Microsoft. SecurityInsights dataConnectors

Definicja zasobu Bicepsa

Typ zasobu dataConnectors można wdrożyć za pomocą operacji docelowych:

Aby uzyskać listę zmienionych właściwości w każdej wersji interfejsu API, zobacz dziennik zmian.

Przykłady użycia

Próbki Bicepsa

Podstawowy przykład wdrażania łącznika danych.

param resourceName string = 'acctest0001'
param location string = 'westeurope'

resource workspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
  name: resourceName
  location: location
  properties: {
    features: {
      disableLocalAuth: false
      enableLogAccessUsingOnlyResourcePermissions: true
    }
    publicNetworkAccessForIngestion: 'Enabled'
    publicNetworkAccessForQuery: 'Enabled'
    retentionInDays: 30
    sku: {
      name: 'PerGB2018'
    }
    workspaceCapping: {
      dailyQuotaGb: -1
    }
  }
}

resource onboardingState 'Microsoft.SecurityInsights/onboardingStates@2023-06-01-preview' = {
  name: 'default'
  scope: workspace
  properties: {
    customerManagedKey: false
  }
}

resource dataConnector 'Microsoft.SecurityInsights/dataConnectors@2022-10-01-preview' = {
  name: resourceName
  scope: workspace
  dependsOn: [
    onboardingState
  ]
  kind: 'MicrosoftThreatIntelligence'
  properties: {
    dataTypes: {
      bingSafetyPhishingURL: {
        lookbackPeriod: ''
        state: 'Disabled'
      }
      microsoftEmergingThreatFeed: {
        lookbackPeriod: '1970-01-01T00:00:00Z'
        state: 'enabled'
      }
    }
    tenantId: tenant().tenantId
  }
}

Moduły zweryfikowane na platformie Azure

Następujące Azure Zweryfikowane moduły mogą być użyte do wdrażania tego typu zasobu.

Moduł	Opis
Szczegółowe informacje o zabezpieczeniach — łącznik danych	Moduł zasobów AVM do szczegółowych informacji o zabezpieczeniach — łącznik danych

Format zasobu

By stworzyć Microsoft. Zasób SecurityInsights/dataConnectors, dodaj następujący Bicep do swojego szablonu.

resource symbolicname 'Microsoft.SecurityInsights/dataConnectors@2025-10-01-preview' = {
  etag: 'string'
  name: 'string'
  kind: 'string'
  // For remaining properties, see Microsoft.SecurityInsights/dataConnectors objects
}

Obiekty Obiektu NieauthConfig

Ustaw właściwość , aby określić typ obiektu.

W przypadku klucza APIKey użyj:

{
  apiKey: 'string'
  apiKeyIdentifier: 'string'
  apiKeyName: 'string'
  isApiKeyInPostPayload: bool
  type: 'APIKey'
}

W przypadku platformy AWS użyj:

{
  externalId: 'string'
  roleArn: 'string'
  type: 'AWS'
}

W przypadku warstwy Podstawowa użyj:

{
  password: 'string'
  type: 'Basic'
  userName: 'string'
}

W przypadku platformy GCP użyj:

{
  projectNumber: 'string'
  serviceAccountEmail: 'string'
  type: 'GCP'
  workloadIdentityProviderId: 'string'
}

Dla GitHub używaj:

{
  installationId: 'string'
  type: 'GitHub'
}

W przypadku aplikacji JwtToken użyj:

{
  headers: {
    {customized property}: 'string'
  }
  isCredentialsInHeaders: bool
  isJsonRequest: bool
  password: {
    {customized property}: 'string'
  }
  queryParameters: {
    {customized property}: 'string'
  }
  requestTimeoutInSeconds: int
  tokenEndpoint: 'string'
  type: 'JwtToken'
  userName: {
    {customized property}: 'string'
  }
}

W przypadku opcji Brak użyj:

{
  type: 'None'
}

W przypadku protokołu OAuth2 użyj:

{
  accessTokenPrepend: 'string'
  authorizationCode: 'string'
  authorizationEndpoint: 'string'
  authorizationEndpointHeaders: {
    {customized property}: 'string'
  }
  authorizationEndpointQueryParameters: {
    {customized property}: 'string'
  }
  clientId: 'string'
  clientSecret: 'string'
  grantType: 'string'
  isCredentialsInHeaders: bool
  isJwtBearerFlow: bool
  redirectUri: 'string'
  scope: 'string'
  tokenEndpoint: 'string'
  tokenEndpointHeaders: {
    {customized property}: 'string'
  }
  tokenEndpointQueryParameters: {
    {customized property}: 'string'
  }
  type: 'OAuth2'
}

