Microsoft.SecurityInsights dataConnectors 2021-03-01-preview

Article
12/09/2024

Bicep resource definition

The dataConnectors resource type can be deployed with operations that target:

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.SecurityInsights/dataConnectors resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.SecurityInsights/dataConnectors@2021-03-01-preview' = {
  etag: 'string'
  name: 'string'
  kind: 'string'
  // For remaining properties, see Microsoft.SecurityInsights/dataConnectors objects
}

Microsoft.SecurityInsights/dataConnectors objects

Set the kind property to specify the type of object.

For AmazonWebServicesCloudTrail, use:

{
  kind: 'AmazonWebServicesCloudTrail'
  properties: {
    awsRoleArn: 'string'
    dataTypes: {
      logs: {
        state: 'string'
      }
    }
  }
}

For AzureActiveDirectory, use:

{
  kind: 'AzureActiveDirectory'
  properties: {
    dataTypes: {
      alerts: {
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

For AzureAdvancedThreatProtection, use:

{
  kind: 'AzureAdvancedThreatProtection'
  properties: {
    dataTypes: {
      alerts: {
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

For AzureSecurityCenter, use:

{
  kind: 'AzureSecurityCenter'
  properties: {
    dataTypes: {
      alerts: {
        state: 'string'
      }
    }
    subscriptionId: 'string'
  }
}

For Dynamics365, use:

{
  kind: 'Dynamics365'
  properties: {
    dataTypes: {
      dynamics365CdsActivities: {
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

For GenericUI, use:

{
  kind: 'GenericUI'
  properties: {
    connectorUiConfig: {
      availability: {
        isPreview: bool
        status: '1'
      }
      connectivityCriteria: [
        {
          type: 'string'
          value: [
            'string'
          ]
        }
      ]
      customImage: 'string'
      dataTypes: [
        {
          lastDataReceivedQuery: 'string'
          name: 'string'
        }
      ]
      descriptionMarkdown: 'string'
      graphQueries: [
        {
          baseQuery: 'string'
          legend: 'string'
          metricName: 'string'
        }
      ]
      graphQueriesTableName: 'string'
      instructionSteps: [
        {
          description: 'string'
          instructions: [
            {
              parameters: any(Azure.Bicep.Types.Concrete.AnyType)
              type: 'string'
            }
          ]
          title: 'string'
        }
      ]
      permissions: {
        customs: [
          {
            description: 'string'
            name: 'string'
          }
        ]
        resourceProvider: [
          {
            permissionsDisplayText: 'string'
            provider: 'string'
            providerDisplayName: 'string'
            requiredPermissions: {
              action: bool
              delete: bool
              read: bool
              write: bool
            }
            scope: 'string'
          }
        ]
      }
      publisher: 'string'
      sampleQueries: [
        {
          description: 'string'
          query: 'string'
        }
      ]
      title: 'string'
    }
  }
}

For MicrosoftCloudAppSecurity, use:

{
  kind: 'MicrosoftCloudAppSecurity'
  properties: {
    dataTypes: {
      alerts: {
        state: 'string'
      }
      discoveryLogs: {
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

For MicrosoftDefenderAdvancedThreatProtection, use:

{
  kind: 'MicrosoftDefenderAdvancedThreatProtection'
  properties: {
    dataTypes: {
      alerts: {
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

For MicrosoftThreatIntelligence, use:

{
  kind: 'MicrosoftThreatIntelligence'
  properties: {
    dataTypes: {
      bingSafetyPhishingURL: {
        lookbackPeriod: 'string'
        state: 'string'
      }
      microsoftEmergingThreatFeed: {
        lookbackPeriod: 'string'
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

For MicrosoftThreatProtection, use:

{
  kind: 'MicrosoftThreatProtection'
  properties: {
    dataTypes: {
      incidents: {
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

For Office365, use:

{
  kind: 'Office365'
  properties: {
    dataTypes: {
      exchange: {
        state: 'string'
      }
      sharePoint: {
        state: 'string'
      }
      teams: {
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

