Skip to content

Commit 607728d

Browse files
v-dvedakv-dvedak
authored
Merge pull request #13918 from CharlesZhaoCitrix/citrixanalyticsccf
Add Citrix Analytics CCF solution (Push connector via Codeless Connector Framework)
2 parents 3d428e6 + 4b688e2 commit 607728d

31 files changed

Lines changed: 5546 additions & 0 deletions

‎Logos/citrix_logo.svg‎

Lines changed: 41 additions & 0 deletions
Loading

‎Solutions/Citrix Analytics CCF/Data Connectors/CitrixAnalytics_CCF/CitrixAnalytics_DCR.json‎

Lines changed: 281 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,281 @@
1+
{
2+
"type": "Microsoft.Insights/dataCollectionRules",
3+
"apiVersion": "2023-03-11",
4+
"name": "CitrixAnalyticsDCR",
5+
"location": "{{location}}",
6+
"properties": {
7+
"dataCollectionEndpointId": "{{dataCollectionEndpointId}}",
8+
"streamDeclarations": {
9+
"Custom-CitrixAnalytics_SPA_Events_V1": {
10+
"columns": [
11+
{ "name": "event_type", "type": "string" },
12+
{ "name": "tenant_id", "type": "string" },
13+
{ "name": "entity_id", "type": "string" },
14+
{ "name": "entity_type", "type": "string" },
15+
{ "name": "timestamp", "type": "datetime" },
16+
{ "name": "version", "type": "int" },
17+
{ "name": "event_id", "type": "string" },
18+
{ "name": "occurrence_event_type", "type": "string" },
19+
{ "name": "product", "type": "string" },
20+
{ "name": "event_category", "type": "string" },
21+
{ "name": "event_source", "type": "string" },
22+
{ "name": "app_name", "type": "string" },
23+
{ "name": "saas_app_name", "type": "string" },
24+
{ "name": "policy_name", "type": "string" },
25+
{ "name": "rule_name", "type": "string" },
26+
{ "name": "policy_result", "type": "string" },
27+
{ "name": "event_status", "type": "string" },
28+
{ "name": "info_code", "type": "string" },
29+
{ "name": "event_description", "type": "string" },
30+
{ "name": "app_fqdn", "type": "string" },
31+
{ "name": "saas_app_launch_url", "type": "string" },
32+
{ "name": "store_url", "type": "string" },
33+
{ "name": "operation_type", "type": "string" },
34+
{ "name": "transaction_id", "type": "string" },
35+
{ "name": "app_type", "type": "string" },
36+
{ "name": "launch_type", "type": "string" },
37+
{ "name": "session_key", "type": "string" },
38+
{ "name": "session_type", "type": "string" },
39+
{ "name": "hardware_id", "type": "string" },
40+
{ "name": "mode_of_access", "type": "string" },
41+
{ "name": "client_ip", "type": "string" },
42+
{ "name": "city", "type": "string" },
43+
{ "name": "country", "type": "string" },
44+
{ "name": "device_id", "type": "string" },
45+
{ "name": "product_version", "type": "string" },
46+
{ "name": "file_size_in_bytes", "type": "real" },
47+
{ "name": "file_download_file_path", "type": "string" },
48+
{ "name": "file_download_file_format", "type": "string" },
49+
{ "name": "device_type", "type": "string" },
50+
{ "name": "job_details_filename", "type": "string" },
51+
{ "name": "os_name", "type": "string" },
52+
{ "name": "os_version", "type": "string" },
53+
{ "name": "os_extra_info", "type": "string" },
54+
{ "name": "connector_id", "type": "string" },
55+
{ "name": "resource_location_id", "type": "string" },
56+
{ "name": "browser_name", "type": "string" },
57+
{ "name": "browser_version", "type": "string" },
58+
{ "name": "clipboard_details_format_type", "type": "string" },
59+
{ "name": "clipboard_operation", "type": "string" },
60+
{ "name": "clipboard_details_format_size_in_bytes", "type": "real" },
61+
{ "name": "clipboard_details_result", "type": "string" },
62+
{ "name": "clipboard_details_initiator", "type": "string" },
63+
{ "name": "workspaceAppStatus", "type": "string" },
64+
{ "name": "scan_type", "type": "string" },
65+
{ "name": "test_mode", "type": "boolean" },
66+
{ "name": "skip_check", "type": "boolean" },
67+
{ "name": "endpoint_information", "type": "dynamic" },
68+
{ "name": "device_posture_tags", "type": "dynamic" },
69+
{ "name": "compromised_password", "type": "boolean" },
70+
{ "name": "user_name", "type": "string" },
71+
{ "name": "full_name", "type": "string" },
72+
{ "name": "identity_provider", "type": "string" },
73+
{ "name": "user_oid", "type": "string" },
74+
