Skip to content

Commit b689aa0

Browse files
authored
Merge pull request Azure#12810 from camilo86/camilo/entra-assets
Entra ID Assets
2 parents 838f96b + 9d9c37c commit b689aa0

File tree

9 files changed

+531
-0
lines changed

9 files changed

+531
-0
lines changed

Logos/AADCloudSync.svg

Lines changed: 1 addition & 0 deletions
Loading
Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"id": "EntraIDAssets",
3+
"title": "Microsoft Enta ID Assets",
4+
"publisher": "Microsoft",
5+
"logo": "AADCloudSync.svg",
6+
"descriptionMarkdown": "Entra ID assets data connector gives richer insights into activity data by supplementing details with asset information. Data from this connector is used to build data risk graphs in Purview. If you have enabled those graphs, deactivating this Connector will prevent the graphs from being built. [Learn about the data risk graph.](https://go.microsoft.com/fwlink/?linkid=2320023)",
7+
"graphQueries": [],
8+
"sampleQueries": [],
9+
"dataTypes": [],
10+
"connectivityCriterias": [
11+
{
12+
"type": "EntraIDAssets"
13+
}
14+
],
15+
"permissions": {
16+
"tenant": [
17+
"GlobalAdmin",
18+
"SecurityAdmin"
19+
]
20+
},
21+
"availability": {
22+
"status": 2
23+
},
24+
"instructionSteps": [
25+
{
26+
"instructions": [
27+
{
28+
"parameters": {
29+
"type": "EntraIDAssets",
30+
"description": "1. Connect Microsoft Entra ID assets to ingest into Sentinel Lake.",
31+
"items": [
32+
{
33+
"label": "Applications"
34+
},
35+
{
36+
"label": "Group Memberships"
37+
},
38+
{
39+
"label": "Groups"
40+
},
41+
{
42+
"label": "Members"
43+
},
44+
{
45+
"label": "Organizations"
46+
},
47+
{
48+
"label": "Service Principals"
49+
},
50+
{
51+
"label": "Users"
52+
}
53+
]
54+
},
55+
"type": "MSG"
56+
}
57+
]
58+
}
59+
]
60+
}
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"Name": "Microsoft Entra ID Assets",
3+
"Author": "Microsoft",
4+
"Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Logos/AADCloudSync.svg\" width=\"75px\" height=\"75px\">",
5+
"Description": "Entra ID assets data connector gives richer insights into activity data by supplementing details with asset information. Data from this connector is used to build data risk graphs in Purview. If you have enabled those graphs, deactivating this Connector will prevent the graphs from being built. [Learn about the data risk graph.](https://go.microsoft.com/fwlink/?linkid=2320023)",
6+
"Data Connectors": [
7+
"Data Connectors/EntraIDAssets_DataConnectorDefinition.json"
8+
],
9+
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Microsoft Entra ID Assets",
10+
"Version": "3.0.0",
11+
"Metadata": "SolutionMetadata.json",
12+
"TemplateSpec": true
13+
}
4.4 KB
Binary file not shown.
Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
3+
"handler": "Microsoft.Azure.CreateUIDef",
4+
"version": "0.1.2-preview",
5+
"parameters": {
6+
"config": {
7+
"isWizard": false,
8+
"basics": {
9+
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Logos/AADCloudSync.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Microsoft%20Entra%20ID%20Assets/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nEntra ID assets data connector gives richer insights into activity data by supplementing details with asset information. Data from this connector is used to build data risk graphs in Purview. If you have enabled those graphs, deactivating this Connector will prevent the graphs from being built. [Learn about the data risk graph.](https://go.microsoft.com/fwlink/?linkid=2320023)\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
10+
"subscription": {
11+
"resourceProviders": [
12+
"Microsoft.OperationsManagement/solutions",
13+
"Microsoft.OperationalInsights/workspaces/providers/alertRules",
14+
"Microsoft.Insights/workbooks",
15+
"Microsoft.Logic/workflows"
16+
]
17+
},
18+
"location": {
19+
"metadata": {
20+
"hidden": "Hiding location, we get it from the log analytics workspace"
21+
},
22+
"visible": false
23+
},
24+
"resourceGroup": {
25+
"allowExisting": true
26+
}
27+
}
28+
},
29+
"basics": [
30+
{
31+
"name": "getLAWorkspace",
32+
"type": "Microsoft.Solutions.ArmApiControl",
33+
"toolTip": "This filters by workspaces that exist in the Resource Group selected",
34+
"condition": "[greater(length(resourceGroup().name),0)]",
35+
"request": {
36+
"method": "GET",
37+
"path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]"
38+
}
39+
},
40+
{
41+
"name": "workspace",
42+
"type": "Microsoft.Common.DropDown",
43+
"label": "Workspace",
44+
"placeholder": "Select a workspace",
45+
"toolTip": "This dropdown will list only workspace that exists in the Resource Group selected",
46+
"constraints": {
47+
"allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]",
48+
"required": true
49+
},
50+
"visible": true
51+
}
52+
],
53+
"steps": [
54+
{
55+
"name": "dataconnectors",
56+
"label": "Data Connectors",
57+
"bladeTitle": "Data Connectors",
58+
"elements": [
59+
{
60+
"name": "dataconnectors1-text",
61+
"type": "Microsoft.Common.TextBlock",
62+
"options": {
63+
"text": "This Solution installs the data connector for Microsoft Entra ID Assets. You can get Microsoft Entra ID Assets custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
64+
}
65+
},
66+
{
67+
"name": "dataconnectors-link1",
68+
"type": "Microsoft.Common.TextBlock",
69+
"options": {
70+
"link": {
71+
"label": "Learn more about connecting data sources",
72+
"uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources"
73+
}
74+
}
75+
}
76+
]
77+
}
78+
],
79+
"outputs": {
80+
"workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
81+
"location": "[location()]",
82+
"workspace": "[basics('workspace')]"
83+
}
84+
}
85+
}

0 commit comments

Comments
 (0)