From a84a93a01f63b48dad5f6b42b9c4a5721fefc82a Mon Sep 17 00:00:00 2001 From: v-ezequielbi Date: Thu, 22 Oct 2026 12:59:24 -0600 Subject: [PATCH] Updated the Workday Data Connector to distinguish multi-instance logs using the source API endpoint in AdditionalFields.WorkdayDomain; added an environment summary query and upgrade guidance. --- .../Workday_ccp/Workday_DCR.json | 6 +- .../Workday_DataConnectorDefinition.json | 29 +++++++ .../Workday_ccp/Workday_PollingConfig.json | 1 + Solutions/Workday/Data/Solution_Workday.json | 2 +- Solutions/Workday/Package/3.2.1.zip | Bin 0 -> 9744 bytes Solutions/Workday/Package/mainTemplate.json | 71 +++++++++++++++++- Solutions/Workday/ReleaseNotes.md | 1 + 7 files changed, 104 insertions(+), 6 deletions(-) create mode 100644 Solutions/Workday/Package/3.2.1.zip diff --git a/Solutions/Workday/Data Connectors/Workday_ccp/Workday_DCR.json b/Solutions/Workday/Data Connectors/Workday_ccp/Workday_DCR.json index 871fed7816d..6ad0c709a6f 100644 --- a/Solutions/Workday/Data Connectors/Workday_ccp/Workday_DCR.json +++ b/Solutions/Workday/Data Connectors/Workday_ccp/Workday_DCR.json @@ -47,6 +47,10 @@ { "name": "ipAddress", "type": "string" + }, + { + "name": "apiEndpoint", + "type": "string" } ] } @@ -68,7 +72,7 @@ "clv2ws1" ], "outputStream": "Microsoft-ASimAuditEventLogs", - "transformKql": "source\n| extend TimeGenerated= requestTime, EventStartTime= requestTime, EventEndTime= requestTime\n | project-rename EventType= activityAction, DvcIpAddr=ipAddress, DvcDescription=deviceType, EventOriginalUid= taskId, Operation= taskDisplayName, ActorUsername= systemAccount, ActorSessionId=sessionId, HttpUserAgent= userAgent\n | extend Object= tostring(target.descriptor), TargetAppId= tostring(target.id), TargetUrl= tostring(target.href), EventCount= toint(1), EventSchema= \"AuditEvent\", EventResult= \"NA\", EventProduct=\"Workday\", EventVendor=\"Workday\", EventSchemaVersion=\"0.1\",ObjectType=\"Other\", Dvc=DvcIpAddr | extend EventType = case(EventType == \"READ\",\"Read\", EventType == \"WRITE\",\"Set\", \"Other\")\n| project-away requestTime, target, EventSchema, Dvc " + "transformKql": "source\n| extend TimeGenerated= requestTime, EventStartTime= requestTime, EventEndTime= requestTime\n | project-rename EventType= activityAction, DvcIpAddr=ipAddress, DvcDescription=deviceType, EventOriginalUid= taskId, Operation= taskDisplayName, ActorUsername= systemAccount, ActorSessionId=sessionId, HttpUserAgent= userAgent\n | extend Object= tostring(target.descriptor), TargetAppId= tostring(target.id), TargetUrl= tostring(target.href), EventCount= toint(1), EventSchema= \"AuditEvent\", EventResult= \"NA\", EventProduct=\"Workday\", EventVendor=\"Workday\", EventSchemaVersion=\"0.1\",ObjectType=\"Other\", Dvc=DvcIpAddr, AdditionalFields=bag_pack(\"WorkdayDomain\", apiEndpoint) | extend EventType = case(EventType == \"READ\",\"Read\", EventType == \"WRITE\",\"Set\", \"Other\")\n| project-away requestTime, target, apiEndpoint, EventSchema, Dvc " } ] } diff --git a/Solutions/Workday/Data Connectors/Workday_ccp/Workday_DataConnectorDefinition.json b/Solutions/Workday/Data Connectors/Workday_ccp/Workday_DataConnectorDefinition.json index 83f3aa29500..b876203d7dd 100644 --- a/Solutions/Workday/Data Connectors/Workday_ccp/Workday_DataConnectorDefinition.json +++ b/Solutions/Workday/Data Connectors/Workday_ccp/Workday_DataConnectorDefinition.json @@ -21,6 +21,10 @@ { "description": "Get a sample of Workday User Activity logs", "query": "ASimAuditEventLogs\n | where EventProduct == \"Workday\" | take 10" + }, + { + "description": "Summarize