Skip to content

Commit 334ffb9

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request #11792 from malowe101/ApigeeConnector
Add GCPApigee CCP connector
2 parents f3a613d + 7c19894 commit 334ffb9

File tree

15 files changed

+1544
-92
lines changed

15 files changed

+1544
-92
lines changed

‎.script/tests/KqlvalidationsTests/CustomTables/ApigeeXV2_CL.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"Name": "ApigeeXV2_CL",
3+
"properties": [
4+
{
5+
"name": "protoPayload",
6+
"type": "dynamic"
7+
},
8+
{
9+
"name": "insertId",
10+
"type": "string"
11+
},
12+
{
13+
"name": "resource",
14+
"type": "dynamic"
15+
},
16+
{
17+
"name": "timestamp",
18+
"type": "datetime"
19+
},
20+
{
21+
"name": "severity",
22+
"type": "string"
23+
},
24+
{
25+
"name": "logName",
26+
"type": "string"
27+
},
28+
{
29+
"name": "receiveTimestamp",
30+
"type": "datetime"
31+
},
32+
{
33+
"name": "TimeGenerated",
34+
"type": "datetime"
35+
},
36+
{
37+
"name": "payload_request_name_s",
38+
"type": "string"
39+
}
40+
]
41+
}

‎.script/tests/KqlvalidationsTests/CustomTables/ApigeeX_CL.json‎

Lines changed: 130 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -92,10 +92,6 @@
9292
"Name": "log_name",
9393
"Type": "string"
9494
},
95-
{
96-
"Name": "insert_id_",
97-
"Type": "string"
98-
},
9995
{
10096
"Name": "severity",
10197
"Type": "string"
@@ -244,10 +240,6 @@
244240
"Name": "log_name",
245241
"Type": "string"
246242
},
247-
{
248-
"Name": "insert_id",
249-
"Type": "string"
250-
},
251243
{
252244
"Name": "severity",
253245
"Type": "string"
@@ -329,12 +321,140 @@
329321
"Type": "datetime"
330322
},
331323
{
332-
"Name": "Type",
324+
"Name": "_ResourceId",
333325
"Type": "string"
334326
},
335327
{
336-
"Name": "_ResourceId",
328+
"Name": "payload_request_name_s",
329+
"Type": "string"
330+
},
331+
{
332+
"Name": "payload_request_environment_apiProxyType_s",
333+
"Type": "string"
334+
},
335+
{
336+
"Name": "payload_request_environment_deploymentType_s",
337+
"Type": "string"
338+
},
339+
{
340+
"Name": "payload_request_environment_description_s",
341+
"Type": "string"
342+
},
343+
{
344+
"Name": "payload_request_environment_displayname_s",
345+
"Type": "string"
346+
},
347+
{
348+
"Name": "payload_request_environment_name_s",
349+
"Type": "string"
350+
},
351+
{
352+
"Name": "payload_response_type_s",
337353
"Type": "string"
354+
},
355+
{
356+
"Name": "payload_response_name_s",
357+
"Type": "string"
358+
},
359+
{
360+
"Name": "payload_response_displayName_s",
361+
"Type": "string"
362+
},
363+
{
364+
"Name": "payload_response_apiProxyType_s",
365+
"Type": "string"
366+
},
367+
{
368+
"Name": "payload_status_message_s",
369+
"Type": "string"
370+
},
371+
{
372+
"Name": "payload_request_reportTime_s",
373+
"Type": "string"
374+
},
375+
{
376+
"Name": "insert_id_s",
377+
"Type": "string"
378+
},
379+
{
380+
"Name": "resource_type_s",
381+
"Type": "string"
382+
},
383+
{
384+
"Name": "severity_s",
385+
"Type": "string"
386+
},
387+
{
388+
"Name": "payload__type_s",
389+
"Type": "string"
390+
},
391+
{
392+
"Name": "log_name_s",
393+
"Type": "string"
394+
},
395+
{
396+
"Name": "payload_methodName_s",
397+
"Type": "string"
398+
},
399+
{
400+
"Name": "resource_labels_project_id_s",
401+
"Type": "string"
402+
},
403+
{
404+
"Name": "resource_labels_service_s",
405+
"Type": "string"
406+
},
407+
{
408+
"Name": "resource_labels_method_s",
409+
"Type": "string"
410+
},
411+
{
412+
"Name": "payload_authenticationInfo_principalEmail_s",
413+
"Type": "string"
414+
},
415+
{
416+
"Name": "payload_requestMetadata_callerIp_s",
417+
"Type": "string"
418+
},
419+
{
420+
"Name": "payload_requestMetadata_callerSuppliedUserAgent_s",
421+
"Type": "string"
422+
},
423+
{
424+
"Name": "payload_requestMetadata_requestAttributes_time_s",
425+
"Type": "string"
426+
},
427+
{
428+
"Name": "payload_serviceName_s",
429+
"Type": "string"
430+
},
431+
{
432+
"Name": "payload_authorizationInfo_s",
433+
"Type": "string"
434+
},
435+
{
436+
"Name": "payload_resourceName_s",
437+
"Type": "string"
438+
},
439+
{
440+
"Name": "payload_request_type_s",
441+
"Type": "string"
442+
},
443+
{
444+
"Name": "payload_request_instanceUid_g",
445+
"Type": "string"
446+
},
447+
{
448+
"Name": "payload_requestMetadata_requestAttributes_time_t",
449+
"Type": "datetime"
450+
},
451+
{
452+
"Name": "timestamp_t",
453+
"Type": "datetime"
454+
},
455+
{
456+
"Name": "payload_status_code_d",
457+
"Type": "real"
338458
}
339459
]
340460
}

