|
1286 | 1286 | ], |
1287 | 1287 | "entityMappings": [ |
1288 | 1288 | { |
1289 | | - "entityType": "Account", |
1290 | 1289 | "fieldMappings": [ |
1291 | 1290 | { |
1292 | 1291 | "columnName": "Name", |
|
1296 | 1295 | "columnName": "UPNSuffix", |
1297 | 1296 | "identifier": "UPNSuffix" |
1298 | 1297 | } |
1299 | | - ] |
| 1298 | + ], |
| 1299 | + "entityType": "Account" |
1300 | 1300 | } |
1301 | 1301 | ] |
1302 | 1302 | } |
|
1394 | 1394 | ], |
1395 | 1395 | "entityMappings": [ |
1396 | 1396 | { |
1397 | | - "entityType": "Account", |
1398 | 1397 | "fieldMappings": [ |
1399 | 1398 | { |
1400 | 1399 | "columnName": "AccountCustomEntity", |
1401 | 1400 | "identifier": "FullName" |
1402 | 1401 | } |
1403 | | - ] |
| 1402 | + ], |
| 1403 | + "entityType": "Account" |
1404 | 1404 | } |
1405 | 1405 | ] |
1406 | 1406 | } |
|
1498 | 1498 | ], |
1499 | 1499 | "entityMappings": [ |
1500 | 1500 | { |
1501 | | - "entityType": "Account", |
1502 | 1501 | "fieldMappings": [ |
1503 | 1502 | { |
1504 | 1503 | "columnName": "AccountCustomEntity", |
1505 | 1504 | "identifier": "FullName" |
1506 | 1505 | } |
1507 | | - ] |
| 1506 | + ], |
| 1507 | + "entityType": "Account" |
1508 | 1508 | } |
1509 | 1509 | ] |
1510 | 1510 | } |
|
1602 | 1602 | ], |
1603 | 1603 | "entityMappings": [ |
1604 | 1604 | { |
1605 | | - "entityType": "Account", |
1606 | 1605 | "fieldMappings": [ |
1607 | 1606 | { |
1608 | 1607 | "columnName": "AccountCustomEntity", |
1609 | 1608 | "identifier": "FullName" |
1610 | 1609 | } |
1611 | | - ] |
| 1610 | + ], |
| 1611 | + "entityType": "Account" |
1612 | 1612 | } |
1613 | 1613 | ] |
1614 | 1614 | } |
|
1706 | 1706 | ], |
1707 | 1707 | "entityMappings": [ |
1708 | 1708 | { |
1709 | | - "entityType": "Account", |
1710 | 1709 | "fieldMappings": [ |
1711 | 1710 | { |
1712 | 1711 | "columnName": "AccountCustomEntity", |
1713 | 1712 | "identifier": "FullName" |
1714 | 1713 | } |
1715 | | - ] |
| 1714 | + ], |
| 1715 | + "entityType": "Account" |
1716 | 1716 | } |
1717 | 1717 | ] |
1718 | 1718 | } |
|
1810 | 1810 | ], |
1811 | 1811 | "entityMappings": [ |
1812 | 1812 | { |
1813 | | - "entityType": "Account", |
1814 | 1813 | "fieldMappings": [ |
1815 | 1814 | { |
1816 | 1815 | "columnName": "AccountCustomEntity", |
1817 | 1816 | "identifier": "FullName" |
1818 | 1817 | } |
1819 | | - ] |
| 1818 | + ], |
| 1819 | + "entityType": "Account" |
1820 | 1820 | } |
1821 | 1821 | ] |
1822 | 1822 | } |
|
1914 | 1914 | ], |
1915 | 1915 | "entityMappings": [ |
1916 | 1916 | { |
1917 | | - "entityType": "Account", |
1918 | 1917 | "fieldMappings": [ |
1919 | 1918 | { |
1920 | 1919 | "columnName": "AccountCustomEntity", |
1921 | 1920 | "identifier": "FullName" |
1922 | 1921 | } |
1923 | | - ] |
| 1922 | + ], |
| 1923 | + "entityType": "Account" |
1924 | 1924 | } |
1925 | 1925 | ] |
1926 | 1926 | } |
|
2018 | 2018 | ], |
2019 | 2019 | "entityMappings": [ |
2020 | 2020 | { |
2021 | | - "entityType": "IP", |
2022 | 2021 | "fieldMappings": [ |
2023 | 2022 | { |
2024 | 2023 | "columnName": "IPCustomEntity", |
2025 | 2024 | "identifier": "Address" |
2026 | 2025 | } |
2027 | | - ] |
| 2026 | + ], |
| 2027 | + "entityType": "IP" |
2028 | 2028 | } |
2029 | 2029 | ] |
2030 | 2030 | } |
|
2136 | 2136 | ], |
2137 | 2137 | "entityMappings": [ |
2138 | 2138 | { |
2139 | | - "entityType": "Account", |
2140 | 2139 | "fieldMappings": [ |
2141 | 2140 | { |
2142 | 2141 | "columnName": "ClientEmail", |
2143 | 2142 | "identifier": "FullName" |
2144 | 2143 | } |
2145 | | - ] |
| 2144 | + ], |
| 2145 | + "entityType": "Account" |
2146 | 2146 | } |
2147 | 2147 | ] |
2148 | 2148 | } |
|
2254 | 2254 | ], |
2255 | 2255 | "entityMappings": [ |
2256 | 2256 | { |
2257 | | - "entityType": "Account", |
2258 | 2257 | "fieldMappings": [ |
2259 | 2258 | { |
