        DisplayName = "API Protection workbook template",
        MainTemplate = new Dictionary<string, object?>
        {
            ["$schema"] = "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
            ["contentVersion"] = "1.0.1",
            ["resources"] = new[]
            {
                new Dictionary<string, object?>
                {
                    ["apiVersion"] = "2022-04-01-preview",
                    ["kind"] = "Scheduled",
                    ["location"] = "[parameters('workspace-location')]",
                    ["name"] = "8365ebfe-a381-45b7-ad08-7d818070e11f",
                    ["properties"] = new Dictionary<string, object?>
                    {
                        ["description"] = "Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user",
                        ["displayName"] = "Critical or High Severity Detections by User",
                        ["enabled"] = false,
                        ["query"] = "...",
                        ["queryFrequency"] = "PT1H",
                        ["queryPeriod"] = "PT1H",
                        ["severity"] = "High",
                        ["status"] = "Available",
                        ["suppressionDuration"] = "PT1H",
                        ["suppressionEnabled"] = false,
                        ["triggerOperator"] = "GreaterThan",
                        ["triggerThreshold"] = 0,
                    },
                    ["type"] = "Microsoft.SecurityInsights/AlertRuleTemplates",
                },
                new Dictionary<string, object?>
                {
                    ["apiVersion"] = "2022-01-01-preview",
                    ["name"] = "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split([resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)],'/'))))]",
                    ["properties"] = new Dictionary<string, object?>
                    {
                        ["author"] = new Dictionary<string, object?>
                        {
                            ["email"] = "support@microsoft.com",
                            ["name"] = "Microsoft",
                        },
                        ["contentId"] = "4465ebde-b381-45f7-ad08-7d818070a11c",
                        ["description"] = "CrowdStrike Falcon Endpoint Protection Analytics Rule 1",
                        ["kind"] = "AnalyticsRule",
                        ["parentId"] = "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)]",
                        ["source"] = new Dictionary<string, object?>
                        {
                            ["kind"] = "Solution",
                            ["name"] = "str",
                            ["sourceId"] = "str.azure-sentinel-solution-str",
                        },
                        ["support"] = new Dictionary<string, object?>
                        {
                            ["email"] = "support@microsoft.com",
                            ["link"] = "https://support.microsoft.com/",
                            ["name"] = "Microsoft Corporation",
                            ["tier"] = "Microsoft",
                        },
                        ["version"] = "1.0.0",
                    },
                    ["type"] = "Microsoft.OperationalInsights/workspaces/providers/metadata",
                },
            },
        },
        PackageId = "str.azure-sentinel-solution-str",
        PackageKind = AzureNative.SecurityInsights.PackageKind.Solution,
        PackageName = "str",
        ResourceGroupName = "myRg",
        Source = new AzureNative.SecurityInsights.Inputs.MetadataSourceArgs
        {
            Kind = AzureNative.SecurityInsights.SourceKind.Solution,
            Name = "str",
            SourceId = "str.azure-sentinel-solution-str",
        },
        Support = new AzureNative.SecurityInsights.Inputs.MetadataSupportArgs
        {
            Email = "support@microsoft.com",
            Link = "https://support.microsoft.com/",
            Name = "Microsoft Corporation",
            Tier = AzureNative.SecurityInsights.SupportTier.Microsoft,
        },
        TemplateId = "str.azure-sentinel-solution-str",
        Version = "1.0.1",
        WorkspaceName = "myWorkspace",
    });

});
Copy
package main

import (
	securityinsights "github.com/pulumi/pulumi-azure-native-sdk/securityinsights/v2"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := securityinsights.NewContentTemplate(ctx, "contentTemplate", &securityinsights.ContentTemplateArgs{
			Author: &securityinsights.MetadataAuthorArgs{
				Email: pulumi.String("support@microsoft.com"),
				Name:  pulumi.String("Microsoft"),
			},
			ContentId:   pulumi.String("8365ebfe-a381-45b7-ad08-7d818070e11f"),
			ContentKind: pulumi.String(securityinsights.KindAnalyticsRule),
			DisplayName: pulumi.String("API Protection workbook template"),
			MainTemplate: pulumi.Any(map[string]interface{}{
				"$schema":        "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
				"contentVersion": "1.0.1",
				"resources": []interface{}{
					map[string]interface{}{
						"apiVersion": "2022-04-01-preview",
						"kind":       "Scheduled",
						"location":   "[parameters('workspace-location')]",
						"name":       "8365ebfe-a381-45b7-ad08-7d818070e11f",
						"properties": map[string]interface{}{
							"description":         "Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user",
							"displayName":         "Critical or High Severity Detections by User",
							"enabled":             false,
							"query":               "...",
							"queryFrequency":      "PT1H",
							"queryPeriod":         "PT1H",
							"severity":            "High",
							"status":              "Available",
							"suppressionDuration": "PT1H",
							"suppressionEnabled":  false,
							"triggerOperator":     "GreaterThan",
							"triggerThreshold":    0,
						},
						"type": "Microsoft.SecurityInsights/AlertRuleTemplates",
					},
					map[string]interface{}{
						"apiVersion": "2022-01-01-preview",
						"name":       "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split([resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)],'/'))))]",
						"properties": map[string]interface{}{
							"author": map[string]interface{}{
								"email": "support@microsoft.com",
								"name":  "Microsoft",
							},
							"contentId":   "4465ebde-b381-45f7-ad08-7d818070a11c",
							"description": "CrowdStrike Falcon Endpoint Protection Analytics Rule 1",
							"kind":        "AnalyticsRule",
							"parentId":    "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)]",
							"source": map[string]interface{}{
								"kind":     "Solution",
								"name":     "str",
								"sourceId": "str.azure-sentinel-solution-str",
							},
							"support": map[string]interface{}{
								"email": "support@microsoft.com",
								"link":  "https://support.microsoft.com/",
								"name":  "Microsoft Corporation",
								"tier":  "Microsoft",
							},
							"version": "1.0.0",
						},
						"type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
					},
				},
			}),
			PackageId:         pulumi.String("str.azure-sentinel-solution-str"),
			PackageKind:       pulumi.String(securityinsights.PackageKindSolution),
			PackageName:       pulumi.String("str"),
			ResourceGroupName: pulumi.String("myRg"),
			Source: &securityinsights.MetadataSourceArgs{
				Kind:     pulumi.String(securityinsights.SourceKindSolution),
				Name:     pulumi.String("str"),
				SourceId: pulumi.String("str.azure-sentinel-solution-str"),
			},
			Support: &securityinsights.MetadataSupportArgs{
				Email: pulumi.String("support@microsoft.com"),
				Link:  pulumi.String("https://support.microsoft.com/"),
				Name:  pulumi.String("Microsoft Corporation"),
				Tier:  pulumi.String(securityinsights.SupportTierMicrosoft),
			},
			TemplateId:    pulumi.String("str.azure-sentinel-solution-str"),
			Version:       pulumi.String("1.0.1"),
			WorkspaceName: pulumi.String("myWorkspace"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Copy
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.securityinsights.ContentTemplate;
import com.pulumi.azurenative.securityinsights.ContentTemplateArgs;
import com.pulumi.azurenative.securityinsights.inputs.MetadataAuthorArgs;
import com.pulumi.azurenative.securityinsights.inputs.MetadataSourceArgs;
import com.pulumi.azurenative.securityinsights.inputs.MetadataSupportArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var contentTemplate = new ContentTemplate("contentTemplate", ContentTemplateArgs.builder()
            .author(MetadataAuthorArgs.builder()
                .email("support@microsoft.com")
                .name("Microsoft")
                .build())
            .contentId("8365ebfe-a381-45b7-ad08-7d818070e11f")
            .contentKind("AnalyticsRule")
            .displayName("API Protection workbook template")
            .mainTemplate(Map.ofEntries(
                Map.entry("$schema", "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#"),
                Map.entry("contentVersion", "1.0.1"),
                Map.entry("resources",                 
                    Map.ofEntries(
                        Map.entry("apiVersion", "2022-04-01-preview"),
                        Map.entry("kind", "Scheduled"),
                        Map.entry("location", "[parameters('workspace-location')]"),
                        Map.entry("name", "8365ebfe-a381-45b7-ad08-7d818070e11f"),
                        Map.entry("properties", Map.ofEntries(
                            Map.entry("description", "Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user"),
                            Map.entry("displayName", "Critical or High Severity Detections by User"),
                            Map.entry("enabled", false),
                            Map.entry("query", "..."),
                            Map.entry("queryFrequency", "PT1H"),
                            Map.entry("queryPeriod", "PT1H"),
                            Map.entry("severity", "High"),
                            Map.entry("status", "Available"),
                            Map.entry("suppressionDuration", "PT1H"),
                            Map.entry("suppressionEnabled", false),
                            Map.entry("triggerOperator", "GreaterThan"),
                            Map.entry("triggerThreshold", 0)
                        )),
                        Map.entry("type", "Microsoft.SecurityInsights/AlertRuleTemplates")
                    ),
                    Map.ofEntries(
                        Map.entry("apiVersion", "2022-01-01-preview"),
                        Map.entry("name", "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split([resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)],'/'))))]"),
                        Map.entry("properties", Map.ofEntries(
                            Map.entry("author", Map.ofEntries(
                                Map.entry("email", "support@microsoft.com"),
                                Map.entry("name", "Microsoft")
                            )),
                            Map.entry("contentId", "4465ebde-b381-45f7-ad08-7d818070a11c"),
                            Map.entry("description", "CrowdStrike Falcon Endpoint Protection Analytics Rule 1"),
                            Map.entry("kind", "AnalyticsRule"),
                            Map.entry("parentId", "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)]"),
                            Map.entry("source", Map.ofEntries(
                                Map.entry("kind", "Solution"),
                                Map.entry("name", "str"),
                                Map.entry("sourceId", "str.azure-sentinel-solution-str")
                            )),
                            Map.entry("support", Map.ofEntries(
                                Map.entry("email", "support@microsoft.com"),
                                Map.entry("link", "https://support.microsoft.com/"),
                                Map.entry("name", "Microsoft Corporation"),
                                Map.entry("tier", "Microsoft")
                            )),
                            Map.entry("version", "1.0.0")
                        )),
                        Map.entry("type", "Microsoft.OperationalInsights/workspaces/providers/metadata")
                    ))
            ))
            .packageId("str.azure-sentinel-solution-str")
            .packageKind("Solution")
            .packageName("str")
            .resourceGroupName("myRg")
            .source(MetadataSourceArgs.builder()
                .kind("Solution")
                .name("str")
                .sourceId("str.azure-sentinel-solution-str")
                .build())
            .support(MetadataSupportArgs.builder()
                .email("support@microsoft.com")
                .link("https://support.microsoft.com/")
                .name("Microsoft Corporation")
                .tier("Microsoft")
                .build())
            .templateId("str.azure-sentinel-solution-str")
            .version("1.0.1")
            .workspaceName("myWorkspace")
            .build());

