From d105d1dc35a71d0477106afa5807c1a01689dc3b Mon Sep 17 00:00:00 2001 From: doc352 Date: Wed, 9 Aug 2023 19:21:22 -0400 Subject: [PATCH 1/3] Support sovereign clouds and other minor changes Calculates StorageSuffix, LogAnalyticsUri, and LoginEndpoint from the environment function and collects the O365 Management Activities API uri as a parameter. --- .../O365APItoAS-Template/TimerTrigger/run.ps1 | 29 +++++++++++++++---- DataConnectors/O365 Data/azuredeploy.json | 18 +++++++++--- .../O365 Data/azuredeploy.parameters.json | 3 -- 3 files changed, 38 insertions(+), 12 deletions(-) diff --git a/DataConnectors/O365 Data/O365APItoAS-Template/TimerTrigger/run.ps1 b/DataConnectors/O365 Data/O365APItoAS-Template/TimerTrigger/run.ps1 index 744592f9e15..4aa63e17a8f 100644 --- a/DataConnectors/O365 Data/O365APItoAS-Template/TimerTrigger/run.ps1 +++ b/DataConnectors/O365 Data/O365APItoAS-Template/TimerTrigger/run.ps1 @@ -104,14 +104,23 @@ function Write-OMSLogfile { -method $method ` -contentType $ContentType ` -resource $resource - $uri = "https://" + $customerId + ".ods.opinsights.azure.com" + $resource + "?api-version=2016-04-01" + + # Compatible with previous version + if ([string]::IsNullOrEmpty($LAURI)){ + $LAURI = "https://" + $CustomerId + ".ods.opinsights.azure.com" + $resource + "?api-version=2016-04-01" + } + else + { + $LAURI = $LAURI + $resource + "?api-version=2016-04-01" + } + $headers = @{ "Authorization" = $signature; "Log-Type" = $type; "x-ms-date" = $rfc1123date "time-generated-field" = $dateTime } - $response = Invoke-WebRequest -Uri $uri -Method $method -ContentType $ContentType -Headers $headers -Body $body -UseBasicParsing + $response = Invoke-WebRequest -Uri $LAURI -Method $method -ContentType $ContentType -Headers $headers -Body $body -UseBasicParsing Write-Verbose -message ('Post Function Return Code ' + $response.statuscode) return $response.statuscode } @@ -150,9 +159,9 @@ function Get-AuthToken{ [string]$TenantGUID ) # Create app of type Web app / API in Azure AD, generate a Client Secret, and update the client id and client secret here - $loginURL = "https://login.microsoftonline.com/" + $loginURL = "$env:loginEndpoint" # Get the tenant GUID from Properties | Directory ID under the Azure Active Directory section - $resource = "https://manage.office.com" + $resource = "https://$env:managementApi" # auth $body = @{grant_type="client_credentials";resource=$resource;client_id=$ClientID;client_secret=$ClientSecret} $oauth = Invoke-RestMethod -Method Post -Uri $loginURL/$tenantdomain/oauth2/token?api-version=1.0 -Body $body @@ -176,7 +185,7 @@ function Get-O365Data{ $contentTypes = $env:contentTypes.split(",") #Loop for each content Type like Audit.General foreach($contentType in $contentTypes){ - $listAvailableContentUri = "https://manage.office.com/api/v1.0/$tenantGUID/activity/feed/subscriptions/content?contentType=$contentType&PublisherIdentifier=$env:publisher&startTime=$startTime&endTime=$endTime" + $listAvailableContentUri = "https://$env:managementApi/api/v1.0/$tenantGUID/activity/feed/subscriptions/content?contentType=$contentType&PublisherIdentifier=$env:publisher&startTime=$startTime&endTime=$endTime" do { #List Available Content $contentResult = Invoke-RestMethod -Method GET -Headers $headerParams -Uri $listAvailableContentUri @@ -232,6 +241,16 @@ if ($Timer.IsPastDue) { Write-Host "PowerShell timer is running late!" } +$LAURI = $env:LAURI +if (-Not [string]::IsNullOrEmpty($LAURI)){ + if($LAURI.Trim() -notmatch 'https:\/\/([\w\-]+)\.ods\.opinsights\.azure.([a-zA-Z\.]+)$') + { + Write-Error -Message "MCASActivity-SecurityEvents: Invalid Log Analytics Uri." -ErrorAction Stop + Exit + } +} + + #add last run time to blob file to ensure no missed packages $endTime = $currentUTCtime | Get-Date -Format yyyy-MM-ddTHH:mm:ss $azstoragestring = $Env:WEBSITE_CONTENTAZUREFILECONNECTIONSTRING diff --git a/DataConnectors/O365 Data/azuredeploy.json b/DataConnectors/O365 Data/azuredeploy.json index caf1a107fe7..ce67e54cd5b 100644 --- a/DataConnectors/O365 Data/azuredeploy.json +++ b/DataConnectors/O365 Data/azuredeploy.json @@ -37,12 +37,19 @@ "workspaceKey": { "type": "string", "defaultValue": "" + }, + "office365Environment": { + "type": "string", + "defaultValue": "manage.office.com", + "allowedValues": ["manage.office.com", "manage-gcc.office.com", "manage.office365.us", "manage.protection.apps.mil"] } }, "variables": { "Name": "O365Data", "FunctionName": "[concat(variables('Name'), 'fn', uniqueString(resourceGroup().id, subscription().id))]", "StorageAccountName": "[tolower(concat(variables('Name'), 'sa', uniqueString(resourceGroup().id, subscription().id)))]", + "StorageSuffix": "[environment().suffixes.storage]", + "LogAnaltyicsUri": "[replace(environment().portal, 'https://portal', concat('https://', toLower(parameters('WorkspaceId')), '.ods.opinsights'))]", "KeyVaultName": "[concat(variables('Name'), 