Terraform, AZAPI, Microsoft.SecurityInsights/alertRules, ThreatIntelligence rule

[bisskar]

Terraform, AZAPI, Microsoft.SecurityInsights/alertRules, ThreatIntelligence rule

[bisskar]

I was able to deploy template using following code:

resource "azapi_resource" "PreviewMicrosoftDefenderThreatIntelligenceAnalytics" {            
            type = "Microsoft.SecurityInsights/alertRules@2023-02-01-preview"            
            name = "0dd422ee-e6af-4204-b219-f59ac172e4c6"
            parent_id = var.sentinel_workspace_id
            body = jsonencode({
                    kind = "ThreatIntelligence"
                    properties = {
                         alertRuleTemplateName = "0dd422ee-e6af-4204-b219-f59ac172e4c6"
                         enabled = true
                         severity = "Medium"   
                         tactics = ["Persistence", "LateralMovement"]
                         techniques = []
                         displayName = "(Preview) Microsoft Defender Threat Intelligence Analytics"                                      
                    }
            })
            schema_validation_enabled = false
        }

However, seems that bypassing schema validation is not a way to go, rule is broken, screenshots from "editing"

How it looks:

How it should look:

[bisskar]

Solved, sorry for bothering.

resource "azapi_resource" "PreviewMicrosoftDefenderThreatIntelligenceAnalytics" {            
            type = "Microsoft.SecurityInsights/alertRules@2023-02-01-preview"            
            name = "0dd422ee-e6af-4204-b219-f59ac172e4c6"
            parent_id = var.sentinel_workspace_id
            body = jsonencode({
                    kind = "ThreatIntelligence"
                    properties = {
                         alertRuleTemplateName = "0dd422ee-e6af-4204-b219-f59ac172e4c6"
                         enabled = true                         
                         description = <<EOF
                         This rule generates an alert when a Microsoft Defender Threat Intelligence Indicator gets matched with your event logs. The alerts are very high fidelity.
                         EOF
                         enabled = true                          
                         tactics = ["Persistence", "LateralMovement"]
                         techniques = []
                         displayName = "(Preview) Microsoft Defender Threat Intelligence Analytics"
                         severity = "Medium"
                    }
            })
            schema_validation_enabled = false            
        }
        

[bisskar]

Bypassing schema validation works.

schema_validation_enabled = false