BPiz*0+&|GwjBvMJ{NGCxj1%M0)+&4CLH;FwlFsom-ZEXJv`cc?;WsYarmqwCvEt(R~}F`p0J&$Kn=H}__0C7A4}f2?djp&
zb8}a&Yqt%M%OW{~@cc1{O9g&VTQ`f0N4pn*Y*(|7r5i
gtn)t(T7T>G|4Tl)8hC$Y008^%M*Y1<\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe Google Cloud Platform (GCP) Security Command Center is a comprehensive security and risk management platform for Google Cloud, ingested from Sentinel's connector. It offers features such as asset inventory and discovery, vulnerability and threat detection, and risk mitigation and remediation to help you gain insight into your organization's security and data attack surface. This integration enables you to perform tasks related to findings and assets more effectively.\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+ "subscription": {
+ "resourceProviders": [
+ "Microsoft.OperationsManagement/solutions",
+ "Microsoft.OperationalInsights/workspaces/providers/alertRules",
+ "Microsoft.Insights/workbooks",
+ "Microsoft.Logic/workflows"
+ ]
+ },
+ "location": {
+ "metadata": {
+ "hidden": "Hiding location, we get it from the log analytics workspace"
+ },
+ "visible": false
+ },
+ "resourceGroup": {
+ "allowExisting": true
+ }
+ }
+ },
+ "basics": [
+ {
+ "name": "getLAWorkspace",
+ "type": "Microsoft.Solutions.ArmApiControl",
+ "toolTip": "This filters by workspaces that exist in the Resource Group selected",
+ "condition": "[greater(length(resourceGroup().name),0)]",
+ "request": {
+ "method": "GET",
+ "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]"
+ }
+ },
+ {
+ "name": "workspace",
+ "type": "Microsoft.Common.DropDown",
+ "label": "Workspace",
+ "placeholder": "Select a workspace",
+ "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected",
+ "constraints": {
+ "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]",
+ "required": true
+ },
+ "visible": true
+ }
+ ],
+ "steps": [
+ {
+ "name": "dataconnectors",
+ "label": "Data Connectors",
+ "bladeTitle": "Data Connectors",
+ "elements": [
+ {
+ "name": "dataconnectors1-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "This Solution installs the data connector for Google Cloud Platform Security Command Center. You can get Google Cloud Platform Security Command Center custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
+ }
+ },
+ {
+ "name": "dataconnectors-link2",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "link": {
+ "label": "Learn more about connecting data sources",
+ "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources"
+ }
+ }
+ }
+ ]
+ }
+ ],
+ "outputs": {
+ "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
+ "location": "[location()]",
+ "workspace": "[basics('workspace')]"
+ }
+ }
+}
diff --git a/Solutions/Google Cloud Platform Security Command Center/Package/mainTemplate.json b/Solutions/Google Cloud Platform Security Command Center/Package/mainTemplate.json
new file mode 100644
index 00000000000..08adcac78e0
--- /dev/null
+++ b/Solutions/Google Cloud Platform Security Command Center/Package/mainTemplate.json
@@ -0,0 +1,210 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "metadata": {
+ "author": "Microsoft - support@microsoft.com",
+ "comments": "Solution template for Google Cloud Platform Security Command Center"
+ },
+ "parameters": {
+ "location": {
+ "type": "string",
+ "minLength": 1,
+ "defaultValue": "[resourceGroup().location]",
+ "metadata": {
+ "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace"
+ }
+ },
+ "workspace-location": {
+ "type": "string",
+ "defaultValue": "",
+ "metadata": {
+ "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"
+ }
+ },
+ "workspace": {
+ "defaultValue": "",
+ "type": "string",
+ "metadata": {
+ "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
+ }
+ }
+ },
+ "variables": {
+ "solutionId": "azuresentinel.azure-sentinel-solution-gcpsecuritycommandcenter",
+ "_solutionId": "[variables('solutionId')]",
+ "email": "support@microsoft.com",
+ "_email": "[variables('email')]",
+ "_solutionName": "Google Cloud Platform Security Command Center",
+ "_solutionVersion": "3.0.0",
+ "dataConnectorContentId1": null,
+ "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]",
+ "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]",
+ "_dataConnectorId1": "[variables('dataConnectorId1')]",
+ "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]",
+ "dataConnectorVersion1": "1.0.0",
+ "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]",
+ "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
+ },
+ "resources": [
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('dataConnectorTemplateSpecName1')]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "Google Cloud Platform Security Command Center data connector with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('dataConnectorVersion1')]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]",
+ "apiVersion": "2021-03-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
+ "location": "[parameters('workspace-location')]",
+ "kind": "StaticUI",
+ "properties": {
+ "connectorUiConfig": {
+ "id": "[variables('_uiConfigId1')]",
+ "title": null,
+ "publisher": null,
+ "descriptionMarkdown": null,
+ "graphQueries": null,
+ "connectivityCriterias": null,
+ "dataTypes": null
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]",
+ "properties": {
+ "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]",
+ "contentId": "[variables('_dataConnectorContentId1')]",
+ "kind": "DataConnector",
+ "version": "[variables('dataConnectorVersion1')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Google Cloud Platform Security Command Center",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Microsoft Corporation",
+ "email": "support@microsoft.com",
+ "tier": "Microsoft",
+ "link": "https://support.microsoft.com"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('_dataConnectorContentId1')]",
+ "contentKind": "DataConnector",
+ "displayName": null,
+ "contentProductId": "[variables('_dataConnectorcontentProductId1')]",
+ "id": "[variables('_dataConnectorcontentProductId1')]",
+ "version": "[variables('dataConnectorVersion1')]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]",
+ "dependsOn": [
+ "[variables('_dataConnectorId1')]"
+ ],
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]",
+ "contentId": "[variables('_dataConnectorContentId1')]",
+ "kind": "DataConnector",
+ "version": "[variables('dataConnectorVersion1')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Google Cloud Platform Security Command Center",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Microsoft Corporation",
+ "email": "support@microsoft.com",
+ "tier": "Microsoft",
+ "link": "https://support.microsoft.com"
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
+ "apiVersion": "2023-04-01-preview",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "version": "3.0.0",
+ "kind": "Solution",
+ "contentSchemaVersion": "3.0.0",
+ "displayName": "Google Cloud Platform Security Command Center",
+ "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation",
+ "descriptionHtml": "Note: There may be known issues pertaining to this Solution, please refer to them before installing.
\nThe Google Cloud Platform (GCP) Security Command Center is a comprehensive security and risk management platform for Google Cloud, ingested from Sentinel's connector. It offers features such as asset inventory and discovery, vulnerability and threat detection, and risk mitigation and remediation to help you gain insight into your organization's security and data attack surface. This integration enables you to perform tasks related to findings and assets more effectively.
\nData Connectors: 1
\nLearn more about Microsoft Sentinel | Learn more about Solutions
\n",
+ "contentKind": "Solution",
+ "contentProductId": "[variables('_solutioncontentProductId')]",
+ "id": "[variables('_solutioncontentProductId')]",
+ "icon": "",
+ "contentId": "[variables('_solutionId')]",
+ "parentId": "[variables('_solutionId')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Google Cloud Platform Security Command Center",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Microsoft Corporation",
+ "email": "support@microsoft.com",
+ "tier": "Microsoft",
+ "link": "https://support.microsoft.com"
+ },
+ "dependencies": {
+ "operator": "AND",
+ "criteria": [
+ {
+ "kind": "DataConnector",
+ "contentId": "[variables('_dataConnectorContentId1')]",
+ "version": "[variables('dataConnectorVersion1')]"
+ }
+ ]
+ },
+ "firstPublishDate": "2023-09-11",
+ "providers": [
+ "Microsoft"
+ ],
+ "categories": {
+ "domains": [
+ "Security - Cloud Security"
+ ]
+ }
+ },
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]"
+ }
+ ],
+ "outputs": {}
+}
From 9df42111366c8fe9fd1fb0bb398ea366b9ea613c Mon Sep 17 00:00:00 2001
From: v-atulyadav <104008048+v-atulyadav@users.noreply.github.com>
Date: Tue, 12 Sep 2023 14:13:44 +0530
Subject: [PATCH 03/23] update package
---
.../Package/3.0.0.zip | Bin 3980 -> 4031 bytes
.../Package/createUiDefinition.json | 2 +-
.../Package/mainTemplate.json | 10 ++--------
.../SolutionMetadata.json | 2 +-
4 files changed, 4 insertions(+), 10 deletions(-)
diff --git a/Solutions/Google Cloud Platform Security Command Center/Package/3.0.0.zip b/Solutions/Google Cloud Platform Security Command Center/Package/3.0.0.zip
index ce8835c6307bc9503e08e5f1e239326852a15c81..2fc7e40995bc23ed162e23a511895926944ebbda 100644
GIT binary patch
literal 4031
zcmZ`+bx;(Jx?NgYdI9NBN>V_&7nY?KknUV!L0CGaOL~_^S|lW-LtJU31?iLqX(@^8
z@4cBfZ|2_neSe(!&dhiIJ?ChvV_{PQ0DwmTJ3U^5*yQpOD_j8J3mE`F^Ov>pu(Lwg
z>BE%l>|t;i0_FyP?&RqPZ#3A4FNjj!%UT|}7ZBGn%zBVp&OYX4s4p2HC^1Q~<%<#r
zI>w^JzZa=My_cSU$+t^tdO8Q%vmW%G^zIJ*`gWk(^ZF`}a3$oPR_C}h7W&x|jgRx8
zvGpZw(l?|#S_pNFGv+d|OqCs-VyqWn9|&ZO>@PMwD_yNTY26w=eP>~MoHYe=Js9&mUIUjI8HHnM#`QE0-X3gz5ABmiUN~$EnU(%9<@URr8}+_JnX2?AS{<
zetgQ1J?k8=rCO%gI>UECY6l3NjEi^KaLhnMWF63x0+zBcblPm4k~~3{cj1H(F^P<=
zg$eQz&D1(FD3H)Isa;F9p^FAuo?!8czx)i171~^``EBlqQcHTp+O!Kh+OIinmIk+~
zLQR6Cb8OQNR#!oG*Mn$`&eU95&Frxj&dPzZTzfFMk=#f@S4KBGZ6Lu8+D6svmd{C0gOjJBeAL@&4jZ*=G_xIp8c>3vQ&U<~Ec{aM7On
zBi~LGD3aP+W7`P>-isjN6F11ZKy@oi&HDQ1ctkWpU%s%=*r`vI;GwmSqT6^i6mF!tfo!6Ah#F9+L|~oeXd@OcJU)ML80UBtjtc=G>n=;oVs^~gNAw8?D^uij!nl5dlYLi1lFar
z5U>ab7jCi~Va)0l+oUWzd-y7`05)V+P9qK@=cGa!5Ji3H{ZdXrTmAWrRhBc&=&|41
zlGiYw4e!H`;@^$@;xzQFK5$u%FdVo~8jNITV%>y$H;TMGJ70^Mu8YG(*Xq|m1YK#W
zUU7AEQUZ2kx+a~t*6a0_8#&6&VnQ%O84b_st=3!W7MpHna5&=J&kx=$Avs)*^>Ao3c=c18ag=~tu|`oP*m^Sps#E3>(CO(G-4
z=1}r0>DSk>P8^EHufe9^IUzPPBP2J*Os1)c2+*lu$MV1AU3%R=s4&Br
z>N@dZ_;=X0TO@{qDMdq@BTvOc)qOdY+l{5-TW`hTaXYicn3KH&4GQoAPy47}^Lw!d
zlCkr3UYdbtmB@p9D0rEGMtM~@fU{(OOT^6Wv2Z9wZ*+TR@(ttSJ^|J#a{*j+gF8vG
zO^47%=kmC{XN=InM9gI3W{DyAW8Cf_g(oV`utaW?=;A~VBZ3`
z{=8v`e;gz^nX1u>SpPE@x=eMVH`wyz9DaLOa3^i;ACDu*+xKy-CL*1Esk0K&^lZX9
z;#vs|tel9enrqd4CoUB{!v1m5Vl`~@E;ad1NcyG|j(Lu|HW^F$A(ei7S9m6TDc9=e
zm6?3;#|!tfaF%K3fNQZ(ISa$j$NmC~bjvk{QvtGEg72`OrWHh!0j%$*lKs;x#qm3y
z{_$b**AD9H)$MmJ^y@HTn~!k?LruzA=Y!0o1>!fDco{!dh@QpHjg?jZSRl&=Q=gew
zb&6?$*Z0g;=64YbI6++wAhvHS^LfE%j=_rxHvtV{*P~>}3^UL7NO7-G6^*Mly&uJ8
zCkYo=+COJTfmi54i4qF|N@d=&&fT;`s2(t0Wh*<=2TN@WuW2dPAq~lrH*#Ch{%|c=
za%%Ug1&xOq8mxZO)2yI;y&~n5s?ft5zxYIRQ@h@;z6AsUBG5sOA>NV){bZKdGu!t8LG-^6v$Rw^PZ@X_>+536MY_hm`c*h*L)~47Q6#$dKBT-yQ4ch1`5WH??0i=F
zcC$M5*EcwW;`V36(iCwaq+&R#W_nd^8D_ZZs$=Srm3yaqI3r(2ef0D$mk
z0Ki{k0=Qbi;Cgnh?k<15>3{s_7oDryg6Pek&^x@ZKB44a>VJB7TSd~FW?-7tR`HPNRHHHOfoeFiQLW0Sv
