124 строки
4.7 KiB
JSON
124 строки
4.7 KiB
JSON
{
|
|
"id": "Alcide_kAudit",
|
|
"title": "Alcide kAudit (Preview)",
|
|
"publisher": "Alcide",
|
|
"descriptionMarkdown": "Alcide kAudit connector allows you to automatically export your Kubernetes cluster audit logs into Azure Sentinel in real-time. This enables enhanced visibility and observability into your Kubernetes audit logs, providing robust security and monitoring capabilities for forensics purposes.",
|
|
"graphQueries": [
|
|
{
|
|
"metricName": "Anomalies and Incidents - All Data",
|
|
"legend": "alcide_kaudit_detections_1_CL",
|
|
"baseQuery": "alcide_kaudit_detections_1_CL"
|
|
}
|
|
],
|
|
"sampleQueries": [
|
|
{
|
|
"description" : "All detections (anomalies and incidents) entries",
|
|
"query": "\nalcide_kaudit_detections_1_CL\n| sort by TimeGenerated\n"
|
|
},
|
|
{
|
|
"description" : "All audit activity for a Secret resource type, summarized count by resource namespace",
|
|
"query": "\nalcide_kaudit_activity_1_CL\n| where resource_type_s == \"secrets\"\n| summarize count() by resource_namespace_s"
|
|
},
|
|
{
|
|
"description" : "Audit activity, summarized by principal, Type and Caller IP",
|
|
"query": "\nalcide_kaudit_selections_details_1_CL\n| summarize count() by principal_s, Type, caller_ip_s"
|
|
}
|
|
],
|
|
"dataTypes": [
|
|
{
|
|
"name": "alcide_kaudit_activity_1_CL",
|
|
"lastDataReceivedQuery": "alcide_kaudit_activity_1_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
|
|
},
|
|
{
|
|
"name": "alcide_kaudit_detections_1_CL",
|
|
"lastDataReceivedQuery": "alcide_kaudit_detections_1_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
|
|
},
|
|
{
|
|
"name": "alcide_kaudit_selections_count_1_CL",
|
|
"lastDataReceivedQuery": "alcide_kaudit_selections_count_1_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
|
|
},
|
|
{
|
|
"name": "alcide_kaudit_selections_details_1_CL",
|
|
"lastDataReceivedQuery": "alcide_kaudit_selections_details_1_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
|
|
}
|
|
],
|
|
"connectivityCriterias": [
|
|
{
|
|
"type": "IsConnectedQuery",
|
|
"value": [
|
|
"alcide_kaudit_activity_1_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)"
|
|
]
|
|
}
|
|
],
|
|
"availability": {
|
|
"status": 1,
|
|
"isPreview": true
|
|
},
|
|
"permissions": {
|
|
"resourceProvider": [
|
|
{
|
|
"provider": "Microsoft.OperationalInsights/workspaces",
|
|
"permissionsDisplayText": "read and write permissions are required.",
|
|
"providerDisplayName": "Workspace",
|
|
"scope": "Workspace",
|
|
"requiredPermissions": {
|
|
"write": true,
|
|
"read": true,
|
|
"delete": true
|
|
}
|
|
},
|
|
{
|
|
"provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
|
|
"permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
|
|
"providerDisplayName": "Keys",
|
|
"scope": "Workspace",
|
|
"requiredPermissions": {
|
|
"action": true
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"instructionSteps": [
|
|
{
|
|
"title": "",
|
|
"description": "Follow the step-by-step instructions provided in the [Alcide kAudit Installation Guide](https://get.alcide.io/hubfs/Azure%20Sentinel%20Integration%20with%20kAudit.pdf)",
|
|
"instructions": [
|
|
{
|
|
"parameters": {
|
|
"fillWith": [
|
|
"WorkspaceId"
|
|
],
|
|
"label": "Workspace ID"
|
|
},
|
|
"type": "CopyableLabel"
|
|
},
|
|
{
|
|
"parameters": {
|
|
"fillWith": [
|
|
"PrimaryKey"
|
|
],
|
|
"label": "Primary Key"
|
|
},
|
|
"type": "CopyableLabel"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"metadata" : {
|
|
"id": "ffaeb3c2-6c9a-4d55-8852-e13da1162ec6",
|
|
"version": "1.0.0",
|
|
"kind": "dataConnector",
|
|
"source": {
|
|
"kind": "community"
|
|
},
|
|
"author": {
|
|
"name": "Alcide"
|
|
},
|
|
"support": {
|
|
"name": "Alcide",
|
|
"link": "https://www.alcide.io/company/contact-us/",
|
|
"tier": "developer"
|
|
}
|
|
}
|
|
}
|