diff --git a/Logos/DragonCopilot_logo.svg b/Logos/DragonCopilot_logo.svg new file mode 100644 index 00000000000..fa4eea85235 --- /dev/null +++ b/Logos/DragonCopilot_logo.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/Solutions/DragonCopilot/Data Connectors/DragonCopilotNative_ConnectorDefinition.json b/Solutions/DragonCopilot/Data Connectors/DragonCopilotNative_ConnectorDefinition.json new file mode 100644 index 00000000000..dc48801b47d --- /dev/null +++ b/Solutions/DragonCopilot/Data Connectors/DragonCopilotNative_ConnectorDefinition.json @@ -0,0 +1,80 @@ +{ + "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", + "apiVersion": "2024-09-01", + "name": "DragonCopilotNative", + "location": "{{location}}", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "DragonCopilotNative", + "title": "Dragon Copilot", + "publisher": "Microsoft", + "logo": "DragonCopilot.svg", + "descriptionMarkdown": "Microsoft Dragon Copilot is an AI-powered clinical assistant that captures and processes clinician interactions to generate structured clinical documentation and activity records. It leverages conversational, ambient, and generative AI to streamline clinical workflows, improve documentation efficiency, and surface actionable insights for healthcare professionals—including clinicians, nurses, and radiologists. Dragon Copilot activity logs represent administrative and user-level events (e.g., interactions, generated outputs, and system actions), making this connector the central ingestion point for admin, audit, and operational logs for the Dragon Copilot workload. Within the Sentinel integration context, Dragon Copilot emits audit and activity signals representing user interactions and system-generated outputs. These signals enable security monitoring, compliance auditing, and operational visibility across healthcare workflows.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "Dragon Copilot", + "baseQuery": "DragonCopilot" + } + ], + "sampleQueries": [ + { + "description": "Dragon Copilot Logs", + "query": "DragonCopilot\n | sort by TimeGenerated" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "dataTypes": [ + { + "name": "DragonCopilot", + "lastDataReceivedQuery": "DragonCopilot\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "availability": { + "status": 1, + "isPreview": true + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "Tenant Permissions", + "description": "'Security Administrator' or 'Global Administrator' on the workspace's tenant." + } + ] + }, + "instructionSteps": [ + { + "title": "Connect Dragon Copilot audit logs to Microsoft Sentinel", + "description": "This connector uses the Office Management API to get your Dragon Copilot audit logs. The logs will be stored and processed in your existing Microsoft Sentinel workspace. You can find the data in the **DragonCopilot** table.", + "instructions": [ + { + "type": "ConnectionToggleButton", + "parameters": { + "connectLabel": "Connect", + "name": "toggle" + } + } + ] + } + ] + } + } +} diff --git a/Solutions/DragonCopilot/Data Connectors/DragonCopilotNative_DCR.json b/Solutions/DragonCopilot/Data Connectors/DragonCopilotNative_DCR.json new file mode 100644 index 00000000000..1207baefd40 --- /dev/null +++ b/Solutions/DragonCopilot/Data Connectors/DragonCopilotNative_DCR.json @@ -0,0 +1,31 @@ +[ + { + "name": "DragonCopilotNative-DCR", + "apiVersion": "2023-03-11", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "{{location}}", + "properties": { + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "{{workspaceResourceId}}", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Microsoft-DragonCopilot" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source", + "outputStream": "Microsoft-DragonCopilot" + } + ], + "dataCollectionEndpointId": "{{dataCollectionEndpointId}}" + } + } +] diff --git a/Solutions/DragonCopilot/Data Connectors/DragonCopilotNative_PollingConfig.json b/Solutions/DragonCopilot/Data Connectors/DragonCopilotNative_PollingConfig.json new file mode 100644 index 00000000000..b541ab585e7 --- /dev/null +++ b/Solutions/DragonCopilot/Data Connectors/DragonCopilotNative_PollingConfig.json @@ -0,0 +1,25 @@ +{ + "name": "DragonCopilotNativePolling", + "apiVersion": "2024-09-01", + "type": "Microsoft.SecurityInsights/dataConnectors", + "location": "{{location}}", + "kind": "PurviewAudit", + "properties": { + "connectorDefinitionName": "DragonCopilotNative", + "TenantId": "{{tenantId}}", + "SourceType": "DragonCopilot", + "DataTypes": { + "Logs": { + "state": "Enabled" + } + }, + "dcrConfig": { + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}", + "streamName": "DRAGON_COPILOT" + }, + "request": { + "RetryCount": 