{ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "location": { "type": "string", "minLength": 1, "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" } }, "workspace-location": { "type": "string", "defaultValue": "", "metadata": { "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" } }, "subscription": { "defaultValue": "[last(split(subscription().id, '/'))]", "type": "string", "metadata": { "description": "subscription id where Microsoft Sentinel is setup" } }, "resourceGroupName": { "defaultValue": "[resourceGroup().name]", "type": "string", "metadata": { "description": "resource group name where Microsoft Sentinel is setup" } }, "workspace": { "defaultValue": "", "type": "string", "metadata": { "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" } } }, "variables": { "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "dataCollectionEndpointId": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]", "_solutionName": "SalesforceEventLog", "_solutionVersion": "0.0.1", "_solutionAuthor": "Microsoft", "_packageIcon": "icon", "_solutionId": "azuresentinel.azure-sentinel-solution-azuresentinel.azure-sentinel-SalesforceEventLogConnector", "dataConnectorVersionConnectorDefinition": "0.0.1", "dataConnectorVersionConnections": "0.0.1", "_solutionTier": "Community", "_dataConnectorContentIdConnectorDefinition": "SalesforceEventLogConnectorTemplateConnectorDefinition", "dataConnectorTemplateNameConnectorDefinition": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition')))]", "_dataConnectorContentIdConnections": "SalesforceEventLogConnectorTemplateConnections", "dataConnectorTemplateNameConnections": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections')))]", "_logAnalyticsTableId1": "SalesforceServiceCloudV2_CL" }, "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition'), variables('dataConnectorVersionConnectorDefinition'))]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "contentId": "[variables('_dataConnectorContentIdConnectorDefinition')]", "displayName": "[concat(variables('_solutionName'), variables('dataConnectorTemplateNameConnectorDefinition'))]", "contentKind": "DataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersionConnectorDefinition')]", "parameters": { }, "variables": { }, "resources": [ { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition'))]", "contentId": "[variables('_dataConnectorContentIdConnectorDefinition')]", "kind": "DataConnector", "version": "[variables('dataConnectorVersionConnectorDefinition')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "[variables('_solutionAuthor')]" }, "support": { "name": "[variables('_solutionAuthor')]", "tier": "[variables('_solutionTier')]" }, "dependencies": { "criteria": [ { "version": "[variables('dataConnectorVersionConnections')]", "contentId": "[variables('_dataConnectorContentIdConnections')]", "kind": "ResourcesDataConnector" } ] } } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition'))]", "apiVersion": "2022-09-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", "location": "[parameters('workspace-location')]", "kind": "Customizable", "properties": { "connectorUiConfig": { "id": "SalesforceServiceCloudCCPDefinition", "title": "Salesforce Service Cloud (via Codeless Connector Framework)", "publisher": "Microsoft", "descriptionMarkdown": "The Salesforce Service Cloud data connector provides the capability to ingest information about your Salesforce operational events into Microsoft Sentinel through the REST API. The connector provides ability to review events in your org on an accelerated basis, get [event log files](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/event_log_file_hourly_overview.htm) in hourly increments for recent activity.", "graphQueriesTableName": "SalesforceServiceCloudV2_CL", "graphQueries": [ { "metricName": "Total data received", "legend": "Salesforce Service Cloud EventLogFile Events", "baseQuery": "{{graphQueriesTableName}}" } ], "sampleQueries": [ { "description": "Get a sample of Salesforce Service Cloud Event Log File Events", "query": "{{graphQueriesTableName}}\n| take 10" } ], "dataTypes": [ { "name": "{{graphQueriesTableName}}", "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "HasDataConnectors" } ], "availability": { "isPreview": false, "status": 1 }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "Read and Write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true, "action": false } } ], "customs": [ { "name": "Salesforce Service Cloud API access", "description": "Access to the Salesforce Service Cloud API through a Connected App is required." } ] }, "instructionSteps": [ { "title": "Connect to Salesforce Service Cloud API to start collecting event logs in Microsoft Sentinel", "description": "Follow [Create a Connected App in Salesforce for OAuth](https://help.salesforce.com/s/articleView?id=platform.ev_relay_create_connected_app.htm&type=5) and [Configure a Connected App for the OAuth 2.0 Client Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_client_credentials_setup.htm&type=5) to create a Connected App with access to the Salesforce Service Cloud API. Through those instructions, you should get the Consumer Key and Consumer Secret.\n For Salesforce Domain name, Go to Setup, type My Domain in the Quick Find box, and select My Domain to view your domain details. Make sure to enter the domain name without a trailing slash (e.g., https://your-domain.my.salesforce.com). Fill the form below with that information.", "instructions": [ { "type": "DataConnectorsGrid", "parameters": { "mapping": [ { "columnName": "Salesforce Domain", "columnValue": "properties.addOnAttributes.SalesforceDomain" }, { "columnName": "Grant Type", "columnValue": "properties.addOnAttributes.GrantType" } ], "menuItems": [ "DeleteConnector" ] } }, { "type": "ContextPane", "parameters": { "isPrimary": true, "label": "Add Connection", "title": "Configure API Connection", "subtitle": "Connect to Salesforce to ingest event log file", "contextPaneType": "DataConnectorsContextPane", "instructionSteps": [ { "instructions": [ { "type": "InfoMessage", "parameters": { "text": "**Note:** For legacy or classic setup, ensure that the security token is appended to your password for the password-based grant type authentication to work. For lightning, passing just the password should work. For more information, refer to the [OAuth 2.0 Username-Password Flow for Special Scenarios](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_username_password_flow.htm&type=5).", "visible": true, "inline": true } }, { "type": "Textbox", "parameters": { "label": "Salesforce Domain Name", "placeholder": "Example: https://your-domain.my.salesforce.com", "type": "text", "name": "salesforceDomainName", "validations": { "required": true } } }, { "type": "Dropdown", "parameters": { "label": "Log Collection Interval", "name": "queryType", "options": [ { "key": "SELECT Id,EventType,LogDate,Interval,CreatedDate,LogFile,LogFileLength FROM EventLogFile WHERE Interval='Hourly' and CreatedDate>{_QueryWindowStartTime} and CreatedDate<{_QueryWindowEndTime}", "text": "Hourly" }, { "key": "SELECT Id,EventType,LogDate,CreatedDate,LogFile,LogFileLength FROM EventLogFile WHERE CreatedDate>{_QueryWindowStartTime} and CreatedDate<{_QueryWindowEndTime}", "text": "Daily" } ], "placeholder": "Select an interval type", "isMultiSelect": false, "required": true } }, { "type": "Radio", "parameters": { "title": "Grant Type", "name": "salesforceGrantType", "validations": { "required": true }, "options": [ { "label": "Client Credentials", "value": "client_credentials", "instructions": [ { "type": "Textbox", "parameters": { "label": "Consumer Key", "placeholder": "Enter Connected App Consumer Key", "type": "text", "name": "clientId", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Consumer Secret", "placeholder": "Enter Connected App Consumer Secret", "type": "password", "name": "clientSecret", "validations": { "required": true } } } ] }, { "label": "Password", "value": "password", "instructions": [ { "type": "Textbox", "parameters": { "label": "Consumer Key", "placeholder": "Enter Connected App Consumer Key", "type": "text", "name": "clientId", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Consumer Secret", "placeholder": "Enter Connected App Consumer Secret", "type": "password", "name": "clientSecret", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Username", "placeholder": "Enter your Salesforce username", "type": "text", "name": "username", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Password", "placeholder": "Enter your Salesforce password", "type": "password", "name": "password", "validations": { "required": true } } } ] } ] } } ] } ] } } ] } ] } } }, { "name": "SalesforceServiceCloudDCR", "apiVersion": "2021-09-01-preview", "type": "Microsoft.Insights/dataCollectionRules", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "dataCollectionEndpointId": "{{DataCollectionEndpointId}}", "streamDeclarations": { "Custom-SalesforceServiceCloudV2_CL": { "columns": [ { "name": "REQUEST_SIZE", "type": "string" }, { "name": "EXEC_TIME", "type": "string" }, { "name": "ACTION", "type": "string" }, { "name": "PLATFORM_TYPE", "type": "string" }, { "name": "OS_NAME", "type": "string" }, { "name": "OS_VERSION", "type": "string" }, { "name": "TIMESTAMP", "type": "string" }, { "name": "STATUS_CODE", "type": "string" }, { "name": "EVENT_TYPE", "type": "string" }, { "name": "REFERRER_URI", "type": "string" }, { "name": "USER_AGENT", "type": "string" }, { "name": "BROWSER_TYPE", "type": "string" }, { "name": "TIME", "type": "string" }, { "name": "RESPONSE_SIZE", "type": "string" }, { "name": "DEVICE_ID", "type": "string" }, { "name": "DEVICE_MODEL", "type": "string" }, { "name": "SOURCE_IP", "type": "string" }, { "name": "CLIENT_IP", "type": "string" }, { "name": "SUCCESS", "type": "string" }, { "name": "URI", "type": "string" }, { "name": "URL", "type": "string" }, { "name": "CLIENT_NAME", "type": "string" }, { "name": "USER_TYPE", "type": "string" }, { "name": "USER_INITIATED_LOGOUT", "type": "string" }, { "name": "USER_ID_DERIVED", "type": "string" }, { "name": "USER_ID", "type": "string" }, { "name": "USER_EMAIL", "type": "string" }, { "name": "USER_NAME", "type": "string" }, { "name": "USER", "type": "string" }, { "name": "URI_ID_DERIVED", "type": "string" }, { "name": "UI_EVENT_TYPE", "type": "string" }, { "name": "UI_EVENT_TIMESTAMP", "type": "string" }, { "name": "UI_EVENT_SOURCE", "type": "string" }, { "name": "UI_EVENT_SEQUENCE_NUM", "type": "string" }, { "name": "UI_EVENT_ID", "type": "string" }, { "name": "TLS_PROTOCOL", "type": "string" }, { "name": "TIMESTAMP_DERIVED", "type": "datetime" }, { "name": "TARGET_UI_ELEMENT", "type": "string" }, { "name": "SORT", "type": "string" }, { "name": "SESSION_TYPE", "type": "string" }, { "name": "SESSION_LEVEL", "type": "string" }, { "name": "SESSION_KEY", "type": "string" }, { "name": "SEARCH_QUERY", "type": "string" }, { "name": "SDK_VERSION", "type": "string" }, { "name": "SDK_APP_VERSION", "type": "string" }, { "name": "SDK_APP_TYPE", "type": "string" }, { "name": "RUN_TIME", "type": "string" }, { "name": "ROWS_PROCESSED", "type": "string" }, { "name": "ROW_COUNT", "type": "string" }, { "name": "RESOLUTION_TYPE", "type": "string" }, { "name": "REQUEST_STATUS", "type": "string" }, { "name": "REQUEST_ID", "type": "string" }, { "name": "REPORT_ID_DERIVED", "type": "string" }, { "name": "REPORT_ID", "type": "string" }, { "name": "RENDERING_TYPE", "type": "string" }, { "name": "RELATED_LIST", "type": "string" }, { "name": "RECORD_TYPE", "type": "string" }, { "name": "RECORD_ID", "type": "string" }, { "name": "QUIDDITY", "type": "string" }, { "name": "QUERY_ID", "type": "string" }, { "name": "PREVPAGE_URL", "type": "string" }, { "name": "PREVPAGE_ENTITY_TYPE", "type": "string" }, { "name": "PREVPAGE_ENTITY_ID", "type": "string" }, { "