import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
import * as outputs from "../types/output";
/**
 * Manages a Sentinel Threat Intelligence Indicator.
 *
 * ## Example Usage
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as azure from "@pulumi/azure";
 *
 * const example = new azure.core.ResourceGroup("example", {
 *     name: "example-rg",
 *     location: "east us",
 * });
 * const exampleAnalyticsWorkspace = new azure.operationalinsights.AnalyticsWorkspace("example", {
 *     name: "example-law",
 *     location: example.location,
 *     resourceGroupName: example.name,
 *     sku: "PerGB2018",
 *     retentionInDays: 30,
 * });
 * const exampleLogAnalyticsWorkspaceOnboarding = new azure.sentinel.LogAnalyticsWorkspaceOnboarding("example", {workspaceId: exampleAnalyticsWorkspace.id});
 * const exampleThreatIntelligenceIndicator = new azure.sentinel.ThreatIntelligenceIndicator("example", {
 *     workspaceId: exampleLogAnalyticsWorkspaceOnboarding.workspaceId,
 *     patternType: "domain-name",
 *     pattern: "http://example.com",
 *     source: "Microsoft Sentinel",
 *     validateFromUtc: "2022-12-14T16:00:00Z",
 *     displayName: "example-indicator",
 * });
 * ```
 *
 * ## Import
 *
 * Sentinel Threat Intelligence Indicators can be imported using the `resource id`, e.g.
 *
 * ```sh
 * $ pulumi import azure:sentinel/threatIntelligenceIndicator:ThreatIntelligenceIndicator example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/resourcegroup1/providers/Microsoft.OperationalInsights/workspaces/workspace1/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators/indicator1
 * ```
 */
export declare class ThreatIntelligenceIndicator extends pulumi.CustomResource {
    /**
     * Get an existing ThreatIntelligenceIndicator resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: ThreatIntelligenceIndicatorState, opts?: pulumi.CustomResourceOptions): ThreatIntelligenceIndicator;
    /**
     * Returns true if the given object is an instance of ThreatIntelligenceIndicator.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj: any): obj is ThreatIntelligenceIndicator;
    /**
     * Confidence levels of the Threat Intelligence Indicator.
     */
    readonly confidence: pulumi.Output<number | undefined>;
    /**
     * The creator of the Threat Intelligence Indicator.
     */
    readonly createdBy: pulumi.Output<string | undefined>;
    /**
     * The date of this Threat Intelligence Indicator created.
     */
    readonly createdOn: pulumi.Output<string>;
    /**
     * Whether the Threat Intelligence entity is defanged?
     */
    readonly defanged: pulumi.Output<boolean>;
    /**
     * The description of the Threat Intelligence Indicator.
     */
    readonly description: pulumi.Output<string | undefined>;
    /**
     * The display name of the Threat Intelligence Indicator.
     */
    readonly displayName: pulumi.Output<string>;
    /**
     * The extension config of the Threat Intelligence Indicator in JSON format.
     */
    readonly extension: pulumi.Output<string>;
    /**
     * The external ID of the Threat Intelligence Indicator.
     */
    readonly externalId: pulumi.Output<string>;
    /**
     * the External last updated time in UTC.
     */
    readonly externalLastUpdatedTimeUtc: pulumi.Output<string>;
    /**
     * One or more `externalReference` blocks as defined below.
     */
    readonly externalReferences: pulumi.Output<outputs.sentinel.ThreatIntelligenceIndicatorExternalReference[] | undefined>;
    /**
     * One or more `granularMarking` blocks as defined below.
     */
    readonly granularMarkings: pulumi.Output<outputs.sentinel.ThreatIntelligenceIndicatorGranularMarking[] | undefined>;
    /**
     * The guid of this Sentinel Threat Intelligence Indicator.
     */
    readonly guid: pulumi.Output<string>;
    /**
     * A list of indicator types of this Threat Intelligence Indicator.
     */
    readonly indicatorTypes: pulumi.Output<string[]>;
    /**
     * One or more `killChainPhase` blocks as defined below.
     */
    readonly killChainPhases: pulumi.Output<outputs.sentinel.ThreatIntelligenceIndicatorKillChainPhase[] | undefined>;
    /**
     * The language of the Threat Intelligence Indicator.
     */
    readonly language: pulumi.Output<string | undefined>;
    /**
     * The last updated time of the Threat Intelligence Indicator in UTC.
     */
    readonly lastUpdatedTimeUtc: pulumi.Output<string>;
    /**
     * Specifies a list of Threat Intelligence marking references.
     */
    readonly objectMarkingRefs: pulumi.Output<string[] | undefined>;
    /**
     * A `parsedPattern` block as defined below.
