Migrated Dynatrace Solution to use DCR

Solutions/Dynatrace/Data Connectors/Connector_Dynatrace_Attacks.json

@@ -29,7 +29,7 @@
             "properties": {
                 "connectorUiConfig": {
                     "id": "DynatraceAttacks",
-                    "title": "Dynatrace Attacks",
+                    "title": "Dynatrace Attacks V1",
                     "publisher": "Dynatrace",
                     "descriptionMarkdown": "This connector uses the Dynatrace Attacks REST API to ingest detected attacks into Microsoft Sentinel Log Analytics",
                     "additionalRequirementBanner": "This data connector depends on a parser based on Kusto Function to work as expected which is deployed with the Microsoft Sentinel Solution.",
@@ -71,7 +71,7 @@
                     ],
                     "availability": {
                         "status": 1,
-                        "isPreview": true
+                        "isPreview": false
                     },
                     "permissions": {
                         "resourceProvider": [
@@ -142,7 +142,7 @@
                         "endTimeAttributeName": "to",
                         "headers": {
                             "Accept": "application/json",
-                            "User-Agent" : "dynatrace-microsoft-sentinel/3.x/connectors/attacks"
+                            "User-Agent" : "dynatrace-microsoft-sentinel/3.0.2/connectors/attacks"
                         },
                         "queryParameters": {
                             "fields": "+attacker,+request,+entrypoint,+vulnerability,+managementZones"

Solutions/Dynatrace/Data Connectors/Connector_Dynatrace_Attacks_DCR.json

@@ -0,0 +1,87 @@
+{
+    "name": "DTAttacksV2DCR",
+    "apiVersion": "2021-09-01-preview",
+    "type": "Microsoft.Insights/dataCollectionRules",
+    "location": "{{location}}",
+    "properties": {
+        "streamDeclarations": {
+            "Custom-DynatraceAttacksV2": {
+                "columns": [
+                    {
+                        "name": "timestamp",
+                        "type": "long"
+                    },
+                    {
+                        "name": "attackId",
+                        "type": "string"
+                    },
+                    {
+                        "name": "displayId",
+                        "type": "string"
+                    },
+                    {
+                        "name": "displayName",
+                        "type": "string"
+                    },
+                    {
+                        "name": "attackType",
+                        "type": "string"
+                    },
+                    {
+                        "name": "technology",
+                        "type": "string"
+                    },
+                    {
+                        "name": "state",
+                        "type": "string"
+                    },
+                    {
+                        "name": "affectedEntities",
+                        "type": "dynamic"
+                    },
+                    {
+                        "name": "request",
+                        "type": "dynamic"
+                    },
+                    {
+                        "name": "entrypoint",
+                        "type": "dynamic"
+                    },
+                    {
+                        "name": "vulnerability",
+                        "type": "dynamic"
+                    },
+                    {
+                        "name": "attacker",
+                        "type": "dynamic"
+                    },
+                    {
+                        "name": "managementZones",
+                        "type": "dynamic"
+                    }
+                ]
+            }
+        },
+        "destinations": {
+            "logAnalytics": [
+                {
+                    "workspaceResourceId": "{{workspaceResourceId}}",
+                    "name": "clv2ws1"
+                }
+            ]
+        },
+        "dataFlows": [
+            {
+                "streams": [
+                    "Custom-DynatraceAttacksV2"
+                ],
+                "destinations": [
+                    "clv2ws1"
+                ],
+                "transformKql": "let fromUnixTime = (t: long) {\ndatetime(1970-01-01) + t * 1ms\n};\nsource | extend TimeGenerated = fromUnixTime(timestamp) | project-away timestamp",
+                "outputStream": "Custom-DynatraceAttacksV2_CL"
+            }
+        ],
+        "dataCollectionEndpointId": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]"
+    }
+}

