{ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "author": "Feedly ml@feedly.com", "comments": "Solution template for Feedly" }, "parameters": { "location": { "type": "string", "minLength": 1, "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" } }, "workspace-location": { "type": "string", "defaultValue": "", "metadata": { "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" } }, "workspace": { "defaultValue": "", "type": "string", "metadata": { "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" } }, "resourceGroupName": { "type": "string", "defaultValue": "[resourceGroup().name]", "metadata": { "description": "resource group name where Microsoft Sentinel is setup" } }, "subscription": { "type": "string", "defaultValue": "[last(split(subscription().id, '/'))]", "metadata": { "description": "subscription id where Microsoft Sentinel is setup" } } }, "variables": { "_solutionName": "Feedly", "_solutionVersion": "3.0.4", "solutionId": "feedlyinc1693853810319.azure-sentinel-solution-feedly", "_solutionId": "[variables('solutionId')]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "dataConnectorCCPVersion": "1.0.0", "_dataConnectorContentIdConnectorDefinition1": "FeedlyCCPDefinition", "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]", "_dataConnectorContentIdConnections1": "FeedlyCCPDefinitionConnections", "dataConnectorTemplateNameConnections1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections1')))]", "dataCollectionEndpointId1": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]", "blanks": "[replace('b', 'b', '')]", "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition1'), variables('dataConnectorCCPVersion'))]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", "displayName": "Feedly IoC", "contentKind": "DataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorCCPVersion')]", "parameters": {}, "variables": {}, "resources": [ { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", "apiVersion": "2022-09-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", "location": "[parameters('workspace-location')]", "kind": "Customizable", "properties": { "connectorUiConfig": { "id": "FeedlyCCPDefinition", "title": "Feedly IoC", "publisher": "Feedly", "descriptionMarkdown": "The [Feedly](https://feedly.com/) IoC data connector provides the capability to ingest Indicators of Compromise (IoCs) from Feedly API into Microsoft Sentinel.", "graphQueriesTableName": "feedly_indicators_CL", "graphQueries": [ { "metricName": "Total data received", "legend": "Feedly IoCs", "baseQuery": "{{graphQueriesTableName}}\n| summarize count() by bin(TimeGenerated, 1h)" } ], "sampleQueries": [ { "description": "All IoCs collected", "query": "{{graphQueriesTableName}}\n| sort by TimeGenerated desc" }, { "description": "IP addresses", "query": "{{graphQueriesTableName}}\n| where indicatorType == \"ipv4-addr\"\n| sort by TimeGenerated desc" }, { "description": "Domain names", "query": "{{graphQueriesTableName}}\n| where indicatorType == \"domain-name\"\n| sort by TimeGenerated desc" } ], "dataTypes": [ { "name": "{{graphQueriesTableName}}", "lastDataReceivedQuery": "{{graphQueriesTableName}}\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" } ], "availability": { "isPreview": false }, "connectivityCriteria": [ { "type": "HasDataConnectors" } ], "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "Read and Write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true } } ], "customs": [ { "name": "Feedly API access", "description": "Access to the Feedly API is required. You need a Feedly API token with access to the IoC streams you want to ingest. Generate your API token at https://feedly.com/i/team/api" } ] }, "instructionSteps": [ { "title": "Connect to Feedly to start collecting IoCs in Microsoft Sentinel", "description": "1) Go to https://feedly.com/i/team/api and generate a new API token for the connector.\n2) In Sentinel, in the connector page - provide your Feedly API Key and Stream IDs. Then click \"Connect\".", "instructions": [ { "type": "Textbox", "parameters": { "label": "Feedly API Key", "placeholder": "Enter your Feedly API token", "type": "password", "name": "feedlyApiKey", "required": true } }, { "type": "Textbox", "parameters": { "label": "Feedly Stream IDs", "placeholder": "streamId1,streamId2,streamId3", "type": "text", "name": "feedlyStreamIds", "required": true } }, { "type": "ConnectionToggleButton", "parameters": { "connectLabel": "Connect", "name": "connect" } } ] } ] } } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", "kind": "DataConnector", "version": "[variables('dataConnectorCCPVersion')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "Feedly ml@feedly.com" }, "support": { "name": "Feedly Inc", "email": "ml@feedly.com", "tier": "Partner", "link": "https://feedly.com/i/support/contactUs" }, "dependencies": { "criteria": [ { "version": "[variables('dataConnectorCCPVersion')]", "contentId": "[variables('_dataConnectorContentIdConnections1')]", "kind": "ResourcesDataConnector" } ] } } }, { "name": "feedlyDCR1", "apiVersion": "2022-06-01", "type": "Microsoft.Insights/dataCollectionRules", "location": "[parameters('workspace-location')]", "kind": "[variables('blanks')]", "properties": { "dataCollectionEndpointId": "[variables('dataCollectionEndpointId1')]", "streamDeclarations": { "Custom-feedly_indicators_CL": { "columns": [ { "name": "subtype", "type": "string" }, { "name": "value", "type": "string" }, { "name": "source_name", "type": "string" }, { "name": "type", "type": "string" }, { "name": "source_entry_id", "type": "string" }, { "name": "source_entry_title", "type": "string" } ] } }, "destinations": { "logAnalytics": [ { "workspaceResourceId": "[variables('workspaceResourceId')]", "name": "clv2ws1" } ] }, "dataFlows": [ { "streams": [ "Custom-feedly_indicators_CL" ], "destinations": [ "clv2ws1" ], "outputStream": "Custom-feedly_indicators_CL", "transformKql": "source | extend TimeGenerated = now() , value = ['value'] , indicatorType = ['type'] , indicatorSubType = ['subtype'] , source = ['source_name'] , articleUrl = strcat('https://feedly.com/i/entry/', ['source_entry_id']) , articleTitle = ['source_entry_title'] | project TimeGenerated , value , indicatorType , indicatorSubType , source , articleUrl , articleTitle" } ] } }, { "name": "feedly_indicators_CL", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "totalRetentionInDays": 365, "plan": "Analytics", "schema": { "name": "feedly_indicators_CL", "description": "Feedly IoC data collected from Feedly API", "columns": [ { "name": "TimeGenerated", "type": "DateTime" }, { "name": "indicatorType", "type": "String", "description": "Type of indicator (e.g., ipv4-addr, domain-name, url)" }, { "name": "indicatorSubType", "type": "String", "description": "Subtype classification of the indicator" }, { "name": "value", "type": "String", "description": "The Indicator of Compromise value, such as an IP address, domain name, URL, hash, or email" }, { "name": "articleTitle", "type": "String", "description": "Title of the source article" }, { "name": "articleUrl", "type": "String", "description": "URL to the source article in Feedly" }, { "name": "source", "type": "String", "description": "Source publication name" } ] } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition1'),'-', variables('dataConnectorCCPVersion'))))]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('dataConnectorCCPVersion')]" } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", "apiVersion": "2022-09-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", "location": "[parameters('workspace-location')]", "kind": "Customizable", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "connectorUiConfig": { "id": "FeedlyCCPDefinition", "title": "Feedly IoC", "publisher": "Feedly", "descriptionMarkdown": "The [Feedly](https://feedly.com/) IoC data connector provides the capability to ingest Indicators of Compromise (IoCs) from Feedly API into Microsoft Sentinel.", "graphQueriesTableName": "feedly_indicators_CL", "graphQueries": [ { "metricName": "Total data received", "legend": "Feedly IoCs", "baseQuery": "{{graphQueriesTableName}}\n| summarize count() by bin(TimeGenerated, 1h)" } ], "sampleQueries": [ { "description": "All IoCs collected", "query": "{{graphQueriesTableName}}\n| sort by TimeGenerated desc" }, { "description": "IP addresses", "query": "{{graphQueriesTableName}}\n| where indicatorType == \"ipv4-addr\"\n| sort by TimeGenerated desc" }, { "description": "Domain names", "query": "{{graphQueriesTableName}}\n| where indicatorType == \"domain-name\"\n| sort by TimeGenerated desc" } ], "dataTypes": [ { "name": "{{graphQueriesTableName}}", "lastDataReceivedQuery": "{{graphQueriesTableName}}\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" } ], "availability": { "isPreview": false }, "connectivityCriteria": [ { "type": "HasDataConnectors" } ], "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "Read and Write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true } } ], "customs": [ { "name": "Feedly API access", "description": "Access to the Feedly API is required. You need a Feedly API token with access to the IoC streams you want to ingest. Generate your API token at https://feedly.com/i/team/api" } ] }, "instructionSteps": [ { "title": "Connect to Feedly to start collecting IoCs in Microsoft Sentinel", "description": "1) Go to https://feedly.com/i/team/api and generate a new API token for the connector.