ARM Templates
The Microsoft Sentinel Data Collection Rules (DCR) templates in Director offer standardized monitoring configurations. They were designed to streamline the data ingestion while maintaining consistent data structures and optimal performance.
These templates do not deploy as printed. streamDeclarations is left empty, but every entry in dataFlows names a Custom-* stream. Azure rejects a data collection rule whose data flow references a stream the rule does not declare, so the deployment fails validation before anything is created.
Fill streamDeclarations in with one declaration — name and column list — per Custom-* stream the data flows use. Contact VirtualMetric Support for the stream names and schemas that match your Director's output; they depend on which tables you route and cannot be derived from this page.
Description
Azure Resource Manager (ARM) is the deployment and management service for Azure. It provides a consistent management layer that enables you to create, update, and delete resources in your Azure subscription.
The ARM templates are JSON files that define the infrastructure and configuration of your Azure solution, allowing you to manage your resources declaratively. They can be validated before deployment, allowing for automated and consistent deployments. The dependencies between resources can be defined explicitly, and access control can be integrated with Azure Active Directory. They also have tagging for resource organization.
Here's a typical example:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"storageAccountName": {
"type": "string",
"metadata": {
"description": "Name of the storage account"
}
}
},
"resources": [
{
"type": "Microsoft.Storage/storageAccounts",
"apiVersion": "2021-09-01",
"name": "[parameters('storageAccountName')]",
"location": "[resourceGroup().location]",
"sku": {
"name": "Standard_LRS"
},
"kind": "StorageV2"
}
]
}
The ARM templates enable Infrastructure as Code (IaC) for Azure resources, allowing you to version, maintain, and automate your Azure infrastructure deployments. While more verbose than Bicep, ARM templates remain the underlying format that Azure uses for resource deployments, and Bicep templates are ultimately converted to ARM templates during deployment.
Director offers two distinct template types to accommodate different logging requirements and data models.
Standard Version
These follow Microsoft Sentinel's native table schema, enabling direct integration with built-in analytics, workbooks, and hunting queries. They maintain the original data structure while ensuring compatibility with Sentinel's standard monitoring capabilities.
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"dataCollectionRuleName": {
"type": "string",
"metadata": {
"description": "Specifies the name of the Data Collection Rule to create."
}
},
"location": {
"defaultValue": "[resourceGroup().location]",
"type": "string",
"metadata": {
"description": "Specifies the location in which to create the Data Collection Rule."
}
},
"workspaceResourceId": {
"type": "string",
"metadata": {
"description": "Specifies the Azure resource ID of the Log Analytics workspace to use."
}
},
"endpointResourceId": {
"type": "string",
"metadata": {
"description": "Specifies the Azure resource ID of the Data Collection Endpoint to use."
}
}
},
"variables": {},
"resources": [
{
"type": "Microsoft.Insights/dataCollectionRules",
"apiVersion": "2023-03-11",
"name": "[parameters('dataCollectionRuleName')]",
"location": "[parameters('location')]",
"properties": {
"description": "10.0.0",
"dataCollectionEndpointId": "[parameters('endpointResourceId')]",
"streamDeclarations": {},
"destinations": {
"logAnalytics": [
{
"workspaceResourceId": "[parameters('workspaceResourceId')]",
"name": "vmetric-datastream"
}
]
},
"dataFlows": [
{
"streams": [
"Custom-CommonSecurityLog"
],
"destinations": [
"vmetric-datastream"
],
"transformKql": "source",
"outputStream": "Microsoft-CommonSecurityLog"
},
{
"streams": [
"Custom-SecurityEvent"
],
"destinations": [
"vmetric-datastream"
],
"transformKql": "source",
"outputStream": "Microsoft-SecurityEvent"
},
{
"streams": [
"Custom-Event"
],
"destinations": [
"vmetric-datastream"
],
"transformKql": "source",
"outputStream": "Microsoft-Event"
},
{
"streams": [
"Custom-Syslog"
],
"destinations": [
"vmetric-datastream"
],
"transformKql": "source",
"outputStream": "Microsoft-Syslog"
},
{
"streams": [
"Custom-WindowsEvent"
],
"destinations": [
"vmetric-datastream"
],
"transformKql": "source",
"outputStream": "Microsoft-WindowsEvent"
}
]
}
}
]
}
ASIM Version
The Advanced Security Information Model (ASIM) templates align with Microsoft's ASIM framework, providing normalized and enriched data schemas that facilitate cross-source correlation and advanced security analytics. ASIM templates standardize security events across different data sources, making it easier to develop and maintain detection rules and investigation workflows.
