import * as pulumi from "@pulumi/pulumi";
import * as inputs from "./types/input";
import * as outputs from "./types/output";
/**
 * Provides a Datadog Security Monitoring Rule API resource. This can be used to create and manage Datadog security monitoring rules. To change settings for a default rule, use `datadog.SecurityMonitoringDefaultRule` instead.
 *
 * ## Example Usage
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as datadog from "@pulumi/datadog";
 *
 * const myrule = new datadog.SecurityMonitoringRule("myrule", {
 *     name: "My rule",
 *     message: "The rule has triggered.",
 *     enabled: true,
 *     queries: [
 *         {
 *             name: "errors",
 *             query: "status:error",
 *             aggregation: "count",
 *             dataSource: "logs",
 *             groupByFields: ["host"],
 *         },
 *         {
 *             name: "warnings",
 *             query: "status:warning",
 *             aggregation: "count",
 *             dataSource: "logs",
 *             groupByFields: ["host"],
 *         },
 *     ],
 *     cases: [{
 *         status: "high",
 *         condition: "errors > 3 && warnings > 10",
 *         notifications: ["@user"],
 *     }],
 *     options: {
 *         evaluationWindow: 300,
 *         keepAlive: 600,
 *         maxSignalDuration: 900,
 *     },
 *     tags: ["type:dos"],
 * });
 * ```
 *
 * ## Import
 *
 * The `pulumi import` command can be used, for example:
 *
 * Security monitoring rules can be imported using ID, e.g.
 *
 * ```sh
 * $ pulumi import datadog:index/securityMonitoringRule:SecurityMonitoringRule my_rule m0o-hto-lkb
 * ```
 */
export declare class SecurityMonitoringRule extends pulumi.CustomResource {
    /**
     * Get an existing SecurityMonitoringRule resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: SecurityMonitoringRuleState, opts?: pulumi.CustomResourceOptions): SecurityMonitoringRule;
    /**
     * Returns true if the given object is an instance of SecurityMonitoringRule.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj: any): obj is SecurityMonitoringRule;
    /**
     * One or more calculated fields. Available only for scheduled rules (in other words, when `schedulingOptions` is defined).
     */
    readonly calculatedFields: pulumi.Output<outputs.SecurityMonitoringRuleCalculatedField[] | undefined>;
    /**
     * Cases for generating signals.
     */
    readonly cases: pulumi.Output<outputs.SecurityMonitoringRuleCase[] | undefined>;
    /**
     * Whether the rule is enabled. Defaults to `true`.
     */
    readonly enabled: pulumi.Output<boolean | undefined>;
    /**
     * Additional queries to filter matched events before they are processed. **Note**: This field is deprecated for log detection, signal correlation, and workload security rules.
     */
    readonly filters: pulumi.Output<outputs.SecurityMonitoringRuleFilter[] | undefined>;
    /**
     * Additional grouping to perform on top of the query grouping.
     */
    readonly groupSignalsBies: pulumi.Output<string[] | undefined>;
    /**
     * Whether the notifications include the triggering group-by values in their title. Defaults to `false`.
     */
    readonly hasExtendedTitle: pulumi.Output<boolean | undefined>;
    /**
     * Message for generated signals.
     */
    readonly message: pulumi.Output<string>;
    /**
     * The name of the rule.
     */
    readonly name: pulumi.Output<string>;
    /**
     * Options on rules.
     */
    readonly options: pulumi.Output<outputs.SecurityMonitoringRuleOptions | undefined>;
    /**
     * Queries for selecting logs which are part of the rule.
     */
    readonly queries: pulumi.Output<outputs.SecurityMonitoringRuleQuery[] | undefined>;
    /**
     * Reference tables for filtering query results.
     */
    readonly referenceTables: pulumi.Output<outputs.SecurityMonitoringRuleReferenceTable[] | undefined>;
    /**
     * Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs in real time on ingested logs.
     */
    readonly schedulingOptions: pulumi.Output<outputs.SecurityMonitoringRuleSchedulingOptions | undefined>;
    /**
     * Queries for selecting logs which are part of the rule.
     */
    readonly signalQueries: pulumi.Output<outputs.SecurityMonitoringRuleSignalQuery[] | undefined>;
    /**
     * Tags for generated signals. Note: if default tags are present at provider level, they will be added to this resource.
     */
    readonly tags: pulumi.Output<string[]>;
    /**
     * Cases for generating signals for third-party rules. Only required and accepted for third-party rules
     */
    readonly thirdPartyCases: pulumi.Output<outputs.SecurityMonitoringRuleThirdPartyCase[] | undefined>;
    /**
     * The rule type. Valid values are `applicationSecurity`, `logDetection`, `workloadSecurity`, `signalCorrelation`. Defaults to `"logDetection"`.
     */
    readonly type: pulumi.Output<string | undefined>;
    /**
     * Whether or not to validate the Rule.
     */
    readonly validate: pulumi.Output<boolean | undefined>;
    /**
     * Create a SecurityMonitoringRule resource with the given unique name, arguments, and options.
     *
     * @param name The _unique_ name of the resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param opts A bag of options that control this resource's behavior.
     */
    constructor(name: string, args: SecurityMonitoringRuleArgs, opts?: pulumi.CustomResourceOptions);
}
/**
 * Input properties used for looking up and filtering SecurityMonitoringRule resources.
 */
export interface SecurityMonitoringRuleState {
    /**
     * One or more calculated fields. Available only for scheduled rules (in other words, when `schedulingOptions` is defined).