For OfficeATP, use:

{
  kind: 'OfficeATP'
  properties: {
    dataTypes: {
      alerts: {
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

For ThreatIntelligence, use:

{
  kind: 'ThreatIntelligence'
  properties: {
    dataTypes: {
      indicators: {
        state: 'string'
      }
    }
    tenantId: 'string'
    tipLookbackPeriod: 'string'
  }
}

For ThreatIntelligenceTaxii, use:

{
  kind: 'ThreatIntelligenceTaxii'
  properties: {
    collectionId: 'string'
    dataTypes: {
      taxiiClient: {
        state: 'string'
      }
    }
    friendlyName: 'string'
    password: 'string'
    pollingFrequency: 'string'
    taxiiLookbackPeriod: 'string'
    taxiiServer: 'string'
    tenantId: 'string'
    userName: 'string'
    workspaceId: 'string'
  }
}

Property values

AADDataConnector

Name	Description	Value
kind	The data connector kind	'AzureActiveDirectory' (required)
properties	AAD (Azure Active Directory) data connector properties.	AADDataConnectorProperties

AADDataConnectorProperties

Name	Description	Value
dataTypes	The available data types for the connector.	AlertsDataTypeOfDataConnector
tenantId	The tenant id to connect to, and get the data from.	string (required)

AatpDataConnector

Name	Description	Value
kind	The data connector kind	'AzureAdvancedThreatProtection' (required)
properties	AATP (Azure Advanced Threat Protection) data connector properties.	AatpDataConnectorProperties

AatpDataConnectorProperties

Name	Description	Value
dataTypes	The available data types for the connector.	AlertsDataTypeOfDataConnector
tenantId	The tenant id to connect to, and get the data from.	string (required)

AlertsDataTypeOfDataConnector

Name	Description	Value
alerts	Alerts data type connection.	DataConnectorDataTypeCommon (required)

ASCDataConnector

Name	Description	Value
kind	The data connector kind	'AzureSecurityCenter' (required)
properties	ASC (Azure Security Center) data connector properties.	ASCDataConnectorProperties

ASCDataConnectorProperties

Name	Description	Value
dataTypes	The available data types for the connector.	AlertsDataTypeOfDataConnector
subscriptionId	The subscription id to connect to, and get the data from.	string

Availability

Name	Description	Value
isPreview	Set connector as preview	bool
status	The connector Availability Status	'1'

AwsCloudTrailDataConnector

Name	Description	Value
kind	The data connector kind	'AmazonWebServicesCloudTrail' (required)
properties	Amazon Web Services CloudTrail data connector properties.	AwsCloudTrailDataConnectorProperties

AwsCloudTrailDataConnectorDataTypes

Name	Description	Value
logs	Logs data type.	AwsCloudTrailDataConnectorDataTypesLogs (required)

AwsCloudTrailDataConnectorDataTypesLogs

Name	Description	Value
state	Describe whether this data type connection is enabled or not.	'Disabled' 'Enabled' (required)

AwsCloudTrailDataConnectorProperties

Name	Description	Value
awsRoleArn	The Aws Role Arn (with CloudTrailReadOnly policy) that is used to access the Aws account.	string
dataTypes	The available data types for the connector.	AwsCloudTrailDataConnectorDataTypes (required)

CodelessParameters

Name	Description	Value
connectorUiConfig	Config to describe the instructions blade	CodelessUiConnectorConfigProperties

CodelessUiConnectorConfigProperties

Name	Description	Value
availability	Connector Availability Status	Availability (required)
connectivityCriteria	Define the way the connector check connectivity	CodelessUiConnectorConfigPropertiesConnectivityCriteriaItem[] (required)
customImage	An optional custom image to be used when displaying the connector within Azure Sentinel's connector's gallery	string
dataTypes	Data types to check for last data received	CodelessUiConnectorConfigPropertiesDataTypesItem[] (required)
descriptionMarkdown	Connector description	string (required)
graphQueries	The graph query to show the current data status	CodelessUiConnectorConfigPropertiesGraphQueriesItem[] (required)
graphQueriesTableName	Name of the table the connector will insert the data to	string (required)
instructionSteps	Instruction steps to enable the connector	CodelessUiConnectorConfigPropertiesInstructionStepsItem[] (required)
permissions	Permissions required for the connector	Permissions (required)
publisher	Connector publisher name	string (required)
sampleQueries	The sample queries for the connector	CodelessUiConnectorConfigPropertiesSampleQueriesItem[] (required)
title	Connector blade title	string (required)