Solutions/Dynatrace/Data Connectors/Connector_Dynatrace_Attacks_Definition.json

@@ -0,0 +1,118 @@
+{
+    "name": "DynatraceAttacksCCPDefinition",
+    "apiVersion": "2022-09-01-preview",
+    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
+    "location": "{{location}}",
+    "kind": "Customizable",
+    "properties": {
+        "connectorUiConfig": {
+            "id": "DynatraceAttacksCCPDefinition",
+            "title": "Dynatrace Attacks V2",
+            "publisher": "Dynatrace",
+            "descriptionMarkdown": "This connector uses the Dynatrace Attacks REST API to ingest detected attacks into Microsoft Sentinel Log Analytics",
+            "additionalRequirementBanner": "This data connector depends on a parser based on Kusto Function to work as expected which is deployed with the Microsoft Sentinel Solution.",
+            "graphQueriesTableName": "DynatraceAttacksV2_CL",
+            "graphQueries": [
+                {
+                    "metricName": "Total data received",
+                    "legend": "Dynatrace Attack Events",
+                    "baseQuery": "{{graphQueriesTableName}}"
+                }
+            ],
+            "sampleQueries": [
+                {
+                    "description": "All Attack Events",
+                    "query": "DynatraceAttacks\n| summarize  arg_max(TimeStamp, *) by AttackId\n|  take 10"
+                },
+                {
+                    "description": "All Exploited Attack Events",
+                    "query": "DynatraceAttacks\n| where State == \"EXPLOITED\"\n| summarize  arg_max(TimeStamp, *) by AttackId\n|  take 10"
+                },
+                {
+                    "description": "Count Attacks by Type",
+                    "query": "DynatraceAttacks\n| summarize  arg_max(TimeStamp, *) by AttackId\n| summarize count() by AttackType\n| take 10"
+                }
+            ],
+            "dataTypes": [
+                {
+                    "name": "{{graphQueriesTableName}}",
+                    "lastDataReceivedQuery": "{{graphQueriesTableName}}\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
+                }
+            ],
+            "connectivityCriteria": [
+                {
+                    "type": "HasDataConnectors",
+                    "value": null
+                }
+            ],
+            "availability": {
+                "status": 1,
+                "isPreview": true
+            },
+            "permissions": {
+                "resourceProvider": [
+                    {
+                        "provider": "Microsoft.OperationalInsights/workspaces",
+                        "permissionsDisplayText": "read and write permissions are required.",
+                        "providerDisplayName": "Workspace",
+                        "scope": "Workspace",
+                        "requiredPermissions": {
+                            "write": true,
+                            "read": true,
+                            "delete": true
+                        }
+                    }
+                ],
+                "customs": [
+                    {
+                        "name": "Dynatrace tenant (ex. xyz.dynatrace.com)",
+                        "description": "You need a valid Dynatrace tenant with [Application Security](https://www.dynatrace.com/platform/application-security/) enabled, learn more about the [Dynatrace platform](https://www.dynatrace.com/)."
+                    },
+                    {
+                        "name": "Dynatrace Access Token",
+                        "description": "You need a Dynatrace Access Token, the token should have ***Read attacks*** (attacks.read) scope."
+                    }
+                ]
+            },
+            "instructionSteps": [
+                {
+                    "title": "Dynatrace Attack Events to Microsoft Sentinel",
+                    "description": "Configure and Enable Dynatrace [Application Security](https://www.dynatrace.com/platform/application-security/). \n Follow [these instructions](https://docs.dynatrace.com/docs/shortlink/token#create-api-token) to generate an access token.",
+                    "instructions": [
+                        {
+                            "parameters": {
+                                "enable": "true",
+                                "type": "text",
+                                "label": "Dynatrace tenant (ex. xyz.dynatrace.com)",
+                                "placeholder": "{{dynatraceEnvironmentUrl}}",
+                                "name": "dynatraceEnvironmentUrl"
+                            },
+                            "type": "Textbox"
+                        },
+                        {
+                            "parameters": {
+                                "enable": "true",
+                                "type": "password",
+                                "label": "Dynatrace Access Token",
+                                "placeholder": "{{dynatraceAccessToken}}",
+                                "name": "dynatraceAccessToken"
+                            },
+                            "type": "Textbox"
+                        },
+                        {
+                            "type": "ConnectionToggleButton",
+                            "parameters": {
+                                "connectLabel": "connect",
+                                "name": "toggle"
+                            }
+                        }
+                    ]
+                }
+            ],
+            "metadata": {
+                "version": "1.0.2",
+                "kind": "dataConnector"
+            }
+        }
+    }
+}

Solutions/Dynatrace/Data Connectors/Connector_Dynatrace_Attacks_Polling_Config.json

