{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "author": "Microsoft - support@microsoft.com",
    "comments": "Solution template for CustomLogsAma"
  },
  "parameters": {
    "location": {
      "type": "string",
      "minLength": 1,
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`.  We instead use the `workspace-location` which is derived from the LA workspace"
      }
    },
    "workspace-location": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"
      }
    },
    "workspace": {
      "defaultValue": "",
      "type": "string",
      "metadata": {
        "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
      }
    }
  },
  "variables": {
    "email": "support@microsoft.com",
    "_email": "[variables('email')]",
    "_solutionName": "CustomLogsAma",
    "_solutionVersion": "3.0.0",
    "solutionId": "azuresentinel.azure-sentinel-solution-customlogsviaama",
    "_solutionId": "[variables('solutionId')]",
    "uiConfigId1": "CustomLogsAma",
    "_uiConfigId1": "[variables('uiConfigId1')]",
    "dataConnectorContentId1": "CustomLogsAma",
    "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]",
    "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentId1'))]",
    "_dataConnectorId1": "[variables('dataConnectorId1')]",
    "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]",
    "dataConnectorVersion1": "1.0.0",
    "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]",
    "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
  },
  "resources": [
    {
      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
      "apiVersion": "2023-04-01-preview",
      "name": "[variables('dataConnectorTemplateSpecName1')]",
      "location": "[parameters('workspace-location')]",
      "dependsOn": [
        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
      ],
      "properties": {
        "description": "CustomLogsAma data connector with template version 3.0.0",
        "mainTemplate": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "[variables('dataConnectorVersion1')]",
          "parameters": {},
          "variables": {},
          "resources": [
            {
              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]",
              "apiVersion": "2024-06-01",
              "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
              "location": "[parameters('workspace-location')]",
              "kind": "Customizable",
              "properties": {
                "connectorUiConfig": {
                  "id": "[variables('_uiConfigId1')]",
                  "title": "Custom logs via AMA",
                  "publisher": "Microsoft",
                  "descriptionMarkdown": "Many applications log information to text or JSON files instead of standard logging services, such as Windows Event logs, Syslog or CEF. The Custom Logs data connector allows you to collect events from files on both Windows and Linux computers and stream them to custom logs tables you created. While streaming the data you can parse and transform the contents using the DCR. After collecting the data, you can apply analytic rules, hunting, searching, threat intelligence, enrichments and more.\n\n**NOTE: Use this connector for the following devices:** Cisco Meraki, Zscaler Private Access (ZPA), VMware vCenter, Apache HTTP server, Apache Tomcat, Jboss Enterprise application platform, Juniper IDP, MarkLogic Audit, MongoDB Audit, Nginx HTTP server, Oracle Weblogic server, PostgreSQL Events, Squid Proxy, Ubiquiti UniFi, SecurityBridge Threat detection SAP and AI vectra stream.",
                  "graphQueries": [
                    {
                      "metricName": "JBossEvent",
                      "legend": "JBossEvent_CL",
                      "baseQuery": "JBossEvent_CL\n"
                    },
                    {
                      "metricName": "JuniperIDP",
                      "legend": "JuniperIDP_CL",
                      "baseQuery": "JuniperIDP_CL\n"
                    },
                    {
                      "metricName": "ApacheHTTPServer",
                      "legend": "ApacheHTTPServer_CL",
                      "baseQuery": "ApacheHTTPServer_CL\n"
                    },
                    {
                      "metricName": "Tomcat",
                      "legend": "Tomcat_CL",
                      "baseQuery": "Tomcat_CL\n"
                    },
                    {
                      "metricName": "meraki",
                      "legend": "meraki_CL",
                      "baseQuery": "meraki_CL\n"
                    },
                    {
                      "metricName": "VectraStream",
                      "legend": "VectraStream_CL",
                      "baseQuery": "VectraStream_CL\n"
                    },
                    {
                      "metricName": "MarkLogicAudit",
                      "legend": "MarkLogicAudit_CL",
                      "baseQuery": "MarkLogicAudit_CL\n"
                    },
                    {
                      "metricName": "MongoDBAudit",
                      "legend": "MongoDBAudit_CL",
                      "baseQuery": "MongoDBAudit_CL\n"
                    },
                    {
                      "metricName": "NGINX",
                      "legend": "NGINX_CL",
                      "baseQuery": "NGINX_CL\n"
                    },
                    {
                      "metricName": "OracleWebLogicServer",
                      "legend": "OracleWebLogicServer_CL",
                      "baseQuery": "OracleWebLogicServer_CL\n"
                    },
                    {
                      "metricName": "PostgreSQL",
                      "legend": "PostgreSQL_CL",