    }
}
Copy
import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const contentTemplate = new azure_native.securityinsights.ContentTemplate("contentTemplate", {
    author: {
        email: "support@microsoft.com",
        name: "Microsoft",
    },
    contentId: "8365ebfe-a381-45b7-ad08-7d818070e11f",
    contentKind: azure_native.securityinsights.Kind.AnalyticsRule,
    displayName: "API Protection workbook template",
    mainTemplate: {
        $schema: "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
        contentVersion: "1.0.1",
        resources: [
            {
                apiVersion: "2022-04-01-preview",
                kind: "Scheduled",
                location: "[parameters('workspace-location')]",
                name: "8365ebfe-a381-45b7-ad08-7d818070e11f",
                properties: {
                    description: "Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user",
                    displayName: "Critical or High Severity Detections by User",
                    enabled: false,
                    query: "...",
                    queryFrequency: "PT1H",
                    queryPeriod: "PT1H",
                    severity: "High",
                    status: "Available",
                    suppressionDuration: "PT1H",
                    suppressionEnabled: false,
                    triggerOperator: "GreaterThan",
                    triggerThreshold: 0,
                },
                type: "Microsoft.SecurityInsights/AlertRuleTemplates",
            },
            {
                apiVersion: "2022-01-01-preview",
                name: "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split([resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)],'/'))))]",
                properties: {
                    author: {
                        email: "support@microsoft.com",
                        name: "Microsoft",
                    },
                    contentId: "4465ebde-b381-45f7-ad08-7d818070a11c",
                    description: "CrowdStrike Falcon Endpoint Protection Analytics Rule 1",
                    kind: "AnalyticsRule",
                    parentId: "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)]",
                    source: {
                        kind: "Solution",
                        name: "str",
                        sourceId: "str.azure-sentinel-solution-str",
                    },
                    support: {
                        email: "support@microsoft.com",
                        link: "https://support.microsoft.com/",
                        name: "Microsoft Corporation",
                        tier: "Microsoft",
                    },
                    version: "1.0.0",
                },
                type: "Microsoft.OperationalInsights/workspaces/providers/metadata",
            },
        ],
    },
    packageId: "str.azure-sentinel-solution-str",
    packageKind: azure_native.securityinsights.PackageKind.Solution,
    packageName: "str",
    resourceGroupName: "myRg",
    source: {
        kind: azure_native.securityinsights.SourceKind.Solution,
        name: "str",
        sourceId: "str.azure-sentinel-solution-str",
    },
    support: {
        email: "support@microsoft.com",
        link: "https://support.microsoft.com/",
        name: "Microsoft Corporation",
        tier: azure_native.securityinsights.SupportTier.Microsoft,
    },
    templateId: "str.azure-sentinel-solution-str",
    version: "1.0.1",
    workspaceName: "myWorkspace",
});
Copy
import pulumi
import pulumi_azure_native as azure_native

