Versasec CMS Initial Solution Version

Solutions/VersasecCMS/Data Connectors/VersasecCMS_ccp/DCE.json

@@ -0,0 +1,11 @@
+{
+    "type": "Microsoft.Insights/dataCollectionEndpoints",
+    "apiVersion": "2022-06-01",
+    "name": "[parameters('dceName')]",
+    "location": "[parameters('location')]",
+    "properties": {
+        "networkAcls": {
+            "publicNetworkAccess": "Enabled"
+        }
+    }
+}

Solutions/VersasecCMS/Data Connectors/VersasecCMS_ccp/DCR.json

@@ -0,0 +1,53 @@
+{
+    "type": "Microsoft.Insights/dataCollectionRules",
+    "apiVersion": "2022-06-01",
+    "name": "VersasecCms-DCR",
+    "location": "[parameters('location')]",
+    "dependsOn": [
+        "[resourceId(parameters('subscription'), parameters('resourceGroupName'), 'Microsoft.Insights/dataCollectionEndpoints', parameters('dceName'))]",
+        "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), 'VersasecCmsSysLogs_CL')]",
+		"[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), 'VersasecCmsErrorLogs_CL')]",
+        "[resourceId('Microsoft.OperationsManagement/solutions', concat('SecurityInsights(', parameters('workspaceName'), ')'))]"
+    ],
+    "properties": {
+        "dataCollectionEndpointId": "[resourceId(parameters('subscription'), parameters('resourceGroupName'), 'Microsoft.Insights/dataCollectionEndpoints', parameters('dceName'))]",
+        "streamDeclarations": {
+          "Custom-VersasecCmsSysLogs_API": {
+            "columns": [
+              { "name": "rowData", "type": "dynamic" }
+            ]
+          },
+          "Custom-VersasecCmsErrorLogs_API": {
+            "columns": [
+              { "name": "rowData", "type": "dynamic" }
+            ]
+          }
+        },
+        "destinations": {
+          "logAnalytics": [
+            {
+              "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))]",
+              "name": "ws"
+            }
+          ]
+        },
+        "dataFlows": [
+          {
+            "streams": [ "Custom-VersasecCmsSysLogs_API" ],
+            "destinations": [ "ws" ],
+            "transformKql": "source | project SyslogID = toreal(rowData[0]), SyslogIDCode = tostring(rowData[1]), SyslogIDStrg = tostring(rowData[2]), TimeGenerated = todatetime(rowData[3]), ID = toreal(rowData[4]), ComputerName = tostring(rowData[5]), CLID = tostring(rowData[6]), Param1 = tostring(rowData[7]), UserID = toreal(rowData[8]), TicketRef = tostring(rowData[9])",
+            "outputStream": "[concat('Custom-', variables('syslogTableName'))]"
+          },
+          {
+            "streams": [ "Custom-VersasecCmsErrorLogs_API" ],
+            "destinations": [ "ws" ],
+            "transformKql": "source | project CmsErrorID = toreal(rowData[0]), CmsErrorIDCode = tostring(rowData[1]), CmsErrorIDStrg = tostring(rowData[2]), TimeGenerated = todatetime(rowData[3]), ID = toreal(rowData[4]), ComputerName = tostring(rowData[5]), CLID = tostring(rowData[6]), ErrorStrg = tostring(rowData[7]), UserID = toreal(rowData[8]), SupportTicket = tostring(rowData[9]), TicketRef = tostring(rowData[10])",
+            "outputStream": "[concat('Custom-', variables('errorlogTableName'))]"
+          }
+        ]
+    },
+	"variables": {
+        "syslogTableName": "VersasecCmsSysLogs_CL",
+        "errorlogTableName": "VersasecCmsErrorLogs_CL"
+    }
+}