                      "baseQuery": "PostgreSQL_CL\n"
                    },
                    {
                      "metricName": "SquidProxy",
                      "legend": "SquidProxy_CL",
                      "baseQuery": "SquidProxy_CL\n"
                    },
                    {
                      "metricName": "Ubiquiti",
                      "legend": "Ubiquiti_CL",
                      "baseQuery": "Ubiquiti_CL\n"
                    },
                    {
                      "metricName": "vcenter",
                      "legend": "vcenter_CL",
                      "baseQuery": "vcenter_CL\n"
                    },
                    {
                      "metricName": "ZPA",
                      "legend": "ZPA_CL",
                      "baseQuery": "ZPA_CL\n"
                    },
                    {
                      "metricName": "SecurityBridgeLogs",
                      "legend": "SecurityBridgeLogs_CL",
                      "baseQuery": "SecurityBridgeLogs_CL\n"
                    }
                  ],
                  "sampleQueries": [
                    {
                      "description": "All JBossEvent logs",
                      "query": "JBossEvent_CL\n| sort by TimeGenerated"
                    },
                    {
                      "description": "All JuniperIDP logs",
                      "query": "JuniperIDP_CL\n| sort by TimeGenerated"
                    },
                    {
                      "description": "All ApacheHTTPServer logs",
                      "query": "ApacheHTTPServer_CL\n| sort by TimeGenerated"
                    },
                    {
                      "description": "All Tomcat logs",
                      "query": "Tomcat_CL\n| sort by TimeGenerated"
                    },
                    {
                      "description": "All meraki logs",
                      "query": "meraki_CL\n| sort by TimeGenerated"
                    },
                    {
                      "description": "All VectraStream logs",
                      "query": "VectraStream_CL\n| sort by TimeGenerated"
                    },
                    {
                      "description": "All MarkLogicAudit logs",
                      "query": "MarkLogicAudit_CL\n| sort by TimeGenerated"
                    },
                    {
                      "description": "All MongoDBAudit logs",
                      "query": "MongoDBAudit_CL\n| sort by TimeGenerated"
                    },
                    {
                      "description": "All NGINX logs",
                      "query": "NGINX_CL\n| sort by TimeGenerated"
                    },
                    {
                      "description": "All OracleWebLogicServer logs",
                      "query": "OracleWebLogicServer_CL\n| sort by TimeGenerated"
                    },
                    {
                      "description": "All PostgreSQL logs",
                      "query": "PostgreSQL_CL\n| sort by TimeGenerated"
                    },
                    {
                      "description": "All SquidProxy logs",
                      "query": "SquidProxy_CL\n| sort by TimeGenerated"
                    },
                    {
                      "description": "All Ubiquiti logs",
                      "query": "Ubiquiti_CL\n| sort by TimeGenerated"
                    },
                    {
                      "description": "All vcenter logs",
                      "query": "vcenter_CL\n| sort by TimeGenerated"
                    },
                    {
                      "description": "All ZPA logs",
                      "query": "ZPA_CL\n| sort by TimeGenerated"
                    },
                    {
                      "description": "All SecurityBridgeLogs logs",
                      "query": "SecurityBridgeLogs_CL\n| sort by TimeGenerated"
                    }
                  ],
                  "connectivityCriteria": [
                    {
                      "type": "IsConnectedQuery",
                      "value": [
                        "JBossEvent_CL\n| summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                        "JuniperIDP_CL\n| summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                        "ApacheHTTPServer_CL\n| summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                        "Tomcat_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                        "meraki_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                        "VectraStream_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                        "MarkLogicAudit_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                        "MongoDBAudit_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                        "NGINX_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                        "OracleWebLogicServer_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                        "PostgreSQL_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                        "SquidProxy_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                        "Ubiquiti_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                        "vcenter_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                        "ZPA_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                        "SecurityBridgeLogs_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)"
                      ]
                    }
                  ],
                  "dataTypes": [
                    {
