createUiDefinition.json

{
  "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
  "handler": "Microsoft.Azure.CreateUIDef",
  "version": "0.1.2-preview",
  "parameters": {
    "config": {
      "isWizard": false,
      "basics": {
        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/onapsis_logo.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Onapsis%20Defend/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nEmpower security teams with deep visibility into unique exploit, zero-day, and threat actor activity; suspicious user or insider behavior; sensitive data downloads; security control violations; and more - all enriched by the SAP experts at Onapsis.\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
        "subscription": {
          "resourceProviders": [
            "Microsoft.OperationsManagement/solutions",
            "Microsoft.OperationalInsights/workspaces/providers/alertRules",
            "Microsoft.Insights/workbooks",
            "Microsoft.Logic/workflows"
          ]
        },
        "location": {
          "metadata": {
            "hidden": "Hiding location, we get it from the log analytics workspace"
          },
          "visible": false
        },
        "resourceGroup": {
          "allowExisting": true
        }
      }
    },
    "basics": [
      {
        "name": "getLAWorkspace",
        "type": "Microsoft.Solutions.ArmApiControl",
        "toolTip": "This filters by workspaces that exist in the Resource Group selected",
        "condition": "[greater(length(resourceGroup().name),0)]",
        "request": {
          "method": "GET",
          "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]"
        }
      },
      {
        "name": "workspace",
        "type": "Microsoft.Common.DropDown",
        "label": "Workspace",
        "placeholder": "Select a workspace",
        "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected",
        "constraints": {
          "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]",
          "required": true
        },
        "visible": true
      }
    ],
    "steps": [
      {
        "name": "dataconnectors",
        "label": "Data Connectors",
        "bladeTitle": "Data Connectors",
        "elements": [
          {
            "name": "dataconnectors1-text",
            "type": "Microsoft.Common.TextBlock",
            "options": {
              "text": "This Solution installs the data connector for Onapsis Defend. You can get Onapsis Defend data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
            }
          },
          {
            "name": "dataconnectors-link1",
            "type": "Microsoft.Common.TextBlock",
            "options": {
              "link": {
                "label": "Learn more about connecting data sources",
                "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources"
              }
            }
          }
        ]
      }
    ],
    "outputs": {
      "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
      "location": "[location()]",
      "workspace": "[basics('workspace')]"
    }
  }
}