{ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "workspace": { "defaultValue": "", "type": "string", "metadata": { "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" } } }, "variables": { "DCRName": "WorkdayDCR", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "_solutionName": "Workday User Activity solution", "_solutionVersion": "1.0.0", "_solutionAuthor": "Microsoft", "_packageIcon": "icon icon icon icon", "_solutionId": "azuresentinel.azure-sentinel-solution-azuresentinel.azure-sentinel-workday", "dataConnectorVersionConnectorDefinition": "1.0.0", "dataConnectorVersionConnections": "1.0.0", "_solutionTier": "Microsoft", "_dataConnectorContentIdConnectorDefinition": "WorkdayTemplateConnectorDefinition", "dataConnectorTemplateNameConnectorDefinition": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition')))]", "_dataConnectorContentIdConnections": "WorkdayTemplateConnections", "dataConnectorTemplateNameConnections": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections')))]", "asimTableName": "ASimAuditEventLogs", "location": "[resourceGroup().location]", "subscriptionId": "[last(split(subscription().id, '/'))]" }, "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition'), variables('dataConnectorVersionConnectorDefinition'))]", "location": "[variables('location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "contentId": "[variables('_dataConnectorContentIdConnectorDefinition')]", "displayName": "[concat(variables('_solutionName'), variables('dataConnectorTemplateNameConnectorDefinition'))]", "contentKind": "DataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersionConnectorDefinition')]", "parameters": {}, "variables": {}, "resources": [ { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition'))]", "contentId": "[variables('_dataConnectorContentIdConnectorDefinition')]", "kind": "DataConnector", "version": "[variables('dataConnectorVersionConnectorDefinition')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "[variables('_solutionAuthor')]" }, "support": { "name": "[variables('_solutionAuthor')]", "tier": "[variables('_solutionTier')]" }, "dependencies": { "criteria": [ { "version": "[variables('dataConnectorVersionConnections')]", "contentId": "[variables('_dataConnectorContentIdConnections')]", "kind": "ResourcesDataConnector" } ] } } }, { "name": "[variables('DCRName')]", "apiVersion": "2021-09-01-preview", "type": "Microsoft.Insights/dataCollectionRules", "location": "[variables('location')]", "properties": { "dataCollectionEndpointId": "[concat('/subscriptions/',variables('subscriptionID'),'/resourceGroups/',resourceGroup().name,'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]", "streamDeclarations": { "[concat('Custom-', variables('asimTableName'))]": { "columns": [ { "name": "taskDisplayName", "type": "string" }, { "name": "requestTime", "type": "datetime" }, { "name": "userAgent", "type": "string" }, { "name": "sessionId", "type": "string" }, { "name": "taskId", "type": "string" }, { "name": "systemAccount", "type": "string" }, { "name": "deviceType", "type": "string" }, { "name": "activityAction", "type": "string" }, { "name": "target", "type": "dynamic" }, { "name": "ipAddress", "type": "string" } ] } }, "destinations": { "logAnalytics": [ { "workspaceResourceId": "[variables('workspaceResourceId')]", "name": "clv2ws1" } ] }, "dataFlows": [ { "streams": [ "[concat('Custom-', variables('asimTableName'))]" ], "destinations": [ "clv2ws1" ], "transformKql": "source\n| extend TimeGenerated= requestTime, EventStartTime= requestTime, EventEndTime= requestTime\n | project-rename EventType= activityAction, DvcIpAddr=ipAddress, DvcDescription=deviceType, EventOriginalUid= taskId, Operation= taskDisplayName, ActorUsername= systemAccount, ActorSessionId=sessionId, HttpUserAgent= userAgent\n | extend Object= tostring(target.descriptor), TargetAppId= tostring(target.id), TargetUrl= tostring(target.href), EventCount= toint(1), EventSchema= \"AuditEvent\", EventResult= \"NA\", EventProduct=\"Workday\", EventVendor=\"Workday\", EventSchemaVersion=\"0.1\",ObjectType=\"Other\", Dvc=DvcIpAddr | extend EventType = case(EventType == \"READ\",\"Read\", EventType == \"WRITE\",\"Set\", \"Other\") ", "outputStream": "[concat('Microsoft-', variables('asimTableName'))]" } ] } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition'),'-', variables('dataConnectorVersionConnectorDefinition'))))]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('_solutionVersion')]" } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition'))]", "apiVersion": "2022-09-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", "location": "[variables('location')]", "kind": "Customizable", "properties": { "connectorUiConfig": { "title": "Workday User Activity (Preview)", "publisher": "Microsoft", "descriptionMarkdown": "The [Workday](https://www.workday.com/) User Activity data connector provides the capability to ingest User Activity Logs from [Workday API](https://community.workday.com/sites/default/files/file-hosting/restapi/index.html#privacy/v1/get-/activityLogging) into Microsoft Sentinel.", "graphQueriesTableName": "ASimAuditEventLogs", "graphQueries": [ { "metricName": "Total data received", "legend": "Workday User Activity logs", "baseQuery": "{{graphQueriesTableName}}\n| where EventProduct == \"Workday\"" } ], "sampleQueries": [ { "description": "Get a sample of Workday User Activity logs", "query": "{{graphQueriesTableName}}\n | where EventProduct == \"Workday\" | take 10" } ], "dataTypes": [ { "name": "{{graphQueriesTableName}}", "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where EventProduct == \"Workday\" |summarize Time = max (TimeGenerated)\n|where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "HasDataConnectors" } ], "availability": { "isPreview": false }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "Read and Write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true } } ], "customs": [ { "name": "Workday User Activity API access", "description": "Access to the Workday user activity API through Oauth are required. The API Client need to have the scope: System and it needs to be authorized by an account with System Auditing permissions." } ] }, "instructionSteps": [ { "description": "1) In Workday, access the \"Edit Tenant Setup - Security\" task.\n2) In the \"OAuth 2.0 Settings\" section, select the \"OAuth 2.0 Clients Enabled\" check box. \n3) Access the \"Register API Client\" task.\n4) Enter the Client Name.\n5) Select the \"Client Grant Type\": \"Authorization Code\".\n6) Select the \"Access Token Type\": \"Bearer\".\n7) Enter the \"Redirection URI\": https://portal.azure.com/TokenAuthorize/ExtensionName/Microsoft_Azure_Security_Insights \n8) From the \"Scope (Functional Areas)\" prompt, select \"System\". \n9) Copy the Client ID and Secret before navigateing away from the page, and store it securely.\n10) Provide the required information below and click \"Connect\". To complete the authentication, you will also need an account with System Auditing permissions to authorize the API Client connection.\n", "instructions": [ { "type": "Textbox", "parameters": { "label": "Token Endpoint", "placeholder": "https://wd2-impl-services1.workday.com/ccx/oauth2/{tenantName}/token", "type": "text", "name": "tokenEndpoint" } }, { "type": "Textbox", "parameters": { "label": "Authorization Endpoint", "placeholder": "https://impl.workday.com/{tenantName}/authorize", "type": "text", "name": "authorizationEndpoint" } }, { "type": "Textbox", "parameters": { "label": "User Activity Logs Endpoint", "placeholder": "https://wd2-impl-services1.workday.com/ccx/api/privacy/v1/{tenantName}/activityLogging", "type": "text", "name": "apiEndpoint" } }, { "type": "OAuthForm", "parameters": { "clientIdLabel": "Client ID", "clientSecretLabel": "Client Secret", "connectButtonLabel": "Connect", "disconnectButtonLabel": "Disconnect" } } ], "title": "Connect to Workday to start collecting user activity logs in Microsoft Sentinel" } ] } } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition'))]", "contentId": "[variables('_dataConnectorContentIdConnectorDefinition')]", "kind": "DataConnector", "version": "[variables('dataConnectorVersionConnectorDefinition')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "[variables('_solutionAuthor')]" }, "support": { "name": "[variables('_solutionAuthor')]", "tier": "[variables('_solutionTier')]" }, "dependencies": { "criteria": [ { "version": "[variables('dataConnectorVersionConnections')]", "contentId": "[variables('_dataConnectorContentIdConnections')]", "kind": "ResourcesDataConnector" } ] } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections'), variables('dataConnectorVersionConnections'))]", "location": "[variables('location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "contentId": "[variables('_dataConnectorContentIdConnections')]", "displayName": "[concat(variables('_solutionName'), variables('dataConnectorTemplateNameConnections'))]", "contentKind": "ResourcesDataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersionConnections')]", "parameters": { "clientSecret": { "defaultValue": "-NA-", "type": "string", "minLength": 1, "metadata": { "description": "clientSecret" } }, "clientId": { "defaultValue": "-NA-", "type": "string", "minLength": 1, "metadata": { "description": "ClientId" } }, "authorizationCode": { "defaultValue": "-NA-", "type": "string", "minLength": 1, "metadata": { "description": "authorization code" } }, "tokenEndpoint": { "defaultValue": "", "type": "string", "metadata": { "description": "Token endpoint required for Workday authentication through Oauth 2.0. It could be something like this https://wd2-impl-services1.workday.com/ccx/oauth2/{tenant}/token, but you should check the endpoint urls by using \"View API Clients\" report in your Workday tenant." } }, "authorizationEndpoint": { "defaultValue": "", "type": "string", "metadata": { "description": "Authorzation endpoint required for Workday authentication through Oauth 2.0 It could be something like this https://impl.workday.com/{tenant}/authorize, but you should check the endpoint urls by using \"View API Clients\" report in your Workday tenant." } }, "apiEndpoint": { "defaultValue": "https://{wd2-impl-services1 or services1}.