Skip to content

Commit 74a2a63

Browse files
Shreyas-MicrosoftCopilot
Shreyas-Microsoft
and
Copilot
committed
fix(infra): apply DCR review feedback from PR #244 (ADO #43311)
Address review comments from @Harsh-Microsoft on PR #244: - xPathQueries: broaden the Windows Security filter to use the audit Keywords bitmask (0x30000000000000 = AuditSuccess|AuditFailure) and exclude the very high-volume EventID 4624 (successful logon). The new filter captures all audit success and audit failure events (which is what the SFI item actually asks for), not just 4624/4625, while keeping ingestion cost sane. - dataSources: add a small Microsoft-Perf set (CPU, memory, disk, network) to the same DCR so the jumpbox VM also produces a baseline VM health signal alongside the security audit stream. - dcrLogAnalyticsDestinationName: extract the destination name to a variable (\la-<lawName>-destination\) and reference it from the destinations.logAnalytics entry and both dataFlows (SecurityEvent and Perf) so the name is defined once. Applied to both infra/main.bicep and infra/main_custom.bicep, and regenerated infra/main.json from main.bicep. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent e9215d2 commit 74a2a63

3 files changed

Lines changed: 112 additions & 23 deletions

File tree

‎infra/main.bicep‎

Lines changed: 40 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -433,16 +433,21 @@ module jumpboxVM 'br/public:avm/res/compute/virtual-machine:0.15.0' = if (enable
433433
}
434434
}
435435

436-
// SFI: data collection rule that captures Windows Security audit success
437-
// (EventID 4624) and audit failure (EventID 4625) events from the jumpbox VM
438-
// and routes them to Log Analytics via the Microsoft-SecurityEvent stream.
439-
// The SecurityEvent table is auto-provisioned by Azure Monitor on first
440-
// ingestion via the DCR; no legacy OMSGallery/Security solution is needed.
441-
// (ADO #43311)
436+
// SFI: data collection rule that captures Windows Security audit success and
437+
// audit failure events from the jumpbox VM and routes them to Log Analytics
438+
// via the Microsoft-SecurityEvent stream. The xPath filter uses the Windows
439+
// audit Keywords bitmask (0x30000000000000 = AuditSuccess|AuditFailure) and
440+
// excludes EventID 4624 (successful logon) because it is extremely
441+
// high-volume. Also collects a small set of Windows performance counters via
442+
// Microsoft-Perf for the jumpbox so the same DCR provides basic VM health
443+
// signal. The SecurityEvent / Perf tables are auto-provisioned by Azure
444+
// Monitor on first ingestion via the DCR; no legacy OMSGallery/Security
445+
// solution is needed. (ADO #43311)
442446
var dataCollectionRulesResourceName = 'dcr-${solutionSuffix}'
443447
var dataCollectionRulesLocation = useExistingLogAnalytics
444448
? existingLogAnalyticsWorkspace!.location
445449
: logAnalyticsWorkspace!.outputs.location
450+
var dcrLogAnalyticsDestinationName = 'la-${logAnalyticsWorkspaceResourceName}-destination'
446451
module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-rule:0.11.0' = if (enablePrivateNetworking && enableMonitoring) {
447452
name: take('avm.res.insights.data-collection-rule.${dataCollectionRulesResourceName}', 64)
448453
params: {
@@ -460,7 +465,25 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
460465
'Microsoft-SecurityEvent'
461466
]
462467
xPathQueries: [
463-
'Security!*[System[(EventID=4624 or EventID=4625)]]'
468+
'Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]'
469+
]
470+
}
471+
]
472+
performanceCounters: [
473+
{
474+
name: 'VMPerfCounters'
475+
streams: [
476+
'Microsoft-Perf'
477+
]
478+
samplingFrequencyInSeconds: 60
479+
counterSpecifiers: [
480+
'\\Processor Information(_Total)\\% Processor Time'
481+
'\\Memory\\% Committed Bytes In Use'
482+
'\\Memory\\Available Bytes'
483+
'\\LogicalDisk(_Total)\\% Free Space'
484+
'\\LogicalDisk(_Total)\\Disk Reads/sec'
485+
'\\LogicalDisk(_Total)\\Disk Writes/sec'
486+
'\\Network Interface(*)\\Bytes Total/sec'
464487
]
465488
}
466489
]
@@ -469,7 +492,7 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
469492
logAnalytics: [
470493
{
471494
workspaceResourceId: logAnalyticsWorkspaceResourceId
472-
name: 'la-${dataCollectionRulesResourceName}'
495+
name: dcrLogAnalyticsDestinationName
473496
}
474497
]
475498
}
@@ -479,7 +502,15 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
479502
'Microsoft-SecurityEvent'
480503
]
481504
destinations: [
482-
'la-${dataCollectionRulesResourceName}'
505+
dcrLogAnalyticsDestinationName
506+
]
507+
}
508+
{
509+
streams: [
510+
'Microsoft-Perf'
511+
]
512+
destinations: [
513+
dcrLogAnalyticsDestinationName
483514
]
484515
}
485516
]