     */
    readonly parsedPatterns: pulumi.Output<outputs.sentinel.ThreatIntelligenceIndicatorParsedPattern[]>;
    /**
     * The pattern used by the Threat Intelligence Indicator. When `patternType` set to `file`, `pattern` must be specified with `<HashName>:<Value>` format, such as `MD5:78ecc5c05cd8b79af480df2f8fba0b9d`.
     */
    readonly pattern: pulumi.Output<string>;
    /**
     * The type of pattern used by the Threat Intelligence Indicator. Possible values are `domain-name`, `file`, `ipv4-addr`, `ipv6-addr` and `url`.
     */
    readonly patternType: pulumi.Output<string>;
    /**
     * The version of a Threat Intelligence entity.
     */
    readonly patternVersion: pulumi.Output<string | undefined>;
    /**
     * Whether the Threat Intelligence entity revoked.
     */
    readonly revoked: pulumi.Output<boolean | undefined>;
    /**
     * Source of the Threat Intelligence Indicator. Changing this forces a new resource to be created.
     */
    readonly source: pulumi.Output<string>;
    /**
     * Specifies a list of tags of the Threat Intelligence Indicator.
     */
    readonly tags: pulumi.Output<string[] | undefined>;
    /**
     * Specifies a list of threat types of this Threat Intelligence Indicator.
     */
    readonly threatTypes: pulumi.Output<string[] | undefined>;
    /**
     * The start of validate date in RFC3339.
     */
    readonly validateFromUtc: pulumi.Output<string>;
    /**
     * The end of validate date of the Threat Intelligence Indicator in RFC3339 format.
     */
    readonly validateUntilUtc: pulumi.Output<string | undefined>;
    /**
     * The ID of the Log Analytics Workspace. Changing this forces a new Sentinel Threat Intelligence Indicator to be created.
     */
    readonly workspaceId: pulumi.Output<string>;
    /**
     * Create a ThreatIntelligenceIndicator resource with the given unique name, arguments, and options.
     *
     * @param name The _unique_ name of the resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param opts A bag of options that control this resource's behavior.
     */
    constructor(name: string, args: ThreatIntelligenceIndicatorArgs, opts?: pulumi.CustomResourceOptions);
}
/**
 * Input properties used for looking up and filtering ThreatIntelligenceIndicator resources.
 */
export interface ThreatIntelligenceIndicatorState {
    /**
     * Confidence levels of the Threat Intelligence Indicator.
     */
    confidence?: pulumi.Input<number>;
    /**
     * The creator of the Threat Intelligence Indicator.
     */
    createdBy?: pulumi.Input<string>;
    /**
     * The date of this Threat Intelligence Indicator created.
     */
    createdOn?: pulumi.Input<string>;
    /**
     * Whether the Threat Intelligence entity is defanged?
     */
    defanged?: pulumi.Input<boolean>;
    /**
     * The description of the Threat Intelligence Indicator.
     */
    description?: pulumi.Input<string>;
    /**
     * The display name of the Threat Intelligence Indicator.
     */
    displayName?: pulumi.Input<string>;
    /**
     * The extension config of the Threat Intelligence Indicator in JSON format.
     */
    extension?: pulumi.Input<string>;
    /**
     * The external ID of the Threat Intelligence Indicator.
     */
    externalId?: pulumi.Input<string>;
    /**
     * the External last updated time in UTC.
     */
    externalLastUpdatedTimeUtc?: pulumi.Input<string>;
    /**
     * One or more `externalReference` blocks as defined below.
     */
    externalReferences?: pulumi.Input<pulumi.Input<inputs.sentinel.ThreatIntelligenceIndicatorExternalReference>[]>;
    /**
     * One or more `granularMarking` blocks as defined below.
     */
    granularMarkings?: pulumi.Input<pulumi.Input<inputs.sentinel.ThreatIntelligenceIndicatorGranularMarking>[]>;
    /**
     * The guid of this Sentinel Threat Intelligence Indicator.
     */
    guid?: pulumi.Input<string>;
    /**
     * A list of indicator types of this Threat Intelligence Indicator.
     */
    indicatorTypes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * One or more `killChainPhase` blocks as defined below.
     */
    killChainPhases?: pulumi.Input<pulumi.Input<inputs.sentinel.ThreatIntelligenceIndicatorKillChainPhase>[]>;
    /**
     * The language of the Threat Intelligence Indicator.
     */
    language?: pulumi.Input<string>;
    /**
     * The last updated time of the Threat Intelligence Indicator in UTC.
     */
    lastUpdatedTimeUtc?: pulumi.Input<string>;
    /**
     * Specifies a list of Threat Intelligence marking references.
     */
    objectMarkingRefs?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A `parsedPattern` block as defined below.
