Azure-Sentinel/Solutions/Google Apigee/Data Connectors/Apigee_GCP_CCP/ApigeeXV2_DCR.json at 81cfbf238cd0cfd1b31915b971a805d9694655c7 · Azure/Azure-Sentinel · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
[
    {
        "type": "Microsoft.Insights/dataCollectionRules",
        "apiVersion": "2023-03-11",
        "name": "ApigeeXV2_CL",
        "location": "{{location}}",
        "properties": {
            "dataCollectionEndpointId": "{{dataCollectionEndpointResourceId}}",
            "streamDeclarations": {
                "Custom-ApigeeXV2_CL": {
                    "columns": [
                        {
                            "name": "protoPayload",
                            "type": "dynamic"
                        },
                        {
                            "name": "insertId",
                            "type": "string"
                        },
                        {
                            "name": "resource",
                            "type": "dynamic"
                        },
                        {
                            "name": "timestamp",
                            "type": "datetime"
                        },
                        {
                            "name": "severity",
                            "type": "string"
                        },
                        {
                            "name": "logName",
                            "type": "string"
                        },
                        {
                            "name": "receiveTimestamp",
                            "type": "datetime"
                        }
                    ]
                }
            },
            "dataSources": {},
            "destinations": {
                "logAnalytics": [
                    {
                        "workspaceResourceId": "[variables('logAnalyticsWorkspaceResourceId)]",
                        "name": "SentinelWorkspace"
                    }
                ]
            },
            "dataFlows": [
                {
                    "streams": [
                        "Custom-ApigeeXV2_CL"
                    ],
                    "destinations": [
                        "SentinelWorkspace"
                    ],
                    "transformKql": "source\n| extend TimeGenerated = timestamp\n",
                    "outputStream": "Custom-ApigeeXV2_CL"
                }
            ]
        }
    }
]