Skip to content

fix: update event stream names and enforce security settings in Bicep #593

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Kanchan-Microsoft wants to merge 5 commits into
base: dev
Choose a base branch
from
+75 −46
Open

fix: update event stream names and enforce security settings in Bicep #593

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7adc453
fix: update event stream names and enforce security settings in Bicep…
Kanchan-Microsoft May 19, 2026
e13d1c5
fix: update event log configuration and refine xPathQueries for data …
Kanchan-Microsoft May 19, 2026
ee3777a
Merge branch 'dev' into sfi-fix
Kanchan-Microsoft May 20, 2026
85ea0b0
refactor: update log analytics resource naming in Bicep templates
Kanchan-Microsoft May 20, 2026
3f17071
refactor: update log analytics workspace resource name in Bicep templ…
Kanchan-Microsoft May 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 21 additions & 14 deletions infra/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -362,6 +362,8 @@ module maintenanceConfiguration 'br/public:avm/res/maintenance/maintenance-confi

var dataCollectionRulesResourceName = 'dcr-${solutionSuffix}'
var dataCollectionRulesLocation = logAnalyticsWorkspace!.outputs.location
var logAnalyticsWorkspaceResourceName = 'log-${solutionSuffix}'
var dcrLogAnalyticsDestinationName = 'la-${logAnalyticsWorkspaceResourceName}-destination'
Comment thread
Kanchan-Microsoft marked this conversation as resolved.
module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-rule:0.11.0' = if (enablePrivateNetworking && enableMonitoring) {
name: take('avm.res.insights.data-collection-rule.${dataCollectionRulesResourceName}', 64)
params: {
Expand Down Expand Up @@ -433,19 +435,10 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
{
name: 'SecurityAuditEvents'
streams: [
'Microsoft-WindowsEvent'
]
eventLogName: 'Security'
eventTypes: [
{
eventType: 'Audit Success'
}
{
eventType: 'Audit Failure'
}
'Microsoft-Event'
]
Comment thread
Kanchan-Microsoft marked this conversation as resolved.
xPathQueries: [
'Security!*[System[(EventID=4624 or EventID=4625)]]'
'Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]'
]
}
]
Expand All @@ -454,7 +447,7 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
logAnalytics: [
{
workspaceResourceId: logAnalyticsWorkspace!.outputs.resourceId
name: 'la-${dataCollectionRulesResourceName}'
name: dcrLogAnalyticsDestinationName
}
]
}
Expand All @@ -464,11 +457,21 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
'Microsoft-Perf'
]
destinations: [
'la-${dataCollectionRulesResourceName}'
dcrLogAnalyticsDestinationName
]
transformKql: 'source'
outputStream: 'Microsoft-Perf'
}
{
streams: [
'Microsoft-Event'
]
destinations: [
dcrLogAnalyticsDestinationName
]
transformKql: 'source'
outputStream: 'Microsoft-Event'
Comment thread
Kanchan-Microsoft marked this conversation as resolved.
}
]
}
}
Expand Down Expand Up @@ -517,7 +520,7 @@ module avmPrivateDnsZones 'br/public:avm/res/network/private-dns-zone:0.8.1' = [
module logAnalyticsWorkspace 'modules/log-analytics-workspace.bicep' = if (enableMonitoring) {
name: take('module.log-analytics-workspace.${solutionSuffix}', 64)
params: {
name: 'log-${solutionSuffix}'
name: logAnalyticsWorkspaceResourceName
location: location
tags: tags
enableTelemetry: enableTelemetry
Expand Down Expand Up @@ -654,6 +657,7 @@ module avmStorageAccount 'br/public:avm/res/storage/storage-account:0.32.0' = {
defaultAction: (enablePrivateNetworking) ? 'Deny' : 'Allow'
ipRules: []
}
requireInfrastructureEncryption: true
supportsHttpsTrafficOnly: true
accessTier: 'Hot'
tags: tags
Expand Down Expand Up @@ -1048,6 +1052,7 @@ module avmContainerApp_API 'br/public:avm/res/app/container-app:0.22.1' = {
ingressExternal: true
activeRevisionsMode: 'Single'
ingressTransport: 'auto'
ingressAllowInsecure: false
corsPolicy: {
allowedOrigins: [
'*'
Expand Down Expand Up @@ -1089,6 +1094,7 @@ module avmContainerApp_Web 'br/public:avm/res/app/container-app:0.22.1' = {
ingressTargetPort: 3000
activeRevisionsMode: 'Single'
ingressTransport: 'auto'
ingressAllowInsecure: false
scaleSettings: {
maxReplicas: enableScalability ? 3 : 2
minReplicas: enableScalability ? 2 : 1
Expand Down Expand Up @@ -1722,6 +1728,7 @@ module avmContainerApp_API_update 'br/public:avm/res/app/container-app:0.22.1' =