Workday User Activity logs by environment", + "query": "ASimAuditEventLogs\n| where EventProduct == \"Workday\"\n| extend WorkdayDomain = tostring(AdditionalFields.WorkdayDomain)\n| extend WorkdayEnvironment = iff(isempty(WorkdayDomain), \"Unknown - record collected before environment tracking\", WorkdayDomain)\n| summarize EventCount = count() by WorkdayEnvironment" } ], "dataTypes": [ @@ -61,6 +65,31 @@ ] }, "instructionSteps": [ + { + "title": "Environment identification", + "description": "Understand how Workday environments are identified in collected records", + "instructions": [ + { + "type": "MessageBar", + "parameters": { + "text": "Only records collected after this connector update include the Workday environment in `AdditionalFields.WorkdayDomain`. Existing records are not updated.", + "type": "warning" + } + }, + { + "type": "Markdown", + "parameters": { + "content": "### Updating an existing connector\n\nBefore deploying this updated template in a workspace that already has the Workday connector installed:\n\n1. Disconnect all existing Workday connector connections.\n2. Remove the existing Workday connector connections from **Data connectors**.\n3. Remove the installed Workday solution from **Content hub**.\n4. Delete the existing `workdayDCR` data collection rule from the workspace resource group.\n5. Deploy the updated connector template.\n6. Recreate and reconnect each Workday connection.\n\nExisting data in `ASimAuditEventLogs` remains unchanged. Only records collected after the updated connector is deployed and reconnected include `AdditionalFields.WorkdayDomain`." + } + }, + { + "type": "Markdown", + "parameters": { + "content": "Use the following query to summarize Workday logs by environment. Historical records without an environment value are grouped as `Unknown - record collected before environment tracking`.\n\n```kusto\nASimAuditEventLogs\n| where EventProduct == \"Workday\"\n| extend WorkdayDomain = tostring(AdditionalFields.WorkdayDomain)\n| extend WorkdayEnvironment = iff(isempty(WorkdayDomain), \"Unknown - record collected before environment tracking\", WorkdayDomain)\n| summarize EventCount = count() by WorkdayEnvironment\n```" + } + } + ] + }, { "title": "Connect Workday to Microsoft Sentinel", "description": "1) In Workday, access the \"Edit Tenant Setup - Security\" task, verify \"OAuth 2.0 Settings\" section, make sure that the \"OAuth 2.0 Clients Enabled\" check box is ticked. \n2) In Workday, access the \"Edit Tenant Setup - System\" task, verify \"User Activity Logging\" section, make sure that the \"Enable User Activity Logging\" check box is ticked. \n3) In Workday, access the \"Register API Client\" task.\n4) Define the Client Name, select the \"Client Grant Type\": \"Authorization Code Grant\" and then select \"Access Token Type\": \"Bearer\"\n5) Enter the \"Redirection URI\" found in the form below \n6) In section \"Scope (Functional Areas)\", select the appropriate scope for the user activity and click OK at the bottom select \"System\" and click OK at the bottom \n7) Copy the Client ID and Client Secret before navigating away from the page, and store it securely. \n8) In Sentinel, in the connector page - provide required Token, Authorization and User Activity Endpoints, along with Client ID and Client Secret from previous step. Then click \"Connect\". \n9) A Workday pop up will appear to complete the OAuth2 authentication and authorization of the API client. Here you need to provide credentials for Workday account with \"System Auditing\" permissions in Workday (can be either