Skip to content

Commit

Permalink
renamed the prismacloudcompute solution name
Browse files Browse the repository at this point in the history
  • Loading branch information
v-amolpatil committed Oct 26, 2023
1 parent f69f6e5 commit 559144f
Show file tree
Hide file tree
Showing 22 changed files with 44 additions and 45 deletions.
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
[{
"name": "PrismaCloudComputeDCR",
"name": "PaloAltoPrismaCloudCWPP_DCR",
"apiVersion": "2021-09-01-preview",
"type": "Microsoft.Insights/dataCollectionRules",
"properties": {
"streamDeclarations": {
"Custom-PrismaCloudCompute_IncidentsApi": {
"Custom-PaloAltoPrismaCloudCWPP_IncidentsApi": {
"columns": [
{
"name": "_id",
Expand Down Expand Up @@ -110,7 +110,7 @@
"dataFlows": [
{
"streams": [
"Custom-PrismaCloudCompute_IncidentsApi"
"Custom-PaloAltoPrismaCloudCWPP_IncidentsApi"
],
"destinations": [
"clv2ws1"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,10 @@
"kind": "Customizable",
"properties": {
"connectorUiConfig": {
"id": "PrismaCloudCompute",
"id": "PaloAltoPrismaCloudCWPP",
"title": "Prisma Cloud Compute CWPP (using REST API)",
"publisher": "Microsoft",
"descriptionMarkdown": "The [Prisma Cloud Compute CWPP](https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents) data connector allows you to connect to your Prisma Cloud CWPP instance and ingesting alerts into Microsoft Sentinel. The data connector is built on Microsoft Sentinels Codeless Connector Platform and uses the Prisma Cloud API to fetch security events and supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security event data into a custom columns so that queries don't need to parse it again, thus resulting in better performance.",
"descriptionMarkdown": "The [Prisma Cloud Compute CWPP](https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents) data connector allows you to connect to your Prisma Cloud CWPP instance and ingesting alerts into Microsoft Sentinel. The data connector is built on Microsoft Sentinel's Codeless Connector Platform and uses the Prisma Cloud API to fetch security events and supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security event data into a custom columns so that queries don't need to parse it again, thus resulting in better performance.",
"graphQueriesTableName": "PrismaCloudCompute_CL",
"graphQueries": [
{
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,10 @@
"name": "apiRequest",
"kind": "RestApiPoller",
"properties": {
"connectorDefinitionName": "PrismaCloudCompute",
"connectorDefinitionName": "PaloAltoPrismaCloudCWPP",
"dataType": "PrismaCloudCompute_CL",
"dcrConfig": {
"streamName": "Custom-PrismaCloudCompute_IncidentsApi",
"streamName": "Custom-PaloAltoPrismaCloudCWPP_IncidentsApi",
"dataCollectionEndpoint": "data collection Endpoint",
"dataCollectionRuleImmutableId": "data collection rule immutableId"
},
Expand Down
Binary file not shown.
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
"config": {
"isWizard": false,
"basics": {
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Prisma Cloud Compute CWPP](https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents) solution for Microsoft Sentinel allows you to connect to your Prisma Cloud CWPP instance and ingest alerts into your Microsoft Sentinel workspace using the Prisma Cloud API.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:\n\na. [Codeless Connector Platform (CCP)](https://learn.microsoft.com/en-us/azure/sentinel/create-custom-connector#connect-with-the-codeless-connector-platform)\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Prisma Cloud Compute CWPP](https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents) solution for Microsoft Sentinel allows you to connect to your Palo Alto Prisma Cloud CWPP instance and ingest alerts into your Microsoft Sentinel workspace using the Prisma Cloud API.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:\n\na. [Codeless Connector Platform (CCP)](https://learn.microsoft.com/en-us/azure/sentinel/create-custom-connector#connect-with-the-codeless-connector-platform)\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
"subscription": {
"resourceProviders": [
"Microsoft.OperationsManagement/solutions",
Expand Down Expand Up @@ -60,7 +60,7 @@
"name": "dataconnectors1-text",
"type": "Microsoft.Common.TextBlock",
"options": {
"text": "This Solution installs the data connector for PrismaCloudCompute. You can get PrismaCloudCompute custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
"text": "This Solution installs the data connector for Prisma Cloud Compute CWPP. You can get Prisma Cloud Compute CWPP custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
