{ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "author": "Microsoft - support@microsoft.com", "comments": "Solution template for Oracle Cloud Infrastructure" }, "parameters": { "location": { "type": "string", "minLength": 1, "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" } }, "workspace-location": { "type": "string", "defaultValue": "", "metadata": { "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" } }, "workspace": { "defaultValue": "", "type": "string", "metadata": { "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" } }, "resourceGroupName": { "type": "string", "defaultValue": "[resourceGroup().name]", "metadata": { "description": "resource group name where Microsoft Sentinel is setup" } }, "subscription": { "type": "string", "defaultValue": "[last(split(subscription().id, '/'))]", "metadata": { "description": "subscription id where Microsoft Sentinel is setup" } } }, "variables": { "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Oracle Cloud Infrastructure", "_solutionVersion": "3.0.2", "solutionId": "azuresentinel.azure-sentinel-solution-ocilogs", "_solutionId": "[variables('solutionId')]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "dataConnectorCCPVersion": "1.0.0", "_dataConnectorContentIdConnectorDefinition1": "OCI-Connector-CCP-Definition", "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]", "_dataConnectorContentIdConnections1": "OCI-Connector-CCP-DefinitionConnections", "dataConnectorTemplateNameConnections1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections1')))]", "dataCollectionEndpointId": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]", "blanks": "[replace('b', 'b', '')]", "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition1'), variables('dataConnectorCCPVersion'))]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", "displayName": "Oracle Cloud Infrastructure (via CCP) – Preview", "contentKind": "DataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorCCPVersion')]", "parameters": {}, "variables": {}, "resources": [ { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", "apiVersion": "2022-09-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", "location": "[parameters('workspace-location')]", "kind": "Customizable", "properties": { "connectorUiConfig": { "id": "OCI-Connector-CCP-Definition", "title": "Oracle Cloud Infrastructure (via CCP) – Preview", "publisher": "Microsoft", "descriptionMarkdown": "The Oracle Cloud Infrastructure (OCI) data connector provides the capability to ingest OCI Logs from [OCI Stream](https://docs.oracle.com/iaas/Content/Streaming/Concepts/streamingoverview.htm) into Microsoft Sentinel using the [OCI Streaming REST API](https://docs.oracle.com/iaas/api/#/streaming/streaming/20180418).", "graphQueriesTableName": "OCI_LogsV2_CL", "graphQueries": [ { "metricName": "OCI Events", "legend": "OCI Data Connector Event Logs", "baseQuery": "{{graphQueriesTableName}}" } ], "sampleQueries": [ { "description": "All OCI Events", "query": "{{graphQueriesTableName}} \n| sort by TimeGenerated desc" }, { "description": "Get Sample of OCI Events", "query": "{{graphQueriesTableName}} \n | take 10" } ], "dataTypes": [ { "name": "{{graphQueriesTableName}}", "lastDataReceivedQuery": "{{graphQueriesTableName}} \n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "HasDataConnectors" } ], "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "Read and Write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true } } ], "customs": [ { "name": "OCI Streaming API access", "description": "Access to the OCI Streaming API through a API Signing Keys is required." } ] }, "instructionSteps": [ { "title": "Connect to OCI Streaming API to start collecting Event logs in Microsoft Sentinel", "description": "1) Log in to the OCI console and access the navigation menu.\n2) In the navigation menu, go to \"Analytics & AI\" → \"Streaming\".\n3) Click \"Create Stream\".\n4) Select an existing \"Stream Pool\" or create a new one.\n5) Enter the following details:\n - \"Stream Name\"\n - \"Retention\"\n - \"Number of Partitions\"\n - \"Total Write Rate\"\n - \"Total Read Rate\" (based on your data volume)\n6) In the navigation menu, go to \"Logging\" → \"Service Connectors\".\n7) Click \"Create Service Connector\".\n8) Enter the following details:\n - \"Connector Name\"\n - \"Description\"\n - \"Resource Compartment\"\n9) Select the \"Source\": \"Logging\".\n10) Select the \"Target\": \"Streaming\".\n11) (Optional) Configure \"Log Group\", \"Filters\", or use a \"custom search query\" to stream only the required logs.\n12) Configure the \"Target\" by selecting the previously created stream.\n13) Click \"Create\".\n14) Follow the documentation to create a [Private Key and API Key Configuration File](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm).\n", "instructions": [ { "type": "Textbox", "parameters": { "label": "Stream OCID", "required": true, "placeholder": "Provide the OCI Stream OCID (E.g. ocid1.stream.oc1..xxxxxxEXAMPLExxxxxx)", "type": "text", "name": "streamId" } }, { "type": "Textbox", "parameters": { "label": "Service Endpoint Base URL", "required": true, "placeholder": "Provide the Service Endpoint Base URL: (cell-1.streaming.ap-hyderabad-1.oci.oraclecloud.com)", "type": "text", "name": "serviceEndpointBaseUrl" } }, { "type": "Dropdown", "parameters": { "label": "Cursor Type", "name": "cursorType", "required": true, "type": "text", "placeholder": "Select Cursor Type", "options": [ { "key": "IndividualCursor", "text": "Individual Cursor" } ] } }, { "type": "Textbox", "parameters": { "label": "Partition Id", "required": true, "placeholder": "Provide the Partition Id. (E.g. 0 or 1 or 2)", "type": "text", "name": "partitions", "description": "The partition ID uses zero-based indexing. For example, if a stream has 3 partitions, the valid partition IDs are 0, 1, or 2." } }, { "type": "Textbox", "parameters": { "label": "Tenant ID", "required": true, "placeholder": "OCI Tenant ID (E.g. ocid1.tenancy.oc1..xxxxxxEXAMPLExxxxxx)", "type": "text", "name": "tenantId" } }, { "type": "Textbox", "parameters": { "label": "User ID", "required": true, "placeholder": "Provide the User Id. (E.g. ocid1.user.oc1..xxxxxxEXAMPLExxxxxx)", "type": "text", "name": "userId" } }, { "type": "Textbox", "parameters": { "label": "Pem File Content", "required": true, "placeholder": "Provide the Pem File content.", "type": "password", "name": "pemFile" } }, { "type": "Textbox", "parameters": { "label": "Pass Phrase", "required": false, "placeholder": "Provide the pass phrase for the Pem File Content. (Optional)", "type": "password", "name": "passPhrase" } }, { "type": "Textbox", "parameters": { "label": "Fingerprint", "required": true, "placeholder": "Provide the fingerprint for the Pem File Content. (E.g. 12:34:56:78:90:AB:CD:EF:GH:IJ:KL:MN:OP)", "type": "password", "name": "publicFingerprint" } }, { "type": "ConnectionToggleButton", "parameters": { "connectLabel": "Connect", "name": "Connect" } } ] } ] } } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", "kind": "DataConnector", "version": "[variables('dataConnectorCCPVersion')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" }, "dependencies": { "criteria": [ { "version": "[variables('dataConnectorCCPVersion')]", "contentId": "[variables('_dataConnectorContentIdConnections1')]", "kind": "ResourcesDataConnector" } ] } } }, { "name": "OCI_DCR", "apiVersion": "2022-06-01", "type": "Microsoft.Insights/dataCollectionRules", "location": "[parameters('workspace-location')]", "kind": "[variables('blanks')]", "properties": { "streamDeclarations": { "Custom-OCI_LogsV2_CL": { "columns": [ { "name": "data", "type": "dynamic" }, { "name": "dataschema", "type": "string" }, { "name": "id", "type": "string" }, { "name": "oracle", "type": "dynamic" }, { "name": "source", "type": "string" }, { "name": "specversion", "type": "string" }, { "name": "time", "type": "datetime" }, { "name": "type", "type": "string" } ] } }, "destinations": { "logAnalytics": [ { "workspaceResourceId": "[variables('workspaceResourceId')]", "name": "clv2ws1" } ] }, "dataFlows": [ { "streams": [ "Custom-OCI_LogsV2_CL" ], "destinations": [ "clv2ws1" ], "transformKql": "source | extend o = oracle, d = data | extend rq = d.request, rs = d.response, di = d.identity, dsc = d.stateChange.current, adDls = d.additionalDetails | extend py = rs.payload, rh = rq.headers, sh = rs.headers, pm = rs.parameters, dsci = dsc.Instance, dsca = dsc.agentConfig, dscl = dsc.launchOptions, dscsh = dsc.shapeConfig, dscsd = dsc.sourceDetails, time_t = [\"time\"], TimeGenerated = todatetime([\"time\"]), oracle_compartmentid_s = tostring(o.compartmentid), oracle_ingestedtime_t = todatetime(o.ingestedtime), oracle_loggroupid_s = tostring(o.loggroupid), oracle_tenantid_s = tostring(o.tenantid), oracle_logid_s = tostring(o.logid), oracle_vniccompartmentocid_s = tostring(o.vniccompartmentocid), oracle_vnicocid_s = tostring(o.vnicocid), oracle_vnicsubnetocid_s = tostring(o.vnicsubnetocid), data_endTime_d = toint(d.endTime), data_flowid_s = tostring(d.flowid), data_startTime_d = toint(d.startTime), data_status_s = tostring(d.status), data_version_s = tostring(d.version), data_action_s = tostring(d.action), data_bytesOut_d = toint(d.bytesOut), data_destinationAddress_s = tostring(d.destinationAddress), data_destinationPort_d = toint(d.destinationPort), data_packets_d = toint(d.packets), data_protocol_d = toint(d.protocol), data_protocolName_s = tostring(d.protocolName), data_sourceAddress_s = tostring(d.sourceAddress), data_sourcePort_d = toint(d.sourcePort) | extend data_request_parameters_serviceName_s = tostring(pm.serviceName), data_request_parameters_vcnId_s = tostring(pm.vcnId), data_request_parameters_imageId_s = tostring(pm.imageId), data_request_parameters_operatingSystem_s = tostring(pm.operatingSystemType), data_request_parameters_operatingSystemVersion_s = tostring(pm.operatingSystemVersion), data_request_parameters_shape_s = tostring(pm.shape), data_request_parameters_isMergeEnabled_s = tostring(pm.isMergeEnabled), data_identity_callerId_s = tostring(di.callerId), data_identity_callerName_s = tostring(di.callerName), data_request_headers_opc_obo_token_s = tostring(rh[\"opc-obo-token\"]), data_additionalDetails_imageId_s = tostring(adDls.imageId), data_additionalDetails_shape_s = tostring(adDls.shape), data_additionalDetails_type_s = tostring(adDls.type), data_additionalDetails_volumeId_s = tostring(adDls.volumeId), data_stateChange_current_systemTags_orcl_cloud_s = tostring(dsc.systemTags[\"orcl-cloud\"]), data_request_parameters_instanceId_s = tostring(pm.instanceId), data_request_headers_opc_retry_token_s = tostring(rh[\"opc-retry-token\"]), data_additionalDetails_isFreeTier_b = tobool(adDls.isFreeTier), data_stateChange_current_Instance_agentConfig_s = tostring(dsci.agentConfig), data_stateChange_current_Instance_availabilityConfig_s = tostring(dsci.availabilityConfig), data_stateChange_current_Instance_availabilityDomain_s = tostring(dsci.availabilityDomain), data_stateChange_current_Instance_compartmentId_s = tostring(dsci.compartmentId), data_stateChange_current_Instance_definedTags_s = tostring(dsci.definedTags), data_stateChange_current_Instance_displayName_s = tostring(dsci.displayName), data_response_headers_Content_Security_Policy_s = tostring(sh[\"Content-Security-Policy\"]), data_response_headers_Etag_s = tostring(sh[\"Etag\"]), data_response_headers_Opc_Request_Id_s = tostring(sh[\"opc-request-id\"]), data_response_headers_Strict_Transport_Security_s = tostring(sh[\"Strict-Transport-Security\"]), data_response_headers_X_Frame_Options_s = tostring(sh[\"X-Frame-Options\"]), data_response_headers_X_Xss_Protection_s = tostring(sh[\"X-Xss-Protection\"]), data_stateChange_current_compartmentId_s = tostring(dsc.compartmentId), data_stateChange_current_definedTags_Oracle_Tags_s = tostring(dsc.definedTags[\"Oracle-Tags\"]), data_stateChange_current_displayName_s = tostring(dsc.displayName), data_stateChange_current_id_s = tostring(dsc.id), data_stateChange_current_instanceId_s = tostring(dsc.instanceId), data_stateChange_current_lifecycleDetails_s = tostring(dsc.lifecycleDetails), data_stateChange_current_tenancyId_s = tostring(dsc.tenancyId), data_stateChange_current_timeUpdated_t = todatetime(dsc.timeUpdated), data_stateChange_current_userDisplayName_s = tostring(dsc.userDisplayName), data_stateChange_current_userName_s = tostring(dsc.userName), data_request_headers_oci_splat_generated_ocids_s = tostring(rh[\"oci-splat-generated-ocids\"]), data_response_headers_opc_work_request_id_s = tostring(sh[\"opc-work-request-id\"]), data_stateChange_current_configuration_s = tostring(dsc.configuration), data_stateChange_current_definedTags_s = tostring(dsc.definedTags), data_stateChange_current_freeformTags_s = tostring(dsc.freeformTags), data_stateChange_current_isEnabled_b = tobool(dsc.isEnabled), data_stateChange_current_logGroupId_s = tostring(dsc.logGroupId), data_stateChange_current_logType_s = tostring(dsc.logType), data_stateChange_current_retentionDuration_d = todouble(dsc.retentionDuration), data_stateChange_current_timeCreated_t = todatetime(dsc.timeCreated), data_stateChange_current_timeLastModified_t = todatetime(dsc.timeLastModified), data_request_headers_Cache_Control_s = tostring(rh[\"Cache-Control\"]), data_request_headers_Cookie_s = tostring(rh[\"Cookie\"]), data_response_headers_X_FRAME_OPTIONS_s = tostring(sh[\"X-FRAME-OPTIONS\"]), data_additionalDetails_id_s = tostring(adDls.id), data_availabilityDomain_s = tostring(d.availabilityDomain), data_compartmentId_s = tostring(d.compartmentId), data_compartmentName_s = tostring(d.compartmentName), data_definedTags_Oracle_Tags_CreatedBy_s = tostring(d.definedTags[\"Oracle-Tags\"].CreatedBy), data_definedTags_Oracle_Tags_CreatedOn_t = todatetime(d.definedTags[\"Oracle-Tags\"].CreatedOn), data_eventGroupingId_s = tostring(d.eventGroupingId), data_eventName_s = tostring(d.eventName), data_identity_ipAddress_s = tostring(di.ipAddress), data_identity_principalId_s = tostring(di.principalId), data_identity_tenantId_s = tostring(di.tenantId), data_identity_userAgent_s = tostring(di.userAgent), data_message_s = tostring(d.message), data_request_action_s = tostring(rq.action), data_request_headers_Connection_s = tostring(rh[\"Connection\"]), data_request_headers_User_Agent_s = tostring(rh[\"User-Agent\"]), data_request_headers_X_Forwarded_For_s = tostring(rh[\"X-Forwarded-For\"]), data_request_headers_auth_info_s = tostring(rh[\"auth_info\"]), data_request_headers_opc_request_id_s = tostring(rh[\"Opc-Request-Id\"]), data_request_id_s = tostring(rq.id), data_request_parameters_tenancy_s = tostring(pm.tenancy), data_request_path_s = tostring(rq.path), data_resourceId_s = tostring(d.resourceId), data_response_headers_Content_Length_d = todouble(sh[\"Content-Length\"]), data_response_headers_Content_Type_s = tostring(sh[\"Content-Type\"]), data_response_headers_Date_t = todatetime(sh[\"Date\"]), data_response_headers_ETag_s = tostring(sh[\"ETag\"]), data_response_headers_Vary_s = tostring(sh[\"Vary\"]), data_response_headers_opc_request_id_s = tostring(sh[\"opc-request-id\"]), data_response_responseTime_d = todouble(rs.responseTime), data_response_status_d = toint(rs.status), data_response_status_s = tostring(rs.status), dataschema_s = tostring(dataschema), id_s = tostring(id), source_s = tostring(source), specversion_s = tostring(specversion), type_s = tostring([\"type\"]), data_identity_authType_s = tostring(di.authType), data_identity_consoleSessionId_s = tostring(di.consoleSessionId), data_identity_credentials_s = tostring(di.credentials), data_identity_principalName_s = tostring(di.principalName), data_request_headers_Accept_s = tostring(rh[\"Accept\"]), data_request_headers_Accept_Encoding_s = tostring(rh[\"Accept-Encoding\"]), data_request_headers_Accept_Language_s = tostring(rh[\"Accept-Language\"]), data_request_headers_Origin_s = tostring(rh[\"Origin\"]), data_request_headers_Referer_s = tostring(rh[\"Referer\"]), data_request_headers_X_OCI_LB_NetworkMetadata_s = tostring(rh[\"X-OCI-LB-NetworkMetadata\"]), data_request_headers_X_Real_IP_s = tostring(rh[\"X-Real-IP\"]), data_request_headers_X_Real_Port_s = tostring(rh[\"X-Real-Port\"]), data_request_headers_oci_original_url_s = tostring(rh[\"oci-original-url\"]), data_request_headers_oci_skip_authorization_for_splat_s = tostring(rh[\"oci-skip-authorization-for-splat\"]), data_request_headers_opc_principal_s = tostring(rh[\"opc-principal\"]), data_request_headers_x_date_t = todatetime(rh[\"x-date\"]), data_request_parameters_compartmentId_s = tostring(pm.compartmentId), data_response_headers_Access_Control_Allow_Credentials_s = tostring(sh[\"Access-Control-Allow-Credentials\"]), data_response_headers_Access_Control_Allow_Origin_s = tostring(sh[\"Access-Control-Allow-Origin\"]), data_response_headers_Access_Control_Expose_Headers_s = tostring(sh[\"Access-Control-Expose-Headers\"]), data_request_parameters_limit_d = todouble(pm[\"limit\"]), data_request_headers_oci_splat_audited_s = tostring(rh[\"oci-splat-audited\"]), data_request_headers_oci_splat_internal_context_s = tostring(rh[\"oci-splat-internal-context\"]), data_request_parameters_sortBy_s = tostring(pm.sortBy), data_request_parameters_sortOrder_s = tostring(pm.sortOrder), data_additionalDetails_X_Real_Port_s = tostring(adDls[\"X-Real-Port\"]), data_freeformTags_VCN_s = tostring(d.freeformTags[\"VCN\"]), data_response_headers_Connection_s = tostring(sh[\"Connection\"]), data_response_headers_Timing_Allow_Origin_s = tostring(sh[\"Timing-Allow-Origin\"]), data_response_headers_X_Content_Type_Options_s = tostring(sh[\"X-Content-Type-Options\"]), data_request_headers_Content_Length_d = todouble(rh[\"Content-Length\"]), data_request_headers_Content_Type_s = tostring(rh[\"Content-Type\"]), data_request_headers_x_content_sha256_s = tostring(rh[\"x-content-sha256\"]), data_request_headers_If_None_Match_s = tostring(rh[\"If-None-Match\"]), data_response_headers_Content_Encoding_s = tostring(sh[\"Content-Encoding\"]), data_request_parameters_includeSubcompartments_b = tobool(pm.includeSubcompartments), data_response_headers_opc_limit_d = todouble(sh[\"opc-limit\"]), data_request_headers_Date_t = todatetime(rh[\"Date\"]), data_request_headers_opc_client_info_s = tostring(rh[\"opc-client-info\"]), data_request_parameters_endTime_t = todatetime(pm.endTime), data_request_parameters_startTime_t = todatetime(pm.startTime), data_response_headers_opc_next_page_s = tostring(sh[\"opc-next-page\"]), data_response_headers_opc_prev_page_s = tostring(sh[\"opc-prev-page\"]), data_request_parameters_id_s = tostring(pm.id), data_request_parameters_lifecycleState_s = tostring(pm.lifecycleState), data_request_parameters_name_s = tostring(pm.name), data_request_parameters_page_s = tostring(pm.page), data_request_parameters_streamPoolId_s = tostring(pm.streamPoolId), data_response_headers_opc_previous_page_s = tostring(sh[\"opc-previous-page\"]), data_response_payload_id_s = tostring(py.id), data_response_payload_resourceName_s = tostring(py.resourceName), data_request_headers_accept_language_s = tostring(rh[\"accept-language\"]), data_request_headers_authorization_s = tostring(rh[\"authorization\"]), data_response_headers_access_control_allow_credentials_s = tostring(sh[\"access-control-allow-credentials\"]), data_response_headers_access_control_allow_methods_s = tostring(sh[\"access-control-allow-methods\"]), data_response_headers_access_control_allow_origin_s = tostring(sh[\"access-control-allow-origin\"]), data_response_headers_access_control_expose_headers_s = tostring(sh[\"access-control-expose-headers\"]), data_response_headers_date_t = todatetime(sh[\"date\"]), data_response_headers_x_api_id_s = tostring(sh[\"x-api-id\"]), data_additionalDetails_namespace_s = tostring(adDls[\"namespace\"]), data_request_parameters_param0_s = tostring(pm.param0), data_response_headers_Cache_Control_s = tostring(sh[\"Cache-Control\"]), data_response_headers_Pragma_s = tostring(sh[\"Pragma\"]), data_response_headers_Transfer_Encoding_s = tostring(sh[\"Transfer-Encoding\"]), data_request_parameters_accessLevel_s = tostring(pm.accessLevel), data_request_parameters_compartmentIdInSubtree_b = tobool(pm.compartmentIdInSubtree), data_additionalDetails_description_s = tostring(adDls[\"description\"]), data_additionalDetails_isAccessable_b = tobool(adDls[\"isAccessable\"]), data_additionalDetails_lifeCycleState_s = tostring(adDls[\"lifeCycleState\"]), data_additionalDetails_homeRegionKey_s = tostring(adDls[\"homeRegionKey\"]), data_additionalDetails_oracleMyServicesIdentifier_s = tostring(adDls[\"oracleMyServicesIdentifier\"]), data_request_headers_X_Forwarded_Host_s = tostring(rh[\"X-Forwarded-Host\"]), data_request_headers_X_Forwarded_Port_s = tostring(rh[\"X-Forwarded-Port\"]), data_request_headers_X_Forwarded_Proto_s = tostring(rh[\"X-Forwarded-Proto\"]), data_request_headers_X_Oracle_Auth_Client_CN_s = tostring(rh[\"X-Oracle-Auth-Client-CN\"]), data_request_parameters_isBanner_b = tobool(pm.isBanner), data_request_parameters_granularity_s = tostring(pm.granularity), data_request_parameters_protocol_s = tostring(pm.protocol), data_additionalDetails_userId_s = tostring(adDls[\"userId\"]), data_response_headers_Location_s = tostring(sh[\"Location\"]), data_stateChange_current_fingerprint_s = tostring(dsc.fingerprint), data_stateChange_current_keyId_s = tostring(dsc.keyId), data_stateChange_current_keyValue_s = tostring(dsc.keyValue), data_stateChange_current_lifecycleState_s = tostring(dsc.lifecycleState), data_stateChange_current_userId_s = tostring(dsc.userId), data_request_parameters_userId_s = tostring(pm.userId), data_request_headers_X_OCI_LB_PrivateAccessMetadata_s = tostring(rh[\"X-OCI-LB-PrivateAccessMetadata\"]), data_request_headers_date_t = todatetime(rh[\"date\"]), data_stateChange_current_LoadBalancers_s = tostring(dsc.LoadBalancers), data_request_parameters_fields_s = tostring(pm.fields), data_request_parameters_availabilityDomain_s = tostring(pm.availabilityDomain), data_request_parameters_subnetId_s = tostring(pm.subnetId) | extend EventVendor = 'Oracle', EventProduct = 'Oracle Cloud Infrastructure', EventStartTime = iff(isnotnull(columnifexists(\"data_startTime_d\", long(null))), todatetime(columnifexists(\"data_startTime_d\", long(null))), time_t), EventEndTime = iff(isnotnull(columnifexists(\"data_endTime_d\", long(null))), todatetime(columnifexists(\"data_endTime_d\", long(null))), time_t), SrcIpAddr = iff(isnotempty(columnifexists(\"data_sourceAddress_s\", '')), columnifexists(\"data_sourceAddress_s\", ''), data_identity_ipAddress_s), SrcPortNumber=columnifexists(\"data_sourcePort_d\", ''), DstIpAddr=columnifexists (\"data_destinationAddress_s\", ''), DstPortNumber=columnifexists (\"data_destinationPort_d\", ''), DstBytes=columnifexists (\"data_bytesOut_d\", ''), NetworkProtocol=columnifexists (\"data_protocolName_s\", ''), data_stateChange_current_Instance_displayName_s = columnifexists(\"data_stateChange_current_Instance_displayName_s\", ''), data_stateChange_current_userName_s = columnifexists(\"data_stateChange_current_userName_s\", ''), data_request_headers_oci_original_url_s = columnifexists(\"data_request_headers_oci_original_url_s\", ''), data_action_s = columnifexists(\"data_action_s\", '') | project-rename EventType=type_s, EventMessage=data_message_s, HttpUserAgentOriginal=data_identity_userAgent_s, HttpStatusCode=data_response_status_s, HttpRequestMethod=data_request_action_s | project-away d, o, [\"time\"], [\"type\"], rs, rq, di, dsc, adDls, py, rh, sh, pm, dsci, dsca, dscl, dscsh, dscsd, dataschema, source, specversion\n", "outputStream": "Custom-OCI_LogsV2_CL" } ], "dataCollectionEndpointId": "[variables('dataCollectionEndpointId')]" } }, { "name": "OCI_LogsV2_CL", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "schema": { "name": "OCI_LogsV2_CL", "columns": [ { "name": "data", "type": "dynamic" }, { "name": "id", "type": "string" }, { "name": "oracle", "type": "dynamic" }, { "name": "time_t", "type": "datetime" }, { "name": "TimeGenerated", "type": "datetime" }, { "name": "oracle_compartmentid_s", "type": "string" }, { "name": "oracle_ingestedtime_t", "type": "datetime" }, { "name": "oracle_loggroupid_s", "type": "string" }, { "name": "oracle_tenantid_s", "type": "string" }, { "name": "oracle_logid_s", "type": "string" }, { "name": "oracle_vniccompartmentocid_s", "type": "string" }, { "name": "oracle_vnicocid_s", "type": "string" }, { "name": "oracle_vnicsubnetocid_s", "type": "string" }, { "name": "data_endTime_d", "type": "int" }, { "name": "data_flowid_s", "type": "string" }, { "name": "data_startTime_d", "type": "int" }, { "name": "data_status_s", "type": "string" }, { "name": "data_version_s", "type": "string" }, { "name": "data_bytesOut_d", "type": "int" }, { "name": "data_destinationAddress_s", "type": "string" }, { "name": "data_destinationPort_d", "type": "int" }, { "name": "data_packets_d", "type": "int" }, { "name": "data_protocol_d", "type": "int" }, { "name": "data_protocolName_s", "type": "string" }, { "name": "data_sourceAddress_s", "type": "string" }, { "name": "data_sourcePort_d", "type": "int" }, { "name": "data_request_parameters_serviceName_s", "type": "string" }, { "name": "data_request_parameters_vcnId_s", "type": "string" }, { "name": "data_request_parameters_imageId_s", "type": "string" }, { "name": "data_request_parameters_operatingSystem_s", "type": "string" }, { "name": "data_request_parameters_operatingSystemVersion_s", "type": "string" }, { "name": "data_request_parameters_shape_s", "type": "string" }, { "name": "data_request_parameters_isMergeEnabled_s", "type": "string" }, { "name": "data_identity_callerId_s", "type": "string" }, { "name": "data_identity_callerName_s", "type": "string" }, { "name": "data_request_headers_opc_obo_token_s", "type": "string" }, { "name": "data_additionalDetails_imageId_s", "type": "string" }, { "name": "data_additionalDetails_shape_s", "type": "string" }, { "name": "data_additionalDetails_type_s", "type": "string" }, { "name": "data_additionalDetails_volumeId_s", "type": "string" }, { "name": "data_stateChange_current_systemTags_orcl_cloud_s", "type": "string" }, { "name": "data_request_parameters_instanceId_s", "type": "string" }, { "name": "data_request_headers_opc_retry_token_s", "type": "string" }, { "name": "data_additionalDetails_isFreeTier_b", "type": "boolean" }, { "name": "data_stateChange_current_Instance_agentConfig_s", "type": "string" }, { "name": "data_stateChange_current_Instance_availabilityConfig_s", "type": "string" }, { "name": "data_stateChange_current_Instance_availabilityDomain_s", "type": "string" }, { "name": "data_stateChange_current_Instance_compartmentId_s", "type": "string" }, { "name": "data_stateChange_current_Instance_definedTags_s", "type": "string" }, { "name": "data_response_headers_Content_Security_Policy_s", "type": "string" }, { "name": "data_response_headers_Etag_s", "type": "string" }, { "name": "data_response_headers_Opc_Request_Id_s", "type": "string" }, { "name": "data_response_headers_Strict_Transport_Security_s", "type": "string" }, { "name": "data_response_headers_X_Frame_Options_s", "type": "string" }, { "name": "data_response_headers_X_Xss_Protection_s", "type": "string" }, { "name": "data_stateChange_current_compartmentId_s", "type": "string" }, { "name": "data_stateChange_current_definedTags_Oracle_Tags_s", "type": "string" }, { "name": "data_stateChange_current_displayName_s", "type": "string" }, { "name": "data_stateChange_current_id_s", "type": "string" }, { "name": "data_stateChange_current_instanceId_s", "type": "string" }, { "name": "data_stateChange_current_lifecycleDetails_s", "type": "string" }, { "name": "data_stateChange_current_tenancyId_s", "type": "string" }, { "name": "data_stateChange_current_timeUpdated_t", "type": "datetime" }, { "name": "data_stateChange_current_userDisplayName_s", "type": "string" }, { "name": "data_request_headers_oci_splat_generated_ocids_s", "type": "string" }, { "name": "data_response_headers_opc_work_request_id_s", "type": "string" }, { "name": "data_stateChange_current_configuration_s", "type": "string" }, { "name": "data_stateChange_current_definedTags_s", "type": "string" }, { "name": "data_stateChange_current_freeformTags_s", "type": "string" }, { "name": "data_stateChange_current_isEnabled_b", "type": "boolean" }, { "name": "data_stateChange_current_logGroupId_s", "type": "string" }, { "name": "data_stateChange_current_logType_s", "type": "string" }, { "name": "data_stateChange_current_retentionDuration_d", "type": "real" }, { "name": "data_stateChange_current_timeCreated_t", "type": "datetime" }, { "name": "data_stateChange_current_timeLastModified_t", "type": "datetime" }, { "name": "data_request_headers_Cache_Control_s", "type": "string" }, { "name": "data_request_headers_Cookie_s", "type": "string" }, { "name": "data_response_headers_X_FRAME_OPTIONS_s", "type": "string" }, { "name": "data_additionalDetails_id_s", "type": "string" }, { "name": "data_availabilityDomain_s", "type": "string" }, { "name": "data_compartmentId_s", "type": "string" }, { "name": "data_compartmentName_s", "type": "string" }, { "name": "data_definedTags_Oracle_Tags_CreatedBy_s", "type": "string" }, { "name": "data_definedTags_Oracle_Tags_CreatedOn_t", "type": "datetime" }, { "name": "data_eventGroupingId_s", "type": "string" }, { "name": "data_eventName_s", "type": "string" }, { "name": "data_identity_ipAddress_s", "type": "string" }, { "name": "data_identity_principalId_s", "type": "string" }, { "name": "data_identity_tenantId_s", "type": "string" }, { "name": "HttpUserAgentOriginal", "type": "string" }, { "name": "EventMessage", "type": "string" }, { "name": "HttpRequestMethod", "type": "string" }, { "name": "data_request_headers_Connection_s", "type": "string" }, { "name": "data_request_headers_User_Agent_s", "type": "string" }, { "name": "data_request_headers_X_Forwarded_For_s", "type": "string" }, { "name": "data_request_headers_auth_info_s", "type": "string" }, { "name": "data_request_headers_opc_request_id_s", "type": "string" }, { "name": "data_request_id_s", "type": "string