NrtAlertRuleTemplateProperties interface
NRT alert rule template properties
Properties
| alert |
The alert details override settings |
| alert |
The number of alert rules that were created by this template |
| created |
The time that this alert rule template has been added. |
| custom |
Dictionary of string key-value pairs of columns to be attached to the alert |
| description | The description of the alert rule template. |
| display |
The display name for alert rule template. |
| entity |
Array of the entity mappings of the alert rule |
| event |
The event grouping settings. |
| last |
The last time that this alert rule template has been updated. |
| query | The query that creates alerts for this rule. |
| required |
The required data sources for this template |
| sentinel |
Array of the sentinel entity mappings of the alert rule |
| severity | The severity for alerts created by this alert rule. |
| status | The alert rule template status. |
| tactics | The tactics of the alert rule |
| techniques | The techniques of the alert rule |
| version | The version of this template - in format <a.b.c>, where all are numbers. For example <1.0.2>. |
Property Details
alertDetailsOverride
The alert details override settings
alertDetailsOverride?: AlertDetailsOverrideProperty Value
alertRulesCreatedByTemplateCount
The number of alert rules that were created by this template
alertRulesCreatedByTemplateCount?: numberProperty Value
number
createdDateUTC
The time that this alert rule template has been added.
createdDateUTC?: DateProperty Value
Date
customDetails
Dictionary of string key-value pairs of columns to be attached to the alert
customDetails?: Record<string, string>Property Value
Record<string, string>
description
The description of the alert rule template.
description?: stringProperty Value
string
displayName
The display name for alert rule template.
displayName?: stringProperty Value
string
entityMappings
Array of the entity mappings of the alert rule
entityMappings?: EntityMapping[]Property Value
eventGroupingSettings
The event grouping settings.
eventGroupingSettings?: EventGroupingSettingsProperty Value
lastUpdatedDateUTC
The last time that this alert rule template has been updated.
lastUpdatedDateUTC?: DateProperty Value
Date
query
The query that creates alerts for this rule.
query?: stringProperty Value
string
requiredDataConnectors
The required data sources for this template
requiredDataConnectors?: AlertRuleTemplateDataSource[]Property Value
sentinelEntitiesMappings
Array of the sentinel entity mappings of the alert rule
sentinelEntitiesMappings?: SentinelEntityMapping[]Property Value
severity
The severity for alerts created by this alert rule.
severity?: stringProperty Value
string
status
The alert rule template status.
status?: stringProperty Value
string
tactics
The tactics of the alert rule
tactics?: string[]Property Value
string[]
techniques
The techniques of the alert rule
techniques?: string[]Property Value
string[]
version
The version of this template - in format <a.b.c>, where all are numbers. For example <1.0.2>.
version?: stringProperty Value
string
