updated cse_outlier_rule example

website/docs/r/cse_outlier_rule.html.markdown

@@ -10,30 +10,37 @@ Provides a Sumo Logic CSE [Outlier Rule](https://help.sumologic.com/docs/cse/rul
 
 ## Example Usage
 ```hcl
-resource "sumologic_cse_first_seen_rule" "first_seen_rule" {
+resource "sumologic_cse_outlier_rule" "outlier_rule" {
+ name = "Spike in Login Failures from a User"
+ enabled = true
+ severity = 4
+ is_prototype = false
+ summary_expression = "Excessive count of failure login events identified for user: {{user_username}} based on daily historic activity"
+
  aggregation_functions {
-  name = "total"
-  function = "count"
-  arguments = ["true"]
+  name = "current" 
+  function = "count"
+  arguments = ["true"]
  }
- baseline_window_size = "1209600000" // 14 days
- description_expression = "Spike in Login Failures - {{ user_username }}"
- enabled = true
+ group_by_fields = ["user_username"]
+
+ window_size = "T24H"
+ baseline_window_size = 604800000 
+ retention_window_size = 7776000000
+
+ floor_value = 10
+
+ name_expression = "Spike in Login Failures from a User"
+ description_expression = "Detects excessive failed login attempts for the same username based on a daily outlier standard deviation for said user. This is designed to catch both slow and quick brute force type attacks using a user specific historic baseline. The minimum floor of failures expected by default is set to 10."
+ match_expression = "objectType = 'Authentication'\nAND normalizedAction = 'logon'\nAND success = false"
+ deviation_threshold = 2
+
  entity_selectors {
  entity_type = "_username"
  expression = "user_username"
  }
- floor_value = 0
- deviation_threshold = 3
- group_by_fields = ["user_username"]
- is_prototype = false
- match_expression = "objectType=\"Authentication\" AND success=false"
- name = "Spike in Login Failures"
- name_expression = "Spike in Login Failures - {{ user_username }}"
- retention_window_size = "7776000000" // 90 days
- severity = 1
- summary_expression = "Spike in Login Failures - {{ user_username }}"
- window_size = "T24H"
+
+ tags = ["_mitreAttackTactic:TA0006", "_mitreAttackTechnique:T1110"]
 }
 ```
 ## Argument Reference