Bicep Templates

Bicep templates provide an alternative Infrastructure as Code (IaC) format for deploying Microsoft Sentinel Data Collection Rules (DCR). Director generates ARM (JSON) templates; the Bicep equivalents on this page are reference templates for teams that prefer Bicep authoring.

Description

Bicep is Microsoft Azure's domain-specific language (DSL) for deploying Azure resources. It provides a more concise and readable syntax compared to ARM (Azure Resource Manager) templates, while maintaining full compatibility with Azure: Bicep files are automatically transpiled into ARM templates during deployment.

Bicep templates also offer type safety and enhanced validation at authoring time, modularity through composition, and IntelliSense in Visual Studio Code.

Here's a typical example:

param location string = 'eastus'
param storageName string

resource storageAccount 'Microsoft.Storage/storageAccounts@2021-09-01' = {
  name: storageName
  location: location
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'StorageV2'
}

For comparison, here is an equivalent ARM template:

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "location": {
      "type": "string",
      "defaultValue": "eastus"
    },
    "storageName": {
      "type": "string"
    }
  },
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2021-09-01",
      "name": "[parameters('storageName')]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "Standard_LRS"
      },
      "kind": "StorageV2"
    }
  ]
}

Bicep simplifies the process of managing Azure infrastructure as code, making it easier to maintain and version control your resource configurations.

The following reference templates cover the same two DCR configurations as the ARM templates.

Standard Version

These generate DCRs that align with Microsoft Sentinel's native table schema. They include predefined parameters and variables for customizing data collection settings while maintaining compatibility with Sentinel's built-in analytics and workbooks. The templates are designed to facilitate integration with your existing Sentinel deployments.

@description('The location of the resources')
param location string 

@description('The name of the Data Collection Endpoint Id')
param dataCollectionEndpointId string

@description('The Log Analytics Workspace Id used for Sentinel')
param workspaceResourceId string

resource dataCollectionRule 'Microsoft.Insights/dataCollectionRules@2022-06-01' = {
  name: 'vmetric-dcr'
  location: location
  properties: {
    dataCollectionEndpointId: dataCollectionEndpointId
    streamDeclarations: {
        // Contact with VirtualMetric Support to get the stream names
    }
    destinations: {
      logAnalytics: [
        {
          workspaceResourceId: workspaceResourceId
          name: 'vmetric-datastream'
        }
      ]
    }
    dataFlows: [
      {
        streams: [
          'Custom-CommonSecurityLog'
        ]
        destinations: [
          'vmetric-datastream'
        ]
        transformKql: 'source'
        outputStream: 'Microsoft-CommonSecurityLog'
      }
      {
        streams: [
          'Custom-SecurityEvent'
        ]
        destinations: [
          'vmetric-datastream'
        ]
        transformKql: 'source'
        outputStream: 'Microsoft-SecurityEvent'
      }
      {
        streams: [
          'Custom-Syslog'
        ]
        destinations: [
          'vmetric-datastream'
        ]
        transformKql: 'source'
        outputStream: 'Microsoft-Syslog'
      }
      {
        streams: [
          'Custom-WindowsEvent'
        ]
        destinations: [
          'vmetric-datastream'
        ]
        transformKql: 'source'
        outputStream: 'Microsoft-WindowsEvent'
      }
    ]
  }
}

output immutableId string = dataCollectionRule.properties.immutableId

ASIM Version

These create DCRs that implement the Advanced Security Information Model (ASIM) schema. They include specific parsers and transformations required for normalizing VirtualMetric data into ASIM-compliant formats. They ensure your security data is standardized across different sources, enhancing threat detection and investigation.

@description('The location of the resources')
param location string 

@description('The name of the Data Collection Endpoint Id')
param dataCollectionEndpointId string

@description('The Log Analytics Workspace Id used for Sentinel')
param workspaceResourceId string

resource dataCollectionRule 'Microsoft.Insights/dataCollectionRules@2022-06-01' = {
  name: 'vmetric-dcr'
  location: location
  properties: {
    dataCollectionEndpointId: dataCollectionEndpointId
    streamDeclarations: {
        // Contact with VirtualMetric Support to get the stream names
    }
    destinations: {
      logAnalytics: [
        {
          workspaceResourceId: workspaceResourceId
          name: 'vmetric-datastream'
        }
      ]
    }
    dataFlows: [
      {
        streams: [
          'Custom-ASimAuditEventLogs'
        ]
        destinations: [
          'vmetric-datastream'
        ]
        transformKql: 'source'
        outputStream: 'Microsoft-ASimAuditEventLogs'
      }
      {
        streams: [
          'Custom-ASimAuthenticationEventLogs'
        ]
        destinations: [
          'vmetric-datastream'
        ]
        transformKql: 'source'
        outputStream: 'Microsoft-ASimAuthenticationEventLogs'
      }
      {
        streams: [
          'Custom-ASimDhcpEventLogs'
        ]
        destinations: [
          'vmetric-datastream'
        ]
        transformKql: 'source'
        outputStream: 'Microsoft-ASimDhcpEventLogs'
      }
      {
        streams: [
          'Custom-ASimDnsActivityLogs'
        ]
        destinations: [
          'vmetric-datastream'
        ]
        transformKql: 'source'
        outputStream: 'Microsoft-ASimDnsActivityLogs'
      }
      {
        streams: [
          'Custom-ASimNetworkSessionLogs'
        ]
        destinations: [
          'vmetric-datastream'
        ]
        transformKql: 'source'
        outputStream: 'Microsoft-ASimNetworkSessionLogs'
      }
      {
        streams: [
          'Custom-ASimFileEventLogs'
        ]
        destinations: [
          'vmetric-datastream'
        ]
        transformKql: 'source'
        outputStream: 'Microsoft-ASimFileEventLogs'
      }
      {
        streams: [
          'Custom-ASimProcessEventLogs'
        ]
        destinations: [
          'vmetric-datastream'
        ]
        transformKql: 'source'
        outputStream: 'Microsoft-ASimProcessEventLogs'
      }
      {
        streams: [
          'Custom-ASimRegistryEventLogs'
        ]
        destinations: [
          'vmetric-datastream'
        ]
        transformKql: 'source'
        outputStream: 'Microsoft-ASimRegistryEventLogs'
      }
      {
        streams: [
          'Custom-ASimUserManagementActivityLogs'
        ]
        destinations: [
          'vmetric-datastream'
        ]
        transformKql: 'source'
        outputStream: 'Microsoft-ASimUserManagementActivityLogs'
      }
    ]
  }
}

output immutableId string = dataCollectionRule.properties.immutableId