name": "PREVPAGE_CONTEXT", "type": "string" }, { "name": "PREVPAGE_APP_NAME", "type": "string" }, { "name": "PREFIXES_SEARCHED", "type": "string" }, { "name": "PARENT_UI_ELEMENT", "type": "string" }, { "name": "PAGE_URL", "type": "string" }, { "name": "PAGE_START_TIME", "type": "string" }, { "name": "PAGE_ENTITY_TYPE", "type": "string" }, { "name": "PAGE_ENTITY_ID", "type": "string" }, { "name": "PAGE_CONTEXT", "type": "string" }, { "name": "PAGE_APP_NAME", "type": "string" }, { "name": "ORIGIN", "type": "string" }, { "name": "ORGANIZATION_ID", "type": "string" }, { "name": "NUM_RESULTS", "type": "string" }, { "name": "NUMBER_SOQL_QUERIES", "type": "string" }, { "name": "NUMBER_FIELDS", "type": "string" }, { "name": "NUMBER_EXCEPTION_FILTERS", "type": "string" }, { "name": "NUMBER_COLUMNS", "type": "string" }, { "name": "NUMBER_BUCKETS", "type": "string" }, { "name": "METHOD_NAME", "type": "string" }, { "name": "METHOD", "type": "string" }, { "name": "MEDIA_TYPE", "type": "string" }, { "name": "LOGIN_STATUS", "type": "string" }, { "name": "LOGIN_KEY", "type": "string" }, { "name": "HTTP_METHOD", "type": "string" }, { "name": "GRANDPARENT_UI_ELEMENT", "type": "string" }, { "name": "ENTRY_POINT", "type": "string" }, { "name": "ENTITY_NAME", "type": "string" }, { "name": "ENTITY", "type": "string" }, { "name": "EFFECTIVE_PAGE_TIME", "type": "string" }, { "name": "DURATION", "type": "string" }, { "name": "DISPLAY_TYPE", "type": "string" }, { "name": "DEVICE_SESSION_ID", "type": "string" }, { "name": "DEVICE_PLATFORM", "type": "string" }, { "name": "DB_TOTAL_TIME", "type": "string" }, { "name": "DB_CPU_TIME", "type": "string" }, { "name": "DB_BLOCKS", "type": "string" }, { "name": "CPU_TIME", "type": "string" }, { "name": "CONNECTION_TYPE", "type": "string" }, { "name": "COMPONENT_NAME", "type": "string" }, { "name": "CLIENT_VERSION", "type": "string" }, { "name": "CLIENT_ID", "type": "string" }, { "name": "CIPHER_SUITE", "type": "string" }, { "name": "CALLOUT_TIME", "type": "string" }, { "name": "BROWSER_VERSION", "type": "string" }, { "name": "BROWSER_NAME", "type": "string" }, { "name": "AVERAGE_ROW_SIZE", "type": "string" }, { "name": "APP_TYPE", "type": "string" }, { "name": "APP_NAME", "type": "string" }, { "name": "API_VERSION", "type": "string" }, { "name": "API_TYPE", "type": "string" }, { "name": "ARTICLE_VERSION_ID", "type": "string" }, { "name": "ARTICLE_VERSION", "type": "string" }, { "name": "ARTICLE_STATUS", "type": "string" }, { "name": "ARTICLE_ID", "type": "string" }, { "name": "ANALYTICS_MODE", "type": "string" }, { "name": "BATCH_ID", "type": "string" }, { "name": "CLICKED_RECORD_ID", "type": "string" }, { "name": "CLASS_NAME", "type": "string" }, { "name": "COMPONENT_ID_DERIVED", "type": "string" }, { "name": "COMPONENT_ID", "type": "string" }, { "name": "CONTROLLER_TYPE", "type": "string" }, { "name": "CONTEXT", "type": "string" }, { "name": "CONSOLE_ID_DERIVED", "type": "string" }, { "name": "CONSOLE_ID", "type": "string" }, { "name": "CLIENT_INFO", "type": "string" }, { "name": "DST_BYTES", "type": "string" }, { "name": "DST_USER", "type": "string" }, { "name": "DST_USER_SID", "type": "string" }, { "name": "DST_USER_SID_DERIVED", "type": "string" }, { "name": "DATA", "type": "string" }, { "name": "DASHBOARD_TYPE", "type": "string" }, { "name": "DASHBOARD_ID_DERIVED", "type": "string" }, { "name": "DASHBOARD_ID", "type": "string" }, { "name": "DASHBOARD_COMPONENT_ID", "type": "string" }, { "name": "DVC_ACTION", "type": "string" }, { "name": "DVC_OS", "type": "string" }, { "name": "DVC_OS_NAME", "type": "string" }, { "name": "DVC_OS_VERSION", "type": "string" }, { "name": "DELIVERY_LOCATION", "type": "string" }, { "name": "DELIVERY_ID", "type": "string" }, { "name": "DOCUMENT_ID_DERIVED", "type": "string" }, { "name": "DOCUMENT_ID", "type": "string" }, { "name": "ENTITY_TYPE", "type": "string" }, { "name": "ENTITY_ID", "type": "string" }, { "name": "FILE_TYPE", "type": "string" }, { "name": "FILE_PREVIEW_TYPE", "type": "string" }, { "name": "EXCEPTION_TYPE", "type": "string" }, { "name": "EXCEPTION_MESSAGE", "type": "string" }, { "name": "EPT", "type": "string" }, { "name": "EVENT_COUNT", "type": "string" }, { "name": "EVENT_END_TIME", "type": "string" }, { "name": "EVENT_RESULT", "type": "string" }, { "name": "FILE_SIZE", "type": "string" }, { "name": "HTTP_REFERRER_ORIGINAL", "type": "string" }, { "name": "HTTP_USER_AGENT_ORIGINAL", "type": "string" }, { "name": "HTTP_USER_AGENT", "type": "string" }, { "name": "LOG_GROUP_ID", "type": "string" }, { "name": "LIMIT_USAGE_PERCENT", "type": "string" }, { "name": "LICENSE_CONTEXT", "type": "string" }, { "name": "LAST_VERSION", "type": "string" }, { "name": "LANGUAGE", "type": "string" }, { "name": "JOB_ID", "type": "string" }, { "name": "IS_SUCCESS", "type": "string" }, { "name": "IS_SECURE", "type": "string" }, { "name": "IS_SCHEDULED", "type": "string" }, { "name": "IS_NEW", "type": "string" }, { "name": "IS_MOBILE", "type": "string" }, { "name": "IS_LONG_RUNNING_REQUEST", "type": "string" }, { "name": "IS_GUEST", "type": "string" }, { "name": "IS_FIRST_REQUEST", "type": "string" }, { "name": "IS_ERROR", "type": "string" }, { "name": "IS_API", "type": "string" }, { "name": "IS_AJAX_REQUEST", "type": "string" }, { "name": "MANAGED_PACKAGE_NAMESPACE", "type": "string" }, { "name": "HTTP_HEADERS", "type": "string" }, { "name": "NETWORK_DURATION", "type": "string" }, { "name": "NAME", "type": "string" }, { "name": "NUMBER_FAILURES", "type": "string" }, { "name": "NUM_CLICKS", "type": "string" }, { "name": "OPERATION_TYPE", "type": "string" }, { "name": "NUM_SESSIONS", "type": "string" }, { "name": "PAGE_NAME", "type": "string" }, { "name": "QUERY", "type": "string" }, { "name": "REQUEST_TYPE", "type": "string" }, { "name": "REPORT_DESCRIPTION", "type": "string" }, { "name": "REOPEN_COUNT", "type": "string" }, { "name": "RELATED_ENTITY_ID", "type": "string" }, { "name": "RECORD_ID_DERIVED", "type": "string" }, { "name": "READ_TIME", "type": "string" }, { "name": "RANK", "type": "string" }, { "name": "SRC_BYTES", "type": "string" }, { "name": "SRC_DVC_ID", "type": "string" }, { "name": "SRC_DVC_MODEL_NAME", "type": "string" }, { "name": "SRC_IP_ADDR", "type": "string" }, { "name": "SRC_NAT_IP_ADDR", "type": "string" }, { "name": "SESSION_ID", "type": "string" }, { "name": "SITE_ID", "type": "string" }, { "name": "SHARING_PERMISSION", "type": "string" }, { "name": "SHARING_OPERATION", "type": "string" }, { "name": "SHARED_WITH_ENTITY_ID", "type": "string" }, { "name": "URL_ORIGINAL", "type": "string" }, { "name": "WAVE_TIMESTAMP", "type": "string" }, { "name": "WAVE_SESSION_ID", "type": "string" }, { "name": "VIEW_STATE_SIZE", "type": "string" }, { "name": "VERSION_ID_DERIVED", "type": "string" }, { "name": "VERSION_ID", "type": "string" }, { "name": "TRIGGER_TYPE", "type": "string" }, { "name": "TRIGGER_NAME", "type": "string" }, { "name": "TRIGGER_ID", "type": "string" }, { "name": "TRANSACTION_TYPE", "type": "string" }, { "name": "TOTAL_TIME", "type": "string" }, { "name": "TAB_ID", "type": "string" }, { "name": "STACK_TRACE", "type": "string" }, { "name": "ASSET_TYPE", "type": "string" }, { "name": "BLOCKED_URI", "type": "string" }, { "name": "BLOCKED_URI_DOMAIN", "type": "string" }, { "name": "BOT_IDENTIFIER", "type": "string" }, { "name": "BOT_SESSION_IDENTIFIER", "type": "string" }, { "name": "CLIENT_GEO", "type": "string" }, { "name": "CONNECT_END", "type": "string" }, { "name": "CONNECT_START", "type": "string" }, { "name": "CONNECTED_APP_ID", "type": "string" }, { "name": "DECODED_BODY_SIZE", "type": "string" }, { "name": "DISPOSITION", "type": "string" }, { "name": "DOMAIN_LOOKUP_END", "type": "string" }, { "name": "DOMAIN_LOOKUP_START", "type": "string" }, { "name": "ENCODED_BODY_SIZE", "type": "string" }, { "name": "ERROR_MESSAGE", "type": "string" }, { "name": "EXECUTE_MS", "type": "string" }, { "name": "FETCH_MS", "type": "string" }, { "name": "FETCH_START", "type": "string" }, { "name": "FILTER", "type": "string" }, { "name": "FIRST_INTERIM_RESPONSE_START", "type": "string" }, { "name": "FLOW_VERSION_ID", "type": "string" }, { "name": "INITIATOR_TYPE", "type": "string" }, { "name": "LIMIT", "type": "string" }, { "name": "MESSAGE", "type": "string" }, { "name": "NEXT_HOP_PROTOCOL", "type": "string" }, { "name": "NEXT_LINK", "type": "string" }, { "name": "NUMBER_OF_RECORDS", "type": "string" }, { "name": "OFFSET", "type": "string" }, { "name": "OPERATION", "type": "string" }, { "name": "ORDERBY", "type": "string" }, { "name": "PARENT_CALLOUT", "type": "string" }, { "name": "PLANNER_IDENTIFIER", "type": "string" }, { "name": "PROVIDER_TYPE", "type": "string" }, { "name": "REDIRECT_END", "type": "string" }, { "name": "REDIRECT_START", "type": "string" }, { "name": "REFERRER", "type": "string" }, { "name": "RENDER_BLOCKING_STATUS", "type": "string" }, { "name": "REQUEST_START", "type": "string" }, { "name": "RESPONSE_END", "type": "string" }, { "name": "RESPONSE_START", "type": "string" }, { "name": "RESPONSE_STATUS", "type": "string" }, { "name": "ROWS", "type": "string" }, { "name": "ROWS_FETCHED", "type": "string" }, { "name": "SEARCH", "type": "string" }, { "name": "SECURE_CONNECT_START", "type": "string" }, { "name": "SELECT", "type": "string" }, { "name": "SERVER_REQUEST_ID", "type": "string" }, { "name": "START_TIME", "type": "string" }, { "name": "STATUS", "type": "string" }, { "name": "SUBQUERIES", "type": "string" }, { "name": "THROUGHPUT", "type": "string" }, { "name": "TOTAL_MS", "type": "string" }, { "name": "TRANSFER_SIZE", "type": "string" }, { "name": "TYPE", "type": "string" }, { "name": "UI_EVENT_RELATIVE_TIMESTAMP", "type": "string" }, { "name": "UI_ROOT_ACTIVITY_ID", "type": "string" }, { "name": "UI_THREAD_RESPONSE_DELAY", "type": "string" }, { "name": "VIEW_MODE", "type": "string" }, { "name": "WORKER_START", "type": "string" }, { "name": "ACCESS_ERROR", "type": "string" }, { "name": "ACTION_MESSAGE", "type": "string" }, { "name": "ACTION_NAME", "type": "string" }, { "name": "ACTION_TYPE", "type": "string" }, { "name": "ACTION_VERSION", "type": "string" }, { "name": "ACTUAL_LOGGED_IN_USER_ID", "type": "string" }, { "name": "AGENT_ACTION", "type": "string" }, { "name": "ALL_OR_NONE", "type": "string" }, { "name": "API_CALLER", "type": "string" }, { "name": "API_CLIENT_CATEGORY", "type": "string" }, { "name": "API_FAMILY", "type": "string" }, { "name": "API_RESOURCE", "type": "string" }, { "name": "ASSET_ID", "type": "string" }, { "name": "AUTHENTICATION_CONTEXT_CLASS_REFERENCE", "type": "string" }, { "name": "AUTHENTICATION_METHOD_REFERENCE", "type": "string" }, { "name": "AUTHENTICATION_SERVICE_ID", "type": "string" }, { "name": "B2B_EDITION", "type": "string" }, { "name": "B2B_VERSION", "type": "string" }, { "name": "BROWSER_DEVICE_TYPE", "type": "string" }, { "name": "BYTES", "type": "string" }, { "name": "CALLER_PACKAGE_NAMESPACE", "type": "string" }, { "name": "CANCELLED_REASON", "type": "string" }, { "name": "CHANGE_SET_NAME", "type": "string" }, { "name": "COLUMN_NUMBER", "type": "string" }, { "name": "CONCURRENCY_MODE", "type": "string" }, { "name": "CONNECTED_APP_NAME", "type": "string" }, { "name": "CONTEXT_ID", "type": "string" }, { "name": "CONTEXT_MAP", "type": "string" }, { "name": "CONTINUATION_ID", "type": "string" }, { "name": "CORRELATION_ID", "type": "string" }, { "name": "COUNT", "type": "string" }, { "name": "COUNTS_AGAINST_API_LIMIT", "type": "string" }, { "name": "COUNTRY_CODE", "type": "string" }, { "name": "CURRENT_SANDBOX_ORG_ID", "type": "string" }, { "name": "DATA_SOURCE_NAME", "type": "string" }, { "name": "DATASET_IDS", "type": "string" }, { "name": "DELEGATED_USER_ID", "type": "string" }, { "name": "DELEGATED_USER_ID_DERIVED", "type": "string" }, { "name": "DELEGATED_USER_NAME", "type": "string" }, { "name": "DESCRIPTION", "type": "string" }, { "name": "DIRECTIVE", "type": "string" }, { "name": "DML_TYPE", "type": "string" }, { "name": "DOCUMENT_URI", "type": "string" }, { "name": "DOM_COMPLETE", "type": "string" }, { "name": "DOM_CONTENT_LOADED_EVENT_END", "type": "string" }, { "name": "DOM_CONTENT_LOADED_EVENT_START", "type": "string" }, { "name": "DOM_INTERACTIVE", "type": "string" }, { "name": "DOMAIN", "type": "string" }, { "name": "DOWNLOAD_ERROR", "type": "string" }, { "name": "DOWNLOAD_FORMAT", "type": "string" }, { "name": "EASY_SUITE_VALUE", "type": "string" }, { "name": "EFFECTIVE_ACCOUNT_ID", "type": "string" }, { "name": "EFFECTIVE_PAGE_TIME_DEVIATION", "type": "string" }, { "name": "EFFECTIVE_PAGE_TIME_DEVIATION_ERROR_TYPE", "type": "string" }, { "name": "EFFECTIVE_PAGE_TIME_DEVIATION_REASON", "type": "string" }, { "name": "ERROR_CODE", "type": "string" }, { "name": "ERROR_DESCRIPTION", "type": "string" }, { "name": "ERROR_TIMESTAMP", "type": "string" }, { "name": "EVALUATION_TIME_MS", "type": "string" }, { "name": "EVENT_TIMESTAMP", "type": "string" }, { "name": "EXCEPTION_CATEGORY", "type": "string" }, { "name": "EXPAND", "type": "string" }, { "name": "EXTERNAL_OBJECT", "type": "string" }, { "name": "FAILURE_REASON", "type": "string" }, { "name": "FAILURE_TYPE", "type": "string" }, { "name": "FEATURE_ID", "type": "string" }, { "name": "FIRST_ENTITY_ID", "type": "string" }, { "name": "FLOW_LOAD_TIME", "type": "string" }, { "name": "FLOW_PROCESS_TYPE", "type": "string" }, { "name": "FORWARDED_FOR_IP", "type": "string" }, { "name": "GROUP_ID", "type": "string" }, { "name": "GROUP_TYPE", "type": "string" }, { "name": "HAS_CHART", "type": "string" }, { "name": "HAVING", "type": "string" }, { "name": "HOST", "type": "string" }, { "name": "HTTP_REFERER", "type": "string" }, { "name": "INITIAL_REFERENCE_IDS", "type": "string" }, { "name": "INSECURE_URI", "type": "string" }, { "name": "INVOCATION_SOURCE", "type": "string" }, { "name": "INVOKING_APEX_CLASS_NAME", "type": "string" }, { "name": "IS_BLOCKED_REDIRECTION", "type": "string" }, { "name": "IS_CANCELLED", "type": "string" }, { "name": "IS_INITIAL", "type": "string" }, { "name": "IS_MANAGED", "type": "string" }, { "name": "IS_PUSH", "type": "string" }, { "name": "IS_RELEASED", "type": "string" }, { "name": "IS_REQUEST_COLLATION_ON", "type": "string" }, { "name": "IS_RETRY", "type": "string" }, { "name": "IS_SUCCESSFUL", "type": "string" }, { "name": "JOB_STATUS", "type": "string" }, { "name": "KEY_ID", "type": "string" }, { "name": "KEY_ID_DERIVED", "type": "string" }, { "name": "KEY_PREFIX", "type": "string" }, { "name": "KEY_TYPE", "type": "string" }, { "name": "LARGE_LANGUAGE_MODEL", "type": "string" }, { "name": "LIBRARY", "type": "string" }, { "name": "LINE_NUMBER", "type": "string" }, { "name": "LOAD_EVENT_END", "type": "string" }, { "name": "LOAD_EVENT_START", "type": "string" }, { "name": "LOGIN_SUB_TYPE", "type": "string" }, { "name": "LOGIN_TYPE", "type": "string" }, { "name": "LOGIN_URL", "type": "string" }, { "name": "MALFORMED_URL", "type": "string" }, { "name": "MASTER_REPORT_ID", "type": "string" }, { "name": "MEMBER_ID", "type": "string" }, { "name": "NAMED_CREDENTIAL_NAME", "type": "string" }, { "name": "NAVIGATION_TYPE", "type": "string" }, { "name": "NETWORK_ID", "type": "string" }, { "name": "NUM_GRAPH_DEPTH", "type": "string" }, { "name": "NUM_RETRIES", "type": "string" }, { "name": "NUM_ROWS", "type": "string" }, { "name": "NUMBER_OF_ERRORS", "type": "string" }, { "name": "NUMBER_OF_INTERVIEWS", "type": "string" }, { "name": "NUMBER_REQUESTS", "type": "string" }, { "name": "OPERATION_STAGE", "type": "string" }, { "name": "OPERATION_STATE", "type": "string" }, { "name": "OPERATION_STATUS", "type": "string" }, { "name": "OPERATION_TIME", "type": "string" }, { "name": "ORIGIN_REQUEST_ID", "type": "string" }, { "name": "PACKAGE_NAME", "type": "string" }, { "name": "PAGE_FLEXI_PAGE_NAME_OR_ID", "type": "string" }, { "name": "PAGE_FLEXI_PAGE_TYPE", "type": "string" }, { "name": "PAGE_ID", "type": "string" }, { "name": "PATH", "type": "string" }, { "name": "PENDING_SANDBOX_ORG_ID", "type": "string" }, { "name": "PERMISSION_TYPE", "type": "string" }, { "name": "POLICY_ID", "type": "string" }, { "name": "POLICY_ID_DERIVED", "type": "string" }, { "name": "PRICING_API_ENDPOINT", "type": "string" }, { "name": "PRICING_DETAILS", "type": "string" }, { "name": "PRICING_ERROR_CODE", "type": "string" }, { "name": "PRICING_LOG_NAME", "type": "string" }, { "name": "PRICING_PROCEDURE", "type": "string" }, { "name": "PRICING_STATUS", "type": "string" }, { "name": "PROCESS_TYPE", "type": "string" }, { "name": "PROMPT_TEMPLATE", "type": "string" }, { "name": "QUERY_IDENTIFIER", "type": "string" }, { "name": "QUERY_TYPE", "type": "string" }, { "name": "RATE_LIMIT_USAGE_PERCENT", "type": "string" }, { "name": "RECORDS_FAILED", "type": "string" }, { "name": "RECORDS_PROCESSED", "type": "string" }, { "name": "REDIRECT_COUNT", "type": "string" }, { "name": "REDIRECT_REASON", "type": "string" }, { "name": "REMOTE_ADDRESS", "type": "string" }, { "name": "REQUEST_COUNT", "type": "string" }, { "name": "REQUEST_FORM_SIZE", "type": "string" }, { "name": "REQUEST_METHOD", "type": "string" }, { "name": "REQUEST_PATH", "type": "string" }, { "name": "REQUEST_URI", "type": "string" }, { "name": "REQUESTED_ACCESS_LEVEL", "type": "string" }, { "name": "REQUESTS", "type": "string" }, { "name": "REQUESTS_LIMIT", "type": "string" }, { "name": "RESOURCE_SAMPLE", "type": "string" }, { "name": "RESULT", "type": "string" }, { "name": "RESULT_SIZE_MB", "type": "string" }, { "name": "SAMPLE_FACTOR", "type": "string" }, { "name": "SANDBOX_ID", "type": "string" }, { "name": "SAVED_VIEW_ID", "type": "string" }, { "name": "SEQUENCE", "type": "string" }, { "name": "SERVICE_NAME", "type": "string" }, { "name": "SIZE_BYTES", "type": "string" }, { "name": "SOURCE", "type": "string" }, { "name": "SOURCE_FILE", "type": "string" }, { "name": "SOURCE_HOSTNAME", "type": "string" }, { "name": "SQL_ID", "type": "string" }, { "name": "TABLE_NAME", "type": "string" }, { "name": "TARGET_HOSTNAME", "type": "string" }, { "name": "TARGET_ORG_ID", "type": "string" }, { "name": "TOTAL_EXECUTION_TIME", "type": "string" }, { "name": "UI_NUMBER_COLUMNS", "type": "string" }, { "name": "UNIQUE_ID", "type": "string" }, { "name": "UNLOAD_EVENT_END", "type": "string" }, { "name": "UNLOAD_EVENT_START", "type": "string" }, { "name": "UPDATE_TYPE", "type": "string" }, { "name": "USE_API_TOKEN", "type": "string" }, { "name": "USING_MRU", "type": "string" }, { "name": "VF_CONTROLLER_SIZE", "type": "string" }, { "name": "VIEWING_USER_ID", "type": "string" }, { "name": "WEBSTORE_ID", "type": "string" }, { "name": "WEBSTORE_TYPE", "type": "string" } ] } }, "destinations": { "logAnalytics": [ { "workspaceResourceId": "[variables('workspaceResourceId')]", "name": "clv2ws1" } ] }, "dataFlows": [ { "streams": [ "Custom-SalesforceServiceCloudV2_CL" ], "destinations": [ "clv2ws1" ], "outputStream": "Custom-SalesforceServiceCloudV2_CL", "transformKql": "source | project TimeGenerated=iff(isempty(TIMESTAMP_DERIVED),now(),todatetime(TIMESTAMP_DERIVED)),RequestSize=REQUEST_SIZE,ExecTime=EXEC_TIME,Action=ACTION,PlatformType=PLATFORM_TYPE,OsName=OS_NAME,OsVersion=OS_VERSION,TimeStamp=TIMESTAMP,StatusCode=STATUS_CODE,EventType=EVENT_TYPE,ReferrerUri=REFERRER_URI,UserAgent=USER_AGENT,BrowserType=BROWSER_TYPE,Time=TIME,ResponseSize=RESPONSE_SIZE,DeviceId=DEVICE_ID,DeviceModel=DEVICE_MODEL,SourceIp=SOURCE_IP,ClientIp=CLIENT_IP,Success=SUCCESS,Uri=URI,Url=URL,ClientName=CLIENT_NAME,UserType=USER_TYPE,UserInitiatedLogout=USER_INITIATED_LOGOUT,UserIdDerived=USER_ID_DERIVED,UserId=USER_ID,UserEmail=USER_EMAIL,UserName=USER_NAME,User=USER,UriIdDerived=URI_ID_DERIVED,UiEventType=UI_EVENT_TYPE,UiEventTimestamp=UI_EVENT_TIMESTAMP,UiEventSource=UI_EVENT_SOURCE,UiEventSequenceNum=UI_EVENT_SEQUENCE_NUM,UiEventId=UI_EVENT_ID,TlsProtocol=TLS_PROTOCOL,TimestampDerived=TIMESTAMP_DERIVED,TargetUiElement=TARGET_UI_ELEMENT,Sort=SORT,SessionType=SESSION_TYPE,SessionLevel=SESSION_LEVEL,SessionKey=SESSION_KEY,SearchQuery=SEARCH_QUERY,SdkVersion=SDK_VERSION,SdkAppVersion=SDK_APP_VERSION,SdkAppType=SDK_APP_TYPE,RunTime=RUN_TIME,RowsProcessed=ROWS_PROCESSED,RowCount=ROW_COUNT,ResolutionType=RESOLUTION_TYPE,RequestStatus=REQUEST_STATUS,RequestId=REQUEST_ID,ReportIdDerived=REPORT_ID_DERIVED,ReportId=REPORT_ID,RenderingType=RENDERING_TYPE,RelatedList=RELATED_LIST,RecordType=RECORD_TYPE,RecordId=RECORD_ID,Quiddity=QUIDDITY,QueryId=QUERY_ID,PrevpageUrl=PREVPAGE_URL,PrevpageEntityType=PREVPAGE_ENTITY_TYPE,PrevpageEntityId=PREVPAGE_ENTITY_ID,PrevpageContext=PREVPAGE_CONTEXT,PrevpageAppName=PREVPAGE_APP_NAME,PrefixesSearched=PREFIXES_SEARCHED,ParentUiElement=PARENT_UI_ELEMENT,PageUrl=PAGE_URL,PageStartTime=PAGE_START_TIME,PageEntityType=PAGE_ENTITY_TYPE,PageEntityId=PAGE_ENTITY_ID,PageContext=PAGE_CONTEXT,PageAppName=PAGE_APP_NAME,Origin=ORIGIN,OrganizationId=ORGANIZATION_ID,NumResults=NUM_RESULTS,NumberSoqlQueries=NUMBER_SOQL_QUERIES,NumberFields=NUMBER_FIELDS,NumberExceptionFilters=NUMBER_EXCEPTION_FILTERS,NumberColumns=NUMBER_COLUMNS,NumberBuckets=NUMBER_BUCKETS,MethodName=METHOD_NAME,Method=METHOD,MediaType=MEDIA_TYPE,LoginStatus=LOGIN_STATUS,LoginKey=LOGIN_KEY,HttpMethod=HTTP_METHOD,GrandparentUiElement=GRANDPARENT_UI_ELEMENT,EntryPoint=ENTRY_POINT,EntityName=ENTITY_NAME,Entity=ENTITY,EffectivePageTime=EFFECTIVE_PAGE_TIME,Duration=DURATION,DisplayType=DISPLAY_TYPE,DeviceSessionId=DEVICE_SESSION_ID,DevicePlatform=DEVICE_PLATFORM,DbTotalTime=DB_TOTAL_TIME,DbCpuTime=DB_CPU_TIME,DbBlocks=DB_BLOCKS,CpuTime=CPU_TIME,ConnectionType=CONNECTION_TYPE,ComponentName=COMPONENT_NAME,ClientVersion=CLIENT_VERSION,ClientId=CLIENT_ID,CipherSuite=CIPHER_SUITE,CalloutTime=CALLOUT_TIME,BrowserVersion=BROWSER_VERSION,BrowserName=BROWSER_NAME,AverageRowSize=AVERAGE_ROW_SIZE,AppType=APP_TYPE,AppName=APP_NAME,ApiVersion=API_VERSION,ApiType=API_TYPE,ArticleVersionId=ARTICLE_VERSION_ID,ArticleVersion=ARTICLE_VERSION,ArticleStatus=ARTICLE_STATUS,ArticleId=ARTICLE_ID,AnalyticsMode=ANALYTICS_MODE,BatchId=BATCH_ID,ClickedRecordId=CLICKED_RECORD_ID,ClassName=CLASS_NAME,ComponentIdDerived=COMPONENT_ID_DERIVED,ComponentId=COMPONENT_ID,ControllerType=CONTROLLER_TYPE,Context=CONTEXT,ConsoleIdDerived=CONSOLE_ID_DERIVED,ConsoleId=CONSOLE_ID,ClientInfo=CLIENT_INFO,DstBytes=DST_BYTES,DstUser=DST_USER,DstUserSid=DST_USER_SID,DstUserSidDerived=DST_USER_SID_DERIVED,Data=DATA,DashboardType=DASHBOARD_TYPE,DashboardIdDerived=DASHBOARD_ID_DERIVED,DashboardId=DASHBOARD_ID,DashboardComponentId=DASHBOARD_COMPONENT_ID,DvcAction=DVC_ACTION,DvcOs=DVC_OS,DvcOsName=DVC_OS_NAME,DvcOsVersion=DVC_OS_VERSION,DeliveryLocation=DELIVERY_LOCATION,DeliveryId=DELIVERY_ID,DocumentIdDerived=DOCUMENT_ID_DERIVED,DocumentId=DOCUMENT_ID,EntityType=ENTITY_TYPE,EntityId=ENTITY_ID,FileType=FILE_TYPE,FilePreviewType=FILE_PREVIEW_TYPE,ExceptionType=EXCEPTION_TYPE,ExceptionMessage=EXCEPTION_MESSAGE,Ept=EPT,EventCount=EVENT_COUNT,EventEndTime=EVENT_END_TIME,EventResult=EVENT_RESULT,FileSize=FILE_SIZE,HttpReferrerOriginal=HTTP_REFERRER_ORIGINAL,HttpUserAgentOriginal=HTTP_USER_AGENT_ORIGINAL,HttpUserAgent=HTTP_USER_AGENT,LogGroupId=LOG_GROUP_ID,LimitUsagePercent=LIMIT_USAGE_PERCENT,LicenseContext=LICENSE_CONTEXT,LastVersion=LAST_VERSION,Language=LANGUAGE,JobId=JOB_ID,IsSuccess=IS_SUCCESS,IsSecure=IS_SECURE,IsScheduled=IS_SCHEDULED,IsNew=IS_NEW,IsMobile=IS_MOBILE,IsLongRunningRequest=IS_LONG_RUNNING_REQUEST,IsGuest=IS_GUEST,IsFirstRequest=IS_FIRST_REQUEST,IsError=IS_ERROR,IsApi=IS_API,IsAjaxRequest=IS_AJAX_REQUEST,ManagedPackageNamespace=MANAGED_PACKAGE_NAMESPACE,HttpHeaders=HTTP_HEADERS,NetworkDuration=NETWORK_DURATION,Name=NAME,NumberFailures=NUMBER_FAILURES,NumClicks=NUM_CLICKS,OperationType=OPERATION_TYPE,NumSessions=NUM_SESSIONS,PageName=PAGE_NAME,Query=QUERY,RequestType=REQUEST_TYPE,ReportDescription=REPORT_DESCRIPTION,ReopenCount=REOPEN_COUNT,RelatedEntityId=RELATED_ENTITY_ID,RecordIdDerived=RECORD_ID_DERIVED,ReadTime=READ_TIME,Rank=RANK,SrcBytes=SRC_BYTES,SrcDvcId=SRC_DVC_ID,SrcDvcModelName=SRC_DVC_MODEL_NAME,SrcIpAddr=SRC_IP_ADDR,SrcNatIpAddr=SRC_NAT_IP_ADDR,SessionId=SESSION_ID,SiteId=SITE_ID,SharingPermission=SHARING_PERMISSION,SharingOperation=SHARING_OPERATION,SharedWithEntityId=SHARED_WITH_ENTITY_ID,UrlOriginal=URL_ORIGINAL,WaveTimeStamp=WAVE_TIMESTAMP,WaveSessionId=WAVE_SESSION_ID,ViewStateSize=VIEW_STATE_SIZE,VersionIdDerived=VERSION_ID_DERIVED,VersionId=VERSION_ID,TriggerType=TRIGGER_TYPE,TriggerName=TRIGGER_NAME,TriggerId=TRIGGER_ID,TransactionType=TRANSACTION_TYPE,TotalTime=TOTAL_TIME,TabId=TAB_ID,StackTrace=STACK_TRACE,AssetType=ASSET_TYPE,BlockedUri=BLOCKED_URI,BlockedUriDomain=BLOCKED_URI_DOMAIN,BotIdentifier=BOT_IDENTIFIER,BotSessionIdentifier=BOT_SESSION_IDENTIFIER,ClientGeo=CLIENT_GEO,ConnectEnd=CONNECT_END,ConnectStart=CONNECT_START,ConnectedAppId=CONNECTED_APP_ID,DecodedBodySize=DECODED_BODY_SIZE,Disposition=DISPOSITION,DomainLookupEnd=DOMAIN_LOOKUP_END,DomainLookupStart=DOMAIN_LOOKUP_START,EncodedBodySize=ENCODED_BODY_SIZE,ErrorMessage=ERROR_MESSAGE,ExecuteMs=EXECUTE_MS,FetchMs=FETCH_MS,FetchStart=FETCH_START,Filter=FILTER,FirstInterimResponseStart=FIRST_INTERIM_RESPONSE_START,FlowVersionId=FLOW_VERSION_ID,InitiatorType=INITIATOR_TYPE,Limit=LIMIT,Message=MESSAGE,NextHopProtocol=NEXT_HOP_PROTOCOL,NextLink=NEXT_LINK,NumberOfRecords=NUMBER_OF_RECORDS,Offset=OFFSET,Operation=OPERATION,Orderby=ORDERBY,ParentCallout=PARENT_CALLOUT,PlannerIdentifier=PLANNER_IDENTIFIER,ProviderType=PROVIDER_TYPE,RedirectEnd=REDIRECT_END,RedirectStart=REDIRECT_START,Referrer=REFERRER,RenderBlockingStatus=RENDER_BLOCKING_STATUS,RequestStart=REQUEST_START,ResponseEnd=RESPONSE_END,ResponseStart=RESPONSE_START,ResponseStatus=RESPONSE_STATUS,Rows=ROWS,RowsFetched=ROWS_FETCHED,Search=SEARCH,SecureConnectStart=SECURE_CONNECT_START,Select=SELECT,ServerRequestId=SERVER_REQUEST_ID,StartTime=START_TIME,Status=STATUS,Subqueries=SUBQUERIES,Throughput=THROUGHPUT,TotalMs=TOTAL_MS,TransferSize=TRANSFER_SIZE,EventObjectType=TYPE,UiEventRelativeTimestamp=UI_EVENT_RELATIVE_TIMESTAMP,UiRootActivityId=UI_ROOT_ACTIVITY_ID,UiThreadResponseDelay=UI_THREAD_RESPONSE_DELAY,ViewMode=VIEW_MODE,WorkerStart=WORKER_START,AccessError=ACCESS_ERROR,ActionMessage=ACTION_MESSAGE,ActionName=ACTION_NAME,ActionType=ACTION_TYPE,ActionVersion=ACTION_VERSION,ActualLoggedInUserId=ACTUAL_LOGGED_IN_USER_ID,AgentAction=AGENT_ACTION,AllOrNone=ALL_OR_NONE,ApiCaller=API_CALLER,ApiClientCategory=API_CLIENT_CATEGORY,ApiFamily=API_FAMILY,ApiResource=API_RESOURCE,AssetId=ASSET_ID,AuthenticationContextClassReference=AUTHENTICATION_CONTEXT_CLASS_REFERENCE,AuthenticationMethodReference=AUTHENTICATION_METHOD_REFERENCE,AuthenticationServiceId=AUTHENTICATION_SERVICE_ID,B2bEdition=B2B_EDITION,B2bVersion=B2B_VERSION,BrowserDeviceType=BROWSER_DEVICE_TYPE,Bytes=BYTES,CallerPackageNamespace=CALLER_PACKAGE_NAMESPACE,CancelledReason=CANCELLED_REASON,ChangeSetName=CHANGE_SET_NAME,ColumnNumber=COLUMN_NUMBER,ConcurrencyMode=CONCURRENCY_MODE,ConnectedAppName=CONNECTED_APP_NAME,ContextId=CONTEXT_ID,ContextMap=CONTEXT_MAP,ContinuationId=CONTINUATION_ID,CorrelationId=CORRELATION_ID,Count=COUNT,CountsAgainstApiLimit=COUNTS_AGAINST_API_LIMIT,CountryCode=COUNTRY_CODE,CurrentSandboxOrgId=CURRENT_SANDBOX_ORG_ID,DataSourceName=DATA_SOURCE_NAME,DatasetIds=DATASET_IDS,DelegatedUserId=DELEGATED_USER_ID,DelegatedUserIdDerived=DELEGATED_USER_ID_DERIVED,DelegatedUserName=DELEGATED_USER_NAME,Description=DESCRIPTION,Directive=DIRECTIVE,DmlType=DML_TYPE,DocumentUri=DOCUMENT_URI,DomComplete=DOM_COMPLETE,DomContentLoadedEventEnd=DOM_CONTENT_LOADED_EVENT_END,DomContentLoadedEventStart=DOM_CONTENT_LOADED_EVENT_START,DomInteractive=DOM_INTERACTIVE,Domain=DOMAIN,DownloadError=DOWNLOAD_ERROR,DownloadFormat=DOWNLOAD_FORMAT,EasySuiteValue=EASY_SUITE_VALUE,EffectiveAccountId=EFFECTIVE_ACCOUNT_ID,EffectivePageTimeDeviation=EFFECTIVE_PAGE_TIME_DEVIATION,EffectivePageTimeDeviationErrorType=EFFECTIVE_PAGE_TIME_DEVIATION_ERROR_TYPE,EffectivePageTimeDeviationReason=EFFECTIVE_PAGE_TIME_DEVIATION_REASON,ErrorCode=ERROR_CODE,ErrorDescription=ERROR_DESCRIPTION,ErrorTimestamp=ERROR_TIMESTAMP,EvaluationTimeMs=EVALUATION_TIME_MS,EventTimestamp=EVENT_TIMESTAMP,ExceptionCategory=EXCEPTION_CATEGORY,Expand=EXPAND,ExternalObject=EXTERNAL_OBJECT,FailureReason=FAILURE_REASON,FailureType=FAILURE_TYPE,FeatureId=FEATURE_ID,FirstEntityId=FIRST_ENTITY_ID,FlowLoadTime=FLOW_LOAD_TIME,FlowProcessType=FLOW_PROCESS_TYPE,ForwardedForIp=FORWARDED_FOR_IP,GroupId=GROUP_ID,GroupType=GROUP_TYPE,HasChart=HAS_CHART,Having=HAVING,Host=HOST,HttpReferer=HTTP_REFERER,InitialReferenceIds=INITIAL_REFERENCE_IDS,InsecureUri=INSECURE_URI,InvocationSource=INVOCATION_SOURCE,InvokingApexClassName=INVOKING_APEX_CLASS_NAME,IsBlockedRedirection=IS_BLOCKED_REDIRECTION,IsCancelled=IS_CANCELLED,IsInitial=IS_INITIAL,IsManaged=IS_MANAGED,IsPush=IS_PUSH,IsReleased=IS_RELEASED,IsRequestCollationOn=IS_REQUEST_COLLATION_ON,IsRetry=IS_RETRY,IsSuccessful=IS_SUCCESSFUL,JobStatus=JOB_STATUS,KeyId=KEY_ID,KeyIdDerived=KEY_ID_DERIVED,KeyPrefix=KEY_PREFIX,KeyType=KEY_TYPE,LargeLanguageModel=LARGE_LANGUAGE_MODEL,Library=LIBRARY,LineNumber=LINE_NUMBER,LoadEventEnd=LOAD_EVENT_END,LoadEventStart=LOAD_EVENT_START,LoginSubType=LOGIN_SUB_TYPE,LoginType=LOGIN_TYPE,LoginUrl=LOGIN_URL,MalformedUrl=MALFORMED_URL,MasterReportId=MASTER_REPORT_ID,MemberId=MEMBER_ID,NamedCredentialName=NAMED_CREDENTIAL_NAME,NavigationType=NAVIGATION_TYPE,NetworkId=NETWORK_ID,NumGraphDepth=NUM_GRAPH_DEPTH,NumRetries=NUM_RETRIES,NumRows=NUM_ROWS,NumberOfErrors=NUMBER_OF_ERRORS,NumberOfInterviews=NUMBER_OF_INTERVIEWS,NumberRequests=NUMBER_REQUESTS,OperationStage=OPERATION_STAGE,OperationState=OPERATION_STATE,OperationStatus=OPERATION_STATUS,OperationTime=OPERATION_TIME,OriginRequestId=ORIGIN_REQUEST_ID,PackageName=PACKAGE_NAME,PageFlexiPageNameOrId=PAGE_FLEXI_PAGE_NAME_OR_ID,PageFlexiPageType=PAGE_FLEXI_PAGE_TYPE,PageId=PAGE_ID,Path=PATH,PendingSandboxOrgId=PENDING_SANDBOX_ORG_ID,PermissionType=PERMISSION_TYPE,PolicyId=POLICY_ID,PolicyIdDerived=POLICY_ID_DERIVED,PricingApiEndpoint=PRICING_API_ENDPOINT,PricingDetails=PRICING_DETAILS,PricingErrorCode=PRICING_ERROR_CODE,PricingLogName=PRICING_LOG_NAME,PricingProcedure=PRICING_PROCEDURE,PricingStatus=PRICING_STATUS,ProcessType=PROCESS_TYPE,PromptTemplate=PROMPT_TEMPLATE,QueryIdentifier=QUERY_IDENTIFIER,QueryType=QUERY_TYPE,RateLimitUsagePercent=RATE_LIMIT_USAGE_PERCENT,RecordsFailed=RECORDS_FAILED,RecordsProcessed=RECORDS_PROCESSED,RedirectCount=REDIRECT_COUNT,RedirectReason=REDIRECT_REASON,RemoteAddress=REMOTE_ADDRESS,RequestCount=REQUEST_COUNT,RequestFormSize=REQUEST_FORM_SIZE,RequestMethod=REQUEST_METHOD,RequestPath=REQUEST_PATH,RequestUri=REQUEST_URI,RequestedAccessLevel=REQUESTED_ACCESS_LEVEL,Requests=REQUESTS,RequestsLimit=REQUESTS_LIMIT,ResourceSample=RESOURCE_SAMPLE,Result=RESULT,ResultSizeMb=RESULT_SIZE_MB,SampleFactor=SAMPLE_FACTOR,SandboxId=SANDBOX_ID,SavedViewId=SAVED_VIEW_ID,Sequence=SEQUENCE,ServiceName=SERVICE_NAME,SizeBytes=SIZE_BYTES,Source=SOURCE,SourceFile=SOURCE_FILE,SourceHostname=SOURCE_HOSTNAME,SqlId=SQL_ID,TableName=TABLE_NAME,TargetHostname=TARGET_HOSTNAME,TargetOrgId=TARGET_ORG_ID,TotalExecutionTime=TOTAL_EXECUTION_TIME,UiNumberColumns=UI_NUMBER_COLUMNS,UniqueId=UNIQUE_ID,UnloadEventEnd=UNLOAD_EVENT_END,UnloadEventStart=UNLOAD_EVENT_START,UpdateType=UPDATE_TYPE,UseApiToken=USE_API_TOKEN,UsingMru=USING_MRU,VfControllerSize=VF_CONTROLLER_SIZE,ViewingUserId=VIEWING_USER_ID,WebstoreId=WEBSTORE_ID,WebstoreType=WEBSTORE_TYPE" } ] } }, { "name": "[variables('_logAnalyticsTableId1')]", "apiVersion": "2021-03-01-privatepreview", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "schema": { "name": "[variables('_logAnalyticsTableId1')]", "description": "Event Log data", "columns": [ { "name": "TimeGenerated", "type": "datetime", "isDefaultDisplay": true }, { "name": "RequestSize", "type": "string", "description": "The size of the request payload." }, { "name": "ExecTime", "type": "string", "description": "The execution time of the request." }, { "name": "Action", "type": "string", "description": "The action performed." }, { "name": "PlatformType", "type": "string", "description": "The platform type." }, { "name": "OsName", "type": "string", "description": "The operating system name." }, { "name": "OsVersion", "type": "string", "description": "The operating system version." }, { "name": "TimeStamp", "type": "string", "description": "The timestamp of the event." }, { "name": "StatusCode", "type": "string", "description": "The status code of the response." }, { "name": "EventType", "type": "string", "description": "The type of the event." }, { "name": "ReferrerUri", "type": "string", "description": "The referrer URI." }, { "name": "UserAgent", "type": "string", "description": "The user agent." }, { "name": "BrowserType", "type": "string", "description": "The browser type." }, { "name": "Time", "type": "string", "description": "The time of the event." }, { "name": "ResponseSize", "type": "string", "description": "The size of the response payload." }, { "name": "DeviceId", "type": "string", "description": "The device ID." }, { "name": "DeviceModel", "type": "string", "description": "The device model." }, { "name": "SourceIp", "type": "string", "description": "The source IP address." }, { "name": "ClientIp", "type": "string", "description": "The client IP address." }, { "name": "Success", "type": "string", "description": "Indicates if the request was successful." }, { "name": "Uri", "type": "string", "description": "The URI of the request." }, { "name": "Url", "type": "string", "description": "The URL of the request." }, { "name": "ClientName", "type": "string", "description": "The name of the client." }, { "name": "UserType", "type": "string", "description": "The type of the user." }, { "name": "UserInitiatedLogout", "type": "string", "description": "Indicates if the logout was user-initiated." }, { "name": "UserIdDerived", "type": "string", "description": "The derived user ID." }, { "name": "UserId", "type": "string", "description": "The user ID." }, { "name": "UserEmail", "type": "string", "description": "The user email." }, { "name": "UserName", "type": "string", "description": "The user name." }, { "name": "User", "type": "string", "description": "The user." }, { "name": "UriIdDerived", "type": "string", "description": "The derived URI ID." }, { "name": "UiEventType", "type": "string", "description": "The UI event type." }, { "name": "UiEventTimestamp", "type": "string", "description": "The UI event timestamp." }, { "name": "UiEventSource", "type": "string", "description": "The UI event source." }, { "name": "UiEventSequenceNum", "type": "string", "description": "The UI event sequence number." }, { "name": "UiEventId", "type": "string", "description": "The UI event ID." }, { "name": "TlsProtocol", "type": "string", "description": "The TLS protocol." }, { "name": "TimestampDerived", "type": "datetime", "description": "The derived timestamp." }, { "name": "TargetUiElement", "type": "string", "description": "The target UI element." }, { "name": "Sort", "type": "string", "description": "The sort order." }, { "name": "SessionType", "type": "string", "description": "The session type." }, { "name": "SessionLevel", "type": "string", "description": "The session level." }, { "name": "SessionKey", "type": "string", "description": "The session key." }, { "name": "SearchQuery", "type": "string", "description": "The search query." }, { "name": "SdkVersion", "type": "string", "description": "The SDK version." }, { "name": "SdkAppVersion", "type": "string", "description": "The SDK app version." }, { "name": "SdkAppType", "type": "string", "description": "The SDK app type." }, { "name": "RunTime", "type": "string", "description": "The run time." }, { "name": "RowsProcessed", "type": "string", "description": "The