     */
    parsedPatterns?: pulumi.Input<pulumi.Input<inputs.sentinel.ThreatIntelligenceIndicatorParsedPattern>[]>;
    /**
     * The pattern used by the Threat Intelligence Indicator. When `patternType` set to `file`, `pattern` must be specified with `<HashName>:<Value>` format, such as `MD5:78ecc5c05cd8b79af480df2f8fba0b9d`.
     */
    pattern?: pulumi.Input<string>;
    /**
     * The type of pattern used by the Threat Intelligence Indicator. Possible values are `domain-name`, `file`, `ipv4-addr`, `ipv6-addr` and `url`.
     */
    patternType?: pulumi.Input<string>;
    /**
     * The version of a Threat Intelligence entity.
     */
    patternVersion?: pulumi.Input<string>;
    /**
     * Whether the Threat Intelligence entity revoked.
     */
    revoked?: pulumi.Input<boolean>;
    /**
     * Source of the Threat Intelligence Indicator. Changing this forces a new resource to be created.
     */
    source?: pulumi.Input<string>;
    /**
     * Specifies a list of tags of the Threat Intelligence Indicator.
     */
    tags?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Specifies a list of threat types of this Threat Intelligence Indicator.
     */
    threatTypes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The start of validate date in RFC3339.
     */
    validateFromUtc?: pulumi.Input<string>;
    /**
     * The end of validate date of the Threat Intelligence Indicator in RFC3339 format.
     */
    validateUntilUtc?: pulumi.Input<string>;
    /**
     * The ID of the Log Analytics Workspace. Changing this forces a new Sentinel Threat Intelligence Indicator to be created.
     */
    workspaceId?: pulumi.Input<string>;
}
/**
 * The set of arguments for constructing a ThreatIntelligenceIndicator resource.
 */
export interface ThreatIntelligenceIndicatorArgs {
    /**
     * Confidence levels of the Threat Intelligence Indicator.
     */
    confidence?: pulumi.Input<number>;
    /**
     * The creator of the Threat Intelligence Indicator.
     */
    createdBy?: pulumi.Input<string>;
    /**
     * The description of the Threat Intelligence Indicator.
     */
    description?: pulumi.Input<string>;
    /**
     * The display name of the Threat Intelligence Indicator.
     */
    displayName: pulumi.Input<string>;
    /**
     * The extension config of the Threat Intelligence Indicator in JSON format.
     */
    extension?: pulumi.Input<string>;
    /**
     * One or more `externalReference` blocks as defined below.
     */
    externalReferences?: pulumi.Input<pulumi.Input<inputs.sentinel.ThreatIntelligenceIndicatorExternalReference>[]>;
    /**
     * One or more `granularMarking` blocks as defined below.
     */
    granularMarkings?: pulumi.Input<pulumi.Input<inputs.sentinel.ThreatIntelligenceIndicatorGranularMarking>[]>;
    /**
     * One or more `killChainPhase` blocks as defined below.
     */
    killChainPhases?: pulumi.Input<pulumi.Input<inputs.sentinel.ThreatIntelligenceIndicatorKillChainPhase>[]>;
    /**
     * The language of the Threat Intelligence Indicator.
     */
    language?: pulumi.Input<string>;
    /**
     * Specifies a list of Threat Intelligence marking references.
     */
    objectMarkingRefs?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The pattern used by the Threat Intelligence Indicator. When `patternType` set to `file`, `pattern` must be specified with `<HashName>:<Value>` format, such as `MD5:78ecc5c05cd8b79af480df2f8fba0b9d`.
     */
    pattern: pulumi.Input<string>;
    /**
     * The type of pattern used by the Threat Intelligence Indicator. Possible values are `domain-name`, `file`, `ipv4-addr`, `ipv6-addr` and `url`.
     */
    patternType: pulumi.Input<string>;
    /**
     * The version of a Threat Intelligence entity.
     */
    patternVersion?: pulumi.Input<string>;
    /**
     * Whether the Threat Intelligence entity revoked.
     */
    revoked?: pulumi.Input<boolean>;
    /**
     * Source of the Threat Intelligence Indicator. Changing this forces a new resource to be created.
     */
    source: pulumi.Input<string>;
    /**
     * Specifies a list of tags of the Threat Intelligence Indicator.
     */
    tags?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Specifies a list of threat types of this Threat Intelligence Indicator.
     */
    threatTypes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The start of validate date in RFC3339.
     */
    validateFromUtc: pulumi.Input<string>;
    /**
     * The end of validate date of the Threat Intelligence Indicator in RFC3339 format.
     */
    validateUntilUtc?: pulumi.Input<string>;
    /**
     * The ID of the Log Analytics Workspace. Changing this forces a new Sentinel Threat Intelligence Indicator to be created.
     */
    workspaceId: pulumi.Input<string>;
}