content_template = azure_native.securityinsights.ContentTemplate("contentTemplate",
    author={
        "email": "support@microsoft.com",
        "name": "Microsoft",
    },
    content_id="8365ebfe-a381-45b7-ad08-7d818070e11f",
    content_kind=azure_native.securityinsights.Kind.ANALYTICS_RULE,
    display_name="API Protection workbook template",
    main_template={
        "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
        "contentVersion": "1.0.1",
        "resources": [
            {
                "apiVersion": "2022-04-01-preview",
                "kind": "Scheduled",
                "location": "[parameters('workspace-location')]",
                "name": "8365ebfe-a381-45b7-ad08-7d818070e11f",
                "properties": {
                    "description": "Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user",
                    "displayName": "Critical or High Severity Detections by User",
                    "enabled": False,
                    "query": "...",
                    "queryFrequency": "PT1H",
                    "queryPeriod": "PT1H",
                    "severity": "High",
                    "status": "Available",
                    "suppressionDuration": "PT1H",
                    "suppressionEnabled": False,
                    "triggerOperator": "GreaterThan",
                    "triggerThreshold": 0,
                },
                "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
            },
            {
                "apiVersion": "2022-01-01-preview",
                "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split([resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)],'/'))))]",
                "properties": {
                    "author": {
                        "email": "support@microsoft.com",
                        "name": "Microsoft",
                    },
                    "contentId": "4465ebde-b381-45f7-ad08-7d818070a11c",
                    "description": "CrowdStrike Falcon Endpoint Protection Analytics Rule 1",
                    "kind": "AnalyticsRule",
                    "parentId": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 8365ebfe-a381-45b7-ad08-7d818070e11f)]",
                    "source": {
                        "kind": "Solution",
                        "name": "str",
                        "sourceId": "str.azure-sentinel-solution-str",
                    },
                    "support": {
                        "email": "support@microsoft.com",
                        "link": "https://support.microsoft.com/",
                        "name": "Microsoft Corporation",
                        "tier": "Microsoft",
                    },
                    "version": "1.0.0",
                },
                "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
            },
        ],
    },
    package_id="str.azure-sentinel-solution-str",
    package_kind=azure_native.securityinsights.PackageKind.SOLUTION,
    package_name="str",
    resource_group_name="myRg",
    source={
        "kind": azure_native.securityinsights.SourceKind.SOLUTION,
        "name": "str",
        "source_id": "str.azure-sentinel-solution-str",
    },
    support={
        "email": "support@microsoft.com",
        "link": "https://support.microsoft.com/",
        "name": "Microsoft Corporation",
        "tier": azure_native.securityinsights.SupportTier.MICROSOFT,
    },
    template_id="str.azure-sentinel-solution-str",
    version="1.0.1",
    workspace_name="myWorkspace")
Copy
resources:
  contentTemplate:
    type: azure-native:securityinsights:ContentTemplate
    properties:
      author:
        email: support@microsoft.com
        name: Microsoft
      contentId: 8365ebfe-a381-45b7-ad08-7d818070e11f
      contentKind: AnalyticsRule
      displayName: API Protection workbook template
      mainTemplate:
        $schema: https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#
        contentVersion: 1.0.1
        resources:
          - apiVersion: 2022-04-01-preview
            kind: Scheduled
            location: '[parameters(''workspace-location'')]'
            name: 8365ebfe-a381-45b7-ad08-7d818070e11f
            properties:
              description: Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user
              displayName: Critical or High Severity Detections by User
              enabled: false
              query: '...'
              queryFrequency: PT1H
              queryPeriod: PT1H
              severity: High
              status: Available
              suppressionDuration: PT1H
              suppressionEnabled: false
              triggerOperator: GreaterThan
              triggerThreshold: 0
            type: Microsoft.SecurityInsights/AlertRuleTemplates
          - apiVersion: 2022-01-01-preview
            name: '[concat(parameters(''workspace''),''/Microsoft.SecurityInsights/'',concat(''AnalyticsRule-'', last(split([resourceId(''Microsoft.SecurityInsights/AlertRuleTemplates'', 8365ebfe-a381-45b7-ad08-7d818070e11f)],''/''))))]'
            properties:
              author:
                email: support@microsoft.com
                name: Microsoft
              contentId: 4465ebde-b381-45f7-ad08-7d818070a11c
              description: CrowdStrike Falcon Endpoint Protection Analytics Rule 1
              kind: AnalyticsRule
              parentId: '[resourceId(''Microsoft.SecurityInsights/AlertRuleTemplates'', 8365ebfe-a381-45b7-ad08-7d818070e11f)]'
              source:
                kind: Solution
                name: str
                sourceId: str.azure-sentinel-solution-str
              support:
                email: support@microsoft.com
                link: https://support.microsoft.com/
                name: Microsoft Corporation
                tier: Microsoft
              version: 1.0.0
            type: Microsoft.OperationalInsights/workspaces/providers/metadata
      packageId: str.azure-sentinel-solution-str
      packageKind: Solution
      packageName: str
      resourceGroupName: myRg
      source:
        kind: Solution
        name: str
        sourceId: str.azure-sentinel-solution-str
      support:
        email: support@microsoft.com
        link: https://support.microsoft.com/
        name: Microsoft Corporation
        tier: Microsoft
      templateId: str.azure-sentinel-solution-str
      version: 1.0.1
      workspaceName: myWorkspace
Copy

Create ContentTemplate Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new ContentTemplate(name: string, args: ContentTemplateArgs, opts?: CustomResourceOptions);
@overload
def ContentTemplate(resource_name: str,
                    args: ContentTemplateArgs,
                    opts: Optional[ResourceOptions] = None)

@overload
def ContentTemplate(resource_name: str,
                    opts: Optional[ResourceOptions] = None,
                    resource_group_name: Optional[str] = None,
                    source: Optional[MetadataSourceArgs] = None,
                    content_id: Optional[str] = None,
                    content_kind: Optional[Union[str, Kind]] = None,
                    workspace_name: Optional[str] = None,
                    version: Optional[str] = None,
                    package_id: Optional[str] = None,
                    display_name: Optional[str] = None,
                    providers: Optional[Sequence[str]] = None,
                    package_name: Optional[str] = None,
                    preview_images_dark: Optional[Sequence[str]] = None,
                    main_template: Optional[Any] = None,
                    categories: Optional[MetadataCategoriesArgs] = None,
                    threat_analysis_tactics: Optional[Sequence[str]] = None,
                    author: Optional[MetadataAuthorArgs] = None,
                    first_publish_date: Optional[str] = None,
                    icon: Optional[str] = None,
                    preview_images: Optional[Sequence[str]] = None,
                    last_publish_date: Optional[str] = None,
                    dependencies: Optional[MetadataDependenciesArgs] = None,
                    support: Optional[MetadataSupportArgs] = None,
                    template_id: Optional[str] = None,
                    package_kind: Optional[Union[str, PackageKind]] = None,
                    threat_analysis_techniques: Optional[Sequence[str]] = None,
                    custom_version: Optional[str] = None,
                    content_schema_version: Optional[str] = None)
func NewContentTemplate(ctx *Context, name string, args ContentTemplateArgs, opts ...ResourceOption) (*ContentTemplate, error)
public ContentTemplate(string name, ContentTemplateArgs args, CustomResourceOptions? opts = null)
public ContentTemplate(String name, ContentTemplateArgs args)
public ContentTemplate(String name, ContentTemplateArgs args, CustomResourceOptions options)

