diff --git a/Solutions/Workday/Data Connectors/Workday_ccp/Workday_DCR.json b/Solutions/Workday/Data Connectors/Workday_ccp/Workday_DCR.json index 871fed7816d..6ad0c709a6f 100644 --- a/Solutions/Workday/Data Connectors/Workday_ccp/Workday_DCR.json +++ b/Solutions/Workday/Data Connectors/Workday_ccp/Workday_DCR.json @@ -47,6 +47,10 @@ { "name": "ipAddress", "type": "string" + }, + { + "name": "apiEndpoint", + "type": "string" } ] } @@ -68,7 +72,7 @@ "clv2ws1" ], "outputStream": "Microsoft-ASimAuditEventLogs", - "transformKql": "source\n| extend TimeGenerated= requestTime, EventStartTime= requestTime, EventEndTime= requestTime\n | project-rename EventType= activityAction, DvcIpAddr=ipAddress, DvcDescription=deviceType, EventOriginalUid= taskId, Operation= taskDisplayName, ActorUsername= systemAccount, ActorSessionId=sessionId, HttpUserAgent= userAgent\n | extend Object= tostring(target.descriptor), TargetAppId= tostring(target.id), TargetUrl= tostring(target.href), EventCount= toint(1), EventSchema= \"AuditEvent\", EventResult= \"NA\", EventProduct=\"Workday\", EventVendor=\"Workday\", EventSchemaVersion=\"0.1\",ObjectType=\"Other\", Dvc=DvcIpAddr | extend EventType = case(EventType == \"READ\",\"Read\", EventType == \"WRITE\",\"Set\", \"Other\")\n| project-away requestTime, target, EventSchema, Dvc " + "transformKql": "source\n| extend TimeGenerated= requestTime, EventStartTime= requestTime, EventEndTime= requestTime\n | project-rename EventType= activityAction, DvcIpAddr=ipAddress, DvcDescription=deviceType, EventOriginalUid= taskId, Operation= taskDisplayName, ActorUsername= systemAccount, ActorSessionId=sessionId, HttpUserAgent= userAgent\n | extend Object= tostring(target.descriptor), TargetAppId= tostring(target.id), TargetUrl= tostring(target.href), EventCount= toint(1), EventSchema= \"AuditEvent\", EventResult= \"NA\", EventProduct=\"Workday\", EventVendor=\"Workday\", EventSchemaVersion=\"0.1\",ObjectType=\"Other\", Dvc=DvcIpAddr, AdditionalFields=bag_pack(\"WorkdayDomain\", apiEndpoint) | extend EventType = case(EventType == \"READ\",\"Read\", EventType == \"WRITE\",\"Set\", \"Other\")\n| project-away requestTime, target, apiEndpoint, EventSchema, Dvc " } ] } diff --git a/Solutions/Workday/Data Connectors/Workday_ccp/Workday_DataConnectorDefinition.json b/Solutions/Workday/Data Connectors/Workday_ccp/Workday_DataConnectorDefinition.json index 83f3aa29500..b876203d7dd 100644 --- a/Solutions/Workday/Data Connectors/Workday_ccp/Workday_DataConnectorDefinition.json +++ b/Solutions/Workday/Data Connectors/Workday_ccp/Workday_DataConnectorDefinition.json @@ -21,6 +21,10 @@ { "description": "Get a sample of Workday User Activity logs", "query": "ASimAuditEventLogs\n | where EventProduct == \"Workday\" | take 10" + }, + { + "description": "Summarize Workday User Activity logs by environment", + "query": "ASimAuditEventLogs\n| where EventProduct == \"Workday\"\n| extend WorkdayDomain = tostring(AdditionalFields.WorkdayDomain)\n| extend WorkdayEnvironment = iff(isempty(WorkdayDomain), \"Unknown - record collected before environment tracking\", WorkdayDomain)\n| summarize EventCount = count() by WorkdayEnvironment" } ], "dataTypes": [ @@ -61,6 +65,31 @@ ] }, "instructionSteps": [ + { + "title": "Environment identification", + "description": "Understand how Workday environments are identified in collected records", + "instructions": [ + { + "type": "MessageBar", + "parameters": { + "text": "Only records collected after this connector update include the Workday environment in `AdditionalFields.WorkdayDomain`. Existing records are not updated.", + "type": "warning" + } + }, + { + "type": "Markdown", + "parameters": { + "content": "### Updating an existing connector\n\nBefore deploying this updated template in a workspace that already has the Workday connector installed:\n\n1. Disconnect all existing Workday connector connections.\n2. Remove the existing Workday connector connections from **Data connectors**.