1 + } + } +} diff --git a/Solutions/DragonCopilot/Data/Solution_DragonCopilot.json b/Solutions/DragonCopilot/Data/Solution_DragonCopilot.json new file mode 100644 index 00000000000..f9517c3f161 --- /dev/null +++ b/Solutions/DragonCopilot/Data/Solution_DragonCopilot.json @@ -0,0 +1,14 @@ +{ + "Name": "DragonCopilot", + "Author": "Microsoft - support@microsoft.com", + "Logo": "", + "Description": "Microsoft Dragon Copilot is an AI-powered clinical assistant that captures and processes clinician interactions to generate structured clinical documentation and activity records. It leverages conversational, ambient, and generative AI to streamline clinical workflows, improve documentation efficiency, and surface actionable insights for healthcare professionals—including clinicians, nurses, and radiologists. Dragon Copilot activity logs represent administrative and user-level events (e.g., interactions, generated outputs, and system actions), making this connector the central ingestion point for admin, audit, and operational logs for the Dragon Copilot workload. Within the Sentinel integration context, Dragon Copilot emits audit and activity signals representing user interactions and system-generated outputs. These signals enable security monitoring, compliance auditing, and operational visibility across healthcare workflows.", + "Data Connectors": [ + "Data Connectors/DragonCopilotNative_ConnectorDefinition.json" + ], + "BasePath": "Solutions/DragonCopilot", + "Version": "3.0.0", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": false, + "StaticDataConnector": true +} diff --git a/Solutions/DragonCopilot/DragonCopilotDataConnector_README.md b/Solutions/DragonCopilot/DragonCopilotDataConnector_README.md new file mode 100644 index 00000000000..b8e3d139d68 --- /dev/null +++ b/Solutions/DragonCopilot/DragonCopilotDataConnector_README.md @@ -0,0 +1,234 @@ +# Microsoft Dragon Copilot — Microsoft Sentinel Data Connector + +## Overview + +Microsoft Dragon Copilot is an AI-powered clinical assistant that captures and processes clinician interactions to generate structured clinical documentation and activity records. It leverages conversational, ambient, and generative AI to streamline clinical workflows and surface actionable insights for healthcare professionals — including clinicians, nurses, and radiologists. + +This connector ingests Dragon Copilot **audit and activity logs** into Microsoft Sentinel via the Office Management API. The logs are stored in the standard **`DragonCopilot`** table in your Log Analytics workspace and enable: + +- **Security monitoring** — detect anomalous access patterns and suspicious activity. +- **Compliance auditing** — maintain audit trails for HIPAA and organizational policies. +- **Operational visibility** — track usage, sessions, and system actions across clinical workflows. + +> **Note:** This connector is currently in **Preview**. + +--- + +## Prerequisites + +Before deploying the connector, ensure you have the following: + +| Requirement | Details | +|---|---| +| **Microsoft Sentinel workspace** | An active Log Analytics workspace with Microsoft Sentinel enabled. | +| **Permissions** | `Security Administrator` or `Global Administrator` role on the tenant. Read, write, and delete permissions on the Log Analytics workspace. | +| **Dragon Copilot license** | An active Microsoft Dragon Copilot subscription with audit logging enabled in your tenant. | +| **Azure subscription** | An Azure subscription linked to the tenant where Dragon Copilot is provisioned. | + +--- + +## Deployment Steps (ARM Template — Current) + +The Dragon Copilot connector is not yet available in the Microsoft Sentinel Content Hub. During this initial phase, the connector can be deployed by running the provided ARM template directly. + +### Step 1 — Deploy the ARM Template + +**Option A — Azure Portal (Custom Deployment):** + +1. In the [Azure portal](https://portal.azure.com), search for **Deploy a custom template** and select it. +2. Click **Build your own template in the editor**. +3. Load the `mainTemplate.json` file provided to you (paste or upload). +4. Click **Save**. +5. Fill in the required parameters: + + | Parameter | Description | + |---|---| + | **Subscription** | The Azure subscription where your Sentinel workspace resides. | + | **Resource Group** | The resource group containing your Log Analytics workspace. | + | **Workspace** | The name of your