Azure-Sentinel/Solutions/InsightVM/Package/createUiDefinition.json

{
  "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
  "handler": "Microsoft.Azure.CreateUIDef",
  "version": "0.1.2-preview",
  "parameters": {
    "config": {
      "isWizard": false,
      "basics": {
        "description": "**Important:** _This Microsoft Sentinel Solution is currently in public preview. This feature is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/)._\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Rapid7 Insight platform](https://www.rapid7.com/products/insightvm/) brings together Rapid7’s library of vulnerability research, exploit knowledge, global attacker behavior, Internet-wide scanning data, exposure analytics, and real-time reporting to provide a fully available, scalable, and efficient way to collect your vulnerability data and turn it into answers. InsightVM leverages this platform for live vulnerability and endpoint analytics.\n\nMicrosoft Sentinel Solutions provide a consolidated way to acquire Microsoft Sentinel content like data connectors, workbooks, analytics, and automations in your workspace with a single deployment step.\n\n**Data Connectors:** 1, **Parsers:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
        "subscription": {
          "resourceProviders": [
            "Microsoft.OperationsManagement/solutions",
            "Microsoft.OperationalInsights/workspaces/providers/alertRules",
            "Microsoft.Insights/workbooks",
            "Microsoft.Logic/workflows"
          ]
        },
        "location": {
          "metadata": {
            "hidden": "Hiding location, we get it from the log analytics workspace"
          },
          "visible": false
        },
        "resourceGroup": {
          "allowExisting": true
        }
      }
    },
    "basics": [
      {
        "name": "getLAWorkspace",
        "type": "Microsoft.Solutions.ArmApiControl",
        "toolTip": "This filters by workspaces that exist in the Resource Group selected",
        "condition": "[greater(length(resourceGroup().name),0)]",
        "request": {
          "method": "GET",
          "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]"
        }
      },
      {
        "name": "workspace",
        "type": "Microsoft.Common.DropDown",
        "label": "Workspace",
        "placeholder": "Select a workspace",
        "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected",
        "constraints": {
          "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(filter.id, toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]",
          "required": true
        },
        "visible": true
      }
    ],
    "steps": [
      {
        "name": "dataconnectors",
        "label": "Data Connectors",
        "bladeTitle": "Data Connectors",
        "elements": [
          {
            "name": "dataconnectors1-text",
            "type": "Microsoft.Common.TextBlock",
            "options": {
              "text": "This Solution installs the data connector for Rapid7InsightVM. You can get Rapid7InsightVM custom log data in your Microsoft Sentinel workspace. Configure and enable this data connector in the Data Connector gallery after this Solution deploys. This data connector creates custom log table(s) NexposeInsightVMCloud_assets_CL NexposeInsightVMCloud_vulnerabilities_CL in your Microsoft Sentinel / Azure Log Analytics workspace."
            }
          },
          {
            "name": "dataconnectors-parser-text",
            "type": "Microsoft.Common.TextBlock",
            "options": {
              "text": "The Solution installs a parser that transforms the ingested data into Microsoft Sentinel normalized format. The normalized format enables better correlation of different types of data from different data sources to drive end-to-end outcomes seamlessly in security monitoring, hunting, incident investigation and response scenarios in Microsoft Sentinel."
            }
          },
          {
            "name": "dataconnectors-link1",
            "type": "Microsoft.Common.TextBlock",
            "options": {
              "link": {
                "label": "Learn more about normalized format",
                "uri": "https://docs.microsoft.com/azure/sentinel/normalization-schema"
              }
            }
          },
          {
            "name": "dataconnectors-link2",
            "type": "Microsoft.Common.TextBlock",
            "options": {
              "link": {
                "label": "Learn more about connecting data sources",
                "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources"
              }
            }
          }
        ]
      }
    ],
    "outputs": {
      "workspace-location":"[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(filter.id, toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
      "location": "[location()]",
      "workspace": "[basics('workspace')]"
    }
  }
}