rows processed." }, { "name": "RowCount", "type": "string", "description": "The row count." }, { "name": "ResolutionType", "type": "string", "description": "The resolution type." }, { "name": "RequestStatus", "type": "string", "description": "The request status." }, { "name": "RequestId", "type": "string", "description": "The request ID." }, { "name": "ReportIdDerived", "type": "string", "description": "The derived report ID." }, { "name": "ReportId", "type": "string", "description": "The report ID." }, { "name": "RenderingType", "type": "string", "description": "The rendering type." }, { "name": "RelatedList", "type": "string", "description": "The related list." }, { "name": "RecordType", "type": "string", "description": "The record type." }, { "name": "RecordId", "type": "string", "description": "The record ID." }, { "name": "Quiddity", "type": "string", "description": "The quiddity." }, { "name": "QueryId", "type": "string", "description": "The query ID." }, { "name": "PrevpageUrl", "type": "string", "description": "The previous page URL." }, { "name": "PrevpageEntityType", "type": "string", "description": "The previous page entity type." }, { "name": "PrevpageEntityId", "type": "string", "description": "The previous page entity ID." }, { "name": "PrevpageContext", "type": "string", "description": "The previous page context." }, { "name": "PrevpageAppName", "type": "string", "description": "The previous page app name." }, { "name": "PrefixesSearched", "type": "string", "description": "The prefixes searched." }, { "name": "ParentUiElement", "type": "string", "description": "The parent UI element." }, { "name": "PageUrl", "type": "string", "description": "The page URL." }, { "name": "PageStartTime", "type": "string", "description": "The page start time." }, { "name": "PageEntityType", "type": "string", "description": "The page entity type." }, { "name": "PageEntityId", "type": "string", "description": "The page entity ID." }, { "name": "PageContext", "type": "string", "description": "The page context." }, { "name": "PageAppName", "type": "string", "description": "The page app name." }, { "name": "Origin", "type": "string", "description": "The origin." }, { "name": "OrganizationId", "type": "string", "description": "The organization ID." }, { "name": "NumResults", "type": "string", "description": "The number of results." }, { "name": "NumberSoqlQueries", "type": "string", "description": "The number of SOQL queries." }, { "name": "NumberFields", "type": "string", "description": "The number of fields." }, { "name": "NumberExceptionFilters", "type": "string", "description": "The number of exception filters." }, { "name": "NumberColumns", "type": "string", "description": "The number of columns." }, { "name": "NumberBuckets", "type": "string", "description": "The number of buckets." }, { "name": "MethodName", "type": "string", "description": "The method name." }, { "name": "Method", "type": "string", "description": "The method." }, { "name": "MediaType", "type": "string", "description": "The media type." }, { "name": "LoginStatus", "type": "string", "description": "The login status." }, { "name": "LoginKey", "type": "string", "description": "The login key." }, { "name": "HttpMethod", "type": "string", "description": "The HTTP method." }, { "name": "GrandparentUiElement", "type": "string", "description": "The grandparent UI element." }, { "name": "EntryPoint", "type": "string", "description": "The entry point." }, { "name": "EntityName", "type": "string", "description": "The entity name." }, { "name": "Entity", "type": "string", "description": "The entity." }, { "name": "EffectivePageTime", "type": "string", "description": "The effective page time." }, { "name": "Duration", "type": "string", "description": "The duration." }, { "name": "DisplayType", "type": "string", "description": "The display type." }, { "name": "DeviceSessionId", "type": "string", "description": "The device session ID." }, { "name": "DevicePlatform", "type": "string", "description": "The device platform." }, { "name": "DbTotalTime", "type": "string", "description": "The database total time." }, { "name": "DbCpuTime", "type": "string", "description": "The database CPU time." }, { "name": "DbBlocks", "type": "string", "description": "The database blocks." }, { "name": "CpuTime", "type": "string", "description": "The CPU time." }, { "name": "ConnectionType", "type": "string", "description": "The connection type." }, { "name": "ComponentName", "type": "string", "description": "The component name." }, { "name": "ClientVersion", "type": "string", "description": "The client version." }, { "name": "ClientId", "type": "string", "description": "The client ID." }, { "name": "CipherSuite", "type": "string", "description": "The cipher suite." }, { "name": "CalloutTime", "type": "string", "description": "The callout time." }, { "name": "BrowserVersion", "type": "string", "description": "The browser version." }, { "name": "BrowserName", "type": "string", "description": "The browser name." }, { "name": "AverageRowSize", "type": "string", "description": "The average row size." }, { "name": "AppType", "type": "string", "description": "The app type." }, { "name": "AppName", "type": "string", "description": "The app name." }, { "name": "ApiVersion", "type": "string", "description": "The API version." }, { "name": "ApiType", "type": "string", "description": "The API type." }, { "name": "ArticleVersionId", "type": "string", "description": "The article version ID." }, { "name": "ArticleVersion", "type": "string", "description": "The article version." }, { "name": "ArticleStatus", "type": "string", "description": "The article status." }, { "name": "ArticleId", "type": "string", "description": "The article ID." }, { "name": "AnalyticsMode", "type": "string", "description": "The analytics mode." }, { "name": "BatchId", "type": "string", "description": "The batch ID." }, { "name": "ClickedRecordId", "type": "string", "description": "The clicked record ID." }, { "name": "ClassName", "type": "string", "description": "The class name." }, { "name": "ComponentIdDerived", "type": "string", "description": "The component ID derived." }, { "name": "ComponentId", "type": "string", "description": "The component ID." }, { "name": "ControllerType", "type": "string", "description": "The controller type." }, { "name": "Context", "type": "string", "description": "The context." }, { "name": "ConsoleIdDerived", "type": "string", "description": "The console ID derived." }, { "name": "ConsoleId", "type": "string", "description": "The console ID." }, { "name": "ClientInfo", "type": "string", "description": "The client info." }, { "name": "DstBytes", "type": "string", "description": "The destination bytes." }, { "name": "DstUser", "type": "string", "description": "The destination user." }, { "name": "DstUserSid", "type": "string", "description": "The destination user SID." }, { "name": "DstUserSidDerived", "type": "string", "description": "The destination user SID derived." }, { "name": "Data", "type": "string", "description": "The data." }, { "name": "DashboardType", "type": "string", "description": "The dashboard type." }, { "name": "DashboardIdDerived", "type": "string", "description": "The dashboard ID derived." }, { "name": "DashboardId", "type": "string", "description": "The dashboard ID." }, { "name": "DashboardComponentId", "type": "string", "description": "The dashboard component ID." }, { "name": "DvcAction", "type": "string", "description": "The DVC action." }, { "name": "DvcOs", "type": "string", "description": "The DVC OS." }, { "name": "DvcOsName", "type": "string", "description": "The DVC OS name." }, { "name": "DvcOsVersion", "type": "string", "description": "The DVC OS version." }, { "name": "DeliveryLocation", "type": "string", "description": "The delivery location." }, { "name": "DeliveryId", "type": "string", "description": "The delivery ID." }, { "name": "DocumentIdDerived", "type": "string", "description": "The document ID derived." }, { "name": "DocumentId", "type": "string", "description": "The document ID." }, { "name": "EntityType", "type": "string", "description": "The entity type." }, { "name": "EntityId", "type": "string", "description": "The entity ID." }, { "name": "FileType", "type": "string", "description": "The file type." }, { "name": "FilePreviewType", "type": "string", "description": "The file preview type." }, { "name": "ExceptionType", "type": "string", "description": "The exception type." }, { "name": "ExceptionMessage", "type": "string", "description": "The exception message." }, { "name": "Ept", "type": "string", "description": "The EPT." }, { "name": "EventCount", "type": "string", "description": "The event count." }, { "name": "EventEndTime", "type": "string", "description": "The event end time." }, { "name": "EventResult", "type": "string", "description": "The event result." }, { "name": "FileSize", "type": "string", "description": "The file size." }, { "name": "HttpReferrerOriginal", "type": "string", "description": "The HTTP referrer original." }, { "name": "HttpUserAgentOriginal", "type": "string", "description": "The HTTP user agent original." }, { "name": "HttpUserAgent", "type": "string", "description": "The HTTP user agent." }, { "name": "LogGroupId", "type": "string", "description": "The log group ID." }, { "name": "LimitUsagePercent", "type": "string", "description": "The limit usage percent." }, { "name": "LicenseContext", "type": "string", "description": "The license context." }, { "name": "LastVersion", "type": "string", "description": "The last version." }, { "name": "Language", "type": "string", "description": "The language." }, { "name": "JobId", "type": "string", "description": "The job ID." }, { "name": "IsSuccess", "type": "string", "description": "Indicates if the operation was successful." }, { "name": "IsSecure", "type": "string", "description": "Indicates if the connection is secure." }, { "name": "IsScheduled", "type": "string", "description": "Indicates if the job is scheduled." }, { "name": "IsNew", "type": "string", "description": "Indicates if the job is new." }, { "name": "IsMobile", "type": "string", "description": "Indicates if the job is mobile." }, { "name": "IsLongRunningRequest", "type": "string", "description": "Indicates if the job is a long-running request." }, { "name": "IsGuest", "type": "string", "description": "Indicates if the user is a guest." }, { "name": "IsFirstRequest", "type": "string", "description": "Indicates if this is the first request." }, { "name": "IsError", "type": "string", "description": "Indicates if there was an error." }, { "name": "IsApi", "type": "string", "description": "Indicates if the request is an API request." }, { "name": "IsAjaxRequest", "type": "string", "description": "Indicates if the request is an AJAX request." }, { "name": "ManagedPackageNamespace", "type": "string", "description": "The managed package namespace." }, { "name": "HttpHeaders", "type": "string", "description": "The HTTP headers." }, { "name": "NetworkDuration", "type": "string", "description": "The network duration." }, { "name": "Name", "type": "string", "description": "The name." }, { "name": "NumberFailures", "type": "string", "description": "The number of failures." }, { "name": "NumClicks", "type": "string", "description": "The number of clicks." }, { "name": "OperationType", "type": "string", "description": "The operation type." }, { "name": "NumSessions", "type": "string", "description": "The number of sessions." }, { "name": "PageName", "type": "string", "description": "The page name." }, { "name": "Query", "type": "string", "description": "The query." }, { "name": "RequestType", "type": "string", "description": "The request type." }, { "name": "ReportDescription", "type": "string", "description": "The report