{ "name": "AtlassianAuditEventsConnector", "apiVersion": "2023-02-01", "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", "location": "{{location}}", "kind": "Customizable", "properties": { "connectorUiConfig": { "id": "AtlassianAuditEventsConnector", "title": "Atlassian Organization Audit Events (via Codeless Connector Framework)", "publisher": "Atlassian", "descriptionMarkdown": "The Atlassian Organization Audit Events data connector provides the capability to ingest organization audit events from Atlassian Cloud into Microsoft Sentinel through the Polling API. This connector enables comprehensive security monitoring and compliance auditing across all Atlassian Cloud products including Jira (Software/Service Desk/Core), Confluence, Bitbucket, Trello, Opsgenie, Statuspage, and Loom. The connector ingests audit events covering user management, authentication activities, group changes, product access modifications, administrative actions, and policy changes. With 180 days of data retention in Atlassian Cloud, this connector provides visibility into user access granted/revoked, authentication failures and successes, MFA configuration changes, API token management, group membership changes, product license assignments, organization policy updates, and domain verification activities. The connector uses API Key authentication with read-only OAuth scope (read:events:admin) and is optimized for continuous polling with cursor-based pagination. This connector is built on Microsoft Sentinel Codeless Connector Platform and supports DCR-based ingestion time transformations for optimized query performance. Refer to Atlassian Organization Events API documentation for more information.", "graphQueries": [ { "metricName": "Total events received", "legend": "Atlassian Audit Events", "baseQuery": "AtlassianAuditEvents" }, { "metricName": "Recent events", "legend": "Last 24 Hours", "baseQuery": "AtlassianAuditEvents | where TimeGenerated > ago(24h)" } ], "sampleQueries": [ { "description": "Sample of recent audit events", "query": "AtlassianAuditEvents\n| take 20" } ], "dataTypes": [ { "name": "AtlassianAuditEvents", "lastDataReceivedQuery": "AtlassianAuditEvents\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "HasDataConnectors" } ], "availability": { "isPreview": false, "status": 1 }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "Read and Write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true, "action": false } } ], "customs": [ { "name": "Atlassian Organization Events API access", "description": "An API key with the read-only `read:events:admin` OAuth scope is required to read organization audit events. See the [Atlassian Organization Events API documentation](https://developer.atlassian.com/cloud/admin/organization/rest/) for more information." } ] }, "instructionSteps": [ { "title": "Prerequisites", "description": "Before setting up this connector, ensure you have the following:", "instructions": [ { "type": "Markdown", "parameters": { "content": "- **Atlassian organization admin access** to create an API key with the `read:events:admin` OAuth scope.\r\n- **Your Atlassian Organization ID** (a UUID).\r\n- **Microsoft Sentinel workspace** with write permissions to configure the data connector." } } ] }, { "title": "1. Create API Key in Atlassian", "description": "Follow these steps to create an API key with the required permissions:", "instructions": [ { "type": "Markdown", "parameters": { "content": "#### Create API Key\r\n1. Navigate to [Atlassian Administration](https://admin.atlassian.com/)\r\n2. Select your organization (if you have multiple)\r\n3. Navigate to **Settings**, then select **API keys**\r\n4. Click **Create API key**\r\n5. Configure the API key:\r\n - **Name:** Microsoft Sentinel Integration (or descriptive name)\r\n - **Expiration:** Set expiration date (maximum 1 year from creation)\r\n - **Scopes:** Select `read:events:admin` (read-only access to audit events)\r\n6. Click **Create**\r\n7. **IMPORTANT:** Copy the API key immediately - it will not be shown again" } } ] }, { "title": "2. Get Your Organization ID", "description": "Your Organization ID is required to connect to the Atlassian API:", "instructions": [ { "type": "Markdown", "parameters": { "content": "#### Locate Organization ID\r\nYour Organization ID is a UUID (e.g., `00000000-0000-0000-0000-000000000000`)\r\n\r\n**Option 1: From Atlassian Administration URL**\r\n- Look at the URL in your Atlassian Administration console\r\n- Format: `https://admin.atlassian.com/o/{orgId}/overview`\r\n- Copy the UUID between `/o/` and `/overview`\r\n\r\n**Option 2: During API Key Creation**\r\n- The Organization ID is displayed when you create an API key\r\n- Copy it along with your API key\r\n\r\n**Example:** `00000000-0000-0000-0000-000000000000`" } } ] }, { "title": "3. Connect to Microsoft Sentinel", "description": "Add one connection per Atlassian organization (tenant). Each connection is identified by a unique Connection Alias and may target a different organization or API base URL, so you can ingest events from multiple Atlassian organizations side by side.", "instructions": [ { "type": "DataConnectorsGrid", "parameters": { "mapping": [ { "columnName": "Connection Alias", "columnValue": "properties.addOnAttributes.friendlyName" }, { "columnName": "Atlassian API Base URL", "columnValue": "properties.addOnAttributes.apiUrl" }, { "columnName": "Organization ID", "columnValue": "properties.addOnAttributes.organizationId" }, { "columnName": "Data Type", "columnValue": "properties.addOnAttributes.dataType" } ], "menuItems": [ "DeleteConnector" ] } }, { "type": "ContextPane", "parameters": { "isPrimary": true, "label": "Add Connection", "title": "Configure Atlassian Connection", "subtitle": "Connect to an Atlassian organization to ingest audit events", "contextPaneType": "DataConnectorsContextPane", "instructionSteps": [ { "title": "Connection Details", "description": "Enter the details for this Atlassian organization.", "instructions": [ { "type": "Textbox", "parameters": { "label": "Connection Alias", "placeholder": "e.g. Contoso Production", "type": "text", "name": "friendlyName", "validations": { "required": true } } }, { "type": "InfoMessage", "parameters": { "text": "Enter a unique alias to identify this Atlassian connection. **Important:** Use a different alias for each connection. To update an existing connection, delete it and recreate it with the same alias.", "visible": true, "inline": true } }, { "type": "Textbox", "parameters": { "label": "Atlassian API Base URL", "placeholder": "https://api.atlassian.com", "type": "text", "name": "atlassianApiBaseUrl", "validations": { "required": true } } }, { "type": "InfoMessage", "parameters": { "text": "Enter the API base URL for this tenant without a trailing slash (e.g. `https://api.atlassian.com`). Use the region-specific base URL if your organization is assigned one.", "visible": true, "inline": true } }, { "type": "Textbox", "parameters": { "label": "Organization ID", "placeholder": "00000000-0000-0000-0000-000000000000", "type": "text", "name": "organizationId", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "API Key", "placeholder": "Enter your Atlassian API Key", "type": "password", "name": "apiKey", "validations": { "required": true } } } ] } ] } } ] } ], "isConnectivityCriteriasMatchSome": false } } }