Skip to content

Commit 8e39dd8

Browse files
oZakarigithub-actions[bot]
oZakari
and
github-actions[bot]
authored
fix: Add required change tracking solution (#997)
* Add missing change tracking solution * Changes to workspace solutions * Fix name of changetracking * Add umi location param for accelerator * Formatting * Generate Parameter Markdowns [oZakari/4b1d31cb] --------- Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 4b1d31c commit 8e39dd8

File tree

8 files changed

+134
-76
lines changed

8 files changed

+134
-76
lines changed

Diff for: ‎accelerator/.config/ALZ-Powershell-Auto.config.json

+4
Original file line numberDiff line numberDiff line change
@@ -305,6 +305,10 @@
305305
"Name": "parLocation.value",
306306
"Destination": "Parameters"
307307
},
308+
{
309+
"Name": "parUserAssignedManagedIdentityLocation.value",
310+
"Destination": "Parameters"
311+
},
308312
{
309313
"Name": "parAutomationAccountLocation.value",
310314
"Destination": "Parameters"

Diff for: ‎infra-as-code/bicep/modules/logging/generateddocs/logging.bicep.md

+27-19
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,8 @@ parLogAnalyticsWorkspaceCapacityReservationLevel | No | Log Analytics Work
2020
parLogAnalyticsWorkspaceLogRetentionInDays | No | Number of days of log retention for Log Analytics Workspace.
2121
parLogAnalyticsWorkspaceLock | No | Resource Lock Configuration for Log Analytics Workspace. - `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None. - `notes` - Notes about this lock.
2222
parLogAnalyticsWorkspaceSolutions | No | Solutions that will be added to the Log Analytics Workspace.
23-
parLogAnalyticsWorkspaceSolutionsLock | No | Resource Lock Configuration for Log Analytics Workspace Solutions. - `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None. - `notes` - Notes about this lock.
23+
parSecurityInsightsOnboardingLock | No | Resource Lock Configuration for Security Insights solution. - `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None. - `notes` - Notes about this lock.
24+
parChangeTrackingSolutionLock | No | Resource Lock Configuration for Change Tracking solution. - `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None. - `notes` - Notes about this lock.
2425
parUserAssignedManagedIdentityName | No | Name of the User Assigned Managed Identity required for authenticating Azure Monitoring Agent to Azure.
2526
parUserAssignedManagedIdentityLocation | No | User Assigned Managed Identity location.
2627
parAutomationAccountEnabled | No | Switch to enable/disable Automation Account deployment.
@@ -33,7 +34,6 @@ parAutomationAccountLock | No | Resource Lock Configuration for Automation
3334
parTags | No | Tags you would like to be applied to all resources in this module.
3435
parAutomationAccountTags | No | Tags you would like to be applied to Automation Account.
3536
parLogAnalyticsWorkspaceTags | No | Tags you would like to be applied to Log Analytics Workspace.
36-
parUseSentinelClassicPricingTiers | No | Set Parameter to true to use Sentinel Classic Pricing Tiers, following changes introduced in July 2023 as documented here: https://learn.microsoft.com/azure/sentinel/enroll-simplified-pricing-tier.
3737
parLogAnalyticsLinkedServiceAutomationAccountName | No | Log Analytics LinkedService name for Automation Account.
3838
parTelemetryOptOut | No | Set Parameter to true to Opt-out of deployment telemetry
3939

@@ -176,21 +176,33 @@ Resource Lock Configuration for Log Analytics Workspace.
176176

177177
Solutions that will be added to the Log Analytics Workspace.
178178

179-
- Default value: `SecurityInsights`
179+
- Default value: `SecurityInsights ChangeTracking`
180180

181-
- Allowed values: `SecurityInsights`
181+
- Allowed values: `SecurityInsights`, `ChangeTracking`
182182

183-
### parLogAnalyticsWorkspaceSolutionsLock
183+
### parSecurityInsightsOnboardingLock
184184

185185
![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square)
186186

187-
Resource Lock Configuration for Log Analytics Workspace Solutions.
187+
Resource Lock Configuration for Security Insights solution.
188188

189189
- `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None.
190190
- `notes` - Notes about this lock.
191191

