Azure-Sentinel/Tools/RDAP/RDAPQuery/azuredeploy.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "functionName": {
      "defaultValue": "RDAPQuery",
      "type": "string",
      "metadata": {
        "description": "Specifies the name of the Function App."
      }
    },
    "WorkspaceID": {
      "type": "string",
      "metadata": {
        "description": "Specifies the Log Analytics Workspace Id."
      }
    },
    "SharedKey": {
      "type": "securestring",
      "metadata": {
        "description": "Specifies the Log Analytics Workspace Key."
      }
    },
    "TenantID": {
      "type": "string",
      "metadata": {
        "description": "Specifies your Azure AD Tenant ID."
      }
    },
    "clientID": {
      "type": "string",
      "metadata": {
        "description": "Specifies the client ID for the application."
      }
    },
    "clientSecret": {
      "type": "securestring",
      "metadata": {
        "description": "Specifies the shared secret used by the application."
      }
    },
    "ResourceLocation": {
      "defaultValue": "https://westus2.api.loganalytics.io",
      "type": "string",
      "metadata": {
        "description": "Specifies the root location of your log analytics instance."
      }
    },
    "LogAnalyticsCustomLogName": {
      "defaultValue": "ResolvedDomains",
      "type": "string",
      "metadata": {
        "description": "Specifies Azure Log Analytics Workspace table name to store resolved domains."
      }
    }
  },
  "variables": {
    "functionName": "[concat(toLower(parameters('functionName')), uniqueString(resourceGroup().id))]",
    "StorageAccountName": "[substring(variables('functionName'), 0, 22)]",
    "HostingPlanName": "[concat('ASP-',substring(variables('functionName'), 0, 22))]",
    "StorageSuffix": "[environment().suffixes.storage]",
    "LogAnaltyicsUri": "[replace(environment().portal, 'https://portal', concat('https://', toLower(parameters('WorkspaceId')), '.ods.opinsights'))]"
  },
  "resources": [
    {
      "type": "Microsoft.Insights/components",
      "apiVersion": "2015-05-01",
      "name": "[variables('FunctionName')]",
      "location": "[resourceGroup().location]",
      "kind": "web",
      "properties": {
        "Application_Type": "web",
        "ApplicationId": "[variables('FunctionName')]"
      }
    },
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2019-06-01",
      "name": "[variables('StorageAccountName')]",
      "location": "[resourceGroup().location]",
      "sku": {
        "name": "Standard_LRS",
        "tier": "Standard"
      },
      "kind": "StorageV2",
      "properties": {
        "networkAcls": {
          "bypass": "AzureServices",
          "virtualNetworkRules": [],
          "ipRules": [],
          "defaultAction": "Allow"
        },
        "supportsHttpsTrafficOnly": true,
        "encryption": {
          "services": {
            "file": {
              "keyType": "Account",
              "enabled": true
            },
            "blob": {
              "keyType": "Account",
              "enabled": true
            }
          },
          "keySource": "Microsoft.Storage"
        }
      }
    },
    {
      "type": "Microsoft.Storage/storageAccounts/blobServices",
      "apiVersion": "2019-06-01",
      "name": "[concat(variables('StorageAccountName'), '/default')]",
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', variables('StorageAccountName'))]"
      ],
      "sku": {
        "name": "Standard_LRS",
        "tier": "Standard"
      },
      "properties": {
        "cors": {
          "corsRules": []
        },
        "deleteRetentionPolicy": {
          "enabled": false
        }
      }
    },
    {
      "type": "Microsoft.Storage/storageAccounts/fileServices",
      "apiVersion": "2019-06-01",
      "name": "[concat(variables('StorageAccountName'), '/default')]",
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', variables('StorageAccountName'))]"
      ],
      "sku": {
        "name": "Standard_LRS",
        "tier": "Standard"
      },
      "properties": {
        "cors": {
          "corsRules": []
        }
      }
    },
    {
      "apiVersion": "2018-02-01",
      "name": "[variables('HostingPlanName')]",
      "type": "Microsoft.Web/serverfarms",
      "location": "[resourceGroup().location]",
      "tags": {},
      "dependsOn": [],
      "properties": {},
      "sku": {
        "name": "Y1",
        "tier": "Dynamic"
      }
    },
    {
      "type": "Microsoft.Web/sites",
      "apiVersion": "2021-01-15",
      "name": "[variables('functionName')]",
      "location": "[resourceGroup().location]",
      "kind": "functionapp",
      "dependsOn": [
        "[resourceId('Microsoft.Web/serverfarms', variables('HostingPlanName'))]",
        "[resourceId('Microsoft.Storage/storageAccounts', variables('StorageAccountName'))]"
      ],
      "identity": {
        "type": "SystemAssigned"
      },
      "properties": {
        "enabled": true,
        "httpsOnly": true,
        "alwaysOn": true,
        "reserved": false,
        "serverFarmId": "[concat('/subscriptions/', subscription().subscriptionId,'/resourcegroups/', resourceGroup().name, '/providers/Microsoft.Web/serverfarms/', variables('HostingPlanName'))]"
      },
      "resources": [
        {
          "apiVersion": "2018-11-01",
          "type": "config",
          "name": "appsettings",
          "dependsOn": [
            "[concat('Microsoft.Web/sites/', variables('FunctionName'))]"
          ],
          "properties": {
            "FUNCTIONS_EXTENSION_VERSION": "~3",
            "FUNCTIONS_WORKER_RUNTIME": "dotnet",
            "APPINSIGHTS_INSTRUMENTATIONKEY": "[reference(resourceId('Microsoft.insights/components', variables('FunctionName')), '2015-05-01').InstrumentationKey]",
            "APPLICATIONINSIGHTS_CONNECTION_STRING": "[reference(resourceId('microsoft.insights/components', variables('FunctionName')), '2015-05-01').ConnectionString]",
            "AzureWebJobsStorage": "[concat('DefaultEndpointsProtocol=https;AccountName=', toLower(variables('StorageAccountName')),';AccountKey=',listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('StorageAccountName')), '2019-06-01').keys[0].value, ';EndpointSuffix=',toLower(variables('StorageSuffix')))]",
            "WorkspaceID": "[parameters('WorkspaceID')]",
            "SharedKey": "[parameters('SharedKey')]",
            "LogName": "[parameters('LogAnalyticsCustomLogName')]",
            "resource": "[parameters('ResourceLocation')]",
            "client_id": "[parameters('clientID')]",
            "client_secret": "[parameters('clientSecret')]",
            "grant_type": "client_credentials",
            "tenant_id": "[parameters('tenantID')]",
            "query_string": "{\"query\": \"GetDomainsForRDAP\"}",
            "WEBSITE_RUN_FROM_PACKAGE": "https://github.com/Azure/Azure-Sentinel/blob/master/Tools/RDAP/RDAPQuery/RDAPQuery.zip?raw=true"
            
          }
        }
      ]
    }
  ]
}