azure_sentinel_alert_rule_templates Resource
Use the azure_sentinel_alert_rule_templates
InSpec audit resource to test the properties related to alert rule templates for a resource group or the entire subscription.
See the Azure alert rule templates documentation
for additional information.
Azure Rest API Version, Endpoint, And HTTP Client Parameters
This resource interacts with API versions supported by the resource provider. The api_version
can be defined as a resource parameter.
If not provided, the latest version will be used. For more information, refer to azure_generic_resource
.
Unless defined, azure_cloud
global endpoint, and default values for the HTTP client will be used. For more information, refer to the resource pack README.
Installation
This resource is available in the Chef InSpec Azure resource pack.
See the Chef InSpec documentation on cloud platforms for information on configuring your Azure environment for InSpec and creating an InSpec profile that uses the InSpec Azure resource pack.
Syntax
An azure_sentinel_alert_rule_templates
resource block returns all Azure alert rule templates, either within a resource group (if provided) or an entire Subscription.
describe azure_sentinel_alert_rule_templates(resource_group: 'RESOURCE_GROUP', workspace_name: 'WORKSPACE_NAME') do
#...
end
resource_group
and workspace_name
are required parameters.
Parameters
resource_group
- Azure resource group where the targeted resource resides.
workspace_name
- Azure workspace Name for which alert rule templates are being retrieved.
Properties
names
- A list of the unique resource names.
Field:
name
ids
- A list of alert rule templates IDs.
Field:
id
properties
- A list of properties for the resource.
Field:
properties
types
- A list of types for each resource.
Field:
type
severities
- The severity for alerts created by this alert rule.
Field:
severity
statuses
- The status of the alert rule.
Field:
status
triggerThresholds
- The user’s email the incident is assigned to.
Field:
triggerThreshold
displayNames
- The user’s principal name the incident is assigned to.
Field:
displayName
triggerOperators
- The user’s name the incident is assigned to.
Field:
triggerOperator
queryPeriods
- The list of period (in ISO 8601 duration format) that this alert rule looks at.
Field:
queryPeriod
queryFrequencies
- The List of frequency (in ISO 8601 duration format) for this alert rule to run.
Field:
queryFrequency
Note
See the documentation on FilterTable for information on using filter criteria on plural resources.
Examples
Test if properties matches.
describe azure_sentinel_alert_rule_templates(resource_group: 'RESOURCE_GROUP', workspace_name: 'WORKSPACE_NAME') do
its('names') { should include 'RESOURCE_NAME' }
its('types') { should include 'Microsoft.SecurityInsights/AlertRuleTemplates' }
its('kinds') { should include 'ALERT_RULE_KIND' }
its('triggerThresholds') { should include INTEGER }
its('statuses') { should include 'STATUS' }
its('severities') { should include 'ALERT_SEVERITY' }
its('queryFrequencies') { should include 'FREQUENCY' }
its('queryPeriods') { should include 'PERIOD' }
its('triggerOperators') { should include 'OPERATOR' }
its('displayNames') { should include 'ALERT_RULE_DISPLAY_NAME' }
end
Test if any alert rule templates exist in the resource group
describe azure_sentinel_alert_rule_templates(resource_group: 'RESOURCE_GROUP', workspace_name: 'WORKSPACE_NAME') do
it { should exist }
end
Test that there aren’t any alert rule templates in a resource group
**Should not exist if no alert rule templates are in the resource group.**
describe azure_sentinel_alert_rule_templates(resource_group: 'RESOURCE_GROUP', workspace_name: 'WORKSPACE_NAME') do
it { should_not exist }
end
Azure Permissions
Your Service Principal must be set up with at least a contributor
role on the subscription you wish to test.
Was this page helpful?