From eccaba51a9f18166798185eb729d2c7ca5f20eff Mon Sep 17 00:00:00 2001 From: Relkci Date: Wed, 16 Oct 2024 21:28:04 -0600 Subject: [PATCH] test sentinel with obs --- Deploy-LAB/azure-deploy.json | 60 +++--- Deploy-Sentinel/azuredeploy-sentinel.json | 248 +++++++++++----------- 2 files changed, 159 insertions(+), 149 deletions(-) diff --git a/Deploy-LAB/azure-deploy.json b/Deploy-LAB/azure-deploy.json index b6f083a..e2996d2 100644 --- a/Deploy-LAB/azure-deploy.json +++ b/Deploy-LAB/azure-deploy.json @@ -88,39 +88,39 @@ "doremoteaccessmode": "AllowPublicIP" }, "resources": [ -// { -// "name": "Deploy-Sentinel", -// "type": "Microsoft.Resources/deployments", -// "apiVersion": "2020-10-01", -// "properties": { -// "mode": "Incremental", -// "templateLink": { -// "uri": "https://raw.githubusercontent.com/DefensiveOrigins/DO-LAB/main/Deploy-Sentinel/azuredeploy-sentinel.json", -// "contentVersion": "1.0.0.0" -// }, -// "parameters": { -// "workspaceName": { -// "value": "[variables('doworkspaceprefix')]" -// }, -// "pricingTier": { -// "value": "[parameters('pricingTier')]" -// }, -// "dataRetention": { -// "value": "[parameters('dataRetention')]" -// }, -// "immediatePurgeDataOn30Days": { -// "value": "[parameters('doimmediatePurgeDataOn30Days')]" -// } -// } -// } -// }, + { + "name": "Deploy-Sentinel", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "properties": { + "mode": "Incremental", + "templateLink": { + "uri": "https://raw.githubusercontent.com/DefensiveOrigins/DO-LAB/main/Deploy-Sentinel/azuredeploy-sentinel.json", + "contentVersion": "1.0.0.0" + }, + "parameters": { + "workspaceName": { + "value": "[variables('doworkspaceprefix')]" + }, + "pricingTier": { + "value": "[parameters('pricingTier')]" + }, + "dataRetention": { + "value": "[parameters('dataRetention')]" + }, + "immediatePurgeDataOn30Days": { + "value": "[parameters('doimmediatePurgeDataOn30Days')]" + } + } + } + }, { "name": "Deploy-AD", "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", -// "dependsOn": [ -// "Deploy-Sentinel" -// ], + "dependsOn": [ + "Deploy-Sentinel" + ], "properties": { "mode": "Incremental", "templateLink": { @@ -175,7 +175,7 @@ "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", "dependsOn": [ -// "Deploy-Sentinel", + "Deploy-Sentinel", "Deploy-AD" ], "properties": { diff --git a/Deploy-Sentinel/azuredeploy-sentinel.json b/Deploy-Sentinel/azuredeploy-sentinel.json index 933c85c..7f8aef1 100644 --- a/Deploy-Sentinel/azuredeploy-sentinel.json +++ b/Deploy-Sentinel/azuredeploy-sentinel.json @@ -1,126 +1,136 @@ { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "utcValue": { - "type": "string", - "metadata": { - "description": "Returns the current (UTC) datetime value in the specified format. If no format is provided, the ISO 8601 (yyyyMMddTHHmmssZ) format is used" - }, - "defaultValue": "[utcNow()]" - }, - "workspaceName": { - "type": "string", - "metadata": { - "description": "Name for the Log Analytics workspace used to aggregate data" - } - }, - "pricingTier": { - "type": "string", - "metadata": { - "description": "Pricing tier: pergb2018 or legacy tiers (Free, Standalone, PerNode, Standard or Premium) which are not available to all customers." - }, - "allowedValues": [ - "PerGB2018", - "Free", - "Standalone", - "PerNode", - "Standard", - "Premium" - ], - "defaultValue": "PerGB2018" - }, - "dataRetention": { - "type": "int", - "minValue": 7, - "maxValue": 730, - "metadata": { - "description": "Number of days of retention. Workspaces in the legacy Free pricing tier can only have 7 days." - }, - "defaultValue": 30 - }, - "immediatePurgeDataOn30Days": { - "type": "bool", - "metadata": { - "description": "If set to true when changing retention to 30 days, older data will be immediately deleted. Use this with extreme caution. This only applies when retention is being set to 30 days." - }, - "defaultValue": true - }, - "securityCollectionTier": { - "type": "string", - "defaultValue": "Minimal", - "allowedValues": [ - "All", - "Recommended", - "Minimal", - "None" - ], - "metadata": { - "description": "Tier for gathering Windows Security Events." - } - }, - "location": { - "type": "string", - "metadata": { - "description": "Location for all resources." - }, - "defaultValue": "[resourceGroup().location]" - } - }, - "variables": { - "uniqueWorkspace": "[concat(parameters('workspaceName'), uniquestring(resourceGroup().id, parameters('utcValue')))]" - }, - "resources": [ - { - "name": "[variables('uniqueWorkspace')]", - "type": "Microsoft.OperationalInsights/workspaces", - "apiVersion": "2020-08-01", - "location": "[parameters('location')]", - "properties": { - "retentionInDays": "[parameters('dataRetention')]", - "features": { - "immediatePurgeDataOn30Days": "[parameters('immediatePurgeDataOn30Days')]" + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "utcValue": { + "type": "string", + "metadata": { + "description": "Returns the current (UTC) datetime value in the specified format. If no format is provided, the ISO 8601 (yyyyMMddTHHmmssZ) format