Add panorays solution

Solutions/Panorays/Data Connectors/Panorays_CCF/DeployInstance.json

@@ -0,0 +1,169 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "workspaceName": { "type": "string", "metadata": { "description": "Log Analytics Workspace Name (Not ID)" } },
+    "location": { "type": "string", "defaultValue": "eastus" },
+    "panoraysAPIBaseUrl": { "type": "string", "defaultValue": "https://api.panoraysapp.com" },
+    "apitoken": { "type": "securestring" }
+  },
+  "variables": {
+    "dceName": "Panorays-Manual-DCE",
+    "dcrName": "Panorays-Manual-DCR",
+    "tableName": "PanoraysCompanyFindingPOC_CL",
+    "connectorDefinitionName": "ccpPanoraysCompanyFindingPOC",
+    "connectorInstanceName": "Panorays-Manual-Instance"
+  },
+  "resources": [
+    {
+      "type": "Microsoft.Insights/dataCollectionEndpoints",
+      "apiVersion": "2021-09-01-preview",
+      "name": "[variables('dceName')]",
+      "location": "[parameters('location')]",
+      "properties": {
+        "networkAcls": { "publicNetworkAccess": "Enabled" }
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/tables",
+      "apiVersion": "2022-10-01",
+      "name": "[concat(parameters('workspaceName'), '/', variables('tableName'))]",
+      "location": "[parameters('location')]",
+      "properties": {
+        "schema": {
+          "name": "[variables('tableName')]",
+          "columns": [
+            { "name": "TimeGenerated", "type": "datetime" },
+            { "name": "FindingKey", "type": "string" },
+            { "name": "status", "type": "string" },
+            { "name": "severity", "type": "string" },
+            { "name": "asset_name", "type": "string" },
+            { "name": "cves", "type": "dynamic" },
+            { "name": "finding_text", "type": "string" },
+            { "name": "description", "type": "string" }
+          ]
+        }
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
+      "apiVersion": "2022-09-01-preview",
+      "name": "[concat(parameters('workspaceName'), '/Microsoft.SecurityInsights/', variables('connectorDefinitionName'))]",
+      "location": "[parameters('location')]",
+      "kind": "Customizable",
+      "properties": {
+        "connectorUiConfig": {
+          "id": "[variables('connectorDefinitionName')]",
+          "title": "Panorays (Manual)",
+          "publisher": "Microsoft",
+          "descriptionMarkdown": "Manually deployed Panorays Connector for testing.",
+          "graphQueriesTableName": "[variables('tableName')]",
+          "graphQueries": [
+            { "metricName": "Total findings", "legend": "Findings", "baseQuery": "{{graphQueriesTableName}}" }
+          ],
+          "sampleQueries": [
+            { "description": "Get Sample Data", "query": "{{graphQueriesTableName}} | take 10" }
+          ],
+          "dataTypes": [
+            { "name": "{{graphQueriesTableName}}", "lastDataReceivedQuery": "{{graphQueriesTableName}} | summarize Time = max(TimeGenerated) | where isnotempty(Time)" }
+          ],
+          "connectivityCriteria": [ { "type": "HasDataConnectors" } ],
+          "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "Read and Write", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "read": true, "write": true, "delete": true } } ] },
+          "instructionSteps": [
+            {
+              "instructions": [
+                { "type": "Markdown", "parameters": { "content": "Manual Deployment Test" } }
+              ]
+            }
+          ]
+        }
+      }
+    },
+    {
+      "type": "Microsoft.Insights/dataCollectionRules",
+      "apiVersion": "2021-09-01-preview",
+      "name": "[variables('dcrName')]",
+      "location": "[parameters('location')]",
+      "dependsOn": [
+        "[resourceId('Microsoft.Insights/dataCollectionEndpoints', variables('dceName'))]",
+        "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), variables('tableName'))]"
+      ],
+      "properties": {
+        "dataCollectionEndpointId": "[resourceId('Microsoft.Insights/dataCollectionEndpoints', variables('dceName'))]",
+        "streamDeclarations": {
+          "Custom-PanoraysStream": {
+            "columns": [
+              { "name": "id", "type": "string" },
+              { "name": "status", "type": "string" },
+              { "name": "severity", "type": "string" },
+              { "name": "asset_name", "type": "string" },
+              { "name": "cves", "type": "string" },
+              { "name": "finding_text", "type": "string" },
+              { "name": "description", "type": "string" }
+            ]
+          }
+        },
+        "destinations": {
+          "logAnalytics": [
+            {
+              "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))]",
+              "name": "law"
+            }
+          ]
+        },
+        "dataFlows": [
+          {
+            "streams": [ "Custom-PanoraysStream" ],
+            "destinations": [ "law" ],
+            "transformKql": "source | project TimeGenerated = now(), FindingKey = id, status, severity, asset_name, cves, finding_text, description",
+            "outputStream": "[concat('Custom-', variables('tableName'))]"
+          }
+        ]
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
+      "apiVersion": "2022-09-01-preview",
+      "name": "[concat(parameters('workspaceName'), '/Microsoft.SecurityInsights/', variables('connectorInstanceName'))]",
+      "location": "[parameters('location')]",
+      "dependsOn": [
+        "[resourceId('Microsoft.Insights/dataCollectionRules', variables('dcrName'))]",
+        "[resourceId('Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions', parameters('workspaceName'), 'Microsoft.SecurityInsights', variables('connectorDefinitionName'))]"
+      ],
+      "kind": "RestApiPoller",
+      "properties": {
+        "connectorDefinitionName": "[variables('connectorDefinitionName')]",
+        "dataType": "[variables('tableName')]",
+        "dcrConfig": {
+          "streamName": "Custom-PanoraysStream",
+          "dataCollectionEndpoint": "[reference(resourceId('Microsoft.Insights/dataCollectionEndpoints', variables('dceName')), '2021-09-01-preview').logsIngestion.endpoint]",
+          "dataCollectionRuleImmutableId": "[reference(resourceId('Microsoft.Insights/dataCollectionRules', variables('dcrName')), '2021-09-01-preview').immutableId]" 
+        },
+        "auth": {
+          "type": "APIKey",
+          "ApiKey": "[parameters('apitoken')]",
+          "ApiKeyName": "Authorization",
+          "ApiKeyIdentifier": "Bearer"
+        },
+        "request": {
+          "apiEndpoint": "[concat(parameters('panoraysAPIBaseUrl'), '/v2/findings')]",
+          "rateLimitQPS": 10,
+          "queryWindowInMin": 1,
+          "httpMethod": "GET",
+          "headers": { 
+            "Accept": "application/json",
+            "User-Agent": "PanoraysIntegration/1.0"
+          }
+        },
+        "paging": {
+          "pagingType": "NextPageToken",
+          "PageSize": 100,
+          "PageSizeParameterName": "limit",
+          "NextPageTokenJsonPath": "$.pagination.nextCursor",
+          "NextPageParaName": "cursor"
+        },
+        "response": { "eventsJsonPaths": [ "$.data" ] }
+      }
+    }
+  ]
+}