FindingsRefinement class

Represents a set of logic conditions used to refine various types of findings such as curated rule detections.

To get more information about FindingsRefinement, see:

• API documentation
• How-to Guides
• Google SecOps Guides

Example Usage

Chronicle Findings Refinement Basic

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const findingsRefinementExample = new gcp.chronicle.FindingsRefinement("findings_refinement_example", {
    location: "us",
    instance: "00000000-0000-0000-0000-000000000000",
    displayName: "findings_refinement_display_name",
    type: "DETECTION_EXCLUSION",
    query: "network.dns.response = true",
    outcomeFilters: [{
        outcomeVariable: "risk_score",
        outcomeFilterOperator: "EQUAL",
        outcomeValue: "value",
    }],
});

import pulumi
import pulumi_gcp as gcp

findings_refinement_example = gcp.chronicle.FindingsRefinement("findings_refinement_example",
    location="us",
    instance="00000000-0000-0000-0000-000000000000",
    display_name="findings_refinement_display_name",
    type="DETECTION_EXCLUSION",
    query="network.dns.response = true",
    outcome_filters=[{
        "outcome_variable": "risk_score",
        "outcome_filter_operator": "EQUAL",
        "outcome_value": "value",
    }])

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var findingsRefinementExample = new Gcp.Chronicle.FindingsRefinement("findings_refinement_example", new()
    {
        Location = "us",
        Instance = "00000000-0000-0000-0000-000000000000",
        DisplayName = "findings_refinement_display_name",
        Type = "DETECTION_EXCLUSION",
        Query = "network.dns.response = true",
        OutcomeFilters = new[]
        {
            new Gcp.Chronicle.Inputs.FindingsRefinementOutcomeFilterArgs
            {
                OutcomeVariable = "risk_score",
                OutcomeFilterOperator = "EQUAL",
                OutcomeValue = "value",
            },
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/chronicle"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := chronicle.NewFindingsRefinement(ctx, "findings_refinement_example", &chronicle.FindingsRefinementArgs{
			Location:    pulumi.String("us"),
			Instance:    pulumi.String("00000000-0000-0000-0000-000000000000"),
			DisplayName: pulumi.String("findings_refinement_display_name"),
			Type:        pulumi.String("DETECTION_EXCLUSION"),
			Query:       pulumi.String("network.dns.response = true"),
			OutcomeFilters: chronicle.FindingsRefinementOutcomeFilterArray{
				&chronicle.FindingsRefinementOutcomeFilterArgs{
					OutcomeVariable:       pulumi.String("risk_score"),
					OutcomeFilterOperator: pulumi.String("EQUAL"),
					OutcomeValue:          pulumi.String("value"),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_chronicle_findingsrefinement" "findings_refinement_example" {
  location     = "us"
  instance     = "00000000-0000-0000-0000-000000000000"
  display_name = "findings_refinement_display_name"
  type         = "DETECTION_EXCLUSION"
  query        = "network.dns.response = true"
  outcome_filters {
    outcome_variable        = "risk_score"
    outcome_filter_operator = "EQUAL"
    outcome_value           = "value"
  }
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.chronicle.FindingsRefinement;
import com.pulumi.gcp.chronicle.FindingsRefinementArgs;
import com.pulumi.gcp.chronicle.inputs.FindingsRefinementOutcomeFilterArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var findingsRefinementExample = new FindingsRefinement("findingsRefinementExample", FindingsRefinementArgs.builder()
            .location("us")
            .instance("00000000-0000-0000-0000-000000000000")
            .displayName("findings_refinement_display_name")
            .type("DETECTION_EXCLUSION")
            .query("network.dns.response = true")
            .outcomeFilters(FindingsRefinementOutcomeFilterArgs.builder()
                .outcomeVariable("risk_score")
                .outcomeFilterOperator("EQUAL")
                .outcomeValue("value")
                .build())
            .build());

    }
}

resources:
  findingsRefinementExample:
    type: gcp:chronicle:FindingsRefinement
    name: findings_refinement_example
    properties:
      location: us
      instance: 00000000-0000-0000-0000-000000000000
      displayName: findings_refinement_display_name
      type: DETECTION_EXCLUSION
      query: network.dns.response = true
      outcomeFilters:
        - outcomeVariable: risk_score
          outcomeFilterOperator: EQUAL
          outcomeValue: value

