Merge pull request #123947 from jcfm/patch-1

Update slack-audit.md

Author: Jak-MS

articles/sentinel/data-connectors/slack-audit.md

@@ -49,30 +49,87 @@ To integrate with Slack Audit (using Azure Functions) make sure you have:
 
 
 > [!NOTE]
-   >  This connector uses Azure Functions to connect to the Slack REST API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details.
-
+> This connector uses Azure Functions to connect to the Slack REST API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details.
 
 >**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App.
 
-
 > [!NOTE]
-   >  This data connector depends on a parser based on a Kusto Function to work as expected. [Follow these steps](https://aka.ms/sentinel-SlackAuditAPI-parser) to create the Kusto functions alias, **SlackAudit**
-
+> This data connector depends on a parser based on a Kusto Function to work as expected. [Follow these steps](https://aka.ms/sentinel-SlackAuditAPI-parser) to create the Kusto functions alias, **SlackAudit**
 
 **STEP 1 - Configuration steps for the Slack API**
 
  [Follow the instructions](https://api.slack.com/web#authentication) to obtain the credentials. 
 
+**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**
 
+> [!IMPORTANT]
+> Before deploying the Slack Audit data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following).
 
-**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**
+Option 1 - Azure Resource Manager (ARM) Template
+
+Use this method for automated deployment of the Slack Audit data connector using an ARM Tempate.
+
+1. Select the **Deploy to Azure** button below. 
+
+   [![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-SlackAuditAPI-azuredeploy)
+
+2. Select the preferred **Subscription**, **Resource Group** and **Location**.
+   
+   > [!NOTE]
+   > Within the same resource group, you can't mix Windows and Linux apps in the same region. Select existing resource group without Windows apps in it or create new resource group.
+
+4. Enter the **SlackAPIBearerToken** and deploy. 
+5. Mark the checkbox labeled **I agree to the terms and conditions stated above**. 
+6. Select **Purchase** to deploy.
+
+Option 2 - Manual Deployment of Azure Functions
+
+Use the following step-by-step instructions to deploy the Slack Audit data connector manually with Azure Functions (Deployment via Visual Studio Code).
+
+**1. Deploy a Function App**
+
+> [!NOTE]
+> You will need to [prepare VS code](/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.
+
+1. Download the [Azure Function App](https://aka.ms/sentinel-SlackAuditAPI-functionapp) file. Extract archive to your local development computer.
+2. Start VS Code. Choose File in the main menu and select Open Folder.
+3. Select the top level folder from extracted files.
+4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.
+
+   - If you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**
+   - If you're already signed in, go to the next step.
+
+6. Provide the following information at the prompts:
+
+	a. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.
+
+	b. **Select Subscription:** Choose the subscription to use.
+
+	c. Select **Create new Function App in Azure** (Don't choose the Advanced option)
+
+	d. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. SlackAuditXXXXX).
+
+	e. **Select a runtime:** Choose Python 3.8.
 
->**IMPORTANT:** Before deploying the Slack Audit data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following).
+	f. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.
 
+7. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.
+8. Go to Azure Portal for the Function App configuration.
 
+**2. Configure the Function App**
 
+1. In the Function App, select the Function App Name and select **Configuration**.
+1. In the **Application settings** tab, select **New application setting**.
+1. Add each of the following application settings individually, with their respective string values (case-sensitive):
+   
+   - SlackAPIBearerToken
+   - WorkspaceID
+   - WorkspaceKey
+   - logAnalyticsUri (optional)
 
+   > Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://<CustomerId>.ods.opinsights.azure.us`.
 
+1. Once all application settings have been entered, click **Save**.
 
 
 ## Next steps