'kv', uniqueString(resourceGroup().id, subscription().id))]" }, "resources": [ @@ -231,8 +238,8 @@ "FUNCTIONS_WORKER_RUNTIME": "powershell", "APPINSIGHTS_INSTRUMENTATIONKEY": "[reference(resourceId('Microsoft.insights/components', variables('FunctionName')), '2015-05-01').InstrumentationKey]", "APPLICATIONINSIGHTS_CONNECTION_STRING": "[reference(resourceId('microsoft.insights/components', variables('FunctionName')), '2015-05-01').ConnectionString]", - "AzureWebJobsStorage": "[concat('DefaultEndpointsProtocol=https;AccountName=', variables('StorageAccountName'),';AccountKey=',listKeys(resourceId('Microsoft.Storage/storageAccounts', toLower(variables('StorageAccountName'))), '2019-06-01').keys[0].value, ';EndpointSuffix=core.windows.net')]", - "WEBSITE_CONTENTAZUREFILECONNECTIONSTRING": "[concat('DefaultEndpointsProtocol=https;AccountName=', variables('StorageAccountName'),';AccountKey=', listKeys(resourceId('Microsoft.Storage/storageAccounts', toLower(variables('StorageAccountName'))), '2019-06-01').keys[0].value, ';EndpointSuffix=core.windows.net')]", + "AzureWebJobsStorage": "[concat('DefaultEndpointsProtocol=https;AccountName=', variables('StorageAccountName'),';AccountKey=',listKeys(resourceId('Microsoft.Storage/storageAccounts', toLower(variables('StorageAccountName'))), '2019-06-01').keys[0].value, ';EndpointSuffix=',toLower(variables('StorageSuffix')))]", + "WEBSITE_CONTENTAZUREFILECONNECTIONSTRING": "[concat('DefaultEndpointsProtocol=https;AccountName=', variables('StorageAccountName'),';AccountKey=', listKeys(resourceId('Microsoft.Storage/storageAccounts', toLower(variables('StorageAccountName'))), '2019-06-01').keys[0].value, ';EndpointSuffix=',toLower(variables('StorageSuffix')))]", "WEBSITE_CONTENTSHARE": "[variables('StorageAccountName')]", "clientID": "[parameters('clientID')]", "clientSecret": "[concat('@Microsoft.KeyVault(SecretUri=', reference(resourceId('Microsoft.KeyVault/vaults/secrets', variables('KeyVaultName'), 'clientSecret')).SecretUriWithVersion, ')')]", @@ -244,8 +251,11 @@ "recordTypes": "[parameters('recordTypes')]", "workspaceID": "[parameters('workspaceID')]", "workspaceKey": "[concat('@Microsoft.KeyVault(SecretUri=', reference(resourceId('Microsoft.KeyVault/vaults/secrets', variables('KeyVaultName'), 