{
  "id": "AzureBatchAccount_CCP",
  "title": "Azure Batch Account",
  "publisher": "Microsoft",
  "descriptionMarkdown": "Azure Batch Account is a uniquely identified entity within the Batch service. Most Batch solutions use Azure Storage for storing resource files and output files, so each Batch account is usually associated with a corresponding storage account. This connector lets you stream your Azure Batch account diagnostics logs into Microsoft Sentinel, allowing you to continuously monitor activity. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2224103&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
  "graphQueries": [
    {
      "metricName": "Total data received",
      "legend": "AzureDiagnostics",
      "baseQuery": "AzureDiagnostics| where ResourceProvider == \"MICROSOFT.BATCH\""
    }
  ],
  "sampleQueries": [
    {
      "description": "All logs",
      "query": "AzureDiagnostics \n| where ResourceProvider == \"MICROSOFT.BATCH\" \n"
    },
    {
      "description": "Count By Batch Accounts",
      "query": "AzureDiagnostics \n| where ResourceProvider == \"MICROSOFT.BATCH\" \n| summarize count() by Resource"
    }
  ],
  "connectivityCriterias": [
    {
      "type": "IsConnectedQuery",
      "value": [
        "AzureDiagnostics | where ResourceProvider == \"MICROSOFT.BATCH\"\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(7d)"
      ]
    }
  ],
  "dataTypes": [
    {
      "name": "AzureDiagnostics (Batch Account)",
      "lastDataReceivedQuery": "AzureDiagnostics| where ResourceProvider == \"MICROSOFT.BATCH\" | summarize Time = max(TimeGenerated) | where isnotempty(Time)"
    }
  ],
  "availability": {
    "status": 1,
    "isPreview": false
  },
  "permissions": {
    "resourceProvider": [
      {
        "provider": "Microsoft.OperationalInsights/workspaces",
        "permissionsDisplayText": "read and write permissions are required.",
        "providerDisplayName": "Workspace",
        "scope": "Workspace",
        "requiredPermissions": {
          "write": true,
          "read": true,
          "delete": true
        }
      }
    ],
    "customs": [
      {
        "name": "Policy",
        "description": "owner role assigned for each policy assignment scope"
      }
    ]
  },
  "instructionSteps": [
    {
      "title": "Connect your Azure Batch Account diagnostics logs into Sentinel.",
      "description": "This connector uses Azure Policy to apply a single Azure Batch Account log-streaming configuration to a collection of instances, defined as a scope. Follow the instructions below to create and apply a policy to all current and future instances. Note, you may already have an active policy for this resource type.",
      "instructions": [
        {
          "parameters": {
            "noFxPadding": "1",
            "expanded": "1",
            "instructionSteps": [
              {
                "title": "Stream diagnostics logs from your Azure Batch Account at scale",
                "innerSteps": [
                  {
                    "title": "Launch the Azure Policy Assignment wizard and follow the steps. ",
                    "description": ">    1. In the **Basics** tab, click the button with the three dots under **Scope** to select your subscription.<br />2. In the **Parameters** tab, choose your Microsoft Sentinel workspace from the **Log Analytics workspace** drop-down list, and leave marked as \"True\" all the log categories you want to ingest.<br />3. To apply the policy on your existing resources, mark the **Create a remediation task** check box in the **Remediation** tab.</value>",
                    "instructions": [
                      {
                        "parameters": {
                          "policyDefinitionGuid": "c84e5349-db6d-4769-805e-e14037dab9b5"
                        },
                        "type": "PolicyAssignment"
                      }
                    ]
                  }
                ]
              }
            ]
          },
          "type": "InstructionStepsGroup"
        }
      ]
    }
  ]
}