Packaging tool changes for AWS, GCP kind of CCP connectors

Solutions/Google Cloud Platform Audit Logs/Data Connectors/GCPAuditLogs_ccp/data_connector_definition.json

@@ -0,0 +1,97 @@
+{
+	"type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
+	"apiVersion": "2022-09-01-preview",
+	"name": "{{workspace}}/Microsoft.SecurityInsights/GCPAuditLogsDefinition",
+	"kind": "Customizable",
+	"properties": {
+		"connectorUiConfig": {
+			"id": "GCPAuditLogsDefinition",
+			"title": "GCP Pub/Sub Audit Logs",
+			"publisher": "Microsoft",
+			"descriptionMarkdown": "The Google Cloud Platform (GCP) audit logs, ingested from Sentinel's connector, enable you to capture three types of audit logs: admin activity logs, data access logs, and access transparency logs. Google cloud audit logs record a trail that practitioners can use to monitor access and detect potential threats across Google Cloud Platform (GCP) resources.",
+			"graphQueriesTableName": "GCPAuditLogs",
+			"graphQueries": [
+				{
+					"metricName": "Total events received",
+					"legend": "GCP Audit Logs",
+					"baseQuery": "{{graphQueriesTableName}}"
+				}
+			],
+			"sampleQueries": [
+				{
+					"description": "Get Sample of GCP Audit Logs",
+					"query": "{{graphQueriesTableName}}\n | take 10"
+				}
+			],
+			"dataTypes": [
+				{
+					"name": "{{graphQueriesTableName}}",
+					"lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
+				}
+			],
+			"connectivityCriteria": [
+				{
+					"type": "HasDataConnectors"
+				}
+			],
+			"availability": {
+				"status": 1,
+				"isPreview": false
+			},
+			"permissions": {
+				"resourceProvider": [
+					{
+						"provider": "Microsoft.OperationalInsights/workspaces",
+						"permissionsDisplayText": "Read and Write permissions are required.",
+						"providerDisplayName": "Workspace",
+						"scope": "Workspace",
+						"requiredPermissions": {
+							"read": true,
+							"write": true,
+							"delete": true,
+							"action": false
+						}
+					}
+				]
+			},
+			"instructionSteps": [
+				{
+					"instructions": [
+						{
+							"type": "MarkdownControlEnvBased",
+							"parameters": {
+								"prodScript":
+										"#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation).",
+								"govScript":
+										"#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Gov Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov)."
+						}
+						},
+						{
+							"type": "CopyableLabel",
+							"parameters": {
+								"label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.",
+								"fillWith": ["TenantId"],
+								"name": "PoolId",
+								"disabled": true
+							}
+						},
+						{
+							"type": "Markdown",
+							"parameters": {
+								"content": "#### 2. Connect new collectors \n To enable GCP Audit Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect."
+							}
+						},
+						{
+							"type": "GCPGrid",
+							"parameters":{}
+						},
+						{
+							"type": "GCPContextPane",
+							"parameters":{}
+						}
+					]
+				}
+			]
+		}
+	}
+}

Solutions/Google Cloud Platform Audit Logs/Data Connectors/GCPAuditLogs_ccp/data_connector_poller.json

@@ -0,0 +1,24 @@
+[{
+	"type": "Microsoft.SecurityInsights/dataConnectors",
+	"apiVersion": "2022-10-01-preview",
+	"name": "{{workspace}}/Microsoft.SecurityInsights/GCPAuditLogs",
+	"kind": "GCP",
+	"properties": {
+		"connectorDefinitionName": "GCPAuditLogsDefinition",
+		"dataType": "GCPAuditLogs",
+		"dcrConfig": {
+			"streamName": "SENTINEL_GCP_AUDIT_LOGS"
+		},
+		"auth": {
+			"serviceAccountEmail": "{{GCPServiceAccountEmail}}",
+			"projectNumber": "{{GCPProjectNumber}}",
+			"workloadIdentityProviderId": "{{GCPWorkloadIdentityProviderId}}"
+		},
+		"request": {
+			"projectId": "{{GCPProjectId}}",
+			"subscriptionNames": [
+				"{{GCPSubscriptionName}}"
+			]
+		}
+	}
+}]

Solutions/Google Cloud Platform Audit Logs/Data Connectors/GCPAuditLogs_ccp/dcr.json

@@ -0,0 +1,25 @@
+[{
+	"name": "GCPAuditLogs",
+	"apiVersion": "2021-09-01-preview",
+	"type": "Microsoft.Insights/dataCollectionRules",
+	"location": "{{location}}",
+	"properties": {
+		"destinations": {
+			"logAnalytics": [
+				{
+					"name": "clv2ws1"
+				}
+			]
+		},
+		"dataFlows": [
+			{
+				"streams": [
+					"Microsoft-GCPAuditLogs"
+				],
+				"destinations": [
+					"clv2ws1"
+				]
+			}
+		]
+	}
+}]

Tools/Create-Azure-Sentinel-Solution/V3/createSolutionV3.ps1

@@ -320,5 +320,5 @@ try {
     }
 }
 catch {
-    Write-Host "Error occured in catch of createSolutionV3 file Error details are $_"
+    Write-Host "Error occurred in catch of createSolutionV3 file Error details are $_"
 }

Tools/Create-Azure-Sentinel-Solution/common/commonFunctions.ps1

@@ -3112,6 +3112,9 @@ function PrepareSolutionMetadata($solutionMetadataRawContent, $contentResourceDe
             if ($null -ne $global:baseCreateUiDefinition.parameters.steps -and 
             $($global:baseCreateUiDefinition.parameters.steps).GetType() -ne [System.Object[]]) {
                 $global:baseCreateUiDefinition.parameters.steps = @($global:baseCreateUiDefinition.parameters.steps)
+            } elseif ($null -eq $global:baseCreateUiDefinition.parameters.steps) {
+                # when there is no content then create ui fails as step is null
+                $global:baseCreateUiDefinition.parameters.steps = @(@{}) # [{}]
             }
             $global:baseCreateUiDefinition | ConvertTo-Json -Depth $jsonConversionDepth | Out-File $createUiDefinitionOutputPath -Encoding utf8
         }