{
    "properties": {
      "displayName": "Configure machines to automatically create the Azure Security Center pipeline for Azure Monitor Agent",
      "policyType": "BuiltIn",
      "mode": "Indexed",
      "description": "Configure machines to automatically create the Azure Security Center pipeline for Azure Monitor Agent. Security Center collects events from the agent and uses them to provide security alerts and tailored hardening tasks (recommendations). Create a resource group and Log Analytics workspace in the same region as the machine to store audit records. Target virtual machines must be in a supported location.",
      "metadata": {
        "category": "Security Center",
        "version": "1.0.0-preview",
        "preview": true
      },
      "parameters": {
        "effect": {
          "type": "string",
          "defaultValue": "DeployIfNotExists",
          "allowedValues": [
            "DeployIfNotExists",
            "Disabled"
          ],
          "metadata": {
            "displayName": "Effect",
            "description": "Enable or disable the execution of the policy"
          }
        }
      },
      "policyRule": {
        "if": {
            "allOf": [{
                "field": "type",
                "equals": "Microsoft.Compute/virtualMachines"
              },
              {
                  "field": "location",
                  "in": [
                    "australiacentral",
                    "australiaeast",
                    "australiasoutheast",
                    "canadacentral",
                    "centralindia",
                    "centralus",
                    "eastasia",
                    "eastus2euap",
                    "eastus",
                    "eastus2",
                    "francecentral",
                    "germanywestcentral",
                    "japaneast",
                    "koreacentral",
                    "northcentralus",
                    "northeurope",
                    "southafricanorth",
                    "southcentralus",
                    "southeastasia",
                    "switzerlandnorth",
                    "uksouth",
                    "ukwest",
                    "westcentralus",
                    "westeurope",
                    "westus",
                    "westus2"
                  ]
              }
            ]
        },
        "then": {
          "effect": "[parameters('effect')]",
          "details": {
            "type": "Microsoft.Insights/dataCollectionRuleAssociations",
            "name": "Security-RulesAssociation",
            "deploymentScope": "subscription",
            "roleDefinitionIds": [
              "/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
            ],
            "deployment": {
              "location": "eastus",
              "properties": {
                "mode": "incremental",
                "parameters": {
                  "resourceGroup": {
                    "value": "[resourceGroup().name]"
                  },
                  "location": {
                    "value": "[field('location')]"
                  },
                  "vmName": {
                    "value": "[field('name')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "parameters": {
                    "resourceGroup": {
                      "type": "string"
                    },
                    "location": {
                      "type": "string"
                    },
                    "vmName": {
                      "type": "string"
                    }
                  },
                  "variables": {
                    "locationLongNameToShortMap": {
                        "australiacentral": "CAU",
                        "australiaeast": "EAU",
                        "australiasoutheast": "SEAU",
                        "brazilsouth": "CQ",
                        "canadacentral": "CCA",
                        "centralindia": "CIN",
                        "centralus": "CUS",
                        "eastasia": "EA",
                        "eastus2euap": "eus2p",
                        "eastus": "EUS",
                        "eastus2": "EUS2",
                        "francecentral": "PAR",
                        "germanywestcentral": "DEWC",
                        "japaneast": "EJP",
                        "koreacentral": "SE",
                        "northcentralus": "NCUS",
                        "northeurope": "NEU",
                        "norwayeast": "NOE",
                        "southcentralus": "SCUS",
                        "southeastasia": "SEA",
                        "switzerlandnorth": "CHN",
                        "switzerlandwest": "CHW",
                        "southafricanorth": "JNB",
                        "swedencentral": "SEC",
                        "uaenorth": "DXB",
                        "uksouth": "SUK",
                        "ukwest": "WUK",
                        "westcentralus": "WCUS",
                        "westeurope": "WEU",
                        "westus": "WUS",
                        "westus2": "WUS2"
                    },
                    "locationCode": "[variables('locationLongNameToShortMap')[parameters('location')]]",
                    "subscriptionId": "[subscription().subscriptionId]",
                    "defaultRGName": "[concat('DefaultResourceGroup-', variables('locationCode'))]",
                    "defaultRGLocation": "[parameters('location')]",
                    "workspaceName": "[concat('defaultWorkspace-', variables('subscriptionId'),'-', variables('locationCode'))]",
                    "dcrName": "[concat('Microsoft-Security-', variables('locationCode'), '-dcr')]",
                    "dcrId": "[concat('/subscriptions/', variables('subscriptionId'), '/resourceGroups/', variables('defaultRGName'), '/providers/Microsoft.Insights/dataCollectionRules/', variables('dcrName'))]",
                    "dcraName" : "[concat(parameters('vmName'),'/Microsoft.Insights/Security-RulesAssociation')]",
                    "deployDefaultAscResourceGroup": "[concat('deployDefaultAscResourceGroup-', uniqueString(deployment().name))]",
                    "deployDataCollectionRulesAssociation": "[concat('deployDataCollectionRulesAssociation-', uniqueString(deployment().name))]"
                  },
                  "resources": [
                    {
                        "type": "Microsoft.Resources/resourceGroups",
                        "name": "[variables('defaultRGName')]",
                        "apiVersion": "2019-05-01",
                        "location": "[variables('defaultRGLocation')]"
                    },
                    {
                        "type": "Microsoft.Resources/deployments",
                        "name": "[variables('deployDefaultAscResourceGroup')]",
                        "apiVersion": "2020-06-01",
                        "resourceGroup": "[variables('defaultRGName')]",
                        "properties": {
                            "mode": "Incremental",