ingressExternal: true
activeRevisionsMode: 'Single'
ingressTransport: 'auto'
ingressAllowInsecure: false
corsPolicy: {
allowedOrigins: [
'*'
Expand Down
51 changes: 33 additions & 18 deletions infra/main.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
"_generator": {
"name": "bicep",
"version": "0.42.1.51946",
"templateHash": "12078312041649297460"
"templateHash": "5885652317352749587"
},
"name": "Content Processing Solution Accelerator",
"description": "Bicep template to deploy the Content Processing Solution Accelerator with AVM compliance."
Expand Down Expand Up @@ -243,6 +243,8 @@
"bastionHostName": "[format('bas-{0}', variables('solutionSuffix'))]",
"jumpboxVmName": "[take(format('vm-{0}', variables('solutionSuffix')), 15)]",
"dataCollectionRulesResourceName": "[format('dcr-{0}', variables('solutionSuffix'))]",
"logAnalyticsWorkspaceResourceName": "[format('log-{0}', variables('solutionSuffix'))]",
"dcrLogAnalyticsDestinationName": "[format('la-{0}-destination', variables('logAnalyticsWorkspaceResourceName'))]",
"privateDnsZones": [
"privatelink.cognitiveservices.azure.com",
"privatelink.openai.azure.com",
Expand Down Expand Up @@ -14607,19 +14609,10 @@
{
"name": "SecurityAuditEvents",
"streams": [
"Microsoft-WindowsEvent"
],
"eventLogName": "Security",
"eventTypes": [
{
"eventType": "Audit Success"
},
{
"eventType": "Audit Failure"
}
"Microsoft-Event"
],
"xPathQueries": [
"Security!*[System[(EventID=4624 or EventID=4625)]]"
"Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]"
]
}
]
Expand All @@ -14628,7 +14621,7 @@
"logAnalytics": [
{
"workspaceResourceId": "[reference('logAnalyticsWorkspace').outputs.resourceId.value]",
"name": "[format('la-{0}', variables('dataCollectionRulesResourceName'))]"
"name": "[variables('dcrLogAnalyticsDestinationName')]"
}
]
},
Expand All @@ -14638,10 +14631,20 @@
"Microsoft-Perf"
],
"destinations": [
"[format('la-{0}', variables('dataCollectionRulesResourceName'))]"
"[variables('dcrLogAnalyticsDestinationName')]"
],
"transformKql": "source",
"outputStream": "Microsoft-Perf"
},
{
"streams": [
"Microsoft-Event"
],
"destinations": [
"[variables('dcrLogAnalyticsDestinationName')]"
],
"transformKql": "source",
"outputStream": "Microsoft-Event"
}
]
}
Expand Down Expand Up @@ -19272,7 +19275,7 @@
"mode": "Incremental",
"parameters": {
"name": {
"value": "[format('log-{0}', variables('solutionSuffix'))]"
"value": "[variables('logAnalyticsWorkspaceResourceName')]"
},
"location": {
"value": "[parameters('location')]"
Expand Down Expand Up @@ -28050,6 +28053,9 @@
"ipRules": []
}
},
"requireInfrastructureEncryption": {
"value": true
},
"supportsHttpsTrafficOnly": {
"value": true
},
Expand Down Expand Up @@ -36177,8 +36183,8 @@
"avmContainerApp_API",
"avmContainerApp_Workflow",
"avmManagedIdentity",
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').storageBlob)]",
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').storageQueue)]",
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').storageBlob)]",
"virtualNetwork"
]
},
Expand Down Expand Up @@ -42482,9 +42488,9 @@
"dependsOn": [
"avmAiServices",
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').contentUnderstanding)]",
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]",
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').aiServices)]",
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').openAI)]",
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').aiServices)]",
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]",
"virtualNetwork"
]
},
Expand Down Expand Up @@ -45910,6 +45916,9 @@
"ingressTransport": {
"value": "auto"
},
"ingressAllowInsecure": {
"value": false
},
"corsPolicy": {
"value": {
"allowedOrigins": [
Expand Down Expand Up @@ -47515,6 +47524,9 @@
"ingressTransport": {
"value": "auto"
},
"ingressAllowInsecure": {
"value": false
},
"scaleSettings": {
"value": {
"maxReplicas": "[if(parameters('enableScalability'), 3, 2)]",
Expand Down Expand Up @@ -63172,6 +63184,9 @@
"ingressTransport": {
"value": "auto"
},
"ingressAllowInsecure": {
"value": false
},
"corsPolicy": {
"value": {
"allowedOrigins": [
Expand Down
35 changes: 21 additions & 14 deletions infra/main_custom.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -365,6 +365,8 @@ module maintenanceConfiguration 'br/public:avm/res/maintenance/maintenance-confi

