{
    "id": "VirtualMetricDirectorProxy",
    "title": "VirtualMetric Director Proxy",
    "publisher": "VirtualMetric",
    "descriptionMarkdown": "VirtualMetric Director Proxy deploys an Azure Function App to securely bridge VirtualMetric DataStream with Azure services including Microsoft Sentinel, Azure Data Explorer, and Azure Storage.",
    "graphQueriesTableName": "CommonSecurityLog",
    "graphQueries": [
        {
            "metricName": "Total CommonSecurityLog Events",
            "legend": "CommonSecurityLog",
            "baseQuery": "CommonSecurityLog"
        }
    ],
    "sampleQueries": [
        {
            "description": "Get sample CommonSecurityLog events from the last 24 hours",
            "query": "CommonSecurityLog\n| where TimeGenerated > ago(24h)\n| take 10"
        }
    ],
    "dataTypes": [
        {
            "name": "CommonSecurityLog",
            "lastDataReceivedQuery": "CommonSecurityLog\n| where TimeGenerated > ago(7d)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
    ],
    "connectivityCriteria": [
        {
            "type": "HasDataConnectors"
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required.",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": false
                }
            }
        ],
        "customs": [
            {
                "name": "Azure Function App",
                "description": "An Azure Function App must be deployed to host the Director Proxy. Requires read, write, and delete permissions on Microsoft.Web/sites resources within your resource group to create and manage the Function App."
            },
            {
                "name": "VirtualMetric DataStream Configuration",
                "description": "You need VirtualMetric DataStream configured with authentication credentials to connect to the Director Proxy. The Director Proxy acts as a secure bridge between VirtualMetric DataStream and Azure services."
            },
            {
                "name": "Target Azure Services",
                "description": "Configure your target Azure services such as Microsoft Sentinel Data Collection Endpoints, Azure Data Explorer clusters, or Azure Storage accounts where the Director Proxy will forward data."
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Deploy VirtualMetric Director Proxy",
            "description": "Deploy the Azure Function App that serves as a secure proxy between VirtualMetric DataStream and Microsoft Sentinel.",
            "instructions": [
                {
                    "type": "InstructionStepsGroup",
                    "parameters": {
                        "enable": true,
                        "instructionSteps": [
                            {
                                "title": "Prerequisites and Deployment Order",
                                "description": "**Recommended Deployment Order:**\n\nFor optimal configuration, consider deploying the target connectors first:\n\n1. **Deploy Microsoft Sentinel Connector**: Deploy the VirtualMetric DataStream for Microsoft Sentinel connector first to create the required Data Collection Endpoints and Rules.\n\n2. **Deploy Microsoft Sentinel data lake Connector** (optional): If using Microsoft Sentinel data lake tables, deploy the VirtualMetric DataStream for Microsoft Sentinel data lake connector.\n\n3. **Deploy Director Proxy** (this step): The Director Proxy can then be configured with your Microsoft Sentinel targets.\n\n**Note:** This order is recommended but not required. You can deploy the Director Proxy independently and configure it with your targets later."
                            },
                            {
                                "title": "Deploy Azure Function App",
                                "description": "Deploy the VirtualMetric Director Proxy Azure Function App using the Deploy to Azure button.\n\n1. **Deploy to Azure**:\n   - Click the Deploy to Azure button below to deploy the Function App:\n   - [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FVirtualMetric%2520DataStream%2FData%2520Connectors%2FVirtualMetric-DirectorProxy%2FDeployToAzure.json)\n\n2. **Configure Deployment Parameters**:\n   - **Subscription**: Select your Azure subscription\n   - **Resource Group**: Choose the same resource group as your Microsoft Sentinel workspace or create a new one\n   - **Region**: Select the Azure region (should match your Microsoft Sentinel workspace region)\n   - **Function App Name**: Provide a unique name for the Function App (e.g., \"vmetric-director-proxy\")\n\n3. **Complete Deployment**:\n   - Click **Review + create** to validate the parameters\n   - Click **Create** to deploy the Function App\n   - Wait for deployment to complete (typically 3-5 minutes)\n   - Note the Function App URL: `https://<function-app-name>.azurewebsites.net`"
                            },
                            {
                                "title": "Configure Function App Permissions",
                                "description": "Assign the necessary permissions to the Function App's managed identity to access Microsoft Sentinel resources.\n\n1. **Enable System-Assigned Managed Identity**:\n   - Navigate to your deployed Function App in Azure Portal\n   - Go to **Identity** under Settings\n   - Toggle **Status** to **On** for System assigned identity\n   - Click **Save** and confirm\n\n2. **Navigate to Resource Group**:\n   - Go to the resource group containing your Microsoft Sentinel workspace and Data Collection Endpoints\n\n3. **Assign Required Roles**:\n   - Open **Access control (IAM)**\n   - Click **+ Add** > **Add role assignment**\n   - Assign the following roles to the Function App's system-assigned managed identity:\n     - **Monitoring Metrics Publisher**: For sending data to Data Collection Endpoints\n     - **Monitoring Reader**: For reading Data Collection Rules configuration\n\n4. **Select the Function App Identity**:\n   - In **Members** tab, select **Managed identity**\n   - Choose **Function App** and select your deployed Director Proxy Function App\n   - Complete the role assignment\n\n5. **Get Function App Access Token** (Optional for Function Key authentication):\n   - Navigate to your Function App\n   - Go to **App keys** under Functions\n   - Copy the default host key or create a new function key for authentication"
                            },
                            {
                                "title": "Configure VirtualMetric DataStream Integration",
                                "description": "Set up VirtualMetric DataStream to send security telemetry to Microsoft Sentinel through the Director Proxy.\n\n1. **Access VirtualMetric DataStream Configuration**:\n   - Log into your **VirtualMetric DataStream** management console\n   - Navigate to **Targets** section\n   - Click **Microsoft Sentinel Targets**\n   - Click **Add new target** or edit an existing Microsoft Sentinel target\n\n2. **Configure General Settings**:\n   - **Name**: Enter a name for your target (e.g., \"sentinel-with-proxy\")\n   - **Description**: Optionally provide a description for the target configuration\n\n3. **Configure Azure Authentication**:\n   \n   **For Service Principal Authentication:**\n   - **Managed Identity for Azure**: Keep **Disabled**\n   - **Tenant ID**: Enter your Azure Active Directory tenant ID\n   - **Client ID**: Enter your service principal application ID\n   - **Client Secret**: Enter your service principal client secret\n   \n   **For Azure Managed Identity:**\n   - **Managed Identity for Azure**: Set to **Enabled**\n\n4. **Configure Director Proxy** (in Azure Properties tab):\n   - **Endpoint Address**: Enter the Function App URL from Step 2 (format: `https://<function-app-name>.azurewebsites.net`)\n   - **Access Token**: Enter the Function App host key from Step 3 (optional if using Managed Identity)\n\n5. **Configure Stream Properties**:\n   - **Endpoint**: Enter the DCE Logs Ingestion URI (format: `https://<dce-name>.<region>.ingest.monitor.azure.com`)\n   - **Streams**: Select **Auto** for automatic stream detection, or configure specific streams if needed\n\n6. **Verify Data Ingestion in Microsoft Sentinel**:\n   - Return to your **Log Analytics Workspace**\n   - Run sample queries to confirm data is being received:\n     ```kql\n     CommonSecurityLog\n     | where TimeGenerated > ago(1h)\n     | take 10\n     ```\n   - Check the **Microsoft Sentinel Overview** dashboard for new data sources and event counts"
                            }
                        ]
                    }
                }
            ]
        }
    ]
}