W przypadku programu Oracle użyj:

{
  pemFile: 'string'
  publicFingerprint: 'string'
  tenantId: 'string'
  type: 'Oracle'
  userId: 'string'
}

W przypadku usługi ServiceBus użyj:

{
  credentialsConfig: {
    {customized property}: 'string'
  }
  storageAccountCredentialsConfig: {
    {customized property}: 'string'
  }
  type: 'ServiceBus'
}

W przypadku sesji użyj:

{
  headers: {
    {customized property}: 'string'
  }
  isPostPayloadJson: bool
  password: {
    {customized property}: 'string'
  }
  queryParameters: {
    {customized property}: any(...)
  }
  sessionIdName: 'string'
  sessionLoginRequestUri: 'string'
  sessionTimeoutInMinutes: int
  type: 'Session'
  userName: {
    {customized property}: 'string'
  }
}

Microsoft. Obiekty SecurityInsights/dataConnectors

Ustaw właściwość kind , aby określić typ obiektu.

W przypadku APIPollingużyj:

{
  kind: 'APIPolling'
  properties: {
    connectorUiConfig: {
      availability: {
        isPreview: bool
        status: int
      }
      connectivityCriteria: [
        {
          type: 'string'
          value: [
            'string'
          ]
        }
      ]
      customImage: 'string'
      dataTypes: [
        {
          lastDataReceivedQuery: 'string'
          name: 'string'
        }
      ]
      descriptionMarkdown: 'string'
      graphQueries: [
        {
          baseQuery: 'string'
          legend: 'string'
          metricName: 'string'
        }
      ]
      graphQueriesTableName: 'string'
      instructionSteps: [
        {
          description: 'string'
          instructions: [
            {
              parameters: any(...)
              type: 'string'
            }
          ]
          title: 'string'
        }
      ]
      permissions: {
        customs: [
          {
            description: 'string'
            name: 'string'
          }
        ]
        resourceProvider: [
          {
            permissionsDisplayText: 'string'
            provider: 'string'
            providerDisplayName: 'string'
            requiredPermissions: {
              action: bool
              delete: bool
              read: bool
              write: bool
            }
            scope: 'string'
          }
        ]
      }
      publisher: 'string'
      sampleQueries: [
        {
          description: 'string'
          query: 'string'
        }
      ]
      title: 'string'
    }
    pollingConfig: {
      auth: {
        apiKeyIdentifier: 'string'
        apiKeyName: 'string'
        authorizationEndpoint: 'string'
        authorizationEndpointQueryParameters: any(...)
        authType: 'string'
        flowName: 'string'
        isApiKeyInPostPayload: 'string'
        isClientSecretInHeader: bool
        redirectionEndpoint: 'string'
        scope: 'string'
        tokenEndpoint: 'string'
        tokenEndpointHeaders: any(...)
        tokenEndpointQueryParameters: any(...)
      }
      isActive: bool
      paging: {
        nextPageParaName: 'string'
        nextPageTokenJsonPath: 'string'
        pageCountAttributePath: 'string'
        pageSize: int
        pageSizeParaName: 'string'
        pageTimeStampAttributePath: 'string'
        pageTotalCountAttributePath: 'string'
        pagingType: 'string'
        searchTheLatestTimeStampFromEventsList: 'string'
      }
      request: {
        apiEndpoint: 'string'
        endTimeAttributeName: 'string'
        headers: any(...)
        httpMethod: 'string'
        queryParameters: any(...)
        queryParametersTemplate: 'string'
        queryTimeFormat: 'string'
        queryWindowInMin: int
        rateLimitQps: int
        retryCount: int
        startTimeAttributeName: 'string'
        timeoutInSeconds: int
      }
      response: {
        eventsJsonPaths: [
          'string'
        ]
        isGzipCompressed: bool
        successStatusJsonPath: 'string'
        successStatusValue: 'string'
      }
    }
  }
}

W przypadku aplikacji AmazonWebServicesCloudTrail użyj:

{
  kind: 'AmazonWebServicesCloudTrail'
  properties: {
    awsRoleArn: 'string'
    dataTypes: {
      logs: {
        state: 'string'
      }
    }
  }
}