Chronicle Findings Refinement Full

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const findingsRefinementExample = new gcp.chronicle.FindingsRefinement("findings_refinement_example", {
    location: "us",
    instance: "00000000-0000-0000-0000-000000000000",
    displayName: "findings_refinement_display_name",
    type: "DETECTION_EXCLUSION",
    query: "network.dns.response = true",
    outcomeFilters: [{
        outcomeVariable: "network.dns.response = true",
        outcomeFilterOperator: "EQUAL",
        outcomeValue: "value1",
    }],
});

import pulumi
import pulumi_gcp as gcp

findings_refinement_example = gcp.chronicle.FindingsRefinement("findings_refinement_example",
    location="us",
    instance="00000000-0000-0000-0000-000000000000",
    display_name="findings_refinement_display_name",
    type="DETECTION_EXCLUSION",
    query="network.dns.response = true",
    outcome_filters=[{
        "outcome_variable": "network.dns.response = true",
        "outcome_filter_operator": "EQUAL",
        "outcome_value": "value1",
    }])

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var findingsRefinementExample = new Gcp.Chronicle.FindingsRefinement("findings_refinement_example", new()
    {
        Location = "us",
        Instance = "00000000-0000-0000-0000-000000000000",
        DisplayName = "findings_refinement_display_name",
        Type = "DETECTION_EXCLUSION",
        Query = "network.dns.response = true",
        OutcomeFilters = new[]
        {
            new Gcp.Chronicle.Inputs.FindingsRefinementOutcomeFilterArgs
            {
                OutcomeVariable = "network.dns.response = true",
                OutcomeFilterOperator = "EQUAL",
                OutcomeValue = "value1",
            },
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/chronicle"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := chronicle.NewFindingsRefinement(ctx, "findings_refinement_example", &chronicle.FindingsRefinementArgs{
			Location:    pulumi.String("us"),
			Instance:    pulumi.String("00000000-0000-0000-0000-000000000000"),
			DisplayName: pulumi.String("findings_refinement_display_name"),
			Type:        pulumi.String("DETECTION_EXCLUSION"),
			Query:       pulumi.String("network.dns.response = true"),
			OutcomeFilters: chronicle.FindingsRefinementOutcomeFilterArray{
				&chronicle.FindingsRefinementOutcomeFilterArgs{
					OutcomeVariable:       pulumi.String("network.dns.response = true"),
					OutcomeFilterOperator: pulumi.String("EQUAL"),
					OutcomeValue:          pulumi.String("value1"),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_chronicle_findingsrefinement" "findings_refinement_example" {
  location     = "us"
  instance     = "00000000-0000-0000-0000-000000000000"
  display_name = "findings_refinement_display_name"
  type         = "DETECTION_EXCLUSION"
  query        = "network.dns.response = true"
  outcome_filters {
    outcome_variable        = "network.dns.response = true"
    outcome_filter_operator = "EQUAL"
    outcome_value           = "value1"
  }
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.chronicle.FindingsRefinement;
import com.pulumi.gcp.chronicle.FindingsRefinementArgs;
import com.pulumi.gcp.chronicle.inputs.FindingsRefinementOutcomeFilterArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var findingsRefinementExample = new FindingsRefinement("findingsRefinementExample", FindingsRefinementArgs.builder()
            .location("us")
            .instance("00000000-0000-0000-0000-000000000000")
            .displayName("findings_refinement_display_name")
            .type("DETECTION_EXCLUSION")
            .query("network.dns.response = true")
            .outcomeFilters(FindingsRefinementOutcomeFilterArgs.builder()
                .outcomeVariable("network.dns.response = true")
                .outcomeFilterOperator("EQUAL")
                .outcomeValue("value1")
                .build())
            .build());

    }
}

resources:
  findingsRefinementExample:
    type: gcp:chronicle:FindingsRefinement
    name: findings_refinement_example
    properties:
      location: us
      instance: 00000000-0000-0000-0000-000000000000
      displayName: findings_refinement_display_name
      type: DETECTION_EXCLUSION
      query: network.dns.response = true
      outcomeFilters:
        - outcomeVariable: network.dns.response = true
          outcomeFilterOperator: EQUAL
          outcomeValue: value1

Import

FindingsRefinement can be imported using any of these accepted formats:

• projects/{{project}}/locations/{{location}}/instances/{{instance}}/findingsRefinements/{{name}}
• {{project}}/{{location}}/{{instance}}/{{name}}
• {{location}}/{{instance}}/{{name}}