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"dataCollectionRuleName": {
"type": "string",
"metadata": {
"description": "Specifies the name of the Data Collection Rule to create."
}
},
"location": {
"defaultValue": "[resourceGroup().location]",
"type": "string",
"metadata": {
"description": "Specifies the location in which to create the Data Collection Rule."
}
},
"workspaceResourceId": {
"type": "string",
"metadata": {
"description": "Specifies the Azure resource ID of the Log Analytics workspace to use."
}
},
"endpointResourceId": {
"type": "string",
"metadata": {
"description": "Specifies the Azure resource ID of the Data Collection Endpoint to use."
}
}
},
"variables": {},
"resources": [
{
"type": "Microsoft.Insights/dataCollectionRules",
"apiVersion": "2023-03-11",
"name": "[parameters('dataCollectionRuleName')]",
"location": "[parameters('location')]",
"properties": {
"description": "10.0.0",
"dataCollectionEndpointId": "[parameters('endpointResourceId')]",
"streamDeclarations": {},
"destinations": {
"logAnalytics": [
{
"workspaceResourceId": "[parameters('workspaceResourceId')]",
"name": "vmetric-datastream"
}
]
},
"dataFlows": [
{
"streams": [
"Custom-ASimAuditEventLogs"
],
"destinations": [
"vmetric-datastream"
],
"transformKql": "source",
"outputStream": "Microsoft-ASimAuditEventLogs"
},
{
"streams": [
"Custom-ASimAuthenticationEventLogs"
],
"destinations": [
"vmetric-datastream"
],
"transformKql": "source",
"outputStream": "Microsoft-ASimAuthenticationEventLogs"
},
{
"streams": [
"Custom-ASimDhcpEventLogs"
],
"destinations": [
"vmetric-datastream"
],
"transformKql": "source",
"outputStream": "Microsoft-ASimDhcpEventLogs"
},
{
"streams": [
"Custom-ASimDnsActivityLogs"
],
"destinations": [
"vmetric-datastream"
],
"transformKql": "source",
"outputStream": "Microsoft-ASimDnsActivityLogs"
},
{
"streams": [
"Custom-ASimNetworkSessionLogs"
],
"destinations": [
"vmetric-datastream"
],
"transformKql": "source",
"outputStream": "Microsoft-ASimNetworkSessionLogs"
},
{
"streams": [
"Custom-ASimFileEventLogs"
],
"destinations": [
"vmetric-datastream"
],
"transformKql": "source",
"outputStream": "Microsoft-ASimFileEventLogs"
},
{
"streams": [
"Custom-ASimProcessEventLogs"
],
"destinations": [
"vmetric-datastream"
],
"transformKql": "source",
"outputStream": "Microsoft-ASimProcessEventLogs"
},
{
"streams": [
"Custom-ASimRegistryEventLogs"
],
"destinations": [
"vmetric-datastream"
],
"transformKql": "source",
"outputStream": "Microsoft-ASimRegistryEventLogs"
},
{
"streams": [
"Custom-ASimUserManagementActivityLogs"
],
"destinations": [
"vmetric-datastream"
],
"transformKql": "source",
"outputStream": "Microsoft-ASimUserManagementActivityLogs"
},
{
"streams": [
"Custom-ASimWebSessionLogs"
],
"destinations": [
"vmetric-datastream"
],
"transformKql": "source",
"outputStream": "Microsoft-ASimWebSessionLogs"
}
]
}
}
]
}
Both template types are preconfigured to handle VirtualMetric's monitoring data while adhering to Microsoft Sentinel's best practices for data collection and processing.