Sentinelascode/randomcustom.json at main · holi1-ops/Sentinelascode · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
{
    "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workspaceName": {
            "type": "string",
            "defaultValue": "test1loganalysis"
        },
        "location": {
            "type": "string",
            "defaultValue": "Southeast Asia"
        }
    },
    "resources": [
        {
            "type": "Microsoft.OperationalInsights/workspaces",
            "apiVersion": "2017-03-15-preview",
            "name": "[parameters('workspaceName')]",
            "location": "[parameters('location')]",
            "resources": [
                {
                    "type": "savedSearches",
                    "apiVersion": "2020-08-01",
                    "name": "randomcustomquery",
                    "dependsOn": [
                        "[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
                    ],
                    "properties": {
                        "etag": "*",
                        "displayName": "randomcustomquery",
                        "category": "Security",
                        "FunctionAlias": "randomcustomquery",
                        "query": "SigninLogs\r\n| take 10 \r\n| extend writer=\"holi1\"",
                        "version": 1,
                        "functionParameters": "disabled:bool=False"
                    }
                }
            ]
        }
    ]
}