                            "expressionEvaluationOptions": {
                                "scope": "inner"
                            },
                            "parameters": {
                                "defaultRGLocation": {
                                  "value": "[variables('defaultRGLocation')]"
                                },
                                "workspaceName": {
                                  "value": "[variables('workspaceName')]"
                                },
                                "dcrName": {
                                    "value": "[variables('dcrName')]"
                                }
                            },
                            "template": {
                                "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                                "contentVersion": "1.0.0.0",
                                "parameters": {
                                    "defaultRGLocation": {
                                      "type": "string"
                                    },
                                    "workspaceName": {
                                      "type": "string"
                                    },
                                    "dcrName": {
                                      "type": "string"
                                    }
                                },
                                "variables": {
                                    "securitySolution": {
                                      "Name": "[Concat('Security', '(', parameters('workspaceName'), ')')]",
                                      "GalleryName": "Security"
                                    },
                                    "securityCenterFreeSolution": {
                                      "Name": "[Concat('SecurityCenterFree', '(', parameters('workspaceName'), ')')]",
                                      "GalleryName": "SecurityCenterFree"
                                    }
                                },
                                "resources": [
                                    {
                                        "type": "Microsoft.OperationalInsights/workspaces",
                                        "name": "[parameters('workspaceName')]",
                                        "apiVersion": "2015-11-01-preview",
                                        "location": "[parameters('defaultRGLocation')]",
                                        "properties": {
                                            "sku": {
                                                "name": "pernode"
                                            },
                                            "retentionInDays": 30,
                                            "features": {
                                            "searchVersion": 1
                                            }
                                        }
                                    },
                                    {
                                        "type": "Microsoft.OperationsManagement/solutions",
                                        "name": "[variables('securitySolution').Name]",
                                        "apiVersion": "2015-11-01-preview",
                                        "location": "[parameters('defaultRGLocation')]",
                                        "dependsOn": [
                                            "[parameters('workspaceName')]"
                                        ],
                                        "properties": {
                                          "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
                                        },
                                        "plan": {
                                            "name": "[variables('securitySolution').Name]",
                                            "publisher": "Microsoft",
                                            "product": "[Concat('OMSGallery/', variables('securitySolution').GalleryName)]",
                                            "promotionCode": ""
                                        }
                                    },
                                    {
                                        "type": "Microsoft.OperationsManagement/solutions",
                                        "name": "[variables('securityCenterFreeSolution').Name]",
                                        "apiVersion": "2015-11-01-preview",
                                        "location": "[parameters('defaultRGLocation')]",
                                        "dependsOn": [
                                            "[parameters('workspaceName')]"
                                        ],
                                        "properties": {
                                          "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
                                        },
                                        "plan": {
                                            "name": "[variables('securityCenterFreeSolution').Name]",
                                            "publisher": "Microsoft",
                                            "product": "[Concat('OMSGallery/', variables('securityCenterFreeSolution').GalleryName)]",
                                            "promotionCode": ""
                                        }
                                    },
                                    {
                                        "type": "Microsoft.Insights/dataCollectionRules",
                                        "name": "[parameters('dcrName')]",
                                        "apiVersion": "2019-11-01-preview",
                                        "location": "[parameters('defaultRGLocation')]",
                                        "dependsOn": [
                                            "[parameters('workspaceName')]"
                                        ],
                                        "properties": {
                                            "description": "Data collection rule for Azure Security Center. Deleting this rule will break the detection of security vulnerabilities.",
                                            "dataSources": {
                                                "windowsEventLogs": [
                                                    {
                                                        "name": "RomeDetectionEventDataSource",
                                                        "streams": [
                                                            "Microsoft-RomeDetectionEvent"
                                                        ],
                                                        "scheduledTransferPeriod": "PT5M",
                                                        "xPathQueries": [
                                                            "Security!*",