zuKFFTXqBpxYcDC*!s-=HvNSZO-ucTuCGR)n#+UhkWB3&bp*1L2nTQcaQe&sp
z-1@+0(&eIJ?9+J2BEGiS8gaa#O>LBOM2q`(8>W&WP<7lYN0zkIo(Q#~INeqi2RQ(Z
zpad3oL=xp(0Gn0pOI$8_3{YQ!vLRjM9*1H2e(E!fh>Zr-Di^Stv1u}E3fIBt{AMPv
zJ96-y`zu%nk0y4duhO#nD9nAshPqNNsu5D$3@HL9`zFA7VhI$i$=L?A
zV6U4GZPX(QMET41TjRA4!hp-%^xP#Jb_
zOqTWw^oMrUS2bQ@wc%Kpe?8F2>oU0C$W&QFb@~+C!Jf|y-+S97rIU*HlQ|Ld4vQA&
z`CH5vZ{-nhZ|0G`+H>l!yWIvlUtJSpy|@)a28WKa2Govv`|nmPyipEnZ}e{T&{Tud
z0e3v@5Qj}af^_|iJ(`NfH+vgIGc<_S5UkJUG+_bWrw6UHbls_GR2)7ejyeXD=#m5W
z{IsG0`T-S#&Me9%*IDHV8Lc?OK#KPYq=h^sOfXF$Rv9cvPrQ)YTav>Xc~y$bnBZuYfUh>OcT>1Y$0o4}@S
zk55RkFYn95u3Qd&+ZNnyr#X)NPzlIi!jok%w@
zWv>#y;ow7Xb)^F+?|hfBgwh3xFsNg4l^rC%BujMa_K|co@^yLcAL(&xE<7L52R5nKwbpWFGI^<(=|aLz1{=
zb@}R<^8}WHz{ii~8ct282wVLj)73DbC#k(z+D|XfgW@%%ZTUR6P!w@!BEwy{qgK=9
z?#yD)?|laxw<24)@@1O?4bQ|S-OQV+jxG^PK@y;E{O+Y>j2p9j+-cC%sAJuE)T3^j
z^)p|&H80tk1=1NOZQk?Ti(jb64FXtaAfKqN!|tXGlFo7`Pk@_4LYuf(P|H;DkMX+*
z!s}JAHGW`wWpaWw0Tok?^IabOg+)@w
zy@%4tm1*>$Mc|&?Um`1
z%cFC~Pj5zpRY9`lX-9jjcs_?^Y!6h^lcOEzk95}EsBB5>ZEfzFs*c8Oob#n^^adJ-6uunPTG{Wfd{Q&P
zC-0d6)uiT^6m&yB)q=P7?oMaHD^{)RAX?3(f&>n06^(3pKMQoBr#
z+1c&cAT2tK*;1)xj`O8EUVK)+ZmxXt)3j^Ko*b=j-$`-G0UjhB5T?$T0X|Z`gm}5r
ze5NF?Gb-}ySyc_Sar!rEkaA3wo^$&lJ$G+?$OWUfD!w25)dR+vUjt{ry{ju9MrQYL`=e_@tY4Nv3}rb
zXXXINh!{|W!zlJgl>+{iT$Wy`z%5ggC6cX=!gPE^1B}1Ic=Ll?9iNLh^$e$E1-sLL
z1UoP_Gg+}@97j)BCuuXnIY*5bg;}CA6L&)ugfWO~Pm$dq8Y;wZ%h%51O0bd0JGGcsF#1bx)(ShYR0hz58PB
z^OA5VGSERKb7rfzBLCtufrGFt#jn{G7*~JkuhYhOg6~Xfz#~u1;i+(=F~x~;wboiq
zmG;%$U2gl3COVnv*x<|X5_@<$qdYwq4~(%-=7H$`jzU`<1CtW)-)r*UOaj0FF#iL8
q=f9NZ|1a{NQq4cF|0{y}+ra-V<7lhn{G|Z^%)cA)7dc4(x&8$!2#Zeu
delta 3909
zcmZ{nWl+=spzW8C?hsJAmX?rQKoAjFdg;ccr5mX~p>%hHlncm$u%OaQtaK<{0xI3z
z+?e;?yty;?d^vMwe&5eIoh%6~Pj%FBaA`mw5CKStL%_&Z0e_7i4+ILL0DT>b6x@A9fL{G+Z
zEo{w`-oQ=%9_?Q)dOy4NQJ@KSF3oTdkg8y9Y8L+V%c+UVUciBHEWl0a{L7?lg1+HF
z?v`!-jN)
zNnoJNP2!n`yRi!rnLWMJwIyU=nwTpIS8g=OA;`~a{OLjJJ+1gh;m98m3YIhmXr#0C
zN^tQ%&G6|~&Iirxez4CaapZ#M7m;>6ATNbWGU7R#&K4SPZslLd-Wr&M1_r1exalFK
z?OZg)wEW}EYrUv28H=(cPY-6XDaG{k@`a&U`$8CXqiznqZ_Ol>gVYUiE_@_QlMyz2
zoDNax>)yy3*CO)vP|5JQmJ_C
zr%A_$lMHVOv(h1sOaL*I<{mG`aDjit$cP9IM@aNWYB!nQo{}W3!n(sfG`wp?-8jvGAVf<60-^04)So}NhYj5hGt12eC*^NbHl8c12upl*t&URZc3uF
zgfC+SJu05BOM)!&n9w_Z>Pc|2@);SUo)EEVO&XQLL5fc*hT6<{s@$jBi(+b^=Z=|K
zq%k3GVP#y8mpgD0i-)?!%b9CI@oleZ$9
zGUv1Hn)NiV!#Xu{mv?-qd-!Vy;S1jS+)aV^iu4}6zMz_+q^!vO#_8`)SfrFPwX7=c
zp4okU$g$tez`cLlmz{`<1>>RLhvp6&9~8EYYi$owV8@118#u*iZ#E13vbjK1
zCoC<)+_kV2lT@6vv^~_lK2IH$sa_kWema1xw-pmAJhj9t5mA;k5Jj%%K4qafZNBsS
z%FfbbzMFRmRaN`hXZo)}DUytMcxIx@I8n%EWSM65=qWd)Jxg-}ZBJZ84Bd2ACJN0R
zj@?)*Za14Ctu9`|D*e{HP9tx7mX+(xN
z07;mh_!|`8K*-8_Me>Coqh@u^p}K#;9zmYRov)WoW*e9PJ&e{HK{i(obqxC8L6{>b
z#pwPgUW`1oeeLi4KSN{Dd;VjnX*th0aN?R^d$P9D;yo~HMzIp2dtSX$`Ab74(!fKK
zZhm&PQ=ox$^6&-Cyht?*ch&m)x{Smt$Q0(-Q2E@T>ATX`QoQzf@n=2A-pW1cRJrEu
z^S$w4*#Ozg|Is1U(Ia<$1RxM9y%vuVSZuxu3Vr1Hl=Z39(p4I*Qe^y>VJuh~GJneH
z1}(y9x~8_MR{k2cVJY@-A;+n#CaZPa&m(G}3|<6$qxRXqmih(4%hDWgAJ
zo9$1do=3f3O?5tpaabIE*6$*$g3_Z_u-i9e2MA<_0vO83>q+9JTiA7Z5vFBgtYIbz
zqhUmp93|J*<^1(stZej7$W{E&m@6UN%KSkqG*lfX6jflyL
zs9xvF=jX;V5vrDPF>Q2h0!c~Wq(05~pOuAtP*ExrqL;zK>jPA6O{9gN7XH4M^L1Pq
zwt8%Rzfwh(HC@&CMtq!dK<2S%ypjUxgI4!JeGCVgV=f@|p*kE)gf#F)e~#z$^1q~ts1KKhu=yeY(M
zcV@8weA_5+2sMSx4*}eEJ1H~%Cu&l1>;!M&dqnUs(X=g`%vYIxQDnXzpX*C5g*a+w
zJ=P(~;?C*fw#uXHDdQngWY0B9UmAMS&j}~E&=_J`&SEWRT#_T~!BT!-L?cdLiP<1s
zdH*!yIa5E67c><=P_Hk(H3@9-PVj>!*{dKQ+Ale9kUM@Uf@CZZ&JF{Dld`j$~7UtkO)M7}HwcBSjSH
zIk4FYh4xH2Vd~d4n6@7`e{wSnE$bGa8=22t(LBj}(FD^IXyxtBQgeO0=X~m28eMC0xH4VQV
zIbCYrM*?3r&ZO=QCD#^JsqUXC8_1Z1Cb;Iv?@
zVD_-{OzfP^jT50>g#=U~26`d(NRjUO)*~E+`7J5;A)>w=7Kua^gV$~Au6kX^LSqPLG51*UcEbmA5{Iu=*zZ&bsdIFLD3GusB+&JBv#H>MBc8bJR!`e+p9u;w_+N?lyEJqe
zO^gNQDU+2_Cqq6lB_|CrEgzj?A&Yc$_^75Qm8vR6;RfvoW1PE$HV$=Ca*t1=H{Eem0Fyv!xVwl2jV(C=z;EcD#yl9k=B6o3?4
zUkExU_`Nd
(iH%3Xo>5${iM1aFzZL|qzR1(md!(&z|57A_VC
z`>w=5IAnIHV{(mTQ6_iz6YFxYDNqm!FTw7YKD-S%z2EIQTB%_5n9h!nzBH?j$HcK-
zXhlEIDe;QUTaeY4YREs>vq>Q}H~Sv_#-AtLWuFneY0lOGYUebi_SUyAf9+6vAPXwYizp46J)0CP5PJJBV)
z14O8GF6asgO3n9gxAts=LHIXS;j+#JR6o)q1S3gr2bwmulI8^ho+0Ha6)nH>r~iDAp@v6gQ!~&Rw;+XwqSKQ9t|neL44DjNOCW?j7@h3@)7cEY&~M4I3TTTEY7}Ej-F>
z|0B3$Y2>^kCw1hVcOFyO7^+Kvfd-q~=ufaK=6EH@1iQUe(mhR_M~tm4bgw2|;gefzG`v=mK+{!Zu-a
zJtF8qYOQkV%Y*aI-oMsF$-M2XcNdU>&>8PB@28iuvEM|8N1d}D(ZWLNnFb*@FAaS?
ze@8Xu(zziS7KL?oNOq?3{cLfj-p3dHiTNIyzay`axQ!sH3GgN^3k@-!xmo1690hBS
z%x%g<4C-VIc67D}@C6*P=%{01)8PCsC-*\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe Google Cloud Platform (GCP) Security Command Center is a comprehensive security and risk management platform for Google Cloud, ingested from Sentinel's connector. It offers features such as asset inventory and discovery, vulnerability and threat detection, and risk mitigation and remediation to help you gain insight into your organization's security and data attack surface. This integration enables you to perform tasks related to findings and assets more effectively.\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+ "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Google Cloud Platform Security Command Center/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Google Cloud Platform (GCP) Security Command Center is a comprehensive security and risk management platform for Google Cloud, ingested from Sentinel's connector. It offers features such as asset inventory and discovery, vulnerability and threat detection, and risk mitigation and remediation to help you gain insight into your organization's security and data attack surface. This integration enables you to perform tasks related to findings and assets more effectively.\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
"subscription": {
"resourceProviders": [
"Microsoft.OperationsManagement/solutions",
diff --git a/Solutions/Google Cloud Platform Security Command Center/Package/mainTemplate.json b/Solutions/Google Cloud Platform Security Command Center/Package/mainTemplate.json
index 08adcac78e0..9327f62410c 100644
--- a/Solutions/Google Cloud Platform Security Command Center/Package/mainTemplate.json
+++ b/Solutions/Google Cloud Platform Security Command Center/Package/mainTemplate.json
@@ -30,7 +30,7 @@
}
},
"variables": {
- "solutionId": "azuresentinel.azure-sentinel-solution-gcpsecuritycommandcenter",
+ "solutionId": "azuresentinel.azure-sentinel-solution-gcpscclogs-api",
"_solutionId": "[variables('solutionId')]",
"email": "support@microsoft.com",
"_email": "[variables('email')]",
@@ -70,13 +70,7 @@
"kind": "StaticUI",
"properties": {
"connectorUiConfig": {
- "id": "[variables('_uiConfigId1')]",
- "title": null,
- "publisher": null,
- "descriptionMarkdown": null,
- "graphQueries": null,
- "connectivityCriterias": null,
- "dataTypes": null
+ "id": "[variables('_uiConfigId1')]"
}
}
},
diff --git a/Solutions/Google Cloud Platform Security Command Center/SolutionMetadata.json b/Solutions/Google Cloud Platform Security Command Center/SolutionMetadata.json
index c9536914f82..a6c65a0a611 100644
--- a/Solutions/Google Cloud Platform Security Command Center/SolutionMetadata.json
+++ b/Solutions/Google Cloud Platform Security Command Center/SolutionMetadata.json
@@ -1,6 +1,6 @@
{
"publisherId": "azuresentinel",
- "offerId": "azure-sentinel-solution-gcpsecuritycommandcenter",
+ "offerId": "azure-sentinel-solution-gcpscclogs-api",
"firstPublishDate": "2023-09-11",
"providers": [
"Microsoft"
From ea5d0acbf647ed2a157d833bf082e0cbf6ff8b70 Mon Sep 17 00:00:00 2001
From: v-atulyadav <104008048+v-atulyadav@users.noreply.github.com>
Date: Tue, 12 Sep 2023 18:01:00 +0530
Subject: [PATCH 04/23] update package
---
.../GCPSecurityCommandCenter.json | 225 +++---
...loud Platform Security Command Center.json | 2 +-
.../Data/system_generated_metadata.json | 2 +-
.../Package/3.0.0.zip | Bin 4031 -> 6035 bytes
.../Package/createUiDefinition.json | 2 +-
.../Package/mainTemplate.json | 750 +++++++++++++-----
6 files changed, 668 insertions(+), 313 deletions(-)
diff --git a/Solutions/Google Cloud Platform Security Command Center/Data Connectors/GCPSecurityCommandCenter.json b/Solutions/Google Cloud Platform Security Command Center/Data Connectors/GCPSecurityCommandCenter.json
index 57cc88ac523..fd5b0202b84 100644
--- a/Solutions/Google Cloud Platform Security Command Center/Data Connectors/GCPSecurityCommandCenter.json
+++ b/Solutions/Google Cloud Platform Security Command Center/Data Connectors/GCPSecurityCommandCenter.json
@@ -1,124 +1,103 @@
{
- "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
- "contentVersion": "1.0.0.0",
- "parameters": {
- "workspace": {
- "type": "string",
- "defaultValue": ""
- }
- },
- "resources": [
- {
- "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition'))]",
- "apiVersion": "2022-09-01-preview",
- "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
- "location": "[parameters('workspace-location')]",
- "kind": "Customizable",
- "properties": {
- "connectorUiConfig": {
- "title": "Google Security Command Center",
- "publisher": "Microsoft",
- "descriptionMarkdown": "The Google Cloud Platform (GCP) Security Command Center is a comprehensive security and risk management platform for Google Cloud, ingested from Sentinel's connector. It offers features such as asset inventory and discovery, vulnerability and threat detection, and risk mitigation and remediation to help you gain insight into your organization's security and data attack surface. This integration enables you to perform tasks related to findings and assets more effectively.",
- "graphQueriesTableName": "GoogleCloudSCC",
- "graphQueries": [
- {
- "metricName": "Total events received",
- "legend": "Google Security Command Center",
- "baseQuery": "{{graphQueriesTableName}}"
- }
- ],
- "sampleQueries": [
- {
- "description": "Get Sample of Google SCC",
- "query": "{{graphQueriesTableName}}\n | take 10"
- }
- ],
- "dataTypes": [
- {
- "name": "{{graphQueriesTableName}}",
- "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | where name_s == \"no data test\" | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
- }
- ],
- "connectivityCriteria": [
- {
- "type": "HasDataConnectors",
- "value": null
- }
- ],
- "availability": {
- "status": 1,
- "isPreview": false
- },
- "permissions": {
- "tenant": null,
- "licenses": null,
- "resourceProvider": [
- {
- "provider": "Microsoft.OperationalInsights/workspaces",
- "permissionsDisplayText": "Read and Write permissions are required.",
- "providerDisplayName": "Workspace",
- "scope": "Workspace",
- "requiredPermissions": {
- "read": true,
- "write": true,
- "delete": true,
- "action": false
- }
- },
- {
- "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
- "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)",
- "providerDisplayName": "Keys",
- "scope": "Workspace",
- "requiredPermissions": {
- "read": false,
- "write": false,
- "delete": false,
- "action": true
- }
- }
- ]
- },
- "instructionSteps": [
- {
- "instructions": [
- {
- "type": "Markdown",
- "parameters": {
- "content": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation)."
- }
- },
- {
- "type": "CopyableLabel",
- "parameters": {
- "label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.",
- "fillWith": [
- "TenantId"
- ],
- "name": "PoolId",
- "disabled": true
- }
- },
- {
- "type": "Markdown",
- "parameters": {
- "content": "#### 2. Connect new collectors \n To enable GCP SCC for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect."