{ "name": "user_sid", "type": "string" },
75+
{ "name": "user_upn", "type": "string" },
76+
{ "name": "user_email", "type": "string" },
77+
{ "name": "url", "type": "string" }
78+
]
79+
},
80+
"Custom-CitrixAnalytics_indicatorSummary_V1": {
81+
"columns": [
82+
{ "name": "event_type", "type": "string" },
83+
{ "name": "indicator_type", "type": "string" },
84+
{ "name": "severity", "type": "string" },
85+
{ "name": "pre_configured", "type": "string" },
86+
{ "name": "indicator_category", "type": "string" },
87+
{ "name": "indicator_id", "type": "string" },
88+
{ "name": "indicator_name", "type": "string" },
89+
{ "name": "indicator_uuid", "type": "string" },
90+
{ "name": "data_source", "type": "string" },
91+
{ "name": "occurrence_details_condition", "type": "string" },
92+
{ "name": "occurrence_details_type", "type": "string" },
93+
{ "name": "occurrence_details_time_unit", "type": "string" },
94+
{ "name": "occurrence_details_happen", "type": "int" },
95+
{ "name": "occurrence_details_time_quantity", "type": "int" },
96+
{ "name": "occurrence_details_repeat", "type": "int" },
97+
{ "name": "occurrence_details_new_entities", "type": "string" },
98+
{ "name": "risk_probability", "type": "real" },
99+
{ "name": "tenant_id", "type": "string" },
100+
{ "name": "timestamp", "type": "datetime" },
101+
{ "name": "entity_id", "type": "string" },
102+
{ "name": "entity_type", "type": "string" },
103+
{ "name": "ui_link", "type": "string" },
104+
{ "name": "version", "type": "int" },
105+
{ "name": "data_source_id", "type": "int" },
106+
{ "name": "indicator_category_id", "type": "int" }
107+
]
108+
},
109+
"Custom-CitrixAnalytics_CVAD_Events_V1": {
110+
"columns": [
111+
{ "name": "event_type", "type": "string" },
112+
{ "name": "tenant_id", "type": "string" },
113+
{ "name": "entity_id", "type": "string" },
114+
{ "name": "entity_type", "type": "string" },
115+
{ "name": "timestamp", "type": "datetime" },
116+
{ "name": "version", "type": "int" },
117+
{ "name": "event_id", "type": "string" },
118+
{ "name": "occurrence_event_type", "type": "string" },
119+
{ "name": "product", "type": "string" },
120+
{ "name": "event_category", "type": "string" },
121+
{ "name": "event_source", "type": "string" },
122+
{ "name": "client_ip", "type": "string" },
123+
{ "name": "session_key", "type": "string" },
124+
{ "name": "city", "type": "string" },
125+
{ "name": "country", "type": "string" },
126+
{ "name": "app_name", "type": "string" },
127+
{ "name": "product_version", "type": "string" },
128+
{ "name": "device_id", "type": "string" },
129+
{ "name": "os_name", "type": "string" },
130+
{ "name": "os_version", "type": "string" },
131+
{ "name": "os_extra_info", "type": "string" },
132+
{ "name": "clipboard_details_format_type", "type": "string" },
133+
{ "name": "clipboard_operation", "type": "string" },
134+
{ "name": "clipboard_details_format_size_in_bytes", "type": "real" },
135+
{ "name": "clipboard_details_operation_direction", "type": "string" },
136+
{ "name": "clipboard_details_operation_permitted", "type": "string" },
137+
{ "name": "machine_name", "type": "string" },
138+
{ "name": "workspaceAppStatus", "type": "string" }
139+
]
140+
},
141+
"Custom-CitrixAnalytics_indicatorEventDetails_V1": {
142+
"columns": [
143+
{ "name": "event_type", "type": "string" },
144+
{ "name": "tenant_id", "type": "string" },
145+
{ "name": "entity_id", "type": "string" },
146+
{ "name": "entity_type", "type": "string" },
147+
{ "name": "indicator_id", "type": "string" },
148+
{ "name": "timestamp", "type": "datetime" },
149+
{ "name": "indicator_uuid", "type": "string" },
150+
{ "name": "version", "type": "int" },
151+
{ "name": "event_id", "type": "string" },
152+
{ "name": "occurrence_event_type", "type": "string" },
153+
{ "name": "product", "type": "string" },
154+
{ "name": "data_source_id", "type": "int" },
155+
{ "name": "indicator_category_id", "type": "int" },
156+
{ "name": "client_ip", "type": "string" },
157+
{ "name": "session_user_name", "type": "string" },
158+
{ "name": "session_key", "type": "string" },
159+
{ "name": "city", "type": "string" },
160+
{ "name": "country", "type": "string" },
161+