Solutions/VersasecCMS/Data Connectors/VersasecCMS_ccp/PollerConfig.json

@@ -0,0 +1,96 @@
+[{
+        "name": "VersasecCmsPoller_syslogs_created_events",
+        "apiVersion": "2022-10-01-preview",
+        "type": "Microsoft.SecurityInsights/dataConnectors",
+        "kind": "RestApiPoller",
+        "dependsOn": [
+            "[resourceId('Microsoft.Insights/dataCollectionRules', 'VersasecCms-DCR')]"
+        ],
+        "properties": {
+            "connectorDefinitionName": "VersasecCmsCCP",
+            "dataType": "VersasecCms API",
+            "dcrConfig": {
+                "streamName": "Custom-VersasecCmsSysLogs_API",
+                "dataCollectionEndpoint": "[reference(resourceId('Microsoft.Insights/dataCollectionEndpoints', parameters('dceName')), '2022-06-01').logsIngestion.endpoint]",
+                "dataCollectionRuleImmutableId": "[reference(resourceId('Microsoft.Insights/dataCollectionRules', 'VersasecCms-DCR'), '2022-06-01').immutableId]"
+            },
+            "auth": {
+                "type": "APIKey",
+                "ApiKey": "[parameters('apiToken')]",
+                "ApiKeyName": "X-VSECCMS-AUTHTICKET"
+            },
+
+            "request": {
+                "apiEndpoint": "[concat(parameters('managementUrl'), parameters('apiBasePath'), 'QueryCmsPersistenceData')]",
+                "rateLimitQPS": 10,
+                "queryWindowInMin": "[parameters('pollingInterval')]",
+                "httpMethod": "POST",
+                "contentType": "application/json",
+                "queryTimeFormat": "yyyy-MM-ddTHH:mm:ss",
+                "headers": {
+                    "Content-Type": "application/json",
+                    "Accept": "application/json"
+                },
+                "isPostPayloadJson": true,
+                "queryParametersTemplate": "[format('{{\"tableName\": \"CvSysLog\", \"queryStatement\": \"StartOperationAnd false AddOperationGreaterEqual false TimeStamp false \\\"T{0}\\\" FinishLogicalOperation\", \"flags\": 0, \"resultPosition\": 0, \"resultAmount\": 100}}', '{_QueryWindowStartTime}')]"
+            },
+            "paging": {
+                "pagingType": "NextPageToken",
+                "NextPageTokenJsonPath": "$.pagination.nextCursor",
+                "NextPageParaName": "cursor"
+            },
+            "response": {
+                "eventsJsonPaths": [
+                    "$.rows"
+                ]
+            }
+        }
+    }, {
+        "name": "VersasecCmsPoller_errorlogs_created_events",
+        "apiVersion": "2022-10-01-preview",
+        "type": "Microsoft.SecurityInsights/dataConnectors",
+        "kind": "RestApiPoller",
+        "dependsOn": [
+            "[resourceId('Microsoft.Insights/dataCollectionRules', 'VersasecCms-DCR')]"
+        ],
+        "properties": {
+            "connectorDefinitionName": "VersasecCmsCCP",
+            "dataType": "VersasecCms API",
+            "dcrConfig": {
+                "streamName": "Custom-VersasecCmsErrorLogs_API",
+                "dataCollectionEndpoint": "[reference(resourceId('Microsoft.Insights/dataCollectionEndpoints', parameters('dceName')), '2022-06-01').logsIngestion.endpoint]",
+                "dataCollectionRuleImmutableId": "[reference(resourceId('Microsoft.Insights/dataCollectionRules', 'VersasecCms-DCR'), '2022-06-01').immutableId]"
+            },
+            "auth": {
+                "type": "APIKey",
+                "ApiKey": "[parameters('apiToken')]",
+                "ApiKeyName": "X-VSECCMS-AUTHTICKET"
+            },
+
+            "request": {
+                "apiEndpoint": "[concat(parameters('managementUrl'), parameters('apiBasePath'), 'QueryCmsPersistenceData')]",
+                "rateLimitQPS": 10,
+                "queryWindowInMin": "[parameters('pollingInterval')]",
+                "httpMethod": "POST",
+                "contentType": "application/json",
+                "queryTimeFormat": "yyyy-MM-ddTHH:mm:ss",
+                "headers": {
+                    "Content-Type": "application/json",
+                    "Accept": "application/json"
+                },
+                "isPostPayloadJson": true,
+                "queryParametersTemplate": "[format('{{\"tableName\": \"CvErrorLog\", \"queryStatement\": \"StartOperationAnd false AddOperationGreaterEqual false TimeStamp false \\\"T{0}\\\" FinishLogicalOperation\", \"flags\": 0, \"resultPosition\": 0, \"resultAmount\": 100}}', '{_QueryWindowStartTime}')]"
+            },
+            "paging": {
+                "pagingType": "NextPageToken",
+                "NextPageTokenJsonPath": "$.pagination.nextCursor",
+                "NextPageParaName": "cursor"
+            },
+            "response": {
+                "eventsJsonPaths": [
+                    "$.rows"
+                ]
+            }
+        }
+    }
+]