- }
- },
- {
- "type": "GCPGrid",
- "parameters": {}
- },
- {
- "type": "GCPContextPane",
- "parameters": {}
- }
- ]
- }
- ],
- "isConnectivityCriteriasMatchSome": false
- }
- }
- }]
-}
-
+"id": "GoogleSCCDefinition",
+"title": "Google Security Command Center",
+"publisher": "Microsoft",
+"descriptionMarkdown": "The Google Cloud Platform (GCP) Security Command Center is a comprehensive security and risk management platform for Google Cloud, ingested from Sentinel's connector. It offers features such as asset inventory and discovery, vulnerability and threat detection, and risk mitigation and remediation to help you gain insight into your organization's security and data attack surface. This integration enables you to perform tasks related to findings and assets more effectively.",
+"graphQueriesTableName": "GoogleCloudSCC",
+"graphQueries": [
+ {
+ "metricName": "Total events received",
+ "legend": "Google Security Command Center",
+ "baseQuery": "{{graphQueriesTableName}}"
+ }
+],
+"sampleQueries": [
+ {
+ "description": "Get Sample of Google SCC",
+ "query": "{{graphQueriesTableName}}\n | take 10"
+ }
+],
+"dataTypes": [
+ {
+ "name": "{{graphQueriesTableName}}",
+ "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | where name_s == \"no data test\" | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
+ }
+],
+"connectivityCriteria": [
+ {
+ "type": "HasDataConnectors",
+ "value": null
+ }
+],
+"availability": {
+ "status": 1,
+ "isPreview": false
+},
+"permissions": {
+ "tenant": null,
+ "licenses": null,
+ "resourceProvider": [
+ {
+ "provider": "Microsoft.OperationalInsights/workspaces",
+ "permissionsDisplayText": "Read and Write permissions are required.",
+ "providerDisplayName": "Workspace",
+ "scope": "Workspace",
+ "requiredPermissions": {
+ "read": true,
+ "write": true,
+ "delete": true,
+ "action": false
+ }
+ },
+ {
+ "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
+ "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)",
+ "providerDisplayName": "Keys",
+ "scope": "Workspace",
+ "requiredPermissions": {
+ "read": false,
+ "write": false,
+ "delete": false,
+ "action": true
+ }
+ }
+ ]
+},
+"instructionSteps": [
+ {
+ "instructions": [
+ {
+ "type": "Markdown",
+ "parameters": {
+ "content": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation)."
+ }
+ },
+ {
+ "type": "CopyableLabel",
+ "parameters": {
+ "label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.",
+ "fillWith": [
+ "TenantId"
+ ],
+ "name": "PoolId",
+ "disabled": true
+ }
+ },
+ {
+ "type": "Markdown",
+ "parameters": {
+ "content": "#### 2. Connect new collectors \n To enable GCP SCC for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect."
+ }
+ },
+ {
+ "type": "GCPGrid",
+ "parameters": {}
+ },
+ {
+ "type": "GCPContextPane",
+ "parameters": {}
+ }
+ ]
+ }
+ ]
+}
\ No newline at end of file
diff --git a/Solutions/Google Cloud Platform Security Command Center/Data/Solution_Google Cloud Platform Security Command Center.json b/Solutions/Google Cloud Platform Security Command Center/Data/Solution_Google Cloud Platform Security Command Center.json
index 5bbb783e63d..f1a5f4e1ecd 100644
--- a/Solutions/Google Cloud Platform Security Command Center/Data/Solution_Google Cloud Platform Security Command Center.json
+++ b/Solutions/Google Cloud Platform Security Command Center/Data/Solution_Google Cloud Platform Security Command Center.json
@@ -1,7 +1,7 @@
{
"Name": "Google Cloud Platform Security Command Center",
"Author": "Microsoft - support@microsoft.com",
- "Logo": "",
+ "Logo": "",
"Description": "The Google Cloud Platform (GCP) Security Command Center is a comprehensive security and risk management platform for Google Cloud, ingested from Sentinel's connector. It offers features such as asset inventory and discovery, vulnerability and threat detection, and risk mitigation and remediation to help you gain insight into your organization's security and data attack surface. This integration enables you to perform tasks related to findings and assets more effectively.",
"Data Connectors": [
"Data Connectors/GCPSecurityCommandCenter.json"
diff --git a/Solutions/Google Cloud Platform Security Command Center/Data/system_generated_metadata.json b/Solutions/Google Cloud Platform Security Command Center/Data/system_generated_metadata.json
index 2a05ee5355a..6995a9e4881 100644
--- a/Solutions/Google Cloud Platform Security Command Center/Data/system_generated_metadata.json
+++ b/Solutions/Google Cloud Platform Security Command Center/Data/system_generated_metadata.json
@@ -1,7 +1,7 @@
{
"Name": "Google Cloud Platform Security Command Center",
"Author": "Microsoft - support@microsoft.com",
- "Logo": "",
+ "Logo": "",
"Description": "The Google Cloud Platform (GCP) Security Command Center is a comprehensive security and risk management platform for Google Cloud, ingested from Sentinel's connector. It offers features such as asset inventory and discovery, vulnerability and threat detection, and risk mitigation and remediation to help you gain insight into your organization's security and data attack surface. This integration enables you to perform tasks related to findings and assets more effectively.",
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Google Cloud Platform Security Command Center\\",
"Version": "3.0.0",
diff --git a/Solutions/Google Cloud Platform Security Command Center/Package/3.0.0.zip b/Solutions/Google Cloud Platform Security Command Center/Package/3.0.0.zip
index 2fc7e40995bc23ed162e23a511895926944ebbda..dacf956459179ab438de5a0f592e3a3b9c0d74ab 100644
GIT binary patch
delta 4880
zcmV+r6YuQ5ACoT|P)h>@6aWAK2mok~ELYlFWgKG$006xa000-0P!AfhH4*`T<3y=M
z@?RxBLbFVIv=XsRPkUc~mA~y#%0-ge>g(Agn`8$EKPt;l4i4y*P0?Rvp786aeXnztU8G;b~nt>VqM&b@#^eN6H41FyUuyHp_2gw83JqNlNLm^c~B^s2YV%j}MOzM~B~x4v%_p
zc;D?dF73O;)kj{S>tC4Qlb{3^0-W-bxCCYa*^?gyx&c{}+67Glz2=iC26qlmdn{L%
zSgDFK5C8zggOjcX7=ImWZ{s%dbNed@_W&nAY$s{&fG*Gja?V~FY<4%dNxL|ti!3A2
zHXB(~MatQ9oBw`8N|g1YNcqvUJ#&F&|ThI1U^DVdW{4Dqi?OokqtXV3WP`0(i4!QnT9!=sT;qJMxr%6`{m9tBvC;m@3f
zU-b@B3?2&wJp7TwoU%|NIvO6zf4W12V>~AUp2Ne>>NE9uz&tF{ANQh5-Bp8Y?=LpC1fe`md5H8Tiiwxo5YQ~blAHdMT
zzsTTw9Qz)FVIPMGy(frV9#8@&UaP`A_*@Psd?EcLY32N@$&|R2*}v$zkefB_(-xc6+6UPkjP$0FC<5U
z0pdgol^`ht^c3LZfOzt^{=rh{_WJsHe}Dgj3v+mKSETN9`^0Yo%*7s$0t!D1BSF|G
z2uOdV&>nQ*Z71FpaU$x2kdT<5*VKy{XA^<0Ksjkh0x36~h$M1hK}l`i04E*zP*t@M
zhHZ1=8h;;}N`y$F+sx#bnq-~y7N_@KQ<2VW!eVs6rsyQZ!K0uaUt_N7w`|6}1&%4c
z3rNK}=S+B)vH9FDt@63Q*PmA70u|~YHiOX
zu6M@RG$3dku*8S?c}YygBO0?gY+gPZ!-PrP2!Eik8+~2ai^`o&5;0@3?2|LG)DK9!
zhb{8lO94$4F}DGmvPN(zgVbKiv!zIP)`9+Wpt}yHUc@~QK=A>NXc3&0k1-2FFk~#w
zrjh@BN+vXz%AQY0L35IomPdG+$m_4%8Z7q@3`-=1B(yd7V>{o(YsGDNCLZmO;&W#|4;
zJC>B}Alt&wo+Ze#DJ
zaTbH6+f^G4&K(JT{x&QvTmJZld;+dZYL=VNUUB1bUCEY>2RySD7H8{zneG6*%zyEM
z#jm@RA1YG?SppITt?aM)b5HB1;-s@0m)EDtU)wT@xhY;X0uyYZJj_i
z8{29#Ba>}Y7BCy#FUi!PqNg1+sDD|4OO)4a{joIkMq6JSzs5F{2M!h#7GqQIkK?87
zd3K{)TCU~dRIP89Rkbau;=SA&)bN|*$}
zhTRmOa6v;whua9*dc_RHHh=ZrlqoGpOG6hsL#r*9LoZkyKk%bxP(3@rDvR^)fIYag
z+@0N7BFY`KZcBX`G-Z=q+6VjGb*sv2M_M~CuYKWUvkQU46e~%(m!Tgqnr}rqC>s@P
zQZiaA+Lq!o73Y=eM%CW6LX;Y^jEt;?P?J~%TrNVazNdWg#TS)y<9~)CT<3k=ma1!t
zTU+*=b>dW01h?7jq4r3|2^VZmf0bOS_HjtNrBwbvf#3<98uu0OZADP5M%n97rQuO>
z7f?Pk7gtKX3q`=!IKKDUgJRP4jG$66>@vV&!s0pFI~!l_n`n}yK#V*#hozp$;C?|6
z*Ii||nDTqHOq-!dgMXFf#v;N4M8heVHGSwn7aRK=<*Xc{bAi}o0xO9o1PfURLphO*m{9{kPM~B2L*ybs-|hlUwsC&
z`!xMqFf=1UgdSOfrkIBEV1*P|_#Ym@r!ivj6o()+O1gNNAAeGS5f%b__dt0(0ZAO9
z>lv^S#*=BP1&D-7F%=Sd>Vw3JX9Dwk4%EnmqB;%&^6vxNxB{&hz|ow=1QB2oOlm=b
z$Dv6Q09iEqPXbX3Ned|DqG&?}#W=im53)GFpqVlCH12CAaDa$hL^)HB$YUrr$1osM
z68bA^P!8t~bAKXd^e91n{@lo*rzf*5Z?@xxU9ZRSJPODLI9RFcpMe@&DcGPZTF1-_
znS=SoI`f}G^cx7_JwZo@o8p2l5U#}my(5~}%qBsY3mJC4%OuV&1;C3!`z<>xaZTss
zj7UQxHT0hdPubql@oYcuASu1&=)3RGPrZ<(=0Kj~`hTfcA?Y_T4P5|66;{-%~Hv%_=&nl*OGcUV?U`vKqMa>#EDD;L@67#Rs}Xl{6c
zX^`y>tq~xE2(a-;X+1Ji*`xe2^L<{R2@W`E>}slmfW4nn&aKgC58N~yik>Yd?gi9?
