New Data Source: alicloud_threat_detection_incident, New Data Source: alicloud_threat_detection_incidents - #10403
Open
api-tool-agent wants to merge 1 commit into
Conversation
api-tool-agent
changed the title
api-tool-agent
changed the title
api-tool-agent
force-pushed
the
feature/86382285-threat-detection-incident-datasource
branch
from
September 5, 2026 00:11
35014af to
bf066cd
Compare
…ent data sources Add data sources alicloud_threat_detection_incident and alicloud_threat_detection_incidents to query Threat Detection Incidents from the cloud-siem service (2024-12-12 API). The single data source queries by incident_uuid via GetIncident. The plural data source lists and filters incidents via ListIncidents with pagination support.
api-tool-agent
force-pushed
the
feature/86382285-threat-detection-incident-datasource
branch
from
September 5, 2026 00:35
bf066cd to
56f9257
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR adds two new data sources for querying Threat Detection (Security Center) Incidents:
alicloud_threat_detection_incident— queries a single incident byincident_uuidvia theGetIncidentAPIalicloud_threat_detection_incidents— lists and filters incidents via theListIncidentsAPI with pagination supportThe Incident resource is read-only (category: readonly); the backing APIs (
GetIncident,ListIncidents) are read operations on the cloud-siem service (version 2024-12-12), so they are exposed as data sources rather than managed resources.Fields
Both data sources expose the incident attributes:
incident_uuid,incident_name,incident_description,incident_status,owner,threat_level,threat_score,incident_aggregation_type,incident_tags,incident_remark,attck_tactics,relate_user_ids,relate_data_source_ids,relate_alert_count,relate_asset_count,relate_entity_id,relate_asset_id,alert_uuid,role_type,create_time,update_time,start_time,end_time,response_time,detection_rule_id,lang, andregion_id.The plural data source supports filtering by
incident_status,threat_level,owner,start_time,end_time,incident_name,alert_uuid,relate_asset_id,relate_entity_id,order_field_name,order_direction,role_type,role_for, andlang.Motivation
Threat Detection Incidents were not yet available as Terraform data sources. Users managing security incidents programmatically need to query and list incidents to integrate with their infrastructure-as-code workflows for security monitoring and response automation.
Checklist
provider.gogo vetpasses locally