192192

193193

194+
- Default value: `@{kind=None; notes=This lock was created by the ALZ Bicep Logging Module.}`
195+
196+
### parChangeTrackingSolutionLock
197+
198+
![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square)
199+
200+
Resource Lock Configuration for Change Tracking solution.
201+
- `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None.
202+
- `notes` - Notes about this lock.
203+
204+
205+
194206
- Default value: `@{kind=None; notes=This lock was created by the ALZ Bicep Logging Module.}`
195207

196208
### parUserAssignedManagedIdentityName
@@ -292,14 +304,6 @@ Tags you would like to be applied to Log Analytics Workspace.
292304

293305
- Default value: `[parameters('parTags')]`
294306

295-
### parUseSentinelClassicPricingTiers
296-
297-
![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square)
298-
299-
Set Parameter to true to use Sentinel Classic Pricing Tiers, following changes introduced in July 2023 as documented here: https://learn.microsoft.com/azure/sentinel/enroll-simplified-pricing-tier.
300-
301-
- Default value: `False`
302-
303307
### parLogAnalyticsLinkedServiceAutomationAccountName
304308

305309
![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square)
@@ -403,10 +407,17 @@ outAutomationAccountId | string |
403407
},
404408
"parLogAnalyticsWorkspaceSolutions": {
405409
"value": [
406-
"SecurityInsights"
410+
"SecurityInsights",
411+
"ChangeTracking"
407412
]
408413
},
409-
"parLogAnalyticsWorkspaceSolutionsLock": {
414+
"parSecurityInsightsOnboardingLock": {
415+
"value": {
416+
"kind": "None",
417+
"notes": "This lock was created by the ALZ Bicep Logging Module."
418+
}
419+
},
420+
"parChangeTrackingSolutionLock": {
410421
"value": {
411422
"kind": "None",
412423
"notes": "This lock was created by the ALZ Bicep Logging Module."
@@ -451,9 +462,6 @@ outAutomationAccountId | string |
451462
"parLogAnalyticsWorkspaceTags": {
452463
"value": "[parameters('parTags')]"
453464
},
454-
"parUseSentinelClassicPricingTiers": {
455-
"value": false
456-
},
457465
"parLogAnalyticsLinkedServiceAutomationAccountName": {
458466
"value": "Automation"
459467
},

Diff for: ‎infra-as-code/bicep/modules/logging/logging.bicep

+39-24
Original file line numberDiff line numberDiff line change
@@ -115,23 +115,36 @@ param parLogAnalyticsWorkspaceLock lockType = {
115115

116116
@allowed([
117117
'SecurityInsights'
118+
'ChangeTracking'
118119
])
119120
@sys.description('Solutions that will be added to the Log Analytics Workspace.')
120121
param parLogAnalyticsWorkspaceSolutions array = [
121122
'SecurityInsights'
123+
'ChangeTracking'
122124
]
123125

124-
@sys.description('''Resource Lock Configuration for Log Analytics Workspace Solutions.
126+
@sys.description('''Resource Lock Configuration for Security Insights solution.
125127
126128
- `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None.
127129
- `notes` - Notes about this lock.
128130
129131
''')
130-
param parLogAnalyticsWorkspaceSolutionsLock lockType = {
132+
param parSecurityInsightsOnboardingLock lockType = {
131133
kind: 'None'
132134
notes: 'This lock was created by the ALZ Bicep Logging Module.'
133135
}
134136

137+
@sys.description('''Resource Lock Configuration for Change Tracking solution.
138+
- `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None.
139+
- `notes` - Notes about this lock.
140+
141+
''')
142+
param parChangeTrackingSolutionLock lockType = {
143+
kind: 'None'
144+
notes: 'This lock was created by the ALZ Bicep Logging Module.'
145+
}
146+
147+
135148
@sys.description('Name of the User Assigned Managed Identity required for authenticating Azure Monitoring Agent to Azure.')
136149
param parUserAssignedManagedIdentityName string = 'alz-logging-mi'
137150

@@ -176,9 +189,6 @@ param parAutomationAccountTags object = parTags
176189
@sys.description('Tags you would like to be applied to Log Analytics Workspace.')
177190
param parLogAnalyticsWorkspaceTags object = parTags
178191

179-
@sys.description('Set Parameter to true to use Sentinel Classic Pricing Tiers, following changes introduced in July 2023 as documented here: https://learn.microsoft.com/azure/sentinel/enroll-simplified-pricing-tier.')
180-
param parUseSentinelClassicPricingTiers bool = false
181-
182192
@sys.description('Log Analytics LinkedService name for Automation Account.')
183193
param parLogAnalyticsLinkedServiceAutomationAccountName string = 'Automation'
184194