z%~|P~rGKY(hc7di%NkwSgR5S&gyrn>IfSl7Hl3!W$ZPURa-;W7o^+IU|GgAbROpB>
zC`e3xNoY)b)7DtVl2LzJu6E{!k6d7Y7ZP6o+Di!C3ByB2I`Mm2ABS$*XQd
zd=ikZW3ZQPRA#*>HcK|H9jTpHD+%X_&p?d)SAXPj6LMOVPVnhc*ytXBD<@f=zRgjW
z#TVUNk@PgL&%8wX*SU`x5FCf8FNp70A_^cRJLEg27qJVi8am2<;vOT(<>#sc3iUMiq&OI
zu76ow2IZ$#ds%q6oVZBwEYOE5LF~dpWLYo{-Q1u_M17k5yEg
zuCGXxUqM4hLx@-eN}@D=gn%0&zy*z2sA6XD^8O2f;5^|1&F~`C_z4RF25LA}-Is^g
zeVG&?>F(#L!~>|Y4K&lcVQy_+vVUh%ivtE02{aOdZwQ|v#)8JrGqqJ%IEfcj
znkLU<36T3h#jI-7rZByXB5-T7WA#N^hH{qIB#yC)bTb4Tom`&hWS*bAhW{aC_hjG>
z59NpX%)uI7(C}VjTf#}<7tGxhh)eF2nLANtPW>F{Y{N*zgpB484Ul+Lc1lOU=YLTS
zd8Cir-sS|{DzacM`$MLuSdJ`H1@2Ps(
z$8J!HEt}Q3@3z{qIV8Y!%VXM0(0{>mTMDGuxdmXH}mDO{PEN_`FxX(`C5
z{AS{<==&s4ghP^ANd*}?WMuwSHEQ2+*LZ(GarpsAk@&3
zzmY;&u|}6t;C4o+dQ7#I!+$HB#narqQpcoQ-kZt?7|uC0$wFyxlC02m&{npLI0PR$gFw^gZ)|-=SyN%xNyP&yX6v?^)7u`=aLtPOI@1II#@1k
zalHq{3772>7FT2j2CR0;N)w?@m#Da1nqrA-yUQqbx~61R{d0uA>ZK=!O|HHurB7V8
ztTha~_vgRFGF>*;Gk-H_@A_uC-qDHOrIq>fjVs@lFRL^NL~$;!+BLpm;9u^x%68l6
z8l%cE_KPTzXz+X3Ypf-dTfozuYXq}(yRO4ZiH69Y`_G_
zGK1FdB&hXn`F53h-?r~FsP(R#YR_4KSKGlb{ZO>s$2Bt^F+w4D)lX@z+>ow
zXra#*q-B~=-+zrW9aXC)TQ?zjI0I~ZZ8uOgPr_7_%y;_sJ=*T4^)}?$fpZDn^9@ZELPt<9F%tTxx=qkk2c3vIScXtlW#XGbmDikZ@C
zTlEytle!gBw&k?e+&&8PDD9&T#-wRKI6D4)_Jgvev>{q6Jy(OKl@6Q>Ti34JkvXD+
zg)S0q=xC>2p>cQrb*p?+Q&IevPu#G}*5dV-=b2O5-yb%QSrKJJNZ^XOGSo%i?If1I
zFsr)d$$!t?n5%4ehgEIN#Z)-aoU?JGM>eSirL^U_+zoQQP_0&o4@|JoQ*!;!cPG7?l((;kj=6@=bZz{{sR`9D}T+7+&Tr##56g#Y1
z!8ZoGAH0)%H|BPp7oRGPlgJDX^({Bnsd2?#w_$H3a
zxSstg4Khk1XRUQpI6Jv5ucGp)nVi={*srX(c|(dH!Q?{7vI-q>Zw1
zp=vtIR>LXQ>bU|32ga(bTlPD6u(I2sXIFPLYJD5`sNBArT!`xVkZu-nd6CGe0~{l>
z3l+@o#azW;@&)&%uGDML7QN11yZ@nn`|#z{m;VD$O928D02BZK00;nRjx1N&TV)($
z1^@uPlRghPA5VKMSC?3+iZT!Y0K|g;01*HH000000096X0001(la&u72Kg2M0002U
C$zKov
delta 2927
zcmV-#3y}1aFTWobP)h>@6aWAK2mobNELVw;sH9;A006+T7cc>T<=(ILUTBs{k5(eK
z>1prlukyD&O1Vf{Gt|DtOTV`rQ0u6e2588i3&I@mJM$D^~F^E$+vN|_m7
zDwRl1=Ta3h+-4S&$N>xiZj;pkBN9wCV^eulM`XNoDLkN@Ys+jFX<5jOYc>_KcFm?P
zGbu)@MI~Mvhmq-%lL8?D)RVOWG67AK=mIM^DPYYV>~PXo&6=14`h#}0G&%G1;fB?*
ziUz^3Rj*7jZ5OOoDZ?fd0O^Ro(rPK04e-wXvUEt21(AH5gRcii}
zFv_ZkyyOgZ&;)J4`_0Eg8#1XPwihn66Xuw=z2Q2Sh-2s`rGDD4aL(I@+UEGNA>g-JuO4}>D&Uv?|H?$7V^x`ZR$SA9o?4D9e-U=5*
z;4^zBr0eFB9t0qN_wc*K&lb8bd6w9;-vO~d2wjAO;o;yu=tBKFT8G_7l2o~ABDj2h
z+hrzZ5}SI9un&6l+sO$-A|Ccy+3>Lm^c~B^sG5dOj}MOzM~B~x4v%_pc;D?dF73O;
z)kj{S>t7h+F0{%o&__Gcl1;gE;``Zv-WBmw$+#T!Zv6d|y#!+c+>;>%x&dXA+yzYn
zJ?N7w26qk*Vk}n|g7W5I2mkYzwaR_N~9(ECCPAy-L1oBkM85VPNNur8V
zxkhI|02eVj11f}%6xn+tVTm~gDStr$N5+grSQ>@uC0LZ}k|+U$
zDeTVL<(MpRmC2uQR%yH|P6VrXMBZ>#l}E=D%jMdo)iGF2OGKQOwM?V8OrlDVc#Li<
zi3&nu5+lh_iG@Iz=b@BKu#b@F<3-IRyi8e@#UY@EUz6|~%;Sgw+Q$h(KYtTM3n2-P
z6;&itfnNNC0Ui0)DvrHBd?6HZsaa=}@y!7pB+24Q67zBfPatrxo__p|S&
zArCg!6@)1;JPLjwiH;nGOk5*jgUR|vpb&zQsHjkprS!AH!g59;^(z>+QF9d7{owfc
zdbjSL%3CxWj<&s2{@LZ^3j5`mo~CA>&lX=WT6NJ_9$Nv45g~sABxgl+yEf
z27pDCWeuHSFi(#GFjq4V#F8Mt0i+V}hdKw&<0Ibw44N33d|wi-Lmg-5fRUt9Oq;+K
z!5Fz|(QH6ojFCgd+N~ksNu|g*N)0Kmlda!EyG*mqCbr34mLyW%pSk5@K)Z1;-J)DD
z-h~~;Q5cM?g8o_&lYi|;`x)SPNQ*k)wD2=8;(Tg#_kPD&Tt!Vt)$&TbB%UB{>W#lV
zQIZGaAdUk40~rM_jRG}|L3EA!+Lgsn*-LT5Z^*q?`3(a#{5O?;fX*U&u+DaR>8jg-
zMSZ)qcC~U&Np2b#=yPRs?zYx_Q+Zl)wxZDG#k4k;O$_05B7Z2^PHB5~^6a@88pD#4
z6(x5LXi-LD8n{chNHwhfnypVDVimX@A9hGT2Xs?X7k=MmEPiUcqb)hc~`s+_2
z4Wp=Y8X1hYwtq@oZxHbh1o!@?H~4Jq^<<#^=ac{GCd97pu)VkJRWCPH)B<#pcNU&J
z?@itYhYqBcE7o_v2ed3aW`ll;eh7Uuty{emhlGViK4g0_J0Qf)%h|k-F-^%2-&pqT+|D>dQ8==X&7@4W?hrxb#v^a;Y8;_
zoo|4a4SXtDH$2*YFI^LRkvbw97$57%l?EcBfA?UoRiEx;S-xxYVQ8(EWr9`QS=o34FV&kc?sq6(6r_{hb>SmyCaG8x&^~x+7Ij13!$w
zq2x@KNjUH$gl;-*-+72d9pU+dm=f
zm<*m`A~<{!@Y+Xz=ik-w_wV!`vw_ZjNJl@Ylke)_2Y2qKBmWiE(w6r6;^kpQ^XY4e
zlNH@Aye+;DXy$&4eRw*I%IY?wA|?E_PqF)+G)6n4&AqYuM&>%|=H=;JNY0An^evO*
z#eaNSf1x?aPv7gus~oSrx
z0CEnzOdq{Ddv`o|3kRIlEnE(9m#Ut!B7aC&PzA=RSfcjw43(Db=2Q3>WP=!&_N~@>
zB@pc;-vpgY#1^2JKnsGUdbmTPic*9@3?YaFA}c^-+;E2|iWr3J8ahms6_9qfG_#^f
z@CBAAhIELGFt`8|OL^jJVr|_Xm~;&dV$$vHs2dHGNo@$^8^VVp_hR*3&(ep
zgvzwKtpu_2y}odMr7UIs8(Qm5bC_BQpI)$p3A1-&_a&GJP5R>&x=D0D@OV
zYyEY)=Rh@lJoDzt{ZRft82wKSMt<8=XCqQXJy)C~rpF=k7p-2seZ9dK+J7xLlBzeE
zolg}z2l^WBu_uR`%%P_PpTJ&sISa~#d}l_O*XG5lp7y>9XEQ$&?bx_!DaWPl^0kW!
z(;rC~?{iMf)Pq^iL(!;7xv)+~yWr{RDrSGS8a~yDe)of\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Google Cloud Platform Security Command Center/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Google Cloud Platform (GCP) Security Command Center is a comprehensive security and risk management platform for Google Cloud, ingested from Sentinel's connector. It offers features such as asset inventory and discovery, vulnerability and threat detection, and risk mitigation and remediation to help you gain insight into your organization's security and data attack surface. This integration enables you to perform tasks related to findings and assets more effectively.\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+ "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Google Cloud Platform Security Command Center/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Google Cloud Platform (GCP) Security Command Center is a comprehensive security and risk management platform for Google Cloud, ingested from Sentinel's connector. It offers features such as asset inventory and discovery, vulnerability and threat detection, and risk mitigation and remediation to help you gain insight into your organization's security and data attack surface. This integration enables you to perform tasks related to findings and assets more effectively.\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
"subscription": {
"resourceProviders": [
"Microsoft.OperationsManagement/solutions",
diff --git a/Solutions/Google Cloud Platform Security Command Center/Package/mainTemplate.json b/Solutions/Google Cloud Platform Security Command Center/Package/mainTemplate.json
index 9327f62410c..92a80824c6b 100644
--- a/Solutions/Google Cloud Platform Security Command Center/Package/mainTemplate.json
+++ b/Solutions/Google Cloud Platform Security Command Center/Package/mainTemplate.json
@@ -1,204 +1,580 @@
{
- "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
- "contentVersion": "1.0.0.0",
- "metadata": {
- "author": "Microsoft - support@microsoft.com",
- "comments": "Solution template for Google Cloud Platform Security Command Center"
- },
- "parameters": {
- "location": {
- "type": "string",
- "minLength": 1,
- "defaultValue": "[resourceGroup().location]",
- "metadata": {
- "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace"
- }
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "location": {
+ "type": "string",
+ "minLength": 1,
+ "defaultValue": "[resourceGroup().location]",
+ "metadata": {
+ "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace"
+ }
+ },
+ "workspace-location": {
+ "type": "string",
+ "defaultValue": "",
+ "metadata": {
+ "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"
+ }
+ },
+ "subscription": {
+ "defaultValue": "[last(split(subscription().id, '/'))]",
+ "type": "string",
+ "metadata": {
+ "description": "subscription id where Microsoft Sentinel is setup"
+ }
+ },
+ "resourceGroupName": {
+ "defaultValue": "[resourceGroup().name]",
+ "type": "string",
+ "metadata": {
+ "description": "resource group name where Microsoft Sentinel is setup"
+ }
+ },
+ "workspace": {
+ "defaultValue": "",
+ "type": "string",
+ "metadata": {
+ "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
+ }
+ }
},
- "workspace-location": {
- "type": "string",
- "defaultValue": "",
- "metadata": {
- "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"
- }
+ "variables": {
+ "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
+ "_solutionName": "Google Cloud Security Command Center",
+ "_solutionVersion": "3.0.0",
+ "_solutionAuthor": "Microsoft",
+ "_packageIcon": "google_logo",
+ "_solutionId": "azuresentinel.azure-sentinel-solution-gcpscclogs-api",
+ "dataConnectorVersionConnectorDefinition": "3.0.0",
+ "dataConnectorVersionConnections": "3.0.0",
+ "_solutionTier": "Microsoft",
+ "_dataConnectorContentIdConnectorDefinition": "GoogleSCCDefinition",
+ "dataConnectorTemplateNameConnectorDefinition": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition')))]",
+ "_dataConnectorContentIdConnections": "GoogleSCCTemplateConnections",
+ "dataConnectorTemplateNameConnections": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections')))]",
+ "dataType": "GoogleCloudSCC",
+ "streamName": "SENTINEL_GOOGLE_CLOUD_SCC",
+ "_logAnalyticsTableId1": "GoogleCloudSCC",
+ "dataCollectionRuleId": "GoogleCloudSCC"
},
- "workspace": {
- "defaultValue": "",
- "type": "string",
- "metadata": {
- "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
- }
- }
- },
- "variables": {
- "solutionId": "azuresentinel.azure-sentinel-solution-gcpscclogs-api",
- "_solutionId": "[variables('solutionId')]",
- "email": "support@microsoft.com",
- "_email": "[variables('email')]",
- "_solutionName": "Google Cloud Platform Security Command Center",
- "_solutionVersion": "3.0.0",
- "dataConnectorContentId1": null,
- "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]",
- "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]",
- "_dataConnectorId1": "[variables('dataConnectorId1')]",
- "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]",
- "dataConnectorVersion1": "1.0.0",
- "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]",
- "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
- },
- "resources": [
- {
- "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
- "apiVersion": "2023-04-01-preview",
- "name": "[variables('dataConnectorTemplateSpecName1')]",
- "location": "[parameters('workspace-location')]",
- "dependsOn": [
- "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
- ],
- "properties": {
- "description": "Google Cloud Platform Security Command Center data connector with template version 3.0.0",
- "mainTemplate": {
- "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
- "contentVersion": "[variables('dataConnectorVersion1')]",
- "parameters": {},
- "variables": {},
- "resources": [
- {
- "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]",
- "apiVersion": "2021-03-01-preview",
- "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
- "location": "[parameters('workspace-location')]",
- "kind": "StaticUI",
- "properties": {
+ "resources": [
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition'), variables('dataConnectorVersionConnectorDefinition'))]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "contentId": "[variables('_dataConnectorContentIdConnectorDefinition')]",
+ "displayName": "[concat(variables('_solutionName'), variables('dataConnectorTemplateNameConnectorDefinition'))]",
+ "contentKind": "DataConnector",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('dataConnectorVersionConnectorDefinition')]",
+ "parameters": {
+
+ },
+ "variables": {
+
+ },
+ "resources": [
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition')))]",
+ "apiVersion": "2022-01-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "properties": {
+ "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition'))]",
+ "contentId": "[variables('_dataConnectorContentIdConnectorDefinition')]",
+ "kind": "DataConnector",
+ "version": "[variables('dataConnectorVersionConnectorDefinition')]",
+ "source": {
+ "sourceId": "[variables('_solutionId')]",
+ "name": "[variables('_solutionName')]",
+ "kind": "Solution"
+ },
+ "author": {
+ "name": "[variables('_solutionAuthor')]"
+ },
+ "support": {
+ "name": "[variables('_solutionAuthor')]",
+ "tier": "[variables('_solutionTier')]"
+ },
+ "dependencies": {
+ "criteria": [
+ {
+ "version": "[variables('dataConnectorVersionConnections')]",
+ "contentId": "[variables('_dataConnectorContentIdConnections')]",
+ "kind": "ResourcesDataConnector"
+ }
+ ]
+ }
+ }
+ },
+ {
+ "name": "[variables('dataCollectionRuleId')]",
+ "apiVersion": "2021-09-01-preview",
+ "type": "Microsoft.Insights/dataCollectionRules",
+ "location": "[parameters('workspace-location')]",
+ "kind": null,
+ "properties": {
+ "destinations": {
+ "logAnalytics": [
+ {
+ "workspaceResourceId": "[variables('workspaceResourceId')]",
+ "name": "clv2ws1"
+ }
+ ]
+ },
+ "dataFlows": [
+ {
+ "streams": [
+ "Microsoft-GoogleCloudSCC"
+ ],
+ "destinations": [
+ "clv2ws1"
+ ]
+ }
+ ],
+ "dataCollectionEndpointId": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]"
+ }
+ },
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition'))]",
+ "apiVersion": "2022-09-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
+ "location": "[parameters('workspace-location')]",
+ "kind": "Customizable",
+ "properties": {
"connectorUiConfig": {
- "id": "[variables('_uiConfigId1')]"
- }
- }
- },
- {
- "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
- "apiVersion": "2023-04-01-preview",
- "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]",
- "properties": {
- "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]",
- "contentId": "[variables('_dataConnectorContentId1')]",
+ "title": "Google Security Command Center",
+ "publisher": "Microsoft",
+ "descriptionMarkdown": "The Google Cloud Platform (GCP) Security Command Center is a comprehensive security and risk management platform for Google Cloud, ingested from Sentinel's connector. It offers features such as asset inventory and discovery, vulnerability and threat detection, and risk mitigation and remediation to help you gain insight into your organization's security and data attack surface. This integration enables you to perform tasks related to findings and assets more effectively.",
+ "graphQueriesTableName": "GoogleCloudSCC",
+ "graphQueries": [
+ {
+ "metricName": "Total events received",
+ "legend": "Google Security Command Center",
+ "baseQuery": "{{graphQueriesTableName}}"
+ }
+ ],
+ "sampleQueries": [
+ {
+ "description": "Get Sample of Google SCC",
+ "query": "{{graphQueriesTableName}}\n | take 10"
+ }
+ ],
+ "dataTypes": [
+ {
+ "name": "{{graphQueriesTableName}}",
+ "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | where name_s == \"no data test\" | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
+ }
+ ],
+ "connectivityCriteria": [
+ {
+ "type": "HasDataConnectors",
+ "value": null
+ }
+ ],
+ "availability": {
+ "status": 1,
+ "isPreview": false
+ },
+ "permissions": {
+ "tenant": null,
+ "licenses": null,
+ "resourceProvider": [
+ {
+ "provider": "Microsoft.OperationalInsights/workspaces",
+ "permissionsDisplayText": "Read and Write permissions are required.",
+ "providerDisplayName": "Workspace",
+ "scope": "Workspace",
+ "requiredPermissions": {
+ "read": true,
+ "write": true,
+ "delete": true,
+ "action": false
+ }
+ },
+ {
+ "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
+ "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)",
+ "providerDisplayName": "Keys",
+ "scope": "Workspace",
+ "requiredPermissions": {
+ "read": false,
+ "write": false,
+ "delete": false,
+ "action": true
+ }
+ }
+ ]
+ },
+ "instructionSteps": [
+ {
+ "instructions": [
+ {
+ "type": "Markdown",
+ "parameters": {
+ "content": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation)."
