[Workday] Identify source environments in collected audit logs

Solutions/Workday/Data Connectors/Workday_ccp/Workday_DCR.json

@@ -47,6 +47,10 @@
           {
             "name": "ipAddress",
             "type": "string"
+          },
+          {
+            "name": "apiEndpoint",
+            "type": "string"
           }
         ]
       }
@@ -68,7 +72,7 @@
           "clv2ws1"
         ],
         "outputStream": "Microsoft-ASimAuditEventLogs",
-        "transformKql": "source\n| extend TimeGenerated= requestTime, EventStartTime= requestTime, EventEndTime= requestTime\n | project-rename EventType= activityAction,  DvcIpAddr=ipAddress, DvcDescription=deviceType, EventOriginalUid= taskId, Operation= taskDisplayName, ActorUsername= systemAccount, ActorSessionId=sessionId, HttpUserAgent= userAgent\n | extend Object= tostring(target.descriptor), TargetAppId= tostring(target.id), TargetUrl= tostring(target.href), EventCount= toint(1), EventSchema= \"AuditEvent\", EventResult= \"NA\", EventProduct=\"Workday\", EventVendor=\"Workday\", EventSchemaVersion=\"0.1\",ObjectType=\"Other\", Dvc=DvcIpAddr | extend EventType = case(EventType == \"READ\",\"Read\", EventType == \"WRITE\",\"Set\", \"Other\")\n| project-away requestTime, target, EventSchema, Dvc "
+        "transformKql": "source\n| extend TimeGenerated= requestTime, EventStartTime= requestTime, EventEndTime= requestTime\n | project-rename EventType= activityAction,  DvcIpAddr=ipAddress, DvcDescription=deviceType, EventOriginalUid= taskId, Operation= taskDisplayName, ActorUsername= systemAccount, ActorSessionId=sessionId, HttpUserAgent= userAgent\n | extend Object= tostring(target.descriptor), TargetAppId= tostring(target.id), TargetUrl= tostring(target.href), EventCount= toint(1), EventSchema= \"AuditEvent\", EventResult= \"NA\", EventProduct=\"Workday\", EventVendor=\"Workday\", EventSchemaVersion=\"0.1\",ObjectType=\"Other\", Dvc=DvcIpAddr, AdditionalFields=bag_pack(\"WorkdayDomain\", apiEndpoint) | extend EventType = case(EventType == \"READ\",\"Read\", EventType == \"WRITE\",\"Set\", \"Other\")\n| project-away requestTime, target, apiEndpoint, EventSchema, Dvc "
       }
     ]
   }

Solutions/Workday/Data Connectors/Workday_ccp/Workday_DataConnectorDefinition.json

@@ -21,6 +21,10 @@
         {
           "description": "Get a sample of Workday User Activity logs",
           "query": "ASimAuditEventLogs\n | where EventProduct == \"Workday\" | take 10"
+        },
+        {
+          "description": "Summarize Workday User Activity logs by environment",
+          "query": "ASimAuditEventLogs\n| where EventProduct == \"Workday\"\n| extend WorkdayDomain = tostring(AdditionalFields.WorkdayDomain)\n| extend WorkdayEnvironment = iff(isempty(WorkdayDomain), \"Unknown - record collected before environment tracking\", WorkdayDomain)\n| summarize EventCount = count() by WorkdayEnvironment"
         }
       ],
       "dataTypes": [
@@ -61,6 +65,31 @@
         ]
       },
       "instructionSteps": [
+        {
+          "title": "Environment identification",
+          "description": "Understand how Workday environments are identified in collected records",
+          "instructions": [
+            {
+              "type": "MessageBar",
+              "parameters": {
+                "text": "Only records collected after this connector update include the Workday environment in `AdditionalFields.WorkdayDomain`. Existing records are not updated.",
+                "type": "warning"
+              }
+            },
+            {
+              "type": "Markdown",
+              "parameters": {
+                "content": "### Updating an existing connector\n\nBefore deploying this updated template in a workspace that already has the Workday connector installed:\n\n1. Disconnect all existing Workday connector connections.\n2. Remove the existing Workday connector connections from **Data connectors**.\n3. Remove the installed Workday solution from **Content hub**.\n4. Delete the existing `workdayDCR` data collection rule from the workspace resource group.\n5. Deploy the updated connector template.\n6. Recreate and reconnect each Workday connection.\n\nExisting data in `ASimAuditEventLogs` remains unchanged. Only records collected after the updated connector is deployed and reconnected include `AdditionalFields.WorkdayDomain`."
+              }
+            },
+            {
+              "type": "Markdown",
+              "parameters": {
+                "content": "Use the following query to summarize Workday logs by environment. Historical records without an environment value are grouped as `Unknown - record collected before environment tracking`.\n\n```kusto\nASimAuditEventLogs\n| where EventProduct == \"Workday\"\n| extend WorkdayDomain = tostring(AdditionalFields.WorkdayDomain)\n| extend WorkdayEnvironment = iff(isempty(WorkdayDomain), \"Unknown - record collected before environment tracking\", WorkdayDomain)\n| summarize EventCount = count() by WorkdayEnvironment\n```"
+              }
+            }
+          ]
+        },
         {
           "title": "Connect Workday to Microsoft Sentinel",
           "description": "1) In Workday, access the \"Edit Tenant Setup - Security\" task, verify \"OAuth 2.0 Settings\" section, make sure that the \"OAuth 2.0 Clients Enabled\" check box is ticked. \n2) In Workday, access the \"Edit Tenant Setup - System\" task, verify \"User Activity Logging\" section, make sure that the \"Enable User Activity Logging\" check box is ticked. \n3) In Workday, access the \"Register API Client\" task.\n4) Define the Client Name, select the \"Client Grant Type\": \"Authorization Code Grant\" and then select \"Access Token Type\": \"Bearer\"\n5) Enter the \"Redirection URI\" found in the form below \n6) In section \"Scope (Functional Areas)\", select the appropriate scope for the user activity and click OK at the bottom select \"System\" and click OK at the bottom \n7) Copy the Client ID and Client Secret before navigating away from the page, and store it securely. \n8) In Sentinel, in the connector page - provide required Token, Authorization and User Activity Endpoints, along with Client ID and Client Secret from previous step. Then click \"Connect\". \n9) A Workday pop up will appear to complete the OAuth2 authentication and authorization of the API client. Here you need to provide credentials for Workday account with \"System Auditing\" permissions in Workday (can be either Workday account or Integration System User). \n10) Once that's complete, the message will be displayed to authorize your API client \n",