" }, { "name": "data_request_parameters_tenancy_s", "type": "string" }, { "name": "data_request_path_s", "type": "string" }, { "name": "data_resourceId_s", "type": "string" }, { "name": "data_response_headers_Content_Length_d", "type": "real" }, { "name": "data_response_headers_Content_Type_s", "type": "string" }, { "name": "data_response_headers_Date_t", "type": "datetime" }, { "name": "data_response_headers_ETag_s", "type": "string" }, { "name": "data_response_headers_Vary_s", "type": "string" }, { "name": "data_response_headers_opc_request_id_s", "type": "string" }, { "name": "data_response_responseTime_d", "type": "real" }, { "name": "data_response_status_d", "type": "int" }, { "name": "HttpStatusCode", "type": "string" }, { "name": "dataschema_s", "type": "string" }, { "name": "id_s", "type": "string" }, { "name": "source_s", "type": "string" }, { "name": "specversion_s", "type": "string" }, { "name": "EventType", "type": "string" }, { "name": "data_identity_authType_s", "type": "string" }, { "name": "data_identity_consoleSessionId_s", "type": "string" }, { "name": "data_identity_credentials_s", "type": "string" }, { "name": "data_identity_principalName_s", "type": "string" }, { "name": "data_request_headers_Accept_s", "type": "string" }, { "name": "data_request_headers_Accept_Encoding_s", "type": "string" }, { "name": "data_request_headers_Accept_Language_s", "type": "string" }, { "name": "data_request_headers_Origin_s", "type": "string" }, { "name": "data_request_headers_Referer_s", "type": "string" }, { "name": "data_request_headers_X_OCI_LB_NetworkMetadata_s", "type": "string" }, { "name": "data_request_headers_X_Real_IP_s", "type": "string" }, { "name": "data_request_headers_X_Real_Port_s", "type": "string" }, { "name": "data_request_headers_oci_skip_authorization_for_splat_s", "type": "string" }, { "name": "data_request_headers_opc_principal_s", "type": "string" }, { "name": "data_request_headers_x_date_t", "type": "datetime" }, { "name": "data_request_parameters_compartmentId_s", "type": "string" }, { "name": "data_response_headers_Access_Control_Allow_Credentials_s", "type": "string" }, { "name": "data_response_headers_Access_Control_Allow_Origin_s", "type": "string" }, { "name": "data_response_headers_Access_Control_Expose_Headers_s", "type": "string" }, { "name": "data_request_parameters_limit_d", "type": "real" }, { "name": "data_request_headers_oci_splat_audited_s", "type": "string" }, { "name": "data_request_headers_oci_splat_internal_context_s", "type": "string" }, { "name": "data_request_parameters_sortBy_s", "type": "string" }, { "name": "data_request_parameters_sortOrder_s", "type": "string" }, { "name": "data_additionalDetails_X_Real_Port_s", "type": "string" }, { "name": "data_freeformTags_VCN_s", "type": "string" }, { "name": "data_response_headers_Connection_s", "type": "string" }, { "name": "data_response_headers_Timing_Allow_Origin_s", "type": "string" }, { "name": "data_response_headers_X_Content_Type_Options_s", "type": "string" }, { "name": "data_request_headers_Content_Length_d", "type": "real" }, { "name": "data_request_headers_Content_Type_s", "type": "string" }, { "name": "data_request_headers_x_content_sha256_s", "type": "string" }, { "name": "data_request_headers_If_None_Match_s", "type": "string" }, { "name": "data_response_headers_Content_Encoding_s", "type": "string" }, { "name": "data_request_parameters_includeSubcompartments_b", "type": "boolean" }, { "name": "data_response_headers_opc_limit_d", "type": "real" }, { "name": "data_request_headers_Date_t", "type": "datetime" }, { "name": "data_request_headers_opc_client_info_s", "type": "string" }, { "name": "data_request_parameters_endTime_t", "type": "datetime" }, { "name": "data_request_parameters_startTime_t", "type": "datetime" }, { "name": "data_response_headers_opc_next_page_s", "type": "string" }, { "name": "data_response_headers_opc_prev_page_s", "type": "string" }, { "name": "data_request_parameters_id_s", "type": "string" }, { "name": "data_request_parameters_lifecycleState_s", "type": "string" }, { "name": "data_request_parameters_name_s", "type": "string" }, { "name": "data_request_parameters_page_s", "type": "string" }, { "name": "data_request_parameters_streamPoolId_s", "type": "string" }, { "name": "data_response_headers_opc_previous_page_s", "type": "string" }, { "name": "data_response_payload_id_s", "type": "string" }, { "name": "data_response_payload_resourceName_s", "type": "string" }, { "name": "data_request_headers_accept_language_s", "type": "string" }, { "name": "data_request_headers_authorization_s", "type": "string" }, { "name": "data_response_headers_access_control_allow_credentials_s", "type": "string" }, { "name": "data_response_headers_access_control_allow_methods_s", "type": "string" }, { "name": "data_response_headers_access_control_allow_origin_s", "type": "string" }, { "name": "data_response_headers_access_control_expose_headers_s", "type": "string" }, { "name": "data_response_headers_date_t", "type": "datetime" }, { "name": "data_response_headers_x_api_id_s", "type": "string" }, { "name": "data_additionalDetails_namespace_s", "type": "string" }, { "name": "data_request_parameters_param0_s", "type": "string" }, { "name": "data_response_headers_Cache_Control_s", "type": "string" }, { "name": "data_response_headers_Pragma_s", "type": "string" }, { "name": "data_response_headers_Transfer_Encoding_s", "type": "string" }, { "name": "data_request_parameters_accessLevel_s", "type": "string" }, { "name": "data_request_parameters_compartmentIdInSubtree_b", "type": "boolean" }, { "name": "data_additionalDetails_description_s", "type": "string" }, { "name": "data_additionalDetails_isAccessable_b", "type": "boolean" }, { "name": "data_additionalDetails_lifeCycleState_s", "type": "string" }, { "name": "data_additionalDetails_homeRegionKey_s", "type": "string" }, { "name": "data_additionalDetails_oracleMyServicesIdentifier_s", "type": "string" }, { "name": "data_request_headers_X_Forwarded_Host_s", "type": "string" }