Azure_Sentinel_Codeless_Connector.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "logAnalyticsWorkspaceName": {
      "defaultValue": "",
      "type": "string",
      "metadata": {
        "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
      }
    },
    "connectorResourceName": {
      "type": "string",
      "defaultValue": "AirtableAuditLogsCCP",
      "metadata": {
        "description": "Resource name for connector"
      }
    }
  },
  "functions": [],
  "variables": {},
  "resources": [
    {
      "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
      "name": "[concat(parameters('logAnalyticsWorkspaceName'),'/Microsoft.SecurityInsights/', parameters('connectorResourceName'))]",
      "apiVersion": "2021-03-01-preview",
      "location": "[resourceGroup().location]",
      "dependsOn": [],
      "kind": "APIPolling",
      "properties": {
        "connectorUiConfig": {
          "id": "AirtableAuditLogsCCP",
          "title": "Airtable Audit Logs",
          "publisher": "Airtable Labs",
          "descriptionMarkdown": "This [Airtable](https://airtable.com) data connector provides the capability to ingest [Airtable Audit Logs](https://airtable.com/developers/web/api/audit-logs-overview) events into Microsoft Sentinel. \n\nThis data connector is not supported by Formagrid Inc (Airtable) or part of the Airtable Service. It is made available on an 'as is' basis and provided without express or implied warranties of any kind.",
          "graphQueriesTableName": "AirtableAuditLogs_CL",
          "graphQueries": [
            {
              "metricName": "Total data received",
              "legend": "Airtable Audit Log events",
              "baseQuery": "{{graphQueriesTableName}}"
            }
          ],
          "sampleQueries": [
            {
              "description": "All Airtable Audit Log events",
              "query": "{{graphQueriesTableName}}\n| sort by TimeGenerated desc"
            }
          ],
          "dataTypes": [
            {
              "name": "{{graphQueriesTableName}}",
              "lastDataReceivedQuery": "{{graphQueriesTableName}}\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
            }
          ],
          "connectivityCriteria": [
            {
              "type": "SentinelKindsV2",
              "value": []
            }
          ],
          "availability": {
            "status": 1,
            "isPreview": true
          },
          "permissions": {
            "resourceProvider": [
              {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Azure Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                  "write": true,
                  "read": true,
                  "delete": true
                }
              },
              {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)",
                "providerDisplayName": "Azure Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                  "action": true
                }
              }
            ],
            "customs": [
              {
                "name": "Airtable Audit Logs",
                "description": "A [personal access token](https://support.airtable.com/docs/creating-and-using-api-keys-and-access-tokens) (from a user or [service account](https://support.airtable.com/docs/en/service-accounts-overview) with admin privileges) with the [enterprise.auditLogs:read](https://airtable.com/developers/web/api/scopes#enterprise-audit-logs-read) scope (entered as 'API key' below)"
              }
            ]
          },
          "instructionSteps": [
            {
              "title": "Connect your Airtable Enterprise Audit Logs to Microsoft Sentinel",
              "description": "Provide the following information to connect your Airtable Enterprise Audit Logs to Microsoft Sentinel.",
              "instructions": [
                {
                  "parameters": {
                    "enable": "true",
                    "userRequestPlaceHoldersInput": [
                      {
                        "displayText": "Airtable Enterprise Account ID",
                        "requestObjectKey": "apiEndpoint",
                        "placeHolderName": "{{enterpriseAccountId}}",
                        "placeHolderValue": ""
                      }
                    ]
                  },
                  "type": "APIKey"
                }
              ]
            }
          ]
        },
        "pollingConfig": {
          "auth": {
            "authType": "APIKey",
            "APIKeyName": "Authorization",
            "APIKeyIdentifier": "Bearer"
          },
          "request": {
            "apiEndpoint": "https://api.airtable.com/v0/meta/enterpriseAccounts/{{enterpriseAccountId}}/auditLogEvents",
            "httpMethod": "Get",
            "rateLimitQPS": 5,
            "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
            "startTimeAttributeName": "startTime",
            "endTimeAttributeName": "endTime",
            "queryWindowInMin": 5,
            "headers": {
              "User-Agent": "Azure-Sentinel CCP by Airtable Labs/1.0.0"
            },
            "queryParameters": {
              "pageSize": 100,
              "sortOrder": "ascending"
            }
          },
          "paging": {
            "pagingType": "NextPageToken",
            "nextPageParaName": "next",
            "nextPageTokenJsonPath": "$..pagination.next"
          },
          "response": {
            "eventsJsonPaths": [
              "$..events"
            ]
          }
        }
      }
    }
  ],
  "outputs": {}
}