                      "name": "JBossEvent_CL",
                      "lastDataReceivedQuery": "JBossEvent_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                    },
                    {
                      "name": "JuniperIDP_CL",
                      "lastDataReceivedQuery": "JuniperIDP_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                    },
                    {
                      "name": "ApacheHTTPServer_CL",
                      "lastDataReceivedQuery": "ApacheHTTPServer_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                    },
                    {
                      "name": "Tomcat_CL",
                      "lastDataReceivedQuery": "Tomcat_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                    },
                    {
                      "name": "meraki_CL",
                      "lastDataReceivedQuery": "meraki_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                    },
                    {
                      "name": "VectraStream_CL",
                      "lastDataReceivedQuery": "VectraStream_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                    },
                    {
                      "name": "MarkLogicAudit_CL",
                      "lastDataReceivedQuery": "MarkLogicAudit_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                    },
                    {
                      "name": "MongoDBAudit_CL",
                      "lastDataReceivedQuery": "MongoDBAudit_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                    },
                    {
                      "name": "NGINX_CL",
                      "lastDataReceivedQuery": "NGINX_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                    },
                    {
                      "name": "OracleWebLogicServer_CL",
                      "lastDataReceivedQuery": "OracleWebLogicServer_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                    },
                    {
                      "name": "PostgreSQL_CL",
                      "lastDataReceivedQuery": "PostgreSQL_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                    },
                    {
                      "name": "SquidProxy_CL",
                      "lastDataReceivedQuery": "SquidProxy_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                    },
                    {
                      "name": "Ubiquiti_CL",
                      "lastDataReceivedQuery": "Ubiquiti_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                    },
                    {
                      "name": "vcenter_CL",
                      "lastDataReceivedQuery": "vcenter_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                    },
                    {
                      "name": "ZPA_CL",
                      "lastDataReceivedQuery": "ZPA_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                    },
                    {
                      "name": "SecurityBridgeLogs_CL",
                      "lastDataReceivedQuery": "SecurityBridgeLogs_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                    }
                  ],
                  "availability": {
                    "status": 2,
                    "isPreview": true
                  },
                  "permissions": {
                    "resourceProvider": [
                      {
                        "provider": "Microsoft.OperationalInsights/workspaces/datasources",
                        "permissionsDisplayText": "read and write permissions.",
                        "providerDisplayName": "Workspace data sources",
                        "scope": "Workspace",
                        "requiredPermissions": {
                          "read": true,
                          "write": true
                        }
                      }
                    ],
                    "customs": [
                      {
                        "name": "Permissions",
                        "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)"
                      }
                    ]
                  },
                  "instructionSteps": [
                    {
                      "description": "> Custom logs are collected from both Windows and Linux agents.",
                      "instructions": [
                        {
                          "type": "CustomLogsAMA",
                          "parameters": {}
                        },
                        {
                          "parameters": {
                            "linkType": "OpenCreateDataCollectionRule",
                            "dataCollectionRuleType": 8
                          },
                          "type": "InstallAgent"
                        }
                      ],
                      "title": "Enable data collection rule"
                    }
                  ]
                }
              }
            },
            {
              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
              "apiVersion": "2023-04-01-preview",
              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]",
              "properties": {
                "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitnions', variables('_dataConnectorContentId1'))]",
                "contentId": "[variables('_dataConnectorContentId1')]",
                "kind": "DataConnector",
                "version": "[variables('dataConnectorVersion1')]",
                "source": {
                  "kind": "Solution",
                  "name": "CustomLogsAma",