+ }
+ },
+ {
+ "type": "CopyableLabel",
+ "parameters": {
+ "label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.",
+ "fillWith": [
+ "TenantId"
+ ],
+ "name": "PoolId",
+ "disabled": true
+ }
+ },
+ {
+ "type": "Markdown",
+ "parameters": {
+ "content": "#### 2. Connect new collectors \n To enable GCP SCC for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect."
+ }
+ },
+ {
+ "type": "GCPGrid",
+ "parameters": {}
+ },
+ {
+ "type": "GCPContextPane",
+ "parameters": {}
+ }
+ ]
+ }
+ ],
+ "isConnectivityCriteriasMatchSome": false
+ }}
+ }
+
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition'),'-', variables('dataConnectorVersionConnectorDefinition'))))]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "version": "[variables('_solutionVersion')]"
+ }
+ },
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition'))]",
+ "apiVersion": "2022-09-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
+ "location": "[parameters('workspace-location')]",
+ "kind": "Customizable",
+ "properties": {
+ "connectorUiConfig": {
+ "title": "Google Security Command Center",
+ "publisher": "Microsoft",
+ "descriptionMarkdown": "The Google Cloud Platform (GCP) Security Command Center is a comprehensive security and risk management platform for Google Cloud, ingested from Sentinel's connector. It offers features such as asset inventory and discovery, vulnerability and threat detection, and risk mitigation and remediation to help you gain insight into your organization's security and data attack surface. This integration enables you to perform tasks related to findings and assets more effectively.",
+ "graphQueriesTableName": "GoogleCloudSCC",
+ "graphQueries": [
+ {
+ "metricName": "Total events received",
+ "legend": "Google Security Command Center",
+ "baseQuery": "{{graphQueriesTableName}}"
+ }
+ ],
+ "sampleQueries": [
+ {
+ "description": "Get Sample of Google SCC",
+ "query": "{{graphQueriesTableName}}\n | take 10"
+ }
+ ],
+ "dataTypes": [
+ {
+ "name": "{{graphQueriesTableName}}",
+ "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | where name_s == \"no data test\" | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
+ }
+ ],
+ "connectivityCriteria": [
+ {
+ "type": "HasDataConnectors",
+ "value": null
+ }
+ ],
+ "availability": {
+ "status": 1,
+ "isPreview": false
+ },
+ "permissions": {
+ "tenant": null,
+ "licenses": null,
+ "resourceProvider": [
+ {
+ "provider": "Microsoft.OperationalInsights/workspaces",
+ "permissionsDisplayText": "Read and Write permissions are required.",
+ "providerDisplayName": "Workspace",
+ "scope": "Workspace",
+ "requiredPermissions": {
+ "read": true,
+ "write": true,
+ "delete": true,
+ "action": false
+ }
+ },
+ {
+ "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
+ "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)",
+ "providerDisplayName": "Keys",
+ "scope": "Workspace",
+ "requiredPermissions": {
+ "read": false,
+ "write": false,
+ "delete": false,
+ "action": true
+ }
+ }
+ ]
+ },
+ "instructionSteps": [
+ {
+ "instructions": [
+ {
+ "type": "Markdown",
+ "parameters": {
+ "content": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation)."
+ }
+ },
+ {
+ "type": "CopyableLabel",
+ "parameters": {
+ "label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.",
+ "fillWith": [
+ "TenantId"
+ ],
+ "name": "PoolId",
+ "disabled": true
+ }
+ },
+ {
+ "type": "Markdown",
+ "parameters": {
+ "content": "#### 2. Connect new collectors \n To enable GCP SCC for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect."
+ }
+ },
+ {
+ "type": "GCPGrid",
+ "parameters": {}
+ },
+ {
+ "type": "GCPContextPane",
+ "parameters": {}
+ }
+ ]
+ }
+ ],
+ "isConnectivityCriteriasMatchSome": false
+ }}
+ },
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition')))]",
+ "apiVersion": "2022-01-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "properties": {
+ "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition'))]",
+ "contentId": "[variables('_dataConnectorContentIdConnectorDefinition')]",
"kind": "DataConnector",
- "version": "[variables('dataConnectorVersion1')]",
+ "version": "[variables('dataConnectorVersionConnectorDefinition')]",
"source": {
- "kind": "Solution",
- "name": "Google Cloud Platform Security Command Center",
- "sourceId": "[variables('_solutionId')]"
+ "sourceId": "[variables('_solutionId')]",
+ "name": "[variables('_solutionName')]",
+ "kind": "Solution"
},
"author": {
- "name": "Microsoft",
- "email": "[variables('_email')]"
+ "name": "[variables('_solutionAuthor')]"
},
"support": {
- "name": "Microsoft Corporation",
- "email": "support@microsoft.com",
- "tier": "Microsoft",
- "link": "https://support.microsoft.com"
+ "name": "[variables('_solutionAuthor')]",
+ "tier": "[variables('_solutionTier')]"
+ },
+ "dependencies": {
+ "criteria": [
+ {
+ "version": "[variables('dataConnectorVersionConnections')]",
+ "contentId": "[variables('_dataConnectorContentIdConnections')]",
+ "kind": "ResourcesDataConnector"
+ }
+ ]
}
- }
}
- ]
},
- "packageKind": "Solution",
- "packageVersion": "[variables('_solutionVersion')]",
- "packageName": "[variables('_solutionName')]",
- "packageId": "[variables('_solutionId')]",
- "contentSchemaVersion": "3.0.0",
- "contentId": "[variables('_dataConnectorContentId1')]",
- "contentKind": "DataConnector",
- "displayName": null,
- "contentProductId": "[variables('_dataConnectorcontentProductId1')]",
- "id": "[variables('_dataConnectorcontentProductId1')]",
- "version": "[variables('dataConnectorVersion1')]"
- }
- },
- {
- "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
- "apiVersion": "2023-04-01-preview",
- "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]",
- "dependsOn": [
- "[variables('_dataConnectorId1')]"
- ],
- "location": "[parameters('workspace-location')]",
- "properties": {
- "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]",
- "contentId": "[variables('_dataConnectorContentId1')]",
- "kind": "DataConnector",
- "version": "[variables('dataConnectorVersion1')]",
- "source": {
- "kind": "Solution",
- "name": "Google Cloud Platform Security Command Center",
- "sourceId": "[variables('_solutionId')]"
- },
- "author": {
- "name": "Microsoft",
- "email": "[variables('_email')]"
- },
- "support": {
- "name": "Microsoft Corporation",
- "email": "support@microsoft.com",
- "tier": "Microsoft",
- "link": "https://support.microsoft.com"
- }
- }
- },
- {
- "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
- "apiVersion": "2023-04-01-preview",
- "location": "[parameters('workspace-location')]",
- "properties": {
- "version": "3.0.0",
- "kind": "Solution",
- "contentSchemaVersion": "3.0.0",
- "displayName": "Google Cloud Platform Security Command Center",
- "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation",
- "descriptionHtml": "Note: There may be known issues pertaining to this Solution, please refer to them before installing. \nThe Google Cloud Platform (GCP) Security Command Center is a comprehensive security and risk management platform for Google Cloud, ingested from Sentinel's connector. It offers features such as asset inventory and discovery, vulnerability and threat detection, and risk mitigation and remediation to help you gain insight into your organization's security and data attack surface. This integration enables you to perform tasks related to findings and assets more effectively. \nData Connectors: 1 \nLearn more about Microsoft Sentinel | Learn more about Solutions \n",
- "contentKind": "Solution",
- "contentProductId": "[variables('_solutioncontentProductId')]",
- "id": "[variables('_solutioncontentProductId')]",
- "icon": "",
- "contentId": "[variables('_solutionId')]",
- "parentId": "[variables('_solutionId')]",
- "source": {
- "kind": "Solution",
- "name": "Google Cloud Platform Security Command Center",
- "sourceId": "[variables('_solutionId')]"
- },
- "author": {
- "name": "Microsoft",
- "email": "[variables('_email')]"
- },
- "support": {
- "name": "Microsoft Corporation",
- "email": "support@microsoft.com",
- "tier": "Microsoft",
- "link": "https://support.microsoft.com"
- },
- "dependencies": {
- "operator": "AND",
- "criteria": [
- {
- "kind": "DataConnector",
- "contentId": "[variables('_dataConnectorContentId1')]",
- "version": "[variables('dataConnectorVersion1')]"
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections'), variables('dataConnectorVersionConnections'))]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "contentId": "[variables('_dataConnectorContentIdConnections')]",
+ "displayName": "[concat(variables('_solutionName'), variables('dataConnectorTemplateNameConnections'))]",
+ "contentKind": "ResourcesDataConnector",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('dataConnectorVersionConnections')]",
+ "parameters": {
+ "GCPProjectId": {
+ "type": "String",
+ "minLength": 4
+ },
+ "GCPProjectNumber": {
+ "type": "String",
+ "minLength": 1
+ },
+ "GCPWorkloadIdentityProviderId": {
+ "type": "String"
+ },
+ "GCPServiceAccountEmail": {
+ "type": "String",
+ "minLength": 1
+ },
+ "GCPSubscriptionName": {
+ "type": "String",
+ "minLength": 3
+ },
+ "connectorDefinitionName": {
+ "defaultValue": "connectorDefinitionName",
+ "type": "string",
+ "minLength": 1,
+ "metadata": {
+ "description": "connectorDefinitionName"
+ }
+ },
+ "workspace": {
+ "defaultValue": "[parameters('workspace')]",
+ "type": "string"
+ },
+ "dcrConfig": {
+ "type": "object",
+ "defaultValue": {
+ "dataCollectionEndpoint": "data collection Endpoint",
+ "dataCollectionRuleImmutableId": "data collection rule immutableId"
+ }
+ },
+ "guidValue": {
+ "type": "string",
+ "defaultValue": "[[newGuid()]"
+ }
+ },
+ "variables": {
+ "_dataConnectorContentIdConnections": "[variables('_dataConnectorContentIdConnections')]",
+ "connectorName": "[[concat('GCPAuditLogs', parameters('guidValue'))]"
+
+ },
+ "resources": [
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections')))]",
+ "apiVersion": "2022-01-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "properties": {
+ "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections'))]",
+ "contentId": "[variables('_dataConnectorContentIdConnections')]",
+ "kind": "ResourcesDataConnector",
+ "version": "[variables('dataConnectorVersionConnections')]",
+ "source": {
+ "sourceId": "[variables('_solutionId')]",
+ "name": "[variables('_solutionName')]",
+ "kind": "Solution"
+ },
+ "author": {
+ "name": "[variables('_solutionAuthor')]"
+ },
+ "support": {
+ "name": "[variables('_solutionAuthor')]",
+ "tier": "[variables('_solutionTier')]"
+ }
+ }
+ },
+ "name": "[[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('connectorName'))]",
+ "apiVersion": "2022-12-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
+ "location": "[parameters('workspace-location')]",
+ "kind": "GCP",
+ "properties": {
+ "connectorDefinitionName": "[[parameters('connectorDefinitionName')]",
+ "dcrConfig": {
+ "streamName": "[variables('streamName')]",
+ "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]",
+ "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]"
+ },
+ "dataType": "[variables('dataType')]",
+ "auth": {
+ "serviceAccountEmail": "[[parameters('GCPServiceAccountEmail')]",
+ "projectNumber": "[[parameters('GCPProjectNumber')]",