@@ -654,35 +664,40 @@ resource resSentinelOnboarding 'Microsoft.SecurityInsights/onboardingStates@2024
654664
properties: {}
655665
}
656666

657-
resource resLogAnalyticsWorkspaceSolutions 'Microsoft.OperationsManagement/solutions@2015-11-01-preview' = [for solution in parLogAnalyticsWorkspaceSolutions: {
658-
name: '${solution}(${resLogAnalyticsWorkspace.name})'
667+
resource resChangeTrackingSolution 'Microsoft.OperationsManagement/solutions@2015-11-01-preview' = if (contains(parLogAnalyticsWorkspaceSolutions, 'ChangeTracking')) {
668+
name: 'ChangeTracking(${resLogAnalyticsWorkspace.name})'
659669
location: parLogAnalyticsWorkspaceLocation
660-
tags: parTags
661-
properties: solution == 'SecurityInsights' ? {
662-
workspaceResourceId: resLogAnalyticsWorkspace.id
663-
sku: parUseSentinelClassicPricingTiers ? null : {
664-
name: 'Unified'
665-
}
666-
} : {
670+
properties: {
667671
workspaceResourceId: resLogAnalyticsWorkspace.id
668672
}
669673
plan: {
670-
name: '${solution}(${resLogAnalyticsWorkspace.name})'
671-
product: 'OMSGallery/${solution}'
674+
name: 'ChangeTracking(${resLogAnalyticsWorkspace.name})'
675+
product: 'OMSGallery/ChangeTracking'
672676
publisher: 'Microsoft'
673677
promotionCode: ''
674678
}
675-
}]
679+
}
680+
681+
682+
// Add resource lock for SecurityInsights solution
683+
resource resSecurityInsightsSolutionLock 'Microsoft.Authorization/locks@2020-05-01' = if (parSecurityInsightsOnboardingLock.kind != 'None' || parGlobalResourceLock.kind != 'None') {
684+
scope: resSentinelOnboarding
685+
name: parSecurityInsightsOnboardingLock.?name ?? '${resSentinelOnboarding.name}-lock'
686+
properties: {
687+
level: (parGlobalResourceLock.kind != 'None') ? parGlobalResourceLock.kind : parSecurityInsightsOnboardingLock.kind
688+
notes: (parGlobalResourceLock.kind != 'None') ? parGlobalResourceLock.?notes : parSecurityInsightsOnboardingLock.?notes
689+
}
690+
}
676691

677-
// Create a resource lock for each log analytics workspace solutions in parLogAnalyticsWorkspaceSolutions if parGlobalResourceLock.kind != 'None' or if parLogAnalyticsWorkspaceSolutionsLock.kind != 'None'
678-
resource resLogAnalyticsWorkspaceSolutionsLock 'Microsoft.Authorization/locks@2020-05-01' = [for (solution, index) in parLogAnalyticsWorkspaceSolutions: if (parLogAnalyticsWorkspaceSolutionsLock.kind != 'None' || parGlobalResourceLock.kind != 'None') {
679-
scope: resLogAnalyticsWorkspaceSolutions[index]
680-
name: parLogAnalyticsWorkspaceSolutionsLock.?name ?? '${resLogAnalyticsWorkspaceSolutions[index].name}-lock'
692+
// Add resource lock for ChangeTracking solution
693+
resource resChangeTrackingSolutionLock 'Microsoft.Authorization/locks@2020-05-01' = if (parChangeTrackingSolutionLock.kind != 'None' || parGlobalResourceLock.kind != 'None') {
694+
scope: resChangeTrackingSolution
695+
name: parChangeTrackingSolutionLock.?name ?? '${resChangeTrackingSolution.name}-lock'
681696
properties: {
682-
level: (parGlobalResourceLock.kind != 'None') ? parGlobalResourceLock.kind : parLogAnalyticsWorkspaceSolutionsLock.kind
683-
notes: (parGlobalResourceLock.kind != 'None') ? parGlobalResourceLock.?notes : parLogAnalyticsWorkspaceSolutionsLock.?notes
697+
level: (parGlobalResourceLock.kind != 'None') ? parGlobalResourceLock.kind : parChangeTrackingSolutionLock.kind
698+
notes: (parGlobalResourceLock.kind != 'None') ? parGlobalResourceLock.?notes : parChangeTrackingSolutionLock.?notes
684699
}
685-
}]
700+
}
686701

