{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "description": "AgentValet SIEM streaming to Microsoft Sentinel. Creates, in YOUR subscription: a custom table in your Sentinel (Log Analytics) workspace, a Direct data collection rule (DCR) for the Logs Ingestion API, and a Monitoring Metrics Publisher role assignment for the Entra app AgentValet signs in as. Deploy into the resource group that holds the workspace. Source: https://docs.agentvalet.ai/concepts/siem-streaming"
  },
  "parameters": {
    "workspaceName": {
      "type": "string",
      "metadata": { "description": "Name of the existing Log Analytics workspace that Microsoft Sentinel uses, in this resource group." }
    },
    "servicePrincipalObjectId": {
      "type": "string",
      "metadata": { "description": "Object id of the service principal (enterprise application) of the Entra app registration you created for AgentValet. Get it with: az ad sp show --id <application-client-id> --query id -o tsv" }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": { "description": "Region of the workspace. The DCR must be in the same region." }
    },
    "tableName": {
      "type": "string",
      "defaultValue": "AgentValet_CL",
      "metadata": { "description": "Custom table name. Must end in _CL." }
    },
    "dataCollectionRuleName": {
      "type": "string",
      "defaultValue": "dcr-agentvalet",
      "metadata": { "description": "Name of the data collection rule to create." }
    },
    "assignRole": {
      "type": "bool",
      "defaultValue": true,
      "metadata": { "description": "Grant Monitoring Metrics Publisher on the DCR to the app. Needs Owner, User Access Administrator or Role Based Access Control Administrator. Set false if you only have Contributor, and have an Owner assign the role afterwards." }
    }
  },
  "variables": {
    "streamName": "[concat('Custom-', parameters('tableName'))]",
    "monitoringMetricsPublisher": "3913510d-42f4-4e42-8a64-420c390055eb",
    "columns": [
      { "name": "TimeGenerated", "type": "datetime" },
      { "name": "EventUid", "type": "string" },
      { "name": "ClassUid", "type": "int" },
      { "name": "ClassName", "type": "string" },
      { "name": "CategoryUid", "type": "int" },
      { "name": "ActivityId", "type": "int" },
      { "name": "ActivityName", "type": "string" },
      { "name": "TypeUid", "type": "long" },
      { "name": "SeverityId", "type": "int" },
      { "name": "Severity", "type": "string" },
      { "name": "StatusId", "type": "int" },
      { "name": "Status", "type": "string" },
      { "name": "Message", "type": "string" },
      { "name": "AgentId", "type": "string" },
      { "name": "ParentAgentId", "type": "string" },
      { "name": "OrgId", "type": "string" },
      { "name": "OwnerId", "type": "string" },
      { "name": "PlatformId", "type": "string" },
      { "name": "Operation", "type": "string" },
      { "name": "Result", "type": "string" },
      { "name": "Reason", "type": "string" },
      { "name": "CorrelationUid", "type": "string" },
      { "name": "PolicyId", "type": "string" },
      { "name": "ApprovalId", "type": "string" },
      { "name": "PermissionId", "type": "string" },
      { "name": "OcsfVersion", "type": "string" },
      { "name": "Ocsf", "type": "dynamic" }
    ]
  },
  "resources": [
    {
      "type": "Microsoft.OperationalInsights/workspaces/tables",
      "apiVersion": "2022-10-01",
      "name": "[concat(parameters('workspaceName'), '/', parameters('tableName'))]",
      "properties": {
        "plan": "Analytics",
        "schema": {
          "name": "[parameters('tableName')]",
          "columns": "[variables('columns')]"
        }
      }
    },
    {
      "type": "Microsoft.Insights/dataCollectionRules",
      "apiVersion": "2023-03-11",
      "name": "[parameters('dataCollectionRuleName')]",
      "location": "[parameters('location')]",
      "kind": "Direct",
      "dependsOn": [
        "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('tableName'))]"
      ],
      "properties": {
        "description": "AgentValet governance events (OCSF 1.3) via the Logs Ingestion API.",
        "streamDeclarations": {
          "[variables('streamName')]": {
            "columns": "[variables('columns')]"
          }
        },
        "destinations": {
          "logAnalytics": [
            {
              "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))]",
              "name": "sentinelWorkspace"
            }
          ]
        },
        "dataFlows": [
          {
            "streams": ["[variables('streamName')]"],
            "destinations": ["sentinelWorkspace"],
            "transformKql": "source",
            "outputStream": "[variables('streamName')]"
          }
        ]
      }
    },
    {
      "condition": "[parameters('assignRole')]",
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "scope": "[format('Microsoft.Insights/dataCollectionRules/{0}', parameters('dataCollectionRuleName'))]",
      "name": "[guid(resourceId('Microsoft.Insights/dataCollectionRules', parameters('dataCollectionRuleName')), parameters('servicePrincipalObjectId'), variables('monitoringMetricsPublisher'))]",
      "dependsOn": [
        "[resourceId('Microsoft.Insights/dataCollectionRules', parameters('dataCollectionRuleName'))]"
      ],
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('monitoringMetricsPublisher'))]",
        "principalId": "[parameters('servicePrincipalObjectId')]",
        "principalType": "ServicePrincipal"
      }
    }
  ],
  "outputs": {
    "logsIngestionEndpoint": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.Insights/dataCollectionRules', parameters('dataCollectionRuleName')), '2023-03-11').endpoints.logsIngestion]"
    },
    "dcrImmutableId": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.Insights/dataCollectionRules', parameters('dataCollectionRuleName')), '2023-03-11').immutableId]"
    },
    "streamName": {
      "type": "string",
      "value": "[variables('streamName')]"
    },
    "dataCollectionRuleId": {
      "type": "string",
      "value": "[resourceId('Microsoft.Insights/dataCollectionRules', parameters('dataCollectionRuleName'))]"
    }
  }
}