+ "workloadIdentityProviderId": "[[parameters('GCPWorkloadIdentityProviderId')]"
+ },
+ "request": {
+ "projectId": "[[parameters('GCPProjectId')]",
+ "subscriptionNames": [
+ "[[parameters('GCPSubscriptionName')]"
+ ]
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections'),'-', variables('dataConnectorVersionConnections'))))]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "version": "[variables('_solutionVersion')]"
}
- ]
},
- "firstPublishDate": "2023-09-11",
- "providers": [
- "Microsoft"
- ],
- "categories": {
- "domains": [
- "Security - Cloud Security"
- ]
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]",
+ "location": "[parameters('workspace-location')]",
+ "apiVersion": "2023-04-01-preview",
+ "properties": {
+ "version": "[variables('_solutionVersion')]",
+ "kind": "Solution",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('_solutionId')]",
+ "source": {
+ "kind": "Solution",
+ "name": "[variables('_solutionName')]",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "[variables('_solutionAuthor')]"
+ },
+ "support": {
+ "name": "[variables('_solutionAuthor')]"
+ },
+ "dependencies": {
+ "operator": "AND",
+ "criteria": [
+ {
+ "kind": "DataConnector",
+ "contentId": "[variables('dataConnectorVersionConnectorDefinition')]",
+ "version": "[variables('_dataConnectorContentIdConnectorDefinition')]"
+ }
+ ]
+ },
+ "firstPublishDate": "2022-06-24",
+ "providers": [
+ "[variables('_solutionAuthor')]"
+ ],
+ "contentKind": "Solution",
+ "packageId": "[variables('_solutionId')]",
+ "contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]",
+ "displayName": "[variables('_solutionName')]",
+ "publisherDisplayName": "[variables('_solutionId')]",
+ "descriptionHtml": "test",
+ "icon": "[variables('_packageIcon')]"
+ }
}
- },
- "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]"
- }
- ],
- "outputs": {}
+ ]
}
From bd5d226d20c7db600967572982a64afc5550a11b Mon Sep 17 00:00:00 2001
From: v-atulyadav <104008048+v-atulyadav@users.noreply.github.com>
Date: Tue, 12 Sep 2023 18:36:53 +0530
Subject: [PATCH 05/23] Update zip
---
.../Package/3.0.0.zip | Bin 6035 -> 6040 bytes
.../Package/mainTemplate.json | 1 +
2 files changed, 1 insertion(+)
diff --git a/Solutions/Google Cloud Platform Security Command Center/Package/3.0.0.zip b/Solutions/Google Cloud Platform Security Command Center/Package/3.0.0.zip
index dacf956459179ab438de5a0f592e3a3b9c0d74ab..119c3a37138e7d59813086f0859ef46843e44490 100644
GIT binary patch
delta 3613
zcmV+&4&w2XFPJZ|q6Q5YlPp(S(+hMr5C8zoldlFJ9`p8B5bgm^fY?sb-T_^p2jrZ+
zG}!EJZj*L#NEa!S>;@S;O=6KV!{N+u9u)og3k0qAH}1{I9QR(L-b{#yzZ{LyPlj_G
z;whPvPz>>}Nlbha#oPTkz4!!FtR5`sCKW{*YfQ-HVdoqQOBr8*~L!1SP
z?1l6~ax@qqPNYx?k}^O~0X`0hCx7c7EQM~bub=n#_dmKYhbMPM>OQwm{3gI$?C~g|
z@PA<>2pa_f>5mlJgD$-7#JeI+M12qv5)<@>dNJc{BG45mCk;s;<%ScHM1L+UD5=d`
z;G_c|s;U;kux(CU<3m%45J_~Knfy|dtdrj2^gd`R(wR+Ij4s#|orE}e6x8Eu%vJrC
z&A7L~F~xTQsaWTn3GXvDpZld%KKJ+fbB%lWE+VngF&vzSoK9zgkMard{sAiLV-C8a
z8NFMr?U}^&&KR2p1dRih_ke*TK|_xaR>VKEM$zf|K$w
zW?=}1jK$eB^1n~Xgoad@X4Wzme&g-jxTd6q7bVc+bjv^Y4TPo3c7HV<7d|$TshtYB
zRM8E?jN;dNy!efEr0xd5@aT)GNNR>a<2e7-sGSRj?9}@bCq+LkD{0@DEL@>lsUJ0
zv5L#7K!frYOwIA(@mHzWJcwelpyZ+2Kg@V&UEx=Z=7GF6ZzAW_iD{+d7cw0o|2d|iM%BnI)obe^Z4IMW3vq8&(V`|EDfos6x!M{ZJQ-j%
zyLHvp31qXet$#K%GTAm|0khHll1vRMdfGvQnkBeIdCk@zOG9t8^|kS9Y(shAU_oIq
zHue5EUfP~#H@c*AReQA}Hmyr~
zSKwviax^UwH&P4nOpZEz=8N?Egzz?dlo6GMyoYwYXxyN
zXqljdNq-P**iG>X7c^9KxQ&plSIj_cQ}0cg(t@-!bg?tE+HyJcg2nLzKY9k$vlFbc
zIR6gVgFDOJ*_|b#+(GNM)R#e1Hp!)Zw9j3)s=Rijwe#}Y7fv?25I9V+lB9bT`Vph~
zR-}WnQL!c^qqU-KDLzwiUa4+W?OiKGsUgeA$bV`GHHlTg^bYisip{Sv)M!Kk&F{A*qr_{2SGB_s!fGl7ji&N}A&0{I{rN|6r=1cOvf
z(~`gX3~2Xh`nOr4duZKDFd+Z6O*eAz5*XZlWPtf0nd|&4kR4gZ_$sv
zkfr88p5ywlS0U*)Fb^QRG5s}#ioOMt$POg|;gjwTCjp|977s!PUY>N6cK?HuUk_FR
z*ORsnGk=eJy0Q%;`EYs8P8PIPX*>OYFlP{9v3R8Y_7OPpp%^@X;U$ljqLk
zL=ko+NVJxlSAgY~_Hta)JRzY2Vn=>E9;>J}U4LJZD8Gb;j)oAi2$V!={0IRzM1Tt#
zvrxs%;N|@n0>OF01)AYSs__#R1Ps)0s=6-^ulq77LekyOQ;7#qV;@9D=puSpzZ73pROI6ApJ&&fPLc>_O_{17C6KhW8Rk%$Qy%^?~f@u=*Sj)2dj9P&sX
zxxLK^xK(7qT=s`3QK=l6Rf!UrQ&DTYTu&|0={_eV4Z7f}#<=)(y7eYB2tH8tvX9+=
zpcGp+t8?FNwPkZifa{jWw3ncR=e86`vB`6Ja*4J3=QQv+WbwJo?eP$0YK=nj05YXg
z`Jm#;2C*#rriAKhJXYqX{u0Ci@*t|ZSMqt{`(;S-tt}xlic+{TGnM)rAktEhQ~Axr
zThaGPpa_Q~wUP=lbjZm31KSf|(pgM@UB$DqgwI6qIOX>xuzPECxArjC)4C-sC?7YZ
zWcV8_yxA3-=k8-|^i%a+ou<}IN*z|6xL)>R%j@bXDRWoD(bwwxHinbP8Ib%Wa<>y+
z+CW^!%m?qXTx*n0O8pIp;sLY+ba;UNekfm?=pXcbudjZ|wz;cxtY#^x4bu%4=|i_YLbQ0;KrBjcD2)8?Q~Z=-PKNa
zwbN!0yV~ilcDk#b?rNu{)@^RP+G*NzS39j?+0{->ZC5+pgq-ebr@Pu|we4!B4Q*FD
z-PKNawbM#-6T4mQ)YNvhQ`Me-Ll&RQ-0o_pEzOOuyV_}c`xDhpm$0`}X7aXv2~F2a
zXVxh|87`TzmV^E;FOgaG5(fLVEY6q2tZ?Ck19rU2%Xs`}>$ebq}(44YhkeNjrExNKQ#
z7Sv&&KD`kwoE`F&wv
z#!nKTiVHTadcXN%q)uxmUi`K0tIm8_yXEPaGOUeXBhoaa5Njy9UI6(APBC^$EVjfU
zwK;p6j!@3sEwfo|uE|F$Fc;cvnb2x;CC-jowiPp_)wb#>
zq9=7Lq`DX~{rO@!y*0Oy!hA~mse@5z+82(Ff1iD!Y%y(!)=JaWplRg;C&SjY>$YT$
z>|mjbgc~~AsaI&+!vNhX-`G@CgXI%9?6S3Z|K)k+l=k<3hs|SFMA;A;xMHphbjs&0Mqb2sKH8{T168*?%hPBiCk+~|=_YC$PIR)=3opml((Pun%7wd!chSui*A
zZKq0|mnFQzJ{1)*n?}ZTax{1)f#r7mQ@4i2ufTKSm2Bpt8@jE$AvQkQy{lgHPRsAA
z$7{T--t5zVcYJF-b=JGQt)2xqfAP1}*YJe2d}KAc3gw&1HnbJ~Dj3&twmO%NZH2`S
ztJbjQwK!`Nf@F@vtwL)%OXEPV>bFKL>KYY0+2TLrSsEu~Zs%c`Qu6d0gHPU`nmE3R
zV>7O2z)FLRlG#9-MAZR
zqikHL&a%~Tnzeeqz`=pBD(ja04j!!RcIesF9gSMw#yu*x?;?!s
delta 3586
zcmV+d4*l_%FOx5@q6Q65dn{L%SgDFK5C8zgldlFJ9&`IE2=@RdKx`*z?|?4Q19Hw@
z8fC(*>;@S;Y+{i!!{N+u9u)ogO9ZX=H}1{I9QR(J-b{#yzZi|uPlj_G
z;whPvPz>>}NlbYhX}nVh=yDc>`SOf%n17Uz~XxzVUG+n$sf_fjCwOfIr2$N
z7l3jSv$^Viaf0#zy%PCP`Cm`V8GrZc(7UcemD6kS^9Fy?sNOZZvxE49*+VF
zKMNy4*eD1{f27bJbm46$-W72o>VuGwn4s6xiy3DVfv!L~X-EPoH=Kwha(`h#Np0Q$
zCmr}uRkaX?ZFAxpADT*pNTS=!Rco%9x`_g+(x&TPVBbit0h_W$a4Cb-UdpqjNO#tO{&S$a4yInjJr6+f0gh-9oRp6-
z3qvquEY7Bp|9wg(G^D~bvzD>&8*k^vH6<;)D1jcQTmHFkAS_+BtAFvh@Ue+Z?NrDm
zH-OW-gF%K4`UBq^^beAd{*sVX^Y(J7-s`*54)RzL$kw5nr}=dCT#C;-%v;0T>U<><
zJdk*GhTy^3C=6o0k{2XK&x0UA(*YfS2>6ID2myFf{(>VnRBZb
ztGJvBG$?Pu)Eplkf1P^GgD55oN*=2H!;FX4B_1t_)pjqZ6wGO1xouKa7I5=Wv#n`z
zU!;$Rvl^Gzr^;Xj*{9%?;>R}?k!zZW?9(P2
zRFMWZ)4ii5tPNaj$@G+vq)Y82IkNRiaiM8{
zbipj!(lD4eC}&uj&sW*-o^_bP<`r8H>v++TKdm!LgMZI{)qQAcF0}C^idZZ*PMjUJ
zY(0?$kB!h|WVx}4rmiCiJy#YKLQf+9F)8E=z4y%fYIhxpf}`9Efk%@*yg_XOW_6v|59Cy5S}WR?;xiTJmFh;--nBxM8nTRxtbc}3lUM~@E<&unr+o3n7nOA5h9X?&
zechI-Yl>T2_MCO%R8s`E+3cbANX7{lY)*fbT&nhQNV}y}{y>4?37s1E74U6EP^?DT
z>rkcPQF0ehJ~J0rO1%q3z}Gmw_t}GD()Em>QZei@z+%GUIodlLU+$Y|lBGb5JT`}=
zo`1>UenAk|U1hhJ@_V#Qo1sX9mF31F!UIIZDVQ~V=s*`6`yA!09HMi9*kl4Li6#UK
zSqMWs@n#4E8JrUVKo&5N#VK~5a*u)A{0ISl5`-XRcQnwXi5b{>fqak*rN{>bfcK^MTUk_FR
zSCh66Gk*_zy0Q%;`EYs8P8PIPX*>Nnm@|m5SUl2x`v@HQPz)Zx@njGDD|RQq2Ocb=
zD(VkF?*@Ql--$KN%H_)0=hG`Cymnl&<%-p1Os-j72IZ$#ds%
zq6oVZBwEYOE5LF~dpWLYo{-Q1u_M17k5yEgu79sclwUzZM?;8M1WKYbeuRJW~k26T4i*$1Hl3LCgidBf+-iJWxnvRImJ0bbk5*ouKqs
zX(mh)O5$`;DOYd2s8o*3sziy*si-wxuBVphbf1%w23>GfV_f_?-Fg!m1n;SO*~e~w
zP>L;^)w%Ds+Ojz$z;(-G+Dp*Eb6X0e*yOo9xy0K2a~k*@viMx)_IQXgwMHR%0GU#$
zd{A*^gIJb*Q$lq$9xL-xe+l9Mc@S0IEBQR}{W2u^)|QYNMJZgFnM!>Q5NRpMsr+W*
zt?2tCP=rI0T1f>NI%H)2f$a$}=`5yyuHso)!e=6Qobvk;*u6EnTYH%6Y2A_*l#d%y
zGW<0b-t3CabN8_}`l2N=#dHOWG0aO2B%yV~ilcDk#b?rNvI
z+G#V0UF~#NJKfbzceT?}>o&Jt?KJJVtDV-c>}sc`wyT|PLQZ$J(_QVf+IF?mhPJDn
z?rNvI+G(Y^iQTStYHGXMscO%EA&bvtZg;iQmgdISUG22J{fTO)OW4~fGkIITgr@7I
zGwT$f442GU%R&E_m&mMo34{Gw7UxT1R=9A&0lVcAnDs7wS?7`$hf7_W&N^5wZE?K^
z#R-?~5*Alv1_rEl$x0KUPM4^-U7BKvYrD%Rb-JcxRsC~>zUrkXhE1-2z9^+nT(+z=
z47>N|zr-?KHrF#VY47@Gy57-=-KCZJ^NlOtmM^O`2t;u%ui7=fVc=ixw#s(f=o+KS
zFyu03Ka=dJo@Im3cI~R^#`Ie6;&(rMW46L(CQm3^OFaBEhRcAh|-STuy8P>+H5osDyh&2>lFM#|5rx-gW7F*(w
z+MK;j$5=HCmL!LN1B7j5cNFm5b=0lRmf5T}*W{xWmMc?ftmcB5n
zy5-5w-I%LvcZXGN%*9kV(VVk!qenKW1*NoD9eycs)&a6UW!IR_s-rPyzue5Woho%s
zmhcYyQ&h-k8X42c!Qhp|mD{mT-5M6Z0?&z8vYC%;=(h4k*!X1kj(W{2Ex)54ukn(4
zvoGKAZS~ZDN$>KOdKTFH#ota}!xPf-k=5oZly54_&{puPU|h@D>Rd9m6%;$HTEm*x
z;;T&vk~#ji3a#x7jRU=^-x@KfYc%X+i~o#gXq=F_or7UY$n0
z%T~iF*6O(e2M5NgtXuXwc(AhDp=VcjG-`bt_o&>yn_P(M`H*fFae0x*sRJA%vkMi>
z@5NljVDbg`rmoa$&=$SUUc3LHe*5s{)0h7Pll~S_4NrS4SC?3+iZT!Y0K}7A7d8g@
I761SM0GlrbSpWb4
diff --git a/Solutions/Google Cloud Platform Security Command Center/Package/mainTemplate.json b/Solutions/Google Cloud Platform Security Command Center/Package/mainTemplate.json
index 92a80824c6b..103cac312be 100644
--- a/Solutions/Google Cloud Platform Security Command Center/Package/mainTemplate.json
+++ b/Solutions/Google Cloud Platform Security Command Center/Package/mainTemplate.json
@@ -495,6 +495,7 @@
}
}
},
+ {
"name": "[[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('connectorName'))]",
"apiVersion": "2022-12-01-preview",
"type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
From 2c65ce30b7aa96f779d7344d72f64d7d5c0c4756 Mon Sep 17 00:00:00 2001
From: v-atulyadav <104008048+v-atulyadav@users.noreply.github.com>
Date: Tue, 12 Sep 2023 18:45:50 +0530
Subject: [PATCH 06/23] update zip
---
.../Package/3.0.0.zip | Bin 6040 -> 6034 bytes
.../Package/mainTemplate.json | 4 ----
2 files changed, 4 deletions(-)
diff --git a/Solutions/Google Cloud Platform Security Command Center/Package/3.0.0.zip b/Solutions/Google Cloud Platform Security Command Center/Package/3.0.0.zip
index 119c3a37138e7d59813086f0859ef46843e44490..c0eafff29209d675dc61299b5fb8bfdba80eb4eb 100644
GIT binary patch
delta 2073
zcmV+!2gFOn~?q6Q6#l`K~|)Sv+|5C8xuv#$ns2!CEMxy&3SYb;<7g?iBvma~WE
z5NH-Bb($6qugNEwPwc&y=Mtrr{vd@46*?je;vAD-5*icVw2_suWYnLQYm@m=Ar~0n
zGeq4-X)-Sz7q8f0FqZq5h!bK*C0p-7@~Ybqp9G}q80=-+idl+_&5}E7M{4KQO2Rqf
zGY}*HHGg^Bgq#+o6FjgKHo6Dk%B7WOWpmVJ@kKXRBt3iUGcS?eaPCnC1jk|Ox#2sO
zhyn-+`Qx6hL&HcuT%L-P@9%(Oo1a5aI1`psSvIqVpyA$BC4wf+x
z^#`DL1HiHG#F}R1a^>vv>6H>*J1*IB#p*I9*MF=ogL2i9>S!IZYF4^AcVpUlx5jdgQA^0LK
zLpjT9631A@r5OT_PA<=LGS5%mz)uLUJsD=hL-}DobFhXNG`yGCmT*$|1#>qA;*vXM
z=1!EEQ~wWiZeS#0LPm4&-AOzuyO1N`^M5FZJkkebZ*u}}6gN
zT`uBd7Cp+4;{xB2VB2yYC?qllCm{yOI6r-fPEdLXG!v!?C2_i_l&kksRN_VEK%zuu
zK-3y9*HcS$y3a{TgD$wLF)n_cZoLT&f)7-^nqxO8#g@(L+;>}T*&NcQ6~3V(xzH@jl<+s9JqH#&B*p1CpN`?sgta8;Hx8`QTlaD}&NWslTsKJT7*C
z4iC`Z59Lb^{e!;m_0=!gHg}bd^~?vE6$mx7CD-RXTf}N|3usr>k)8DxJGZXNLmhuF|=ybQasL(z&a2%I1(Tw+o`1
z*zGEvrnakes`ebR_*~|8SAXejX>NSoRXW?-pQzHgguR`jkhk>m791T?m;!-?;K^`65VzKosZlx?STN2L9!4f^4^qt}&_%LoQ?XGszCt
zSvCl5*RGmwBd_%?ey_sUW-DxlQlRc_GQT7CtJ2n>@Mu*EKV)gi^DHZ=OO`7zbX5|r
z($wckn)!SM!X9+S{eOF~>Z*`w&8)}Pi2Q0LBE7or?M7(zB7YMg%M4oY`>*wG`R0;(
z-?r}xsP(R#yfMwD6_7dk(6$2k7HTE5{*4iat=Q^8R=BQs)GKSKGlb{ZO>svGL&^F+w4D)lX@z<*=tf@q=77NljGP~VL+
z9aXC)TQ?zjI0I~ZZMQo$Pr_7_%y;_sJ=*T4^)}?$fpZDn^9@PFM^ldt*{n9#u+T-q4IS;&
zD>Uw5fNqs5+@;q}&`}@P@F)N~M2!9P+F;|AV=)Il9(w9D(!65e5-
ziVB%cBV#%_8oZLgay$O1Tf^d4;5qS1HuKR9-B#WZ8=vgnEU$T|aGQHj5G-0jCXSvUR4358U+>NwRHZD|W*=jh=
zT0LLj;J{dwb<2JS4_000000
Dp1c8i
delta 2103
zcmV-72*~%6FPJZ|q6Q5YlPp(S(+hMr5C8zov#$ns2!9XUG#rYaEhg>-)Pv1g>6oRb
zc84!Bm&+Pm*n_KHw1nmC^ErgBMK+zLrO0dYNphq2UY>N6cK?GEQ&i}PFepe&eo1Id
zeACug#*$HgTCR5HhmTxffEN;VAEn8>bQFhTgTYwth$2pi9hGdo2g$2$LwpjDu4Ay5
zZB%BxD1SCfHm)71omVRf=ZMchjQrQ+aT9V{luq#JQrPGofGa0ip1#ddm&F&|T#@uN
zug|OYFlP{9v3R8Y_7OPp
zp%^@Xx)e17b&hJ07d3HeFwlD8Gb;
zj)oAi2$V!={0IRzM1Tt#vrxs%;N|@n0>OF01)AYSs__#R1Ps)0s=6-^ulq77LekyO
zQ-6sEP-7oNf<@FjK&8Xn+Pq}Xq!tGZED~rW1m6%oMT`ZFpJ!^Tuy7JDs5DKU#}Xj-
zfr?qxs7+yd8AagMX2_NoWcOs?4iDvr`OLu@
zUeNGfVq3yV;TO!^6o^ail$kqGW={P-(0|#6k%$Qy%^?~f@u=*Sj)2dj9P&sXxxLK^
zxK(7qT=s`3QK=l6Rf!UrQ&DTYTu&|0={_eV4Z7f}#<=)(y7eYB2tH8tvX9-M6n|Sb
zt8?FNwPkZifa{jWw3ncR=e86`vB`6Ja*4J3=QQv+WbwJo?eP$0YK=nj05YXg`Jm#;
z2C*#rriAKhJXYqX{u0Ci@*t|ZSMqt{`(;S-tt}xlic+{TGnM)rAktEhQ~AxrThaGP
zpa_Q~wUP=lbjZm31KSf|(pgMh#ecK1gwI6qIOX>xuzPECxArjC)4C-sC?7YZWcV8_
zyxA3-=k8-|^i%a+ou<}IN*z|6xL)>R%j@bXDRWoD(bwwxHinbP8Ib%Wa<>y++CW^!