Log Analytics workspace with Microsoft Sentinel enabled. | + | **Workspace Location** | The region of your Log Analytics workspace (e.g., `eastus`, `westeurope`). | + +6. Click **Review + create** → **Create**. +7. Wait for the deployment to complete (typically 1–2 minutes). + +**Option B — Azure CLI:** + +```bash +az deployment group create \ + --resource-group \ + --template-file mainTemplate.json \ + --parameters workspace= workspace-location= +``` + +**Option C — PowerShell:** + +```powershell +New-AzResourceGroupDeployment ` + -ResourceGroupName "" ` + -TemplateFile "mainTemplate.json" ` + -workspace "" ` + -workspace-location "" +``` + +The deployment creates the following resources in your workspace: + +| Resource | Purpose | +|---|---| +| **Data Connector Definition** (`DragonCopilot`) | Registers the connector in the Sentinel Data Connectors gallery. | +| **Standard Table** (`DragonCopilot`) | Log Analytics table that stores the ingested audit records. | +| **Data Collection Rule** (`DragonCopilot-DCR`) | Routes data from the Office Management API to the standard table. | +| **Polling Configuration** (`DragonCopilotPolling`) | Defines the polling schedule and retry behavior for data ingestion. | + +### Step 2 — Connect the Data Connector + +1. In Microsoft Sentinel, go to **Data connectors** (under *Configuration*). +2. Search for **Dragon Copilot** and select it. +3. Click **Open connector page**. +4. Review the description and prerequisites. +5. Click the **Connect** button. +6. Wait for the status to change to **Connected** (this may take a few minutes). + +### Step 3 — Verify Data Ingestion + +After connecting, allow **15–30 minutes** for initial data to arrive. Then verify: + +1. Navigate to **Logs** in your Sentinel workspace. +2. Run the following KQL query: + + ```kql + DragonCopilot + | sort by TimeGenerated desc + | take 10 + ``` + +3. Confirm that records are appearing with expected fields such as `Operation`, `UserId`, `RecordType`, and `ResultStatus`. + +You can also verify from the connector page — the **Data received** graph should show incoming data. + +--- + +## Data - `DragonCopilot` + +The table contains four categories of records, identified by `RecordType`: + +| RecordType | Name | Description | +|---|---|---| +| **454** | Admin | Administrative operations (configuration changes, policy updates). | +| **468** | Access | User authentication and access events. | +| **469** | ClinicalData | Clinical data generation and interaction events. | +| **470** | Session | Session lifecycle events (start, end, disconnect). | + +--- + +## Sample KQL Queries + +### All Dragon Copilot logs (most recent first) + +```kql +DragonCopilot +| sort by TimeGenerated desc +``` + +### Failed operations + +```kql +DragonCopilot +| where ResultStatus == "Failed" +| summarize FailureCount = count() by Operation, UserId +| order by FailureCount desc +``` + +### Access events by authentication method + +```kql +DragonCopilot +| where RecordType == 468 +| summarize Count = count() by AuthenticationMethod, HostType +| order by Count desc +``` + +--- + +## Migrating from the preview custom-table deployment + +If you previously deployed the preview connector that wrote to `DragonCopilot_CL`, disconnect it before enabling this connector to avoid duplicate data ingestion and unnecessary costs. Historical data remains in the custom table until you explicitly remove it. + +### Step 1 — Disconnect the Custom Connector + +1. In Microsoft Sentinel, go to **Data connectors**. +2. Search for **Dragon Copilot** and select the custom connector. +3. Click **Open connector page**. +4. Click **Disconnect**. +5. Confirm the disconnection. + +### Step 2 — Delete the ARM Deployment Resources + +Since the connector was deployed via ARM template (not Content Hub), you need to manually remove the deployed resources. + +**Delete the Data Connector:** + +1. In Microsoft Sentinel, go to **Data connectors**. +2. Find the disconnected **Dragon Copilot** connector. +3. If a delete option is available, use it. Otherwise, use the CLI commands below. + +**Delete the Data Collection Rule:** + +1. In the Azure portal, go to **Monitor** → **Data Collection Rules**. +2. Search for `DragonCopilot-DCR`. +3. Select it and click **Delete**. + +**Delete the Custom Table** (optional — only if you no longer need historical data): + +*Option A — Azure Portal:* + +1. Navigate to your **Log Analytics workspace**. +2. Go to **Settings** → **Tables**. +3. Search for `DragonCopilot_CL`. +4. Click the context menu (**...