                  "sourceId": "[variables('_solutionId')]"
                },
                "author": {
                  "name": "Microsoft",
                  "email": "[variables('_email')]"
                },
                "support": {
                  "tier": "Microsoft",
                  "name": "Microsoft Corporation",
                  "link": "https://support.microsoft.com",
                  "email": "support@microsoft.com"
                }
              }
            }
          ]
        },
        "packageKind": "Solution",
        "packageVersion": "[variables('_solutionVersion')]",
        "packageName": "[variables('_solutionName')]",
        "packageId": "[variables('_solutionId')]",
        "contentSchemaVersion": "3.0.0",
        "contentId": "[variables('_dataConnectorContentId1')]",
        "contentKind": "DataConnector",
        "displayName": "Custom logs via AMA",
        "contentProductId": "[variables('_dataConnectorcontentProductId1')]",
        "id": "[variables('_dataConnectorcontentProductId1')]",
        "version": "[variables('dataConnectorVersion1')]"
      }
    },
    {
      "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
      "apiVersion": "2023-04-01-preview",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]",
      "dependsOn": [
        "[variables('_dataConnectorId1')]"
      ],
      "location": "[parameters('workspace-location')]",
      "properties": {
        "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentId1'))]",
        "contentId": "[variables('_dataConnectorContentId1')]",
        "kind": "DataConnector",
        "version": "[variables('dataConnectorVersion1')]",
        "source": {
          "kind": "Solution",
          "name": "CustomLogsAma",
          "sourceId": "[variables('_solutionId')]"
        },
        "author": {
          "name": "Microsoft",
          "email": "[variables('_email')]"
        },
        "support": {
          "tier": "Microsoft",
          "name": "Microsoft Corporation",
          "link": "https://support.microsoft.com",
          "email": "support@microsoft.com"
        }
      }
    },
    {
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]",
      "apiVersion": "2024-06-01",
      "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
      "location": "[parameters('workspace-location')]",
      "kind": "Customizable",
      "properties": {
        "connectorUiConfig": {
          "title": "Custom logs via AMA",
          "publisher": "Microsoft",
          "descriptionMarkdown": "Many applications log information to text or JSON files instead of standard logging services, such as Windows Event logs, Syslog or CEF. The Custom Logs data connector allows you to collect events from files on both Windows and Linux computers and stream them to custom logs tables you created. While streaming the data you can parse and transform the contents using the DCR. After collecting the data, you can apply analytic rules, hunting, searching, threat intelligence, enrichments and more.\n\n**NOTE: Use this connector for the following devices:** Cisco Meraki, Zscaler Private Access (ZPA), VMware vCenter, Apache HTTP server, Apache Tomcat, Jboss Enterprise application platform, Juniper IDP, MarkLogic Audit, MongoDB Audit, Nginx HTTP server, Oracle Weblogic server, PostgreSQL Events, Squid Proxy, Ubiquiti UniFi, SecurityBridge Threat detection SAP and AI vectra stream.",
          "graphQueries": [
            {
              "metricName": "JBossEvent",
              "legend": "JBossEvent_CL",
              "baseQuery": "JBossEvent_CL\n"
            },
            {
              "metricName": "JuniperIDP",
              "legend": "JuniperIDP_CL",
              "baseQuery": "JuniperIDP_CL\n"
            },
            {
              "metricName": "ApacheHTTPServer",
              "legend": "ApacheHTTPServer_CL",
              "baseQuery": "ApacheHTTPServer_CL\n"
            },
            {
              "metricName": "Tomcat",
              "legend": "Tomcat_CL",
              "baseQuery": "Tomcat_CL\n"
            },
            {
              "metricName": "meraki",
              "legend": "meraki_CL",
              "baseQuery": "meraki_CL\n"
            },
            {
              "metricName": "VectraStream",
              "legend": "VectraStream_CL",
              "baseQuery": "VectraStream_CL\n"
            },
            {
              "metricName": "MarkLogicAudit",
              "legend": "MarkLogicAudit_CL",
              "baseQuery": "MarkLogicAudit_CL\n"
            },
            {
              "metricName": "MongoDBAudit",
              "legend": "MongoDBAudit_CL",
              "baseQuery": "MongoDBAudit_CL\n"
            },
            {
              "metricName": "NGINX",
              "legend": "NGINX_CL",
              "baseQuery": "NGINX_CL\n"
            },
            {
              "metricName": "OracleWebLogicServer",
              "legend": "OracleWebLogicServer_CL",
              "baseQuery": "OracleWebLogicServer_CL\n"
            },
            {
              "metricName": "PostgreSQL",
              "legend": "PostgreSQL_CL",
              "baseQuery": "PostgreSQL_CL\n"
            },
            {
              "metricName": "SquidProxy",
              "legend": "SquidProxy_CL",
              "baseQuery": "SquidProxy_CL\n"
            },
            {
              "metricName": "Ubiquiti",
              "legend": "Ubiquiti_CL",
              "baseQuery": "Ubiquiti_CL\n"
            },
            {
              "metricName": "vcenter",
              "legend": "vcenter_CL",
              "baseQuery": "vcenter_CL\n"
            },
            {
              "metricName": "ZPA",