type: azure-native:securityinsights:ContentTemplate
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name This property is required. string
The unique name of the resource.
args This property is required. ContentTemplateArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name This property is required. str
The unique name of the resource.
args This property is required. ContentTemplateArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name This property is required. string
The unique name of the resource.
args This property is required. ContentTemplateArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name This property is required. string
The unique name of the resource.
args This property is required. ContentTemplateArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name This property is required. String
The unique name of the resource.
args This property is required. ContentTemplateArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var contentTemplateResource = new AzureNative.Securityinsights.ContentTemplate("contentTemplateResource", new()
{
    ResourceGroupName = "string",
    Source = 
    {
        { "kind", "string" },
        { "name", "string" },
        { "sourceId", "string" },
    },
    ContentId = "string",
    ContentKind = "string",
    WorkspaceName = "string",
    Version = "string",
    PackageId = "string",
    DisplayName = "string",
    Providers = new[]
    {
        "string",
    },
    PackageName = "string",
    PreviewImagesDark = new[]
    {
        "string",
    },
    MainTemplate = "any",
    Categories = 
    {
        { "domains", new[]
        {
            "string",
        } },
        { "verticals", new[]
        {
            "string",
        } },
    },
    ThreatAnalysisTactics = new[]
    {
        "string",
    },
    Author = 
    {
        { "email", "string" },
        { "link", "string" },
        { "name", "string" },
    },
    FirstPublishDate = "string",
    Icon = "string",
    PreviewImages = new[]
    {
        "string",
    },
    LastPublishDate = "string",
    Dependencies = 
    {
        { "contentId", "string" },
        { "criteria", new[]
        {
            metadataDependencies,
        } },
        { "kind", "string" },
        { "name", "string" },
        { "operator", "string" },
        { "version", "string" },
    },
    Support = 
    {
        { "tier", "string" },
        { "email", "string" },
        { "link", "string" },
        { "name", "string" },
    },
    TemplateId = "string",
    PackageKind = "string",
    ThreatAnalysisTechniques = new[]
    {
        "string",
    },
    CustomVersion = "string",
    ContentSchemaVersion = "string",
});
Copy
example, err := securityinsights.NewContentTemplate(ctx, "contentTemplateResource", &securityinsights.ContentTemplateArgs{
	ResourceGroupName: "string",
	Source: map[string]interface{}{
		"kind":     "string",
		"name":     "string",
		"sourceId": "string",
	},
	ContentId:     "string",
	ContentKind:   "string",
	WorkspaceName: "string",
	Version:       "string",
	PackageId:     "string",
	DisplayName:   "string",
	Providers: []string{
		"string",
	},
	PackageName: "string",
	PreviewImagesDark: []string{
		"string",
	},
	MainTemplate: "any",
	Categories: map[string]interface{}{
		"domains": []string{
			"string",
		},
		"verticals": []string{
			"string",
		},
	},
	ThreatAnalysisTactics: []string{
		"string",
	},
	Author: map[string]interface{}{
		"email": "string",
		"link":  "string",
		"name":  "string",
	},
	FirstPublishDate: "string",
	Icon:             "string",
	PreviewImages: []string{
		"string",
	},
	LastPublishDate: "string",
	Dependencies: map[string]interface{}{
		"contentId": "string",
		"criteria": []interface{}{
			metadataDependencies,
		},
		"kind":     "string",
		"name":     "string",
		"operator": "string",
		"version":  "string",
	},
	Support: map[string]interface{}{
		"tier":  "string",
		"email": "string",
		"link":  "string",
		"name":  "string",
	},
	TemplateId:  "string",
	PackageKind: "string",
	ThreatAnalysisTechniques: []string{
		"string",
	},
	CustomVersion:        "string",
	ContentSchemaVersion: "string",
})
Copy
var contentTemplateResource = new ContentTemplate("contentTemplateResource", ContentTemplateArgs.builder()
    .resourceGroupName("string")
    .source(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
    .contentId("string")
    .contentKind("string")
    .workspaceName("string")
    .version("string")
    .packageId("string")
    .displayName("string")
    .providers("string")
    .packageName("string")
    .previewImagesDark("string")
    .mainTemplate("any")
    .categories(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
    .threatAnalysisTactics("string")
    .author(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
    .firstPublishDate("string")
    .icon("string")
    .previewImages("string")
    .lastPublishDate("string")
    .dependencies(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
    .support(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
    .templateId("string")
    .packageKind("string")
    .threatAnalysisTechniques("string")
    .customVersion("string")
    .contentSchemaVersion("string")
    .build());
Copy
content_template_resource = azure_native.securityinsights.ContentTemplate("contentTemplateResource",
    resource_group_name=string,
    source={
        kind: string,
        name: string,
        sourceId: string,
    },
    content_id=string,
    content_kind=string,
    workspace_name=string,
    version=string,
    package_id=string,
    display_name=string,
    providers=[string],
    package_name=string,
    preview_images_dark=[string],
    main_template=any,
    categories={
        domains: [string],
        verticals: [string],
    },
    threat_analysis_tactics=[string],
    author={
        email: string,
        link: string,
        name: string,
    },
    first_publish_date=string,
    icon=string,
    preview_images=[string],
    last_publish_date=string,
    dependencies={
        contentId: string,
        criteria: [metadata_dependencies],
        kind: string,
        name: string,
        operator: string,
        version: string,
    },
    support={
        tier: string,
        email: string,
        link: string,
        name: string,
    },
    template_id=string,
    package_kind=string,
    threat_analysis_techniques=[string],
    custom_version=string,
    content_schema_version=string)
Copy
const contentTemplateResource = new azure_native.securityinsights.ContentTemplate("contentTemplateResource", {
    resourceGroupName: "string",
    source: {
        kind: "string",
        name: "string",
        sourceId: "string",
    },
    contentId: "string",
    contentKind: "string",
    workspaceName: "string",
    version: "string",
    packageId: "string",
    displayName: "string",
    providers: ["string"],
    packageName: "string",
    previewImagesDark: ["string"],
    mainTemplate: "any",
    categories: {
        domains: ["string"],
        verticals: ["string"],
    },
    threatAnalysisTactics: ["string"],
    author: {
        email: "string",
        link: "string",
        name: "string",
    },
    firstPublishDate: "string",
    icon: "string",
    previewImages: ["string"],
    lastPublishDate: "string",
    dependencies: {
        contentId: "string",
        criteria: [metadataDependencies],
        kind: "string",
        name: "string",
        operator: "string",
        version: "string",
    },
    support: {
        tier: "string",
        email: "string",
        link: "string",
        name: "string",
    },
    templateId: "string",
    packageKind: "string",
    threatAnalysisTechniques: ["string"],
    customVersion: "string",
    contentSchemaVersion: "string",
});
Copy
type: azure-native:securityinsights:ContentTemplate
properties:
    author:
        email: string
        link: string
        name: string
    categories:
        domains:
            - string
        verticals:
            - string
    contentId: string
    contentKind: string
    contentSchemaVersion: string
    customVersion: string
    dependencies:
        contentId: string
        criteria:
            - ${metadataDependencies}
        kind: string
        name: string
        operator: string
        version: string
    displayName: string
    firstPublishDate: string
    icon: string
    lastPublishDate: string
    mainTemplate: any
    packageId: string
    packageKind: string
    packageName: string
    previewImages:
        - string
    previewImagesDark:
        - string
    providers:
        - string
    resourceGroupName: string
    source:
        kind: string
        name: string
        sourceId: string
    support:
        email: string
        link: string
        name: string
        tier: string
    templateId: string
    threatAnalysisTactics:
        - string
    threatAnalysisTechniques:
        - string
    version: string
    workspaceName: string
Copy

ContentTemplate Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The ContentTemplate resource accepts the following input properties:

