diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json index 6c45cd43f63..7279e63c95c 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json @@ -205,12 +205,12 @@ }, { "title": "3. Veeam API Configuration", - "description": "Configure Veeam API credentials for all Veeam services (Malware Events, Security Analyzer, and Authorization Events).", + "description": "Configure Veeam Backup & Replication credentials for all VBR services (Malware Events, Security Analyzer, Authorization Events and Sessions). Sentinel authenticates via OAuth2 password grant and renews the token automatically.", "instructions": [ { "type": "Markdown", "parameters": { - "content": "#### 3.1 Obtain Veeam API Access Token\n1. Access your Veeam Backup & Replication management console\n2. Navigate to the REST API settings or authentication section\n3. Generate or obtain a Bearer token for API access\n4. Ensure the token has appropriate permissions for:\n - Malware Detection API (v1.3-rev1)\n - Security & Compliance Analyzer API (v1.3-rev1)\n - Authorization Events API (v1.3-rev1)\n - Sessions API (v1.3-rev1)\n5. Note the API base URL (typically https://your-veeam-server.com:9419)\n6. This token will be used for both on-premises and CDN-hosted APIs" + "content": "#### 3.1 Configure Veeam Backup & Replication credentials\n1. Access your Veeam Backup & Replication management console.\n2. Use (or create) a user account that has REST API access with permissions for the Malware Detection, Security & Compliance Analyzer, Authorization Events and Sessions APIs (v1.3-rev1).\n3. Note the API base URL (typically https://your-veeam-server.com:9419).\n4. Microsoft Sentinel signs in with these credentials against `/api/oauth2/token` (OAuth2 password grant) and automatically refreshes the access token, so collection no longer stops when the token expires.\n5. Client ID / Client Secret are optional - leave them blank unless your Veeam server is configured to require a registered OAuth2 client." } }, { @@ -228,25 +228,61 @@ { "type": "Textbox", "parameters": { - "label": "Veeam Bearer Token", - "placeholder": "Your Veeam API Bearer Token", + "label": "Veeam Username", + "placeholder": "DOMAIN\\username", + "type": "text", + "name": "veeamUsername", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam Password", + "placeholder": "Your Veeam account password", "type": "password", - "name": "veeamBearerToken", + "name": "veeamPassword", "validations": { "required": true } } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam Client ID (optional)", + "placeholder": "Leave blank unless your server requires an OAuth2 client", + "type": "text", + "name": "veeamClientId", + "validations": { + "required": false + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam Client Secret (optional)", + "placeholder": "Leave blank unless your server requires an OAuth2 client", + "type": "password", + "name": "veeamClientSecret", + "validations": { + "required": false + } + } } ] }, { "title": "4. Veeam ONE API Configuration", - "description": "Configure Veeam ONE API credentials for triggered alarms data collection.", + "description": "Configure Veeam ONE credentials for triggered alarms data collection. Sentinel authenticates via OAuth2 password grant and renews the token automatically.", "instructions": [ { "type": "Markdown", "parameters": { - "content": "#### 4.1 Obtain Veeam ONE API Access Key\n1. Access your Veeam ONE management console\n2. Navigate to Administration -> Users and Roles\n3. Create or use an existing user with API access permissions\n4. Generate or obtain a Bearer token for API access\n5. Note the Veeam ONE server URL and port (typically https://your-veeam-one-server:1239)" + "content": "#### 4.1 Configure Veeam ONE credentials\n1. Access your Veeam ONE management console.\n2. Navigate to Administration -> Users and Roles and use (or create) a user with REST API access permissions.\n3. Note the Veeam ONE server URL and port (typically https://your-veeam-one-server:1239).\n4. Microsoft Sentinel signs in with these credentials against `/api/token` (OAuth2 password grant) and automatically refreshes the access token.\n5. Client ID / Client Secret are optional - leave them blank unless your Veeam ONE server requires a registered OAuth2 client." } }, { @@ -264,14 +300,50 @@ { "type": "Textbox", "parameters": { - "label": "Veeam ONE API Bearer Token", - "placeholder": "Your Veeam ONE API Bearer Token", + "label": "Veeam ONE Username", + "placeholder": "DOMAIN\\username", + "type": "text", + "name": "veeamOneUsername", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam ONE Password", + "placeholder": "Your Veeam ONE account password", "type": "password", - "name": "veeamOneBearerToken", + "name": "veeamOnePassword", "validations": { "required": true } } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam ONE Client ID (optional)", + "placeholder": "Leave blank unless your server requires an OAuth2 client", + "type": "text", + "name": "veeamOneClientId", + "validations": { + "required": false + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam ONE Client Secret (optional)", + "placeholder": "Leave blank unless your server requires an OAuth2 client", + "type": "password", + "name": "veeamOneClientSecret", + "validations": { + "required": false + } + } } ] }, @@ -292,4 +364,4 @@ ] } } -} \ No newline at end of file +} diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json index e52019664da..e672f61ea68 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json @@ -7,10 +7,16 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]", - "ApiKeyName": "Authorization", - "ApiKeyIdentifier": "Bearer" + "type": "OAuth2", + "GrantType": "password", + "TokenEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/oauth2/token')]", + "TokenEndpointHeaders": { + "x-api-version": "1.3-rev1" + }, + "ClientId": "[[parameters('veeamClientId')]", + "ClientSecret": "[[parameters('veeamClientSecret')]", + "UserName": "[[parameters('veeamUsername')]", + "Password": "[[parameters('veeamPassword')]" }, "request": { "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/malwareDetection/events')]", @@ -111,10 +117,13 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "APIKey", - "ApiKey": "[[parameters('veeamOneBearerToken')]", - "ApiKeyName": "Authorization", - "ApiKeyIdentifier": "Bearer" + "type": "OAuth2", + "GrantType": "password", + "TokenEndpoint": "[[concat(parameters('veeamOneApiUrl'),'/api/token')]", + "ClientId": "[[parameters('veeamOneClientId')]", + "ClientSecret": "[[parameters('veeamOneClientSecret')]", + "UserName": "[[parameters('veeamOneUsername')]", + "Password": "[[parameters('veeamOnePassword')]" }, "request": { "apiEndpoint": "[[concat(parameters('veeamOneApiUrl'),'/api/v2.3/alarms/triggeredAlarms')]", @@ -157,10 +166,16 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]", - "ApiKeyName": "Authorization", - "ApiKeyIdentifier": "Bearer" + "type": "OAuth2", + "GrantType": "password", + "TokenEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/oauth2/token')]", + "TokenEndpointHeaders": { + "x-api-version": "1.3-rev1" + }, + "ClientId": "[[parameters('veeamClientId')]", + "ClientSecret": "[[parameters('veeamClientSecret')]", + "UserName": "[[parameters('veeamUsername')]", + "Password": "[[parameters('veeamPassword')]" }, "request": { "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/securityAnalyzer/bestPractices')]", @@ -198,10 +213,16 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]", - "ApiKeyName": "Authorization", - "ApiKeyIdentifier": "Bearer" + "type": "OAuth2", + "GrantType": "password", + "TokenEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/oauth2/token')]", + "TokenEndpointHeaders": { + "x-api-version": "1.3-rev1" + }, + "ClientId": "[[parameters('veeamClientId')]", + "ClientSecret": "[[parameters('veeamClientSecret')]", + "UserName": "[[parameters('veeamUsername')]", + "Password": "[[parameters('veeamPassword')]" }, "request": { "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/authorization/events')]", @@ -252,10 +273,16 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]", - "ApiKeyName": "Authorization", - "ApiKeyIdentifier": "Bearer" + "type": "OAuth2", + "GrantType": "password", + "TokenEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/oauth2/token')]", + "TokenEndpointHeaders": { + "x-api-version": "1.3-rev1" + }, + "ClientId": "[[parameters('veeamClientId')]", + "ClientSecret": "[[parameters('veeamClientSecret')]", + "UserName": "[[parameters('veeamUsername')]", + "Password": "[[parameters('veeamPassword')]" }, "request": { "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/sessions')]", diff --git a/Solutions/Veeam/Data/Solution_Veeam.json b/Solutions/Veeam/Data/Solution_Veeam.json index 1a5354e590d..f1f924654c6 100644 --- a/Solutions/Veeam/Data/Solution_Veeam.json +++ b/Solutions/Veeam/Data/Solution_Veeam.json @@ -193,9 +193,9 @@ "WatchlistDescription": [], "dependentDomainSolutionIds": [], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Veeam", - "Version": "3.1.0", + "Version": "3.2.0", "DataConnectorCCFVersion": "3.1.0", "Metadata": "SolutionMetadata.json", "TemplateSpec": false, "Is1Pconnector": false -} \ No newline at end of file +} diff --git a/Solutions/Veeam/Package/3.2.0.zip b/Solutions/Veeam/Package/3.2.0.zip new file mode 100644 index 00000000000..8ff48295485 Binary files /dev/null and b/Solutions/Veeam/Package/3.2.0.zip differ diff --git a/Solutions/Veeam/Package/mainTemplate.json b/Solutions/Veeam/Package/mainTemplate.json index 35c120d56ca..8edc9134417 100644 --- a/Solutions/Veeam/Package/mainTemplate.json +++ b/Solutions/Veeam/Package/mainTemplate.json @@ -151,7 +151,7 @@ "email": "microsoftappsupport@veeam.com", "_email": "[variables('email')]", "_solutionName": "Veeam", - "_solutionVersion": "3.1.0", + "_solutionVersion": "3.2.0", "solutionId": "veeamsoftware.azure-sentinel-solution-veeamapp", "_solutionId": "[variables('solutionId')]", "TemplateEmptyArray": "[json('[]')]", @@ -1332,7 +1332,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam data connector with template version 3.1.0", + "description": "Veeam data connector with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -1933,12 +1933,12 @@ }, { "title": "3. Veeam API Configuration", - "description": "Configure Veeam API credentials for all Veeam services (Malware Events, Security Analyzer, and Authorization Events).", + "description": "Configure Veeam Backup & Replication credentials for all VBR services (Malware Events, Security Analyzer, Authorization Events and Sessions). Sentinel authenticates via OAuth2 password grant and renews the token automatically.", "instructions": [ { "type": "Markdown", "parameters": { - "content": "#### 3.1 Obtain Veeam API Access Token\n1. Access your Veeam Backup & Replication management console\n2. Navigate to the REST API settings or authentication section\n3. Generate or obtain a Bearer token for API access\n4. Ensure the token has appropriate permissions for:\n - Malware Detection API (v1.3-rev1)\n - Security & Compliance Analyzer API (v1.3-rev1)\n - Authorization Events API (v1.3-rev1)\n - Sessions API (v1.3-rev1)\n5. Note the API base URL (typically https://your-veeam-server.com:9419)\n6. This token will be used for both on-premises and CDN-hosted APIs" + "content": "#### 3.1 Configure Veeam Backup & Replication credentials\n1. Access your Veeam Backup & Replication management console.