'workspaceKey')).SecretUriWithVersion, ')')]", - "WEBSITE_RUN_FROM_PACKAGE": "https://aka.ms/sentinel-O365APItoAS-functionapp", - "customLogName": "O365" + "WEBSITE_RUN_FROM_PACKAGE": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/O365%20Data/O365APItoAS-Template.zip", + "LAURI": "[variables('LogAnaltyicsUri')]", + "customLogName": "O365", + "managementApi": "[parameters('office365Environment')]", + "loginEndpoint": "[environment().authentication.loginEndpoint]" } } ] diff --git a/DataConnectors/O365 Data/azuredeploy.parameters.json b/DataConnectors/O365 Data/azuredeploy.parameters.json index f187eaa8600..22b4f3c2cf1 100644 --- a/DataConnectors/O365 Data/azuredeploy.parameters.json +++ b/DataConnectors/O365 Data/azuredeploy.parameters.json @@ -2,9 +2,6 @@ "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#", "contentVersion": "1.0.0.0", "parameters": { - "FunctionName": { - "value": "O365Data" - }, "clientID": { "value": "" }, From 4087ccb882dcc13c6cf3b6ff49d080ddd0593b6c Mon Sep 17 00:00:00 2001 From: doc352 Date: Wed, 9 Aug 2023 19:24:41 -0400 Subject: [PATCH 2/3] Updated the zip --- .../O365 Data/O365APItoAS-Template.zip | Bin 10053 -> 11206 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/DataConnectors/O365 Data/O365APItoAS-Template.zip b/DataConnectors/O365 Data/O365APItoAS-Template.zip index 1f2844daf6b03e0cc5bf796dad309f8d6e654a87..a6cfacd13d51d7cf60240a37faa168421d88837e 100644 GIT binary patch delta 6343 zcmaKwWmHss*T!e)Mp8nWp#_xg5|I!F1PP_2M!HL2NTq8?ky3^R326Zdk(6#kQd(L{ z;2rSxX5GB-?6vkf=fidFbN$agGar7Rm0L73Hy#DKH<;g6{~WDx$A6>)#ow1`&W z;pdYA%RAagJ-V%KVr6S-=xD+fMJ>*HCRX7e8NY`RDI=QZTCwe8(?7Ejihqj=ad+ix zPG<)r8)Fl$zp*gRV;!fi>penPED+6cofTHca5HLK_dHr6R!w~=LdXmR09dXy7z2CG z)r6}bGTafWYDBYLtA2o#c&=uR%hiS=R8@#(zE-`9lyt7H$t+RRL#S*JO?|C81KI9e z?UWmZH-yL>i2Og^e<>@<3h-Q>*dR78ff%ZUXu4~Mv!H35s|jJQwlN6R*)f@}RY#!} zAYSv?ei4#?iym=z<-*jTTbbCa+dnrmGqJz4wV^bW-~i8x z4%^o~VuY`vqq)P{3I-EeYv6AFbEt-dR>amNkv6VWxJ<{}(}H9vVLLE^)t8yv5fe~< z`EYN;#2F0+(EK;2>tZMr9O8amRLKxt*xPkNZlQVeal;|3Z&F^YL8 z%psytmWcz|SgDbkLW<8+inJ-(Mf-=KdiHd+MLor7FJd=Qg-ldiQ0t=^f2h`_<>2s< zg2Tb2+`bi!`Xdck%DlVwy_gcfROLo9P{?xft9Ew+6+#O66u0TyfZJ61 zh;oh}x}04MnAK;o{SjTMXd@`Rjdyqks7n7sROJ~X;ift_&^W^sifsn~!Re+nH$>T~ zECng_QHZd`a*a4+c^{Rq<&QxJN7$3enj1BBc(EZUR zTg&^@g+RIaa(dvvdxAIJ4-b8|=kMmhAm@v8Z0_pxVbq)<^?@B(8iw2=~g{6h?AVRP&nyG=0>F#x$_UKo8Aa`#%O3lsdIh zvWX4AJ%}3n>k~hE57TzILP>if2)&SnK(tL6v^hGIbdBUzLoE?os9Lx!G{2W>;t#*o z8m14|Mp%sKK70VT)B)a(LJ#3b?VxDQlNXKGG7{X`8BeZ{Dft*eY9|fPkUQzVpHI3uGd+6(fX=+8G zMLe!8LY|ysUYISSQ~*^gZc*N?eOOUplCBf#NQ$NF!QIHX_iOd{m$u4bnyJ;&9_Uq9j?