description." }, { "name": "ReopenCount", "type": "string", "description": "The reopen count." }, { "name": "RelatedEntityId", "type": "string", "description": "The related entity ID." }, { "name": "RecordIdDerived", "type": "string", "description": "The derived record ID." }, { "name": "ReadTime", "type": "string", "description": "The read time." }, { "name": "Rank", "type": "string", "description": "The rank." }, { "name": "SrcBytes", "type": "string", "description": "The source bytes." }, { "name": "SrcDvcId", "type": "string", "description": "The source device ID." }, { "name": "SrcDvcModelName", "type": "string", "description": "The source device model name." }, { "name": "SrcIpAddr", "type": "string", "description": "The source IP address." }, { "name": "SrcNatIpAddr", "type": "string", "description": "The source NAT IP address." }, { "name": "SessionId", "type": "string", "description": "The session ID." }, { "name": "SiteId", "type": "string", "description": "The site ID." }, { "name": "SharingPermission", "type": "string", "description": "The sharing permission." }, { "name": "SharingOperation", "type": "string", "description": "The sharing operation." }, { "name": "SharedWithEntityId", "type": "string", "description": "The shared with entity ID." }, { "name": "UrlOriginal", "type": "string", "description": "The original URL." }, { "name": "WaveTimeStamp", "type": "string", "description": "The wave timestamp." }, { "name": "WaveSessionId", "type": "string", "description": "The wave session ID." }, { "name": "ViewStateSize", "type": "string", "description": "The view state size." }, { "name": "VersionIdDerived", "type": "string", "description": "The derived version ID." }, { "name": "VersionId", "type": "string", "description": "The version ID." }, { "name": "TriggerType", "type": "string", "description": "The trigger type." }, { "name": "TriggerName", "type": "string", "description": "The trigger name." }, { "name": "TriggerId", "type": "string", "description": "The trigger ID." }, { "name": "TransactionType", "type": "string", "description": "The transaction type." }, { "name": "TotalTime", "type": "string", "description": "The total time." }, { "name": "TabId", "type": "string", "description": "The tab ID." }, { "name": "StackTrace", "type": "string", "description": "The stack trace." }, { "name": "AssetType", "type": "string", "description": "The asset type." }, { "name": "BlockedUri", "type": "string", "description": "The blocked URI." }, { "name": "BlockedUriDomain", "type": "string", "description": "The blocked URI domain." }, { "name": "BotIdentifier", "type": "string", "description": "The bot identifier." }, { "name": "BotSessionIdentifier", "type": "string", "description": "The bot session identifier." }, { "name": "ClientGeo", "type": "string", "description": "The client geographic location." }, { "name": "ConnectEnd", "type": "string", "description": "The connection end time." }, { "name": "ConnectStart", "type": "string", "description": "The connection start time." }, { "name": "ConnectedAppId", "type": "string", "description": "The connected app ID." }, { "name": "DecodedBodySize", "type": "string", "description": "The decoded body size." }, { "name": "Disposition", "type": "string", "description": "The disposition." }, { "name": "DomainLookupEnd", "type": "string", "description": "The domain lookup end time." }, { "name": "DomainLookupStart", "type": "string", "description": "The domain lookup start time." }, { "name": "EncodedBodySize", "type": "string", "description": "The encoded body size." }, { "name": "ErrorMessage", "type": "string", "description": "The error message." }, { "name": "ExecuteMs", "type": "string", "description": "The execution time in milliseconds." }, { "name": "FetchMs", "type": "string", "description": "The fetch time in milliseconds." }, { "name": "FetchStart", "type": "string", "description": "The fetch start time." }, { "name": "Filter", "type": "string", "description": "The filter." }, { "name": "FirstInterimResponseStart", "type": "string", "description": "The first interim response start time." }, { "name": "FlowVersionId", "type": "string", "description": "The flow version ID." }, { "name": "InitiatorType", "type": "string", "description": "The initiator type." }, { "name": "Limit", "type": "string", "description": "The limit." }, { "name": "Message", "type": "string", "description": "The message." }, { "name": "NextHopProtocol", "type": "string", "description": "The next hop protocol." }, { "name": "NextLink", "type": "string", "description": "The next link." }, { "name": "NumberOfRecords", "type": "string", "description": "The number of records." }, { "name": "Offset", "type": "string", "description": "The offset." }, { "name": "Operation", "type": "string", "description": "The operation." }, { "name": "Orderby", "type": "string", "description": "The order by clause." }, { "name": "ParentCallout", "type": "string", "description": "The parent callout." }, { "name": "PlannerIdentifier", "type": "string", "description": "The planner identifier." }, { "name": "ProviderType", "type": "string", "description": "The provider type." }, { "name": "RedirectEnd", "type": "string", "description": "The redirect end time." }, { "name": "RedirectStart", "type": "string", "description": "The redirect start time." }, { "name": "Referrer", "type": "string", "description": "The referrer." }, { "name": "RenderBlockingStatus", "type": "string", "description": "The render blocking status." }, { "name": "RequestStart", "type": "string", "description": "The request start time." }, { "name": "ResponseEnd", "type": "string", "description": "The response end time." }, { "name": "ResponseStart", "type": "string", "description": "The response start time." }, { "name": "ResponseStatus", "type": "string", "description": "The response status." }, { "name": "Rows", "type": "string", "description": "The rows." }, { "name": "RowsFetched", "type": "string", "description": "The rows fetched." }, { "name": "Search", "type": "string", "description": "The search." }, { "name": "SecureConnectStart", "type": "string", "description": "The secure connection start time." }, { "name": "Select", "type": "string", "description": "The select clause." }, { "name": "ServerRequestId", "type": "string", "description": "The server request ID." }, { "name": "StartTime", "type": "string", "description": "The start time." }, { "name": "Status", "type": "string", "description": "The status." }, { "name": "Subqueries", "type": "string", "description": "The subqueries." }, { "name": "Throughput", "type": "string", "description": "The throughput." }, { "name": "TotalMs", "type": "string", "description": "The total time in milliseconds." }, { "name": "TransferSize", "type": "string", "description": "The transfer size." }, { "name": "EventObjectType", "type": "string", "description": "The type." }, { "name": "UiEventRelativeTimestamp", "type": "string", "description": "The UI event relative timestamp." }, { "name": "UiRootActivityId", "type": "string", "description": "The UI root activity ID." }, { "name": "UiThreadResponseDelay", "type": "string", "description": "The UI thread response delay." }, { "name": "ViewMode", "type": "string", "description": "The view mode." }, { "name": "WorkerStart", "type": "string", "description": "The worker start time." }, { "name": "AccessError", "type": "string", "description": "The access error." }, { "name": "ActionMessage", "type": "string", "description": "The action message." }, { "name": "ActionName", "type": "string", "description": "The action name." }, { "name": "ActionType", "type": "string", "description": "The action type." }, { "name": "ActionVersion", "type": "string", "description": "The action version." }, { "name": "ActualLoggedInUserId", "type": "string", "description": "The actual logged-in user ID." }, { "name": "AgentAction", "type": "string", "description": "The agent action." }, { "name": "AllOrNone", "type": "string", "description": "Indicates if the operation is all or none." }, { "name": "ApiCaller", "type": "string", "description": "The API caller." }, { "name": "ApiClientCategory", "type": "string", "description": "The API client category." }, { "name": "ApiFamily", "type": "string", "description": "The API family." }, { "name": "ApiResource", "type": "string", "description": "The API resource." }, { "name": "AssetId", "type": "string", "description": "The asset ID." }, { "name": "AuthenticationContextClassReference", "type": "string", "description": "The authentication context class reference." }, { "name": "AuthenticationMethodReference", "type": "string", "description": "The authentication method reference." }, { "name": "AuthenticationServiceId", "type": "string", "description": "The authentication service ID." }, { "name": "B2bEdition", "type": "string", "description": "The B2B edition." }, { "name": "B2bVersion", "type": "string", "description": "The B2B version." }, { "name": "BrowserDeviceType", "type": "string", "description": "The browser device type." }, { "name": "Bytes", "type": "string", "description": "The bytes." }, { "name": "CallerPackageNamespace", "type": "string", "description": "The caller package namespace." }, { "name": "CancelledReason", "type": "string", "description": "The cancelled reason." }, { "name": "ChangeSetName", "type": "string", "description": "The change set name." }, { "name": "ColumnNumber", "type": "string", "description": "The column number." }, { "name": "ConcurrencyMode", "type": "string", "description": "The concurrency mode." }, { "name": "ConnectedAppName", "type": "string", "description": "The connected app name." }, { "name": "ContextId", "type": "string", "description": "The context ID." }, { "name": "ContextMap", "type": "string", "description": "The context map." }, { "name": "ContinuationId", "type": "string", "description": "The continuation ID." }, { "name": "CorrelationId", "type": "string", "description": "The correlation ID." }, { "name": "Count", "type": "string", "description": "The count." }, { "name": "CountsAgainstApiLimit", "type": "string", "description": "Indicates if the request counts against the API limit." }, { "name": "CountryCode", "type": "string", "description": "The country code." }, { "name": "CurrentSandboxOrgId", "type": "string", "description": "The current sandbox org ID." }, { "name": "DataSourceName", "type": "string", "description": "The data source name." }, { "name": "DatasetIds", "type": "string", "description": "The dataset IDs." }, { "name": "DelegatedUserId", "type": "string", "description": "The delegated user ID." }, { "name": "DelegatedUserIdDerived", "type": "string", "description": "The derived delegated user ID." }, { "name": "DelegatedUserName", "type": "string", "description": "The delegated user name." }, { "name": "Description", "type": "string", "description": "The description." }, { "name": "Directive", "type": "string", "description": "The directive." }, { "name": "DmlType", "type": "string", "description": "The DML type." }, { "name": "DocumentUri", "type": "string", "description": "The document URI." }, { "name": "DomComplete", "type": "string", "description": "The DOM complete time." }, { "name": "DomContentLoadedEventEnd", "type": "string", "description": "The DOM content loaded event end time." }, { "name": "DomContentLoadedEventStart", "type": "string", "description": "The DOM content loaded event start time." }, { "name": "DomInteractive", "type": "string", "description": "The DOM interactive time." }, { "name": "Domain", "type": "string", "description": "The domain." }, { "name": "DownloadError", "type": "string", "description": "The download error." }, { "name": "DownloadFormat", "type": "string", "description": "The download format." }, { "name": "EasySuiteValue", "type": "string", "description": "The easy suite