}
},
{
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -43,17 +43,17 @@
"email": "support@microsoft.com",
"_email": "[variables('email')]",
"workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
"_solutionName": "PrismaCloudCompute",
"_solutionName": "Palo Alto Prisma Cloud CWPP",
"_solutionVersion": "3.0.0",
"_solutionAuthor": "Microsoft",
"_packageIcon": "icon icon icon icon",
"solutionId": "azuresentinel.azure-sentinel-solution-prismacloudcompute",
"_solutionId": "[variables('solutionId')]",
"dataConnectorVersionConnectorDefinition": "1.0.0",
"dataConnectorVersionConnections": "1.0.0",
"_dataConnectorContentIdConnectorDefinition": "PrismaCloudComputeTemplateNameConnectorDefinition",
"_dataConnectorContentIdConnectorDefinition": "PaloAltoPrismaCloudCWPP",
"dataConnectorTemplateNameConnectorDefinition": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition')))]",
"_dataConnectorContentIdConnections": "PrismaCloudComputeTemplateNameConnections",
"_dataConnectorContentIdConnections": "PaloAltoPrismaCloudCWPPTemplateNameConnections",
"dataConnectorTemplateNameConnections": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections')))]",
"_logAnalyticsTableId1": "PrismaCloudCompute_CL"
},
Expand Down Expand Up @@ -118,9 +118,10 @@
"kind": "Customizable",
"properties": {
"connectorUiConfig": {
"id": "[variables('_dataConnectorContentIdConnectorDefinition')]",
"title": "Prisma Cloud Compute CWPP (using REST API)",
"publisher": "Microsoft",
"descriptionMarkdown": "The [Prisma Cloud Compute CWPP](https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents) data connector allows you to connect to your Prisma Cloud CWPP instance and ingesting alerts into Microsoft Sentinel. The data connector is built on Microsoft Sentinel’s Codeless Connector Platform and uses the Prisma Cloud API to fetch security events and supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security event data into a custom columns so that queries don't need to parse it again, thus resulting in better performance.",
"descriptionMarkdown": "The [Prisma Cloud Compute CWPP](https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents) data connector allows you to connect to your Palo Alto Prisma Cloud CWPP instance and ingesting alerts into Microsoft Sentinel. The data connector is built on Microsoft Sentinel’s Codeless Connector Platform and uses the Prisma Cloud API to fetch security events and supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security event data into a custom columns so that queries don't need to parse it again, thus resulting in better performance.",
"graphQueriesTableName": "PrismaCloudCompute_CL",
"graphQueries": [
{
Expand Down Expand Up @@ -178,14 +179,14 @@
],
"customs": [
{
"name": "PrismaCloudCompute API Key",
"description": "A Prisma Cloud Compute CWPP Monitor API username and password is required. [See the documentation to learn more about PrismaCloudCompute SIEM API](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PrismaCloudCompute/Data%20Connectors/readme.md)."
"name": "Palo Alto Prisma Cloud CWPP API Key",
"description": "A Palo Alto Prisma Cloud CWPP Monitor API username and password is required. [See the documentation to learn more about Palo Alto Prisma Cloud CWPP SIEM API](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Palo%20Alto%20Prisma%20Cloud%20CWPP/Data%20Connectors/readme.md)."
}
]
},
"instructionSteps": [
{
"description": "To enable the Prisma Cloud Compute CWPP Security Events for Microsoft Sentinel, provide the required information below and click on Connect.\n>",
"description": "To enable the Palo Alto Prisma Cloud CWPP Security Events for Microsoft Sentinel, provide the required information below and click on Connect.\n>",
"instructions": [
{
"type": "Textbox",
Expand Down Expand Up @@ -229,14 +230,14 @@
}
},
{
"name": "PrismaCloudComputeDCR",
"name": "PaloAltoPrismaCloudCWPP_DCR",
"apiVersion": "2021-09-01-preview",
"type": "Microsoft.Insights/dataCollectionRules",
"location": "[parameters('workspace-location')]",
"kind": null,
"properties": {
"streamDeclarations": {
"Custom-PrismaCloudCompute_IncidentsApi": {
"Custom-PaloAltoPrismaCloudCWPP_IncidentsApi": {
"columns": [
{
"name": "_id",
Expand Down Expand Up @@ -342,7 +343,7 @@
"dataFlows": [
{
"streams": [
"Custom-PrismaCloudCompute_IncidentsApi"
"Custom-PaloAltoPrismaCloudCWPP_IncidentsApi"
],
"destinations": [
"clv2ws1"
Expand Down Expand Up @@ -478,9 +479,10 @@
"kind": "Customizable",
"properties": {
"connectorUiConfig": {
"id": "[variables('_dataConnectorContentIdConnectorDefinition')]",
"title": "Prisma Cloud Compute CWPP (using REST API)",
"publisher": "Microsoft",