\n2) In Sentinel, in the connector page - provide your Feedly API Key and Stream IDs. Then click \"Connect\".", "instructions": [ { "type": "Textbox", "parameters": { "label": "Feedly API Key", "placeholder": "Enter your Feedly API token", "type": "password", "name": "feedlyApiKey", "required": true } }, { "type": "Textbox", "parameters": { "label": "Feedly Stream IDs", "placeholder": "streamId1,streamId2,streamId3", "type": "text", "name": "feedlyStreamIds", "required": true } }, { "type": "ConnectionToggleButton", "parameters": { "connectLabel": "Connect", "name": "connect" } } ] } ] } } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]" ], "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", "kind": "DataConnector", "version": "[variables('dataConnectorCCPVersion')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "Feedly ml@feedly.com" }, "support": { "name": "Feedly Inc", "email": "ml@feedly.com", "tier": "Partner", "link": "https://feedly.com/i/support/contactUs" }, "dependencies": { "criteria": [ { "version": "[variables('dataConnectorCCPVersion')]", "contentId": "[variables('_dataConnectorContentIdConnections1')]", "kind": "ResourcesDataConnector" } ] } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections1'), variables('dataConnectorCCPVersion'))]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "contentId": "[variables('_dataConnectorContentIdConnections1')]", "displayName": "Feedly IoC", "contentKind": "ResourcesDataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorCCPVersion')]", "parameters": { "guidValue": { "defaultValue": "[[newGuid()]", "type": "securestring" }, "innerWorkspace": { "defaultValue": "[parameters('workspace')]", "type": "securestring" }, "connectorDefinitionName": { "defaultValue": "Feedly IoC", "type": "securestring", "minLength": 1 }, "workspace": { "defaultValue": "[parameters('workspace')]", "type": "securestring" }, "dcrConfig": { "defaultValue": { "dataCollectionEndpoint": "data collection Endpoint", "dataCollectionRuleImmutableId": "data collection rule immutableId" }, "type": "object" }, "feedlyApiKey": { "defaultValue": "feedlyApiKey", "type": "securestring", "minLength": 1 }, "feedlyStreamIds": { "defaultValue": "feedlyStreamIds", "type": "securestring", "minLength": 1 } }, "variables": { "_dataConnectorContentIdConnections1": "[variables('_dataConnectorContentIdConnections1')]" }, "resources": [ { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections1')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections1'))]", "contentId": "[variables('_dataConnectorContentIdConnections1')]", "kind": "ResourcesDataConnector", "version": "[variables('dataConnectorCCPVersion')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "Feedly ml@feedly.com" }, "support": { "name": "Feedly Inc", "email": "ml@feedly.com", "tier": "Partner", "link": "https://feedly.com/i/support/contactUs" } } }, { "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'FeedlyCCPPolling', parameters('guidValue'))]", "apiVersion": "2023-02-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", "kind": "RestApiPoller", "properties": { "connectorDefinitionName": "FeedlyCCPDefinition", "dataType": "feedly_indicators_CL", "dcrConfig": { "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", "streamName": "Custom-feedly_indicators_CL" }, "auth": { "type": "APIKey", "ApiKey": "[[parameters('feedlyApiKey')]", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" }, "request": { "apiEndpoint": "https://api.feedly.com/v3/enterprise/ioc", "httpMethod": "GET", "rateLimitQPS": 10, "queryWindowInMin": 30, "queryWindowDelayInMin": 60, "queryTimeFormat": "UnixTimestampInMills", "retryCount": 3, "timeoutInSeconds": 90, "headers": { "Content-Type": "application/json", "Accept": "application/json" }, "queryParameters": { "streamId": "[[parameters('feedlyStreamIds')]", "newerThan": "{_QueryWindowStartTime}", "olderThan": "{_QueryWindowEndTime}", "format": "sentinel" } }, "response": { "eventsJsonPaths": [ "$.objects[*]" ], "format": "json" }, "paging": { "pagingType": "LinkHeader" }, "isActive": true } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections1'),'-', variables('dataConnectorCCPVersion'))))]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('dataConnectorCCPVersion')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]", "properties": { "version": "3.0.4", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Feedly", "publisherDisplayName": "Feedly Inc", "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Feedly Solution for Microsoft Sentinel provides a simple way to ingest Indicators of Compromise from your Feedly streams into Microsoft Sentinel.

\n

Data Connectors: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { "kind": "Solution", "name": "Feedly", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Feedly ml@feedly.com" }, "support": { "name": "Feedly Inc", "email": "ml@feedly.com", "tier": "Partner", "link": "https://feedly.com/i/support/contactUs" }, "dependencies": { "operator": "AND", "criteria": [ { "kind": "DataConnector", "contentId": "[variables('_dataConnectorContentIdConnections1')]", "version": "[variables('dataConnectorCCPVersion')]" } ] }, "firstPublishDate": "2023-08-01", "providers": [ "Feedly" ], "categories": { "domains": [ "Security - Threat Protection" ] } } } ], "outputs": {} }