value." }, { "name": "EffectiveAccountId", "type": "string", "description": "The effective account ID." }, { "name": "EffectivePageTimeDeviation", "type": "string", "description": "The effective page time deviation." }, { "name": "EffectivePageTimeDeviationErrorType", "type": "string", "description": "The effective page time deviation error type." }, { "name": "EffectivePageTimeDeviationReason", "type": "string", "description": "The effective page time deviation reason." }, { "name": "ErrorCode", "type": "string", "description": "The error code." }, { "name": "ErrorDescription", "type": "string", "description": "The error description." }, { "name": "ErrorTimestamp", "type": "string", "description": "The error timestamp." }, { "name": "EvaluationTimeMs", "type": "string", "description": "The evaluation time in milliseconds." }, { "name": "EventTimestamp", "type": "string", "description": "The event timestamp." }, { "name": "ExceptionCategory", "type": "string", "description": "The exception category." }, { "name": "Expand", "type": "string", "description": "The expand clause." }, { "name": "ExternalObject", "type": "string", "description": "The external object." }, { "name": "FailureReason", "type": "string", "description": "The failure reason." }, { "name": "FailureType", "type": "string", "description": "The failure type." }, { "name": "FeatureId", "type": "string", "description": "The feature ID." }, { "name": "FirstEntityId", "type": "string", "description": "The first entity ID." }, { "name": "FlowLoadTime", "type": "string", "description": "The flow load time." }, { "name": "FlowProcessType", "type": "string", "description": "The flow process type." }, { "name": "ForwardedForIp", "type": "string", "description": "The forwarded-for IP address.", "dataTypeHint": "IP" }, { "name": "GroupId", "type": "string", "description": "The group ID." }, { "name": "GroupType", "type": "string", "description": "The group type." }, { "name": "HasChart", "type": "string", "description": "Indicates if the report has a chart." }, { "name": "Having", "type": "string", "description": "The HAVING clause." }, { "name": "Host", "type": "string", "description": "The host." }, { "name": "HttpReferer", "type": "string", "description": "The HTTP referer." }, { "name": "InitialReferenceIds", "type": "string", "description": "The initial reference IDs." }, { "name": "InsecureUri", "type": "string", "description": "The insecure URI." }, { "name": "InvocationSource", "type": "string", "description": "The invocation source." }, { "name": "InvokingApexClassName", "type": "string", "description": "The invoking Apex class name." }, { "name": "IsBlockedRedirection", "type": "string", "description": "Indicates if the redirection was blocked." }, { "name": "IsCancelled", "type": "string", "description": "Indicates if the operation was cancelled." }, { "name": "IsInitial", "type": "string", "description": "Indicates if this is the initial request." }, { "name": "IsManaged", "type": "string", "description": "Indicates if the package is managed." }, { "name": "IsPush", "type": "string", "description": "Indicates if this is a push operation." }, { "name": "IsReleased", "type": "string", "description": "Indicates if the package is released." }, { "name": "IsRequestCollationOn", "type": "string", "description": "Indicates if request collation is on." }, { "name": "IsRetry", "type": "string", "description": "Indicates if this is a retry." }, { "name": "IsSuccessful", "type": "string", "description": "Indicates if the operation was successful." }, { "name": "JobStatus", "type": "string", "description": "The job status." }, { "name": "KeyId", "type": "string", "description": "The key ID." }, { "name": "KeyIdDerived", "type": "string", "description": "The derived key ID." }, { "name": "KeyPrefix", "type": "string", "description": "The key prefix." }, { "name": "KeyType", "type": "string", "description": "The key type." }, { "name": "LargeLanguageModel", "type": "string", "description": "The large language model." }, { "name": "Library", "type": "string", "description": "The library." }, { "name": "LineNumber", "type": "string", "description": "The line number." }, { "name": "LoadEventEnd", "type": "string", "description": "The load event end time." }, { "name": "LoadEventStart", "type": "string", "description": "The load event start time." }, { "name": "LoginSubType", "type": "string", "description": "The login sub type." }, { "name": "LoginType", "type": "string", "description": "The login type." }, { "name": "LoginUrl", "type": "string", "description": "The login URL.", "dataTypeHint": "URI" }, { "name": "MalformedUrl", "type": "string", "description": "Indicates if the URL was malformed." }, { "name": "MasterReportId", "type": "string", "description": "The master report ID." }, { "name": "MemberId", "type": "string", "description": "The member ID." }, { "name": "NamedCredentialName", "type": "string", "description": "The named credential name." }, { "name": "NavigationType", "type": "string", "description": "The navigation type." }, { "name": "NetworkId", "type": "string", "description": "The network ID." }, { "name": "NumGraphDepth", "type": "string", "description": "The number of graph depth levels." }, { "name": "NumRetries", "type": "string", "description": "The number of retries." }, { "name": "NumRows", "type": "string", "description": "The number of rows." }, { "name": "NumberOfErrors", "type": "string", "description": "The number of errors." }, { "name": "NumberOfInterviews", "type": "string", "description": "The number of interviews." }, { "name": "NumberRequests", "type": "string", "description": "The number of requests." }, { "name": "OperationStage", "type": "string", "description": "The operation stage." }, { "name": "OperationState", "type": "string", "description": "The operation state." }, { "name": "OperationStatus", "type": "string", "description": "The operation status." }, { "name": "OperationTime", "type": "string", "description": "The operation time." }, { "name": "OriginRequestId", "type": "string", "description": "The origin request ID." }, { "name": "PackageName", "type": "string", "description": "The package name." }, { "name": "PageFlexiPageNameOrId", "type": "string", "description": "The FlexiPage name or ID." }, { "name": "PageFlexiPageType", "type": "string", "description": "The FlexiPage type." }, { "name": "PageId", "type": "string", "description": "The page ID." }, { "name": "Path", "type": "string", "description": "The path." }, { "name": "PendingSandboxOrgId", "type": "string", "description": "The pending sandbox org ID." }, { "name": "PermissionType", "type": "string", "description": "The permission type." }, { "name": "PolicyId", "type": "string", "description": "The policy ID." }, { "name": "PolicyIdDerived", "type": "string", "description": "The derived policy ID." }, { "name": "PricingApiEndpoint", "type": "string", "description": "The pricing API endpoint." }, { "name": "PricingDetails", "type": "string", "description": "The pricing details." }, { "name": "PricingErrorCode", "type": "string", "description": "The pricing error code." }, { "name": "PricingLogName", "type": "string", "description": "The pricing log name." }, { "name": "PricingProcedure", "type": "string", "description": "The pricing procedure." }, { "name": "PricingStatus", "type": "string", "description": "The pricing status." }, { "name": "ProcessType", "type": "string", "description": "The process type." }, { "name": "PromptTemplate", "type": "string", "description": "The prompt template." }, { "name": "QueryIdentifier", "type": "string", "description": "The query identifier." }, { "name": "QueryType", "type": "string", "description": "The query type." }, { "name": "RateLimitUsagePercent", "type": "string", "description": "The rate limit usage percent." }, { "name": "RecordsFailed", "type": "string", "description": "The number of records failed." }, { "name": "RecordsProcessed", "type": "string", "description": "The number of records processed." }, { "name": "RedirectCount", "type": "string", "description": "The redirect count." }, { "name": "RedirectReason", "type": "string", "description": "The redirect reason." }, { "name": "RemoteAddress", "type": "string", "description": "The remote address.", "dataTypeHint": "IP" }, { "name": "RequestCount", "type": "string", "description": "The request count." }, { "name": "RequestFormSize", "type": "string", "description": "The request form size." }, { "name": "RequestMethod", "type": "string", "description": "The request method." }, { "name": "RequestPath", "type": "string", "description": "The request path." }, { "name": "RequestUri", "type": "string", "description": "The request URI." }, { "name": "RequestedAccessLevel", "type": "string", "description": "The requested access level." }, { "name": "Requests", "type": "string", "description": "The requests." }, { "name": "RequestsLimit", "type": "string", "description": "The requests limit." }, { "name": "ResourceSample", "type": "string", "description": "The resource sample." }, { "name": "Result", "type": "string", "description": "The result." }, { "name": "ResultSizeMb", "type": "string", "description": "The result size in MB." }, { "name": "SampleFactor", "type": "string", "description": "The sample factor." }, { "name": "SandboxId", "type": "string", "description": "The sandbox ID." }, { "name": "SavedViewId", "type": "string", "description": "The saved view ID." }, { "name": "Sequence", "type": "string", "description": "The sequence." }, { "name": "ServiceName", "type": "string", "description": "The service name." }, { "name": "SizeBytes", "type": "string", "description": "The size in bytes." }, { "name": "Source", "type": "string", "description": "The source." }, { "name": "SourceFile", "type": "string", "description": "The source file." }, { "name": "SourceHostname", "type": "string", "description": "The source hostname." }, { "name": "SqlId", "type": "string", "description": "The SQL ID." }, { "name": "TableName", "type": "string", "description": "The table name." }, { "name": "TargetHostname", "type": "string", "description": "The target hostname." }, { "name": "TargetOrgId", "type": "string", "description": "The target org ID." }, { "name": "TotalExecutionTime", "type": "string", "description": "The total execution time." }, { "name": "UiNumberColumns", "type": "string", "description": "The UI number of columns." }, { "name": "UniqueId", "type": "string", "description": "The unique ID." }, { "name": "UnloadEventEnd", "type": "string", "description": "The unload event end time." }, { "name": "UnloadEventStart", "type": "string", "description": "The unload event start time." }, { "name": "UpdateType", "type": "string", "description": "The update type." }, { "name": "UseApiToken", "type": "string", "description": "Indicates if an API token was used." }, { "name": "UsingMru", "type": "string", "description": "Indicates if MRU was used." }, { "name": "VfControllerSize", "type": "string", "description": "The Visualforce controller size." }, { "name": "ViewingUserId", "type": "string", "description": "The viewing user ID." }, { "name": "WebstoreId", "type": "string", "description": "The webstore ID." }, { "name": "WebstoreType", "type": "string", "description": "The webstore type." } ] } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition'),'-', variables('dataConnectorVersionConnectorDefinition'))))]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('_solutionVersion')]" } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition'))]", "apiVersion": "2022-09-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", "location": "[parameters('workspace-location')]", "kind": "Customizable", "properties": { "connectorUiConfig": { "id": "SalesforceServiceCloudCCPDefinition", "title": "Salesforce Service Cloud (via Codeless Connector