{ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "location": { "type": "string", "minLength": 1, "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" } }, "workspace-location": { "type": "string", "defaultValue": "", "metadata": { "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" } }, "subscription": { "defaultValue": "[last(split(subscription().id, '/'))]", "type": "string", "metadata": { "description": "subscription id where Microsoft Sentinel is setup" } }, "resourceGroupName": { "defaultValue": "[resourceGroup().name]", "type": "string", "metadata": { "description": "resource group name where Microsoft Sentinel is setup" } }, "workspace": { "defaultValue": "", "type": "string", "metadata": { "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" } } }, "variables": { "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "_solutionName": "Atlassian Jira Connector", "_solutionVersion": "3.0.0", "_solutionAuthor": "Microsoft", "_packageIcon": "icon icon icon icon", "_solutionId": "azuresentinel.azure-sentinel-solution-azuresentinel.azure-sentinel-JIRAConnector", "dataConnectorVersionConnectorDefinition": "1.0.0", "dataConnectorVersionConnections": "1.0.0", "_solutionTier": "Microsoft", "_dataConnectorContentIdConnectorDefinition": "JIRAConnectorDefinition", "dataConnectorTemplateNameConnectorDefinition": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition')))]", "_dataConnectorContentIdConnections": "JIRATemplateConnections", "dataConnectorTemplateNameConnections": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections')))]", "_logAnalyticsTableId1": "Jira_Audit_v2_CL" }, "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2025-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition'), variables('dataConnectorVersionConnectorDefinition'))]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "contentId": "[variables('_dataConnectorContentIdConnectorDefinition')]", "displayName": "[concat(variables('_solutionName'), variables('dataConnectorTemplateNameConnectorDefinition'))]", "contentKind": "DataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersionConnectorDefinition')]", "parameters": { }, "variables": { }, "resources": [ { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition'))]", "contentId": "[variables('_dataConnectorContentIdConnectorDefinition')]", "kind": "DataConnector", "version": "[variables('dataConnectorVersionConnectorDefinition')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "[variables('_solutionAuthor')]" }, "support": { "name": "[variables('_solutionAuthor')]", "tier": "[variables('_solutionTier')]" }, "dependencies": { "criteria": [ { "version": "[variables('dataConnectorVersionConnections')]", "contentId": "[variables('_dataConnectorContentIdConnections')]", "kind": "ResourcesDataConnector" } ] } } }, { "name": "AtlassianJIRADCR", "apiVersion": "2021-09-01-preview", "type": "Microsoft.Insights/dataCollectionRules", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "streamDeclarations": { "[concat('Custom-', variables('_logAnalyticsTableId1'))]": { "columns": [ { "name": "id", "type": "int" }, { "name": "summary", "type": "string" }, { "name": "created", "type": "datetime" }, { "name": "category", "type": "string" }, { "name": "eventSource", "type": "string" }, { "name": "objectItem", "type": "dynamic" }, { "name": "changedValues", "type": "dynamic" }, { "name": "associatedItems", "type": "dynamic" }, { "name": "remoteAddress", "type": "string" }, { "name": "authorKey", "type": "string" }, { "name": "authorAccountId", "type": "string" } ] } }, "dataSources": { }, "destinations": { "logAnalytics": [ { "workspaceResourceId": "[variables('workspaceResourceId')]", "name": "clv2ws1" } ] }, "dataFlows": [ { "streams": [ "[concat('Custom-', variables('_logAnalyticsTableId1'))]" ], "destinations": [ "clv2ws1" ], "transformKql": "source\n| extend TimeGenerated = now(), EventVendor=\"Atlassian\", EventProduct=\"Jira Audit\"\n| project-rename EventId=id,\n EventMessage=summary,\n SrcIpAddr=remoteAddress,\n UserName=authorKey,\n UserSid=authorAccountId,\n EventCreationTime=created,\n EventSource=eventSource,\n ChangedValues=changedValues,\n AssociatedItems=associatedItems,\n EventCategoryType= category \n|extend ObjectItemId=objectItem.id,\n ObjectItemName=objectItem.name,\n ObjectItemTypeName=objectItem.typeName,\n ObjectItemParentId=objectItem.parentId,\n ObjectItemParentName=objectItem.parentName\n | extend ObjectItemId=tostring(ObjectItemId), ObjectItemName=tostring(ObjectItemName), ObjectItemTypeName=tostring(ObjectItemTypeName), ObjectItemParentId=tostring(ObjectItemParentId), ObjectItemParentName=tostring(ObjectItemParentName) ", "outputStream": "[concat('Custom-', variables('_logAnalyticsTableId1'))]" } ], "provisioningState": "Succeeded", "dataCollectionEndpointId": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]" } }, { "name": "[variables('_logAnalyticsTableId1')]", "apiVersion": "2021-03-01-privatepreview", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "schema": { "tableSubType": "DataCollectionRuleBased", "name": "[variables('_logAnalyticsTableId1')]", "tableType": "CustomLog", "columns": [ { "name": "AssociatedItems", "type": "dynamic", "isDefaultDisplay": false, "isHidden": false }, { "name": "UserSid", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "UserName", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "EventCategoryType", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "ChangedValues", "type": "dynamic", "isDefaultDisplay": false, "isHidden": false }, { "name": "EventCreationTime", "type": "datetime", "isDefaultDisplay": false, "isHidden": false }, { "name": "EventSource", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "EventId", "type": "int", "isDefaultDisplay": false, "isHidden": false }, { "name": "objectItem", "type": "dynamic", "isDefaultDisplay": false, "isHidden": false }, { "name": "SrcIpAddr", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "EventMessage", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "TimeGenerated", "type": "datetime", "isDefaultDisplay": false, "isHidden": false }, { "name": "EventVendor", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "EventProduct", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "ObjectItemId", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "ObjectItemName", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "ObjectItemTypeName", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "ObjectItemParentId", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "ObjectItemParentName", "type": "string", "isDefaultDisplay": false, "isHidden": false } ], "standardColumns": [ { "name": "TenantId", "type": "guid", "isDefaultDisplay": false, "isHidden": false } ], "solutions": [ "LogManagement" ], "isTroubleshootingAllowed": true } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition'),'-', variables('dataConnectorVersionConnectorDefinition'))))]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('_solutionVersion')]" } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition'))]", "apiVersion": "2022-09-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", "location": "[parameters('workspace-location')]", "kind": "Customizable", "properties": { "connectorUiConfig": { "title": " Atlassian Jira Audit (using REST API) (Preview)", "publisher": "Microsoft", "descriptionMarkdown": "The [Atlassian Jira](https://www.atlassian.com/software/jira) Audit data connector provides the capability to ingest [Jira Audit Records](https://support.atlassian.com/jira-cloud-administration/docs/audit-activities-in-jira-applications/) events into Microsoft Sentinel through the REST API. Refer to [API documentation](https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-audit-records/) for more information. The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.", "graphQueriesTableName": "[variables('_logAnalyticsTableId1')]", "graphQueries": [ { "metricName": "Total data received", "legend": "Jira Audit Events", "baseQuery": "{{graphQueriesTableName}}" } ], "sampleQueries": [ { "description": "All Atlassian Jira audit logs", "query": "{{graphQueriesTableName}}\n| sort by TimeGenerated desc" }, { "description": "Total Events", "query": "{{graphQueriesTableName}}\n | summarize count() by OriginalEventUid" } ], "dataTypes": [ { "name": "{{graphQueriesTableName}}", "lastDataReceivedQuery": "{{graphQueriesTableName}}|summarize Time = max (TimeGenerated)\n|where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "HasDataConnectors" } ], "availability": { "isPreview": false }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "Read and Write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true } } ], "customs": [ { "name": "Atlassian Jira API access", "description": "Permission of [Administer Jira](https://developer.atlassian.com/cloud/jira/platform/rest/v3/intro/#authentication) is required to get access to the Jira Audit logs API. See [Jira API documentation](https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-audit-records/#api-group-audit-records) to learn more about the audit API." } ] }, "instructionSteps": [ { "description": "To enable the Atlassian Jira connector for Microsoft Sentinel, click to add an organization, fill the form with the Jira environment credentials and click to Connect. \n Follow [these steps](https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/) to create an API token.