ContentId This property is required. string
Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
ContentKind This property is required. string | Pulumi.AzureNative.SecurityInsights.Kind
The kind of content the template is for.
DisplayName This property is required. string
The display name of the template
PackageId This property is required. string
the package Id contains this template
ResourceGroupName
This property is required.
Changes to this property will trigger replacement.
string
The name of the resource group. The name is case insensitive.
Source This property is required. Pulumi.AzureNative.SecurityInsights.Inputs.MetadataSource
Source of the content. This is where/how it was created.
Version This property is required. string
Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
WorkspaceName
This property is required.
Changes to this property will trigger replacement.
string
The name of the workspace.
Author Pulumi.AzureNative.SecurityInsights.Inputs.MetadataAuthor
The creator of the content item.
Categories Pulumi.AzureNative.SecurityInsights.Inputs.MetadataCategories
Categories for the item
ContentSchemaVersion string
Schema version of the content. Can be used to distinguish between different flow based on the schema version
CustomVersion string
The custom version of the content. A optional free text
Dependencies Pulumi.AzureNative.SecurityInsights.Inputs.MetadataDependencies
Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
FirstPublishDate string
first publish date content item
Icon string
the icon identifier. this id can later be fetched from the content metadata
LastPublishDate string
last publish date for the content item
MainTemplate object
The JSON of the ARM template to deploy active content
PackageKind string | Pulumi.AzureNative.SecurityInsights.PackageKind
the packageKind of the package contains this template
PackageName string
the name of the package contains this template
PreviewImages List<string>
preview image file names. These will be taken from the solution artifacts
PreviewImagesDark List<string>
preview image file names. These will be taken from the solution artifacts. used for dark theme support
Providers List<string>
Providers for the content item
Support Pulumi.AzureNative.SecurityInsights.Inputs.MetadataSupport
Support information for the template - type, name, contact information
TemplateId Changes to this property will trigger replacement. string
template Id
ThreatAnalysisTactics List<string>
the tactics the resource covers
ThreatAnalysisTechniques List<string>
the techniques the resource covers, these have to be aligned with the tactics being used
ContentId This property is required. string
Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
ContentKind This property is required. string | Kind
The kind of content the template is for.
DisplayName This property is required. string
The display name of the template
PackageId This property is required. string
the package Id contains this template
ResourceGroupName
This property is required.
Changes to this property will trigger replacement.
string
The name of the resource group. The name is case insensitive.
Source This property is required. MetadataSourceArgs
Source of the content. This is where/how it was created.
Version This property is required. string
Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
WorkspaceName
This property is required.
Changes to this property will trigger replacement.
string
The name of the workspace.
Author MetadataAuthorArgs
The creator of the content item.
Categories MetadataCategoriesArgs
Categories for the item
ContentSchemaVersion string
Schema version of the content. Can be used to distinguish between different flow based on the schema version
CustomVersion string
The custom version of the content. A optional free text
Dependencies MetadataDependenciesArgs
Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
FirstPublishDate string
first publish date content item
Icon string
the icon identifier. this id can later be fetched from the content metadata
LastPublishDate string
last publish date for the content item
MainTemplate interface{}
The JSON of the ARM template to deploy active content
PackageKind string | PackageKind
the packageKind of the package contains this template
PackageName string
the name of the package contains this template
PreviewImages []string
preview image file names. These will be taken from the solution artifacts
PreviewImagesDark []string
preview image file names. These will be taken from the solution artifacts. used for dark theme support
Providers []string
Providers for the content item
Support MetadataSupportArgs
Support information for the template - type, name, contact information
TemplateId Changes to this property will trigger replacement. string
template Id
ThreatAnalysisTactics []string
the tactics the resource covers
ThreatAnalysisTechniques []string
the techniques the resource covers, these have to be aligned with the tactics being used
contentId This property is required. String
Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
contentKind This property is required. String | Kind
The kind of content the template is for.
displayName This property is required. String
The display name of the template
packageId This property is required. String
the package Id contains this template
resourceGroupName
This property is required.
Changes to this property will trigger replacement.
String
The name of the resource group. The name is case insensitive.
source This property is required. MetadataSource
Source of the content. This is where/how it was created.
version This property is required. String
Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
workspaceName
This property is required.
Changes to this property will trigger replacement.
String
The name of the workspace.
author MetadataAuthor
The creator of the content item.
categories MetadataCategories
Categories for the item
contentSchemaVersion String
Schema version of the content. Can be used to distinguish between different flow based on the schema version
customVersion String
The custom version of the content. A optional free text
dependencies MetadataDependencies
Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
firstPublishDate String
first publish date content item
icon String
the icon identifier. this id can later be fetched from the content metadata
lastPublishDate String
last publish date for the content item
mainTemplate Object
The JSON of the ARM template to deploy active content
packageKind String | PackageKind
the packageKind of the package contains this template
packageName String
the name of the package contains this template
previewImages List<String>
preview image file names. These will be taken from the solution artifacts
previewImagesDark List<String>
preview image file names. These will be taken from the solution artifacts. used for dark theme support
providers List<String>
Providers for the content item
support MetadataSupport
Support information for the template - type, name, contact information
templateId Changes to this property will trigger replacement. String
template Id
threatAnalysisTactics List<String>
the tactics the resource covers
threatAnalysisTechniques List<String>
the techniques the resource covers, these have to be aligned with the tactics being used
contentId This property is required. string
Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
contentKind This property is required. string | Kind
The kind of content the template is for.
displayName This property is required. string
The display name of the template
packageId This property is required. string
the package Id contains this template
resourceGroupName
This property is required.
Changes to this property will trigger replacement.
string
The name of the resource group. The name is case insensitive.
source This property is required. MetadataSource
Source of the content. This is where/how it was created.
version This property is required. string
Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
workspaceName
This property is required.
Changes to this property will trigger replacement.
string
The name of the workspace.
author MetadataAuthor
The creator of the content item.
categories MetadataCategories
Categories for the item
contentSchemaVersion string
Schema version of the content. Can be used to distinguish between different flow based on the schema version
customVersion string
The custom version of the content. A optional free text
dependencies MetadataDependencies
Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
firstPublishDate string
first publish date content item
icon string
the icon identifier. this id can later be fetched from the content metadata
lastPublishDate string
last publish date for the content item
mainTemplate any
The JSON of the ARM template to deploy active content
packageKind string | PackageKind
the packageKind of the package contains this template
packageName string
the name of the package contains this template
previewImages string[]
preview image file names. These will be taken from the solution artifacts
previewImagesDark string[]
preview image file names. These will be taken from the solution artifacts. used for dark theme support
providers string[]
Providers for the content item
support MetadataSupport
Support information for the template - type, name, contact information
templateId Changes to this property will trigger replacement. string
template Id
threatAnalysisTactics string[]
the tactics the resource covers
threatAnalysisTechniques string[]
the techniques the resource covers, these have to be aligned with the tactics being used
content_id This property is required. str
Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
content_kind This property is required. str | Kind
The kind of content the template is for.
display_name This property is required. str
The display name of the template
package_id This property is required. str
the package Id contains this template
resource_group_name
This property is required.
Changes to this property will trigger replacement.
str
The name of the resource group. The name is case insensitive.
source This property is required. MetadataSourceArgs
Source of the content. This is where/how it was created.
version This property is required. str
Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
workspace_name
This property is required.
Changes to this property will trigger replacement.
str
The name of the workspace.
author MetadataAuthorArgs
The creator of the content item.
categories MetadataCategoriesArgs
Categories for the item
content_schema_version str
Schema version of the content. Can be used to distinguish between different flow based on the schema version
custom_version str
The custom version of the content. A optional free text
dependencies MetadataDependenciesArgs
Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
first_publish_date str
first publish date content item
icon str
the icon identifier. this id can later be fetched from the content metadata
last_publish_date str
last publish date for the content item
main_template Any
The JSON of the ARM template to deploy active content
package_kind str | PackageKind
the packageKind of the package contains this template
package_name str
the name of the package contains this template
preview_images Sequence[str]
preview image file names. These will be taken from the solution artifacts
preview_images_dark Sequence[str]
preview image file names. These will be taken from the solution artifacts. used for dark theme support
providers Sequence[str]
Providers for the content item
support MetadataSupportArgs
Support information for the template - type, name, contact information
template_id Changes to this property will trigger replacement. str
template Id
threat_analysis_tactics Sequence[str]
the tactics the resource covers
threat_analysis_techniques Sequence[str]
the techniques the resource covers, these have to be aligned with the tactics being used
contentId This property is required. String
Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
contentKind This property is required. String | "DataConnector" | "DataType" | "Workbook" | "WorkbookTemplate" | "Playbook" | "PlaybookTemplate" | "AnalyticsRuleTemplate" | "AnalyticsRule" | "HuntingQuery" | "InvestigationQuery" | "Parser" | "Watchlist" | "WatchlistTemplate" | "Solution" | "AzureFunction" | "LogicAppsCustomConnector" | "AutomationRule"
The kind of content the template is for.
displayName This property is required. String
The display name of the template
packageId This property is required. String
the package Id contains this template
resourceGroupName
This property is required.
Changes to this property will trigger replacement.
String
The name of the resource group. The name is case insensitive.
source This property is required. Property Map
Source of the content. This is where/how it was created.
version This property is required. String
Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
workspaceName
This property is required.
Changes to this property will trigger replacement.
String
The name of the workspace.
author Property Map
The creator of the content item.
categories Property Map
Categories for the item
contentSchemaVersion String
Schema version of the content. Can be used to distinguish between different flow based on the schema version
customVersion String
The custom version of the content. A optional free text
dependencies Property Map
Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
firstPublishDate String
first publish date content item
icon String
the icon identifier. this id can later be fetched from the content metadata
lastPublishDate String
last publish date for the content item
mainTemplate Any
The JSON of the ARM template to deploy active content
packageKind String | "Solution" | "Standalone"
the packageKind of the package contains this template
packageName String
the name of the package contains this template
previewImages List<String>
preview image file names. These will be taken from the solution artifacts
previewImagesDark List<String>
preview image file names. These will be taken from the solution artifacts. used for dark theme support
providers List<String>
Providers for the content item
support Property Map
Support information for the template - type, name, contact information
templateId Changes to this property will trigger replacement. String
template Id
threatAnalysisTactics List<String>
the tactics the resource covers
threatAnalysisTechniques List<String>
the techniques the resource covers, these have to be aligned with the tactics being used

