Azure / Azure/Azure-Verified-Modules

[Module Proposal]: `avm-ptn-sentinel-solutions`

Open
#760 8 comments 0 reactions 0 assignees View on GitHub
Class: Pattern Module :package: Language: Terraform :globe_with_meridians: Needs: Module Owner :mega: Status: External Contribution :earth_africa:
Dominant language
PowerShell
Stars
580
Forks
161
Avg merge
11h 3m
Merged PRs (30d)
15

Description

### Check for previous/existing GitHub issues/module proposals

- [X] I have checked for previous/existing GitHub issues/module proposals.

### Check this module doesn't already exist in the module indexes

- [X] I have checked for that this module doesn't already exist in the module indexes; or I'm proposing the module to be migrated from CARML/TFVM.

### Bicep or Terraform?

Terraform

### Module Classification?

Pattern Module

### Module Name

avm-ptn-sentinel-solutions

### Module Details

The goals of this module is to propose a simple way to deploy Sentinel community solutions hosted on github

![image](https://github.com/Azure/Azure-Verified-Modules/assets/4702224/f9bd070f-763c-4943-95ff-717286822956)

The proposed module will map the artefacts hosted into https://github.com/Azure/Azure-Sentinel/tree/master/Solutions

The goal is to propose a simple way to use those solutions by providing a map of the solutions to deploy in the workspace

```hcl
solutions = {
"Azure Activity" = {
// Custom solution parameters
}
"Azure DDos Protection" = {}
...
}
```

The module will then map the yaml and json into native azurerm or azapi calls.
![image](https://github.com/Azure/Azure-Verified-Modules/assets/4702224/f71677a2-f66f-46a1-805c-e2a987095bcf)

Mapping identified so far
```
entry point (matadata and files to parse):
-> Data/Solution_*.json

hunting rules
-> azurerm/sentinel_alert_nrt
-> azurerm/sentinel_metadata

data connectors
-> azapi/Microsoft.SecurityInsights/dataConnectors@2023-02-01-preview
-> azurerm/sentinel_metadata

Analytic Rules
-> kind = Scheduled
-> azurerm/sentinel_alert_rule_scheduled

-> kind = NRT
-> azurerm/sentinel_alert_rule_nrt
```

### Do you want to be the owner of this module?

Yes

### Module Owner's GitHub Username (handle)

LaurentLesle

### (Optional) Secondary Module Owner's GitHub Username (handle)

_No response_

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.