is used" + }, + "defaultValue": "[utcNow()]" + }, + "workspaceName": { + "type": "string", + "metadata": { + "description": "Name for the Log Analytics workspace used to aggregate data" + } + }, + "pricingTier": { + "type": "string", + "metadata": { + "description": "Pricing tier: pergb2018 or legacy tiers (Free, Standalone, PerNode, Standard or Premium) which are not available to all customers." + }, + "allowedValues": [ + "PerGB2018", + "Free", + "Standalone", + "PerNode", + "Standard", + "Premium" + ], + "defaultValue": "PerGB2018" + }, + "dataRetention": { + "type": "int", + "minValue": 7, + "maxValue": 730, + "metadata": { + "description": "Number of days of retention. Workspaces in the legacy Free pricing tier can only have 7 days." + }, + "defaultValue": 30 + }, + "immediatePurgeDataOn30Days": { + "type": "bool", + "metadata": { + "description": "If set to true when changing retention to 30 days, older data will be immediately deleted. Use this with extreme caution. This only applies when retention is being set to 30 days." + }, + "defaultValue": true + }, + "securityCollectionTier": { + "type": "string", + "defaultValue": "Minimal", + "allowedValues": [ + "All", + "Recommended", + "Minimal", + "None" + ], + "metadata": { + "description": "Tier for gathering Windows Security Events." + } }, - "sku": { - "name": "[parameters('pricingTier')]" + "location": { + "type": "string", + "metadata": { + "description": "Location for all resources." + }, + "defaultValue": "[resourceGroup().location]" } - } }, - { - "name": "[concat('SecurityInsights','(', variables('uniqueWorkspace'),')')]", - "type": "Microsoft.OperationsManagement/solutions", - "apiVersion": "2015-11-01-preview", - "location": "[parameters('location')]", - "dependsOn": [ - "[resourceId('Microsoft.OperationalInsights/workspaces/', variables('uniqueWorkspace'))]" - ], - "properties": { - "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', variables('uniqueWorkspace'))]" - }, - "plan": { - "name": "[concat('SecurityInsights','(', variables('uniqueWorkspace'),')')]", - "product": "OMSGallery/SecurityInsights", - "publisher": "Microsoft", - "promotionCode": "" - } - } - ], - "outputs": { - "workspaceName": { - "type": "string", - "value": "[variables('uniqueWorkspace')]" - }, - "workspaceIdOutput": { - "type": "string", - "value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces/', variables('uniqueWorkspace')), '2015-11-01-preview').customerId]" - }, - "workspaceKeyOutput": { - "type": "string", - "value": "[listKeys(resourceId('Microsoft.OperationalInsights/workspaces/', variables('uniqueWorkspace')), '2015-11-01-preview').primarySharedKey]" + "variables": { + "uniqueWorkspace": "[concat(parameters('workspaceName'), uniquestring(resourceGroup().id, parameters('utcValue')))]" }, - "workspaceResourceIdOutput": { - "type": "string", - "value": "[resourceId('Microsoft.OperationalInsights/workspaces/', variables('uniqueWorkspace'))]" + "resources": [ + { + "name": "[variables('uniqueWorkspace')]", + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2020-08-01", + "location": "[parameters('location')]", + "properties": { + "retentionInDays": "[parameters('dataRetention')]", + "features": { + "immediatePurgeDataOn30Days": "[parameters('immediatePurgeDataOn30Days')]" + }, + "sku": { + "name": "[parameters('pricingTier')]" + } + } + }, + { + "name": "[concat(variables('uniqueWorkspace'),'/Microsoft.SecurityInsights/default')]", + "type": "Microsoft.OperationalInsights/workspaces/providers/onboardingStates", + "apiVersion": "2021-03-01-preview", + "properties": { + }, + "dependsOn": [ + "[resourceId('Microsoft.OperationalInsights/workspaces', variables('uniqueWorkspace'))]" + ] + }, + { + "name": "[concat('SecurityInsights','(', variables('uniqueWorkspace'),')')]", + "type": "Microsoft.OperationsManagement/solutions", + "apiVersion": "2015-11-01-preview", + "location": "[parameters('location')]", + "dependsOn": [ + "[resourceId('Microsoft.OperationalInsights/workspaces/', variables('uniqueWorkspace'))]" + ], + "properties": { + "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', variables('uniqueWorkspace'))]" + }, + "plan": { + "name": "[concat('SecurityInsights','(', variables('uniqueWorkspace'),')')]", + "product": "OMSGallery/SecurityInsights", + "publisher": "Microsoft", + "promotionCode": "" + } + } + ], + "outputs": { + "workspaceName": { + "type": "string", + "value": "[variables('uniqueWorkspace')]" + }, + "workspaceIdOutput": { + "type": "string", + "value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces/', variables('uniqueWorkspace')), '2015-11-01-preview').customerId]" + }, + "workspaceKeyOutput": { + "type": "string", + "value": "[listKeys(resourceId('Microsoft.OperationalInsights/workspaces/', variables('uniqueWorkspace')), '2015-11-01-preview').primarySharedKey]" + }, + "workspaceResourceIdOutput": { + "type": "string", + "value": "[resourceId('Microsoft.OperationalInsights/workspaces/', variables('uniqueWorkspace'))]" + } } - } } \ No newline at end of file