var dataCollectionRulesResourceName = 'dcr-${solutionSuffix}'
var dataCollectionRulesLocation = logAnalyticsWorkspace!.outputs.location
var logAnalyticsWorkspaceResourceName = 'log-${solutionSuffix}'
var dcrLogAnalyticsDestinationName = 'la-${logAnalyticsWorkspaceResourceName}-destination'
Comment thread
Kanchan-Microsoft marked this conversation as resolved.
module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-rule:0.11.0' = if (enablePrivateNetworking && enableMonitoring) {
name: take('avm.res.insights.data-collection-rule.${dataCollectionRulesResourceName}', 64)
params: {
Expand Down Expand Up @@ -436,19 +438,10 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
{
name: 'SecurityAuditEvents'
streams: [
'Microsoft-WindowsEvent'
]
eventLogName: 'Security'
eventTypes: [
{
eventType: 'Audit Success'
}
{
eventType: 'Audit Failure'
}
'Microsoft-Event'
]
Comment thread
Kanchan-Microsoft marked this conversation as resolved.
xPathQueries: [
'Security!*[System[(EventID=4624 or EventID=4625)]]'
'Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]'
]
}
]
Expand All @@ -457,7 +450,7 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
logAnalytics: [
{
workspaceResourceId: logAnalyticsWorkspace!.outputs.resourceId
name: 'la-${dataCollectionRulesResourceName}'
name: dcrLogAnalyticsDestinationName
}
]
}
Expand All @@ -467,11 +460,21 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
'Microsoft-Perf'
]
destinations: [
'la-${dataCollectionRulesResourceName}'
dcrLogAnalyticsDestinationName
]
transformKql: 'source'
outputStream: 'Microsoft-Perf'
}
{
streams: [
'Microsoft-Event'
]
destinations: [
dcrLogAnalyticsDestinationName
]
transformKql: 'source'
outputStream: 'Microsoft-Event'
Comment thread
Kanchan-Microsoft marked this conversation as resolved.
}
]
}
}
Expand Down Expand Up @@ -520,7 +523,7 @@ module avmPrivateDnsZones 'br/public:avm/res/network/private-dns-zone:0.8.1' = [
module logAnalyticsWorkspace 'modules/log-analytics-workspace.bicep' = if (enableMonitoring) {
name: take('module.log-analytics-workspace.${solutionSuffix}', 64)
params: {
name: 'log-${solutionSuffix}'
name: logAnalyticsWorkspaceResourceName
location: location
tags: tags
enableTelemetry: enableTelemetry
Expand Down Expand Up @@ -657,6 +660,7 @@ module avmStorageAccount 'br/public:avm/res/storage/storage-account:0.32.0' = {
defaultAction: (enablePrivateNetworking) ? 'Deny' : 'Allow'
ipRules: []
}
requireInfrastructureEncryption: true
supportsHttpsTrafficOnly: true
accessTier: 'Hot'
tags: tags
Expand Down Expand Up @@ -1061,6 +1065,7 @@ module avmContainerApp_API 'br/public:avm/res/app/container-app:0.22.1' = {
ingressExternal: true
activeRevisionsMode: 'Single'
ingressTransport: 'auto'
ingressAllowInsecure: false
corsPolicy: {
allowedOrigins: [
'*'
Expand Down Expand Up @@ -1107,6 +1112,7 @@ module avmContainerApp_Web 'br/public:avm/res/app/container-app:0.22.1' = {
ingressTargetPort: 3000
activeRevisionsMode: 'Single'
ingressTransport: 'auto'
ingressAllowInsecure: false
scaleSettings: {
maxReplicas: enableScalability ? 3 : 2
minReplicas: enableScalability ? 2 : 1
Expand Down Expand Up @@ -1756,6 +1762,7 @@ module avmContainerApp_API_update 'br/public:avm/res/app/container-app:0.22.1' =
ingressExternal: true
activeRevisionsMode: 'Single'
ingressTransport: 'auto'
ingressAllowInsecure: false
corsPolicy: {
allowedOrigins: [
'*'
Expand Down
Loading