W przypadku usługi AmazonWebServicesS3użyj:

{
  kind: 'AmazonWebServicesS3'
  properties: {
    dataTypes: {
      logs: {
        state: 'string'
      }
    }
    destinationTable: 'string'
    roleArn: 'string'
    sqsUrls: [
      'string'
    ]
  }
}

W przypadku usługi AzureActiveDirectory użyj:

{
  kind: 'AzureActiveDirectory'
  properties: {
    dataTypes: {
      alerts: {
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

W przypadku usługi AzureAdvancedThreatProtection użyj:

{
  kind: 'AzureAdvancedThreatProtection'
  properties: {
    dataTypes: {
      alerts: {
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

W przypadku programu AzureSecurityCenter użyj:

{
  kind: 'AzureSecurityCenter'
  properties: {
    dataTypes: {
      alerts: {
        state: 'string'
      }
    }
    subscriptionId: 'string'
  }
}

W przypadku usługi Dynamics365użyj:

{
  kind: 'Dynamics365'
  properties: {
    dataTypes: {
      dynamics365CdsActivities: {
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

W przypadku platformy GCP użyj:

{
  kind: 'GCP'
  properties: {
    auth: {
      projectNumber: 'string'
      serviceAccountEmail: 'string'
      workloadIdentityProviderId: 'string'
    }
    connectorDefinitionName: 'string'
    dcrConfig: {
      dataCollectionEndpoint: 'string'
      dataCollectionRuleImmutableId: 'string'
      streamName: 'string'
    }
    request: {
      projectId: 'string'
      subscriptionNames: [
        'string'
      ]
    }
  }
}

W przypadku genericUIużyj:

{
  kind: 'GenericUI'
  properties: {
    connectorUiConfig: {
      availability: {
        isPreview: bool
        status: int
      }
      connectivityCriteria: [
        {
          type: 'string'
          value: [
            'string'
          ]
        }
      ]
      customImage: 'string'
      dataTypes: [
        {
          lastDataReceivedQuery: 'string'
          name: 'string'
        }
      ]
      descriptionMarkdown: 'string'
      graphQueries: [
        {
          baseQuery: 'string'
          legend: 'string'
          metricName: 'string'
        }
      ]
      graphQueriesTableName: 'string'
      instructionSteps: [
        {
          description: 'string'
          instructions: [
            {
              parameters: any(...)
              type: 'string'
            }
          ]
          title: 'string'
        }
      ]
      permissions: {
        customs: [
          {
            description: 'string'
            name: 'string'
          }
        ]
        resourceProvider: [
          {
            permissionsDisplayText: 'string'
            provider: 'string'
            providerDisplayName: 'string'
            requiredPermissions: {
              action: bool
              delete: bool
              read: bool
              write: bool
            }
            scope: 'string'
          }
        ]
      }
      publisher: 'string'
      sampleQueries: [
        {
          description: 'string'
          query: 'string'
        }
      ]
      title: 'string'
    }
  }
}

W przypadku IOT użyj:

{
  kind: 'IOT'
  properties: {
    dataTypes: {
      alerts: {
        state: 'string'
      }
    }
    subscriptionId: 'string'
  }
}

W przypadku usługi MicrosoftCloudAppSecurity użyj:

{
  kind: 'MicrosoftCloudAppSecurity'
  properties: {
    dataTypes: {
      alerts: {
        state: 'string'
      }
      discoveryLogs: {
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

W przypadku elementu MicrosoftDefenderAdvancedThreatProtection użyj:

{
  kind: 'MicrosoftDefenderAdvancedThreatProtection'
  properties: {
    dataTypes: {
      alerts: {
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

W przypadku MicrosoftPurviewInformationProtectionużyj:

{
  kind: 'MicrosoftPurviewInformationProtection'
  properties: {
    dataTypes: {
      logs: {
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

W przypadku rozwiązania MicrosoftThreatIntelligence użyj:

{
  kind: 'MicrosoftThreatIntelligence'
  properties: {
    dataTypes: {
      microsoftEmergingThreatFeed: {
        lookbackPeriod: 'string'
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

W przypadku MicrosoftThreatProtectionużyj:

