-
Notifications
You must be signed in to change notification settings - Fork 1.1k
/
ASC_DINE_monitoring_agent_custom_workspace.json
100 lines (100 loc) · 3.36 KB
/
ASC_DINE_monitoring_agent_custom_workspace.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
{
"properties": {
"displayName": "Enable Security Center's auto provisioning of the Log Analytics agent on your subscriptions with custom workspace.",
"policyType": "BuiltIn",
"mode": "All",
"description": "Allow Security Center to auto provision the Log Analytics agent on your subscriptions to monitor and collect security data using a custom workspace.",
"metadata": {
"version": "1.0.0",
"category": "Security Center"
},
"version": "1.0.0",
"parameters": {
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"DeployIfNotExists",
"Disabled"
],
"defaultValue": "DeployIfNotExists"
},
"logAnalytics": {
"type": "String",
"metadata": {
"displayName": "Log Analytics workspace",
"description": "Auto provision the Log Analytics agent on your subscriptions to monitor and collect security data using a custom workspace.",
"strongType": "omsWorkspace"
}
}
},
"policyRule": {
"if": {
"field": "type",
"equals": "Microsoft.Resources/subscriptions"
},
"then": {
"effect": "[parameters('effect')]",
"details": {
"type": "Microsoft.Security/autoProvisioningSettings",
"deploymentScope": "Subscription",
"roleDefinitionIds": [
"/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
],
"existenceCondition": {
"field": "Microsoft.Security/autoProvisioningSettings/autoProvision",
"equals": "On"
},
"deployment": {
"location": "westus",
"properties": {
"mode": "incremental",
"parameters": {
"logAnalytics": {
"value": "[parameters('logAnalytics')]"
}
},
"template": {
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"logAnalytics": {
"type": "string"
}
},
"variables": {},
"resources": [
{
"type": "Microsoft.Security/autoProvisioningSettings",
"name": "default",
"apiVersion": "2017-08-01-preview",
"properties": {
"autoProvision": "On"
}
},
{
"type": "Microsoft.Security/workspaceSettings",
"apiVersion": "2017-08-01-preview",
"name": "default",
"properties": {
"workspaceId": "[parameters('logAnalytics')]",
"scope": "[subscription().id]"
}
}
]
}
}
}
}
}
},
"versions": [
"1.0.0"
]
},
"id": "/providers/Microsoft.Authorization/policyDefinitions/8e7da0a5-0a0e-4bbc-bfc0-7773c018b616",
"name": "8e7da0a5-0a0e-4bbc-bfc0-7773c018b616"
}