\n3. Remove the installed Workday solution from **Content hub**.\n4. Delete the existing `workdayDCR` data collection rule from the workspace resource group.\n5. Deploy the updated connector template.\n6. Recreate and reconnect each Workday connection.\n\nExisting data in `ASimAuditEventLogs` remains unchanged. Only records collected after the updated connector is deployed and reconnected include `AdditionalFields.WorkdayDomain`." + } + }, + { + "type": "Markdown", + "parameters": { + "content": "Use the following query to summarize Workday logs by environment. Historical records without an environment value are grouped as `Unknown - record collected before environment tracking`.\n\n```kusto\nASimAuditEventLogs\n| where EventProduct == \"Workday\"\n| extend WorkdayDomain = tostring(AdditionalFields.WorkdayDomain)\n| extend WorkdayEnvironment = iff(isempty(WorkdayDomain), \"Unknown - record collected before environment tracking\", WorkdayDomain)\n| summarize EventCount = count() by WorkdayEnvironment\n```" + } + } + ] + }, { "title": "Connect Workday to Microsoft Sentinel", "description": "1) In Workday, access the \"Edit Tenant Setup - Security\" task, verify \"OAuth 2.0 Settings\" section, make sure that the \"OAuth 2.0 Clients Enabled\" check box is ticked. \n2) In Workday, access the \"Edit Tenant Setup - System\" task, verify \"User Activity Logging\" section, make sure that the \"Enable User Activity Logging\" check box is ticked. \n3) In Workday, access the \"Register API Client\" task.\n4) Define the Client Name, select the \"Client Grant Type\": \"Authorization Code Grant\" and then select \"Access Token Type\": \"Bearer\"\n5) Enter the \"Redirection URI\" found in the form below \n6) In section \"Scope (Functional Areas)\", select the appropriate scope for the user activity and click OK at the bottom select \"System\" and click OK at the bottom \n7) Copy the Client ID and Client Secret before navigating away from the page, and store it securely. \n8) In Sentinel, in the connector page - provide required Token, Authorization and User Activity Endpoints, along with Client ID and Client Secret from previous step. Then click \"Connect\". \n9) A Workday pop up will appear to complete the OAuth2 authentication and authorization of the API client. Here you need to provide credentials for Workday account with \"System Auditing\" permissions in Workday (can be either Workday account or Integration System User). \n10) Once that's complete, the message will be displayed to authorize your API client \n", diff --git a/Solutions/Workday/Data Connectors/Workday_ccp/Workday_PollingConfig.json b/Solutions/Workday/Data Connectors/Workday_ccp/Workday_PollingConfig.json index d1f574b5d55..87d06067c04 100644 --- a/Solutions/Workday/Data Connectors/Workday_ccp/Workday_PollingConfig.json +++ b/Solutions/Workday/Data Connectors/Workday_ccp/Workday_PollingConfig.json @@ -63,6 +63,7 @@ "addOnAttributes": { "friendlyName": "[[parameters('friendlyName')]", "tenantHost": "[[first(split(replace(replace(parameters('apiEndpoint'),'https://',''),'http://',''),'/'))]", + "apiEndpoint": "[[parameters('apiEndpoint')]", "dataType": "WorkdayUserActivity" } } diff --git a/Solutions/Workday/Data/Solution_Workday.json b/Solutions/Workday/Data/Solution_Workday.json index ac6cfd64c49..edbe530ec11 100644 --- a/Solutions/Workday/Data/Solution_Workday.json +++ b/Solutions/Workday/Data/Solution_Workday.json @@ -7,7 +7,7 @@ "Data Connectors/Workday_ccp/Workday_DataConnectorDefinition.