128 строки
6.9 KiB
JSON
128 строки
6.9 KiB
JSON
{
|
|
"$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
|
|
"handler": "Microsoft.Azure.CreateUIDef",
|
|
"version": "0.1.2-preview",
|
|
"parameters": {
|
|
"config": {
|
|
"isWizard": false,
|
|
"basics": {
|
|
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/CyberArk_Logo.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CyberArk%20Enterprise%20Password%20Vault%20%28EPV%29%20Events/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\n[CyberArk Enterprise Password Vault](https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-CP/Latest/en/Content/CP%20for%20zOS/Installing-the-Enterprise-Password-Vault.htm?TocPath=Installation%7Cz%2FOS%20Credential%20Provider%7C_____2#:~:text=%20Enterprise%20Password%20Vault%20%201%20Install%20the,applications%20and%20create%2C%20request%2C%20access%20and...%20More%20) Solution for Microsoft Sentinel enables ingestion of Common Event Format (CEF) logs into Microsoft Sentinel. The EPV generates an xml Syslog message for every action taken against the Vault. The EPV will send the xml messages through the Sentinel.xsl translator to be converted into CEF standard format and sent to a syslog server of your choice (syslog-ng, rsyslog). The Log Analytics agent installed on your syslog staging server will import the messages into Azure Log Analytics. Refer to the [CyberArk documentation](https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/DV-Integrating-with-SIEM-Applications.htm) for more guidance on SIEM integrations.\n\n This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024.**\n\n**Data Connectors:** 2, **Workbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
|
|
"subscription": {
|
|
"resourceProviders": [
|
|
"Microsoft.OperationsManagement/solutions",
|
|
"Microsoft.OperationalInsights/workspaces/providers/alertRules",
|
|
"Microsoft.Insights/workbooks",
|
|
"Microsoft.Logic/workflows"
|
|
]
|
|
},
|
|
"location": {
|
|
"metadata": {
|
|
"hidden": "Hiding location, we get it from the log analytics workspace"
|
|
},
|
|
"visible": false
|
|
},
|
|
"resourceGroup": {
|
|
"allowExisting": true
|
|
}
|
|
}
|
|
},
|
|
"basics": [
|
|
{
|
|
"name": "getLAWorkspace",
|
|
"type": "Microsoft.Solutions.ArmApiControl",
|
|
"toolTip": "This filters by workspaces that exist in the Resource Group selected",
|
|
"condition": "[greater(length(resourceGroup().name),0)]",
|
|
"request": {
|
|
"method": "GET",
|
|
"path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]"
|
|
}
|
|
},
|
|
{
|
|
"name": "workspace",
|
|
"type": "Microsoft.Common.DropDown",
|
|
"label": "Workspace",
|
|
"placeholder": "Select a workspace",
|
|
"toolTip": "This dropdown will list only workspace that exists in the Resource Group selected",
|
|
"constraints": {
|
|
"allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]",
|
|
"required": true
|
|
},
|
|
"visible": true
|
|
}
|
|
],
|
|
"steps": [
|
|
{
|
|
"name": "dataconnectors",
|
|
"label": "Data Connectors",
|
|
"bladeTitle": "Data Connectors",
|
|
"elements": [
|
|
{
|
|
"name": "dataconnectors1-text",
|
|
"type": "Microsoft.Common.TextBlock",
|
|
"options": {
|
|
"text": "This solution installs the data connector for ingesting CyberArk Privilege Access Manager (PAM) Events in the CEF format into Microsoft Sentinel. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
|
|
}
|
|
},
|
|
{
|
|
"name": "dataconnectors-link2",
|
|
"type": "Microsoft.Common.TextBlock",
|
|
"options": {
|
|
"link": {
|
|
"label": "Learn more about connecting data sources",
|
|
"uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "workbooks",
|
|
"label": "Workbooks",
|
|
"subLabel": {
|
|
"preValidation": "Configure the workbooks",
|
|
"postValidation": "Done"
|
|
},
|
|
"bladeTitle": "Workbooks",
|
|
"elements": [
|
|
{
|
|
"name": "workbooks-text",
|
|
"type": "Microsoft.Common.TextBlock",
|
|
"options": {
|
|
"text": "This solution installs workbook(s) to help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view."
|
|
}
|
|
},
|
|
{
|
|
"name": "workbooks-link",
|
|
"type": "Microsoft.Common.TextBlock",
|
|
"options": {
|
|
"link": {
|
|
"label": "Learn more",
|
|
"uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"name": "workbook1",
|
|
"type": "Microsoft.Common.Section",
|
|
"label": "CyberArk EPV Events",
|
|
"elements": [
|
|
{
|
|
"name": "workbook1-text",
|
|
"type": "Microsoft.Common.TextBlock",
|
|
"options": {
|
|
"text": "The CyberArk Syslog connector allows you to easily connect all your CyberArk security solution logs with your Microsoft Sentinel, to view dashboards, create custom alerts, and improve investigation. Integration between CyberArk and Microsoft Sentinel makes use of the CEF Data Connector to properly parse and display CyberArk Syslog messages."
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"outputs": {
|
|
"workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
|
|
"location": "[location()]",
|
|
"workspace": "[basics('workspace')]"
|
|
}
|
|
}
|
|
}
|