{
  "name": "GKECCPDefinition",
  "apiVersion": "2024-09-01",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "GKECCPDefinition",
      "title": "Google Kubernetes Engine (via Codeless Connector Framework)",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The Google Kubernetes Engine (GKE) Logs enable you to capture cluster activity, workload behavior, and security events, allowing you to monitor Kubernetes workloads, analyze performance, and detect potential threats across GKE clusters.",
      "graphQueriesTableName": "GKEAudit",
      "graphQueries": [
        {
          "metricName": "Total events received",
          "legend": "GKEAuditLogs",
          "baseQuery": "GKEAudit"
        },
        {
          "metricName": "Total API Server logs received",
          "legend": "GKEAPIServerLogs",
          "baseQuery": "GKEAPIServer"
        },
        {
          "metricName": "Total Scheduler logs received",
          "legend": "GKESchedulerLogs",
          "baseQuery": "GKEScheduler"
        },
        {
          "metricName": "Total Controller Manager logs received",
          "legend": "GKEControllerManagerLogs",
          "baseQuery": "GKEControllerManager"
        },
        {
          "metricName": "Total HPA Decision logs received",
          "legend": "GKEHPADecisionLogs",
          "baseQuery": "GKEHPADecision"
        },
        {
          "metricName": "Total Application logs received",
          "legend": "GKEApplicationLogs",
          "baseQuery": "GKEApplication"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get Sample of GKE Logs",
          "query": "GKEAudit\n | take 10"
        },
        {
          "description": "Get Sample of GKE API Server Logs",
          "query": "GKEAPIServer\n | take 10"
        },
        {
          "description": "Get Sample of GKE Scheduler Logs",
          "query": "GKEScheduler\n | take 10"
        },
        {
          "description": "Get Sample of GKE Controller Manager Logs",
          "query": "GKEControllerManager\n | take 10"
        },
        {
          "description": "Get Sample of GKE HPA Decision Logs",
          "query": "GKEHPADecision\n | take 10"
        },
        {
          "description": "Get Sample of GKE Application Logs",
          "query": "GKEApplication\n | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "GKEAudit",
          "lastDataReceivedQuery": "GKEAudit\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        },
        {
          "name": "GKEAPIServer",
          "lastDataReceivedQuery": "GKEAPIServer\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        },
        {
          "name": "GKEScheduler",
          "lastDataReceivedQuery": "GKEScheduler\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        },
        {
          "name": "GKEHPADecision",
          "lastDataReceivedQuery": "GKEHPADecision\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        },
        {
          "name": "GKEApplication",
          "lastDataReceivedQuery": "GKEApplication\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        },
        {
          "name": "GKEControllerManager",
          "lastDataReceivedQuery": "GKEControllerManager\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": false
      },
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": true,
              "action": false
            }
          }
        ]
      },
      "instructionSteps": [
        {
          "instructions": [
            {
              "type": "MarkdownControlEnvBased",
              "parameters": {
                "prodScript": "#### Please reference [Ingest Google Cloud Platform log data into Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/connect-google-cloud-platform?tabs=terraform%2Cauditlogs) \n1. Set up your GCP environment \nYou must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider, and service account with permissions to get and consume from the subscription.\n\nTo configure this data connector, execute the following Terraform scripts:\n\n1. Setup Authentication: [Authentication tutorial](https://learn.microsoft.com/en-us/azure/sentinel/connect-google-cloud-platform?tabs=terraform%2Cauditlogs#gcp-authentication-setup). Note: If Authentication is already setup using another GCP data connector, kindly skip this step and use the existing service account and workload identity pool.\n2. Setup Required Resources: [Configuration Guide](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/GCP/Terraform/sentinel_resources_creation/GoogleKubernetesEngineLogsSetup/readme.md)",
                "govScript": "#### Please reference [Ingest Google Cloud Platform log data into Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/connect-google-cloud-platform?tabs=terraform%2Cauditlogs) \n1. Set up your GCP environment \nYou must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider, and service account with permissions to get and consume from the subscription.\n\nTo configure this data connector, execute the following Terraform scripts:\n\n1. Setup Authentication: [Authentication tutorial](https://learn.microsoft.com/en-us/azure/sentinel/connect-google-cloud-platform?tabs=terraform%2Cauditlogs#gcp-authentication-setup). Note: If Authentication is already setup using another GCP data connector, kindly skip this step and use the existing service account and workload identity pool.\n2. Setup Required Resources: [Configuration Guide](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/GCP/Terraform/sentinel_resources_creation/GoogleKubernetesEngineLogsSetup/readme.md)"
              }
            },
            {
              "type": "CopyableLabel",
              "parameters": {
                "label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.",
                "fillWith": [
                  "TenantId"
                ],
                "name": "TenantId",
                "disabled": true
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### 2. Enable Kubernetes Engine Logging \nIn your GCP account, navigate to the Kubernetes Engine section. Enable Cloud Logging for your clusters. Within Cloud Logging, ensure that the specific logs you want to ingest\u2014such as API server, scheduler, controller manager, HPA decision, and application logs\u2014are enabled for effective monitoring and security analysis."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### 3. Connect new collectors \nTo enable GKE Logs for Microsoft Sentinel, click the **Add new collector** button, fill in the required information in the context pane, and click **Connect**."
              }
            },
            {
              "type": "GCPGrid",
              "parameters": {
                "collectors": [
                  {
                    "name": "Audit Collector",
                    "tableName": "GKEAudit"
                  },
                  {
                    "name": "API Server Collector",
                    "tableName": "GKEAPIServer"
                  },
                  {
                    "name": "Scheduler Collector",
                    "tableName": "GKEScheduler"
                  },
                  {
                    "name": "Controller Manager Collector",
                    "tableName": "GKEControllerManager"
                  },
                  {
                    "name": "HPA Decision Collector",
                    "tableName": "GKEHPADecision"
                  },
                  {
                    "name": "Application Collector",
                    "tableName": "GKEApplication"
                  }
                ]
              }
            },
            {
              "type": "GCPContextPane",
              "parameters": {}
            }
          ]
        }
      ]
    }
  }
}