-
Notifications
You must be signed in to change notification settings - Fork 981
/
dataCollectionRule-DefenderSQL.json
105 lines (105 loc) · 4.88 KB
/
dataCollectionRule-DefenderSQL.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"WorkspaceResourceId": {
"type": "String",
"metadata": {
"description": "Workspace Resource ID."
}
},
"WorkspaceLocation": {
"type": "String",
"metadata": {
"description": "Workspace Location."
}
},
"userGivenDcrName": {
"type": "String",
"metadata": {
"displayName": "Name of the Data Collection Rule(DCR)",
"description": "This is the name of the Data Collection Rule(DCR) for Defender for SQL."
},
"defaultValue": "dcr-defendersql-prod"
},
"enableCollectionOfSqlQueriesForSecurityResearch": {
"type": "Bool",
"metadata": {
"displayName": "Enable collection of SQL queries for security research",
"description": "Enable collection of SQL queries for security research"
},
"defaultValue": false
}
},
"variables": {},
"resources": [
{
"type": "Microsoft.Resources/deployments",
"apiVersion": "2021-04-01",
"name": "[parameters('userGivenDcrName')]",
"properties": {
"mode": "Incremental",
"template": {
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {},
"resources": [
{
"type": "Microsoft.Insights/dataCollectionRules",
"apiVersion": "2021-04-01",
"name": "[parameters('userGivenDcrName')]",
"location": "[parameters('WorkspaceLocation')]",
"properties": {
"description": "Data collection rule for Defender for SQL.",
"dataSources": {
"extensions": [
{
"extensionName": "MicrosoftDefenderForSQL",
"name": "MicrosoftDefenderForSQL",
"streams": [
"Microsoft-DefenderForSqlAlerts",
"Microsoft-DefenderForSqlLogins",
"Microsoft-DefenderForSqlTelemetry",
"Microsoft-DefenderForSqlScanEvents",
"Microsoft-DefenderForSqlScanResults"
],
"extensionSettings": {
"enableCollectionOfSqlQueriesForSecurityResearch": "[parameters('enableCollectionOfSqlQueriesForSecurityResearch')]"
}
}
]
},
"destinations": {
"logAnalytics": [
{
"workspaceResourceId": "[parameters('WorkspaceResourceId')]",
"name": "LogAnalyticsDest"
}
]
},
"dataFlows": [
{
"streams": [
"Microsoft-DefenderForSqlAlerts",
"Microsoft-DefenderForSqlLogins",
"Microsoft-DefenderForSqlTelemetry",
"Microsoft-DefenderForSqlScanEvents",
"Microsoft-DefenderForSqlScanResults"
],
"destinations": [
"LogAnalyticsDest"
]
}
]
}
}
]
}
},
"subscriptionId": "[split(parameters('WorkspaceResourceId'),'/')[2]]",
"resourceGroup": "[split(parameters('WorkspaceResourceId'),'/')[4]]"
}
],
"outputs": {}
}