Workday account or Integration System User). \n10) Once that's complete, the message will be displayed to authorize your API client \n", diff --git a/Solutions/Workday/Data Connectors/Workday_ccp/Workday_PollingConfig.json b/Solutions/Workday/Data Connectors/Workday_ccp/Workday_PollingConfig.json index d1f574b5d55..87d06067c04 100644 --- a/Solutions/Workday/Data Connectors/Workday_ccp/Workday_PollingConfig.json +++ b/Solutions/Workday/Data Connectors/Workday_ccp/Workday_PollingConfig.json @@ -63,6 +63,7 @@ "addOnAttributes": { "friendlyName": "[[parameters('friendlyName')]", "tenantHost": "[[first(split(replace(replace(parameters('apiEndpoint'),'https://',''),'http://',''),'/'))]", + "apiEndpoint": "[[parameters('apiEndpoint')]", "dataType": "WorkdayUserActivity" } } diff --git a/Solutions/Workday/Data/Solution_Workday.json b/Solutions/Workday/Data/Solution_Workday.json index ac6cfd64c49..edbe530ec11 100644 --- a/Solutions/Workday/Data/Solution_Workday.json +++ b/Solutions/Workday/Data/Solution_Workday.json @@ -7,7 +7,7 @@ "Data Connectors/Workday_ccp/Workday_DataConnectorDefinition.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Workday\\", - "Version": "3.2.0", + "Version": "3.2.1", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false diff --git a/Solutions/Workday/Package/3.2.1.zip b/Solutions/Workday/Package/3.2.1.zip new file mode 100644 index 0000000000000000000000000000000000000000..f790ad4becddeae2acd6d9dc4b659ab5b9c5c3c9 GIT binary patch literal 9744 zcmZ{qV~i$1w5Gdz+C4pO+qP}nw(YNN+qN-n+cu|d+n)Y<=ibd`_ukE|s-#jUsZ&2r zC2#V)M^WYnI4TGT2sDV8p}HPWadWc_5(LBx83Y95U)03e%*fSD%}UhF+{)g{)yl!1 z-rB{%zD0B2esdfNNI-bYXb3BbD!TYfu^BOoM)%YUqyHQ$(nW~qeJlz$QHR0ZlSgEt zGbfN=hM-14`6>xjN(Qh5@?|2qwLi_#wClt2ke)mCO&p+GxBiC41~h^qR#l# z44uyuzBKMhuVgc2$2IWS{ee((k4`65oO@5H>8%SxBW>D@O1l^B4USkM?qIqj00K?w zo7M-L4FR_XEygL3Qw=fUde`coK~$=)z9kM!rgb6A?$yGpG8v(tCBt~`ByX-kiKl(+KMCuZ0(`o2ObQp3a}vhyh%Fwz*0V9TO~8xnB8BnW4WxIiWcqv_q7y zjAHA%m(0tBkXMH059Ei*$d~vpz6`y@og@`+~-27oZg*+C&38%k)LdT*yNd!f+T=Q#D6?x|unKCUP)# zf(cnOR1Rz%!`!+kLD84)e4WcFW;JBD5|~oV%1Qg;%TdX(s**qlRZQc`$6?}z3R7aY zuve#nQZF^F4zzRr^*jnL=adNai_{61%16eRt;`wz^Pe>vJc@i9II?hdDHCMK%OUH= z>^9QWm30`=Jfw&TMxopyxigFOoNq8nYTpy&Nhegwh1Zeu$KN*b;jy2#8 zF?2>=o}PFw>4l1#cC=}1(#;zo0Zud`dI;R5(P6CrcC)Q)2_id3-U zn{7+Bg5dz9CjsT4HQ35bd5&M^0&r@@Jn(6y6=m>5<#OJ#6o-%*A@_eW=L%ck_GjGp z(lm(JT)w01IB2wCwtR>bzCy4 zgWjp{B<1t@Wd|LnuhKRbjRDn2Ls8F3tgP0NfXzxMCiQPM-kd7@F#25crQ!u1W^J0p z{aDlZ6D=84KYKj6&aogr>~+s!k2#6QlL=t^fHyFj`FwkUW|ZR#X$9MzUR>f$p1SL6 zT?#)a_;_vkM$(?+Mt$@Cf@fP=Bf7ZeqV8ra$0mz0tS=i|x$rCFL!AMhxN;lc&sjl$ z)$%6>j`-(tU0H{W4awuiwIH|6>*q=MXmR!G=Kyu~Dl-cAbF@`c{?qUJP36M{S3Kwg z6McU=3}Uk9?f36&IQsF*U?U4$yI49&4RnJ>afP@S(%aHj=eN3u>5?bQO22OTHk+nL zT(>*|9zT!TwXgKea@C<_-4zqE8w(ZIwfUf9aqWY14%o)|%;W_Jv|}!yGMv~pj=oyg z9aOu#k;KI{TKkkyN$=1$izdLJj3n7lo;w?5p|j!E=Hu>RWM~TG8&vVXNE_XrpSdkQ z2uSAv2nf@aQ`W4*S??5TkMUm-#RU~0Yz=rq^r85T(f!Y#H&iC zV}BwUqDU$HJ#?8wjm_(cK_Nld)EjF*@{YZmA4$uxG4#zPe@$d2wlt(rOAv$BcP&`5 zV#g8y|9Wqw4$%CmbspF@0abG`8qgP`hy1NnC# zLpncAU=pH8L@ovh9r1;L7ic1d?P2h&G-*Y4Hv@bY zXSiP|dbd4#Di$^{Cuw+T#zOI>+!_Y920jLs8 zX~;%M@F|_bQIetjy^RD|IddM!kii_f@P35B>6+mD2$FYB5%YE6O5|t*pv_UsF$M81 z^tGljzRZrMexi?9&lVBVsE9&!QUT;a5}j|qNmA737en*sPB2I;L%NU2vnSk@5^6@C zcTT6rtjpcS%d{ytnX#iwR8Uqqkl`UEk>_FOvG(SWqDf&Q5&E7#GXGpXZGG?`0%#v*61dMlmdyLT@r9DcuQaq1fHM z2-nMz(tVJSRsz^sG}ch_pKaTo$rEP1&-AvTnpJpM;i}h1I-Bcwiv{ssBsJuA9n)!JEdS9T>A@m zhVA)jju7%-9_1DUR++3W3;kbQj$%-cRdpHS52O|j53c3KPt(?^HD@VTq-*D9L7q4$ zg%bR~6f#PdGLwp3wUE158i4t7iB9bgg%b2G8M%G zGrn@VYFpde_P}rYT)of<{)bEyV;lcdpFDYVxd5A2+0Ov+~A#Vo`hTM;+6c()s z+ge$Z-X+Mk$vU8PqJj#4bJLUy`f!eLEErRd(hl^vk`wY|-w#*`h|5k*uZfUL>V~~l zRzl%8%Bna-kHs%ea0!