     */
    calculatedFields?: pulumi.Input<pulumi.Input<inputs.SecurityMonitoringRuleCalculatedField>[]>;
    /**
     * Cases for generating signals.
     */
    cases?: pulumi.Input<pulumi.Input<inputs.SecurityMonitoringRuleCase>[]>;
    /**
     * Whether the rule is enabled. Defaults to `true`.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Additional queries to filter matched events before they are processed. **Note**: This field is deprecated for log detection, signal correlation, and workload security rules.
     */
    filters?: pulumi.Input<pulumi.Input<inputs.SecurityMonitoringRuleFilter>[]>;
    /**
     * Additional grouping to perform on top of the query grouping.
     */
    groupSignalsBies?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Whether the notifications include the triggering group-by values in their title. Defaults to `false`.
     */
    hasExtendedTitle?: pulumi.Input<boolean>;
    /**
     * Message for generated signals.
     */
    message?: pulumi.Input<string>;
    /**
     * The name of the rule.
     */
    name?: pulumi.Input<string>;
    /**
     * Options on rules.
     */
    options?: pulumi.Input<inputs.SecurityMonitoringRuleOptions>;
    /**
     * Queries for selecting logs which are part of the rule.
     */
    queries?: pulumi.Input<pulumi.Input<inputs.SecurityMonitoringRuleQuery>[]>;
    /**
     * Reference tables for filtering query results.
     */
    referenceTables?: pulumi.Input<pulumi.Input<inputs.SecurityMonitoringRuleReferenceTable>[]>;
    /**
     * Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs in real time on ingested logs.
     */
    schedulingOptions?: pulumi.Input<inputs.SecurityMonitoringRuleSchedulingOptions>;
    /**
     * Queries for selecting logs which are part of the rule.
     */
    signalQueries?: pulumi.Input<pulumi.Input<inputs.SecurityMonitoringRuleSignalQuery>[]>;
    /**
     * Tags for generated signals. Note: if default tags are present at provider level, they will be added to this resource.
     */
    tags?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Cases for generating signals for third-party rules. Only required and accepted for third-party rules
     */
    thirdPartyCases?: pulumi.Input<pulumi.Input<inputs.SecurityMonitoringRuleThirdPartyCase>[]>;
    /**
     * The rule type. Valid values are `applicationSecurity`, `logDetection`, `workloadSecurity`, `signalCorrelation`. Defaults to `"logDetection"`.
     */
    type?: pulumi.Input<string>;
    /**
     * Whether or not to validate the Rule.
     */
    validate?: pulumi.Input<boolean>;
}
/**
 * The set of arguments for constructing a SecurityMonitoringRule resource.
 */
export interface SecurityMonitoringRuleArgs {
    /**
     * One or more calculated fields. Available only for scheduled rules (in other words, when `schedulingOptions` is defined).
     */
    calculatedFields?: pulumi.Input<pulumi.Input<inputs.SecurityMonitoringRuleCalculatedField>[]>;
    /**
     * Cases for generating signals.
     */
    cases?: pulumi.Input<pulumi.Input<inputs.SecurityMonitoringRuleCase>[]>;
    /**
     * Whether the rule is enabled. Defaults to `true`.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Additional queries to filter matched events before they are processed. **Note**: This field is deprecated for log detection, signal correlation, and workload security rules.
     */
    filters?: pulumi.Input<pulumi.Input<inputs.SecurityMonitoringRuleFilter>[]>;
    /**
     * Additional grouping to perform on top of the query grouping.
     */
    groupSignalsBies?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Whether the notifications include the triggering group-by values in their title. Defaults to `false`.
     */
    hasExtendedTitle?: pulumi.Input<boolean>;
    /**
     * Message for generated signals.
     */
    message: pulumi.Input<string>;
    /**
     * The name of the rule.
     */
    name: pulumi.Input<string>;
    /**
     * Options on rules.
     */
    options?: pulumi.Input<inputs.SecurityMonitoringRuleOptions>;
    /**
     * Queries for selecting logs which are part of the rule.
     */
    queries?: pulumi.Input<pulumi.Input<inputs.SecurityMonitoringRuleQuery>[]>;
    /**
     * Reference tables for filtering query results.
     */
    referenceTables?: pulumi.Input<pulumi.Input<inputs.SecurityMonitoringRuleReferenceTable>[]>;
    /**
     * Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs in real time on ingested logs.
     */
    schedulingOptions?: pulumi.Input<inputs.SecurityMonitoringRuleSchedulingOptions>;
    /**
     * Queries for selecting logs which are part of the rule.
     */
    signalQueries?: pulumi.Input<pulumi.Input<inputs.SecurityMonitoringRuleSignalQuery>[]>;
    /**
     * Tags for generated signals. Note: if default tags are present at provider level, they will be added to this resource.
     */
    tags?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Cases for generating signals for third-party rules. Only required and accepted for third-party rules
     */
    thirdPartyCases?: pulumi.Input<pulumi.Input<inputs.SecurityMonitoringRuleThirdPartyCase>[]>;
    /**
     * The rule type. Valid values are `applicationSecurity`, `logDetection`, `workloadSecurity`, `signalCorrelation`. Defaults to `"logDetection"`.
     */
    type?: pulumi.Input<string>;
    /**
     * Whether or not to validate the Rule.
     */
    validate?: pulumi.Input<boolean>;
}