2260 | 2259 | "columnName": "SrcUserUpn", |
2261 | 2260 | "identifier": "FullName" |
2262 | 2261 | } |
2263 | | - ] |
| 2262 | + ], |
| 2263 | + "entityType": "Account" |
2264 | 2264 | }, |
2265 | 2265 | { |
2266 | | - "entityType": "IP", |
2267 | 2266 | "fieldMappings": [ |
2268 | 2267 | { |
2269 | 2268 | "columnName": "ClientIP", |
2270 | 2269 | "identifier": "Address" |
2271 | 2270 | } |
2272 | | - ] |
| 2271 | + ], |
| 2272 | + "entityType": "IP" |
2273 | 2273 | } |
2274 | 2274 | ] |
2275 | 2275 | } |
|
2336 | 2336 | "resources": [ |
2337 | 2337 | { |
2338 | 2338 | "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", |
2339 | | - "apiVersion": "2025-09-01", |
| 2339 | + "apiVersion": "2022-09-01-preview", |
2340 | 2340 | "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", |
2341 | 2341 | "location": "[parameters('workspace-location')]", |
2342 | 2342 | "kind": "Customizable", |
|
2502 | 2502 | }, |
2503 | 2503 | { |
2504 | 2504 | "name": "ProofpointPodDCR", |
2505 | | - "apiVersion": "2024-03-11", |
| 2505 | + "apiVersion": "2022-06-01", |
2506 | 2506 | "type": "Microsoft.Insights/dataCollectionRules", |
2507 | 2507 | "location": "[parameters('workspace-location')]", |
2508 | 2508 | "kind": "[variables('blanks')]", |
|
2624 | 2624 | }, |
2625 | 2625 | { |
2626 | 2626 | "name": "ProofpointPODMailLog_CL", |
2627 | | - "apiVersion": "2025-07-01", |
| 2627 | + "apiVersion": "2022-10-01", |
2628 | 2628 | "type": "Microsoft.OperationalInsights/workspaces/tables", |
2629 | 2629 | "location": "[parameters('workspace-location')]", |
2630 | 2630 | "kind": null, |
|
2670 | 2670 | }, |
2671 | 2671 | { |
2672 | 2672 | "name": "ProofpointPODMessage_CL", |
2673 | | - "apiVersion": "2025-07-01", |
| 2673 | + "apiVersion": "2022-10-01", |
2674 | 2674 | "type": "Microsoft.OperationalInsights/workspaces/tables", |
2675 | 2675 | "location": "[parameters('workspace-location')]", |
2676 | 2676 | "kind": null, |
|
2735 | 2735 | }, |
2736 | 2736 | { |
2737 | 2737 | "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", |
2738 | | - "apiVersion": "2025-09-01", |
| 2738 | + "apiVersion": "2022-09-01-preview", |
2739 | 2739 | "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", |
2740 | 2740 | "location": "[parameters('workspace-location')]", |
2741 | 2741 | "kind": "Customizable", |
|
2982 | 2982 | }, |
2983 | 2983 | { |
2984 | 2984 | "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'ProofpointPodMessageConnection', parameters('guidValue'))]", |
2985 | | - "apiVersion": "2025-09-01", |
| 2985 | + "apiVersion": "2023-02-01-preview", |
2986 | 2986 | "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", |
2987 | 2987 | "location": "[parameters('workspace-location')]", |
2988 | 2988 | "kind": "WebSocket", |
|
2996 | 2996 | "apiKeyIdentifier": "Bearer" |
2997 | 2997 | }, |
2998 | 2998 | "request": { |
| 2999 | + "httpMethod": "Get", |
2999 | 3000 | "apiEndpoint": "wss://logstream.proofpoint.com:443/v1/stream", |
3000 | 3001 | "queryParameters": { |
3001 | 3002 | "cid": "[[parameters('clusterId')]", |
|
3020 | 3021 | }, |
3021 | 3022 | { |
3022 | 3023 | "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'ProofpointPodMailLogConnection', parameters('guidValue'))]", |
3023 | | - "apiVersion": "2025-09-01", |
| 3024 | + "apiVersion": "2023-02-01-preview", |
3024 | 3025 | "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", |
3025 | 3026 | "location": "[parameters('workspace-location')]", |
3026 | 3027 | "kind": "WebSocket", |
|
3034 | 3035 | "apiKeyIdentifier": "Bearer" |
3035 | 3036 | }, |
3036 | 3037 | "request": { |
| 3038 | + "httpMethod": "Get", |
3037 | 3039 | "apiEndpoint": "wss://logstream.proofpoint.com:443/v1/stream", |
3038 | 3040 | "queryParameters": { |
3039 | 3041 | "cid": "[[parameters('clusterId')]", |
|
0 commit comments