*Sp`1b6y8)CfG=ybQCdqvM+w;1m&Oz zAgOMbJfVp#PX2iU{Ju0Fbut2*c~9E;RE|<{XDPSxii(ASJJLye4)p`(`6!1Bq&I3A zQV9HDz0S|V`d4N)V%N#|FB;yJYt>4_*~7mHPUvv>D20}OVXF+bLsLseG$^?!#1V;; zoWmS&EPP%Rk%AJvMXRdY1-Uj+3rq--k|m;6O=l8_2+-zj^JS%v6qBr_a}UF4u;Lla z>UwUa; zl&n(OV$1@!VmP%PQfo)a?Di(B?wp9x;?D>O8w(Lve6AJ@b;L5+<>z#GR;NPyg`LHMGON=}!GM7N7T)Sq;bIh&p|Ipa1yqI=Z1x z_=y*z97(kKs4PM4gL^20EzC56WTq04g!;ShK*cHzc(ZhN_C)&0JDiCuz9JV0Erpgy z(uIpFXDL|%bZ0zNR$_;Um)*~Zql6nT-=c4^BjVul81=15TFp9XV%&ClYSOojgLTHb}#!IM1zZM1bcuI@s{GRu?jztf~m)_ zTAZL@Cig5u3!~`wgAO-$>5LMl!pl!CBM6Au4w%e{k>%LJ68=iTVI#S&F@HbpnD7@#hBzSUJ}9ty*M7A9?<%6snQX zHz6Bt(G-s88XH>9K*~nyKIC6vqU#ZexEu>yT?p3*)Hb-*V#0ZKq;LUcWJqUC%8stB z;l~(P*N8LIMiH_|W49)i>U9Z|Tf8n~pV@g3@n0CA4>OCA;Acs)?S!5}gk<&pV(YF~ z&kM|G%xEAOyg^COBa|a>pMeprcw5DM1tO^X3Osk0aD)9igrE^?tfFLx^*ROiu94gDxFGO%zQQ1IG?Wjp zp1HJiZF7af+Qui(t)lkgvu3IIHEx%^8SkJJ$*N^yJ3OdZ*r2ZUdO63eC(@FY#!k!g zf(lP1etkn#8v}j73cm%;6vbrm5=w|~{6+>?{On!JI`VSV6L{{fq!@9{6062l5@C~t%y)p)4WtpI z&)I~v{L1vo5+JA1%8&AAPpjV2U~~U$nPhWZ4h^z<*6bpg@(xr1sK+6SwMN9s!Z+G` zf5vUbX}$|a&`UTkW|(EDh$6 zA1PoUQ9sQEVNs-4C}d9{BiBJ`byK_)0oPeo##TN}9V{(<(efEK)ed|Xe2Akvj{(%KLYU_Bjnc-fg7y?9S45%5 zY6N;HLKGa9S6Jz9hV4*h17#Bp;Ux`jzNkWPvgCvEnkPTB&<<}HR=Z`dm4~qpMrdHzj|!_M(O3nl3bB|kNY}1x&kZ9(JM1vd zx1mfjuLi-?>wL3iEN~he^r81~jpa>lVX(a=0DMM`w}x3g2Y+VVi(D8Kwh0hzYNYE@ z;hSBRdMT=SOanWj<2-H6y=j({EjpvVE^*5|j<1-8R$Z-oI=Ol$bfYj8qzqPrsRH|j z6$bl>_Tedq{jEIP2R7W9r>@)gsDysB-6zpA%iTUHHJI$Ph{eh_$$UVE=g7@~HO3Li zb?nd{MT#mXYBE@6qOGiD<~Be*`L{*KDgQuy#3W(SHn4aCO3j?Im}J&=)qn52NrZtX6TYk@XRJ`uG*joS&tu%hKhipfO`o zhbUZhUN6eSZ(a{gp*l0}?4nzMQZ~LU+P-CsJKPJ0yuQ0B=8)+&=FM!@SBDif{V_Lw zmPFWf?0_k)@zq~8&J;g-#n2?~`*!DMuHczP7V9gp5IH!gjlxJ~%kA2t#qk3!?g z(`=gBfyM9RVRJdVnf+{V84|5ZBh&bZJ=`8t5KjnZN1Ggpm_{pW&%&%6GunsPY#!d+ z^CHF>SLko^kH*y6&7K+|mr`}C%LA1po$Q*O3PV{}xu&!+4+uS`;!=>Gn3Y6-Q3N5Q zhmfoHR2_GYsA;_9=xh34kfmD>(Nb?W+P}##RsWi_HPY6z3CJH`lBz!Gerf=+_oG80U1iUbxkqAb7k&EE@M7zCMD#jhi(U;F zB4@7!V1sfZ_4)9Q{{Xzons8udbP^_x7r~V7|6(tYUz{Z)e~~L8k<3Ob^K5JG)U+aO zz@Mb-64a9t{+^bwWG%oTACrCBfSWp|J2oE`hv&#A)?u>EXx#?wDo+2ag5st9+c#6# zqH4{j(Ir33^%)D{8qgreI=|B^NTGz=YB|+V*E4ytvK3}zByXqxg&mG+{0a|n#<1>m z)A{kaW^8P!X8Sz7F7_?I7P1L3)ao{0LnwO%x;X?59gJ-~WDa;YoRK%v%E06E@jxC( zq@7+K3Rf_k2?OKKLr?4*ns4Fwb))LQdoej$%ri3DrnmmqiiRT>U8~KZ&J$)%mdP@0 z%8B=~0My56+M3w^$TII!i6EASX1{IcyU2j<84xVFVE(aTE+5Is61z3w>F8hgiR)ZG z`Z;hod-8gpYkcH%iXWKe9+Bt|xIwD$498sG)v-v}nmH$(y~@p2cmXc5Oxj6=$@T_p zI^N)8cmbsd?k|d;VvO%B1&cXxC5dY*6^{J&n+tCJv7Oeq`7pn%(ykC!-g%V;=dMFj zo=&+P{Rvb)4zhG)i`I%DF`ilrs?Yy?UsKr?FIEgGHO zROMPd{bLh9p_*OF8>27uNzc$z`O99bdSTR7BXtFw6T!0VWY*;%m!+?TG3Qs1^vt=2FF<;W(~be=u<-N|+%u8L${3ZQ^S*yrEP$A8;t zep?y>tE#w}IFGuLEG5^21ct1DO=(4HcLJsLMUb|rmiCe{BlLFi@Z2ZFCvI9C@PSGg z)KnWkpD9bOsBa549DYXcT8{S&G?7f#u@W+-{1Gf%8wb&Jkkq-G?o7)i=V{UuoxZ!7 z+{(zkwdEx92E*%>}M`SJLv{g5$swpkqw4iHiC42kD{3y0vms7hL4+8_sC*JA@2vJ(AS zf<;Byjpw{Kzr4_l&Uw*FN)pK*;DYSqsVr!71BR!ZPszddbzmql@VdZ;8h_lG?Q(}1+nTVAi7OVmG;so$fp%qcX#AN4agZ=5A(A{CY1N+X} zb66N1uMrxMpAC?STJ|=TANBL_WlaCP>@+NG9Dx1CeDEZjQ*&u^g0VimK{hBTa;Fik zUvpV8s7hBf`{Y$}Dw<`ZfiQ5K$Mv660b_wVMfCsJu6B3bJuyUttM?42KZVSDftMfX z7!>~2dwJl3OVhVP?bE#TM>2p1UvPIn8#HV~P+G8mLGl7z=UXN_WoXCo^ZKOahH_5- z?EAXY5h_pFzr%z7^*r#DToAvQ5aF5P()Cf#HUMF(48j*)!Pv0gc4`k4kmU>H_o`I= zJNr%<{t?p#RCBR1dwW6lm?>1m*5P$6=W1WOE{6NMqKs1rI!@2&kI);& zjqB;z2d-V>ytv)Q^|U!EVo~#Uy&x>rUKfi&rw_^Se$kBrSL8pif=|HQTmar2C@xi^ z0a<}$>l1t+JF|HNd^p~|f}s6E(k?H+)u!a=)6Rabg+{5$m53a9v**J1psH+n$^tH!=crkBgJ^AT}&vyrMKHy$KBieoz($vgTTjLT-U3B%N?XSUmVVx5vy9t zNHmY@siHMP{!etLb&avaw!l8W_^w`~t!M6;ngNZv9X89xyskse3pZw~u=HNqyt215 zx82$?A%jSN{Xp+tM->ISSx*w5$Hndd`29==n6YjYKTnaZ2X>F+-%gVn2gw}$WCoEE zz19d$Ow%gi9QtMOmwVCQD^4RAVtOp98bAC~)(Yu4_uIk{c0e|YeYRLfG;LDo-t(hB zx1rr@j9C3c3v3#KvLoN|`#%3Int|KiXp8N$z5&+;sYui^}M>FeNR9cXhbML}}@apUsJb^6T_tFcWt;z*}^ zF>|2g5ELlhzLY(jZST!zLZW*f=CPPcU=>BslURB#-F;v_R8NHOs)KuW^EQ_~;JX98 z<3f{j+BvX@wCZ{2F>^J088tauAupab6ifzDD`#dLhO%$N@M$o_5Y`VJo_FtmA?