{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "description": "SafeHanded audit streaming to Microsoft Sentinel / Log Analytics (Logs Ingestion API): creates the SafeHanded_Audit_CL table and a data collection rule with its own logs ingestion endpoint. Grant your app registration 'Monitoring Metrics Publisher' on the rule afterwards. https://docs.safehanded.com/integrations/siem/sentinel/"
  },
  "parameters": {
    "workspaceName": {
      "type": "string",
      "metadata": {
        "description": "The existing Log Analytics workspace (the one Sentinel uses)."
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Must be the workspace's region."
      }
    },
    "dataCollectionRuleName": {
      "type": "string",
      "defaultValue": "safehanded-audit"
    },
    "retentionInDays": {
      "type": "int",
      "defaultValue": 90,
      "minValue": 4,
      "maxValue": 730
    }
  },
  "variables": {
    "tableName": "SafeHanded_Audit_CL",
    "streamName": "Custom-SafeHanded_Audit_CL"
  },
  "resources": [
    {
      "type": "Microsoft.OperationalInsights/workspaces/tables",
      "apiVersion": "2022-10-01",
      "name": "[format('{0}/{1}', parameters('workspaceName'), variables('tableName'))]",
      "properties": {
        "plan": "Analytics",
        "retentionInDays": "[parameters('retentionInDays')]",
        "schema": {
          "name": "[variables('tableName')]",
          "columns": [
            {
              "name": "TimeGenerated",
              "type": "datetime"
            },
            {
              "name": "OrgId",
              "type": "string"
            },
            {
              "name": "Seq",
              "type": "long"
            },
            {
              "name": "PrevHash",
              "type": "string"
            },
            {
              "name": "Hash",
              "type": "string"
            },
            {
              "name": "Sig",
              "type": "string"
            },
            {
              "name": "SigKeyId",
              "type": "string"
            },
            {
              "name": "Event",
              "type": "string"
            },
            {
              "name": "Level",
              "type": "string"
            },
            {
              "name": "ActorType",
              "type": "string"
            },
            {
              "name": "ActorId",
              "type": "string"
            },
            {
              "name": "ActorLabel",
              "type": "string"
            },
            {
              "name": "RequestId",
              "type": "string"
            },
            {
              "name": "ShareId",
              "type": "string"
            },
            {
              "name": "ClientId",
              "type": "string"
            },
            {
              "name": "ClientSeq",
              "type": "long"
            },
            {
              "name": "SourceIp",
              "type": "string"
            },
            {
              "name": "UserAgent",
              "type": "string"
            },
            {
              "name": "Metadata",
              "type": "dynamic"
            }
          ]
        }
      }
    },
    {
      "type": "Microsoft.Insights/dataCollectionRules",
      "apiVersion": "2023-03-11",
      "name": "[parameters('dataCollectionRuleName')]",
      "location": "[parameters('location')]",
      "kind": "Direct",
      "dependsOn": [
        "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), variables('tableName'))]"
      ],
      "properties": {
        "streamDeclarations": {
          "Custom-SafeHanded_Audit_CL": {
            "columns": [
              {
                "name": "TimeGenerated",
                "type": "datetime"
              },
              {
                "name": "OrgId",
                "type": "string"
              },
              {
                "name": "Seq",
                "type": "long"
              },
              {
                "name": "PrevHash",
                "type": "string"
              },
              {
                "name": "Hash",
                "type": "string"
              },
              {
                "name": "Sig",
                "type": "string"
              },
              {
                "name": "SigKeyId",
                "type": "string"
              },
              {
                "name": "Event",
                "type": "string"
              },
              {
                "name": "Level",
                "type": "string"
              },
              {
                "name": "ActorType",
                "type": "string"
              },
              {
                "name": "ActorId",
                "type": "string"
              },
              {
                "name": "ActorLabel",
                "type": "string"
              },
              {
                "name": "RequestId",
                "type": "string"
              },
              {
                "name": "ShareId",
                "type": "string"
              },
              {
                "name": "ClientId",
                "type": "string"
              },
              {
                "name": "ClientSeq",
                "type": "long"
              },
              {
                "name": "SourceIp",
                "type": "string"
              },
              {
                "name": "UserAgent",
                "type": "string"
              },
              {
                "name": "Metadata",
                "type": "dynamic"
              }
            ]
          }
        },
        "destinations": {
          "logAnalytics": [
            {
              "name": "workspace",
              "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))]"
            }
          ]
        },
        "dataFlows": [
          {
            "streams": [
              "[variables('streamName')]"
            ],
            "destinations": [
              "workspace"
            ],
            "transformKql": "source",
            "outputStream": "[variables('streamName')]"
          }
        ]
      }
    }
  ],
  "outputs": {
    "logsIngestionEndpoint": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.Insights/dataCollectionRules', parameters('dataCollectionRuleName')), '2023-03-11').endpoints.logsIngestion]"
    },
    "dataCollectionRuleImmutableId": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.Insights/dataCollectionRules', parameters('dataCollectionRuleName')), '2023-03-11').immutableId]"
    },
    "streamName": {
      "type": "string",
      "value": "[variables('streamName')]"
    },
    "dataCollectionRuleId": {
      "type": "string",
      "value": "[resourceId('Microsoft.Insights/dataCollectionRules', parameters('dataCollectionRuleName'))]"
    }
  }
}