Framework)", "publisher": "Microsoft", "descriptionMarkdown": "The Salesforce Service Cloud data connector provides the capability to ingest information about your Salesforce operational events into Microsoft Sentinel through the REST API. The connector provides ability to review events in your org on an accelerated basis, get [event log files](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/event_log_file_hourly_overview.htm) in hourly increments for recent activity.", "graphQueriesTableName": "SalesforceServiceCloudV2_CL", "graphQueries": [ { "metricName": "Total data received", "legend": "Salesforce Service Cloud EventLogFile Events", "baseQuery": "{{graphQueriesTableName}}" } ], "sampleQueries": [ { "description": "Get a sample of Salesforce Service Cloud Event Log File Events", "query": "{{graphQueriesTableName}}\n| take 10" } ], "dataTypes": [ { "name": "{{graphQueriesTableName}}", "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "HasDataConnectors" } ], "availability": { "isPreview": false, "status": 1 }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "Read and Write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true, "action": false } } ], "customs": [ { "name": "Salesforce Service Cloud API access", "description": "Access to the Salesforce Service Cloud API through a Connected App is required." } ] }, "instructionSteps": [ { "title": "Connect to Salesforce Service Cloud API to start collecting event logs in Microsoft Sentinel", "description": "Follow [Create a Connected App in Salesforce for OAuth](https://help.salesforce.com/s/articleView?id=platform.ev_relay_create_connected_app.htm&type=5) and [Configure a Connected App for the OAuth 2.0 Client Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_client_credentials_setup.htm&type=5) to create a Connected App with access to the Salesforce Service Cloud API. Through those instructions, you should get the Consumer Key and Consumer Secret.\n For Salesforce Domain name, Go to Setup, type My Domain in the Quick Find box, and select My Domain to view your domain details. Make sure to enter the domain name without a trailing slash (e.g., https://your-domain.my.salesforce.com). Fill the form below with that information.", "instructions": [ { "type": "DataConnectorsGrid", "parameters": { "mapping": [ { "columnName": "Salesforce Domain", "columnValue": "properties.addOnAttributes.SalesforceDomain" }, { "columnName": "Grant Type", "columnValue": "properties.addOnAttributes.GrantType" } ], "menuItems": [ "DeleteConnector" ] } }, { "type": "ContextPane", "parameters": { "isPrimary": true, "label": "Add Connection", "title": "Configure API Connection", "subtitle": "Connect to Salesforce to ingest event log file", "contextPaneType": "DataConnectorsContextPane", "instructionSteps": [ { "instructions": [ { "type": "InfoMessage", "parameters": { "text": "**Note:** For legacy or classic setup, ensure that the security token is appended to your password for the password-based grant type authentication to work. For lightning, passing just the password should work. For more information, refer to the [OAuth 2.0 Username-Password Flow for Special Scenarios](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_username_password_flow.htm&type=5).", "visible": true, "inline": true } }, { "type": "Textbox", "parameters": { "label": "Salesforce Domain Name", "placeholder": "Example: https://your-domain.my.salesforce.com", "type": "text", "name": "salesforceDomainName", "validations": { "required": true } } }, { "type": "Dropdown", "parameters": { "label": "Log Collection Interval", "name": "queryType", "options": [ { "key": "SELECT Id,EventType,LogDate,Interval,CreatedDate,LogFile,LogFileLength FROM EventLogFile WHERE Interval='Hourly' and CreatedDate>{_QueryWindowStartTime} and CreatedDate<{_QueryWindowEndTime}", "text": "Hourly" }, { "key": "SELECT Id,EventType,LogDate,CreatedDate,LogFile,LogFileLength FROM EventLogFile WHERE CreatedDate>{_QueryWindowStartTime} and CreatedDate<{_QueryWindowEndTime}", "text": "Daily" } ], "placeholder": "Select an interval type", "isMultiSelect": false, "required": true } }, { "type": "Radio", "parameters": { "title": "Grant Type", "name": "salesforceGrantType", "validations": { "required": true }, "options": [ { "label": "Client Credentials", "value": "client_credentials", "instructions": [ { "type": "Textbox", "parameters": { "label": "Consumer Key", "placeholder": "Enter Connected App Consumer Key", "type": "text", "name": "clientId", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Consumer Secret", "placeholder": "Enter Connected App Consumer Secret", "type": "password", "name": "clientSecret", "validations": { "required": true } } } ] }, { "label": "Password", "value": "password", "instructions": [ { "type": "Textbox", "parameters": { "label": "Consumer Key", "placeholder": "Enter Connected App Consumer Key", "type": "text", "name": "clientId", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Consumer Secret", "placeholder": "Enter Connected App Consumer Secret", "type": "password", "name": "clientSecret", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Username", "placeholder": "Enter your Salesforce username", "type": "text", "name": "username", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Password", "placeholder": "Enter your Salesforce password", "type": "password", "name": "password", "validations": { "required": true } } } ] } ] } } ] } ] } } ] } ] } } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition'))]", "contentId": "[variables('_dataConnectorContentIdConnectorDefinition')]", "kind": "DataConnector", "version": "[variables('dataConnectorVersionConnectorDefinition')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "[variables('_solutionAuthor')]" }, "support": { "name": "[variables('_solutionAuthor')]", "tier": "[variables('_solutionTier')]" }, "dependencies": { "criteria": [ { "version": "[variables('dataConnectorVersionConnections')]", "contentId": "[variables('_dataConnectorContentIdConnections')]", "kind": "ResourcesDataConnector" } ] } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections'), variables('dataConnectorVersionConnections'))]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "contentId": "[variables('_dataConnectorContentIdConnections')]", "displayName": "[concat(variables('_solutionName'), variables('dataConnectorTemplateNameConnections'))]", "contentKind": "ResourcesDataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersionConnections')]", "parameters": { "connectorDefinitionName": { "defaultValue": "connectorDefinitionName", "type": "string", "minLength": 1 }, "workspace": { "defaultValue": "[parameters('workspace')]", "type": "string" }, "dcrConfig": { "defaultValue": { "dataCollectionEndpoint": "data collection Endpoint", "dataCollectionRuleImmutableId": "data collection rule immutableId" }, "type": "object" }, "salesforceDomainName": { "defaultValue": "salesforceDomainName", "type": "string" }, "queryType": { "type": "array", "defaultValue": "SELECT Id,EventType,LogDate,Interval,CreatedDate,LogFile,LogFileLength FROM EventLogFile WHERE Interval='Hourly' and CreatedDate>{_QueryWindowStartTime} and CreatedDate<{_QueryWindowEndTime}" }, "salesforceGrantType": { "defaultValue": "client_credentials", "type": "string" }, "clientId": { "defaultValue": "clientId", "type": "string" }, "clientSecret": { "defaultValue": "clientSecret", "type": "securestring" }, "username": { "defaultValue": "username", "type": "string" }, "password": { "defaultValue": "password", "type": "securestring" } }, "variables": { "_dataConnectorContentIdConnections": "[variables('_dataConnectorContentIdConnections')]" }, "resources": [ { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections'))]", "contentId": "[variables('_dataConnectorContentIdConnections')]", "kind": "ResourcesDataConnector", "version": "[variables('dataConnectorVersionConnections')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "[variables('_solutionAuthor')]" }, "support": { "name": "[variables('_solutionAuthor')]", "tier": "[variables('_solutionTier')]" } } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', 'SalesforceServiceCloudPolling')]", "apiVersion": "2022-12-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", "kind": "RestApiPoller", "properties": { "auth": { "type": "OAuth2", "ClientId": "[[parameters('ClientId')]", "ClientSecret": "[[parameters('ClientSecret')]", "UserName": "[[if(equals(parameters('salesforceGrantType'), 'password'), parameters('username'), '')]", "Password": "[[if(equals(parameters('salesforceGrantType'), 'password'), parameters('password'), '')]", "GrantType": "[[parameters('salesforceGrantType')]", "TokenEndpoint": "[[concat(parameters('salesforceDomainName'),'/services/oauth2/token')]", "TokenEndpointHeaders": { "Accept": "application/json", "Content-Type": "application/x-www-form-urlencoded" }, "TokenEndpointQueryParameters": { } }, "request": { "apiEndpoint": "[[concat(parameters('salesforceDomainName'),'/services/data/v66.0/query')]", "httpMethod": "GET", "rateLimitQPS": 10, "queryWindowInMin": 10, "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", "retryCount": 3, "timeoutInSeconds": 60, "headers": { "Accept": "application/json", "User-Agent": "Scuba" }, "queryParameters": { "q": "[[parameters('queryType')[0]]" } }, "response": { "eventsJsonPaths": [ "$.records" ], "format": "json" }, "paging": { "pagingType": "NextPageUrl", "nextPageUrl": "[[parameters('salesforceDomainName')]", "nextPageTokenJsonPath": "$.nextRecordsUrl", "isNextPageTokenRelativeUrl": true }, "stepInfo": { "stepType": "Nested", "nextSteps": [ { "stepId": "fetchLogFileData", "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project logFileUrl = res.LogFile" } ] }, "stepCollectorConfigs": { "fetchLogFileData": { "shouldJoinNestedData": true, "joinedDataStepName": "LogData", "request": { "apiEndpoint": "[[concat(parameters('salesforceDomainName'),'$logFileUrl$')]", "httpMethod": "GET", "headers": { "Accept": "application/json", "User-Agent": "Scuba" } }, "response": { "eventsJsonPaths": [ "$" ], "format": "csv", "hasCsvHeader": true } } }, "connectorDefinitionName": "[[parameters('connectorDefinitionName')]", "dataType": "SalesforceServiceCloudV2_CL", "dcrConfig": { "streamName": "Custom-SalesforceServiceCloudV2_CL", "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" }, "addOnAttributes": { "SalesforceDomain": "[[parameters('salesforceDomainName')]", "GrantType": "[[if(equals(parameters('salesforceGrantType'), 'client_credentials'), 'Client Credentials', 'Password')]" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections'),'-', variables('dataConnectorVersionConnections'))))]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('_solutionVersion')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]", "location": "[parameters('workspace-location')]", "apiVersion": "2023-04-01-preview", "properties": { "version": "[variables('_solutionVersion')]", "kind": "Solution", "contentSchemaVersion": "3.0.0", "contentId": "[variables('_solutionId')]", "source": { "kind": "Solution", "name": "[variables('_solutionName')]", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "[variables('_solutionAuthor')]" }, "support": { "name": "[variables('_solutionAuthor')]" }, "dependencies": { "operator": "AND", "criteria": [ { "kind": "DataConnector", "contentId": "[variables('dataConnectorVersionConnectorDefinition')]", "version": "[variables('_dataConnectorContentIdConnectorDefinition')]" } ] }, "firstPublishDate": "2022-06-24", "providers": [ "[variables('_solutionAuthor')]" ], "contentKind": "Solution", "packageId": "[variables('_solutionId')]", "contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]", "displayName": "[variables('_solutionName')]", "publisherDisplayName": "[variables('_solutionId')]", "descriptionHtml": "test", "icon": "[variables('_packageIcon')]" } } ] }