\n ", "instructions": [ { "type": "DataConnectorsGrid", "parameters": { "mapping": [ { "columnName": "Atlassian Jira organization URL", "columnValue": "properties.request.apiEndpoint" } ], "menuItems": [ "DeleteConnector" ] } }, { "type": "ContextPane", "parameters": { "isPrimary": true, "label": "Add organization", "title": "Add organization", "subtitle": "Add Atlassian Jira organization", "contextPaneType": "DataConnectorsContextPane", "instructionSteps": [ { "instructions": [ { "type": "Textbox", "parameters": { "label": "Atlassian Jira organization URL", "placeholder": ".atlassian.net", "type": "string", "name": "jiraorganizationurl" } }, { "type": "Textbox", "parameters": { "label": "User Name", "placeholder": "User Name (e.g., user@example.com)", "type": "securestring", "name": "userid" } }, { "type": "Textbox", "parameters": { "label": "API Token", "placeholder": "API Token", "type": "password", "name": "apikey" } } ] } ] } } ] } ] } } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition'))]", "contentId": "[variables('_dataConnectorContentIdConnectorDefinition')]", "kind": "DataConnector", "version": "[variables('dataConnectorVersionConnectorDefinition')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "[variables('_solutionAuthor')]" }, "support": { "name": "[variables('_solutionAuthor')]", "tier": "[variables('_solutionTier')]" }, "dependencies": { "criteria": [ { "version": "[variables('dataConnectorVersionConnections')]", "contentId": "[variables('_dataConnectorContentIdConnections')]", "kind": "ResourcesDataConnector" } ] } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2025-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections'), variables('dataConnectorVersionConnections'))]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "contentId": "[variables('_dataConnectorContentIdConnections')]", "displayName": "[concat(variables('_solutionName'), variables('dataConnectorTemplateNameConnections'))]", "contentKind": "ResourcesDataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersionConnections')]", "parameters": { "connectorDefinitionName": { "defaultValue": "connectorDefinitionName", "type": "string", "minLength": 1 }, "workspace": { "defaultValue": "[parameters('workspace')]", "type": "string" }, "dcrConfig": { "defaultValue": { "dataCollectionEndpoint": "data collection Endpoint", "dataCollectionRuleImmutableId": "data collection rule immutableId" }, "type": "object" }, "jiraorganizationurl": { "defaultValue": "domain name", "type": "string", "minLength": 1 }, "userid": { "defaultValue": "JIRA email", "type": "string", "minLength": 1 }, "apikey": { "defaultValue": "API Key", "type": "securestring", "minLength": 1 } }, "variables": { "_dataConnectorContentIdConnections": "[variables('_dataConnectorContentIdConnections')]" }, "resources": [ { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections'))]", "contentId": "[variables('_dataConnectorContentIdConnections')]", "kind": "ResourcesDataConnector", "version": "[variables('dataConnectorVersionConnections')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "[variables('_solutionAuthor')]" }, "support": { "name": "[variables('_solutionAuthor')]", "tier": "[variables('_solutionTier')]" } } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', 'AtlassianJira')]", "apiVersion": "2022-12-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", "kind": "RestApiPoller", "properties": { "connectorDefinitionName": "[[parameters('connectorDefinitionName')]", "dataType": "[variables('_logAnalyticsTableId1')]", "dcrConfig": { "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", "streamName": "[concat('Custom-', variables('_logAnalyticsTableId1'))]" }, "auth": { "type": "Basic", "UserName": "[[parameters('userid')]", "Password": "[[parameters('apikey')]" }, "request": { "apiEndpoint": "[[concat('https://',parameters('jiraorganizationurl'),'/rest/api/3/auditing/record')]", "httpMethod": "GET", "retryCount": 3, "timeoutInSeconds": 60, "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", "headers": { "Accept": "application/json", "User-Agent": "Scuba" }, "startTimeAttributeName": "from", "endTimeAttributeName": "to" }, "paging": { "pagingType": "Offset", "offsetParaName": "offset", "pageSizeParaName": "limit", "pageSize": 1000 }, "response": { "eventsJsonPaths": [ "$.records" ], "format": "json" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections'),'-', variables('dataConnectorVersionConnections'))))]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('_solutionVersion')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]", "location": "[parameters('workspace-location')]", "apiVersion": "2025-01-01-preview", "properties": { "version": "[variables('_solutionVersion')]", "kind": "Solution", "contentSchemaVersion": "3.0.0", "contentId": "[variables('_solutionId')]", "source": { "kind": "Solution", "name": "[variables('_solutionName')]", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "[variables('_solutionAuthor')]" }, "support": { "name": "[variables('_solutionAuthor')]" }, "dependencies": { "operator": "AND", "criteria": [ { "kind": "DataConnector", "contentId": "[variables('dataConnectorVersionConnectorDefinition')]", "version": "[variables('_dataConnectorContentIdConnectorDefinition')]" } ] }, "firstPublishDate": "2022-06-24", "providers": [ "[variables('_solutionAuthor')]" ], "contentKind": "Solution", "packageId": "[variables('_solutionId')]", "contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]", "displayName": "[variables('_solutionName')]", "publisherDisplayName": "[variables('_solutionId')]", "descriptionHtml": "test", "icon": "[variables('_packageIcon')]" } } ] }