BigQueryExport class

BigQueryExport resource represents the BigQuery export configuration for a Chronicle instance.

To get more information about BigQueryExport, see:

• API documentation
• How-to Guides
• BigQuery Export Overview

Example Usage

Chronicle Bigquery Export Basic

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const example = new gcp.chronicle.BigQueryExport("example", {
    location: "us",
    instance: "00000000-0000-0000-0000-000000000000",
    udmEventsSettings: {
        enabled: true,
        retentionDays: 7,
    },
});

import pulumi
import pulumi_gcp as gcp

example = gcp.chronicle.BigQueryExport("example",
    location="us",
    instance="00000000-0000-0000-0000-000000000000",
    udm_events_settings={
        "enabled": True,
        "retention_days": 7,
    })

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var example = new Gcp.Chronicle.BigQueryExport("example", new()
    {
        Location = "us",
        Instance = "00000000-0000-0000-0000-000000000000",
        UdmEventsSettings = new Gcp.Chronicle.Inputs.BigQueryExportUdmEventsSettingsArgs
        {
            Enabled = true,
            RetentionDays = 7,
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/chronicle"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := chronicle.NewBigQueryExport(ctx, "example", &chronicle.BigQueryExportArgs{
			Location: pulumi.String("us"),
			Instance: pulumi.String("00000000-0000-0000-0000-000000000000"),
			UdmEventsSettings: &chronicle.BigQueryExportUdmEventsSettingsArgs{
				Enabled:       pulumi.Bool(true),
				RetentionDays: pulumi.Int(7),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_chronicle_bigqueryexport" "example" {
  location = "us"
  instance = "00000000-0000-0000-0000-000000000000"
  udm_events_settings = {
    enabled        = true
    retention_days = 7
  }
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.chronicle.BigQueryExport;
import com.pulumi.gcp.chronicle.BigQueryExportArgs;
import com.pulumi.gcp.chronicle.inputs.BigQueryExportUdmEventsSettingsArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new BigQueryExport("example", BigQueryExportArgs.builder()
            .location("us")
            .instance("00000000-0000-0000-0000-000000000000")
            .udmEventsSettings(BigQueryExportUdmEventsSettingsArgs.builder()
                .enabled(true)
                .retentionDays(7)
                .build())
            .build());

    }
}

resources:
  example:
    type: gcp:chronicle:BigQueryExport
    properties:
      location: us
      instance: 00000000-0000-0000-0000-000000000000
      udmEventsSettings:
        enabled: true
        retentionDays: 7

Chronicle Bigquery Export Full

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const example = new gcp.chronicle.BigQueryExport("example", {
    location: "us",
    instance: "00000000-0000-0000-0000-000000000000",
    bigQueryExportPackage: "BIG_QUERY_EXPORT_PACKAGE_BYOBQ",
    udmEventsSettings: {
        enabled: true,
        retentionDays: 7,
    },
    entityGraphSettings: {
        enabled: true,
        retentionDays: 7,
    },
    iocMatchesSettings: {
        enabled: true,
        retentionDays: 7,
    },
    ruleDetectionsSettings: {
        enabled: true,
        retentionDays: 7,
    },
    udmEventsAggregatesSettings: {
        enabled: true,
        retentionDays: 7,
    },
});

import pulumi
import pulumi_gcp as gcp

example = gcp.chronicle.BigQueryExport("example",
    location="us",
    instance="00000000-0000-0000-0000-000000000000",
    big_query_export_package="BIG_QUERY_EXPORT_PACKAGE_BYOBQ",
    udm_events_settings={
        "enabled": True,
        "retention_days": 7,
    },
    entity_graph_settings={
        "enabled": True,
        "retention_days": 7,
    },
    ioc_matches_settings={
        "enabled": True,
        "retention_days": 7,
    },
    rule_detections_settings={
        "enabled": True,
        "retention_days": 7,
    },
    udm_events_aggregates_settings={
        "enabled": True,
        "retention_days": 7,
    })