**) and select **Delete**. + +*Option B — Azure CLI:* + +```bash +az monitor log-analytics workspace table delete \ + --resource-group \ + --workspace-name \ + --name DragonCopilot_CL +``` + +*Option C — PowerShell:* + +```powershell +Remove-AzOperationalInsightsTable ` + -ResourceGroupName "" ` + -WorkspaceName "" ` + -TableName "DragonCopilot_CL" +``` + +> **Important:** Deleting the table permanently removes all historical data. If you need to retain the data for compliance or investigation purposes, export it first or adjust the retention period before deleting. + +### Step 3 - Install the Standard Connector from Content Hub + +1. In Microsoft Sentinel, go to **Content hub** (under *Content management*). +2. Search for **Dragon Copilot**. +3. Select the solution and click **Install / Update**. +4. Choose the target **Subscription**, **Resource Group**, and **Workspace**, then click **Review + create** → **Create**. + +### Step 4 - Connect the Standard Connector + +1. Go to **Data connectors** in Microsoft Sentinel. +2. Locate the new standard **Dragon Copilot** connector (built-in). +3. Click **Open connector page** and follow the on-screen instructions to connect. +4. Verify data is flowing into the new standard table. + +--- + +## Troubleshooting + +| Issue | Resolution | +|---|---| +| Connector shows **Disconnected** | Verify that Dragon Copilot audit logging is enabled in your tenant and that you have the required permissions. Re-click **Connect**. | +| No data in `DragonCopilot` | Allow up to 30 minutes for initial ingestion. Check that the DCR and Data Collection Endpoint are healthy under **Monitor** -> **Data Collection Rules**. | +| Permission errors during install | Ensure you have `Security Administrator` or `Global Administrator` role, plus workspace read/write/delete permissions. | + +--- + diff --git a/Solutions/DragonCopilot/Package/3.0.0.zip b/Solutions/DragonCopilot/Package/3.0.0.zip new file mode 100644 index 00000000000..6f5f30cee29 Binary files /dev/null and b/Solutions/DragonCopilot/Package/3.0.0.zip differ diff --git a/Solutions/DragonCopilot/Package/createUiDefinition.json b/Solutions/DragonCopilot/Package/createUiDefinition.json new file mode 100644 index 00000000000..14757484495 --- /dev/null +++ b/Solutions/DragonCopilot/Package/createUiDefinition.json @@ -0,0 +1,85 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#", + "handler": "Microsoft.Azure.CreateUIDef", + "version": "0.1.2-preview", + "parameters": { + "config": { + "isWizard": false, + "basics": { + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/DragonCopilot/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nMicrosoft Dragon Copilot is an AI-powered clinical assistant that captures and processes clinician interactions to generate structured clinical documentation and activity records. It leverages conversational, ambient, and generative AI to streamline clinical workflows, improve documentation efficiency, and surface actionable insights for healthcare professionals—including clinicians, nurses, and radiologists. Dragon Copilot activity logs represent administrative and user-level events (e.g., interactions, generated outputs, and system actions), making this connector the central ingestion point for admin, audit, and operational logs for the Dragon Copilot workload. Within the Sentinel integration context, Dragon Copilot emits audit and activity signals representing user interactions and system-generated outputs. These signals enable security monitoring, compliance auditing, and operational visibility across healthcare workflows.\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "subscription": { + "resourceProviders": [ + "Microsoft.OperationsManagement/solutions", + "Microsoft.OperationalInsights/workspaces/providers/alertRules", + "Microsoft.Insights/workbooks", + "Microsoft.Logic/workflows" + ] + }, + "location": { + "metadata": { + "hidden": "Hiding location, we get it from the log analytics workspace" + }, + "visible": false + }, + "resourceGroup": { + "allowExisting": true + } + } + }, + "basics": [ + { + "name": "getLAWorkspace", + "type": "Microsoft.Solutions.ArmApiControl", + "toolTip": "This filters by workspaces that exist in the Resource Group selected", + "condition": "[greater(length(resourceGroup().name),0)]", + "request": { + "method": "GET", + "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]" + } + }, + { + "name": "workspace", + "type": "Microsoft.Common.DropDown", + "label": "Workspace", + "placeholder": "Select a