-
Notifications
You must be signed in to change notification settings - Fork 70
/
main.json
110 lines (110 loc) · 3.7 KB
/
main.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"utcValue": {
"type": "string",
"metadata": {
"description": "Returns the current (UTC) datetime value in the specified format. If no format is provided, the ISO 8601 (yyyyMMddTHHmmssZ) format is used"
},
"defaultValue": "[utcNow()]"
},
"workspaceName": {
"type": "string",
"metadata": {
"description": "Name for the Log Analytics workspace used to aggregate data"
}
},
"pricingTier": {
"type": "string",
"metadata": {
"description": "Pricing tier: pergb2018 or legacy tiers (Free, Standalone, PerNode, Standard or Premium) which are not available to all customers."
},
"defaultValue": "PerGB2018",
"allowedValues": [
"PerGB2018",
"Free",
"Standalone",
"PerNode",
"Standard",
"Premium"
]
},
"dataRetention": {
"type": "int",
"minValue": 7,
"maxValue": 730,
"metadata": {
"description": "Number of days of retention. Workspaces in the legacy Free pricing tier can only have 7 days."
},
"defaultValue": 30
},
"immediatePurgeDataOn30Days": {
"type": "bool",
"metadata": {
"description": "If set to true when changing retention to 30 days, older data will be immediately deleted. Use this with extreme caution. This only applies when retention is being set to 30 days."
},
"defaultValue": true
},
"location": {
"type": "string",
"metadata": {
"description": "Location for all resources."
},
"defaultValue": "[resourceGroup().location]"
}
},
"functions": [],
"variables": {
"uniqueWorkspace_var": "[format('log-{0}{1}', parameters('workspaceName'), uniqueString(resourceGroup().id, parameters('utcValue')))]"
},
"resources": [
{
"type": "Microsoft.OperationalInsights/workspaces",
"apiVersion": "2020-08-01",
"name": "[variables('uniqueWorkspace_var')]",
"location": "[parameters('location')]",
"properties": {
"retentionInDays": "[parameters('dataRetention')]",
"features": {
"immediatePurgeDataOn30Days": "[parameters('immediatePurgeDataOn30Days')]"
},
"sku": {
"name": "[parameters('pricingTier')]"
}
}
},
{
"type": "Microsoft.OperationsManagement/solutions",
"apiVersion": "2015-11-01-preview",
"name": "[format('SecurityInsights({0})', variables('uniqueWorkspace_var'))]",
"location": "[parameters('location')]",
"properties": {
"workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', variables('uniqueWorkspace_var'))]"
},
"plan": {
"name": "[format('SecurityInsights({0})', variables('uniqueWorkspace_var'))]",
"product": "OMSGallery/SecurityInsights",
"publisher": "Microsoft",
"promotionCode": ""
},
"dependsOn": [
"[resourceId('Microsoft.OperationalInsights/workspaces', variables('uniqueWorkspace_var'))]"
]
}
],
"outputs": {
"workspaceName_output": {
"type": "string",
"value": "[variables('uniqueWorkspace_var')]"
},
"workspaceIdOutput": {
"type": "string",
"value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces', variables('uniqueWorkspace_var')), '2015-11-01-preview').customerId]"
},
"workspaceKeyOutput": {
"type": "string",
"value": "[listKeys(resourceId('Microsoft.OperationalInsights/workspaces', variables('uniqueWorkspace_var')), '2015-11-01-preview').primarySharedKey]"
}
}
}