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var example = new Gcp.Chronicle.BigQueryExport("example", new()
    {
        Location = "us",
        Instance = "00000000-0000-0000-0000-000000000000",
        BigQueryExportPackage = "BIG_QUERY_EXPORT_PACKAGE_BYOBQ",
        UdmEventsSettings = new Gcp.Chronicle.Inputs.BigQueryExportUdmEventsSettingsArgs
        {
            Enabled = true,
            RetentionDays = 7,
        },
        EntityGraphSettings = new Gcp.Chronicle.Inputs.BigQueryExportEntityGraphSettingsArgs
        {
            Enabled = true,
            RetentionDays = 7,
        },
        IocMatchesSettings = new Gcp.Chronicle.Inputs.BigQueryExportIocMatchesSettingsArgs
        {
            Enabled = true,
            RetentionDays = 7,
        },
        RuleDetectionsSettings = new Gcp.Chronicle.Inputs.BigQueryExportRuleDetectionsSettingsArgs
        {
            Enabled = true,
            RetentionDays = 7,
        },
        UdmEventsAggregatesSettings = new Gcp.Chronicle.Inputs.BigQueryExportUdmEventsAggregatesSettingsArgs
        {
            Enabled = true,
            RetentionDays = 7,
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/chronicle"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := chronicle.NewBigQueryExport(ctx, "example", &chronicle.BigQueryExportArgs{
			Location:              pulumi.String("us"),
			Instance:              pulumi.String("00000000-0000-0000-0000-000000000000"),
			BigQueryExportPackage: pulumi.String("BIG_QUERY_EXPORT_PACKAGE_BYOBQ"),
			UdmEventsSettings: &chronicle.BigQueryExportUdmEventsSettingsArgs{
				Enabled:       pulumi.Bool(true),
				RetentionDays: pulumi.Int(7),
			},
			EntityGraphSettings: &chronicle.BigQueryExportEntityGraphSettingsArgs{
				Enabled:       pulumi.Bool(true),
				RetentionDays: pulumi.Int(7),
			},
			IocMatchesSettings: &chronicle.BigQueryExportIocMatchesSettingsArgs{
				Enabled:       pulumi.Bool(true),
				RetentionDays: pulumi.Int(7),
			},
			RuleDetectionsSettings: &chronicle.BigQueryExportRuleDetectionsSettingsArgs{
				Enabled:       pulumi.Bool(true),
				RetentionDays: pulumi.Int(7),
			},
			UdmEventsAggregatesSettings: &chronicle.BigQueryExportUdmEventsAggregatesSettingsArgs{
				Enabled:       pulumi.Bool(true),
				RetentionDays: pulumi.Int(7),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_chronicle_bigqueryexport" "example" {
  location                 = "us"
  instance                 = "00000000-0000-0000-0000-000000000000"
  big_query_export_package = "BIG_QUERY_EXPORT_PACKAGE_BYOBQ"
  udm_events_settings = {
    enabled        = true
    retention_days = 7
  }
  entity_graph_settings = {
    enabled        = true
    retention_days = 7
  }
  ioc_matches_settings = {
    enabled        = true
    retention_days = 7
  }
  rule_detections_settings = {
    enabled        = true
    retention_days = 7
  }
  udm_events_aggregates_settings = {
    enabled        = true
    retention_days = 7
  }
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.chronicle.BigQueryExport;
import com.pulumi.gcp.chronicle.BigQueryExportArgs;
import com.pulumi.gcp.chronicle.inputs.BigQueryExportUdmEventsSettingsArgs;
import com.pulumi.gcp.chronicle.inputs.BigQueryExportEntityGraphSettingsArgs;
import com.pulumi.gcp.chronicle.inputs.BigQueryExportIocMatchesSettingsArgs;
import com.pulumi.gcp.chronicle.inputs.BigQueryExportRuleDetectionsSettingsArgs;
import com.pulumi.gcp.chronicle.inputs.BigQueryExportUdmEventsAggregatesSettingsArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new BigQueryExport("example", BigQueryExportArgs.builder()
            .location("us")
            .instance("00000000-0000-0000-0000-000000000000")
            .bigQueryExportPackage("BIG_QUERY_EXPORT_PACKAGE_BYOBQ")
            .udmEventsSettings(BigQueryExportUdmEventsSettingsArgs.builder()
                .enabled(true)
                .retentionDays(7)
                .build())
            .entityGraphSettings(BigQueryExportEntityGraphSettingsArgs.builder()
                .enabled(true)
                .retentionDays(7)
                .build())
            .iocMatchesSettings(BigQueryExportIocMatchesSettingsArgs.builder()
                .enabled(true)
                .retentionDays(7)
                .build())
            .ruleDetectionsSettings(BigQueryExportRuleDetectionsSettingsArgs.builder()
                .enabled(true)
                .retentionDays(7)
                .build())
            .udmEventsAggregatesSettings(BigQueryExportUdmEventsAggregatesSettingsArgs.builder()
                .enabled(true)
                .retentionDays(7)
                .build())
            .build());

    }
}

resources:
  example:
    type: gcp:chronicle:BigQueryExport
    properties:
      location: us
      instance: 00000000-0000-0000-0000-000000000000
      bigQueryExportPackage: BIG_QUERY_EXPORT_PACKAGE_BYOBQ
      udmEventsSettings:
        enabled: true
        retentionDays: 7
      entityGraphSettings:
        enabled: true
        retentionDays: 7
      iocMatchesSettings:
        enabled: true
        retentionDays: 7
      ruleDetectionsSettings:
        enabled: true
        retentionDays: 7
      udmEventsAggregatesSettings:
        enabled: true
        retentionDays: 7