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Workday\\", - "Version": "3.2.0", + "Version": "3.2.1", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false diff --git a/Solutions/Workday/Package/3.2.1.zip b/Solutions/Workday/Package/3.2.1.zip new file mode 100644 index 00000000000..f790ad4becd Binary files /dev/null and b/Solutions/Workday/Package/3.2.1.zip differ diff --git a/Solutions/Workday/Package/mainTemplate.json b/Solutions/Workday/Package/mainTemplate.json index 12d06bf3a3b..9b23785f2f8 100644 --- a/Solutions/Workday/Package/mainTemplate.json +++ b/Solutions/Workday/Package/mainTemplate.json @@ -47,11 +47,11 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Workday", - "_solutionVersion": "3.2.0", + "_solutionVersion": "3.2.1", "solutionId": "azuresentinel.azure-sentinel-solution-workday", "_solutionId": "[variables('solutionId')]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "dataConnectorCCPVersion": "3.2.0", + "dataConnectorCCPVersion": "3.2.1", "_dataConnectorContentIdConnectorDefinition1": "WorkdayCCPDefinition", "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]", "_dataConnectorContentIdConnections1": "WorkdayCCPDefinitionConnections", @@ -102,6 +102,10 @@ { "description": "Get a sample of Workday User Activity logs", "query": "ASimAuditEventLogs\n | where EventProduct == \"Workday\" | take 10" + }, + { + "description": "Summarize Workday User Activity logs by environment", + "query": "ASimAuditEventLogs\n| where EventProduct == \"Workday\"\n| extend WorkdayDomain = tostring(AdditionalFields.WorkdayDomain)\n| extend WorkdayEnvironment = iff(isempty(WorkdayDomain), \"Unknown - record collected before environment tracking\", WorkdayDomain)\n| summarize EventCount = count() by WorkdayEnvironment" } ], "dataTypes": [ @@ -142,6 +146,31 @@ ] }, "instructionSteps": [ + { + "title": "Environment identification", + "description": "Understand how Workday environments are identified in collected records", + "instructions": [ + { + "type": "MessageBar", + "parameters": { + "text": "Only records collected after this connector update include the Workday environment in `AdditionalFields.WorkdayDomain`. Existing records are not updated.", + "type": "warning" + } + }, + { + "type": "Markdown", + "parameters": { + "content": "### Updating an existing connector\n\nBefore deploying this updated template in a workspace that already has the Workday connector installed:\n\n1. Disconnect all existing Workday connector connections.\n2. Remove the existing Workday connector connections from **Data connectors**.\n3. Remove the installed Workday solution from **Content hub**.\n4. Delete the existing `workdayDCR` data collection rule from the workspace resource group.\n5. Deploy the updated connector template.\n6. Recreate and reconnect each Workday connection.\n\nExisting data in `ASimAuditEventLogs` remains unchanged. Only records collected after the updated connector is deployed and reconnected include `AdditionalFields.WorkdayDomain`." + } + }, + { + "type": "Markdown", + "parameters": { + "content": "Use the following query to summarize Workday logs by environment. Historical records without an environment value are grouped as `Unknown - record collected before environment tracking`.\n\n```kusto\nASimAuditEventLogs\n| where EventProduct == \"Workday\"\n| extend WorkdayDomain = tostring(AdditionalFields.WorkdayDomain)\n| extend WorkdayEnvironment = iff(isempty(WorkdayDomain), \"Unknown - record collected before environment tracking\", WorkdayDomain)\n| summarize EventCount = count() by WorkdayEnvironment\n```" + } + } + ] + }, { "title": "Connect Workday to Microsoft Sentinel", "description": "1) In Workday, access the \"Edit Tenant Setup - Security\" task, verify \"OAuth 2.0 Settings\" section, make sure that the \"OAuth 2.0 Clients Enabled\" check box is ticked. \n2) In Workday, access the \"Edit Tenant Setup - System\" task, verify \"User Activity Logging\" section, make sure that the \"Enable User Activity Logging\" check box is ticked. \n3) In Workday, access the \"Register API Client\" task.