, { "name": "data_request_headers_X_Forwarded_Port_s", "type": "string" }, { "name": "data_request_headers_X_Forwarded_Proto_s", "type": "string" }, { "name": "data_request_headers_X_Oracle_Auth_Client_CN_s", "type": "string" }, { "name": "data_request_parameters_isBanner_b", "type": "boolean" }, { "name": "data_request_parameters_granularity_s", "type": "string" }, { "name": "data_request_parameters_protocol_s", "type": "string" }, { "name": "data_additionalDetails_userId_s", "type": "string" }, { "name": "data_response_headers_Location_s", "type": "string" }, { "name": "data_stateChange_current_fingerprint_s", "type": "string" }, { "name": "data_stateChange_current_keyId_s", "type": "string" }, { "name": "data_stateChange_current_keyValue_s", "type": "string" }, { "name": "data_stateChange_current_lifecycleState_s", "type": "string" }, { "name": "data_stateChange_current_userId_s", "type": "string" }, { "name": "data_request_parameters_userId_s", "type": "string" }, { "name": "data_request_headers_X_OCI_LB_PrivateAccessMetadata_s", "type": "string" }, { "name": "data_request_headers_date_t", "type": "datetime" }, { "name": "data_stateChange_current_LoadBalancers_s", "type": "string" }, { "name": "data_request_parameters_fields_s", "type": "string" }, { "name": "data_request_parameters_availabilityDomain_s", "type": "string" }, { "name": "data_request_parameters_subnetId_s", "type": "string" }, { "name": "EventVendor", "type": "string" }, { "name": "EventProduct", "type": "string" }, { "name": "EventStartTime", "type": "datetime" }, { "name": "EventEndTime", "type": "datetime" }, { "name": "SrcIpAddr", "type": "string" }, { "name": "SrcPortNumber", "type": "int" }, { "name": "DstIpAddr", "type": "string" }, { "name": "DstPortNumber", "type": "int" }, { "name": "DstBytes", "type": "int" }, { "name": "NetworkProtocol", "type": "string" }, { "name": "data_stateChange_current_Instance_displayName_s", "type": "string" }, { "name": "data_stateChange_current_userName_s", "type": "string" }, { "name": "data_request_headers_oci_original_url_s", "type": "string" }, { "name": "data_action_s", "type": "string" } ] } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition1'),'-', variables('dataConnectorCCPVersion'))))]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('dataConnectorCCPVersion')]" } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", "apiVersion": "2022-09-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", "location": "[parameters('workspace-location')]", "kind": "Customizable", "properties": { "connectorUiConfig": { "id": "OCI-Connector-CCP-Definition", "title": "Oracle Cloud Infrastructure (via CCP) – Preview", "publisher": "Microsoft", "descriptionMarkdown": "The Oracle Cloud Infrastructure (OCI) data connector provides the capability to ingest OCI Logs from [OCI Stream](https://docs.oracle.com/iaas/Content/Streaming/Concepts/streamingoverview.htm) into Microsoft Sentinel using the [OCI Streaming REST API](https://docs.oracle.com/iaas/api/#/streaming/streaming/20180418).", "graphQueriesTableName": "OCI_LogsV2_CL", "graphQueries": [ { "metricName": "OCI Events", "legend": "OCI Data Connector Event Logs", "baseQuery": "{{graphQueriesTableName}}" } ], "sampleQueries": [ { "description": "All OCI Events", "query": "{{graphQueriesTableName}} \n| sort by TimeGenerated desc" }, { "description": "Get Sample of OCI Events", "query": "{{graphQueriesTableName}} \n | take 10" } ], "dataTypes": [ { "name": "{{graphQueriesTableName}}", "lastDataReceivedQuery": "{{graphQueriesTableName}} \n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "HasDataConnectors" } ], "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "Read and Write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true } } ], "customs": [ { "name": "OCI Streaming API access", "description": "Access to the OCI Streaming API through a API Signing Keys is required." } ] }, "instructionSteps": [ { "title": "Connect to OCI Streaming API to start collecting Event logs in Microsoft Sentinel", "description": "1) Log in to the OCI console and access the navigation menu.\n2) In the navigation menu, go to \"Analytics & AI\" → \"Streaming\".\n3) Click \"Create Stream\".\n4) Select an existing \"Stream Pool\" or create a new one.\n5) Enter the following details:\n - \"Stream Name\"\n - \"Retention\"\n - \"Number of Partitions\"\n - \"Total Write Rate\"\n - \"Total Read Rate\" (based on your data volume)\n6) In the navigation menu, go to \"Logging\" → \"Service Connectors\".\n7) Click \"Create Service Connector\".\n8) Enter the following details:\n - \"Connector Name\"\n - \"Description\"\n - \"Resource Compartment\"\n9) Select the \"Source\": \"Logging\".\n10) Select the \"Target\": \"Streaming\".\n11) (Optional) Configure \"Log Group\", \"Filters\", or use a \"custom search query\" to stream only the required logs.\n12) Configure the \"Target\" by selecting the previously created stream.\n13) Click \"Create\".\n14) Follow the documentation to create a [Private Key and API Key Configuration File](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm).\n", "instructions": [ { "type": "Textbox", "parameters": { "label": "Stream OCID", "required": true, "placeholder": "Provide the OCI Stream OCID (E.g. ocid1.stream.oc1..xxxxxxEXAMPLExxxxxx)", "type": "text", "name": "streamId" } }, { "type": "Textbox", "parameters": { "label": "Service Endpoint Base URL", "required": true, "placeholder": "Provide the Service Endpoint Base URL: (cell-1.streaming.ap-hyderabad-1.oci.oraclecloud.com)", "type": "text", "name": "serviceEndpointBaseUrl" } }, { "type": "Dropdown", "parameters": { "label": "Cursor Type", "name": "cursorType", "required": true, "type": "text", "placeholder": "Select Cursor Type", "options": [ { "key": "IndividualCursor", "text": "Individual Cursor" } ] } }, { "type": "Textbox", "parameters": { "label": "Partition Id", "required": true, "placeholder": "Provide the Partition Id.", "type": "text", "name": "partitions" } }, { "type": "Textbox", "parameters": { "label": "Tenant