              "legend": "ZPA_CL",
              "baseQuery": "ZPA_CL\n"
            },
            {
              "metricName": "SecurityBridgeLogs",
              "legend": "SecurityBridgeLogs_CL",
              "baseQuery": "SecurityBridgeLogs_CL\n"
            }
          ],
          "dataTypes": [
            {
              "name": "JBossEvent_CL",
              "lastDataReceivedQuery": "JBossEvent_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
            },
            {
              "name": "JuniperIDP_CL",
              "lastDataReceivedQuery": "JuniperIDP_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
            },
            {
              "name": "ApacheHTTPServer_CL",
              "lastDataReceivedQuery": "ApacheHTTPServer_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
            },
            {
              "name": "Tomcat_CL",
              "lastDataReceivedQuery": "Tomcat_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
            },
            {
              "name": "meraki_CL",
              "lastDataReceivedQuery": "meraki_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
            },
            {
              "name": "VectraStream_CL",
              "lastDataReceivedQuery": "VectraStream_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
            },
            {
              "name": "MarkLogicAudit_CL",
              "lastDataReceivedQuery": "MarkLogicAudit_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
            },
            {
              "name": "MongoDBAudit_CL",
              "lastDataReceivedQuery": "MongoDBAudit_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
            },
            {
              "name": "NGINX_CL",
              "lastDataReceivedQuery": "NGINX_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
            },
            {
              "name": "OracleWebLogicServer_CL",
              "lastDataReceivedQuery": "OracleWebLogicServer_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
            },
            {
              "name": "PostgreSQL_CL",
              "lastDataReceivedQuery": "PostgreSQL_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
            },
            {
              "name": "SquidProxy_CL",
              "lastDataReceivedQuery": "SquidProxy_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
            },
            {
              "name": "Ubiquiti_CL",
              "lastDataReceivedQuery": "Ubiquiti_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
            },
            {
              "name": "vcenter_CL",
              "lastDataReceivedQuery": "vcenter_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
            },
            {
              "name": "ZPA_CL",
              "lastDataReceivedQuery": "ZPA_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
            },
            {
              "name": "SecurityBridgeLogs_CL",
              "lastDataReceivedQuery": "SecurityBridgeLogs_CL\n | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
            }
          ],
          "connectivityCriteria": [
            {
              "type": "IsConnectedQuery",
              "value": [
                "JBossEvent_CL\n| summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "JuniperIDP_CL\n| summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "ApacheHTTPServer_CL\n| summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "Tomcat_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                "meraki_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                "VectraStream_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                "MarkLogicAudit_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                "MongoDBAudit_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                "NGINX_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                "OracleWebLogicServer_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                "PostgreSQL_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                "SquidProxy_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                "Ubiquiti_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                "vcenter_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                "ZPA_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)",
                "SecurityBridgeLogs_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)"
              ]
            }
          ],
          "sampleQueries": [
            {
              "description": "All JBossEvent logs",
              "query": "JBossEvent_CL\n| sort by TimeGenerated"
            },
            {
              "description": "All JuniperIDP logs",
              "query": "JuniperIDP_CL\n| sort by TimeGenerated"
            },
            {
              "description": "All ApacheHTTPServer logs",
              "query": "ApacheHTTPServer_CL\n| sort by TimeGenerated"
            },
            {
              "description": "All Tomcat logs",
              "query": "Tomcat_CL\n| sort by TimeGenerated"
            },
            {
              "description": "All meraki logs",
              "query": "meraki_CL\n| sort by TimeGenerated"
            },
            {
              "description": "All VectraStream logs",
              "query": "VectraStream_CL\n| sort by TimeGenerated"
            },
            {
              "description": "All MarkLogicAudit logs",
              "query": "MarkLogicAudit_CL\n| sort by TimeGenerated"
            },
            {
              "description": "All MongoDBAudit logs",
              "query": "MongoDBAudit_CL\n| sort by TimeGenerated"