Import

BigQueryExport can be imported using any of these accepted formats:

• projects/{{project}}/locations/{{location}}/instances/{{instance}}/bigQueryExport
• {{project}}/{{location}}/{{instance}}
• {{location}}/{{instance}}

When using the pulumi import command, BigQueryExport can be imported using one of the formats above. For example:

$ pulumi import gcp:chronicle/bigQueryExport:BigQueryExport default projects/{{project}}/locations/{{location}}/instances/{{instance}}/bigQueryExport
$ pulumi import gcp:chronicle/bigQueryExport:BigQueryExport default {{project}}/{{location}}/{{instance}}
$ pulumi import gcp:chronicle/bigQueryExport:BigQueryExport default {{location}}/{{instance}}

Constructors

BigQueryExport(String name, {BigQueryExportArgs? args, CustomResourceOptions? options})

Creates a new BigQueryExport. name The Pulumi resource name. args Arguments used to configure this BigQueryExport. The set of arguments for BigQueryExport. options Resource options controlling this resource's behavior.

BigQueryExport.reference(String urn)

Creates a typed reference to an existing BigQueryExport resource.

Properties

bigQueryExportPackage ↔ Output<String>

The BigQueryExportPackage entitled for the Chronicle instance. Possible values are: BIG_QUERY_EXPORT_PACKAGE_BYOBQ, BIG_QUERY_EXPORT_PACKAGE_ADVANCED.

late, final

childResources → Set<Resource>

final, inherited

completionSources ↔ Map<String, IOutputCompletionSource>

late, final, inherited

entityGraphSettings ↔ Output<BigQueryExportEntityGraphSettings>

The export settings for a data source. Structure is documented below.

late, final

hashCode → int

The hash code for this object.

no setter, inherited

id ↔ Output<String>

getter/setter pair, inherited

instance ↔ Output<String>

Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.

late, final

iocMatchesSettings ↔ Output<BigQueryExportIocMatchesSettings>

The export settings for a data source. Structure is documented below.

late, final

isCustom → bool

Returns whether this resource is provider-managed.

no setter, inherited

isProtected → bool

Returns whether this resource is protected from deletion.

no setter, inherited

isRemote → bool

Whether this resource is registered as remote.

no setter, inherited

isResourceReference → bool

Whether this instance represents a resource value returned over RPC.

final, inherited

location ↔ Output<String>

Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.

late, final

name ↔ Output<String>

Identifier. The resource name of the BigQueryExport. Format: projects/{project}/locations/{location}/instances/{instance}/bigQueryExport

late, final

project ↔ Output<String>

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

late, final

provisioned ↔ Output<bool>

Whether the BigQueryExport has been provisioned for the Chronicle instance.

late, final

resourceTransforms → List<ResourceTransform>

Inherited/explicit async transforms.

no setter, inherited

ruleDetectionsSettings ↔ Output<BigQueryExportRuleDetectionsSettings>

The export settings for a data source. Structure is documented below.

late, final

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

transformations → List<ResourceTransformation>

Inherited/explicit legacy transformations.

no setter, inherited

udmEventsAggregatesSettings ↔ Output<BigQueryExportUdmEventsAggregatesSettings>

The export settings for a data source. Structure is documented below.

late, final

udmEventsSettings ↔ Output<BigQueryExportUdmEventsSettings>

The export settings for a data source. Structure is documented below.

late, final

urn ↔ Output<String>

late, final, inherited

Methods

failId(Object error) → void

Completes this resource ID with an error when registration fails.

inherited

failOutputs(Object error) → void

Completes all output properties with error.

inherited

failUrn(Object error) → void

Completes this resource URN with an error when registration fails.

inherited

getProvider(String moduleMember) → ProviderResource?

Returns provider for moduleMember's package, if configured.

inherited

getResourceName() → String

Returns this resource's logical name.

inherited

getResourceType() → String

Returns this resource's Pulumi type token.

inherited

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

registerOutput<T>(String propertyName, {Object? decoder(Object?)?, bool isSecret = false}) → Output<T>

Registers a dynamic output property for this resource.

inherited

resolveId(String? value, {required bool isKnown}) → void

Resolves the provider-assigned ID for this resource.

inherited

resolveOutputs(Struct outputs) → void

Resolves all output properties from a monitor response payload.

inherited

resolveUrn(String value) → void

Resolves this resource's URN once assigned by the engine.

inherited

serializeProperties(Map<String, dynamic> properties) → Future<Struct>

Serializes resource properties for RPC transmission.

inherited

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Methods

get(String name, Input<String> id, {BigQueryExportState? state, CustomResourceOptions? options}) → BigQueryExport

Gets an existing BigQueryExport resource's state with the given name and id.