%Rba$3%sBP zEm6)XW^*6IA#b{M&^AP&+le{*0I_X|V23kP&M9njAI>3Xx{P!1`Yu?bsIMB*V~bSY zktckw&hU73^ivP&)IIv8mnqLd26uNxr?TvgzU5?=04Yalv6n&eXUe&(8^>mJD zYUiM8i!0$p&s;^IZdM_aZxIY0aIK#(q-kC<&dTO1OY_Fi&R=Ukhl?!pvcG>k!&CKUB35 zGu_;OvgHQ}-gLW{;(;BGV|H(mWJNOUC=!HGE2Rr~BvpP}F!v$K-#$}Ou%1w52;osC zjz;JfvE5qJSZN3|gd*&0r2Wylyc1pY&Jo48K^KY2q(dWS84_3|#5|GP5mB&TyQosYMh%l^CpNq6 zz|Kl?-wsXDb(+C4>(&TF#liKz@)KNlVqC+DSZp)*Ie|ZYFXr*5wbAIF()OzriYS#B zXJh1aY~@IagjhAq8y4nPzz(o0?Ncpbu?*!ts`$-paXM4x9Ib?n?8IfI3DLoJtCMCQ z(ri$`ux*!HNs8N{=0ifzx*#{t${yOCQH*iKOWK58>2KB|mOD9**`Zkn*zEAsRX99c zSli_qZO3oz6V=yx0xR$07ARl`h8U!@;9VszfTrfd(b6Vn~P`(B07uL zHg-EYZmKTVG4Wf=s;+r6weiyG$uBZFGU1NClJjWY#pdR%iu_G$+6I=9o+zf>%VM-Y z?QJoaiz09p6YrysaH%^t^wt2EoqzQm_+vjyqg`vaW9lki!X0%^MN1}@juT_puU0gV z#$Jg)okD-w;dKi)-A;FQ(Y1xXHMRJ0V&{g#0L~t8CLvIP?WpiHL_!q42?R>Da z>SNQ4|4dlMqe0TmX5{)L6ySVgD&keuL8BL;)~21XA`=w+F_axJjB#0a!1;?VV+;Bq zF;xQlT9-$%i%H{t$&f!EVGr|*5Q)fWzH$mQ=^`e^x$sPct6Xljh@9PdmsA9 zNsz{`wgY0fhPlS{6+VctZ#E^CT8YExQw+3Yko7&Z*ou$$CtUQO-p3=(NNFf9S=cVm z__dbfDrqz;o4$Rog-P5(DeVghqB|&072Q9#CPz@*24_KCXaeFqRfV=~@#Jg^1^PJD z(JUCAL$TRabt)fG2A^NpmX}8Slz;-X>CRc$`MjnF>c(N|A=#0#z5& zDxs()#k72gx2>wIB*&={M7EVt2Xb{$sG_4e6Hx(lK43ZE?*d8x=$<(n1!1@U*^j@a zyy+HB-iEIAfAV2-smQoSxx;It3?DbNI@^*Xt0({cB0rd_Q*etsRs5R#B$sh2I=nKO zg~^YB3v3y*-9*HoZA+Nz)H?332zw*pP*oo0UzHn3qUD`s z-*q`~pL}gw=g;0Zb60grYPg0ZDE9gsH80&$IN!f)YX0UMoXT+-$NqMn{J}_fJME-} zZ?K@pbxHBq&YED~!JE5eLY*w>EbPU~i-~SesxRMo`3LEEf=o=#(S4d$aFRhp?`2_< zwv+c|QU>kZw)6I|d{>5yGn?Oc2+i~1YaAFVF9J4BA0!KM{s*L3;XgPIp|GZ{(lvG% z5${3(`i7yOs0`ZO1YfwM0UVF%XXv zC@zi2996F>8k4hkJPvE;D$d%`AB-zLu;y)@Pxy8AiR7nUa4u}HkGPN1U#vq8X|QiZ zDzWIdl}N|-hdPy+$oYzoZT$C%!W&r5x>^PpWOgEE>UiRY#C@Y+u^HDd6=qOHzs$yW zAAQaork6ZzEK68r&>#I{jcJ5~PmWN{xwuz~6NxByQz{;bQI}qd#DObj#J>1qFvS;T zf>k9^GvPl_ks%Ap14hH2B=UPZMva@L|B}lzw1(;ixVOsVV({(gpc9# zLZ2@k17Ts%t1-{;kk}=UBq`!b4-HKd^dL{l!h|mJ1?v0Y_e>WBXU6;6*2T0kK~2*J zvMjIo=qC8MTO1Z<@9)oRug4O=CP?tnKUGAU%!n3q7B=QSdaY$`;&4SwZqI4<@WdEl z@5vNYBl9j3pBwVvrVG>lr!_|H60gh3T#xLXS!ebV#_39 z1t`!1Pen{-iPDU4s#>r9RQ&TA>~lguc7F={zEBp;W{)jbOks#|X=71a9)h_+4 zigwm`#)z&sX~^2;jB^92&0w0lG2TAE+!`O{Z+)=)=Z>o)7V4% zoB+v46}{^&ruEX<`~B1|+{(H(_#W_34ft{zD(l(Tc6oij_5b|)+V@4EC<6+H3i3bq xUH$W?|DW+cbYcDXB>&yv{=XSE|Fv}ee}1>348*@M2ng7}8S-xjkp0K$e*ygm(q;ev literal 0 HcmV?d00001 diff --git a/Solutions/Workday/Package/mainTemplate.json b/Solutions/Workday/Package/mainTemplate.json index 12d06bf3a3b..9b23785f2f8 100644 --- a/Solutions/Workday/Package/mainTemplate.json +++ b/Solutions/Workday/Package/mainTemplate.json @@ -47,11 +47,11 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Workday", - "_solutionVersion": "3.2.0", + "_solutionVersion": "3.2.1", "solutionId": "azuresentinel.azure-sentinel-solution-workday", "_solutionId": "[variables('solutionId')]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "dataConnectorCCPVersion": "3.2.0", + "dataConnectorCCPVersion": "3.2.1", "_dataConnectorContentIdConnectorDefinition1": "WorkdayCCPDefinition", "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]", "_dataConnectorContentIdConnections1": "WorkdayCCPDefinitionConnections", @@ -102,6 +102,10 @@ { "description": "Get a sample of Workday User Activity logs", "query": "ASimAuditEventLogs\n | where EventProduct == \"Workday\" | take 10" + }, + { + "description": "Summarize Workday User Activity logs by environment", + "query": "ASimAuditEventLogs\n| where EventProduct == \"Workday\"\n| extend WorkdayDomain = tostring(AdditionalFields.WorkdayDomain)\n| extend WorkdayEnvironment = iff(isempty(WorkdayDomain), \"Unknown - record collected before environment tracking\", WorkdayDomain)\n| summarize EventCount = count() by WorkdayEnvironment" } ], "dataTypes": [ @@ -142,6 +146,31 @@ ] }, "instructionSteps": [ + { + "title": "Environment identification", + "description": "Understand how Workday environments are identified in collected records", + "instructions": [ + { + "type": "MessageBar", + "parameters": { + "text": "Only records collected after this connector update include the Workday environment in `AdditionalFields.WorkdayDomain`. Existing records are not updated.", + "type": "warning" + } + }, + { + "type": "Markdown", + "parameters": { + "content": "### Updating an existing connector\n\nBefore deploying this updated template in a workspace that already has the Workday connector installed:\n\n1. Disconnect all existing Workday connector connections.\n2. Remove the existing Workday connector connections from **Data connectors**.\n3. Remove the installed Workday solution from **Content hub**.\n4. Delete the existing `workdayDCR` data collection rule from the workspace resource group.\n5. Deploy the updated connector template.\n6. Recreate and reconnect each Workday connection.\n\nExisting data in `ASimAuditEventLogs` remains unchanged. Only records collected after the updated connector is deployed and reconnected include `AdditionalFields.WorkdayDomain`." + } + }, + { + "type": "Markdown", + "parameters": { + "content": "Use the following query to summarize Workday logs by environment. Historical records without an environment value are grouped as `Unknown - record collected before environment tracking`.\n\n```kusto\nASimAuditEventLogs\n| where EventProduct == \"Workday\"\n| extend WorkdayDomain = tostring(AdditionalFields.WorkdayDomain)\n| extend WorkdayEnvironment = iff(isempty(WorkdayDomain), \"Unknown - record collected before environment tracking\", WorkdayDomain)\n| summarize EventCount = count() by WorkdayEnvironment\n```" + } + } + ] + }, { "title": "Connect Workday to Microsoft Sentinel", "description": "1) In Workday, access the \"Edit Tenant Setup - Security\" task, verify \"OAuth 2.0 Settings\" section, make sure that the \"OAuth 2.0 Clients Enabled\" check box is ticked. \n2) In Workday, access the \"Edit Tenant Setup - System\" task, verify \"User Activity Logging\" section, make sure that the \"Enable User Activity Logging\" check box is ticked. \n3) In Workday, access the \"Register API Client\" task.\n4) Define the Client Name, select the \"Client Grant Type\": \"Authorization Code Grant\" and then select \"Access Token Type\": \"Bearer\"\n5) Enter the \"Redirection URI\" found in the form below \n6) In section \"Scope (Functional Areas)\", select the appropriate scope for the user activity and click OK at the bottom select \"System\" and click OK at the bottom \n7) Copy the Client ID and Client Secret before navigating away from the page, and store it securely. \n8) In Sentinel, in the connector page - provide required Token, Authorization and User Activity Endpoints, along with Client ID and Client Secret from previous step. Then click \"Connect\". \n9) A Workday pop up will appear to complete the OAuth2 authentication and authorization of the API client. Here you need to provide credentials for Workday account with \"System Auditing\" permissions in Workday (can be either Workday account or Integration System User). \n10) Once that's complete, the message will be displayed to authorize