azurermSentinelDataConnectorThreatIntelligenceTaxii
Manages an Threat Intelligence TAXII Data Connector.
Example Usage
/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as azurerm from "./.gen/providers/azurerm";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: azurerm.
For a more precise conversion please use the --provider flag in convert.*/
const azurermResourceGroupExample = new azurerm.resourceGroup.ResourceGroup(
this,
"example",
{
location: "West Europe",
name: "example-rg",
}
);
const azurermLogAnalyticsWorkspaceExample =
new azurerm.logAnalyticsWorkspace.LogAnalyticsWorkspace(this, "example_1", {
location: azurermResourceGroupExample.location,
name: "example-workspace",
resource_group_name: azurermResourceGroupExample.name,
sku: "PerGB2018",
});
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermLogAnalyticsWorkspaceExample.overrideLogicalId("example");
const azurermSentinelLogAnalyticsWorkspaceOnboardingExample =
new azurerm.sentinelLogAnalyticsWorkspaceOnboarding.SentinelLogAnalyticsWorkspaceOnboarding(
this,
"example_2",
{
workspace_id: azurermLogAnalyticsWorkspaceExample.id,
}
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermSentinelLogAnalyticsWorkspaceOnboardingExample.overrideLogicalId(
"example"
);
const azurermSentinelDataConnectorThreatIntelligenceTaxiiExample =
new azurerm.sentinelDataConnectorThreatIntelligenceTaxii.SentinelDataConnectorThreatIntelligenceTaxii(
this,
"example_3",
{
api_root_url: "https://foo/taxii2/api2/",
collection_id: "someid",
display_name: "example",
log_analytics_workspace_id:
azurermSentinelLogAnalyticsWorkspaceOnboardingExample.workspaceId,
name: "example",
}
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermSentinelDataConnectorThreatIntelligenceTaxiiExample.overrideLogicalId(
"example"
);
Arguments Reference
The following arguments are supported:
-
logAnalyticsWorkspaceId- (Required) The ID of the Log Analytics Workspace that this Threat Intelligence TAXII Data Connector resides in. Changing this forces a new Threat Intelligence TAXII Data Connector to be created. -
name- (Required) The name which should be used for this Threat Intelligence TAXII Data Connector. Changing this forces a new Threat Intelligence TAXII Data Connector to be created. -
displayName- (Required) The friendly name which should be used for this Threat Intelligence TAXII Data Connector. -
apiRootUrl- (Required) The API root URI of the TAXII server. -
collectionId- (Required) The collection ID of the TAXII server. -
userName- (Optional) The user name for the TAXII server. -
password- (Optional) The password for the TAXII server. -
pollingFrequency- (Optional) The polling frequency for the TAXII server. Possible values areonceAMinute,onceAnHourandonceADay. Defaults toonceAnHour. -
lookbackDate- (Optional) The lookback date for the TAXII server in RFC3339. Defaults to19700101T00:00:00Z.
tenantId- (Optional) The ID of the tenant that this Threat Intelligence TAXII Data Connector connects to. Changing this forces a new Threat Intelligence TAXII Data Connector to be created.
-> NOTE Currently, only the same tenant as the running account is allowed. Cross-tenant scenario is not supported yet.
Attributes Reference
In addition to the Arguments listed above - the following Attributes are exported:
id- The ID of the Threat Intelligence TAXII Data Connector.
Timeouts
The timeouts block allows you to specify timeouts for certain actions:
create- (Defaults to 30 minutes) Used when creating the Threat Intelligence TAXII Data Connector.read- (Defaults to 5 minutes) Used when retrieving the Threat Intelligence TAXII Data Connector.delete- (Defaults to 30 minutes) Used when deleting the Threat Intelligence TAXII Data Connector.update- (Defaults to 30 minutes) Used when updating the Sentinel Data Connector Threat Intelligence Taxii.
Import
Threat Intelligence TAXII Data Connectors can be imported using the resourceId, e.g.