Skip to content

Commit

Permalink
test sentinel with obs
Browse files Browse the repository at this point in the history
  • Loading branch information
@Relkci
Relkci committed Oct 17, 2024
1 parent 0cbe6ee commit eccaba5
Show file tree
Hide file tree
Showing 2 changed files with 159 additions and 149 deletions.
60 changes: 30 additions & 30 deletions Deploy-LAB/azure-deploy.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -88,39 +88,39 @@
"doremoteaccessmode": "AllowPublicIP"
},
"resources": [
// {
// "name": "Deploy-Sentinel",
// "type": "Microsoft.Resources/deployments",
// "apiVersion": "2020-10-01",
// "properties": {
// "mode": "Incremental",
// "templateLink": {
// "uri": "https://raw.githubusercontent.com/DefensiveOrigins/DO-LAB/main/Deploy-Sentinel/azuredeploy-sentinel.json",
// "contentVersion": "1.0.0.0"
// },
// "parameters": {
// "workspaceName": {
// "value": "[variables('doworkspaceprefix')]"
// },
// "pricingTier": {
// "value": "[parameters('pricingTier')]"
// },
// "dataRetention": {
// "value": "[parameters('dataRetention')]"
// },
// "immediatePurgeDataOn30Days": {
// "value": "[parameters('doimmediatePurgeDataOn30Days')]"
// }
// }
// }
// },
{
"name": "Deploy-Sentinel",
"type": "Microsoft.Resources/deployments",
"apiVersion": "2020-10-01",
"properties": {
"mode": "Incremental",
"templateLink": {
"uri": "https://raw.githubusercontent.com/DefensiveOrigins/DO-LAB/main/Deploy-Sentinel/azuredeploy-sentinel.json",
"contentVersion": "1.0.0.0"
},
"parameters": {
"workspaceName": {
"value": "[variables('doworkspaceprefix')]"
},
"pricingTier": {
"value": "[parameters('pricingTier')]"
},
"dataRetention": {
"value": "[parameters('dataRetention')]"
},
"immediatePurgeDataOn30Days": {
"value": "[parameters('doimmediatePurgeDataOn30Days')]"
}
}
}
},
{
"name": "Deploy-AD",
"type": "Microsoft.Resources/deployments",
"apiVersion": "2020-10-01",
// "dependsOn": [
// "Deploy-Sentinel"
// ],
"dependsOn": [
"Deploy-Sentinel"
],
"properties": {
"mode": "Incremental",
"templateLink": {
Expand Down Expand Up @@ -175,7 +175,7 @@
"type": "Microsoft.Resources/deployments",
"apiVersion": "2020-10-01",
"dependsOn": [
// "Deploy-Sentinel",
"Deploy-Sentinel",
"Deploy-AD"
],
"properties": {
Expand Down
248 changes: 129 additions & 119 deletions Deploy-Sentinel/azuredeploy-sentinel.json
View file
Original file line number Diff line number Diff line change
@@ -1,126 +1,136 @@
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"utcValue": {
"type": "string",
"metadata": {
"description": "Returns the current (UTC) datetime value in the specified format. If no format is provided, the ISO 8601 (yyyyMMddTHHmmssZ) format is used"
},
"defaultValue": "[utcNow()]"
},
"workspaceName": {
"type": "string",
"metadata": {
"description": "Name for the Log Analytics workspace used to aggregate data"
}
},
"pricingTier": {
"type": "string",
"metadata": {
"description": "Pricing tier: pergb2018 or legacy tiers (Free, Standalone, PerNode, Standard or Premium) which are not available to all customers."
},
"allowedValues": [
"PerGB2018",
"Free",
"Standalone",
"PerNode",
"Standard",
"Premium"
],
"defaultValue": "PerGB2018"
},
"dataRetention": {
"type": "int",
"minValue": 7,
"maxValue": 730,
"metadata": {
"description": "Number of days of retention. Workspaces in the legacy Free pricing tier can only have 7 days."
},
"defaultValue": 30
},
"immediatePurgeDataOn30Days": {
"type": "bool",
"metadata": {
"description": "If set to true when changing retention to 30 days, older data will be immediately deleted. Use this with extreme caution. This only applies when retention is being set to 30 days."
},
"defaultValue": true
},
"securityCollectionTier": {
"type": "string",
"defaultValue": "Minimal",
"allowedValues": [
"All",
"Recommended",
"Minimal",
"None"
],
"metadata": {
"description": "Tier for gathering Windows Security Events."
}
},
"location": {
"type": "string",
"metadata": {
"description": "Location for all resources."
},
"defaultValue": "[resourceGroup().location]"
}
},
"variables": {
"uniqueWorkspace": "[concat(parameters('workspaceName'), uniquestring(resourceGroup().id, parameters('utcValue')))]"
},
"resources": [
{
"name": "[variables('uniqueWorkspace')]",
"type": "Microsoft.OperationalInsights/workspaces",
"apiVersion": "2020-08-01",
"location": "[parameters('location')]",
"properties": {
"retentionInDays": "[parameters('dataRetention')]",
"features": {
"immediatePurgeDataOn30Days": "[parameters('immediatePurgeDataOn30Days')]"
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"utcValue": {
"type": "string",
"metadata": {
"description": "Returns the current (UTC) datetime value in the specified format. If no format is provided, the ISO 8601 (yyyyMMddTHHmmssZ) format is used"
},