workspace", + "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected", + "constraints": { + "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]", + "required": true + }, + "visible": true + } + ], + "steps": [ + { + "name": "dataconnectors", + "label": "Data Connectors", + "bladeTitle": "Data Connectors", + "elements": [ + { + "name": "dataconnectors1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Solution installs the data connector for Dragon Copilot. You can get Dragon Copilot data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + } + }, + { + "name": "dataconnectors-link1", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more about connecting data sources", + "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources" + } + } + } + ] + } + ], + "outputs": { + "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", + "location": "[location()]", + "workspace": "[basics('workspace')]" + } + } +} diff --git a/Solutions/DragonCopilot/Package/mainTemplate.json b/Solutions/DragonCopilot/Package/mainTemplate.json new file mode 100644 index 00000000000..873a630970e --- /dev/null +++ b/Solutions/DragonCopilot/Package/mainTemplate.json @@ -0,0 +1,519 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "author": "Microsoft - support@microsoft.com", + "comments": "Solution template for DragonCopilot" + }, + "parameters": { + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } + } + }, + "variables": { + "email": "support@microsoft.com", + "_email": "[variables('email')]", + "_solutionName": "DragonCopilot", + "_solutionVersion": "3.0.0", + "solutionId": "azuresentinel.azure-sentinel-solution-dragoncopilot", + "_solutionId": "[variables('solutionId')]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "dataConnectorCCPVersion": "3.0.0", + "_dataConnectorContentIdConnectorDefinition1": "DragonCopilotNative", + "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]", + "_dataConnectorContentIdConnections1": "DragonCopilotNativeConnections", + "dataConnectorTemplateNameConnections1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections1')))]", + "dataCollectionEndpointId1": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]", + "blanks": "[replace('b', 'b', '')]", + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition1'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", + "displayName": "Dragon Copilot", + "contentKind": "DataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "DragonCopilotNative", + "title": "Dragon Copilot", + "publisher": "Microsoft", + "logo": "DragonCopilot.svg", + "descriptionMarkdown": "Microsoft Dragon Copilot is an AI-powered clinical assistant that captures and processes clinician interactions to generate structured clinical documentation and activity records. It leverages conversational, ambient, and generative AI to streamline clinical workflows, improve documentation efficiency, and surface actionable insights for healthcare professionals—including clinicians, nurses, and radiologists. Dragon Copilot activity logs represent administrative and user-level events (e.g., interactions, generated outputs, and system actions), making this connector the central ingestion point for admin, audit, and operational logs for the Dragon Copilot workload. Within the Sentinel integration context, Dragon Copilot emits audit and activity signals representing user interactions and system-generated outputs. These signals enable security monitoring, compliance auditing, and operational visibility across healthcare workflows.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "Dragon Copilot", + "baseQuery": "DragonCopilot" + } + ], + "sampleQueries": [ + { + "description": "Dragon Copilot Logs", + "query": "DragonCopilot\n | sort by TimeGenerated" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "dataTypes": [ + { + "name": "DragonCopilot", + "lastDataReceivedQuery": "DragonCopilot\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "availability": { + "status": 1, + "isPreview": true + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "Tenant Permissions", + "description": "'Security Administrator' or 'Global Administrator' on the workspace's tenant." + } + ] + }, + "instructionSteps": [ + { + "title": "Connect Dragon Copilot audit logs to Microsoft Sentinel", + "description": "This connector uses the Office Management API to get your Dragon Copilot audit logs. The logs will be stored and processed in your existing Microsoft Sentinel workspace. You can find the data in the **DragonCopilot** table.", + "instructions": [ + { + "type": "ConnectionToggleButton", + "parameters": { + "connectLabel": "Connect", + "name": "toggle" + } + } + ] + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "name": "DragonCopilotNative-DCR", + "apiVersion": "2022-06-01", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "[parameters('workspace-location')]", + "kind": "[variables('blanks')]", + "properties": { + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "[variables('workspaceResourceId')]", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Microsoft-DragonCopilot" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source", + "outputStream": "Microsoft-DragonCopilot" + } + ], + "dataCollectionEndpointId": "[variables('dataCollectionEndpointId1')]" + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition1'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "DragonCopilotNative", + "title": "Dragon Copilot", + "publisher": "Microsoft", + "logo": "DragonCopilot.svg", + "descriptionMarkdown": "Microsoft Dragon Copilot is an AI-powered clinical assistant that captures and processes clinician interactions to generate structured clinical documentation and activity records. It leverages conversational, ambient, and generative AI to streamline clinical workflows, improve documentation efficiency, and surface actionable insights for healthcare professionals—including clinicians, nurses, and radiologists. Dragon Copilot activity logs represent administrative and user-level events (e.g., interactions, generated outputs, and system actions), making this connector the central ingestion point for admin, audit, and operational logs for the Dragon Copilot workload. Within the Sentinel integration context, Dragon Copilot emits audit and activity signals representing user interactions and system-generated outputs. These signals enable security monitoring, compliance auditing, and operational visibility across healthcare workflows.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "Dragon Copilot", + "baseQuery": "DragonCopilot" + } + ], + "sampleQueries": [ + { + "description": "Dragon Copilot Logs", + "query": "DragonCopilot\n | sort by TimeGenerated" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "dataTypes": [ + { + "name": "DragonCopilot", + "lastDataReceivedQuery": "DragonCopilot\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "availability": { + "status": 1, + "isPreview": true + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "Tenant Permissions", + "description": "'Security Administrator' or 'Global Administrator' on the workspace's tenant." + } + ] + }, + "instructionSteps": [ + { + "title": "Connect Dragon Copilot audit logs to Microsoft Sentinel", + "description": "This connector uses the Office Management API to get your Dragon Copilot audit logs. The logs will be stored and processed in your existing Microsoft Sentinel workspace. You can find the data in the **DragonCopilot** table.", + "instructions": [ + { + "type": "ConnectionToggleButton", + "parameters": { + "connectLabel": "Connect", + "name": "toggle" + } + } + ] + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections1'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "displayName": "Dragon Copilot", + "contentKind": "ResourcesDataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": { + "guidValue": { + "defaultValue": "[[newGuid()]", + "type": "securestring" + }, + "innerWorkspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "connectorDefinitionName": { + "defaultValue": "Dragon Copilot", + "type": "securestring", + "minLength": 1 + }, + "workspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "dcrConfig": { + "defaultValue": { + "dataCollectionEndpoint": "data collection Endpoint", + "dataCollectionRuleImmutableId": "data collection rule immutableId" + }, + "type": "object" + } + }, + "variables": { + "_dataConnectorContentIdConnections1": "[variables('_dataConnectorContentIdConnections1')]" + }, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections1')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections1'))]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + }, + { + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'DragonCopilotNativePolling', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "PurviewAudit", + "properties": { + "connectorDefinitionName": "DragonCopilotNative", + "TenantId": "[[subscription().tenantId]", + "SourceType": "DragonCopilot", + "DataTypes": { + "Logs": { + "state": "Enabled" + } + }, + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "DRAGON_COPILOT" + }, + "request": { + "RetryCount": 1 + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections1'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", + "location": "[parameters('workspace-location')]", + "properties": { + "version": "3.0.0", + "kind": "Solution", + "contentSchemaVersion": "3.0.0", + "displayName": "DragonCopilot", + "publisherDisplayName": "Microsoft Sentinel, Microsoft", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Microsoft Dragon Copilot is an AI-powered clinical assistant that captures and processes clinician interactions to generate structured clinical documentation and activity records. It leverages conversational, ambient, and generative AI to streamline clinical workflows, improve documentation efficiency, and surface actionable insights for healthcare professionals—including clinicians, nurses, and radiologists. Dragon Copilot activity logs represent administrative and user-level events (e.g., interactions, generated outputs, and system actions), making this connector the central ingestion point for admin, audit, and operational logs for the Dragon Copilot workload. Within the Sentinel integration context, Dragon Copilot emits audit and activity signals representing user interactions and system-generated outputs. These signals enable security monitoring, compliance auditing, and operational visibility across healthcare workflows.

\n

Data Connectors: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", + "contentId": "[variables('_solutionId')]", + "parentId": "[variables('_solutionId')]", + "source": { + "kind": "Solution", + "name": "DragonCopilot", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "version": "[variables('dataConnectorCCPVersion')]" + } + ] + }, + "firstPublishDate": "2026-07-30", + "providers": [ + "Microsoft" + ], + "categories": { + "domains": [ + "Application" + ], + "verticals": [ + "Healthcare" + ] + } + }, + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" + } + ], + "outputs": {} +} diff --git a/Solutions/DragonCopilot/Package/testParameters.json b/Solutions/DragonCopilot/Package/testParameters.json new file mode 100644 index 00000000000..554801e41b7 --- /dev/null +++ b/Solutions/DragonCopilot/Package/testParameters.json @@ -0,0 +1,38 @@ +{ + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } + } +} diff --git a/Solutions/DragonCopilot/ReleaseNotes.md b/Solutions/DragonCopilot/ReleaseNotes.md new file mode 100644 index 00000000000..bdbf8e05797 --- /dev/null +++ b/Solutions/DragonCopilot/ReleaseNotes.md @@ -0,0 +1,3 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|---|---|---| +| 3.0.0 | 30-07-2026 | Releasing a new Microsoft Dragon Copilot solution in Content Hub with a **Data Connector** that ingests Dragon Copilot audit and activity logs into the standard **DragonCopilot** table | diff --git a/Solutions/DragonCopilot/SolutionMetadata.json b/Solutions/DragonCopilot/SolutionMetadata.json new file mode 100644 index 00000000000..7160e03bcf7 --- /dev/null +++ b/Solutions/DragonCopilot/SolutionMetadata.json @@ -0,0 +1,16 @@ +{ + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-solution-dragoncopilot", + "firstPublishDate": "2026-07-30", + "providers": ["Microsoft"], + "categories": { + "domains": ["Application"], + "verticals": ["Healthcare"] + }, + "support": { + "name": "Microsoft", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } +} diff --git a/Tools/Create-Azure-Sentinel-Solution/common/standardLogStreams.ps1 b/Tools/Create-Azure-Sentinel-Solution/common/standardLogStreams.ps1 index 57d3827b3ff..cf4acb5f0a8 100644 --- a/Tools/Create-Azure-Sentinel-Solution/common/standardLogStreams.ps1 +++ b/Tools/Create-Azure-Sentinel-Solution/common/standardLogStreams.ps1 @@ -37,6 +37,7 @@ $standardStreamMapping += @{ Key = 'COMPUTER_GROUP_BLOB'; Value = 'Microsoft-Com $standardStreamMapping += @{ Key = 'SENTINEL_WATCHLIST'; Value = 'Microsoft-Watchlist' } $standardStreamMapping += @{ Key = 'OFFICEDATAVERSE_RESTAPI'; Value = 'Microsoft-DataverseActivity' } $standardStreamMapping += @{ Key = 'LLMACTIVITY_RESTAPI'; Value = 'Microsoft-CopilotActivity' } +$standardStreamMapping += @{ Key = 'DRAGON_COPILOT'; Value = 'Microsoft-DragonCopilot' } $standardStreamMapping += @{ Key = 'TENANTMICROSOFTWINDOWSDEFENDERATP_ADVANCEDHUNTINGDEVICEEVENTS'; Value = 'Microsoft-DeviceEvents' } $standardStreamMapping += @{ Key = 'TENANTMICROSOFTWINDOWSDEFENDERATP_ADVANCEDHUNTINGDEVICEFILECERTIFICATEINFO'; Value = 'Microsoft-DeviceFileCertificateInfo' } $standardStreamMapping += @{ Key = 'TENANTMICROSOFTWINDOWSDEFENDERATP_ADVANCEDHUNTINGDEVICEFILEEVENTS'; Value = 'Microsoft-DeviceFileEvents' }