z%m?qXTx*n0O8pIp;sLY+ba;UNekfm?=pXcbudjZ|wz;cxtY#^x4bu%4=|i_YLbQ0;KrBjcD2)8?Q~Z=-PKNawbN!0
zyV~ilcDk#b?rNu{)@^RP+G*NzS39j?+0{->ZC5+pgq-ebr@Pu|we4!B4Q*FD-PKNa
zwbM#-6T4mQ)YNvhQ`MeB7Jr}1-0o_pEzOOuyV_}c`xDhpm$0`}X7aXv2~F2aXVxh|
z87`TzmV^E;FOgaG5(fLVEY6q2tZ?Ck19rU2%Xs`}>$ebq}(44YhiQGZIGxNKQ#7Sv&&KD`kwoE`F&wv#!nKT
ziVHTadcXN%q)uxmUi`K0tIm8_yXEPaGOUeXBhoaa5Njy9UI6(APBC^$EVjfUwK;p6
zj!@3sEwfo|uE|F$Fc;cvnb2x;CC-jowiPp_)wb#>q9=7L
zq`DX~{rO@!y*0Oy!hA~mse@5z+82(Ff1iD!Y%y(!)=JaWplRg;C&SjY>$YT$>|mjb
zgc~~AsaI&+!vNhX-`G@CgXI%9?6S3Z|K)k+l=kj
zs&0Mqb2sKH8{T168*?%hPBiCk+~|=_YC$PIR)=3opml((Pun%7wd!chSui*AZKq0|
zmnFQzJ{1)*n?}ZTax{1)f#r7mQ@4i2ufTKSm2Bpt8@jE$AvQkQy{lgHPRsAA$7{T-
z-t5zNe1B^_b=JGQt)2xqfAP1}*YJe2d}KAc3gw&1HnbJ~Dj3&twmO%NZH2`StJbjQ
zwK!`Nf@F@vtwL)%OXEPV>bFKL>KYY0+2TLrSsEu~Zs%c`Qu6d0gHPU`nmE3RV>7O2
zz)FLRlG#9-MAZRqikHL
z&a%~Tnzeeqz`=pBD(ja04j!!RcIesF9gSMw#yu*x?
Date: Wed, 13 Sep 2023 14:17:12 +0530
Subject: [PATCH 07/23] update zip
---
.../Package/3.0.0.zip | Bin 6034 -> 6074 bytes
.../Package/mainTemplate.json | 1 -
2 files changed, 1 deletion(-)
diff --git a/Solutions/Google Cloud Platform Security Command Center/Package/3.0.0.zip b/Solutions/Google Cloud Platform Security Command Center/Package/3.0.0.zip
index c0eafff29209d675dc61299b5fb8bfdba80eb4eb..4afd113f7d853b9d10a48a3935b019acc79cc516 100644
GIT binary patch
delta 4303
zcmV;=5HRnOFS;)cP)h>@6aWAK2mpj}EwK%i1`Y^vEmt?%QrTG$001?GlduLEfBkRU
zHumQpaQ_409pD6r?IhbBumU?E=k&6mX_{-Y6^E=y6^XWakws0UoMv7B_j{y7S)xRd
z^2ai4=77$z$oC!}AKxcMfBx%V5VYRkm_NgFulEx5W}L_DN=lL@>IzBx5c5wL3;P7Y^f8aQzPom!qp2wlb@$i3)Mql*~auhy|I6VCkCydZY
zU^*HeivNlpv6pyr%%KB3{hWO%AB5ERcs8i?wS2^%Vk}@Wo{(s&KoyVYB)Y)Sl+U2g
zk^V5i6E6+5HT92q8Cyt%Ftkd7#0%7amEKV4fs05
zzWCHXSW4htUp?>d?|*RQ5lipO1nS(W$y?|#zQ^K_z`v!TAbA92r9YCWbspIyz7q?}
zXb}lOWN?Df8{#LF(FsS_uwzMtLm@>B^E7tkL}e#k0#9Aop>Mwkf5vTj{t6|U3YAD(}<+w7y?@cS;fDBG@~lbQ)qb4rv;|
zEd4Yg{0WWe9L!vRf5tFvoHRoy*{!e3R;$|UB;_-jh)xAFs~v&N2e7B-egA4H(
zlr{s*xFjtv%NHfH!vpo_Ky@8V{h0Yaz+wY0CKY%>R>m}nK+(}8pGxufDV~ssaO3P+
z2E!+2VaW}_Z49XZA7?(od0?O|TfXb@xb(G=Qssw;wKu?1e-^|bO$Yr!;1Bu-X+(Zb
zakdrr3IX5iyAuzRsf%XoSjE?3!fG<*=Ury50B&{00!cB`7m}u%T#scFk^2s2Qz0F&
zU~jH===H11oAb+87k6iG-=1B(x*K1-{o(XZACr+0=7#%S8s_RmL!;@Y!W)3Dw@YXy
zFXm0FIx4uve@1aa7X+LvHp-n`wE&ehlCWW8mNd!n;qlj*|2&8jyde0oHXzFRVqLh=
zl3bjwNM#rV(H}-BDr!iRiT=n7L+Tkc*Z=>qs70+++Ct$rG
zXlY^g%GSkoIa{m?IAtwd&KLhGQ}L|I^pZwz@F+j%f3pRV0wOul?P$@#S9?#g(|LlSE(&oAuWG%vMlY)>oKP(8Tn
z#@fimwp39COSar@;v-tG5*C^)rxR|`mMX$*x7>j#W?$#yd-icA6-bGV$B9EnUOcTC&`W%pp*5i5b*a%KUf0i4ZZ02C%$amIyqV;^xJQ#>;H)wiu
zgs$2OdsgZ@cUG&mstQ{bo!VK-RIsW(bBFfDt?LJSHw&be$8B=v?9$Yhw;JX;FuCqy
zfP?YvdOn6`Tgx=nqTCv|^+LZIxLjtUGz@KBJ3BG~W}HNl6vrW=!3?KGI(566z?4WW
ze~C>)7YDZLt&m7RTpT~LqvzR+4n)gr(7!|a*n#sMxSl7dIsjK~xqSwWi7A(+X9n7u
zF1%gI?Y__sD=3381uH-qjh3jQ|!0te57(*#wp`;PJR)b
zs&%rNAK`6fl>R_~=n0vcZ4NlYJSUn#|GO+4ySTM3pEdddR19Sn`?34lFQYs;lUh5cYtUSvV9cu%cX9e@1wK
zNHhgSrw%lzVr8G9f}2Bh&JmqVU_H?Udt8*y5KH|T@_-D+Fb5zD7)X;0dq9{^!O4C)
zK#MetK-TU_s7T{8FaR6{ARls9ACw3N;hJXW2;_G_dqA?kIYl!Z#^{NrXzGzj9NG|a
z3;%~l@NI%Y%?Gn$sH<@h!Z6^
zkv!ubdtg9~$WO|nCa?_xU>lR5B?B0m(*z?7OoB-*aQHMdiUMGZXa7kd%)#tNAgtC?