Outputs

All input properties are implicitly available as output properties. Additionally, the ContentTemplate resource produces the following output properties:

Id string
The provider-assigned unique ID for this managed resource.
Name string
The name of the resource
SystemData Pulumi.AzureNative.SecurityInsights.Outputs.SystemDataResponse
Azure Resource Manager metadata containing createdBy and modifiedBy information.
Type string
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
Etag string
Etag of the azure resource
Id string
The provider-assigned unique ID for this managed resource.
Name string
The name of the resource
SystemData SystemDataResponse
Azure Resource Manager metadata containing createdBy and modifiedBy information.
Type string
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
Etag string
Etag of the azure resource
id String
The provider-assigned unique ID for this managed resource.
name String
The name of the resource
systemData SystemDataResponse
Azure Resource Manager metadata containing createdBy and modifiedBy information.
type String
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
etag String
Etag of the azure resource
id string
The provider-assigned unique ID for this managed resource.
name string
The name of the resource
systemData SystemDataResponse
Azure Resource Manager metadata containing createdBy and modifiedBy information.
type string
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
etag string
Etag of the azure resource
id str
The provider-assigned unique ID for this managed resource.
name str
The name of the resource
system_data SystemDataResponse
Azure Resource Manager metadata containing createdBy and modifiedBy information.
type str
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
etag str
Etag of the azure resource
id String
The provider-assigned unique ID for this managed resource.
name String
The name of the resource
systemData Property Map
Azure Resource Manager metadata containing createdBy and modifiedBy information.
type String
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
etag String
Etag of the azure resource

Supporting Types

Kind
, KindArgs

DataConnector
DataConnector
DataType
DataType
Workbook
Workbook
WorkbookTemplate
WorkbookTemplate
Playbook
Playbook
PlaybookTemplate
PlaybookTemplate
AnalyticsRuleTemplate
AnalyticsRuleTemplate
AnalyticsRule
AnalyticsRule
HuntingQuery
HuntingQuery
InvestigationQuery
InvestigationQuery
Parser
Parser
Watchlist
Watchlist
WatchlistTemplate
WatchlistTemplate
Solution
Solution
AzureFunction
AzureFunction
LogicAppsCustomConnector
LogicAppsCustomConnector
AutomationRule
AutomationRule
KindDataConnector
DataConnector
KindDataType
DataType
KindWorkbook
Workbook
KindWorkbookTemplate
WorkbookTemplate
KindPlaybook
Playbook
KindPlaybookTemplate
PlaybookTemplate
KindAnalyticsRuleTemplate
AnalyticsRuleTemplate
KindAnalyticsRule
AnalyticsRule
KindHuntingQuery
HuntingQuery
KindInvestigationQuery
InvestigationQuery
KindParser
Parser
KindWatchlist
Watchlist
KindWatchlistTemplate
WatchlistTemplate
KindSolution
Solution
KindAzureFunction
AzureFunction
KindLogicAppsCustomConnector
LogicAppsCustomConnector
KindAutomationRule
AutomationRule
DataConnector
DataConnector
DataType
DataType
Workbook
Workbook
WorkbookTemplate
WorkbookTemplate
Playbook
Playbook
PlaybookTemplate
PlaybookTemplate
AnalyticsRuleTemplate
AnalyticsRuleTemplate
AnalyticsRule
AnalyticsRule
HuntingQuery
HuntingQuery
InvestigationQuery
InvestigationQuery
Parser
Parser
Watchlist
Watchlist
WatchlistTemplate
WatchlistTemplate
Solution
Solution
AzureFunction
AzureFunction
LogicAppsCustomConnector
LogicAppsCustomConnector
AutomationRule
AutomationRule
DataConnector
DataConnector
DataType
DataType
Workbook
Workbook
WorkbookTemplate
WorkbookTemplate
Playbook
Playbook
PlaybookTemplate
PlaybookTemplate
AnalyticsRuleTemplate
AnalyticsRuleTemplate
AnalyticsRule
AnalyticsRule
HuntingQuery
HuntingQuery
InvestigationQuery
InvestigationQuery
Parser
Parser
Watchlist
Watchlist
WatchlistTemplate
WatchlistTemplate
Solution
Solution
AzureFunction
AzureFunction
LogicAppsCustomConnector
LogicAppsCustomConnector
AutomationRule
AutomationRule
DATA_CONNECTOR
DataConnector
DATA_TYPE
DataType
WORKBOOK
Workbook
WORKBOOK_TEMPLATE
WorkbookTemplate
PLAYBOOK
Playbook
PLAYBOOK_TEMPLATE
PlaybookTemplate
ANALYTICS_RULE_TEMPLATE
AnalyticsRuleTemplate
ANALYTICS_RULE
AnalyticsRule
HUNTING_QUERY
HuntingQuery
INVESTIGATION_QUERY
InvestigationQuery
PARSER
Parser
WATCHLIST
Watchlist
WATCHLIST_TEMPLATE
WatchlistTemplate
SOLUTION
Solution
AZURE_FUNCTION
AzureFunction
LOGIC_APPS_CUSTOM_CONNECTOR
LogicAppsCustomConnector
AUTOMATION_RULE
AutomationRule
"DataConnector"
DataConnector
"DataType"
DataType
"Workbook"
Workbook
"WorkbookTemplate"
WorkbookTemplate
"Playbook"
Playbook
"PlaybookTemplate"
PlaybookTemplate
"AnalyticsRuleTemplate"
AnalyticsRuleTemplate
"AnalyticsRule"
AnalyticsRule
"HuntingQuery"
HuntingQuery
"InvestigationQuery"
InvestigationQuery
"Parser"
Parser
"Watchlist"
Watchlist
"WatchlistTemplate"
WatchlistTemplate
"Solution"
Solution
"AzureFunction"
AzureFunction
"LogicAppsCustomConnector"
LogicAppsCustomConnector
"AutomationRule"
AutomationRule

MetadataAuthor
, MetadataAuthorArgs

Email string
Email of author contact
Link string
Link for author/vendor page
Name string
Name of the author. Company or person.
Email string
Email of author contact
Link string
Link for author/vendor page
Name string
Name of the author. Company or person.
email String
Email of author contact
link String
Link for author/vendor page
name String
Name of the author. Company or person.
email string
Email of author contact
link string
Link for author/vendor page
name string
Name of the author. Company or person.
email str
Email of author contact
link str
Link for author/vendor page
name str
Name of the author. Company or person.
email String
Email of author contact
link String
Link for author/vendor page
name String
Name of the author. Company or person.