Solutions/VersasecCMS/Data Connectors/VersasecCMS_ccp/connectorDefinition.json

@@ -0,0 +1,103 @@
+{
+    "name": "[concat(workspaceRef(), '/Microsoft.SecurityInsights/', variables('connectorName'))]",
+    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
+    "apiVersion": "2022-09-01-preview",
+    "kind": "Customizable",
+    "properties": {
+        "connectorUiConfig": {
+            "id": "VersasecCmsCCP",
+            "title": "VersasecCms",
+            "publisher": "Versasec AB",
+            "descriptionMarkdown": "The VersasecCms data connector allows ingesting logs into Microsoft Sentinel.",
+            "graphQueries": [{
+                    "metricName": "Total System Logs",
+                    "legend": "Versasec Cms SysLog",
+                    "baseQuery": "VersasecCmsSysLogs_CL"
+                }, {
+                    "metricName": "Total Error Logs",
+                    "legend": "Versasec Cms ErrorLog",
+                    "baseQuery": "VersasecCmsErrorLogs_CL"
+                }
+            ],
+            "sampleQueries": [{
+                    "description": "View last 50 System Logs",
+                    "query": "VersasecCmsSysLogs_CL | take 50"
+                }, {
+                    "description": "View last 50 Error Logs",
+                    "query": "VersasecCmsErrorLogs_CL | take 50"
+                }
+            ],
+            "dataTypes": [{
+                    "name": "VersasecCmsSysLogs_CL",
+                    "lastDataReceivedQuery": "VersasecCmsSysLogs_CL | summarize Time = max(TimeGenerated)"
+                }, {
+                    "name": "VersasecCmsErrorLogs_CL",
+                    "lastDataReceivedQuery": "VersasecCmsErrorLogs_CL | summarize Time = max(TimeGenerated)"
+                }
+            ],
+            "connectivityCriteria": [{
+                    "type": "IsConnectedQuery",
+                    "value": [
+                        "VersasecCmsSysLogs_CL | summarize count() by TimeGenerated"
+                    ]
+                }
+            ],
+            "permissions": {
+                "resourceProvider": [{
+                        "provider": "Microsoft.OperationalInsights/workspaces",
+                        "permissionsDisplayText": "Read and Write permissions are required.",
+                        "providerDisplayName": "Workspace",
+                        "scope": "Workspace",
+                        "requiredPermissions": {
+                            "read": true,
+                            "write": true,
+                            "delete": true
+                        }
+                    }
+                ]
+            },
+            "instructionSteps": [{
+                    "title": "Configuration",
+                    "description": "Enter credentials for VersasecCms.",
+                    "instructions": [{
+                            "parameters": {
+                                "label": "Management URL",
+                                "type": "text",
+                                "name": "managementUrl"
+                            },
+                            "type": "Textbox"
+                        }, {
+                            "parameters": {
+                                "label": "API Base Path",
+                                "type": "text",
+                                "name": "apiBasePath"
+                            },
+                            "type": "Textbox"
+                        }, {
+                            "parameters": {
+                                "label": "API Token",
+                                "type": "securestring",
+                                "name": "apiToken"
+                            },
+                            "type": "Textbox"
+                        }, {
+                            "parameters": {
+                                "label": "Polling Interval (Minutes)",
+                                "type": "int",
+                                "name": "pollingInterval",
+                                "defaultValue": 5
+                            },
+                            "type": "Textbox"
+                        }, {
+                            "parameters": {
+                                "label": "connect",
+                                "name": "connectButton"
+                            },
+                            "type": "ConnectionToggleButton"
+                        }
+                    ]
+                }
+            ]
+        }
+    }
+}