‎Sample Data/Custom/ApigeeXV2.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
[
2+
{
3+
"protoPayload": {
4+
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
5+
"authenticationInfo": {
6+
"principalEmail": "sanitized@sanitized.com",
7+
"principalSubject": "sanitized@sanitized.com"
8+
},
9+
"requestMetadata": {
10+
"callerIp": "gce-internal-ip",
11+
"callerSuppliedUserAgent": "Go-http-client/1.1,gzip(gfe)",
12+
"requestAttributes": {
13+
"time": "2024-12-11T18:36:57.957393509Z",
14+
"auth": {}
15+
},
16+
"destinationAttributes": {}
17+
},
18+
"serviceName": "apigee.googleapis.com",
19+
"methodName": "google.cloud.apigee.v1.RuntimeService.ReportInstanceStatus",
20+
"authorizationInfo": [
21+
{
22+
"resource": "organizations/project-id/instances/eval-instance",
23+
"permission": "apigee.instances.reportStatus",
24+
"granted": true,
25+
"resourceAttributes": {},
26+
"permissionType": "ADMIN_WRITE"
27+
}
28+
],
29+
"resourceName": "organizations/project-id/instances/eval-instance",
30+
"request": {
31+
"@type": "type.googleapis.com/google.cloud.apigee.v1.ReportInstanceStatusRequest",
32+
"instanceUid": "1bd146a8-523d-4f4b-bb4f-82df179d1152",
33+
"instance": "organizations/project-id/instances/eval-instance",
34+
"reportTime": "2024-12-11T18:36:57.910622476Z"
35+
},
36+
"resourceLocation": {}
37+
},
38+
"insertId": "y59wnoe38mgg",
39+
"resource": {
40+
"type": "audited_resource",
41+
"labels": {
42+
"project_id": "project-id",
43+
"method": "google.cloud.apigee.v1.RuntimeService.ReportInstanceStatus",
44+
"service": "apigee.googleapis.com"
45+
}
46+
},
47+
"timestamp": "2024-12-11T18:36:58.766977706Z",
48+
"severity": "NOTICE",
49+
"logName": "projects/project-id/logs/cloudaudit.googleapis.com%2Factivity",
50+
"receiveTimestamp": "2024-12-11T18:36:58.766977706Z"
51+
}
52+
]

‎Solutions/Google Apigee/Data Connectors/Apigee_GCP_CCP/ApigeeXV2_Config.json‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"name": "GCPApigeeXV2CCP",
3+
"apiVersion": "2022-12-01-preview",
4+
"type": "Microsoft.SecurityInsights/dataConnectors",
5+
"location": "{{location}}",
6+
"kind": "GCP",
7+
"properties": {
8+
"connectorDefinitionName": "GoogleApigeeCCPDefinition",
9+
"dcrConfig": {
10+
"streamName": "Custom-ApigeeXV2_CL",
11+
"dataCollectionEndpoint": "{{dataCollectionEndpointResourceID}}",
12+
"dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}"
13+
},
14+
"dataType": "ApigeeXV2_CL",
15+
"auth": {
16+
"serviceAccountEmail": "{{GCPServiceAccountEmail}}",
17+
"projectNumber": "{{GCPProjectNumber}}",
18+
"workloadIdentityProviderId": "{{GCPWorkloadIdentityProviderId}}"
19+
},
20+
"request": {
21+
"projectId": "{{GCPProjectId'}}",
22+
"subscriptionNames": [
23+
"{{GCPSubscriptionName}}"
24+
]
25+
}
26+
}
27+
}

‎Solutions/Google Apigee/Data Connectors/Apigee_GCP_CCP/ApigeeXV2_DCR.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
[
2+
{
3+
"type": "Microsoft.Insights/dataCollectionRules",
4+
"apiVersion": "2023-03-11",
5+
"name": "ApigeeXV2_CL",
6+
"location": "{{location}}",
7+
"properties": {
8+
"dataCollectionEndpointId": "{{dataCollectionEndpointResourceId}}",
9+
"streamDeclarations": {
10+
"Custom-ApigeeXV2_CL": {
11+
"columns": [
12+
{
13+
"name": "protoPayload",
14+
"type": "dynamic"
15+
},
16+
{
17+
"name": "insertId",
18+
"type": "string"
19+
},
20+
{
21+
"name": "resource",
22+
"type": "dynamic"
23+
},
24+
{
25+
"name": "timestamp",
26+
"type": "datetime"
27+
},
28+
{
29+
"name": "severity",
30+
"type": "string"
31+
},
32+
{
33+
"name": "logName",
34+
"type": "string"
35+
},
36+
{
37+
"name": "receiveTimestamp",
38+
"type": "datetime"
39+
}
40+
]
41+
}
42+
},
43+
"dataSources": {},
44+
"destinations": {
45+
"logAnalytics": [
46+
{
47+
"workspaceResourceId": "[variables('logAnalyticsWorkspaceResourceId)]",
48+
"name": "SentinelWorkspace"
49+
}
50+
]
51+
},
52+
"dataFlows": [
53+
{
54+
"streams": [
55+
"Custom-ApigeeXV2_CL"
56+
],
57+
"destinations": [
58+
"SentinelWorkspace"
59+
],
60+
"transformKql": "source\n| extend TimeGenerated = timestamp\n",
61+
"outputStream": "Custom-ApigeeXV2_CL"
62+
}
63+
]
64+
}
65+
}
66+
]

0 commit comments

Comments
 (0)