\n4) Define the Client Name, select the \"Client Grant Type\": \"Authorization Code Grant\" and then select \"Access Token Type\": \"Bearer\"\n5) Enter the \"Redirection URI\" found in the form below \n6) In section \"Scope (Functional Areas)\", select the appropriate scope for the user activity and click OK at the bottom select \"System\" and click OK at the bottom \n7) Copy the Client ID and Client Secret before navigating away from the page, and store it securely. \n8) In Sentinel, in the connector page - provide required Token, Authorization and User Activity Endpoints, along with Client ID and Client Secret from previous step. Then click \"Connect\". \n9) A Workday pop up will appear to complete the OAuth2 authentication and authorization of the API client. Here you need to provide credentials for Workday account with \"System Auditing\" permissions in Workday (can be either Workday account or Integration System User). \n10) Once that's complete, the message will be displayed to authorize your API client \n", @@ -424,6 +453,10 @@ { "name": "ipAddress", "type": "string" + }, + { + "name": "apiEndpoint", + "type": "string" } ] } @@ -445,7 +478,7 @@ "clv2ws1" ], "outputStream": "Microsoft-ASimAuditEventLogs", - "transformKql": "source\n| extend TimeGenerated= requestTime, EventStartTime= requestTime, EventEndTime= requestTime\n | project-rename EventType= activityAction, DvcIpAddr=ipAddress, DvcDescription=deviceType, EventOriginalUid= taskId, Operation= taskDisplayName, ActorUsername= systemAccount, ActorSessionId=sessionId, HttpUserAgent= userAgent\n | extend Object= tostring(target.descriptor), TargetAppId= tostring(target.id), TargetUrl= tostring(target.href), EventCount= toint(1), EventSchema= \"AuditEvent\", EventResult= \"NA\", EventProduct=\"Workday\", EventVendor=\"Workday\", EventSchemaVersion=\"0.1\",ObjectType=\"Other\", Dvc=DvcIpAddr | extend EventType = case(EventType == \"READ\",\"Read\", EventType == \"WRITE\",\"Set\", \"Other\")\n| project-away requestTime, target, EventSchema, Dvc " + "transformKql": "source\n| extend TimeGenerated= requestTime, EventStartTime= requestTime, EventEndTime= requestTime\n | project-rename EventType= activityAction, DvcIpAddr=ipAddress, DvcDescription=deviceType, EventOriginalUid= taskId, Operation= taskDisplayName, ActorUsername= systemAccount, ActorSessionId=sessionId, HttpUserAgent= userAgent\n | extend Object= tostring(target.descriptor), TargetAppId= tostring(target.id), TargetUrl= tostring(target.href), EventCount= toint(1), EventSchema= \"AuditEvent\", EventResult= \"NA\", EventProduct=\"Workday\", EventVendor=\"Workday\", EventSchemaVersion=\"0.1\",ObjectType=\"Other\", Dvc=DvcIpAddr, AdditionalFields=bag_pack(\"WorkdayDomain\", apiEndpoint) | extend EventType = case(EventType == \"READ\",\"Read\", EventType == \"WRITE\",\"Set\", \"Other\")\n| project-away requestTime, target, apiEndpoint, EventSchema, Dvc " } ] } @@ -484,6 +517,10 @@ { "description": "Get a sample of Workday User Activity logs", "query": "ASimAuditEventLogs\n | where EventProduct == \"Workday\" | take 10" + }, + { + "description": "Summarize Workday User Activity logs by environment", + "query": "ASimAuditEventLogs\n| where EventProduct == \"Workday\"\n| extend WorkdayDomain = tostring(AdditionalFields.WorkdayDomain)\n| extend WorkdayEnvironment = iff(isempty(WorkdayDomain), \"Unknown - record collected before environment tracking\", WorkdayDomain)\n| summarize EventCount = count() by WorkdayEnvironment" } ], "dataTypes": [ @@ -524,6 +561,31 @@ ] }, "instructionSteps": [ + { + "title": "Environment identification", + "description": "Understand how Workday environments are identified in collected records", + "instructions": [ + { + "type": "MessageBar", + "parameters": { + "text": "Only records collected after this connector update include the Workday environment in `AdditionalFields.WorkdayDomain`. Existing records are not updated.", + "type": "warning" + } + }, + { + "type": "Markdown", + "parameters": { + "content": "### Updating an existing connector\n\nBefore deploying this updated template in a workspace that already has the Workday connector installed:\n\n1. Disconnect all existing Workday connector connections.