zo60)I@$GiW<|V@(O^C11-%##_2#bXjv-Pn!=3?`6dLf?TC|G?X6@czNe}=`Zo&>DV
zpBuUKh@#E$lIG9*1}%jMR<@oWYK`me66_sO{FWqy?Oxt@HmWLcfAQK45fo
zxItd1>f)MwP`1*%d^QeMQeV5ChT_S)ZrS@xn{Njep@fjAXN9@^uB5z9fj*e&h
zMF&CZ9Yf!JhkoisG*b}bf7IAdJ&mMaL1BO(C*+q5D*6r->!-a6g8gP92#YAk^O!%$
z?)w{Duv|Hl1?;r3Q_{q?cFIfm-m7K}>;dT_KX@ZT$j!~rTX-bQ4M%(I2r&g1B_X={
zsl-Yz!me@$=_Q(YA;Zmmjnx(~2Xn%hJ(ex%GFQ1DWse>lBB)-xe}v}j%GuT~1H7Er
zX;!Vg!JkB)viD9LixfKiy$~@}>WDm$?*#vxk^~1vTUSMs(|=m6h!!W2oPdC15w9>z
zQF`UNhUEsMJz?Q^l41vBqV*mH!#a)$aELn(^8DQDw1{-M+46A~ybdf|Nl-^@1`-v#
z#!nlO*|Ma9!ZihaE*#Jhdr6czdfq)vc?pDo
z{9#X3!C@pDF3;bI;A;nsIp(}v*SAPQsOZ;~^R6c{^rmVr0_j)K(9sZL6OPh23l|~2hJbHD5*o=6
z8CE#rG&zc|2FViv<
zv%JAc;>o}^N5Ig@)pAh5Z
zCsOgre+MeLFyaZuqdBD^^gD#%FZ=8HT)p`>WhVO}dgUCU*lv_Tp^T2V{MRQ4mt5(FWSFjt;
zt$B}fe-mf?#7Zk4(QV{2iRJU@-{T?5_c@C2BZ!yG>%*RxN{Qy#Hz{A&T++z?)8V}0`(YzaaRt@tGwloe}u83k?!jr1e1?L1!Pe4pa)
zf3-Z0-S#F{F~V?Os!1TKqYZEK?Mke>605y3v@5ahO02sQE83MO^~cm)~EBwFG`k6)1oESKxHM
z@@Addl0UEpSQ{UZ(SV>~Q7WI#eF5PUZVN;d!3t
zJ5{xG6~?Yk#dVffJ;~CluR!+0f9~jiBaU5{Qn|TG*&?A|uSlq0ciSC_)qg9&1j#mw
z_McR!b#MFWn0n{d-(#qC*G>kRX4DR;C7IE>5`~?$6I=g{4uiqAJDnQ$SEN1gg`sUd
z!&&rI80o!GdsYIqsX8sA*L2sDz$p(7`NbntJhM>I09M}mH=n0m*t5(Ff6<{Q&;^lF
zpX~_FG$nx}d%AA6nw;H6`0)(z?X_NyWtfSvELyk)7JF`Y?RuMX1`C{p5-8ll;zl!2
z@+WCP_ywKnPIIv)xv$%iA%C>%xO3mvK_7L^N!9?Y5v-bWlr|)QV}n
z^j{5}+Kk|YSo?OiSLUb?mb*;5p`*hDB%Tg&gKFCEQkD0_@`)pUf6-c^h3ZrbTKoIM
z<}s_{YzQS>QENk;)PMt#mEQ={&7%0;k-<{6cUjxU{Eo(r<~)!iMWTuQP)WJf5mb_L
zT|ldYfsJ{xIv#Uc%~7X2&?V3MV%Eig#igvNkvZKw5vHZX98avO)*u5KKsSbo)^eUi
zwKZ&I^P}BM_RX$rfAuB%WR17%n`3~EuiIz7eV5nl^N{Gz@p}Cl-jWiNyf~SXy>xAJ!@4YA)9Tmav&{&VIgYoBur2;|qFHuaCz5rIsvUK-Enanv{~Xa-
z<<8H3Rr%!d)X4kIoa%8tvsM{p6x|ku?r?&we}cobXL>(O@CrS
z62`Bx>n~2TBLaC=^&f-dZ<n>?cCvx>u4=&D*bq{abMPcE}9*UY@-6yH_
zZ8T$r`ZszT`U#efx^j6>%Bce&Grvo9)bIIRhH&C-{l>n;Z`eC(v3;Abl6{2D0H6L3
xP)h*<6aW+e2LJ#F0EBTZlLr?<4hV8BS2x;H*;x<(05ye^R~Iz~AQu1t000}-aBu(s
delta 4262
zcmV;X5LxfKFOn|}P)h>@6aWAK2mok~EU^uh1`dgpELS(%u1Gpa_BhfY+SyV;J*>s!#enU!>^`c1m
z(X>5tflXqOGsEG`a2^!>`3nTC_c!j%$Q<`xqTWo1h`$_-(ocqS9O5aNlTZxtuSraX
z9-C*+_~`iX=$pae*Mq~Okx!z4e?7{6*JK_ASdih*oP}TZ4pIyr3k5v2?Hk=uLAe*{W6@ej~l
zB2Y+(Pkba8iZJI0$Mb;@_ec;f&`%c`!ok&yC4oPHp@V;s!FM?JJqE*m8Y1+8AR2N(
zurHw^F(c@w2NvJ+2zz9pN&X2v%&0d*lp~+SbO9(QF`KLI7bhqm&?}Mul>ha#oN=!X
zz3VDeIlUG?Z$OBEjJ^JQe=>!SBr8*~L!1SP?1l6~ax@qqPNYx?k}^O~0X`0hCx7c7
zEQM~bub=n#_dmKYhbMPM>OQwm{3gI$?C~g|@PA<>2pa_f>5mlJgD$-7#JeI+M12qv
z5)<@>dNJc{BG45mCk;s;<%ScHL@q2Ssm)v9qyrzSsuseqZBAU{e?wD=5J_~Knfy|d
ztdrj2^gd`R(wR+Ij4s#|orE}e6x8Eu%vJrC&A7L~F~xTQsaWTn3GXvDpZld%KKJ+f
zbB%lWE+VngF&vzSoK9zgkMard{sAiLV-C8a8NFMr?U}^&&KR2p1dRih_%J^&iK%!*
zV>XA)%SU6FFo_!he-w73uL^rnxzkA^W-OL{aweAg0g3mpMV@;pps6C}HegfM2rgxi
z+Dm!16zR@7(0>ke*TK|_xaR>VKEM$zf|K$wW?=}1jK$eB^1n~Xgoad@X4Wzme&g-j
zxTd6q7bVc+bjv^Y4TPo3b~PRsJ~ol5oeH_+25@?JFv!qBe}CY6gZ@Dh(q9siYTjNh
z)q8z++Cd&G0@*rL^E98Xo=fq0hk0vwTb-{&qUZTSk#wEetaKVm*I+J1!T|@tbFGwD
zuijptzkPLad-m?#*~P2d@x{CEPj4$jq?+WW>RM8E?jN;dNy!efE&P2FWG1IFqGY^s
zuK+sUlsUJ0v5L#7K!frYOwIA(@mHzWJcwelpyZ+2
zKg@V&UEo|2d|iM%BnI
z)obe^Z4IMW3vq8&(V`|EDfos6x!M{ZJQ-j%yLHvp31qXetu`|<**0YXv(f#MObse}
z+ChVwe;LK{z_h{a;##Mx2Hf7TOO@Yo1VMwT0!XzDtW&~r6%vh_SL
zGz2JX-MOmG4YqD8=%_Mo&P>*AReQA}Hmyr~SKwviax^U
zwH&P4nOpZEz=8N?Egzz?dlo6GMyoYwYXxyNXqljdNf2z?`?@Vv*A%z5>^bYisip{Sv)M!Kk&F{A
z*qr_{2SGB_s!fGl7ji&N}A&0{I{rN|6r=1cOvf(~`gX3~2Xh`nOr4duZK
zDX{Pp9>J$EV(}D*AT>(5c$ptke}EAd0(-{Eq|Zw)IK+36S=32ta^c!6n>3
z{4(=>UZM#OIBD!^s)K;NpHt4Q(P&;Uxy&3SYb;<7g?iBvma~WEe-LOECv}<@4zI~4
znNRG!m**0tmHr@w3Kcpc4B{Mlo~1+lpC=i_MZdYe#D5)k?xS;xiB<|228sgq#+o
z6FjgKHo6Dk%B7WOe`RyjW${HfS0p`q>oYHr-f-?w1_Z}p>bc=NmWTof3Hjrmu0z8}
zK3txPljUbsh)(|>%o)T(EFNhudjxKGCeR0CfBSkgL2i9>S!IZYF4^AcVpUlf8;6gI8lUM2@0wqxz?Ll}9@!EpMEL0IL_+FBjKFWEDx#Q_701R4pU
zG6XvjV?pERf0^1UES$s(DovB;u>{C{pkh`vYEzhAMiDrn*&+BMEkilWYZAv;#ibbn
zj!rJmb286Q-oQ@?uss=O!$bLDK69{!7c{(=*p_fo_yuz}1>%xBW#&$lnN$A{bZ%fI
zVnRl9@ZCu~D!Y&);PWVlJkkebZ*u}}6@2s9I>2_Ae4T29;y_#b;D8-h|>fCo*ZP^^s)w<;o=q2djxh-K)Z1NPHTw?A1
zISqUce_4Dkb9+2QnOdWeJb+B8#5<_CvOz4%l_{aR8jqFvslT#tfV_Zu_ewrbe7_7y
zzGEe1{!a>5W~Ne~14LR1aw@->cq{ro2^8Uwq*hWvh7K8-e_(q8Ogf9Ht9VwH@RQ6~3V(xzH@jl-NvXrC6W7aLLwQ|2
z(`4>yIH+2EJH~KsI0KTO8}4=NSoRXW?-pQzHgguR`je~`EJ3tqZj=(0|^$Z&y+wRrP?c|psn7aZ8H
zJaN8&WrfQe9I#t1SXu8vm31yqakwz0>12ZCLKN3KMx1cjE;w;TW?;Z-7nn2=>U2Sg
z+l3^SxVF2DQl~3GR@Fa8=&N2RV%X&Bi&FZ;Wy@N_uzP?03nJ5Hb3Ngb_O5THf9oA|
z*j)&jKi|0WZTTWdgFqDL^15B)8wUR6Zh~yLjjl1O3_~ts_A|*2)>$?PZP%`vZX>Vt
zE`G1V*JdkhhEkyJZ8EZ*`w&8)}Pi2Q0LBE7orf9*zS^&)>0Aj=F|@B6RyZu#btdf&G13aIt2oV+p3
zrWKGm`Ovlk`4(y=wEm3|hOOA@K~}iF65YNhx6roZka<^)j@?PqW+SdLOP9sNO&1nP
zjOtX5mp?-JvvwL9psE|{=JQ0ztt#~`s=#CDf@q=77NljGP~VL+9aXC)e_J;pc{l@X
zdu_KnHBZ7+lgxMe_C4C}r}Z}E+2ts6eb0To{4Opq<0pwv#RZ#Iz2AH>Qm3^OFaBD0
zL1#X!-STuy8P>+H5osDyh&2>lFIW5nrx-gW7F*(w+MK;j$5=HCmL!J*gl%Pa6!6_u
zldt*{n9#s{V0&jOsk
z_&eomctTn}vKn25fAURb8`=tg6^v^+Tb)bCw!&hERcl!DTAZ~BK{ChTR-v_>rE#EF
z^;;trb&ZOhZ1JD*ER7Q~xAQPeDS7&ByeDr@O&s6Eu^HDhV5LDuNo_IM_7hNwRHZD|WUfF6m&00NQ;NZYmm37O0
z2M<3ahP)h*<6aW+e000O8XpStCFBd`%iIpr@In
I761SM0Fsm=V*mgE
diff --git a/Solutions/Google Cloud Platform Security Command Center/Package/mainTemplate.json b/Solutions/Google Cloud Platform Security Command Center/Package/mainTemplate.json
index 985fba68845..25b36f47051 100644
--- a/Solutions/Google Cloud Platform Security Command Center/Package/mainTemplate.json
+++ b/Solutions/Google Cloud Platform Security Command Center/Package/mainTemplate.json
@@ -55,7 +55,6 @@
"dataConnectorTemplateNameConnections": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections')))]",
"dataType": "GoogleCloudSCC",
"streamName": "SENTINEL_GOOGLE_CLOUD_SCC",
- "_logAnalyticsTableId1": "GoogleCloudSCC",
"dataCollectionRuleId": "GoogleCloudSCC"
},
"resources": [
From 45e0e9c10fd7ad7d7ddd6b2c5bbf4790de9dc840 Mon Sep 17 00:00:00 2001
From: v-atulyadav <104008048+v-atulyadav@users.noreply.github.com>
Date: Wed, 20 Sep 2023 11:07:27 +0530
Subject: [PATCH 08/23] update zip
---
.../Package/3.0.0.zip | Bin 6074 -> 6086 bytes
.../Package/mainTemplate.json | 3 ++-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/Solutions/Google Cloud Platform Security Command Center/Package/3.0.0.zip b/Solutions/Google Cloud Platform Security Command Center/Package/3.0.0.zip
index 4afd113f7d853b9d10a48a3935b019acc79cc516..4949df5f8002e200bd48b4a9024f3245e686e468 100644
GIT binary patch
delta 3633
zcmV-14$kqqFUBtoP)h>@6aWAK2mobOG_ehp1`U*0G*^`V2&H8Z003&UuLivWe^&Y_
zc)%nC-K6DZ`J!ZYc%c3qsJ?@#A2Z(vSZv_Mq?y2+>%}VV^_Nfj8ux^NjcF8tcBDx@
z|KjgcJRuR`MwYY;hEL4G#~Xs%xL5%`&K!&Lz(8BJ=GWtK>1!jU%6Sn2V}Pg3jzI(u
z`h&n9^bgXA{G8%!|L&Fe?M^(1f3q&ntz#8miwUdAl%IE*xdOP=84D!EOkYTvZgS<9
zO+;>1m`!zq@C18vwXLsTUEZ8uzPh+Od;9k6;?>>w;_VNoclwx&j4-$M@6s^WK^huO
zp%pF!biG|dGr2x*T6I{#H8zS9x**`0u~F_Bs|Bd6k%SGqxukxM50Agjf1K_?oZtn)
zkF^0&&KK*#jh5spZCKC>TDG)^Hd(0(u6d|gk2HEaC1wdp
zOm^FTa9l&_*MjBSRW?*3pCkfPtgW}^Ctplp4c?#LIzlz5V7;{<6m3&lF(2Kp$k#yI
zxE=PBL7Xe3*DS!XQ2%BNPy?`rc`9NJ8xEWLsSogyr8atYOwlc$3}1>vfSWgGY1n#zO&X7t>=U0
z!9ZNQLDQQfbk$baf3s5GxwBfeRaMxk=+w?qrh--VnLD&EZe2gvyICN$JZ_USXP2h7
zywxz*fys3r100NR*Yhzn+ghfn7UkB!trz;$z~wR%rD166+S!o_FykbWq&N-{4Q4nk
zak
zB@Y38l&rd$VN|KTU4&}5GG&c;{!CaOgJ(L+9+!;;TLc3^=KQ(Z;3gs=y+%)+5q
zffY5*GQtByqA4gkbqYdNIQtA0+#I5Fj_70p>xm}Vf8(O&hFI#)kOyQihB*LPz(AU0
z*aO0R3QqRZ0a~PC1hRHdLPZ*%fdSws0Qr!+`k+KG2-h?_d?3FA+5?jP%_*AUFh)-_
zMN^MN;-rU=Tlhabf^QQiR2mg*aHJ#uj&HY1HZK|WXhM92{)TcdL|81On5~b+*%+Ij(+lwwN5SeFsQ`5E
zF)U{FBw&61+{mRbUs}|=LA9G~VUKz9IK&%af24M<;0$)ewS*4aMs2s2B`x6mY@Pp4
z5&9Jb@&Tix!wvF6RTtOfgR+(8<+E`>9Q_eN>$_b3>=FSSDYakoGaEN#j?b`AJz~%P
z6M0j*cXT}4FFFWP?-=^-JM>d8qM3paN6mifX(as$3IhZ=A-`l$(RZL&KkZcz>^BoZ
ze^^90p2z%2cHiINg5}DYEMTXNosuTDwNqZg_g*z?U=K(a`Dq;yLT+w`-ohhcZaCUw
zM~ErFC<)Qkk1|$z5q6b3NH5XE3mIoOeBup*K}~5lFv+hK`01n{brIS-1%C
zH3WPMlF&$o$l${L7vjEo$~c;Ni%bVhXc$u1m{Zw(d1^iosSupmMqj2HU}Fa$9W*BX
z0jeAyR|+S8CiZnmK}W$Bg;*N`rI^yN@%wxqODqg03nG-2@6!~>eI$IQf2+AEOfRPh
zeAfItf0>q{nB@&l5>E!UIRb`GuFeZG&rjaK{~<#6MVt-~#h1m*K|fxQ=s{px!pY#5
z6yOwyOYf!PJCTY{{yR{~g%M9M9?ikk$H}PbY>t4>qXP0s9p=3&2)L7E!Cdx-j;U3L
ze5uXqiRLJJg`kgV{3N23e+%y(hufF-P@)lGJdQk&kMq-)=mcd)Pjiu)5S(O7OPGA`
zM&@rsDkV-uB1NwBa#fXFXZBCX8+7sXedFZ&sn(m2FnmwsYex>crQGs)od=GqE}Bak
zT(u&0y@K6%Zq0j?n>gbqR$BRpZX=&bET2#R9uHBz&ryUQLA+#Me;@X|R7y0@zDfDI
z9*?Cys=s-0fc%j74^mW5f}jdXyhg@FMp1}auD3Fu1f*NYbSBEVq)YlfaTI$I&eW!a
z3>|VZf9DDY7!!p04`81}~F{_L903s18?
z{7e0Hp{8b_rvY9Ae~G>P#hTapnX8t*hSRnBD?g?a&pDLh#B;|ZV@hvaB{Tp}v|5i8
z&P@G1it?GZ19W(R{(dN4zUUwH1HUgn6Fh0;ltpe>dyYrc77d*y}`p&MRzIz3;){N*MPmYF4=3!UezW3Ys;qoLTFN8J8<%
z8c#>qu8eWLg2fS?^$HkQd?r4uc*RR2v2ItmI9}Oei;BC;EOEOdWz{X|3V!7)S4>8*
zVRfosIhwRJ)V}{mxOg*LK-Y6OS?>mOyXL8j-9?*~e-4}9j9b27(@{g#HibXa8)LL+QEe#v9>l-OImx@lA_%Zh=#x@G_m>V}~o})}iuf
zbt>QI3D5I9->Islt1xzTDz3A<>PePXeFd@~c1QmkaqPO3%FR{E776`&MMC|$+wMrL
z{sRjpe@M1jwEqr6t$W+=&D1-${)j`ZyLK|jG^2J%Ey;}5l_>12o!I&hdl(G1-Rac0
zzas5{FAQz#8P1}w!btCh+Orao0E{K%+Y)5dWDG40e({;1eNzBT0YIhZoC9u4!FLld9NS7d_KtE{=|W
zBXdzzqgG7orT=Q+)Mf-H#M-yBy)s9Iu-s+Z4ILdOAn|mF8&uPNm#VxcmQNh |