ID", "required": true, "placeholder": "OCI Tenant ID (E.g. ocid1.tenancy.oc1..xxxxxxEXAMPLExxxxxx)", "type": "text", "name": "tenantId" } }, { "type": "Textbox", "parameters": { "label": "User ID", "required": true, "placeholder": "Provide the User Id. (E.g. ocid1.user.oc1..xxxxxxEXAMPLExxxxxx)", "type": "text", "name": "userId" } }, { "type": "Textbox", "parameters": { "label": "Pem File Content", "required": true, "placeholder": "Provide the Pem File content.", "type": "password", "name": "pemFile" } }, { "type": "Textbox", "parameters": { "label": "Pass Phrase", "required": false, "placeholder": "Provide the pass phrase for the Pem File Content. (Optional)", "type": "password", "name": "passPhrase" } }, { "type": "Textbox", "parameters": { "label": "Fingerprint", "required": true, "placeholder": "Provide the fingerprint for the Pem File Content. (E.g. 12:34:56:78:90:AB:CD:EF:GH:IJ:KL:MN:OP)", "type": "password", "name": "publicFingerprint" } }, { "type": "ConnectionToggleButton", "parameters": { "connectLabel": "Connect", "name": "Connect" } } ] } ] } } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", "kind": "DataConnector", "version": "[variables('dataConnectorCCPVersion')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" }, "dependencies": { "criteria": [ { "version": "[variables('dataConnectorCCPVersion')]", "contentId": "[variables('_dataConnectorContentIdConnections1')]", "kind": "ResourcesDataConnector" } ] } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections1'), variables('dataConnectorCCPVersion'))]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "contentId": "[variables('_dataConnectorContentIdConnections1')]", "displayName": "Oracle Cloud Infrastructure (via CCP) – Preview", "contentKind": "ResourcesDataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorCCPVersion')]", "parameters": { "guidValue": { "defaultValue": "[[newGuid()]", "type": "securestring" }, "innerWorkspace": { "defaultValue": "[parameters('workspace')]", "type": "securestring" }, "connectorDefinitionName": { "defaultValue": "Oracle Cloud Infrastructure (via CCP) – Preview", "type": "securestring", "minLength": 1 }, "workspace": { "defaultValue": "[parameters('workspace')]", "type": "securestring" }, "dcrConfig": { "defaultValue": { "dataCollectionEndpoint": "data collection Endpoint", "dataCollectionRuleImmutableId": "data collection rule immutableId" }, "type": "object" }, "streamId": { "defaultValue": "streamId", "type": "securestring", "minLength": 1 }, "serviceEndpointBaseUrl": { "defaultValue": "serviceEndpointBaseUrl", "type": "securestring", "minLength": 1 }, "cursorType": { "defaultValue": "cursorType", "type": "array" }, "partitions": { "defaultValue": "partitions", "type": "securestring", "minLength": 1 }, "tenantId": { "defaultValue": "tenantId", "type": "securestring", "minLength": 1 }, "userId": { "defaultValue": "userId", "type": "securestring", "minLength": 1 }, "pemFile": { "defaultValue": "pemFile", "type": "securestring", "minLength": 1 }, "passPhrase": { "defaultValue": "passPhrase", "type": "securestring", "minLength": 1 }, "publicFingerprint": { "defaultValue": "publicFingerprint", "type": "securestring", "minLength": 1 } }, "variables": { "_dataConnectorContentIdConnections1": "[variables('_dataConnectorContentIdConnections1')]" }, "resources": [ { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections1')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections1'))]", "contentId": "[variables('_dataConnectorContentIdConnections1')]", "kind": "ResourcesDataConnector", "version": "[variables('dataConnectorCCPVersion')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } }, { "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'oracle-cloud-infra-connector', parameters('guidValue'))]", "apiVersion": "2023-02-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", "kind": "OCI", "properties": { "connectorDefinitionName": "OCI-Connector-CCP-Definition", "dataType": "OCI_LogsV2_CL", "dcrConfig": { "streamName": "Custom-OCI_LogsV2_CL", "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" }, "auth": { "type": "Oracle", "pemFile": "[[parameters('pemFile')]", "publicFingerprint": "[[parameters('publicFingerprint')]", "tenantId": "[[parameters('tenantId')]", "userId": "[[parameters('userId')]", "passPhrase": "[[parameters('passPhrase')]" }, "request": { "streamId": "[[parameters('streamId')]", "rateLimitQPS": 1, "partitions": "[[parameters('partitions')]", "serviceEndpointBaseUrl": "[[parameters('serviceEndpointBaseUrl')]", "queryWindowInMin": 5, "cursorType": "[[parameters('cursorType')[0]]", "type": "OCI" }, "response": { "eventsJsonPaths": [ "$" ], "format": "json" }, "Paging": { "pageSize": 100 } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections1'),'-', variables('dataConnectorCCPVersion'))))]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('dataConnectorCCPVersion')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { "version": "3.0.2", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Oracle Cloud Infrastructure", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Oracle Cloud Infrastructure (OCI) solution provides the capability to ingest OCI Logs from OCI Stream into Microsoft Sentinel using the OCI Streaming REST API.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n

  1. Azure Monitor HTTP Data Collector API

    \n
    2. \n

  2. Azure Functions

    \n
    3. \n
\n

Data Connectors: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { "kind": "Solution", "name": "Oracle Cloud Infrastructure", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" }, "dependencies": { "operator": "AND", "criteria": [ { "kind": "DataConnector", "contentId": "[variables('_dataConnectorContentIdConnections1')]", "version": "[variables('dataConnectorCCPVersion')]" } ] }, "firstPublishDate": "2022-06-01", "providers": [ "Oracle" ], "categories": { "domains": [ "Security - Insider Threat" ] } }, "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" } ], "outputs": {} }