"descriptionMarkdown": "The [Prisma Cloud Compute CWPP](https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents) data connector allows you to connect to your Prisma Cloud CWPP instance and ingesting alerts into Microsoft Sentinel. The data connector is built on Microsoft Sentinel’s Codeless Connector Platform and uses the Prisma Cloud API to fetch security events and supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security event data into a custom columns so that queries don't need to parse it again, thus resulting in better performance.",
"descriptionMarkdown": "The [Prisma Cloud Compute CWPP](https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents) data connector allows you to connect to your Palo Alto Prisma Cloud CWPP instance and ingesting alerts into Microsoft Sentinel. The data connector is built on Microsoft Sentinel’s Codeless Connector Platform and uses the Prisma Cloud API to fetch security events and supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security event data into a custom columns so that queries don't need to parse it again, thus resulting in better performance.",
"graphQueriesTableName": "PrismaCloudCompute_CL",
"graphQueries": [
{
Expand Down Expand Up @@ -538,14 +540,14 @@
],
"customs": [
{
"name": "PrismaCloudCompute API Key",
"description": "A Prisma Cloud Compute CWPP Monitor API username and password is required. [See the documentation to learn more about PrismaCloudCompute SIEM API](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PrismaCloudCompute/Data%20Connectors/readme.md)."
"name": "Palo Alto Prisma Cloud CWPP API Key",
"description": "A Palo Alto Prisma Cloud CWPP Monitor API username and password is required. [See the documentation to learn more about Palo Alto Prisma Cloud CWPP SIEM API](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Palo%20Alto%20Prisma%20Cloud/Data%20Connectors/readme.md)."
}
]
},
"instructionSteps": [
{
"description": "To enable the Prisma Cloud Compute CWPP Security Events for Microsoft Sentinel, provide the required information below and click on Connect.\n>",
"description": "To enable the Palo Alto Prisma Cloud CWPP Security Events for Microsoft Sentinel, provide the required information below and click on Connect.\n>",
"instructions": [
{
"type": "Textbox",
Expand Down Expand Up @@ -709,7 +711,7 @@
"connectorDefinitionName": "[[parameters('connectorDefinitionName')]",
"dataType": "PrismaCloudCompute_CL",
"dcrConfig": {
"streamName": "Custom-PrismaCloudCompute_IncidentsApi",
"streamName": "Custom-PaloAltoPrismaCloudCWPP_IncidentsApi",
"dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]",
"dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]"
},
Expand Down Expand Up @@ -808,7 +810,7 @@
"contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]",
"displayName": "[variables('_solutionName')]",
"publisherDisplayName": "[variables('_solutionId')]",
"descriptionHtml": "<p><strong>Note:</strong> <em>There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</em></p>\n<p>The <a href=\"https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents\">Prisma Cloud Compute CWPP</a> solution for Microsoft Sentinel allows you to connect to your Prisma Cloud CWPP instance and ingest alerts into your Microsoft Sentinel workspace using the Prisma Cloud API.</p>\n<p><strong>Underlying Microsoft Technologies used:</strong></p>\n<p>This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:</p>\n<ol type=\"a\">\n<li><a href=\"https://learn.microsoft.com/en-us/azure/sentinel/create-custom-connector#connect-with-the-codeless-connector-platform\">Codeless Connector Platform (CCP)</a></li>\n</ol>\n<p><strong>Data Connectors:</strong> 1</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n",
"descriptionHtml": "<p><strong>Note:</strong> <em>There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</em></p>\n<p>The <a href=\"https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents\">Prisma Cloud Compute CWPP</a> solution for Microsoft Sentinel allows you to connect to your Palo Alto Prisma Cloud CWPP instance and ingest alerts into your Microsoft Sentinel workspace using the Prisma Cloud API.</p>\n<p><strong>Underlying Microsoft Technologies used:</strong></p>\n<p>This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:</p>\n<ol type=\"a\">\n<li><a href=\"https://learn.microsoft.com/en-us/azure/sentinel/create-custom-connector#connect-with-the-codeless-connector-platform\">Codeless Connector Platform (CCP)</a></li>\n</ol>\n<p><strong>Data Connectors:</strong> 1</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n",
"icon": "[variables('_packageIcon')]"
}
}
Expand Down
Loading

0 comments on commit 559144f

Please sign in to comment.