MetadataAuthorResponse
, MetadataAuthorResponseArgs

Email string
Email of author contact
Link string
Link for author/vendor page
Name string
Name of the author. Company or person.
Email string
Email of author contact
Link string
Link for author/vendor page
Name string
Name of the author. Company or person.
email String
Email of author contact
link String
Link for author/vendor page
name String
Name of the author. Company or person.
email string
Email of author contact
link string
Link for author/vendor page
name string
Name of the author. Company or person.
email str
Email of author contact
link str
Link for author/vendor page
name str
Name of the author. Company or person.
email String
Email of author contact
link String
Link for author/vendor page
name String
Name of the author. Company or person.

MetadataCategories
, MetadataCategoriesArgs

Domains List<string>
domain for the solution content item
Verticals List<string>
Industry verticals for the solution content item
Domains []string
domain for the solution content item
Verticals []string
Industry verticals for the solution content item
domains List<String>
domain for the solution content item
verticals List<String>
Industry verticals for the solution content item
domains string[]
domain for the solution content item
verticals string[]
Industry verticals for the solution content item
domains Sequence[str]
domain for the solution content item
verticals Sequence[str]
Industry verticals for the solution content item
domains List<String>
domain for the solution content item
verticals List<String>
Industry verticals for the solution content item

MetadataCategoriesResponse
, MetadataCategoriesResponseArgs

Domains List<string>
domain for the solution content item
Verticals List<string>
Industry verticals for the solution content item
Domains []string
domain for the solution content item
Verticals []string
Industry verticals for the solution content item
domains List<String>
domain for the solution content item
verticals List<String>
Industry verticals for the solution content item
domains string[]
domain for the solution content item
verticals string[]
Industry verticals for the solution content item
domains Sequence[str]
domain for the solution content item
verticals Sequence[str]
Industry verticals for the solution content item
domains List<String>
domain for the solution content item
verticals List<String>
Industry verticals for the solution content item

MetadataDependencies
, MetadataDependenciesArgs

ContentId string
Id of the content item we depend on
Criteria List<Pulumi.AzureNative.SecurityInsights.Inputs.MetadataDependencies>
This is the list of dependencies we must fulfill, according to the AND/OR operator
Kind string | Pulumi.AzureNative.SecurityInsights.Kind
Type of the content item we depend on
Name string
Name of the content item
Operator string | Pulumi.AzureNative.SecurityInsights.Operator
Operator used for list of dependencies in criteria array.
Version string
Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
ContentId string
Id of the content item we depend on
Criteria []MetadataDependencies
This is the list of dependencies we must fulfill, according to the AND/OR operator
Kind string | Kind
Type of the content item we depend on
Name string
Name of the content item
Operator string | Operator
Operator used for list of dependencies in criteria array.
Version string
Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
contentId String
Id of the content item we depend on
criteria List<MetadataDependencies>
This is the list of dependencies we must fulfill, according to the AND/OR operator
kind String | Kind
Type of the content item we depend on
name String
Name of the content item
operator String | Operator
Operator used for list of dependencies in criteria array.
version String
Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
contentId string
Id of the content item we depend on
criteria MetadataDependencies[]
This is the list of dependencies we must fulfill, according to the AND/OR operator
kind string | Kind
Type of the content item we depend on
name string
Name of the content item
operator string | Operator
Operator used for list of dependencies in criteria array.
version string
Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
content_id str
Id of the content item we depend on
criteria Sequence[MetadataDependencies]
This is the list of dependencies we must fulfill, according to the AND/OR operator
kind str | Kind
Type of the content item we depend on
name str
Name of the content item
operator str | Operator
Operator used for list of dependencies in criteria array.
version str
Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
contentId String
Id of the content item we depend on
criteria List<Property Map>
This is the list of dependencies we must fulfill, according to the AND/OR operator
kind String | "DataConnector" | "DataType" | "Workbook" | "WorkbookTemplate" | "Playbook" | "PlaybookTemplate" | "AnalyticsRuleTemplate" | "AnalyticsRule" | "HuntingQuery" | "InvestigationQuery" | "Parser" | "Watchlist" | "WatchlistTemplate" | "Solution" | "AzureFunction" | "LogicAppsCustomConnector" | "AutomationRule"
Type of the content item we depend on
name String
Name of the content item
operator String | "AND" | "OR"
Operator used for list of dependencies in criteria array.
version String
Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.

MetadataDependenciesResponse
, MetadataDependenciesResponseArgs

ContentId string
Id of the content item we depend on
Criteria List<Pulumi.AzureNative.SecurityInsights.Inputs.MetadataDependenciesResponse>
This is the list of dependencies we must fulfill, according to the AND/OR operator
Kind string
Type of the content item we depend on
Name string
Name of the content item
Operator string
Operator used for list of dependencies in criteria array.
Version string
Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
ContentId string
Id of the content item we depend on
Criteria []MetadataDependenciesResponse
This is the list of dependencies we must fulfill, according to the AND/OR operator
Kind string
Type of the content item we depend on
Name string
Name of the content item
Operator string
Operator used for list of dependencies in criteria array.
Version string
Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
contentId String
Id of the content item we depend on
criteria List<MetadataDependenciesResponse>
This is the list of dependencies we must fulfill, according to the AND/OR operator
kind String
Type of the content item we depend on
name String
Name of the content item
operator String
Operator used for list of dependencies in criteria array.
version String
Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
contentId string
Id of the content item we depend on
criteria MetadataDependenciesResponse[]
This is the list of dependencies we must fulfill, according to the AND/OR operator
kind string
Type of the content item we depend on
name string
Name of the content item
operator string
Operator used for list of dependencies in criteria array.
version string
Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
content_id str
Id of the content item we depend on
criteria Sequence[MetadataDependenciesResponse]
This is the list of dependencies we must fulfill, according to the AND/OR operator
kind str
Type of the content item we depend on
name str
Name of the content item
operator str
Operator used for list of dependencies in criteria array.
version str
Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
contentId String
Id of the content item we depend on
criteria List<Property Map>
This is the list of dependencies we must fulfill, according to the AND/OR operator
kind String
Type of the content item we depend on
name String
Name of the content item
operator String
Operator used for list of dependencies in criteria array.
version String
Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.

MetadataSource
, MetadataSourceArgs

Kind This property is required. string | Pulumi.AzureNative.SecurityInsights.SourceKind
Source type of the content
Name string
Name of the content source. The repo name, solution name, LA workspace name etc.
SourceId string
ID of the content source. The solution ID, workspace ID, etc
Kind This property is required. string | SourceKind
Source type of the content
Name string
Name of the content source. The repo name, solution name, LA workspace name etc.
SourceId string
ID of the content source. The solution ID, workspace ID, etc
kind This property is required. String | SourceKind
Source type of the content
name String
Name of the content source. The repo name, solution name, LA workspace name etc.
sourceId String
ID of the content source. The solution ID, workspace ID, etc
kind This property is required. string | SourceKind
Source type of the content
name string
Name of the content source. The repo name, solution name, LA workspace name etc.
sourceId string
ID of the content source. The solution ID, workspace ID, etc
kind This property is required. str | SourceKind
Source type of the content
name str
Name of the content source. The repo name, solution name, LA workspace name etc.
source_id str
ID of the content source. The solution ID, workspace ID, etc
kind This property is required. String | "LocalWorkspace" | "Community" | "Solution" | "SourceRepository"
Source type of the content
name String
Name of the content source. The repo name, solution name, LA workspace name etc.
sourceId String
ID of the content source. The solution ID, workspace ID, etc