\n2. Remove the existing Workday connector connections from **Data connectors**.\n3. Remove the installed Workday solution from **Content hub**.\n4. Delete the existing `workdayDCR` data collection rule from the workspace resource group.\n5. Deploy the updated connector template.\n6. Recreate and reconnect each Workday connection.\n\nExisting data in `ASimAuditEventLogs` remains unchanged. Only records collected after the updated connector is deployed and reconnected include `AdditionalFields.WorkdayDomain`." + } + }, + { + "type": "Markdown", + "parameters": { + "content": "Use the following query to summarize Workday logs by environment. Historical records without an environment value are grouped as `Unknown - record collected before environment tracking`.\n\n```kusto\nASimAuditEventLogs\n| where EventProduct == \"Workday\"\n| extend WorkdayDomain = tostring(AdditionalFields.WorkdayDomain)\n| extend WorkdayEnvironment = iff(isempty(WorkdayDomain), \"Unknown - record collected before environment tracking\", WorkdayDomain)\n| summarize EventCount = count() by WorkdayEnvironment\n```" + } + } + ] + }, { "title": "Connect Workday to Microsoft Sentinel", "description": "1) In Workday, access the \"Edit Tenant Setup - Security\" task, verify \"OAuth 2.0 Settings\" section, make sure that the \"OAuth 2.0 Clients Enabled\" check box is ticked. \n2) In Workday, access the \"Edit Tenant Setup - System\" task, verify \"User Activity Logging\" section, make sure that the \"Enable User Activity Logging\" check box is ticked. \n3) In Workday, access the \"Register API Client\" task.\n4) Define the Client Name, select the \"Client Grant Type\": \"Authorization Code Grant\" and then select \"Access Token Type\": \"Bearer\"\n5) Enter the \"Redirection URI\" found in the form below \n6) In section \"Scope (Functional Areas)\", select the appropriate scope for the user activity and click OK at the bottom select \"System\" and click OK at the bottom \n7) Copy the Client ID and Client Secret before navigating away from the page, and store it securely. \n8) In Sentinel, in the connector page - provide required Token, Authorization and User Activity Endpoints, along with Client ID and Client Secret from previous step. Then click \"Connect\". \n9) A Workday pop up will appear to complete the OAuth2 authentication and authorization of the API client. Here you need to provide credentials for Workday account with \"System Auditing\" permissions in Workday (can be either Workday account or Integration System User). \n10) Once that's complete, the message will be displayed to authorize your API client \n", @@ -940,6 +1002,7 @@ "addOnAttributes": { "friendlyName": "[[parameters('friendlyName')]", "tenantHost": "[[first(split(replace(replace(parameters('apiEndpoint'),'https://',''),'http://',''),'/'))]", + "apiEndpoint": "[[parameters('apiEndpoint')]", "dataType": "WorkdayUserActivity" } } @@ -960,7 +1023,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.2.0", + "version": "3.2.1", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Workday", diff --git a/Solutions/Workday/ReleaseNotes.md b/Solutions/Workday/ReleaseNotes.md index 7e2bf71f1de..a6be5f109fc 100644 --- a/Solutions/Workday/ReleaseNotes.md +++ b/Solutions/Workday/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|--------------------------------------------------------------| +| 3.2.1 | 22-10-2026 | Updated the Workday Data Connector to distinguish multi-instance logs using the source API endpoint in AdditionalFields.WorkdayDomain; added an environment summary query and upgrade guidance. | | 3.2.0 | 07-10-2026 | Added multi-instance support for the Workday **Data Connector**. | | 3.1.0 | 18-08-2026 | Added support for a configurable page size for the Workday data connector and aliases and grid management. | | 3.0.3 | 23-12-2025 | Updated page size for the Workday **Data connector** and configure the query window + updated **Data Connector** to support dynamic Redirect URI|