_Zgs~~R!A!s7=8&H8tDEzNmDGSTNuC5P^?Yxd zK}No-FK7~yX&WUSH*;rI)-{>wlR}aR0ORCJVuNOGxnfhKD|qCD zh;rY_Ph?XAV`o|R@hSrp%Y>8)diz+}6Ta4~5{M2?^i>R{Pk(8U82SV>X9;Vkc(4Wf zISW=uIu1ChW5I+<7GXH#asFr!26v8_SG)laRPMT0&bLsgu>tCPU8Yr1v$S}VdmNb- zY~P0jZ=nh=QkxR#%9I7ckT%DT1+xr8%ZNti-c^8ixdt23l+r#!s4|hfLXYALP0;-) zC9-he5LIpEi_6))$)btC-QJ3d{m|m-j_y`9b)@VI-A9Jnk}G+y#`zC!`1zKc}SABIX!@$E0<8z?)v|JrFI@~D#OAuue?GB-meyv^g@Bxt#4y%X0N?$0<`;xsuu4G!I6 z6zV_=fxcH$jdjdR1BAd`e>d_vUA6c!=ui)$R(uz8uF>#v)W10LW2&U-tsj11GiO-!qMHjd}~s+B_EV7TKcXE<5W#lQk4%NC(G zs1>uR6nNInEoBKd|9MiHz)idu{|$XKD<}tWm9%$m-=g^jl7l zf*v~)?Cb@~w~#GQQ|rqFE!J#LP#@eU+>5_Knz|lOBtZT?LzCdyGhzEonx7cprRsc@gA`c)MDzT^Arsa$wE~ySH0<)> zMEFOmPw~#$+B=RFkTI~=t1yXNXUoD_AqAm;`%7knb&=AV#Xj6MrEUNMW^bKnFq9x zYHY@7P;Zs)%=|{_z|9`F!5j3GqTqrGDVj84VJ@nvmnCE5zNMsOs+_WGxM|;f*U8cT z6;+&QfD)XEd#}@WmPF?=$$wDu$6GogGb|SLttr{R4B`yUFrc+ zc~;5bhz0SSp#Jhtrj+u;;$_=t##M@=usg8GU)+m~?s%as4Fw8D=+D#xYMwyWm}nj7 zN}|ZbjPkPb);4kXeVr&ng_3XhVZdCH*%fBPTeIlf6U@3O*<-!Zup##IS9$0TX z?XUyx0I`np^T@c?Lf&JyIw|gWT1oboE!x>Tbgtm~6|k!(GzX&kASb;YM`}xwDpEV8 zl;fK=sdcKjvvVZ+K1AKGQKvWrj=ox>SeP>uVj)Y?o)p@fgzNmNgSuC25=DVpf=%7V z#-K#m>f?uH`;<)&{^8}+erTXsu@$pTOf5GCB(RNtFmy;;`i^@SAqK{X=zSSv7*3Tz z1}UYf!3-{}8H?DGy1h^bt22=z$H-d_3JN=JVRG9TbHj%7EoOZcP0O5eQ*sBt7MT&P7yOHE-1%S@je01l|wumsV7_3P)V#y->v?SRu5X#z6|>yoL`M~QF0QCMY_o!FB4HSbQX+AC;d_2TC@l^DRl8q*=! zp7`Ck@6|tU-EHnJel2qcFF>^YIgGRq7PMNGmbTyR*Tw) zgbxd=do4c_#Lv+|(a{pN2McJ7Ez^aQpZem`vGF-Q_Z+QS{V=IJspr0a+Eds3$WL)$ zWUB8C<%h|D$*h#UZbh2=Ycr#LL{3O)gK9LALR1`~HDZqfU+`PvadQO8?38gE+O3Ij ze#-t%`&vzf(v$vx&<#iYuGTj5UJFZ6g5j;a2(lh?3a)+7eQ0CWVU2WUdd{af>Gn3? zoQNX2AG&^)krS3t;id)Ci;A0eWSe^I`B5U3ANwD1h5OCUHhrD}(*|u2c?Egz@N)YM z03I){O${28;fU{a-)}G=-Z^oz6L%F8CI55`>G{&_#oTaUyMxBUGWL7@Vhw zqBC>ASV=${$j`f$(7&BszCX>j&Ij>K1E2En6sk64;>d1v05kFIcfIuBo;J(k{gICAj+AN=y`J}up9rtfSLiRW>EtWN?zMX) zgLgC8o9A@0x9_%Cf~8U&Yo4o*u8#H>u!5IQ7u7N+IF#z?8#WwmwFD$2XZ8QWvj2~5 zu7_n93=9HS5x+D30tC>WT@ZC8?0`LFxCy-q0G>Jic+IZ!a+*DNd~RlKV{Zah1R@aw zF3{td`EQ-!!9T@~xGW<2auD!2iM*hNe`j6I3(sc#3C4f`KbL2nk3!HxhVw&RMu!*P zPuF?>#;`PWvNnQnnmgE7U!3kwqRWW!VrmrvL;aHo@4uWCc8`(nd`FjwTuJe*H)8G*T P2mwc^06-Z+1pxdXK~hEa delta 5252 zcmZvgby!qUx5kIgp+gC!%MlnFBqgLfL_!$4hZJP+0Mgyv-61I5l2Q@^B1nU%w1f)Y z8NA=;bG`2Ktmo{r*8A?Y&pzj`-+)2C`YlZr3``0TY6N21YQHm!Dd0rTQ9*!=cz#I= zR9-`9eo+qjtd0zPR6awW3isM^nY(YQgUmP}gBlr$%WTw%PG~0Awsicqt_Eb19SsB` zM-`9JCa()*UmA;^A``91phOkEpr>CKI8!PN0c4^D8DywJ4Mrvf!Bb(KwvrdxrpSZ~ zGVo9ZH%!