When using the pulumi import command, FindingsRefinement can be imported using one of the formats above. For example:

$ pulumi import gcp:chronicle/findingsRefinement:FindingsRefinement default projects/{{project}}/locations/{{location}}/instances/{{instance}}/findingsRefinements/{{name}}
$ pulumi import gcp:chronicle/findingsRefinement:FindingsRefinement default {{project}}/{{location}}/{{instance}}/{{name}}
$ pulumi import gcp:chronicle/findingsRefinement:FindingsRefinement default {{location}}/{{instance}}/{{name}}

Constructors

FindingsRefinement(String name, {FindingsRefinementArgs? args, CustomResourceOptions? options})

Creates a new FindingsRefinement. name The Pulumi resource name. args Arguments used to configure this FindingsRefinement. The set of arguments for FindingsRefinement. options Resource options controlling this resource's behavior.

FindingsRefinement.reference(String urn)

Creates a typed reference to an existing FindingsRefinement resource.

Properties

childResources → Set<Resource>

final, inherited

completionSources ↔ Map<String, IOutputCompletionSource>

late, final, inherited

createTime ↔ Output<String>

The timestamp of when the findings refinement was created.

late, final

displayName ↔ Output<String?>

Display name of the findings refinement.

late, final

hashCode → int

The hash code for this object.

no setter, inherited

id ↔ Output<String>

getter/setter pair, inherited

instance ↔ Output<String>

Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.

late, final

isCustom → bool

Returns whether this resource is provider-managed.

no setter, inherited

isProtected → bool

Returns whether this resource is protected from deletion.

no setter, inherited

isRemote → bool

Whether this resource is registered as remote.

no setter, inherited

isResourceReference → bool

Whether this instance represents a resource value returned over RPC.

final, inherited

location ↔ Output<String>

Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.

late, final

name ↔ Output<String>

Full resource name for the findings refinement. Format: projects/{project}/locations/{location}/instances/{instance}/findingsRefinements/{findings_refinement}

late, final

outcomeFilters ↔ Output<List<FindingsRefinementOutcomeFilter>?>

The outcome filters for the findings refinement. These allow you to specify filters that are applied to the outcome variables in the detection. All filters must be true for a detection to match the findings refinement. Structure is documented below.

late, final

project ↔ Output<String>

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

late, final

query ↔ Output<String?>

The query for the findings refinement. Works in conjunction with the type field to determine the findings refinement behavior. The syntax of this query is the same as a UDM search string. See the following for more information: https://cloud.google.com/chronicle/docs/investigation/udm-search

late, final

resourceTransforms → List<ResourceTransform>

Inherited/explicit async transforms.

no setter, inherited

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

transformations → List<ResourceTransformation>

Inherited/explicit legacy transformations.

no setter, inherited

type ↔ Output<String?>

DETECTION_EXCLUSION is the only supported type of findings refinement. Possible values: DETECTION_EXCLUSION

late, final

updateTime ↔ Output<String>

The timestamp of when the findings refinement was last updated.

late, final

urn ↔ Output<String>

late, final, inherited

Methods

failId(Object error) → void

Completes this resource ID with an error when registration fails.

inherited

failOutputs(Object error) → void

Completes all output properties with error.

inherited

failUrn(Object error) → void

Completes this resource URN with an error when registration fails.

inherited

getProvider(String moduleMember) → ProviderResource?

Returns provider for moduleMember's package, if configured.

inherited

getResourceName() → String

Returns this resource's logical name.

inherited

getResourceType() → String

Returns this resource's Pulumi type token.

inherited

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

registerOutput<T>(String propertyName, {Object? decoder(Object?)?, bool isSecret = false}) → Output<T>

Registers a dynamic output property for this resource.

inherited

resolveId(String? value, {required bool isKnown}) → void

Resolves the provider-assigned ID for this resource.

inherited

resolveOutputs(Struct outputs) → void

Resolves all output properties from a monitor response payload.

inherited

resolveUrn(String value) → void

Resolves this resource's URN once assigned by the engine.

inherited

serializeProperties(Map<String, dynamic> properties) → Future<Struct>

Serializes resource properties for RPC transmission.

inherited

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Methods

get(String name, Input<String> id, {FindingsRefinementState? state, CustomResourceOptions? options}) → FindingsRefinement

Gets an existing FindingsRefinement resource's state with the given name and id.