{ "name": "app_name", "type": "string" },
162+
{ "name": "product_version", "type": "string" },
163+
{ "name": "device_id", "type": "string" },
164+
{ "name": "launch_type", "type": "string" },
165+
{ "name": "domain", "type": "string" },
166+
{ "name": "server_name", "type": "string" },
167+
{ "name": "os_name", "type": "string" },
168+
{ "name": "os_version", "type": "string" },
169+
{ "name": "os_extra_info", "type": "string" },
170+
{ "name": "workspaceAppStatus", "type": "string" },
171+
{ "name": "device_type", "type": "string" },
172+
{ "name": "device_name", "type": "string" }
173+
]
174+
},
175+
"Custom-CitrixAnalytics_riskScoreChange_V1": {
176+
"columns": [
177+
{ "name": "entity_id", "type": "string" },
178+
{ "name": "tenant_id", "type": "string" },
179+
{ "name": "alert_value", "type": "real" },
180+
{ "name": "cur_riskscore", "type": "int" },
181+
{ "name": "alert_type", "type": "string" },
182+
{ "name": "alert_message", "type": "string" },
183+
{ "name": "event_type", "type": "string" },
184+
{ "name": "entity_type", "type": "string" },
185+
{ "name": "timestamp", "type": "datetime" },
186+
{ "name": "version", "type": "int" }
187+
]
188+
},
189+
"Custom-CitrixAnalytics_userProfile_V1": {
190+
"columns": [
191+
{ "name": "entity_id", "type": "string" },
192+
{ "name": "entity_type", "type": "string" },
193+
{ "name": "event_type", "type": "string" },
194+
{ "name": "tenant_id", "type": "string" },
195+
{ "name": "timestamp", "type": "datetime" },
196+
{ "name": "version", "type": "int" },
197+
{ "name": "client_ip", "type": "string" },
198+
{ "name": "cnt", "type": "int" },
199+
{ "name": "device", "type": "string" },
200+
{ "name": "session_domain", "type": "string" },
201+
{ "name": "user_samaccountname", "type": "string" },
202+
{ "name": "app", "type": "string" },
203+
{ "name": "cur_riskscore", "type": "int" },
204+
{ "name": "last_update_timestamp", "type": "datetime" },
205+
{ "name": "country", "type": "string" },
206+
{ "name": "city", "type": "string" }
207+
]
208+
}
209+
},
210+
"destinations": {
211+
"logAnalytics": [
212+
{
213+
"workspaceResourceId": "{{workspaceResourceId}}",
214+
"name": "clv2ws1"
215+
}
216+
]
217+
},
218+
"dataFlows": [
219+
{
220+
"streams": [
221+
"Custom-CitrixAnalytics_SPA_Events_V1"
222+
],
223+
"destinations": [
224+
"clv2ws1"
225+
],
226+
"transformKql": "source | where event_type in ('datasourceSPAEventDetails', 'datasourceDPSEventDetails') | extend TimeGenerated = todatetime(timestamp)",
227+
"outputStream": "Custom-CitrixAnalytics_SPA_Events_V1_CL"
228+
},
229+
{
230+
"streams": [
231+
"Custom-CitrixAnalytics_indicatorSummary_V1"
232+
],
233+
"destinations": [
234+
"clv2ws1"
235+
],
236+
"transformKql": "source | where event_type=='indicatorSummary' | extend TimeGenerated = todatetime(timestamp)",
237+
"outputStream": "Custom-CitrixAnalytics_indicatorSummary_V1_CL"
238+
},
239+
{
240+
"streams": [
241+
"Custom-CitrixAnalytics_CVAD_Events_V1"
242+
],
243+
"destinations": [
244+
"clv2ws1"
245+
],
246+
"transformKql": "source | where event_type=='datasourceCVADEventDetails' | extend TimeGenerated = todatetime(timestamp)",
247+
"outputStream": "Custom-CitrixAnalytics_CVAD_Events_V1_CL"
248+
},
249+
{
250+
"streams": [
251+
"Custom-CitrixAnalytics_indicatorEventDetails_V1"
252+
],
253+
"destinations": [
254+
"clv2ws1"
255+
],
256+
"transformKql": "source | where event_type=='indicatorEventDetails' | extend TimeGenerated = todatetime(timestamp)",
257+
"outputStream": "Custom-CitrixAnalytics_indicatorEventDetails_V1_CL"
258+
},
259+
{
260+
"streams": [
261+
"Custom-CitrixAnalytics_riskScoreChange_V1"
262+
],
263+
"destinations": [
264+
"clv2ws1"
265+
],
266+
"transformKql": "source | where event_type=='riskScoreChange' | extend TimeGenerated = todatetime(timestamp)",
267+
"outputStream": "Custom-CitrixAnalytics_riskScoreChange_V1_CL"
268+
},
269+
{
270+
"streams": [
271+
"Custom-CitrixAnalytics_userProfile_V1"
272+
],
273+
"destinations": [
274+
"clv2ws1"
275+
],
276+
"transformKql": "source | extend TimeGenerated = todatetime(timestamp)",
277+
"outputStream": "Custom-CitrixAnalytics_userProfile_V1_CL"
278+
}
279+
]
280+
}
281+
}

0 commit comments

Comments
 (0)