                                                            "Microsoft-Windows-AppLocker/EXE and DLL!*"
                                                        ]
                                                    }
                                                ],
                                                "syslog": [
                                                  {
                                                    "name": "SyslogDataSource",
                                                    "streams": [
                                                      "Microsoft-Syslog"
                                                    ],
                                                    "facilityNames": [
                                                      "kern",
                                                      "auth",
                                                      "authpriv",
                                                      "cron",
                                                      "user",
                                                      "daemon",
                                                      "syslog",
                                                      "local0"
                                                    ],
                                                    "logLevels": [
                                                      "Debug",
                                                      "Critical",
                                                      "Emergency"
                                                    ]
                                                  }
                                                ],
                                                "extensions": [
                                                  {
                                                    "extensionName": "AzureSecurityLinuxAgent",
                                                    "name": "AscLinuxDataSource",
                                                    "streams": [
                                                      "Microsoft-OperationLog",
                                                      "Microsoft-SecurityBaseline",
                                                      "Microsoft-SecurityBaselineSummary",
                                                      "Microsoft-ProcessInvestigator",
                                                      "Microsoft-Auditd",
                                                      "Microsoft-ProtectionStatus",
                                                      "Microsoft-Heartbeat"
                                                    ],
                                                    "extensionSettings": {
                                                      "scanners": [
                                                        {
                                                          "name": "heartbeat",
                                                          "frequency": "PT1H"
                                                        },
                                                        {
                                                          "name": "time",
                                                          "frequency": "PT8H"
                                                        },
                                                        {
                                                          "name": "antimalware",
                                                          "frequency": "PT8H"
                                                        },
                                                        {
                                                          "name": "codeintegrity",
                                                          "frequency": "P1D"
                                                        },
                                                        {
                                                          "name": "processinvestigator",
                                                          "frequency": "PT1H"
                                                        },
                                                        {
                                                          "name": "baseline",
                                                          "frequency": "P1D",
                                                          "options": [
                                                            {
                                                              "name": "Baseline",
                                                              "value": "Azure.Ubuntu"
                                                            },
                                                            {
                                                              "name": "AscBaseline",
                                                              "value": "OMS.Linux"
                                                            }
                                                          ]
                                                        },
                                                        {
                                                          "name": "docker",
                                                          "frequency": "P1D",
                                                          "options": [
                                                            {
                                                              "name": "Baseline",
                                                              "value": "Azure.Docker.Linux"
                                                            },
                                                            {
                                                              "name": "AscBaseline",
                                                              "value": "OMS.Docker.Linux"
                                                            }
                                                          ]
                                                        }
                                                      ]
                                                    }
                                                  },
                                                  {
                                                    "extensionName": "AzureSecurityWindowsAgent",
                                                    "name": "AsaWindowsDataSource",
                                                    "streams": [
                                                        "Microsoft-OperationLog",
                                                        "Microsoft-SecurityBaseline",
                                                        "Microsoft-ProcessInvestigator",
                                                        "Microsoft-ProtectionStatus",