-Shi64R(L3b&VHm%++(3x+8SQuX9*IRMq*N6dgeVIGj^6L?iQe!eWCGQl z6jjK}+hT+<4qPow?!e&@tLYx5a^POZ-=%;9|Vta*(py7dGXEpc0PAdO24)4rhDc53F@8 zqyZ1H2^3SDE`28!24FZ8Niuj}6x^@#2ZEq2 zc%1F59!e#oXSGYE8XHCqa|EdnJ1M`Tli_iA%bLU&j2(w@Af^O2bdJs3jx>cQb~^+|A?$N7dB0Pe)qQpd z?lkiY#pz^`U5_pE)}fM`iPUUBmj&@1(S<>=iHTOvZuq5?F*a8+{Zp5sp4rCnG&^Qa z*Vi&&X_%)l^3YO5t5!QQPvS)$EPl%F^{Jw?j)E;+oKYWCX-UJn6T2?ukl(*2qN zPw})9o=^)HZ>aX2+Fn|!J_$G3LP9W`DvNc2R%xVWTvqBLZv=(HyqO|Eoou^K^Yw#1 z{LC;xyHPG92-oNfY5WDjeXLJ5Oq*s7mfjGb3`n;(#!<$S(jBThTcHh;4|Kz*TqzUc zb#g>JDDC@Wd{aA)1B9Dd2F)NlE%wa9*%T>5QS91*Ac`9T?8$p`ARjZBy{p_R zNp5=OR0Nu~;YYCeM^GIlzjXNYYy=wk_IDc&9L(pnptq?R5AuM(IHim{e4wTnI}g1> zxB4v1ObOSTn4xB2DaWbH& z8gVO96O^W#-xVz4pTviMddEA3f=Gxiy0$$WDp3OCRxxCBKD+@uFDNvDT1g2TMxiSKHgm()GT=FX#e_X0 zTJozNBAjHo5IZD$ic$6Wh!f83v7(rE!faOyKdH^$7Xw0n;C!rDa!v8qd7%!-tcyCH zk&6(v<`2<@r6`D7w-nO6$NsgG9Xo-oA9e##q(X?Ht)3Sv-prT@COM_cd)n<#2wUOP zoO%t=r9SZp;%Ma+i=E${WGGWqM8~#%z42DieM`RP)RZxhx{gdr| zth+9kRwVVhbBxueKVS|Jm6$b?TeoS6?XsVDas<7+$KXbdAQQ)QgeJA_C-~7Ow1-<3 zGIvbeoUhD!C_!@CL*vM3@z$3!j%y}V8_|sI$qJmG7~n4LKY2MQMRn2;jhSgICjJca z#YL!B-{JX9b5oM*mqV&SvNt!O-%2|Oq)8~xzg2Rs^7WV`p5+EpB z5wq1aRqrCW)H5)E;E^yG5;0bt9W-Vom^w$_s?VupQQGb@_0>tMY>WM_e10UcLfXc% zu`$q@6Xkn}wk%0+Oq9V&qiP55h9MRyQ7p2|Ih339F@Ugbiz*(6QW&JxT15p_P2uQEe`chELN$wU~pq z#Ch=mU0#T`z9BThG1!kz+wMhI-Pv&h2=^G;Q~|qHgwY>W?iESk6Kzx-YUEYL2w-6x z2!H4PIlT>~QnP{NloEIw$jjFU5VeLb$jxdx!HT63UQ*mQz;#~e=?IUM7gttXHz@D~ zq^f(91~uw|Pc$Cz=EK_NfG3E|oNt~igO4t~E8?kDLZ1S$Go&<*6EP3L5`!aWey!FwCmeTExtBppSRC~sjxhW?1Uan9C&4nRm z1ux%R({}`(5RZY;EANU8zNCbfpYJ9_PrcJWlI3uba77Lskk8^(8J|RGENhFa`p6Y4m^22K8nn7W>ik}bQ^ z?%tW}v}qc=JAK>eq&r!^?<>-42pHFNxB(dW&TyM~n&wOwpDL2I$xxlL%=7Otgs0+QuwWjRld_ zJ8|4MBC6sD@+N!V)Tha}$cGbF@@Wh&kg21Oq=DB>3Z-K2Ny!Xw47tTD;1_&Yedg+# zc!2NC%Eb0Gt2lI+3avO^-mlZ6O3~$kpN%&4TC&Q^Ys;8fT0V5GrR_hZZzXhmB4wyrur$O(#c%MN|#`vin{? zwDE5)NPG2pG^>s^x+mCJGBdcdLW)r0Va(@9K6aQn8dx>!nRI{`ZNx9)Za>hk5CO92 zeQ=0#%x7Oe2qDng!kQ__+Uh(^G4^s(FebKOAbjDBylC>BW2d*w)S4MZFl8U@5m^NHY#;0`rSsK!fBavwpCCq;zR?! zTS`nCi~AnZ$$mK%(TRo?YtN8lNc|N9!B@2BgE6(U^n3` zNM1M>Yif2jM?7}O{6w=}&*#})*>R?iwMq8YQszVV#o8;8Bm0$VPmK2(o*w1YdqP3Z zxi)$UTq&9=UNt_ven#u~_Ah5rH1p?`?t3-J5S^z1wI;FD0Y!t~+}|zI#?916$HF8` zSj01VD1M}lZY!CwHPG5kV4>5&cB3f^#FP}}*v&ByLECj4w$cdbz$6>GF;Ji8t)eBPy~{^PtHvE)6Myh-ek?`UzKT1IS?%x8*(Yh-}QD0CsbvhN%uOFus!JW-ksdut@%*_6ncC za3aqIhn(LtA{N>m(cXOd^OZaPtS+XPSc#^-LCN9ym$f;?d5D}bf1;g1M;aT+=IK+MM(dWBSM;=}D~I=HxgS=QJm9(c zEq`PwUsc|_Ut+7t^|hTpxe|XQ_jgjD-5kTa>=i48g}~z>`4lmBTWfH-SbNXK`I1<9 zV#SchB;&Z_n`v{wn!