\n2. Use (or create) a user account that has REST API access with permissions for the Malware Detection, Security & Compliance Analyzer, Authorization Events and Sessions APIs (v1.3-rev1).\n3. Note the API base URL (typically https://your-veeam-server.com:9419).\n4. Microsoft Sentinel signs in with these credentials against `/api/oauth2/token` (OAuth2 password grant) and automatically refreshes the access token, so collection no longer stops when the token expires.\n5. Client ID / Client Secret are optional - leave them blank unless your Veeam server is configured to require a registered OAuth2 client." } }, { @@ -1956,25 +1956,61 @@ { "type": "Textbox", "parameters": { - "label": "Veeam Bearer Token", - "placeholder": "Your Veeam API Bearer Token", + "label": "Veeam Username", + "placeholder": "DOMAIN\\username", + "type": "text", + "name": "veeamUsername", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam Password", + "placeholder": "Your Veeam account password", "type": "password", - "name": "veeamBearerToken", + "name": "veeamPassword", "validations": { "required": true } } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam Client ID (optional)", + "placeholder": "Leave blank unless your server requires an OAuth2 client", + "type": "text", + "name": "veeamClientId", + "validations": { + "required": false + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam Client Secret (optional)", + "placeholder": "Leave blank unless your server requires an OAuth2 client", + "type": "password", + "name": "veeamClientSecret", + "validations": { + "required": false + } + } } ] }, { "title": "4. Veeam ONE API Configuration", - "description": "Configure Veeam ONE API credentials for triggered alarms data collection.", + "description": "Configure Veeam ONE credentials for triggered alarms data collection. Sentinel authenticates via OAuth2 password grant and renews the token automatically.", "instructions": [ { "type": "Markdown", "parameters": { - "content": "#### 4.1 Obtain Veeam ONE API Access Key\n1. Access your Veeam ONE management console\n2. Navigate to Administration -> Users and Roles\n3. Create or use an existing user with API access permissions\n4. Generate or obtain a Bearer token for API access\n5. Note the Veeam ONE server URL and port (typically https://your-veeam-one-server:1239)" + "content": "#### 4.1 Configure Veeam ONE credentials\n1. Access your Veeam ONE management console.\n2. Navigate to Administration -> Users and Roles and use (or create) a user with REST API access permissions.\n3. Note the Veeam ONE server URL and port (typically https://your-veeam-one-server:1239).\n4. Microsoft Sentinel signs in with these credentials against `/api/token` (OAuth2 password grant) and automatically refreshes the access token.\n5. Client ID / Client Secret are optional - leave them blank unless your Veeam ONE server requires a registered OAuth2 client." } }, { @@ -1992,14 +2028,50 @@ { "type": "Textbox", "parameters": { - "label": "Veeam ONE API Bearer Token", - "placeholder": "Your Veeam ONE API Bearer Token", + "label": "Veeam ONE Username", + "placeholder": "DOMAIN\\username", + "type": "text", + "name": "veeamOneUsername", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam ONE Password", + "placeholder": "Your Veeam ONE account password", "type": "password", - "name": "veeamOneBearerToken", + "name": "veeamOnePassword", "validations": { "required": true } } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam ONE Client ID (optional)", + "placeholder": "Leave blank unless your server requires an OAuth2 client", + "type": "text", + "name": "veeamOneClientId", + "validations": { + "required": false + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam ONE Client Secret (optional)", + "placeholder": "Leave blank unless your server requires an OAuth2 client", + "type": "password", + "name": "veeamOneClientSecret", + "validations": { + "required": false + } + } } ] }, @@ -3196,12 +3268,12 @@ }, { "title": "3. Veeam API Configuration", - "description": "Configure Veeam API credentials for all Veeam services (Malware Events, Security Analyzer, and Authorization Events).", + "description": "Configure Veeam Backup & Replication credentials for all VBR services (Malware Events, Security Analyzer, Authorization Events and Sessions). Sentinel authenticates via OAuth2 password grant and renews the token automatically.", "instructions": [ { "type": "Markdown", "parameters": { - "content": "#### 3.1 Obtain Veeam API Access Token\n1. Access your Veeam Backup & Replication management console\n2. Navigate to the REST API settings or authentication section\n3. Generate or obtain a Bearer token for API access\n4. Ensure the token has appropriate permissions for:\n - Malware Detection API (v1.3-rev1)\n - Security & Compliance Analyzer API (v1.3-rev1)\n - Authorization Events API (v1.3-rev1)\n - Sessions API (v1.3-rev1)\n5. Note the API base URL (typically https://your-veeam-server.com:9419)\n6. This token will be used for both on-premises and CDN-hosted APIs" + "content": "#### 3.1 Configure Veeam Backup & Replication credentials\n1. Access your Veeam Backup & Replication management console.\n2. Use (or create) a user account that has REST API access with permissions for the Malware Detection, Security & Compliance Analyzer, Authorization Events and Sessions APIs (v1.3-rev1).\n3. Note the API base URL (typically https://your-veeam-server.com:9419).\n4. Microsoft Sentinel signs in with these credentials against `/api/oauth2/token` (OAuth2 password grant) and automatically refreshes the access token, so collection no longer stops when the token expires.\n5. Client ID / Client Secret are optional - leave them blank unless your Veeam server is configured to require a registered OAuth2 client." } }, { @@ -3219,25 +3291,61 @@ { "type": "Textbox", "parameters": { - "label": "Veeam Bearer Token", - "placeholder": "Your Veeam API Bearer Token", + "label": "Veeam Username", + "placeholder": "DOMAIN\\username", + "type": "text", + "name": "veeamUsername", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam Password", + "placeholder": "Your Veeam account password", "type": "password", - "name": "veeamBearerToken", + "name": "veeamPassword", "validations": { "required": true } } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam Client ID (optional)", + "placeholder": "Leave blank unless your server requires an OAuth2 client", + "type": "text", + "name": "veeamClientId", + "validations": { + "required": false + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam Client Secret (optional)", + "placeholder": "Leave blank unless your server requires an OAuth2 client", + "type": "password", + "name": "veeamClientSecret", + "validations": { + "required": false + } + } } ] }, { "title": "4. Veeam ONE API Configuration", - "description": "Configure Veeam ONE API credentials for triggered alarms data collection.", + "description": "Configure Veeam ONE credentials for triggered alarms data collection. Sentinel authenticates via OAuth2 password grant and renews the token automatically.", "instructions": [ { "type": "Markdown", "parameters": { - "content": "#### 4.1 Obtain Veeam ONE API Access Key\n1. Access your Veeam ONE management console\n2. Navigate to Administration -> Users and Roles\n3. Create or use an existing user with API access permissions\n4. Generate or obtain a Bearer token for API access\n5. Note the Veeam ONE server URL and port (typically https://your-veeam-one-server:1239)" + "content": "#### 4.1 Configure Veeam ONE credentials\n1. Access your Veeam ONE management console.\n2. Navigate to Administration -> Users and Roles and use (or create) a user with REST API access permissions.\n3. Note the Veeam ONE server URL and port (typically https://your-veeam-one-server:1239).\n4. Microsoft Sentinel signs in with these credentials against `/api/token` (OAuth2 password grant) and automatically refreshes the access token.\n5. Client ID / Client Secret are optional - leave them blank unless your Veeam ONE server requires a registered OAuth2 client." } }, { @@ -3255,14 +3363,50 @@ { "type": "Textbox", "parameters": { - "label": "Veeam ONE API Bearer Token", - "placeholder": "Your Veeam ONE API Bearer Token", + "label": "Veeam ONE Username", + "placeholder": "DOMAIN\\username", + "type": "text", + "name": "veeamOneUsername", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam ONE Password", + "placeholder": "Your Veeam ONE account password", "type": "password", - "name": "veeamOneBearerToken", + "name": "veeamOnePassword", "validations": { "required": true } } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam ONE Client ID (optional)", + "placeholder": "Leave blank unless your server requires an OAuth2 client", + "type": "text", + "name": "veeamOneClientId", + "validations": { + "required": false + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam ONE Client Secret (optional)", + "placeholder": "Leave blank unless your server requires an OAuth2 client", + "type": "password", + "name": "veeamOneClientSecret", + "validations": { + "required": false + } + } } ] }, @@ -3374,20 +3518,46 @@ "type": "securestring", "minLength": 1 }, - "veeamBearerToken": { - "defaultValue": "veeamBearerToken", + "veeamUsername": { + "defaultValue": "veeamUsername", "type": "securestring", "minLength": 1 }, + "veeamPassword": { + "defaultValue": "veeamPassword", + "type": "securestring", + "minLength": 1 + }, + "veeamClientId": { + "defaultValue": "", + "type": "securestring" + }, + "veeamClientSecret": { + "defaultValue": "", + "type": "securestring" + }, "veeamOneApiUrl": { "defaultValue": "veeamOneApiUrl", "type": "securestring", "minLength": 1 }, - "veeamOneBearerToken": { - "defaultValue": "veeamOneBearerToken", + "veeamOneUsername": { + "defaultValue": "veeamOneUsername", + "type": "securestring", + "minLength": 1 + }, + "veeamOnePassword": { + "defaultValue": "veeamOnePassword", "type": "securestring", "minLength": 1 + }, + "veeamOneClientId": { + "defaultValue": "", + "type": "securestring" + }, + "veeamOneClientSecret": { + "defaultValue": "", + "type": "securestring" } }, "variables": { @@ -3428,10 +3598,16 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]", - "ApiKeyName": "Authorization", - "ApiKeyIdentifier": "Bearer" + "type": "OAuth2", + "GrantType": "password", + "TokenEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/oauth2/token')]", + "TokenEndpointHeaders": { + "x-api-version": "1.3-rev1" + }, + "ClientId": "[[parameters('veeamClientId')]", + "ClientSecret": "[[parameters('veeamClientSecret')]", + "UserName": "[[parameters('veeamUsername')]", + "Password": "[[parameters('veeamPassword')]" }, "request": { "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/malwareDetection/events')]", @@ -3532,10 +3708,13 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "APIKey", - "ApiKey": "[[parameters('veeamOneBearerToken')]", - "ApiKeyName": "Authorization", - "ApiKeyIdentifier": "Bearer" + "type": "OAuth2", + "GrantType": "password", + "TokenEndpoint": "[[concat(parameters('veeamOneApiUrl'),'/api/token')]", + "ClientId": "[[parameters('veeamOneClientId')]", + "ClientSecret": "[[parameters('veeamOneClientSecret')]", + "UserName": "[[parameters('veeamOneUsername')]", + "Password": "[[parameters('veeamOnePassword')]" }, "request": { "apiEndpoint": "[[concat(parameters('veeamOneApiUrl'),'/api/v2.3/alarms/triggeredAlarms')]", @@ -3578,10 +3757,16 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]", - "ApiKeyName": "Authorization", - "ApiKeyIdentifier": "Bearer" + "type": "OAuth2", + "GrantType": "password", + "TokenEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/oauth2/token')]", + "TokenEndpointHeaders": { + "x-api-version": "1.3-rev1" + }, + "ClientId": "[[parameters('veeamClientId')]", + "ClientSecret": "[[parameters('veeamClientSecret')]", + "UserName": "[[parameters('veeamUsername')]", + "Password": "[[parameters('veeamPassword')]" }, "request": { "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/securityAnalyzer/bestPractices')]", @@ -3619,10 +3804,16 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]", - "ApiKeyName": "Authorization", - "ApiKeyIdentifier": "Bearer" + "type": "OAuth2", + "GrantType": "password", + "TokenEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/oauth2/token')]", + "TokenEndpointHeaders": { + "x-api-version": "1.3-rev1" + }, + "ClientId": "[[parameters('veeamClientId')]", + "ClientSecret": "[[parameters('veeamClientSecret')]", + "UserName": "[[parameters('veeamUsername')]", + "Password": "[[parameters('veeamPassword')]" }, "request": { "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/authorization/events')]", @@ -3673,10 +3864,16 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]", - "ApiKeyName": "Authorization", - "ApiKeyIdentifier": "Bearer" + "type": "OAuth2", + "GrantType": "password", + "TokenEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/oauth2/token')]", + "TokenEndpointHeaders": { + "x-api-version": "1.3-rev1" + }, + "ClientId": "[[parameters('veeamClientId')]", + "ClientSecret": "[[parameters('veeamClientSecret')]", + "UserName": "[[parameters('veeamUsername')]", + "Password": "[[parameters('veeamPassword')]" }, "request": { "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/sessions')]", @@ -3740,7 +3937,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-ChangeCollectionTime Playbook with template version 3.1.0", + "description": "Veeam-ChangeCollectionTime Playbook with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -4367,7 +4564,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-CollectVeeamAuthorizationEvents Playbook with template version 3.1.0", + "description": "Veeam-CollectVeeamAuthorizationEvents Playbook with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion2')]", @@ -4733,7 +4930,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-CollectSecurityComplianceAnalyzerResult Playbook with template version 3.1.0", + "description": "Veeam-CollectSecurityComplianceAnalyzerResult Playbook with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion3')]", @@ -5100,7 +5297,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-CollectMalwareEvents Playbook with template version 3.1.0", + "description": "Veeam-CollectMalwareEvents Playbook with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion4')]", @@ -5462,7 +5659,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-CollectVeeamONEAlarms Playbook with template version 3.1.0", + "description": "Veeam-CollectVeeamONEAlarms Playbook with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion5')]", @@ -5829,7 +6026,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-CollectCovewareFindings Playbook with template version 3.1.0", + "description": "Veeam-CollectCovewareFindings Playbook with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion6')]", @@ -6194,7 +6391,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-CollectConfigurationBackups Playbook with template version 3.1.0", + "description": "Veeam-CollectConfigurationBackups Playbook with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion7')]", @@ -6789,7 +6986,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-FindCleanRestorePoints Playbook with template version 3.1.0", + "description": "Veeam-FindCleanRestorePoints Playbook with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion8')]", @@ -7225,7 +7422,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-PerformScanBackup Playbook with template version 3.1.0", + "description": "Veeam-PerformScanBackup Playbook with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion9')]", @@ -7791,7 +7988,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-PerformInstantVMRecovery Playbook with template version 3.1.0", + "description": "Veeam-PerformInstantVMRecovery Playbook with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion10')]", @@ -8436,7 +8633,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-ResolveTriggeredAlarm Playbook with template version 3.1.0", + "description": "Veeam-ResolveTriggeredAlarm Playbook with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion11')]", @@ -8804,7 +9001,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-StartSecurityComplianceAnalyzer Playbook with template version 3.1.0", + "description": "Veeam-StartSecurityComplianceAnalyzer Playbook with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion12')]", @@ -9141,7 +9338,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-PerformConfigurationBackupOnIncident Playbook with template version 3.1.0", + "description": "Veeam-PerformConfigurationBackupOnIncident Playbook with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion13')]", @@ -9759,7 +9956,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-StartQuickBackup Playbook with template version 3.1.0", + "description": "Veeam-StartQuickBackup Playbook with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion14')]", @@ -10379,7 +10576,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-SetupConnections Playbook with template version 3.1.0", + "description": "Veeam-SetupConnections Playbook with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion15')]", @@ -12706,7 +12903,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_GetJobFinished Data Parser with template version 3.1.0", + "description": "Veeam_GetJobFinished Data Parser with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", @@ -12838,7 +13035,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_GetVeeamONEAlarms Data Parser with template version 3.1.0", + "description": "Veeam_GetVeeamONEAlarms Data Parser with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject2').parserVersion2]", @@ -12970,7 +13167,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_GetFinishedConfigurationBackupSessions Data Parser with template version 3.1.0", + "description": "Veeam_GetFinishedConfigurationBackupSessions Data Parser with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject3').parserVersion3]", @@ -13102,7 +13299,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_GetSecurityEvents Data Parser with template version 3.1.0", + "description": "Veeam_GetSecurityEvents Data Parser with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject4').parserVersion4]", @@ -13234,7 +13431,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "parser_VeeamAuthorizationEventsV2AliasFunction Data Parser with template version 3.1.0", + "description": "parser_VeeamAuthorizationEventsV2AliasFunction Data Parser with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject5').parserVersion5]", @@ -13366,7 +13563,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "parser_VeeamCovewareFindingsV2AliasFunction Data Parser with template version 3.1.0", + "description": "parser_VeeamCovewareFindingsV2AliasFunction Data Parser with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject6').parserVersion6]", @@ -13498,7 +13695,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "parser_VeeamMalwareEventsV2AliasFunction Data Parser with template version 3.1.0", + "description": "parser_VeeamMalwareEventsV2AliasFunction Data Parser with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject7').parserVersion7]", @@ -13630,7 +13827,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "parser_VeeamOneTriggeredAlarmsV2AliasFunction Data Parser with template version 3.1.0", + "description": "parser_VeeamOneTriggeredAlarmsV2AliasFunction Data Parser with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject8').parserVersion8]", @@ -13762,7 +13959,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "parser_VeeamSecurityComplianceAnalyzerV2AliasFunction Data Parser with template version 3.1.0", + "description": "parser_VeeamSecurityComplianceAnalyzerV2AliasFunction Data Parser with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject9').parserVersion9]", @@ -13894,7 +14091,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "parser_VeeamSessionsV2AliasFunction Data Parser with template version 3.1.0", + "description": "parser_VeeamSessionsV2AliasFunction Data Parser with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject10').parserVersion10]", @@ -14026,7 +14223,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Adding_User_or_Group_Failed_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Adding_User_or_Group_Failed_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -14054,27 +14251,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -14129,7 +14326,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Application_Group_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Application_Group_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -14157,27 +14354,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -14232,7 +14429,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Application_Group_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Application_Group_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -14260,27 +14457,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -14335,7 +14532,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Archive_Repository_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Archive_Repository_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -14363,27 +14560,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -14438,7 +14635,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Archive_Repository_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Archive_Repository_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -14466,27 +14663,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -14541,7 +14738,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Attempt_to_Delete_Backup_Failed_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Attempt_to_Delete_Backup_Failed_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -14569,27 +14766,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -14644,7 +14841,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Attempt_to_Update_Security_Object_Failed_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Attempt_to_Update_Security_Object_Failed_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -14672,27 +14869,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -14747,7 +14944,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Backup_Proxy_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Backup_Proxy_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -14775,27 +14972,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -14850,7 +15047,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Backup_Repository_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Backup_Repository_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -14878,27 +15075,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -14953,7 +15150,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Backup_Repository_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Backup_Repository_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -14981,27 +15178,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -15056,7 +15253,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cloud_Gateway_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Cloud_Gateway_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject11').analyticRuleVersion11]", @@ -15084,27 +15281,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -15159,7 +15356,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cloud_Gateway_Pool_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Cloud_Gateway_Pool_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject12').analyticRuleVersion12]", @@ -15187,27 +15384,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -15262,7 +15459,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cloud_Gateway_Pool_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Cloud_Gateway_Pool_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject13').analyticRuleVersion13]", @@ -15290,27 +15487,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -15365,7 +15562,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cloud_Gateway_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Cloud_Gateway_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject14').analyticRuleVersion14]", @@ -15393,27 +15590,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -15468,7 +15665,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cloud_Replica_Permanent_Failover_Performed_by_Tenant_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Cloud_Replica_Permanent_Failover_Performed_by_Tenant_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject15').analyticRuleVersion15]", @@ -15496,27 +15693,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -15571,7 +15768,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Configuration_Backup_Job_Failed_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Configuration_Backup_Job_Failed_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject16').analyticRuleVersion16]", @@ -15599,26 +15796,26 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "MessageDetails": "MessageDetails", "EventId": "EventId", - "DataSource": "DataSource", "Date": "Date", - "MessageDetails": "MessageDetails" + "DataSource": "DataSource" } } }, @@ -15673,7 +15870,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Configuration_Backup_Job_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Configuration_Backup_Job_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject17').analyticRuleVersion17]", @@ -15701,27 +15898,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -15776,7 +15973,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Connection_to_Backup_Repository_Lost_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Connection_to_Backup_Repository_Lost_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject18').analyticRuleVersion18]", @@ -15804,27 +16001,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -15879,7 +16076,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Credential_Record_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Credential_Record_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject19').analyticRuleVersion19]", @@ -15907,27 +16104,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -15982,7 +16179,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Credential_Record_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Credential_Record_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject20').analyticRuleVersion20]", @@ -16010,27 +16207,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -16085,7 +16282,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Detaching_Backups_Started_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Detaching_Backups_Started_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject21').analyticRuleVersion21]", @@ -16113,27 +16310,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -16188,7 +16385,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Encryption_Password_Added_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Encryption_Password_Added_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject22').analyticRuleVersion22]", @@ -16216,27 +16413,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -16291,7 +16488,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Encryption_Password_Changed_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Encryption_Password_Changed_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject23').analyticRuleVersion23]", @@ -16319,27 +16516,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -16394,7 +16591,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Encryption_Password_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Encryption_Password_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject24').analyticRuleVersion24]", @@ -16422,27 +16619,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -16497,7 +16694,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "External_Repository_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "External_Repository_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject25').analyticRuleVersion25]", @@ -16525,27 +16722,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -16600,7 +16797,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "External_Repository_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "External_Repository_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject26').analyticRuleVersion26]", @@ -16628,27 +16825,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -16703,7 +16900,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Failover_Plan_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Failover_Plan_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject27').analyticRuleVersion27]", @@ -16731,27 +16928,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -16806,7 +17003,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Failover_Plan_Failed_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Failover_Plan_Failed_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject28').analyticRuleVersion28]", @@ -16834,27 +17031,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -16909,7 +17106,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Failover_Plan_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Failover_Plan_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject29').analyticRuleVersion29]", @@ -16937,27 +17134,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -17012,7 +17209,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Failover_Plan_Started_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Failover_Plan_Started_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject30').analyticRuleVersion30]", @@ -17040,27 +17237,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -17115,7 +17312,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Failover_Plan_Stopped_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Failover_Plan_Stopped_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject31').analyticRuleVersion31]", @@ -17143,27 +17340,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -17218,7 +17415,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "File_Server_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "File_Server_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject32').analyticRuleVersion32]", @@ -17246,27 +17443,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -17321,7 +17518,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "File_Server_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "File_Server_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject33').analyticRuleVersion33]", @@ -17349,27 +17546,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -17424,7 +17621,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "File_Share_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "File_Share_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject34').analyticRuleVersion34]", @@ -17452,27 +17649,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -17527,7 +17724,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Four_Eyes_Authorization_Disabled_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Four_Eyes_Authorization_Disabled_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject35').analyticRuleVersion35]", @@ -17555,27 +17752,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -17630,7 +17827,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Four_Eyes_Authorization_Request_Created_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Four_Eyes_Authorization_Request_Created_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject36').analyticRuleVersion36]", @@ -17658,27 +17855,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -17733,7 +17930,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Four_Eyes_Authorization_Request_Expired_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Four_Eyes_Authorization_Request_Expired_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject37').analyticRuleVersion37]", @@ -17761,27 +17958,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -17836,7 +18033,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Four_Eyes_Authorization_Request_Rejected_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Four_Eyes_Authorization_Request_Rejected_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject38').analyticRuleVersion38]", @@ -17864,27 +18061,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -17939,7 +18136,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "General_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "General_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject39').analyticRuleVersion39]", @@ -17967,27 +18164,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -18042,7 +18239,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Global_Network_Traffic_Rules_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Global_Network_Traffic_Rules_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject40').analyticRuleVersion40]", @@ -18070,27 +18267,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -18145,7 +18342,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Global_VM_Exclusions_Added_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Global_VM_Exclusions_Added_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject41').analyticRuleVersion41]", @@ -18173,27 +18370,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -18248,7 +18445,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Global_VM_Exclusions_Changed_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Global_VM_Exclusions_Changed_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject42').analyticRuleVersion42]", @@ -18276,27 +18473,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -18351,7 +18548,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Global_VM_Exclusions_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Global_VM_Exclusions_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject43').analyticRuleVersion43]", @@ -18379,27 +18576,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -18454,7 +18651,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Host_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Host_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject44').analyticRuleVersion44]", @@ -18482,27 +18679,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -18557,7 +18754,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Host_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Host_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject45').analyticRuleVersion45]", @@ -18585,27 +18782,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -18660,7 +18857,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Hypervisor_Host_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Hypervisor_Host_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject46').analyticRuleVersion46]", @@ -18688,16 +18885,16 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "entityMappings": [ @@ -18770,7 +18967,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Hypervisor_Host_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Hypervisor_Host_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject47').analyticRuleVersion47]", @@ -18798,27 +18995,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -18873,7 +19070,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Invalid_Code_for_Multi_Factor_Authentication_Entered_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Invalid_Code_for_Multi_Factor_Authentication_Entered_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject48').analyticRuleVersion48]", @@ -18901,27 +19098,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -18976,7 +19173,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Job_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Job_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject49').analyticRuleVersion49]", @@ -19004,27 +19201,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -19079,7 +19276,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Job_No_Longer_Used_as_Second_Destination_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Job_No_Longer_Used_as_Second_Destination_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject50').analyticRuleVersion50]", @@ -19107,27 +19304,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -19182,7 +19379,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "KMS_Key_Rotation_Job_Finished_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "KMS_Key_Rotation_Job_Finished_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject51').analyticRuleVersion51]", @@ -19210,27 +19407,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -19285,7 +19482,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "KMS_Server_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "KMS_Server_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject52').analyticRuleVersion52]", @@ -19313,27 +19510,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -19388,7 +19585,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "KMS_Server_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "KMS_Server_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject53').analyticRuleVersion53]", @@ -19416,27 +19613,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -19491,7 +19688,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "License_Expired_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "License_Expired_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject54').analyticRuleVersion54]", @@ -19519,27 +19716,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -19594,7 +19791,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "License_Expiring_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "License_Expiring_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject55').analyticRuleVersion55]", @@ -19622,27 +19819,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -19697,7 +19894,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "License_Grace_Period_Started_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "License_Grace_Period_Started_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject56').analyticRuleVersion56]", @@ -19725,27 +19922,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -19800,7 +19997,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "License_Limit_Exceeded_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "License_Limit_Exceeded_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject57').analyticRuleVersion57]", @@ -19828,27 +20025,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -19903,7 +20100,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "License_Removed_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "License_Removed_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject58').analyticRuleVersion58]", @@ -19931,27 +20128,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -20006,7 +20203,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "License_Support_Expired_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "License_Support_Expired_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject59').analyticRuleVersion59]", @@ -20034,27 +20231,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -20109,7 +20306,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "License_Support_Expiring_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "License_Support_Expiring_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject60').analyticRuleVersion60]", @@ -20137,27 +20334,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -20212,7 +20409,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malware_Activity_Detected_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Malware_Activity_Detected_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject61').analyticRuleVersion61]", @@ -20240,28 +20437,28 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "EventId": "EventId", "MachineUuid": "MachineUuid", - "MessageDetails": "MessageDetails", "Date": "Date", "MachineDisplayName": "MachineDisplayName", "Severity": "Severity", + "EventId": "EventId", + "MessageDetails": "MessageDetails", "VbrHostName": "DataSource" } } @@ -20317,7 +20514,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malware_Detection_Exclusions_List_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Malware_Detection_Exclusions_List_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject62').analyticRuleVersion62]", @@ -20345,27 +20542,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -20420,7 +20617,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malware_Detection_Session_Finished_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Malware_Detection_Session_Finished_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject63').analyticRuleVersion63]", @@ -20448,27 +20645,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -20523,7 +20720,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malware_Detection_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Malware_Detection_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject64').analyticRuleVersion64]", @@ -20551,27 +20748,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -20626,7 +20823,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malware_Event_Detected_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Malware_Event_Detected_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject65').analyticRuleVersion65]", @@ -20654,10 +20851,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamMalwareEvents_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "entityMappings": [ @@ -20675,8 +20872,8 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { - "MachineDisplayName": "MachineDisplayName", "MachineUuid": "MachineUuid", + "MachineDisplayName": "MachineDisplayName", "VbrHostName": "VbrHostName", "BackupObjectId": "MachineBackupObjectId" } @@ -20733,7 +20930,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Multi_Factor_Authentication_Disabled_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Multi_Factor_Authentication_Disabled_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject66').analyticRuleVersion66]", @@ -20761,27 +20958,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -20836,7 +21033,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Multi_Factor_Authentication_for_User_Disabled_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Multi_Factor_Authentication_for_User_Disabled_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject67').analyticRuleVersion67]", @@ -20864,27 +21061,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -20939,7 +21136,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Multi_Factor_Authentication_Token_Revoked_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Multi_Factor_Authentication_Token_Revoked_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject68').analyticRuleVersion68]", @@ -20967,27 +21164,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -21042,7 +21239,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Multi_Factor_Authentication_User_Locked_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Multi_Factor_Authentication_User_Locked_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject69').analyticRuleVersion69]", @@ -21070,27 +21267,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -21145,7 +21342,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NDMP_Server_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "NDMP_Server_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject70').analyticRuleVersion70]", @@ -21173,27 +21370,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -21248,7 +21445,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Object_Marked_as_Clean_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Object_Marked_as_Clean_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject71').analyticRuleVersion71]", @@ -21276,27 +21473,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -21351,7 +21548,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Object_Storage_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Object_Storage_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject72').analyticRuleVersion72]", @@ -21379,27 +21576,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -21454,7 +21651,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Object_Storage_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Object_Storage_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject73').analyticRuleVersion73]", @@ -21482,27 +21679,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -21557,7 +21754,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Objects_Added_to_Malware_Detection_Exclusions_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Objects_Added_to_Malware_Detection_Exclusions_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject74').analyticRuleVersion74]", @@ -21585,27 +21782,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -21660,7 +21857,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Objects_Deleted_from_Malware_Detection_Exclusions_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Objects_Deleted_from_Malware_Detection_Exclusions_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject75').analyticRuleVersion75]", @@ -21688,27 +21885,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -21763,7 +21960,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Objects_for_Job_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Objects_for_Job_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject76').analyticRuleVersion76]", @@ -21791,27 +21988,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -21866,7 +22063,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Objects_for_Protection_Group_Changed_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Objects_for_Protection_Group_Changed_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject77').analyticRuleVersion77]", @@ -21894,27 +22091,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -21969,7 +22166,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Objects_for_Protection_Group_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Objects_for_Protection_Group_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject78').analyticRuleVersion78]", @@ -21997,27 +22194,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -22072,7 +22269,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Preferred_Networks_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Preferred_Networks_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject79').analyticRuleVersion79]", @@ -22100,27 +22297,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -22175,7 +22372,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Protection_Group_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Protection_Group_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject80').analyticRuleVersion80]", @@ -22203,27 +22400,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -22278,7 +22475,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Protection_Group_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Protection_Group_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject81').analyticRuleVersion81]", @@ -22306,27 +22503,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -22381,7 +22578,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Recovery_Token_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Recovery_Token_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject82').analyticRuleVersion82]", @@ -22409,27 +22606,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -22484,7 +22681,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Restore_Point_Marked_as_Clean_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Restore_Point_Marked_as_Clean_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject83').analyticRuleVersion83]", @@ -22512,27 +22709,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -22587,7 +22784,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Restore_Point_Marked_as_Infected_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Restore_Point_Marked_as_Infected_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject84').analyticRuleVersion84]", @@ -22615,27 +22812,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -22690,7 +22887,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Scale_Out_Backup_Repository_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Scale_Out_Backup_Repository_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject85').analyticRuleVersion85]", @@ -22718,27 +22915,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -22793,7 +22990,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Scale_Out_Backup_Repository_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Scale_Out_Backup_Repository_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject86').analyticRuleVersion86]", @@ -22821,27 +23018,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -22896,7 +23093,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Service_Provider_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Service_Provider_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject87').analyticRuleVersion87]", @@ -22924,27 +23121,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -22999,7 +23196,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Service_Provider_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Service_Provider_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject88').analyticRuleVersion88]", @@ -23027,27 +23224,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -23102,7 +23299,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SSH_Credentials_Changed_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "SSH_Credentials_Changed_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject89').analyticRuleVersion89]", @@ -23130,27 +23327,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -23205,7 +23402,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Storage_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Storage_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject90').analyticRuleVersion90]", @@ -23233,27 +23430,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -23308,7 +23505,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Storage_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Storage_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject91').analyticRuleVersion91]", @@ -23336,27 +23533,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -23411,7 +23608,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Subtenant_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Subtenant_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject92').analyticRuleVersion92]", @@ -23439,27 +23636,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -23514,7 +23711,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Subtenant_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Subtenant_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject93').analyticRuleVersion93]", @@ -23542,27 +23739,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -23617,7 +23814,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SureBackup_Job_Failed_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "SureBackup_Job_Failed_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject94').analyticRuleVersion94]", @@ -23645,27 +23842,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -23720,7 +23917,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Tape_Erase_Job_Started_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Tape_Erase_Job_Started_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject95').analyticRuleVersion95]", @@ -23748,27 +23945,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -23823,7 +24020,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Tape_Library_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Tape_Library_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject96').analyticRuleVersion96]", @@ -23851,27 +24048,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -23926,7 +24123,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Tape_Media_Pool_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Tape_Media_Pool_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject97').analyticRuleVersion97]", @@ -23954,27 +24151,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -24029,7 +24226,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Tape_Media_Vault_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Tape_Media_Vault_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject98').analyticRuleVersion98]", @@ -24057,27 +24254,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -24132,7 +24329,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Tape_Medium_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Tape_Medium_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject99').analyticRuleVersion99]", @@ -24160,27 +24357,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -24235,7 +24432,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Tape_Server_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Tape_Server_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject100').analyticRuleVersion100]", @@ -24263,27 +24460,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -24338,7 +24535,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Tenant_Password_Changed_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Tenant_Password_Changed_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject101').analyticRuleVersion101]", @@ -24366,27 +24563,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -24441,7 +24638,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Tenant_Quota_Changed_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Tenant_Quota_Changed_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject102').analyticRuleVersion102]", @@ -24469,27 +24666,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -24544,7 +24741,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Tenant_Quota_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Tenant_Quota_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject103').analyticRuleVersion103]", @@ -24572,27 +24769,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -24647,7 +24844,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Tenant_Replica_Started_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Tenant_Replica_Started_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject104').analyticRuleVersion104]", @@ -24675,27 +24872,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -24750,7 +24947,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Tenant_Replica_Stopped_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Tenant_Replica_Stopped_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject105').analyticRuleVersion105]", @@ -24778,27 +24975,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -24853,7 +25050,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Tenant_State_Changed_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Tenant_State_Changed_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject106').analyticRuleVersion106]", @@ -24881,27 +25078,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -24956,7 +25153,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User_or_Group_Added_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "User_or_Group_Added_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject107').analyticRuleVersion107]", @@ -24984,27 +25181,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -25059,7 +25256,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User_or_Group_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "User_or_Group_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject108').analyticRuleVersion108]", @@ -25087,27 +25284,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -25162,7 +25359,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Best_Practice_Compliance_Check_Not_Passed_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Best_Practice_Compliance_Check_Not_Passed_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject109').analyticRuleVersion109]", @@ -25190,10 +25387,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamSecurityComplianceAnalyzer_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { @@ -25201,11 +25398,11 @@ }, "customDetails": { "Id": "Id", - "TenantId": "TenantId", - "BestPracticeName": "BestPractice", - "VbrHostName": "VbrHostName", "Note": "Note", - "Status": "Status" + "BestPracticeName": "BestPractice", + "TenantId": "TenantId", + "Status": "Status", + "VbrHostName": "VbrHostName" } } }, @@ -25260,7 +25457,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_One_Application_with_no_recent_data_backup_sessions_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Veeam_One_Application_with_no_recent_data_backup_sessions_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject110').analyticRuleVersion110]", @@ -25288,27 +25485,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "PredefinedAlarmId": "PredefinedAlarmId", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectType": "ObjectType", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", "Description": "Description", - "ObjectName": "ObjectName", + "ObjectId": "ObjectId", "Comment": "Comment", - "Status": "Status", "TriggeredTime": "TriggeredTime", - "Name": "Name", - "ObjectId": "ObjectId" + "ObjectName": "ObjectName", + "Status": "Status", + "PredefinedAlarmId": "PredefinedAlarmId", + "Name": "Name" } } }, @@ -25363,7 +25560,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_One_Backup_Copy_RPO_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Veeam_One_Backup_Copy_RPO_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject111').analyticRuleVersion111]", @@ -25391,27 +25588,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "PredefinedAlarmId": "PredefinedAlarmId", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectType": "ObjectType", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", "Description": "Description", - "ObjectName": "ObjectName", + "ObjectId": "ObjectId", "Comment": "Comment", - "Status": "Status", "TriggeredTime": "TriggeredTime", - "Name": "Name", - "ObjectId": "ObjectId" + "ObjectName": "ObjectName", + "Status": "Status", + "PredefinedAlarmId": "PredefinedAlarmId", + "Name": "Name" } } }, @@ -25466,7 +25663,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_One_Backup_server_security_&_compliance_state_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Veeam_One_Backup_server_security_&_compliance_state_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject112').analyticRuleVersion112]", @@ -25494,27 +25691,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "PredefinedAlarmId": "PredefinedAlarmId", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectType": "ObjectType", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", "Description": "Description", - "ObjectName": "ObjectName", + "ObjectId": "ObjectId", "Comment": "Comment", - "Status": "Status", "TriggeredTime": "TriggeredTime", - "Name": "Name", - "ObjectId": "ObjectId" + "ObjectName": "ObjectName", + "Status": "Status", + "PredefinedAlarmId": "PredefinedAlarmId", + "Name": "Name" } } }, @@ -25569,7 +25766,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_One_Computer_with_no_backup_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Veeam_One_Computer_with_no_backup_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject113').analyticRuleVersion113]", @@ -25597,27 +25794,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "PredefinedAlarmId": "PredefinedAlarmId", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectType": "ObjectType", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", "Description": "Description", - "ObjectName": "ObjectName", + "ObjectId": "ObjectId", "Comment": "Comment", - "Status": "Status", "TriggeredTime": "TriggeredTime", - "Name": "Name", - "ObjectId": "ObjectId" + "ObjectName": "ObjectName", + "Status": "Status", + "PredefinedAlarmId": "PredefinedAlarmId", + "Name": "Name" } } }, @@ -25672,7 +25869,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_One_Immutability_change_tracking_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Veeam_One_Immutability_change_tracking_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject114').analyticRuleVersion114]", @@ -25700,27 +25897,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "PredefinedAlarmId": "PredefinedAlarmId", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectType": "ObjectType", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", "Description": "Description", - "ObjectName": "ObjectName", + "ObjectId": "ObjectId", "Comment": "Comment", - "Status": "Status", "TriggeredTime": "TriggeredTime", - "Name": "Name", - "ObjectId": "ObjectId" + "ObjectName": "ObjectName", + "Status": "Status", + "PredefinedAlarmId": "PredefinedAlarmId", + "Name": "Name" } } }, @@ -25775,7 +25972,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_One_Immutability_state_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Veeam_One_Immutability_state_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject115').analyticRuleVersion115]", @@ -25803,27 +26000,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "PredefinedAlarmId": "PredefinedAlarmId", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectType": "ObjectType", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", "Description": "Description", - "ObjectName": "ObjectName", + "ObjectId": "ObjectId", "Comment": "Comment", - "Status": "Status", "TriggeredTime": "TriggeredTime", - "Name": "Name", - "ObjectId": "ObjectId" + "ObjectName": "ObjectName", + "Status": "Status", + "PredefinedAlarmId": "PredefinedAlarmId", + "Name": "Name" } } }, @@ -25878,7 +26075,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_One_Job_disabled_Veeam_Backup_for_Microsoft_365_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Veeam_One_Job_disabled_Veeam_Backup_for_Microsoft_365_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject116').analyticRuleVersion116]", @@ -25906,27 +26103,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "PredefinedAlarmId": "PredefinedAlarmId", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectType": "ObjectType", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", "Description": "Description", - "ObjectName": "ObjectName", + "ObjectId": "ObjectId", "Comment": "Comment", - "Status": "Status", "TriggeredTime": "TriggeredTime", - "Name": "Name", - "ObjectId": "ObjectId" + "ObjectName": "ObjectName", + "Status": "Status", + "PredefinedAlarmId": "PredefinedAlarmId", + "Name": "Name" } } }, @@ -25981,7 +26178,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_One_Job_disabled_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Veeam_One_Job_disabled_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject117').analyticRuleVersion117]", @@ -26009,27 +26206,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "PredefinedAlarmId": "PredefinedAlarmId", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectType": "ObjectType", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", "Description": "Description", - "ObjectName": "ObjectName", + "ObjectId": "ObjectId", "Comment": "Comment", - "Status": "Status", "TriggeredTime": "TriggeredTime", - "Name": "Name", - "ObjectId": "ObjectId" + "ObjectName": "ObjectName", + "Status": "Status", + "PredefinedAlarmId": "PredefinedAlarmId", + "Name": "Name" } } }, @@ -26084,7 +26281,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_One_Possible_ransomware_activity_Hyper_V_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Veeam_One_Possible_ransomware_activity_Hyper_V_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject118').analyticRuleVersion118]", @@ -26112,27 +26309,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "PredefinedAlarmId": "PredefinedAlarmId", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectType": "ObjectType", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", "Description": "Description", - "ObjectName": "ObjectName", + "ObjectId": "ObjectId", "Comment": "Comment", - "Status": "Status", "TriggeredTime": "TriggeredTime", - "Name": "Name", - "ObjectId": "ObjectId" + "ObjectName": "ObjectName", + "Status": "Status", + "PredefinedAlarmId": "PredefinedAlarmId", + "Name": "Name" } } }, @@ -26187,7 +26384,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_One_Possible_ransomware_activity_vSphere_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Veeam_One_Possible_ransomware_activity_vSphere_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject119').analyticRuleVersion119]", @@ -26215,27 +26412,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "PredefinedAlarmId": "PredefinedAlarmId", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectType": "ObjectType", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", "Description": "Description", - "ObjectName": "ObjectName", + "ObjectId": "ObjectId", "Comment": "Comment", - "Status": "Status", "TriggeredTime": "TriggeredTime", - "Name": "Name", - "ObjectId": "ObjectId" + "ObjectName": "ObjectName", + "Status": "Status", + "PredefinedAlarmId": "PredefinedAlarmId", + "Name": "Name" } } }, @@ -26290,7 +26487,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_One_Suspicious_incremental_backup_size_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Veeam_One_Suspicious_incremental_backup_size_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject120').analyticRuleVersion120]", @@ -26318,27 +26515,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "PredefinedAlarmId": "PredefinedAlarmId", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectType": "ObjectType", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", "Description": "Description", - "ObjectName": "ObjectName", + "ObjectId": "ObjectId", "Comment": "Comment", - "Status": "Status", "TriggeredTime": "TriggeredTime", - "Name": "Name", - "ObjectId": "ObjectId" + "ObjectName": "ObjectName", + "Status": "Status", + "PredefinedAlarmId": "PredefinedAlarmId", + "Name": "Name" } } }, @@ -26393,7 +26590,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_One_Unusual_job_duration_Veeam_Backup_for_Microsoft_365_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Veeam_One_Unusual_job_duration_Veeam_Backup_for_Microsoft_365_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject121').analyticRuleVersion121]", @@ -26421,27 +26618,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "PredefinedAlarmId": "PredefinedAlarmId", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectType": "ObjectType", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", "Description": "Description", - "ObjectName": "ObjectName", + "ObjectId": "ObjectId", "Comment": "Comment", - "Status": "Status", "TriggeredTime": "TriggeredTime", - "Name": "Name", - "ObjectId": "ObjectId" + "ObjectName": "ObjectName", + "Status": "Status", + "PredefinedAlarmId": "PredefinedAlarmId", + "Name": "Name" } } }, @@ -26496,7 +26693,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_One_Unusual_job_duration_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Veeam_One_Unusual_job_duration_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject122').analyticRuleVersion122]", @@ -26524,27 +26721,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "PredefinedAlarmId": "PredefinedAlarmId", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectType": "ObjectType", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", "Description": "Description", - "ObjectName": "ObjectName", + "ObjectId": "ObjectId", "Comment": "Comment", - "Status": "Status", "TriggeredTime": "TriggeredTime", - "Name": "Name", - "ObjectId": "ObjectId" + "ObjectName": "ObjectName", + "Status": "Status", + "PredefinedAlarmId": "PredefinedAlarmId", + "Name": "Name" } } }, @@ -26599,7 +26796,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_One_Veeam_malware_detection_change_tracking_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Veeam_One_Veeam_malware_detection_change_tracking_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject123').analyticRuleVersion123]", @@ -26627,27 +26824,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "PredefinedAlarmId": "PredefinedAlarmId", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectType": "ObjectType", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", "Description": "Description", - "ObjectName": "ObjectName", + "ObjectId": "ObjectId", "Comment": "Comment", - "Status": "Status", "TriggeredTime": "TriggeredTime", - "Name": "Name", - "ObjectId": "ObjectId" + "ObjectName": "ObjectName", + "Status": "Status", + "PredefinedAlarmId": "PredefinedAlarmId", + "Name": "Name" } } }, @@ -26702,7 +26899,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_One_VM_with_no_backup_Hyper_V_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Veeam_One_VM_with_no_backup_Hyper_V_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject124').analyticRuleVersion124]", @@ -26730,27 +26927,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "PredefinedAlarmId": "PredefinedAlarmId", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectType": "ObjectType", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", "Description": "Description", - "ObjectName": "ObjectName", + "ObjectId": "ObjectId", "Comment": "Comment", - "Status": "Status", "TriggeredTime": "TriggeredTime", - "Name": "Name", - "ObjectId": "ObjectId" + "ObjectName": "ObjectName", + "Status": "Status", + "PredefinedAlarmId": "PredefinedAlarmId", + "Name": "Name" } } }, @@ -26805,7 +27002,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_One_VM_with_no_backup_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Veeam_One_VM_with_no_backup_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject125').analyticRuleVersion125]", @@ -26833,27 +27030,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "PredefinedAlarmId": "PredefinedAlarmId", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectType": "ObjectType", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", "Description": "Description", - "ObjectName": "ObjectName", + "ObjectId": "ObjectId", "Comment": "Comment", - "Status": "Status", "TriggeredTime": "TriggeredTime", - "Name": "Name", - "ObjectId": "ObjectId" + "ObjectName": "ObjectName", + "Status": "Status", + "PredefinedAlarmId": "PredefinedAlarmId", + "Name": "Name" } } }, @@ -26908,7 +27105,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_One_VM_with_no_replica_Hyper_V_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Veeam_One_VM_with_no_replica_Hyper_V_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject126').analyticRuleVersion126]", @@ -26936,27 +27133,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "PredefinedAlarmId": "PredefinedAlarmId", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectType": "ObjectType", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", "Description": "Description", - "ObjectName": "ObjectName", + "ObjectId": "ObjectId", "Comment": "Comment", - "Status": "Status", "TriggeredTime": "TriggeredTime", - "Name": "Name", - "ObjectId": "ObjectId" + "ObjectName": "ObjectName", + "Status": "Status", + "PredefinedAlarmId": "PredefinedAlarmId", + "Name": "Name" } } }, @@ -27011,7 +27208,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_One_VM_with_no_replica_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Veeam_One_VM_with_no_replica_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject127').analyticRuleVersion127]", @@ -27039,27 +27236,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "PredefinedAlarmId": "PredefinedAlarmId", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectType": "ObjectType", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", "Description": "Description", - "ObjectName": "ObjectName", + "ObjectId": "ObjectId", "Comment": "Comment", - "Status": "Status", "TriggeredTime": "TriggeredTime", - "Name": "Name", - "ObjectId": "ObjectId" + "ObjectName": "ObjectName", + "Status": "Status", + "PredefinedAlarmId": "PredefinedAlarmId", + "Name": "Name" } } }, @@ -27114,7 +27311,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Virtual_Lab_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Virtual_Lab_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject128').analyticRuleVersion128]", @@ -27142,27 +27339,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -27217,7 +27414,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Virtual_Lab_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Virtual_Lab_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject129').analyticRuleVersion129]", @@ -27245,27 +27442,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -27320,7 +27517,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "WAN_Accelerator_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "WAN_Accelerator_Deleted_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject130').analyticRuleVersion130]", @@ -27348,27 +27545,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -27423,7 +27620,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "WAN_Accelerator_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "WAN_Accelerator_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject131').analyticRuleVersion131]", @@ -27451,27 +27648,27 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Syslog", "dataTypes": [ "Syslog" - ], - "connectorId": "Syslog" + ] }, { + "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ], - "connectorId": "SyslogAma" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Severity": "Severity", + "MessageDetails": "MessageDetails", "EventId": "EventId", "VbrHostName": "DataSource", - "Date": "Date", - "MessageDetails": "MessageDetails", - "Severity": "Severity" + "Date": "Date" } } }, @@ -27526,7 +27723,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Configuration_Backup_Failed_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Configuration_Backup_Failed_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject132').analyticRuleVersion132]", @@ -27554,21 +27751,21 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamSessions_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "SessionType": "SessionType", - "VbrHostName": "VbrHostName", "SessionId": "SessionId", + "Result": "Result", "Name": "Name", - "Result": "Result" + "VbrHostName": "VbrHostName", + "SessionType": "SessionType" } } }, @@ -27623,7 +27820,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "VeeamDataPlatformMonitoring Workbook with template version 3.1.0", + "description": "VeeamDataPlatformMonitoring Workbook with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -27711,7 +27908,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "VeeamSecurityActivities Workbook with template version 3.1.0", + "description": "VeeamSecurityActivities Workbook with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion2')]", @@ -27819,7 +28016,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.1.0", + "version": "3.2.0", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Veeam", @@ -27937,57 +28134,57 @@ { "kind": "Watchlist", "contentId": "[variables('_Job Types Lookup')]", - "version": "3.1.0" + "version": "3.2.0" }, { "kind": "Watchlist", "contentId": "[variables('_License Editions Lookup')]", - "version": "3.1.0" + "version": "3.2.0" }, { "kind": "Watchlist", "contentId": "[variables('_License Types Lookup')]", - "version": "3.1.0" + "version": "3.2.0" }, { "kind": "Watchlist", "contentId": "[variables('_Operation Names Lookup')]", - "version": "3.1.0" + "version": "3.2.0" }, { "kind": "Watchlist", "contentId": "[variables('_Session States Lookup')]", - "version": "3.1.0" + "version": "3.2.0" }, { "kind": "Watchlist", "contentId": "[variables('_VBR Events Lookup')]", - "version": "3.1.0" + "version": "3.2.0" }, { "kind": "Watchlist", "contentId": "[variables('_Action Results Lookup')]", - "version": "3.1.0" + "version": "3.2.0" }, { "kind": "Watchlist", "contentId": "[variables('_Veeam Backup & Replication Settings')]", - "version": "3.1.0" + "version": "3.2.0" }, { "kind": "Watchlist", "contentId": "[variables('_VONE Settings')]", - "version": "3.1.0" + "version": "3.2.0" }, { "kind": "Watchlist", "contentId": "[variables('_Coveware Settings')]", - "version": "3.1.0" + "version": "3.2.0" }, { "kind": "Watchlist", "contentId": "[variables('_Veeam Collection Schedule Settings')]", - "version": "3.1.0" + "version": "3.2.0" }, { "kind": "Parser", diff --git a/Solutions/Veeam/SolutionMetadata.json b/Solutions/Veeam/SolutionMetadata.json index ce67ed86cc0..b8af0d8133e 100644 --- a/Solutions/Veeam/SolutionMetadata.json +++ b/Solutions/Veeam/SolutionMetadata.json @@ -2,9 +2,14 @@ "publisherId": "veeamsoftware", "offerId": "azure-sentinel-solution-veeamapp", "firstPublishDate": "2026-06-16", - "providers": [ "Veeam" ], + "providers": [ + "Veeam" + ], "categories": { - "domains": [ "IT Operations", "Security - Threat Protection" ] + "domains": [ + "IT Operations", + "Security - Threat Protection" + ] }, "support": { "name": "Veeam Software", @@ -12,5 +17,5 @@ "tier": "Partner", "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" }, - "version": "3.1.0" -} \ No newline at end of file + "version": "3.2.0" +}