{
  kind: 'MicrosoftThreatProtection'
  properties: {
    dataTypes: {
      alerts: {
        state: 'string'
      }
      incidents: {
        state: 'string'
      }
    }
    filteredProviders: {
      alerts: [
        'string'
      ]
    }
    tenantId: 'string'
  }
}

W przypadku usługi Office365 użyj:

{
  kind: 'Office365'
  properties: {
    dataTypes: {
      exchange: {
        state: 'string'
      }
      sharePoint: {
        state: 'string'
      }
      teams: {
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

W przypadku Office365Projectużyj:

{
  kind: 'Office365Project'
  properties: {
    dataTypes: {
      logs: {
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

W przypadku officeATPużyj:

{
  kind: 'OfficeATP'
  properties: {
    dataTypes: {
      alerts: {
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

W przypadku officeIRMużyj:

{
  kind: 'OfficeIRM'
  properties: {
    dataTypes: {
      alerts: {
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

W przypadku OfficePowerBIużyj:

{
  kind: 'OfficePowerBI'
  properties: {
    dataTypes: {
      logs: {
        state: 'string'
      }
    }
    tenantId: 'string'
  }
}

W przypadku PremiumMicrosoftDefenderForThreatIntelligenceużyj:

{
  kind: 'PremiumMicrosoftDefenderForThreatIntelligence'
  properties: {
    dataTypes: {
      connector: {
        state: 'string'
      }
    }
    lookbackPeriod: 'string'
    requiredSKUsPresent: bool
    tenantId: 'string'
  }
}

W przypadku usługi PurviewAudit użyj:

{
  kind: 'PurviewAudit'
  properties: {
    connectorDefinitionName: 'string'
    dataTypes: {
      logs: {
        state: 'string'
      }
    }
    dcrConfig: {
      dataCollectionEndpoint: 'string'
      dataCollectionRuleImmutableId: 'string'
      streamName: 'string'
    }
    sourceType: 'string'
    tenantId: 'string'
  }
}

W przypadku interfejsu RESTApiPoller użyj:

{
  kind: 'RestApiPoller'
  properties: {
    addOnAttributes: {
      {customized property}: 'string'
    }
    auth: {
      type: 'string'
      // For remaining properties, see CcpAuthConfig objects
    }
    connectorDefinitionName: 'string'
    dataType: 'string'
    dcrConfig: {
      dataCollectionEndpoint: 'string'
      dataCollectionRuleImmutableId: 'string'
      streamName: 'string'
    }
    isActive: bool
    paging: {
      pageSize: int
      pageSizeParameterName: 'string'
      pagingType: 'string'
    }
    request: {
      apiEndpoint: 'string'
      endTimeAttributeName: 'string'
      headers: {
        {customized property}: 'string'
      }
      httpMethod: 'string'
      isPostPayloadJson: bool
      queryParameters: {
        {customized property}: any(...)
      }
      queryParametersTemplate: 'string'
      queryTimeFormat: 'string'
      queryTimeIntervalAttributeName: 'string'
      queryTimeIntervalDelimiter: 'string'
      queryTimeIntervalPrepend: 'string'
      queryWindowInMin: int
      rateLimitQPS: int
      retryCount: int
      startTimeAttributeName: 'string'
      timeoutInSeconds: int
    }
    response: {
      compressionAlgo: 'string'
      convertChildPropertiesToArray: bool
      csvDelimiter: 'string'
      csvEscape: 'string'
      eventsJsonPaths: [
        'string'
      ]
      format: 'string'
      hasCsvBoundary: bool
      hasCsvHeader: bool
      isGzipCompressed: bool
      successStatusJsonPath: 'string'
      successStatusValue: 'string'
    }
  }
}

W przypadku aplikacji ThreatIntelligence użyj:

{
  kind: 'ThreatIntelligence'
  properties: {
    dataTypes: {
      indicators: {
        state: 'string'
      }
    }
    tenantId: 'string'
    tipLookbackPeriod: 'string'
  }
}

W przypadku ThreatIntelligenceTaxiiużyj:

{
  kind: 'ThreatIntelligenceTaxii'
  properties: {
    collectionId: 'string'
    dataTypes: {
      taxiiClient: {
        state: 'string'
      }
    }
    friendlyName: 'string'
    password: 'string'
    pollingFrequency: 'string'
    taxiiLookbackPeriod: 'string'
    taxiiServer: 'string'
    tenantId: 'string'
    userName: 'string'
    workspaceId: 'string'
  }
}

Wartości właściwości