your API client \n", @@ -424,6 +453,10 @@ { "name": "ipAddress", "type": "string" + }, + { + "name": "apiEndpoint", + "type": "string" } ] } @@ -445,7 +478,7 @@ "clv2ws1" ], "outputStream": "Microsoft-ASimAuditEventLogs", - "transformKql": "source\n| extend TimeGenerated= requestTime, EventStartTime= requestTime, EventEndTime= requestTime\n | project-rename EventType= activityAction, DvcIpAddr=ipAddress, DvcDescription=deviceType, EventOriginalUid= taskId, Operation= taskDisplayName, ActorUsername= systemAccount, ActorSessionId=sessionId, HttpUserAgent= userAgent\n | extend Object= tostring(target.descriptor), TargetAppId= tostring(target.id), TargetUrl= tostring(target.href), EventCount= toint(1), EventSchema= \"AuditEvent\", EventResult= \"NA\", EventProduct=\"Workday\", EventVendor=\"Workday\", EventSchemaVersion=\"0.1\",ObjectType=\"Other\", Dvc=DvcIpAddr | extend EventType = case(EventType == \"READ\",\"Read\", EventType == \"WRITE\",\"Set\", \"Other\")\n| project-away requestTime, target, EventSchema, Dvc " + "transformKql": "source\n| extend TimeGenerated= requestTime, EventStartTime= requestTime, EventEndTime= requestTime\n | project-rename EventType= activityAction, DvcIpAddr=ipAddress, DvcDescription=deviceType, EventOriginalUid= taskId, Operation= taskDisplayName, ActorUsername= systemAccount, ActorSessionId=sessionId, HttpUserAgent= userAgent\n | extend Object= tostring(target.descriptor), TargetAppId= tostring(target.id), TargetUrl= tostring(target.href), EventCount= toint(1), EventSchema= \"AuditEvent\", EventResult= \"NA\", EventProduct=\"Workday\", EventVendor=\"Workday\", EventSchemaVersion=\"0.1\",ObjectType=\"Other\", Dvc=DvcIpAddr, AdditionalFields=bag_pack(\"WorkdayDomain\", apiEndpoint) | extend EventType = case(EventType == \"READ\",\"Read\", EventType == \"WRITE\",\"Set\", \"Other\")\n| project-away requestTime, target, apiEndpoint, EventSchema, Dvc " } ] } @@ -484,6 +517,10 @@ { "description": "Get a sample of Workday User Activity logs", "query": "ASimAuditEventLogs\n | where EventProduct == \"Workday\" | take 10" + }, + { + "description": "Summarize Workday User Activity logs by environment", + "query": "ASimAuditEventLogs\n| where EventProduct == \"Workday\"\n| extend WorkdayDomain = tostring(AdditionalFields.WorkdayDomain)\n| extend WorkdayEnvironment = iff(isempty(WorkdayDomain), \"Unknown - record collected before environment tracking\", WorkdayDomain)\n| summarize EventCount = count() by WorkdayEnvironment" } ], "dataTypes": [ @@ -524,6 +561,31 @@ ] }, "instructionSteps": [ + { + "title": "Environment identification", + "description": "Understand how Workday environments are identified in collected records", + "instructions": [ + { + "type": "MessageBar", + "parameters": { + "text": "Only records collected after this connector update include the Workday environment in `AdditionalFields.WorkdayDomain`. Existing records are not updated.", + "type": "warning" + } + }, + { + "type": "Markdown", + "parameters": { + "content": "### Updating an existing connector\n\nBefore deploying this updated template in a workspace that already has the Workday connector installed:\n\n1. Disconnect all existing Workday connector connections.\n2. Remove the existing Workday connector connections from **Data connectors**.\n3. Remove the installed Workday solution from **Content hub**.\n4. Delete the existing `workdayDCR` data collection rule from the workspace resource group.\n5. Deploy the updated connector template.\n6. Recreate and reconnect each Workday connection.