687702
resource resLogAnalyticsLinkedServiceForAutomationAccount 'Microsoft.OperationalInsights/workspaces/linkedServices@2023-09-01' = if (parLogAnalyticsWorkspaceLinkAutomationAccount) {
688703
parent: resLogAnalyticsWorkspace

Diff for: ‎infra-as-code/bicep/modules/logging/parameters/logging.parameters.all.json

+24-7
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,8 @@
1919
},
2020
"parLogAnalyticsWorkspaceSolutions": {
2121
"value": [
22-
"SecurityInsights"
22+
"SecurityInsights",
23+
"ChangeTracking"
2324
]
2425
},
2526
"parDataCollectionRuleVMInsightsName": {
@@ -34,6 +35,9 @@
3435
"parUserAssignedManagedIdentityName": {
3536
"value": "alz-umi-identity"
3637
},
38+
"parUserAssignedManagedIdentityLocation": {
39+
"value": "eastus"
40+
},
3741
"parAutomationAccountEnabled": {
3842
"value": false
3943
},
@@ -57,8 +61,15 @@
5761
"Environment": "Live"
5862
}
5963
},
60-
"parUseSentinelClassicPricingTiers": {
61-
"value": false
64+
"parLogAnalyticsWorkspaceTags": {
65+
"value": {
66+
"Environment": "Live"
67+
}
68+
},
69+
"parAutomationAccountTags": {
70+
"value": {
71+
"Environment": "Live"
72+
}
6273
},
6374
"parLogAnalyticsLinkedServiceAutomationAccountName": {
6475
"value": "Automation"
@@ -84,25 +95,31 @@
8495
"notes": "This lock was created by the ALZ Bicep Logging Module."
8596
}
8697
},
87-
"parLogAnalyticsWorkspaceSolutionsLock": {
98+
"parDataCollectionRuleVMInsightsLock": {
8899
"value": {
89100
"kind": "None",
90101
"notes": "This lock was created by the ALZ Bicep Logging Module."
91102
}
92103
},
93-
"parDataCollectionRuleVMInsightsLock": {
104+
"parDataCollectionRuleChangeTrackingLock": {
94105
"value": {
95106
"kind": "None",
96107
"notes": "This lock was created by the ALZ Bicep Logging Module."
97108
}
98109
},
99-
"parDataCollectionRuleChangeTrackingLock": {
110+
"parDataCollectionRuleMDFCSQLLock": {
100111
"value": {
101112
"kind": "None",
102113
"notes": "This lock was created by the ALZ Bicep Logging Module."
103114
}
104115
},
105-
"parDataCollectionRuleMDFCSQLLock": {
116+
"parSecurityInsightsOnboardingLock": {
117+
"value": {
118+
"kind": "None",
119+
"notes": "This lock was created by the ALZ Bicep Logging Module."
120+
}
121+
},
122+
"parChangeTrackingSolutionLock": {
106123
"value": {
107124
"kind": "None",
108125
"notes": "This lock was created by the ALZ Bicep Logging Module."

Diff for: ‎infra-as-code/bicep/modules/logging/parameters/logging.parameters.min.json

+7-9
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,17 @@
22
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
33
"contentVersion": "1.0.0.0",
44
"parameters": {
5-
"parLogAnalyticsWorkspaceLogRetentionInDays": {
6-
"value": 365
7-
},
85
"parLogAnalyticsWorkspaceLocation": {
96
"value": "eastus"
107
},
11-
"parLogAnalyticsWorkspaceSolutions": {
12-
"value": [
13-
"SecurityInsights"
14-
]
8+
"parLogAnalyticsWorkspaceLogRetentionInDays": {
9+
"value": 365
10+
},
11+
"parUserAssignedManagedIdentityName": {
12+
"value": "alz-umi-identity"
1513
},
16-
"parAutomationAccountLocation": {
17-
"value": "eastus2"
14+
"parUserAssignedManagedIdentityLocation": {
15+
"value": "eastus"
1816
},
1917
"parTelemetryOptOut": {
2018
"value": false

0 commit comments

Comments
 (0)