MetadataSourceResponse
, MetadataSourceResponseArgs

Kind This property is required. string
Source type of the content
Name string
Name of the content source. The repo name, solution name, LA workspace name etc.
SourceId string
ID of the content source. The solution ID, workspace ID, etc
Kind This property is required. string
Source type of the content
Name string
Name of the content source. The repo name, solution name, LA workspace name etc.
SourceId string
ID of the content source. The solution ID, workspace ID, etc
kind This property is required. String
Source type of the content
name String
Name of the content source. The repo name, solution name, LA workspace name etc.
sourceId String
ID of the content source. The solution ID, workspace ID, etc
kind This property is required. string
Source type of the content
name string
Name of the content source. The repo name, solution name, LA workspace name etc.
sourceId string
ID of the content source. The solution ID, workspace ID, etc
kind This property is required. str
Source type of the content
name str
Name of the content source. The repo name, solution name, LA workspace name etc.
source_id str
ID of the content source. The solution ID, workspace ID, etc
kind This property is required. String
Source type of the content
name String
Name of the content source. The repo name, solution name, LA workspace name etc.
sourceId String
ID of the content source. The solution ID, workspace ID, etc

MetadataSupport
, MetadataSupportArgs

Tier This property is required. string | Pulumi.AzureNative.SecurityInsights.SupportTier
Type of support for content item
Email string
Email of support contact
Link string
Link for support help, like to support page to open a ticket etc.
Name string
Name of the support contact. Company or person.
Tier This property is required. string | SupportTier
Type of support for content item
Email string
Email of support contact
Link string
Link for support help, like to support page to open a ticket etc.
Name string
Name of the support contact. Company or person.
tier This property is required. String | SupportTier
Type of support for content item
email String
Email of support contact
link String
Link for support help, like to support page to open a ticket etc.
name String
Name of the support contact. Company or person.
tier This property is required. string | SupportTier
Type of support for content item
email string
Email of support contact
link string
Link for support help, like to support page to open a ticket etc.
name string
Name of the support contact. Company or person.
tier This property is required. str | SupportTier
Type of support for content item
email str
Email of support contact
link str
Link for support help, like to support page to open a ticket etc.
name str
Name of the support contact. Company or person.
tier This property is required. String | "Microsoft" | "Partner" | "Community"
Type of support for content item
email String
Email of support contact
link String
Link for support help, like to support page to open a ticket etc.
name String
Name of the support contact. Company or person.

MetadataSupportResponse
, MetadataSupportResponseArgs

Tier This property is required. string
Type of support for content item
Email string
Email of support contact
Link string
Link for support help, like to support page to open a ticket etc.
Name string
Name of the support contact. Company or person.
Tier This property is required. string
Type of support for content item
Email string
Email of support contact
Link string
Link for support help, like to support page to open a ticket etc.
Name string
Name of the support contact. Company or person.
tier This property is required. String
Type of support for content item
email String
Email of support contact
link String
Link for support help, like to support page to open a ticket etc.
name String
Name of the support contact. Company or person.
tier This property is required. string
Type of support for content item
email string
Email of support contact
link string
Link for support help, like to support page to open a ticket etc.
name string
Name of the support contact. Company or person.
tier This property is required. str
Type of support for content item
email str
Email of support contact
link str
Link for support help, like to support page to open a ticket etc.
name str
Name of the support contact. Company or person.
tier This property is required. String
Type of support for content item
email String
Email of support contact
link String
Link for support help, like to support page to open a ticket etc.
name String
Name of the support contact. Company or person.

Operator
, OperatorArgs

AND
AND
OR
OR
OperatorAND
AND
OperatorOR
OR
AND
AND
OR
OR
AND
AND
OR
OR
AND_
AND
OR_
OR
"AND"
AND
"OR"
OR

PackageKind
, PackageKindArgs

Solution
Solution
Standalone
Standalone
PackageKindSolution
Solution
PackageKindStandalone
Standalone
Solution
Solution
Standalone
Standalone
Solution
Solution
Standalone
Standalone
SOLUTION
Solution
STANDALONE
Standalone
"Solution"
Solution
"Standalone"
Standalone

SourceKind
, SourceKindArgs

LocalWorkspace
LocalWorkspace
Community
Community
Solution
Solution
SourceRepository
SourceRepository
SourceKindLocalWorkspace
LocalWorkspace
SourceKindCommunity
Community
SourceKindSolution
Solution
SourceKindSourceRepository
SourceRepository
LocalWorkspace
LocalWorkspace
Community
Community
Solution
Solution
SourceRepository
SourceRepository
LocalWorkspace
LocalWorkspace
Community
Community
Solution
Solution
SourceRepository
SourceRepository
LOCAL_WORKSPACE
LocalWorkspace
COMMUNITY
Community
SOLUTION
Solution
SOURCE_REPOSITORY
SourceRepository
"LocalWorkspace"
LocalWorkspace
"Community"
Community
"Solution"
Solution
"SourceRepository"
SourceRepository

SupportTier
, SupportTierArgs

Microsoft
Microsoft
Partner
Partner
Community
Community
SupportTierMicrosoft
Microsoft
SupportTierPartner
Partner
SupportTierCommunity
Community
Microsoft
Microsoft
Partner
Partner
Community
Community
Microsoft
Microsoft
Partner
Partner
Community
Community
MICROSOFT
Microsoft
PARTNER
Partner
COMMUNITY
Community
"Microsoft"
Microsoft
"Partner"
Partner
"Community"
Community

SystemDataResponse
, SystemDataResponseArgs

CreatedAt string
The timestamp of resource creation (UTC).
CreatedBy string
The identity that created the resource.
CreatedByType string
The type of identity that created the resource.
LastModifiedAt string
The timestamp of resource last modification (UTC)
LastModifiedBy string
The identity that last modified the resource.
LastModifiedByType string
The type of identity that last modified the resource.
CreatedAt string
The timestamp of resource creation (UTC).
CreatedBy string
The identity that created the resource.
CreatedByType string
The type of identity that created the resource.
LastModifiedAt string
The timestamp of resource last modification (UTC)
LastModifiedBy string
The identity that last modified the resource.
LastModifiedByType string
The type of identity that last modified the resource.
createdAt String
The timestamp of resource creation (UTC).
createdBy String
The identity that created the resource.
createdByType String
The type of identity that created the resource.
lastModifiedAt String
The timestamp of resource last modification (UTC)
lastModifiedBy String
The identity that last modified the resource.
lastModifiedByType String
The type of identity that last modified the resource.
createdAt string
The timestamp of resource creation (UTC).
createdBy string
The identity that created the resource.
createdByType string
The type of identity that created the resource.
lastModifiedAt string
The timestamp of resource last modification (UTC)
lastModifiedBy string
The identity that last modified the resource.
lastModifiedByType string
The type of identity that last modified the resource.
created_at str
The timestamp of resource creation (UTC).
created_by str
The identity that created the resource.
created_by_type str
The type of identity that created the resource.
last_modified_at str
The timestamp of resource last modification (UTC)
last_modified_by str
The identity that last modified the resource.
last_modified_by_type str
The type of identity that last modified the resource.
createdAt String
The timestamp of resource creation (UTC).
createdBy String
The identity that created the resource.
createdByType String
The type of identity that created the resource.
lastModifiedAt String
The timestamp of resource last modification (UTC)
lastModifiedBy String
The identity that last modified the resource.
lastModifiedByType String
The type of identity that last modified the resource.

Import

An existing resource can be imported using its type token, name, and identifier, e.g.

$ pulumi import azure-native:securityinsights:ContentTemplate azuresentinel.azure-sentinel-solution-ciscoumbrella /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/contentTemplates/{templateId}
Copy

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository
azure-native-v2 pulumi/pulumi-azure-native
License
Apache-2.0
These are the docs for Azure Native v2. We recommenend using the latest version, Azure Native v3.
Azure Native v2 v2.90.0 published on Thursday, Mar 27, 2025 by Pulumi
pulumi/pulumi-azure-native