Amazing news with the detection as code!!!
https://medium.com/google-cloud/detection-as-code-in-google-secops-with-terraform-646de8967278
I have a question regarding this, when I'm deploying a rule, I'm getting the following error:
Error: Error creating RuleDeployment: googleapi: Error 409: run frequency already set to RUN_FREQUENCY_REALTIME
The error is referring to these pieces of code:
Main file:
resource "google_chronicle_rule_deployment" "rule_deployment" {
for_each = local.secops_rule_deployment
provider = google-beta
project = var.secops_config.project
location = var.secops_config.location
instance = var.secops_config.instance
rule = google_chronicle_rule.rule[each.key].rule_id
enabled = each.value.enabled
alerting = each.value.alerting
archived = each.value.archived
run_frequency = each.value.run_frequency
}
And secops_rules.yaml:
se_999_rule_test:
enabled: false
alerting: false
archived: false
run_frequency: LIVE
Do you know what could be happening? I'm able to deploy the google_chronicle_rule resource (which means the connection is ok) but not the deployment resource 😞