Solutions/VersasecCMS/Data Connectors/VersasecCMS_ccp/table - ErrorLogs.json

@@ -0,0 +1,46 @@
+{
+	"name": "VersasecCmsErrorLogs_CL",
+    "type": "Microsoft.OperationalInsights/workspaces/tables",
+    "apiVersion": "2022-10-01",
+	"tags": {},
+    "properties": {
+        "schema": {
+            "name": "VersasecCmsErrorLogs_CL",
+            "columns": [{
+                    "name": "TimeGenerated",
+                    "type": "datetime"
+                }, {
+                    "name": "CmsErrorID",
+                    "type": "real"
+                }, {
+                    "name": "CmsErrorIDCode",
+                    "type": "string"
+                }, {
+                    "name": "CmsErrorIDStrg",
+                    "type": "string"
+                }, {
+                    "name": "ID",
+                    "type": "real"
+                }, {
+                    "name": "ComputerName",
+                    "type": "string"
+                }, {
+                    "name": "CLID",
+                    "type": "string"
+                }, {
+                    "name": "ErrorStrg",
+                    "type": "string"
+                }, {
+                    "name": "UserID",
+                    "type": "real"
+                },{
+					"name": "SupportTicket",
+                    "type": "string"
+                }, {
+                    "name": "TicketRef",
+                    "type": "string"
+                }
+            ]
+        }
+    }
+}

Solutions/VersasecCMS/Data Connectors/VersasecCMS_ccp/table - SysLogs.json

@@ -0,0 +1,43 @@
+{
+	"name": "VersasecCmsSysLogs_CL",
+    "type": "Microsoft.OperationalInsights/workspaces/tables",
+    "apiVersion": "2022-10-01",
+	"tags": {},
+    "properties": {
+        "schema": {
+            "name": "VersasecCmsSysLogs_CL",
+            "columns": [{
+                    "name": "TimeGenerated",
+                    "type": "datetime"
+                }, {
+                    "name": "SyslogID",
+                    "type": "real"
+                }, {
+                    "name": "SyslogIDCode",
+                    "type": "string"
+                }, {
+                    "name": "SyslogIDStrg",
+                    "type": "string"
+                }, {
+                    "name": "ID",
+                    "type": "real"
+                }, {
+                    "name": "ComputerName",
+                    "type": "string"
+                }, {
+                    "name": "CLID",
+                    "type": "string"
+                }, {
+                    "name": "Param1",
+                    "type": "string"
+                }, {
+                    "name": "UserID",
+                    "type": "real"
+                }, {
+                    "name": "TicketRef",
+                    "type": "string"
+                }
+            ]
+        }
+    }
+}

Solutions/VersasecCMS/Data/Solution_VersasecCMS.json

@@ -0,0 +1,18 @@
+{
+    "Name": "VersasecCMS",
+    "Author": "Versasec AB - [email protected]",
+    "Logo": "<img src=\"https://versasec.com/wp-content/uploads/2025/09/versasec-logo.png\" width=\"75px\" height=\"75px\">",
+    "Description": "Ingests Versasec Cms system logs into Microsoft Sentinel using a REST API poller (CCF).",
+    "Data Connectors": [
+        "Data Connectors/VersasecCMS_ccp/connectorDefinition.json"
+    ],
+    "Workbooks": [],
+    "Parsers": [],
+    "Analytic Rules": [],
+    "Hunting Queries": [],
+    "BasePath": "C:/Github/Azure-Sentinel/Solutions/VersasecCMS",
+    "Version": "1.0.0",
+    "Metadata": "SolutionMetadata.json",
+    "TemplateSpec": true,
+    "Is1PConnector": false
+}