Add Microsoft Dragon Copilot solution with standard-table data connector

Solutions/DragonCopilot/Data Connectors/DragonCopilotNative_ConnectorDefinition.json

@@ -0,0 +1,80 @@
+{
+    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
+    "apiVersion": "2024-09-01",
+    "name": "DragonCopilotNative",
+    "location": "{{location}}",
+    "kind": "Customizable",
+    "properties": {
+        "connectorUiConfig": {
+            "id": "DragonCopilotNative",
+            "title": "Dragon Copilot",
+            "publisher": "Microsoft",
+            "logo": "DragonCopilot.svg",
+            "descriptionMarkdown": "Microsoft Dragon Copilot is an AI-powered clinical assistant that captures and processes clinician interactions to generate structured clinical documentation and activity records. It leverages conversational, ambient, and generative AI to streamline clinical workflows, improve documentation efficiency, and surface actionable insights for healthcare professionals—including clinicians, nurses, and radiologists. Dragon Copilot activity logs represent administrative and user-level events (e.g., interactions, generated outputs, and system actions), making this connector the central ingestion point for admin, audit, and operational logs for the Dragon Copilot workload. Within the Sentinel integration context, Dragon Copilot emits audit and activity signals representing user interactions and system-generated outputs. These signals enable security monitoring, compliance auditing, and operational visibility across healthcare workflows.",
+            "graphQueries": [
+                {
+                    "metricName": "Total data received",
+                    "legend": "Dragon Copilot",
+                    "baseQuery": "DragonCopilot"
+                }
+            ],
+            "sampleQueries": [
+                {
+                    "description": "Dragon Copilot Logs",
+                    "query": "DragonCopilot\n            | sort by TimeGenerated"
+                }
+            ],
+            "connectivityCriteria": [
+                {
+                    "type": "HasDataConnectors"
+                }
+            ],
+            "dataTypes": [
+                {
+                    "name": "DragonCopilot",
+                    "lastDataReceivedQuery": "DragonCopilot\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                }
+            ],
+            "availability": {
+                "status": 1,
+                "isPreview": true
+            },
+            "permissions": {
+                "resourceProvider": [
+                    {
+                        "provider": "Microsoft.OperationalInsights/workspaces",
+                        "permissionsDisplayText": "read and write permissions.",
+                        "providerDisplayName": "Workspace",
+                        "scope": "Workspace",
+                        "requiredPermissions": {
+                            "read": true,
+                            "write": true,
+                            "delete": true
+                        }
+                    }
+                ],
+                "customs": [
+                    {
+                        "name": "Tenant Permissions",
+                        "description": "'Security Administrator' or 'Global Administrator' on the workspace's tenant."
+                    }
+                ]
+            },
+            "instructionSteps": [
+                {
+                    "title": "Connect Dragon Copilot audit logs to Microsoft Sentinel",
+                    "description": "This connector uses the Office Management API to get your Dragon Copilot audit logs. The logs will be stored and processed in your existing Microsoft Sentinel workspace. You can find the data in the **DragonCopilot** table.",
+                    "instructions": [
+                        {
+                            "type": "ConnectionToggleButton",
+                            "parameters": {
+                                "connectLabel": "Connect",
+                                "name": "toggle"
+                            }
+                        }
+                    ]
+                }
+            ]
+        }
+    }
+}

Solutions/DragonCopilot/Data Connectors/DragonCopilotNative_DCR.json

@@ -0,0 +1,31 @@
+[
+    {
+        "name": "DragonCopilotNative-DCR",
+        "apiVersion": "2023-03-11",
+        "type": "Microsoft.Insights/dataCollectionRules",
+        "location": "{{location}}",
+        "properties": {
+            "destinations": {
+                "logAnalytics": [
+                    {
+                        "workspaceResourceId": "{{workspaceResourceId}}",
+                        "name": "clv2ws1"
+                    }
+                ]
+            },
+            "dataFlows": [
+                {
+                    "streams": [
+                        "Microsoft-DragonCopilot"
+                    ],
+                    "destinations": [
+                        "clv2ws1"
+                    ],
+                    "transformKql": "source",
+                    "outputStream": "Microsoft-DragonCopilot"
+                }
+            ],
+            "dataCollectionEndpointId": "{{dataCollectionEndpointId}}"
+        }
+    }
+]

Solutions/DragonCopilot/Data Connectors/DragonCopilotNative_PollingConfig.json

@@ -0,0 +1,25 @@
+{
+    "name": "DragonCopilotNativePolling",
+    "apiVersion": "2024-09-01",
+    "type": "Microsoft.SecurityInsights/dataConnectors",
+    "location": "{{location}}",
+    "kind": "PurviewAudit",
+    "properties": {
+        "connectorDefinitionName": "DragonCopilotNative",
+        "TenantId": "{{tenantId}}",
+        "SourceType": "DragonCopilot",
+        "DataTypes": {
+            "Logs": {
+                "state": "Enabled"
+            }
+        },
+        "dcrConfig": {
+            "dataCollectionEndpoint": "{{dataCollectionEndpoint}}",
+            "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}",
+            "streamName": "DRAGON_COPILOT"
+        },
+        "request": {
+            "RetryCount": 1
+        }
+    }
+}

Solutions/DragonCopilot/Data/Solution_DragonCopilot.json

@@ -0,0 +1,14 @@
+{
+  "Name": "DragonCopilot",
+  "Author": "Microsoft - support@microsoft.com",
+  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/DragonCopilot_logo.svg\" width=\"75px\" height=\"75px\">",
+  "Description": "Microsoft Dragon Copilot is an AI-powered clinical assistant that captures and processes clinician interactions to generate structured clinical documentation and activity records. It leverages conversational, ambient, and generative AI to streamline clinical workflows, improve documentation efficiency, and surface actionable insights for healthcare professionals—including clinicians, nurses, and radiologists. Dragon Copilot activity logs represent administrative and user-level events (e.g., interactions, generated outputs, and system actions), making this connector the central ingestion point for admin, audit, and operational logs for the Dragon Copilot workload. Within the Sentinel integration context, Dragon Copilot emits audit and activity signals representing user interactions and system-generated outputs. These signals enable security monitoring, compliance auditing, and operational visibility across healthcare workflows.",
+  "Data Connectors": [
+    "Data Connectors/DragonCopilotNative_ConnectorDefinition.json"
+  ],
+  "BasePath": "Solutions/DragonCopilot",
+  "Version": "3.0.0",
+  "Metadata": "SolutionMetadata.json",
+  "TemplateSpec": false,
+  "StaticDataConnector": true
+}