‎infra/main.json‎

Lines changed: 32 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"_generator": {
77
"name": "bicep",
88
"version": "0.43.8.12551",
9-
"templateHash": "1952959724829141031"
9+
"templateHash": "7325892054668959743"
1010
}
1111
},
1212
"parameters": {
@@ -272,6 +272,7 @@
272272
"bastionHostName": "[format('bas-{0}', variables('solutionSuffix'))]",
273273
"jumpboxVmName": "[take(format('vm-jumpbox-{0}', variables('solutionSuffix')), 15)]",
274274
"dataCollectionRulesResourceName": "[format('dcr-{0}', variables('solutionSuffix'))]",
275+
"dcrLogAnalyticsDestinationName": "[format('la-{0}-destination', variables('logAnalyticsWorkspaceResourceName'))]",
275276
"processBlobContainerName": "processes",
276277
"processQueueName": "processes-queue",
277278
"privateDnsZones": [
@@ -17209,7 +17210,25 @@
1720917210
"Microsoft-SecurityEvent"
1721017211
],
1721117212
"xPathQueries": [
17212-
"Security!*[System[(EventID=4624 or EventID=4625)]]"
17213+
"Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]"
17214+
]
17215+
}
17216+
],
17217+
"performanceCounters": [
17218+
{
17219+
"name": "VMPerfCounters",
17220+
"streams": [
17221+
"Microsoft-Perf"
17222+
],
17223+
"samplingFrequencyInSeconds": 60,
17224+
"counterSpecifiers": [
17225+
"\\Processor Information(_Total)\\% Processor Time",
17226+
"\\Memory\\% Committed Bytes In Use",
17227+
"\\Memory\\Available Bytes",
17228+
"\\LogicalDisk(_Total)\\% Free Space",
17229+
"\\LogicalDisk(_Total)\\Disk Reads/sec",
17230+
"\\LogicalDisk(_Total)\\Disk Writes/sec",
17231+
"\\Network Interface(*)\\Bytes Total/sec"
1721317232
]
1721417233
}
1721517234
]
@@ -17218,7 +17237,7 @@
1721817237
"logAnalytics": [
1721917238
{
1722017239
"workspaceResourceId": "[if(variables('useExistingLogAnalytics'), parameters('existingLogAnalyticsWorkspaceId'), reference('logAnalyticsWorkspace').outputs.resourceId.value)]",
17221-
"name": "[format('la-{0}', variables('dataCollectionRulesResourceName'))]"
17240+
"name": "[variables('dcrLogAnalyticsDestinationName')]"
1722217241
}
1722317242
]
1722417243
},
@@ -17228,7 +17247,15 @@
1722817247
"Microsoft-SecurityEvent"
1722917248
],
1723017249
"destinations": [
17231-
"[format('la-{0}', variables('dataCollectionRulesResourceName'))]"
17250+
"[variables('dcrLogAnalyticsDestinationName')]"
17251+
]
17252+
},
17253+
{
17254+
"streams": [
17255+
"Microsoft-Perf"
17256+
],
17257+
"destinations": [
17258+
"[variables('dcrLogAnalyticsDestinationName')]"
1723217259
]
1723317260
}
1723417261
]
@@ -35134,8 +35161,8 @@
3513435161
"dependsOn": [
3513535162
"aiFoundryAiServices",
3513635163
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]",
35137-
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').aiServices)]",
3513835164
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').openAI)]",
35165+
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').aiServices)]",
3513935166
"virtualNetwork"
3514035167
]
3514135168
},

