Skip to content

workdayemailactivity #15507

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Bhagya Lakshmi Kukula (Bhagya767) wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

workdayemailactivity #15507

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
66 changes: 66 additions & 0 deletions Solutions/Workday_Email_CCF/DataConnectionRules.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
[
{
"name": "workdayEmailDCR",
"apiVersion": "2021-09-01-preview",
"type": "Microsoft.Insights/dataCollectionRules",
"location": "{{location}}",
"properties": {
"streamDeclarations": {
"Custom-ASimAuditEventLogs": {
"columns": [
{
"name": "DateTimeStamp",
"type": "string"
},
{
"name": "EmailIDAfter",
"type": "string"
},
{
"name": "EmailIDBefore",
"type": "string"
},
{
"name": "Employee_ID",
"type": "string"
},
{
"name": "Login_ID",
"type": "string"
},
{
"name": "TargetID",
"type": "string"
},
{
"name": "Worker",
"type": "string"
}
]
}
},
"dataSources": {},
"destinations": {
"logAnalytics": [
{
"workspaceResourceId": "{{workspaceResourceId}}",
"name": "clv2ws1"
}
]
},
"dataFlows": [
{
"streams": [
"Custom-ASimAuditEventLogs"
],
"destinations": [
"clv2ws1"
],
"transformKql": "source\n| extend TimeGenerated = todatetime(DateTimeStamp), EventStartTime = todatetime(DateTimeStamp), EventEndTime = todatetime(DateTimeStamp)\n| project-rename OldValue = EmailIDBefore, NewValue = EmailIDAfter, ActorUserId = Employee_ID, ActorUsername = Login_ID, EventOriginalUid = TargetID, Object = Worker\n| extend EventCount = toint(1), EventSchema = \"AuditEvent\", EventResult = \"Success\", EventProduct = \"Workday\", EventVendor = \"Workday\", EventSchemaVersion = \"0.1\", ObjectType = \"Other\", EventType = \"Set\", Operation = \"Email Activity\", Dvc = \"Workday\"",
"outputStream": "Microsoft-ASimAuditEventLogs"
}
],
"dataCollectionEndpointId": "[concat('/subscriptions/',variables('subscriptionID'),'/resourceGroups/',resourceGroup().name,'/providers/Microsoft.Insights/dataCollectionEndpoints/',{{dataCollectionEndpointId}}"
}
}
]
108 changes: 108 additions & 0 deletions Solutions/Workday_Email_CCF/DataConnectorDefination.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,108 @@
{
"name": "WorkdayEmailCCPDefinition",
"apiVersion": "2022-09-01-preview",
"type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
"location": "{{location}}",
"kind": "Customizable",
"properties": {
"connectorUiConfig": {
"id": "WorkdayEmailCCPDefinition",
"title": "Workday Email Activity",
"publisher": "Microsoft",
"descriptionMarkdown": "The [Workday](https://www.workday.com/) Email Activity data connector provides the capability to ingest Email Activity reports from [Workday Custom Reports API](https://community.workday.com/sites/default/files/file-hosting/restapi/index.html) into Microsoft Sentinel.",
"graphQueriesTableName": "ASimAuditEventLogs",
"graphQueries": [
{
"metricName": "Total data received",
"legend": "Workday Email Activity logs",
"baseQuery": "{{graphQueriesTableName}}\n| where EventProduct == \"Workday\" and Operation == \"Email Activity\""
}
],
"sampleQueries": [
{
"description": "Get a sample of Workday Email Activity logs",
"query": "{{graphQueriesTableName}}\n | where EventProduct == \"Workday\" and Operation == \"Email Activity\" | take 10"
}
],
"dataTypes": [
{
"name": "{{graphQueriesTableName}}",
"lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where EventProduct == \"Workday\" and Operation == \"Email Activity\" |summarize Time = max (TimeGenerated)\n|where isnotempty(Time)"
}
],
"availability": {
"isPreview": false
},
"connectivityCriteria": [
{
"type": "HasDataConnectors"
}
],
"permissions": {
"resourceProvider": [
{
"provider": "Microsoft.OperationalInsights/workspaces",
"permissionsDisplayText": "Read and Write permissions are required.",
"providerDisplayName": "Workspace",
"scope": "Workspace",
"requiredPermissions": {
"write": true,
"read": true,
"delete": true
}
}
],
"customs": [
{
"name": "Workday Custom Report API access",
"description": "Access to the Workday Custom Report API through OAuth is required. The API Client needs access to the ISU_MS_Sentinel integration system user and the CR_Sentinel_Email_ID_Change custom report."
}
]
},
"instructionSteps": [
{
"description": "1) In Workday, access the \"Edit Tenant Setup - Security\" task, verify \"OAuth 2.0 Settings\" section, make sure that the \"OAuth 2.0 Clients Enabled\" check box is ticked. \n 2) Access the \"Register API Client\" task.\n 3) Define the Client Name, select the \"Client Grant Type\": \"Authorization Code Grant\" and then select \"Access Token Type\": \"Bearer\"\n 4) Enter the \"Redirection URI\" found in the form below \n 5) In section \"Scope (Functional Areas)\", select the appropriate scope for the custom report and click OK at the bottom \n 6) Copy the Client ID and Client Secret before navigating away from the page, and store it securely. \n 7) In Sentinel, in the connector page - provide required Token, Authorization and Email Activity Report Endpoints, along with Client ID and Client Secret from previous step. Then click \"Connect\". \n",
"instructions": [
{
"type": "Textbox",
"parameters": {
"label": "Token Endpoint",
"placeholder": "https://wd3-impl-services1.workday.com/ccx/oauth2/stellantis1/token",
"type": "text",
"name": "tokenEndpoint"
}
},
{
"type": "Textbox",
"parameters": {
"label": "Authorization Endpoint",
"placeholder": "https://wd3-impl.workday.com/stellantis1/authorize?redirect=n",
"type": "text",
"name": "authorizationEndpoint"
}
},
{
"type": "Textbox",
"parameters": {
"label": "Email Activity Report Endpoint",
"placeholder": "https://wd3-impl-services1.workday.com/ccx/service/customreport2/stellantis1/ISU_MS_Sentinel/CR_Sentinel_Email_ID_Change?format=json",
"type": "text",
"name": "apiEndpoint"
}
},
{
"type": "OAuthForm",
"parameters": {
"clientIdLabel": "MDMyMTA4YTEtMTliZC00NmVmLTg2MjEtNTIzNmYyZDQ0YzQz",
"clientSecretLabel": "12b8tuixrlokjvgzvvp8stwr4kgz5bmpo93gnypglnfe2zyo3qv8hln1c1c7nhrdvzuja0ihqzfa7ep7y7587xpsd6txugrsib50",
"connectButtonLabel": "Connect",
"disconnectButtonLabel": "Disconnect"
}
}
],
"title": "Connect to Workday to start collecting Email Activity logs in Microsoft Sentinel"
}
]
}
}
}
Loading
Loading