{workday or myworkday}.com/ccx/api/privacy/v1/{tenant}/activityLogging", "type": "string", "metadata": { "description": "Workday user activity logs Rest Api endpoint. The initial part of the url depends on the environment that you are using (production or non production). You can confirm if the initial part matches the token endpoint." } }, "connectorDefinitionName": { "defaultValue": "", "type": "string", "minLength": 1, "metadata": { "description": "connectorDefinitionName" } }, "workspace": { "defaultValue": "[parameters('workspace')]", "type": "string" }, "dcrConfig": { "type": "object", "defaultValue": { "dataCollectionEndpoint": "data collection Endpoint", "dataCollectionRuleImmutableId": "data collection rule immutableId" } } }, "variables": { "_dataConnectorContentIdConnections": "[variables('_dataConnectorContentIdConnections')]" }, "resources": [ { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections'))]", "contentId": "[variables('_dataConnectorContentIdConnections')]", "kind": "ResourcesDataConnector", "version": "[variables('dataConnectorVersionConnections')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "[variables('_solutionAuthor')]" }, "support": { "name": "[variables('_solutionAuthor')]", "tier": "[variables('_solutionTier')]" } } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', 'Workday')]", "apiVersion": "2022-12-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[variables('location')]", "kind": "RestApiPoller", "properties": { "connectorDefinitionName": "[[parameters('connectorDefinitionName')]", "dataType": "[variables('asimTableName')]", "dcrConfig": { "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", "streamName": "[concat('Custom-',variables('asimTableName'))]" }, "auth": { "type": "OAuth2", "ClientSecret": "[[parameters('clientSecret')]", "ClientId": "[[parameters('clientId')]", "AuthorizationCode": "[[parameters('authorizationCode')]", "GrantType": "authorization_code", "TokenEndpoint": "[[parameters('tokenEndpoint')]", "tokenEndpointHeaders": { "Accept": "application/json", "Content-Type": "application/x-www-form-urlencoded" }, "authorizationEndpoint": "[[parameters('authorizationEndpoint')]", "redirectUri": "https://portal.azure.com/TokenAuthorize/ExtensionName/Microsoft_Azure_Security_Insights" }, "request": { "apiEndpoint": "[[parameters('apiEndpoint')]", "rateLimitQPS": 10, "queryWindowInMin": 5, "httpMethod": "GET", "retryCount": 3, "timeoutInSeconds": 60, "headers": { "Accept": "application/json" }, "StartTimeAttributeName": "from", "EndTimeAttributeName": "to", "queryParameters": { "type": "userActivity", "from": "{_QueryWindowStartTime}", "to": "{_QueryWindowEndTime}", "instancesReturned": "10" } }, "paging": { "pagingType": "Offset", "pageSize": 1000, "PageSizeParaName": "limit", "OffsetParaName": "offset" }, "response": { "eventsJsonPaths": [ "$.data" ] } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections'),'-', variables('dataConnectorVersionConnections'))))]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('_solutionVersion')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]", "location": "[variables('location')]", "apiVersion": "2023-04-01-preview", "properties": { "version": "[variables('_solutionVersion')]", "kind": "Solution", "contentSchemaVersion": "3.0.0", "contentId": "[variables('_solutionId')]", "source": { "kind": "Solution", "name": "[variables('_solutionName')]", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "[variables('_solutionAuthor')]" }, "support": { "name": "[variables('_solutionAuthor')]" }, "dependencies": { "operator": "AND", "criteria": [ { "kind": "DataConnector", "contentId": "[variables('dataConnectorVersionConnectorDefinition')]", "version": "[variables('_dataConnectorContentIdConnectorDefinition')]" } ] }, "firstPublishDate": "2022-06-24", "providers": [ "[variables('_solutionAuthor')]" ], "contentKind": "Solution", "packageId": "[variables('_solutionId')]", "contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]", "displayName": "[variables('_solutionName')]", "publisherDisplayName": "[variables('_solutionId')]", "descriptionHtml": "test", "icon": "[variables('_packageIcon')]" } } ] }