                                                        "Microsoft-SecurityBaselineSummary"
                                                    ],
                                                    "extensionSettings": {
                                                        "scanners": [
                                                            {
                                                                "name": "heartbeat",
                                                                "frequency": "PT1H"
                                                            },
                                                            {
                                                                "name": "baseline",
                                                                "frequency": "P1D"
                                                            },
                                                            {
                                                                "name": "antimalware",
                                                                "frequency": "P1D"
                                                            },
                                                            {
                                                              "name": "processinvestigator",
                                                              "frequency": "PT1H"
                                                            }                            
                                                        ]
                                                    }
                                                  }
                                                ]
                                            },
                                            "destinations": {
                                                "logAnalytics": [
                                                  {
                                                    "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]",
                                                    "name": "LogAnalyticsDest"
                                                  }
                                                ]
                                            },
                                            "dataFlows": [
                                                {
                                                  "streams": [
                                                    "Microsoft-Syslog",
                                                    "Microsoft-OperationLog",
                                                    "Microsoft-SecurityBaseline",
                                                    "Microsoft-SecurityBaselineSummary",
                                                    "Microsoft-RomeDetectionEvent",
                                                    "Microsoft-ProcessInvestigator",
                                                    "Microsoft-Auditd",
                                                    "Microsoft-ProtectionStatus",
                                                    "Microsoft-Heartbeat"
                                                  ],
                                                  "destinations": [
                                                    "LogAnalyticsDest"
                                                  ]
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "dependsOn": [
                          "[resourceId('Microsoft.Resources/resourceGroups', variables('defaultRGName'))]"
                        ]
                    },
                    {
                        "type": "Microsoft.Resources/deployments",
                        "name": "[variables('deployDataCollectionRulesAssociation')]",
                        "apiVersion": "2020-06-01",
                        "resourceGroup": "[parameters('resourceGroup')]",
                        "dependsOn": [
                            "[variables('deployDefaultAscResourceGroup')]"
                        ],
                        "properties": {
                            "mode": "Incremental",
                            "expressionEvaluationOptions": {
                                "scope": "inner"
                            },
                            "parameters": {
                                "location": {
                                  "value": "[parameters('location')]"
                                },
                                "vmName": {
                                  "value": "[parameters('vmName')]"
                                },
                                "dcrId": {
                                  "value": "[variables('dcrId')]"
                                },
                                "dcraName": {
                                  "value": "[variables('dcraName')]"
                                }
                            },
                            "template": {
                                "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                                "contentVersion": "1.0.0.0",
                                "parameters": {
                                    "location": {
                                      "type": "string"
                                    },
                                    "vmName": {
                                      "type": "string"
                                    },
                                    "dcrId": {
                                      "type": "string"
                                    },
                                    "dcraName": {
                                      "type": "string"
                                    }
                                },
                                "variables": {
                                },
                                "resources": [
                                    {
                                        "type": "Microsoft.Compute/virtualMachines/providers/dataCollectionRuleAssociations",
                                        "name": "[parameters('dcraName')]",
                                        "apiVersion": "2019-11-01-preview",
                                        "properties": {
                                            "description": "Association of data collection rule for Azure Security Center. Deleting this association will break the detection of security vulnerabilities for this virtual machine.",
                                            "dataCollectionRuleId": "[parameters('dcrId')]"
                                        }
                                    }
                                ]
                            }
                        }
                    }
                  ]
                }
              }
            }
          }
        }
      }
    },
    "id": "/providers/Microsoft.Authorization/policyDefinitions/8b5ad9ab-3d44-4a6e-9ac3-75b04ea5fd28",
    "name": "8b5ad9ab-3d44-4a6e-9ac3-75b04ea5fd28"
  }