solution built by V3

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "author": "vendor.",
    "comments": "Solution template for Auditd"
  },
  "parameters": {
    "location": {
      "type": "string",
      "minLength": 1,
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`.  We instead use the `workspace-location` which is derived from the LA workspace"
      }
    },
    "workspace-location": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"
      }
    },
    "workspace": {
      "defaultValue": "",
      "type": "string",
      "metadata": {
        "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
      }
    }
  },
  "variables": {
    "_solutionName": "Auditd",
    "_solutionVersion": "3.0.0",
    "solutionId": "vendor.vendor-solution",
    "_solutionId": "[variables('solutionId')]",
    "analyticRuleObject1": {
      "analyticRuleVersion1": "1.0.0",
      "_analyticRulecontentId1": "694ce09d-a4c8-47d5-8095-f1c4693462f5",
      "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '694ce09d-a4c8-47d5-8095-f1c4693462f5')]",
      "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('694ce09d-a4c8-47d5-8095-f1c4693462f5')))]",
      "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','694ce09d-a4c8-47d5-8095-f1c4693462f5','-', '1.0.0')))]"
    },
    "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
  },
  "resources": [
    {
      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
      "apiVersion": "2023-04-01-preview",
      "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]",
      "location": "[parameters('workspace-location')]",
      "dependsOn": [
        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
      ],
      "properties": {
        "description": "auditd_netcat_socat_or_nc_executed_after_firewall_rules_are_altered_AnalyticalRules Analytics Rule with template version 3.0.0",
        "mainTemplate": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]",
          "parameters": {},
          "variables": {},
          "resources": [
            {
              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
              "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
              "apiVersion": "2023-02-01-preview",
              "kind": "Scheduled",
              "location": "[parameters('workspace-location')]",
              "properties": {
                "description": "This query identifies the execution of netcat, socat, or nc following a firewall change",
                "displayName": "AuditD - netcat, socat, or nc Executed After Firewall Rules Are Altered",
                "enabled": false,
                "query": "// update rule. add exclutions (list of users, Dvc)\n// potention new rule. Monitor CmdEvents only -- no firewall status.\n// response: can't use users -- no users in events found\nlet firewallKeys = dynamic([\"iptables_exec\", \"nftables_exec\", \"firewall-cmd_exec\", \"ufw_exec\"]);\nlet cmdKeys = dynamic([\"susp_activity_ncat\", \"susp_activity_socat\", \"susp_activity_nc\"]);\nlet excludeDvc = dynamic([\"centos\"]);\nlet FirewallEvents = ASim_LinuxAuditdSyslog_V01(false)\n    | where key in (firewallKeys);\nlet CmdEvents = ASim_LinuxAuditdSyslog_V01(false)\n    | where key in (cmdKeys)\n    | where not(Dvc has_any (excludeDvc));\nFirewallEvents\n    | join kind=inner (CmdEvents) on $left.Dvc == $right.Dvc\n    | project-rename FirewallAt=TimeGenerated, CmdAt=TimeGenerated1\n    | where FirewallAt <= CmdAt\n    | project FirewallAt, CmdAt, Dvc, FirewallKey=key, CmdKey=key1",
                "queryFrequency": "PT1H",
                "queryPeriod": "PT1H",
                "severity": "Low",
                "suppressionDuration": "PT1H",
                "suppressionEnabled": false,
                "triggerOperator": "GreaterThan",
                "triggerThreshold": 0,
                "status": "Available",
                "requiredDataConnectors": [
                  {
                    "dataTypes": [
                      "Syslog"
                    ],
                    "connectorId": "AuditDSyslog"
                  }
                ],
                "tactics": [
                  "InitialAccess"
                ],
                "techniques": [
                  "T1189"
                ],
                "entityMappings": [
                  {
                    "entityType": "IP",
                    "fieldMappings": [
                      {
                        "identifier": "Address",
                        "columnName": "IPCustomEntity"
                      }
                    ]
                  }
                ]
              }
            },
            {
              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
              "apiVersion": "2022-01-01-preview",
              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]",
              "properties": {
                "description": "Auditd Analytics Rule 1",
                "parentId": "[variables('analyticRuleObject1').analyticRuleId1]",
                "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
                "kind": "AnalyticsRule",
                "version": "[variables('analyticRuleObject1').analyticRuleVersion1]",
                "source": {
                  "kind": "Solution",
                  "name": "Auditd",
                  "sourceId": "[variables('_solutionId')]"
                },
                "author": {
                  "name": "vendor."
                },
                "support": {
                  "name": "vendor.",
                  "email": "[email protected]",
                  "tier": "Partner",
                  "link": "https://microsoft.com"
                }
              }
            }
          ]
        },
        "packageKind": "Solution",
        "packageVersion": "[variables('_solutionVersion')]",
        "packageName": "[variables('_solutionName')]",
        "packageId": "[variables('_solutionId')]",
        "contentSchemaVersion": "3.0.0",
        "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
        "contentKind": "AnalyticsRule",
        "displayName": "AuditD - netcat, socat, or nc Executed After Firewall Rules Are Altered",
        "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]",
        "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]",
        "version": "[variables('analyticRuleObject1').analyticRuleVersion1]"
      }
    },
    {
      "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
      "apiVersion": "2023-04-01-preview",
      "location": "[parameters('workspace-location')]",
      "properties": {
        "version": "3.0.0",
        "kind": "Solution",
        "contentSchemaVersion": "3.0.0",
        "displayName": "Auditd",
        "publisherDisplayName": "vendor.",
        "descriptionHtml": "<p><strong>Note:</strong> Please refer to the following before installing the solution:</p>\n<p>• Review the solution <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Auditd/ReleaseNotes.md\">Release Notes</a></p>\n<p>• There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</p>\n<p>Auditd Solution for MS Sentinel</p>\n<p><strong>Analytic Rules:</strong> 1</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n",
        "contentKind": "Solution",
        "contentProductId": "[variables('_solutioncontentProductId')]",
        "id": "[variables('_solutioncontentProductId')]",
        "icon": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Auditd.svg\" width=\"75px\" height=\"75px\">",
        "contentId": "[variables('_solutionId')]",
        "parentId": "[variables('_solutionId')]",
        "source": {
          "kind": "Solution",
          "name": "Auditd",
          "sourceId": "[variables('_solutionId')]"
        },
        "author": {
          "name": "vendor."
        },
        "support": {
          "name": "vendor.",
          "email": "[email protected]",
          "tier": "Partner",
          "link": "https://microsoft.com"
        },
        "dependencies": {
          "operator": "AND",
          "criteria": [
            {
              "kind": "AnalyticsRule",
              "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
              "version": "[variables('analyticRuleObject1').analyticRuleVersion1]"
            }
          ]
        },
        "firstPublishDate": "2025-08-06",
        "lastPublishDate": "2025-08-06",
        "providers": [
          "vendor"
        ],
        "categories": {
          "domains": [
            "Security - Others"
          ]
        }
      },
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]"
    }
  ],
  "outputs": {}
}