\n\nExisting data in `ASimAuditEventLogs` remains unchanged. Only records collected after the updated connector is deployed and reconnected include `AdditionalFields.WorkdayDomain`." + } + }, + { + "type": "Markdown", + "parameters": { + "content": "Use the following query to summarize Workday logs by environment. Historical records without an environment value are grouped as `Unknown - record collected before environment tracking`.\n\n```kusto\nASimAuditEventLogs\n| where EventProduct == \"Workday\"\n| extend WorkdayDomain = tostring(AdditionalFields.WorkdayDomain)\n| extend WorkdayEnvironment = iff(isempty(WorkdayDomain), \"Unknown - record collected before environment tracking\", WorkdayDomain)\n| summarize EventCount = count() by WorkdayEnvironment\n```" + } + } + ] + }, { "title": "Connect Workday to Microsoft Sentinel", "description": "1) In Workday, access the \"Edit Tenant Setup - Security\" task, verify \"OAuth 2.0 Settings\" section, make sure that the \"OAuth 2.0 Clients Enabled\" check box is ticked. \n2) In Workday, access the \"Edit Tenant Setup - System\" task, verify \"User Activity Logging\" section, make sure that the \"Enable User Activity Logging\" check box is ticked. \n3) In Workday, access the \"Register API Client\" task.\n4) Define the Client Name, select the \"Client Grant Type\": \"Authorization Code Grant\" and then select \"Access Token Type\": \"Bearer\"\n5) Enter the \"Redirection URI\" found in the form below \n6) In section \"Scope (Functional Areas)\", select the appropriate scope for the user activity and click OK at the bottom select \"System\" and click OK at the bottom \n7) Copy the Client ID and Client Secret before navigating away from the page, and store it securely. \n8) In Sentinel, in the connector page - provide required Token, Authorization and User Activity Endpoints, along with Client ID and Client Secret from previous step. Then click \"Connect\". \n9) A Workday pop up will appear to complete the OAuth2 authentication and authorization of the API client. Here you need to provide credentials for Workday account with \"System Auditing\" permissions in Workday (can be either Workday account or Integration System User). \n10) Once that's complete, the message will be displayed to authorize your API client \n", @@ -940,6 +1002,7 @@ "addOnAttributes": { "friendlyName": "[[parameters('friendlyName')]", "tenantHost": "[[first(split(replace(replace(parameters('apiEndpoint'),'https://',''),'http://',''),'/'))]", + "apiEndpoint": "[[parameters('apiEndpoint')]", "dataType": "WorkdayUserActivity" } } @@ -960,7 +1023,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.2.0", + "version": "3.2.1", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Workday", diff --git a/Solutions/Workday/ReleaseNotes.md b/Solutions/Workday/ReleaseNotes.md index 7e2bf71f1de..a6be5f109fc 100644 --- a/Solutions/Workday/ReleaseNotes.md +++ b/Solutions/Workday/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|--------------------------------------------------------------| +| 3.2.1 | 22-10-2026 | Updated the Workday Data Connector to distinguish multi-instance logs using the source API endpoint in AdditionalFields.WorkdayDomain; added an environment summary query and upgrade guidance. | | 3.2.0 | 07-10-2026 | Added multi-instance support for the Workday **Data Connector**. | | 3.1.0 | 18-08-2026 | Added support for a configurable page size for the Workday data connector and aliases and grid management. | | 3.0.3 | 23-12-2025 | Updated page size for the Workday **Data connector** and configure the query window + updated **Data Connector** to support dynamic Redirect URI|