|*8izn@#+5%vwMx6OW>(DC#HCj48BmDha+*nF(Ns<; z$fE<4zI*sOM`a;u>pkbXX7e}kJpvN@D&i~SbxFO2g?7J}qAwl3}--1hD+&VQf9 z-;n2zjQ|q_g1fm`+c{dHh{@l^^gj#;xQ0M~ocP$+PH#Ia_kZ>z`->9&ak?X&ZdR_I zc5YTqR?Z&o$i|lcuk+s|2?Rzi@cT0e;UG_Bh?DL5;84r{XQ05+??HmRO`~Ke%p}G| zcrE=KGohrvSH#A>mU43c{r-RRr#}{TB>77G#KmO!FBtVlCWhp8|3XuL8vQ1RD93-s ie||d9^>4n*glv? Date: Mon, 21 Aug 2023 17:14:52 -0400 Subject: [PATCH 3/3] minor fixes removed locale from doc link, fixed WEBSITE_RUN_FROM_PACKAGE to point back to the original aka.ms short link. --- .../O365 Data/O365APItoAS-Template/TimerTrigger/run.ps1 | 2 +- DataConnectors/O365 Data/azuredeploy.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/DataConnectors/O365 Data/O365APItoAS-Template/TimerTrigger/run.ps1 b/DataConnectors/O365 Data/O365APItoAS-Template/TimerTrigger/run.ps1 index 4aa63e17a8f..ea02a010837 100644 --- a/DataConnectors/O365 Data/O365APItoAS-Template/TimerTrigger/run.ps1 +++ b/DataConnectors/O365 Data/O365APItoAS-Template/TimerTrigger/run.ps1 @@ -14,7 +14,7 @@ function Write-OMSLogfile { Given a value pair hash table, this function will write the data to an OMS Log Analytics workspace. Certain variables, such as Customer ID and Shared Key are specific to the OMS workspace data is being written to. This function will not write to multiple OMS workspaces. Build-signature and post-analytics function from Microsoft documentation - at https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-data-collector-api + at https://docs.microsoft.com/azure/log-analytics/log-analytics-data-collector-api .PARAMETER DateTime date and time for the log. DateTime value .PARAMETER Type diff --git a/DataConnectors/O365 Data/azuredeploy.json b/DataConnectors/O365 Data/azuredeploy.json index ce67e54cd5b..29a54dd027e 100644 --- a/DataConnectors/O365 Data/azuredeploy.json +++ b/DataConnectors/O365 Data/azuredeploy.json @@ -251,7 +251,7 @@ "recordTypes": "[parameters('recordTypes')]", "workspaceID": "[parameters('workspaceID')]", "workspaceKey": "[concat('@Microsoft.KeyVault(SecretUri=', reference(resourceId('Microsoft.KeyVault/vaults/secrets', variables('KeyVaultName'), 'workspaceKey')).SecretUriWithVersion, ')')]", - "WEBSITE_RUN_FROM_PACKAGE": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/O365%20Data/O365APItoAS-Template.zip", + "WEBSITE_RUN_FROM_PACKAGE": "https://aka.ms/sentinel-O365APItoAS-functionapp", "LAURI": "[variables('LogAnaltyicsUri')]", "customLogName": "O365", "managementApi": "[parameters('office365Environment')]",