Microsoft Sentinel resource template for creating a Data Collector Rule (DCR) to ingest custom logs into Microsoft Sentinel SIEM.

ms-sentinel-dcr-template.yml

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "dataCollectionRules_OnePasswordLogs_name": {
            "defaultValue": "OnePasswordLogs",
            "type": "String"
        },
        "dataCollectionEndpoints_1password_externalid": {
            "defaultValue": "/subscriptions/SUBSCRIPTION-ID-HERE/resourceGroups/myresgroup/providers/Microsoft.OperationalInsights/dataCollectionEndpoints/1password",
            "type": "String"
        },
        "workspaces_myworkspace_externalid": {
            "defaultValue": "/subscriptions/SUBSCRIPTION-ID-HERE/resourceGroups/myresgroup/providers/Microsoft.OperationalInsights/workspaces/myworkspace",
            "type": "String"
        }
    },
    "variables": {},
    "resources": [
        {
            "type": "Microsoft.Insights/dataCollectionRules",
            "apiVersion": "2022-06-01",
            "name": "[parameters('dataCollectionRules_OnePasswordLogs_name')]",
            "location": "westeurope",
            "properties": {
                "dataCollectionEndpointId": "[parameters('dataCollectionEndpoints_1password_externalid')]",
                "streamDeclarations": {
                    "Custom-OnePasswordLogs_CL": {
                        "columns": [
                            {
                                "name": "Client",
                                "type": "string"
                            },
                            {
                                "name": "Computer",
                                "type": "string"
                            },
                            {
                                "name": "Location",
                                "type": "string"
                            },
                            {
                                "name": "LogType",
                                "type": "string"
                            },
                            {
                                "name": "ManagementGroupName",
                                "type": "string"
                            },
                            {
                                "name": "RawData",
                                "type": "string"
                            },
                            {
                                "name": "SourceSystem",
                                "type": "string"
                            },
                            {
                                "name": "TimeGenerated",
                                "type": "datetime"
                            },
                            {
                                "name": "Type",
                                "type": "string"
                            },
                            {
                                "name": "User",
                                "type": "string"
                            }
                        ]
                    }
                },
                "destinations": {
                    "logAnalytics": [
                        {
                            "workspaceResourceId": "[parameters('workspaces_myworkspace_externalid')]",
                            "name": "myworkspace"
                        }
                    ]
                },
                "dataFlows": [
                    {
                        "streams": [
                            "[concat('Custom-', parameters('dataCollectionRules_OnePasswordLogs_name'), '_CL')]"
                        ],
                        "destinations": [
                            "myworkspace"
                        ],
                        "outputStream": "[concat('Custom-', parameters('dataCollectionRules_OnePasswordLogs_name'), '_CL')]"
                    }
                ]
            }
        }
    ]
}