‎infra/main_custom.bicep‎

Lines changed: 40 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -411,16 +411,21 @@ module jumpboxVM 'br/public:avm/res/compute/virtual-machine:0.15.0' = if (enable
411411
}
412412
}
413413

414-
// SFI: data collection rule that captures Windows Security audit success
415-
// (EventID 4624) and audit failure (EventID 4625) events from the jumpbox VM
416-
// and routes them to Log Analytics via the Microsoft-SecurityEvent stream.
417-
// The SecurityEvent table is auto-provisioned by Azure Monitor on first
418-
// ingestion via the DCR; no legacy OMSGallery/Security solution is needed.
419-
// (ADO #43311)
414+
// SFI: data collection rule that captures Windows Security audit success and
415+
// audit failure events from the jumpbox VM and routes them to Log Analytics
416+
// via the Microsoft-SecurityEvent stream. The xPath filter uses the Windows
417+
// audit Keywords bitmask (0x30000000000000 = AuditSuccess|AuditFailure) and
418+
// excludes EventID 4624 (successful logon) because it is extremely
419+
// high-volume. Also collects a small set of Windows performance counters via
420+
// Microsoft-Perf for the jumpbox so the same DCR provides basic VM health
421+
// signal. The SecurityEvent / Perf tables are auto-provisioned by Azure
422+
// Monitor on first ingestion via the DCR; no legacy OMSGallery/Security
423+
// solution is needed. (ADO #43311)
420424
var dataCollectionRulesResourceName = 'dcr-${solutionSuffix}'
421425
var dataCollectionRulesLocation = useExistingLogAnalytics
422426
? existingLogAnalyticsWorkspace!.location
423427
: logAnalyticsWorkspace!.outputs.location
428+
var dcrLogAnalyticsDestinationName = 'la-${logAnalyticsWorkspaceResourceName}-destination'
424429
module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-rule:0.11.0' = if (enablePrivateNetworking && enableMonitoring) {
425430
name: take('avm.res.insights.data-collection-rule.${dataCollectionRulesResourceName}', 64)
426431
params: {
@@ -438,7 +443,25 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
438443
'Microsoft-SecurityEvent'
439444
]
440445
xPathQueries: [
441-
'Security!*[System[(EventID=4624 or EventID=4625)]]'
446+
'Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]'
447+
]
448+
}
449+
]
450+
performanceCounters: [
451+
{
452+
name: 'VMPerfCounters'
453+
streams: [
454+
'Microsoft-Perf'
455+
]
456+
samplingFrequencyInSeconds: 60
457+
counterSpecifiers: [
458+
'\\Processor Information(_Total)\\% Processor Time'
459+
'\\Memory\\% Committed Bytes In Use'
460+
'\\Memory\\Available Bytes'
461+
'\\LogicalDisk(_Total)\\% Free Space'
462+
'\\LogicalDisk(_Total)\\Disk Reads/sec'
463+
'\\LogicalDisk(_Total)\\Disk Writes/sec'
464+
'\\Network Interface(*)\\Bytes Total/sec'
442465
]
443466
}
444467
]
@@ -447,7 +470,7 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
447470
logAnalytics: [
448471
{
449472
workspaceResourceId: logAnalyticsWorkspaceResourceId
450-
name: 'la-${dataCollectionRulesResourceName}'
473+
name: dcrLogAnalyticsDestinationName
451474
}
452475
]
453476
}
@@ -457,7 +480,15 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
457480
'Microsoft-SecurityEvent'
458481
]
459482
destinations: [
460-
'la-${dataCollectionRulesResourceName}'
483+
dcrLogAnalyticsDestinationName
484+
]
485+
}
486+
{
487+
streams: [
488+
'Microsoft-Perf'
489+
]
490+
destinations: [
491+
dcrLogAnalyticsDestinationName
461492
]
462493
}
463494
]

0 commit comments

Comments
 (0)