CodelessUiConnectorConfigPropertiesConnectivityCriteriaItem

Name	Description	Value
type	type of connectivity	'IsConnectedQuery'
value	Queries for checking connectivity	string[]

CodelessUiConnectorConfigPropertiesDataTypesItem

Name	Description	Value
lastDataReceivedQuery	Query for indicate last data received	string
name	Name of the data type to show in the graph. can be use with {{graphQueriesTableName}} placeholder	string

CodelessUiConnectorConfigPropertiesGraphQueriesItem

Name	Description	Value
baseQuery	The base query for the graph	string
legend	The legend for the graph	string
metricName	the metric that the query is checking	string

CodelessUiConnectorConfigPropertiesInstructionStepsItem

Name	Description	Value
description	Instruction step description	string
instructions	Instruction step details	InstructionStepsInstructionsItem[]
title	Instruction step title	string

CodelessUiConnectorConfigPropertiesSampleQueriesItem

Name	Description	Value
description	The sample query description	string
query	the sample query	string

CodelessUiDataConnector

Name	Description	Value
kind	The data connector kind	'GenericUI' (required)
properties	Codeless UI data connector properties	CodelessParameters

DataConnectorDataTypeCommon

Name	Description	Value
state	Describe whether this data type connection is enabled or not.	'Disabled' 'Enabled' (required)

Dynamics365DataConnector

Name	Description	Value
kind	The data connector kind	'Dynamics365' (required)
properties	Dynamics365 data connector properties.	Dynamics365DataConnectorProperties

Dynamics365DataConnectorDataTypes

Name	Description	Value
dynamics365CdsActivities	Common Data Service data type connection.	Dynamics365DataConnectorDataTypesDynamics365CdsActivities (required)

Dynamics365DataConnectorDataTypesDynamics365CdsActivities

Name	Description	Value
state	Describe whether this data type connection is enabled or not.	'Disabled' 'Enabled' (required)

Dynamics365DataConnectorProperties

Name	Description	Value
dataTypes	The available data types for the connector.	Dynamics365DataConnectorDataTypes (required)
tenantId	The tenant id to connect to, and get the data from.	string (required)

InstructionStepsInstructionsItem

Name	Description	Value
parameters	The parameters for the setting	any
type	The kind of the setting	'CopyableLabel' 'InfoMessage' 'InstructionStepsGroup' (required)

McasDataConnector

Name	Description	Value
kind	The data connector kind	'MicrosoftCloudAppSecurity' (required)
properties	MCAS (Microsoft Cloud App Security) data connector properties.	McasDataConnectorProperties

McasDataConnectorDataTypes

Name	Description	Value
alerts	Alerts data type connection.	DataConnectorDataTypeCommon (required)
discoveryLogs	Discovery log data type connection.	DataConnectorDataTypeCommon

McasDataConnectorProperties

Name	Description	Value
dataTypes	The available data types for the connector.	McasDataConnectorDataTypes (required)
tenantId	The tenant id to connect to, and get the data from.	string (required)

MdatpDataConnector

Name	Description	Value
kind	The data connector kind	'MicrosoftDefenderAdvancedThreatProtection' (required)
properties	MDATP (Microsoft Defender Advanced Threat Protection) data connector properties.	MdatpDataConnectorProperties

MdatpDataConnectorProperties

Name	Description	Value
dataTypes	The available data types for the connector.	AlertsDataTypeOfDataConnector
tenantId	The tenant id to connect to, and get the data from.	string (required)