@@ -0,0 +1,52 @@
+{
+    "type": "Microsoft.SecurityInsights/dataConnectors",
+    "apiVersion": "2021-10-01-preview",
+    "name": "DynatraceAttacksV2",
+    "location": "{{location}}",
+    "kind": "RestApiPoller",
+    "properties": {
+        "connectorDefinitionName": "DynatraceAttacksCCPDefinition",
+        "dataType": "DynatraceAttacksV2_CL",
+        "auth": {
+            "type": "APIKey",
+            "ApiKey": "[[parameters('dynatraceAccessToken')]",
+            "APIKeyIdentifier": "Api-Token",
+            "APIKeyName": "Authorization"
+        },
+        "request": {
+            "apiEndpoint": "[[concat('https://',parameters('dynatraceEnvironmentUrl'),'/api/v2/attacks')]",
+            "httpMethod": "Get",
+            "rateLimitQPS": 2,
+            "retryCount": 3,
+            "timeoutInSeconds": 120,
+            "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
+            "queryWindowInMin": 5,
+            "startTimeAttributeName": "from",
+            "endTimeAttributeName": "to",
+            "headers": {
+                "Accept": "application/json",
+                "User-Agent": "dynatrace-microsoft-sentinel/3.0.2/connectors/attacks"
+            },
+            "queryParameters": {
+                "fields": "+attacker,+request,+entrypoint,+vulnerability,+managementZones"
+            }
+        },
+        "response": {
+            "eventsJsonPaths": [
+                "$.attacks"
+            ],
+            "convertChildPropertiesToArray": true
+        },
+        "dcrConfig": {
+            "streamName": "Custom-DynatraceAttacksV2",
+            "dataCollectionEndpoint": "{{dataCollectionEndpoint}}",
+            "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}"
+        },
+        "paging": {
+            "pagingType": "NextPageToken",
+            "pagingQueryParamOnly": true,
+            "nextPageTokenJsonPath": "$.nextPageKey",
+            "nextPageParaName": "nextPageKey"
+        }
+    }
+}

Solutions/Dynatrace/Data Connectors/Connector_Dynatrace_Attacks_table.json

@@ -0,0 +1,65 @@
+{
+    "name": "DynatraceAttacksV2_CL",
+    "apiVersion": "2021-03-01-privatepreview",
+    "type": "Microsoft.OperationalInsights/workspaces/tables",
+    "location": "{{location}}",
+    "properties": {
+        "schema": {
+            "name": "DynatraceAttacksV2_CL",
+            "columns": [
+                {
+                    "name": "TimeGenerated",
+                    "type": "datetime"
+                },
+                {
+                    "name": "attackId",
+                    "type": "string"
+                },
+                {
+                    "name": "displayId",
+                    "type": "string"
+                },
+                {
+                    "name": "displayName",
+                    "type": "string"
+                },
+                {
+                    "name": "attackType",
+                    "type": "string"
+                },
+                {
+                    "name": "technology",
+                    "type": "string"
+                },
+                {
+                    "name": "state",
+                    "type": "string"
+                },
+                {
+                    "name": "affectedEntities",
+                    "type": "dynamic"
+                },
+                {
+                    "name": "request",
+                    "type": "dynamic"
+                },
+                {
+                    "name": "entrypoint",
+                    "type": "dynamic"
+                },
+                {
+                    "name": "vulnerability",
+                    "type": "dynamic"
+                },
+                {
+                    "name": "attacker",
+                    "type": "dynamic"
+                },
+                {
+                    "name": "managementZones",
+                    "type": "dynamic"
+                }
+            ]
+        }
+    }
+}

Solutions/Dynatrace/Data Connectors/Connector_Dynatrace_AuditLogs.json

@@ -29,7 +29,7 @@
             "properties": {
                 "connectorUiConfig": {
                     "id" : "DynatraceAuditLogs",
-                    "title": "Dynatrace Audit Logs",
+                    "title": "Dynatrace Audit Logs V1",
                     "publisher": "Dynatrace",
                     "descriptionMarkdown": "This connector uses the [Dynatrace Audit Logs REST API](https://docs.dynatrace.com/docs/dynatrace-api/environment-api/audit-logs) to ingest tenant audit logs into Microsoft Sentinel Log Analytics",
                     "additionalRequirementBanner": "This data connector depends on a parser based on Kusto Function to work as expected which is deployed with the Microsoft Sentinel Solution.",
@@ -71,7 +71,7 @@
                     ],
                     "availability": {
                         "status": 1,
-                        "isPreview": true
+                        "isPreview": false
                     },
                     "permissions": {
                         "resourceProvider": [
@@ -142,7 +142,7 @@
                         "endTimeAttributeName": "to",
                         "headers": {
                             "Accept": "application/json",
-                            "User-Agent" : "dynatrace-microsoft-sentinel/3.x/connectors/auditlogs"
+                            "User-Agent" : "dynatrace-microsoft-sentinel/3.0.2/connectors/auditlogs"
                         }
                     },
                     "paging": {