{
  "id": "AzureServiceBus_CCP",
  "title": "Azure Service Bus",
  "publisher": "Microsoft",
  "descriptionMarkdown": "Azure Service Bus is a fully managed enterprise message broker with message queues and publish-subscribe topics (in a namespace). This connector lets you stream your Azure Service Bus diagnostics logs into Microsoft Sentinel, allowing you to continuously monitor activity. ",
  "graphQueries": [
    {
      "metricName": "Total data received",
      "legend": "AzureDiagnostics",
      "baseQuery": "AzureDiagnostics| where ResourceProvider == \"MICROSOFT.SERVICEBUS\""
    }
  ],
  "sampleQueries": [
    {
      "description": "All logs",
      "query": "AzureDiagnostics \n| where ResourceProvider == \"MICROSOFT.SERVICEBUS\" \n"
    },
    {
      "description": "Count By Service Bus",
      "query": "AzureDiagnostics \n| where ResourceProvider == \"MICROSOFT.SERVICEBUS\" \n| summarize count() by Resource"
    }
  ],
  "connectivityCriterias": [
    {
      "type": "IsConnectedQuery",
      "value": [
        "AzureDiagnostics | where ResourceProvider == \"MICROSOFT.SERVICEBUS\"\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(7d)"
      ]
    }
  ],
  "dataTypes": [
    {
      "name": "AzureDiagnostics (Service Bus)",
      "lastDataReceivedQuery": "AzureDiagnostics| where ResourceProvider == \"MICROSOFT.SERVICEBUS\" | summarize Time = max(TimeGenerated) | where isnotempty(Time)"
    }
  ],
  "availability": {
    "status": 1,
    "isPreview": false
  },
  "permissions": {
    "resourceProvider": [
      {
        "provider": "Microsoft.OperationalInsights/workspaces",
        "permissionsDisplayText": "read and write permissions are required.",
        "providerDisplayName": "Workspace",
        "scope": "Workspace",
        "requiredPermissions": {
          "write": true,
          "read": true,
          "delete": true
        }
      }
    ],
    "customs": [
      {
        "name": "Policy",
        "description": "owner role assigned for each policy assignment scope"
      }
    ]
  },
  "instructionSteps": [
    {
      "title": "Connect your Azure Service Bus diagnostics logs into Sentinel.",
      "description": "This connector uses Azure Policy to apply a single Azure Service Bus log-streaming configuration to a collection of instances, defined as a scope. Follow the instructions below to create and apply a policy to all current and future instances. Note, you may already have an active policy for this resource type.",
      "instructions": [
        {
          "parameters": {
            "noFxPadding": "1",
            "expanded": "1",
            "instructionSteps": [
              {
                "title": "Stream diagnostics logs from your Azure Service Bus at scale",
                "innerSteps": [
                  {
                    "title": "Launch the Azure Policy Assignment wizard and follow the steps. ",
                    "description": ">    1. In the **Basics** tab, click the button with the three dots under **Scope** to select your subscription.<br />2. In the **Parameters** tab, choose your Microsoft Sentinel workspace from the **Log Analytics workspace** drop-down list, and leave marked as \"True\" all the log categories you want to ingest.<br />3. To apply the policy on your existing resources, mark the **Create a remediation task** check box in the **Remediation** tab.</value>",
                    "instructions": [
                      {
                        "parameters": {
                          "policyDefinitionGuid": "04d53d87-841c-4f23-8a5b-21564380b55e"
                        },
                        "type": "PolicyAssignment"
                      }
                    ]
                  }
                ]
              }
            ]
          },
          "type": "InstructionStepsGroup"
        }
      ]
    }
  ]
}