"defaultValue": "[utcNow()]"
},
"workspaceName": {
"type": "string",
"metadata": {
"description": "Name for the Log Analytics workspace used to aggregate data"
}
},
"pricingTier": {
"type": "string",
"metadata": {
"description": "Pricing tier: pergb2018 or legacy tiers (Free, Standalone, PerNode, Standard or Premium) which are not available to all customers."
},
"allowedValues": [
"PerGB2018",
"Free",
"Standalone",
"PerNode",
"Standard",
"Premium"
],
"defaultValue": "PerGB2018"
},
"dataRetention": {
"type": "int",
"minValue": 7,
"maxValue": 730,
"metadata": {
"description": "Number of days of retention. Workspaces in the legacy Free pricing tier can only have 7 days."
},
"defaultValue": 30
},
"immediatePurgeDataOn30Days": {
"type": "bool",
"metadata": {
"description": "If set to true when changing retention to 30 days, older data will be immediately deleted. Use this with extreme caution. This only applies when retention is being set to 30 days."
},
"defaultValue": true
},
"securityCollectionTier": {
"type": "string",
"defaultValue": "Minimal",
"allowedValues": [
"All",
"Recommended",
"Minimal",
"None"
],
"metadata": {
"description": "Tier for gathering Windows Security Events."
}
},
"sku": {
"name": "[parameters('pricingTier')]"
"location": {
"type": "string",
"metadata": {
"description": "Location for all resources."
},
"defaultValue": "[resourceGroup().location]"
}
}
},
{
"name": "[concat('SecurityInsights','(', variables('uniqueWorkspace'),')')]",
"type": "Microsoft.OperationsManagement/solutions",
"apiVersion": "2015-11-01-preview",
"location": "[parameters('location')]",
"dependsOn": [
"[resourceId('Microsoft.OperationalInsights/workspaces/', variables('uniqueWorkspace'))]"
],
"properties": {
"workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', variables('uniqueWorkspace'))]"
},
"plan": {
"name": "[concat('SecurityInsights','(', variables('uniqueWorkspace'),')')]",
"product": "OMSGallery/SecurityInsights",
"publisher": "Microsoft",
"promotionCode": ""
}
}
],
"outputs": {
"workspaceName": {
"type": "string",
"value": "[variables('uniqueWorkspace')]"
},
"workspaceIdOutput": {
"type": "string",
"value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces/', variables('uniqueWorkspace')), '2015-11-01-preview').customerId]"
},
"workspaceKeyOutput": {
"type": "string",
"value": "[listKeys(resourceId('Microsoft.OperationalInsights/workspaces/', variables('uniqueWorkspace')), '2015-11-01-preview').primarySharedKey]"
"variables": {
"uniqueWorkspace": "[concat(parameters('workspaceName'), uniquestring(resourceGroup().id, parameters('utcValue')))]"
},
"workspaceResourceIdOutput": {
"type": "string",
"value": "[resourceId('Microsoft.OperationalInsights/workspaces/', variables('uniqueWorkspace'))]"
"resources": [
{
"name": "[variables('uniqueWorkspace')]",
"type": "Microsoft.OperationalInsights/workspaces",
"apiVersion": "2020-08-01",
"location": "[parameters('location')]",
"properties": {
"retentionInDays": "[parameters('dataRetention')]",
"features": {
"immediatePurgeDataOn30Days": "[parameters('immediatePurgeDataOn30Days')]"
},
"sku": {
"name": "[parameters('pricingTier')]"
}
}
},
{
"name": "[concat(variables('uniqueWorkspace'),'/Microsoft.SecurityInsights/default')]",
"type": "Microsoft.OperationalInsights/workspaces/providers/onboardingStates",
"apiVersion": "2021-03-01-preview",
"properties": {
},
"dependsOn": [
"[resourceId('Microsoft.OperationalInsights/workspaces', variables('uniqueWorkspace'))]"
]
},
{
"name": "[concat('SecurityInsights','(', variables('uniqueWorkspace'),')')]",
"type": "Microsoft.OperationsManagement/solutions",
"apiVersion": "2015-11-01-preview",
"location": "[parameters('location')]",
"dependsOn": [
"[resourceId('Microsoft.OperationalInsights/workspaces/', variables('uniqueWorkspace'))]"
],
"properties": {
"workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', variables('uniqueWorkspace'))]"
},
"plan": {
"name": "[concat('SecurityInsights','(', variables('uniqueWorkspace'),')')]",
"product": "OMSGallery/SecurityInsights",
"publisher": "Microsoft",
"promotionCode": ""
}
}
],
"outputs": {
"workspaceName": {
"type": "string",
"value": "[variables('uniqueWorkspace')]"
},
"workspaceIdOutput": {
"type": "string",
"value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces/', variables('uniqueWorkspace')), '2015-11-01-preview').customerId]"
},
"workspaceKeyOutput": {
"type": "string",
"value": "[listKeys(resourceId('Microsoft.OperationalInsights/workspaces/', variables('uniqueWorkspace')), '2015-11-01-preview').primarySharedKey]"
},
"workspaceResourceIdOutput": {
"type": "string",
"value": "[resourceId('Microsoft.OperationalInsights/workspaces/', variables('uniqueWorkspace'))]"
}
}
}
}

0 comments on commit eccaba5

Please sign in to comment.