            },
            {
              "description": "All NGINX logs",
              "query": "NGINX_CL\n| sort by TimeGenerated"
            },
            {
              "description": "All OracleWebLogicServer logs",
              "query": "OracleWebLogicServer_CL\n| sort by TimeGenerated"
            },
            {
              "description": "All PostgreSQL logs",
              "query": "PostgreSQL_CL\n| sort by TimeGenerated"
            },
            {
              "description": "All SquidProxy logs",
              "query": "SquidProxy_CL\n| sort by TimeGenerated"
            },
            {
              "description": "All Ubiquiti logs",
              "query": "Ubiquiti_CL\n| sort by TimeGenerated"
            },
            {
              "description": "All vcenter logs",
              "query": "vcenter_CL\n| sort by TimeGenerated"
            },
            {
              "description": "All ZPA logs",
              "query": "ZPA_CL\n| sort by TimeGenerated"
            },
            {
              "description": "All SecurityBridgeLogs logs",
              "query": "SecurityBridgeLogs_CL\n| sort by TimeGenerated"
            }
          ],
          "availability": {
            "status": 2,
            "isPreview": true
          },
          "permissions": {
            "resourceProvider": [
              {
                "provider": "Microsoft.OperationalInsights/workspaces/datasources",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace data sources",
                "scope": "Workspace",
                "requiredPermissions": {
                  "read": true,
                  "write": true
                }
              }
            ],
            "customs": [
              {
                "name": "Permissions",
                "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)"
              }
            ]
          },
          "instructionSteps": [
            {
              "description": "> Custom logs are collected from both Windows and Linux agents.",
              "instructions": [
                {
                  "type": "CustomLogsAMA",
                  "parameters": {}
                },
                {
                  "parameters": {
                    "linkType": "OpenCreateDataCollectionRule",
                    "dataCollectionRuleType": 8
                  },
                  "type": "InstallAgent"
                }
              ],
              "title": "Enable data collection rule"
            }
          ],
          "id": "[variables('_uiConfigId1')]"
        }
      }
    },
    {
      "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
      "apiVersion": "2023-04-01-preview",
      "location": "[parameters('workspace-location')]",
      "properties": {
        "version": "3.0.0",
        "kind": "Solution",
        "contentSchemaVersion": "3.0.0",
        "displayName": "CustomLogsAma",
        "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation",
        "descriptionHtml": "<p><strong>Note:</strong> Please refer to the following before installing the solution:</p>\n<p>• Review the solution <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CustomLogsAma/ReleaseNotes.md\">Release Notes</a></p>\n<p>• There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</p>\n<p>Many applications log information to text or JSON files instead of standard logging services, such as Windows Event logs, Syslog or CEF. The Custom Logs solution allows you to collect events from files on both Windows and Linux computers and stream them to custom logs tables you created. While streaming the data you can parse and transform the contents using the DCR. After collecting the data, you can apply analytic rules, hunting, searching, threat intelligence, enrichments and more.</p>\n<p><strong>NOTE: Use this connector for the following devices:</strong> Cisco Meraki, Zscaler Private Access (ZPA), VMware vCenter, Apache HTTP server, Apache Tomcat, Jboss Enterprise application platform, Juniper IDP, MarkLogic Audit, MongoDB Audit, Nginx HTTP server, Oracle Weblogic server, PostgreSQL Events, Squid Proxy, Ubiquiti UniFi, SecurityBridge Threat detection SAP and AI vectra stream.</p>\n<p><strong>Data Connectors:</strong> 1</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n",
        "contentKind": "Solution",
        "contentProductId": "[variables('_solutioncontentProductId')]",
        "id": "[variables('_solutioncontentProductId')]",
        "icon": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">",
        "contentId": "[variables('_solutionId')]",
        "parentId": "[variables('_solutionId')]",
        "source": {
          "kind": "Solution",
          "name": "CustomLogsAma",
          "sourceId": "[variables('_solutionId')]"
        },
        "author": {
          "name": "Microsoft",
          "email": "[variables('_email')]"
        },
        "support": {
          "name": "Microsoft Corporation",
          "email": "support@microsoft.com",
          "tier": "Microsoft",
          "link": "https://support.microsoft.com"
        },
        "dependencies": {
          "operator": "AND",
          "criteria": [
            {
              "kind": "DataConnector",
              "contentId": "[variables('_dataConnectorContentId1')]",
              "version": "[variables('dataConnectorVersion1')]"
            }
          ]
        },
        "firstPublishDate": "2024-07-21",
        "providers": [
          "Microsoft"
        ],
        "categories": {
          "domains": [
            "IT Operations"
          ]
        }
      },
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]"
    }
  ],
  "outputs": {}
}