Solutions/Workday/Data Connectors/Workday_ccp/Workday_PollingConfig.json

@@ -63,6 +63,7 @@
     "addOnAttributes": {
       "friendlyName": "[[parameters('friendlyName')]",
       "tenantHost": "[[first(split(replace(replace(parameters('apiEndpoint'),'https://',''),'http://',''),'/'))]",
+      "apiEndpoint": "[[parameters('apiEndpoint')]",
       "dataType": "WorkdayUserActivity"
     }
   }

Solutions/Workday/Data/Solution_Workday.json

@@ -7,7 +7,7 @@
     "Data Connectors/Workday_ccp/Workday_DataConnectorDefinition.json"
   ],
   "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Workday\\",
-  "Version": "3.2.0",
+  "Version": "3.2.1",
   "Metadata": "SolutionMetadata.json",
   "TemplateSpec": true,
   "Is1PConnector": false

Solutions/Workday/Package/mainTemplate.json

@@ -47,11 +47,11 @@
     "email": "support@microsoft.com",
     "_email": "[variables('email')]",
     "_solutionName": "Workday",
-    "_solutionVersion": "3.2.0",
+    "_solutionVersion": "3.2.1",
     "solutionId": "azuresentinel.azure-sentinel-solution-workday",
     "_solutionId": "[variables('solutionId')]",
     "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
-    "dataConnectorCCPVersion": "3.2.0",
+    "dataConnectorCCPVersion": "3.2.1",
     "_dataConnectorContentIdConnectorDefinition1": "WorkdayCCPDefinition",
     "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]",
     "_dataConnectorContentIdConnections1": "WorkdayCCPDefinitionConnections",
@@ -102,6 +102,10 @@
                     {
                       "description": "Get a sample of Workday User Activity logs",
                       "query": "ASimAuditEventLogs\n | where EventProduct == \"Workday\" | take 10"
+                    },
+                    {
+                      "description": "Summarize Workday User Activity logs by environment",
+                      "query": "ASimAuditEventLogs\n| where EventProduct == \"Workday\"\n| extend WorkdayDomain = tostring(AdditionalFields.WorkdayDomain)\n| extend WorkdayEnvironment = iff(isempty(WorkdayDomain), \"Unknown - record collected before environment tracking\", WorkdayDomain)\n| summarize EventCount = count() by WorkdayEnvironment"
                     }
                   ],
                   "dataTypes": [
@@ -142,6 +146,31 @@
                     ]
                   },
                   "instructionSteps": [
+                    {
+                      "title": "Environment identification",
+                      "description": "Understand how Workday environments are identified in collected records",
+                      "instructions": [
+                        {
+                          "type": "MessageBar",
+                          "parameters": {
+                            "text": "Only records collected after this connector update include the Workday environment in `AdditionalFields.WorkdayDomain`. Existing records are not updated.",
+                            "type": "warning"
+                          }
+                        },
+                        {
+                          "type": "Markdown",
+                          "parameters": {
+                            "content": "### Updating an existing connector\n\nBefore deploying this updated template in a workspace that already has the Workday connector installed:\n\n1. Disconnect all existing Workday connector connections.\n2. Remove the existing Workday connector connections from **Data connectors**.\n3. Remove the installed Workday solution from **Content hub**.\n4. Delete the existing `workdayDCR` data collection rule from the workspace resource group.\n5. Deploy the updated connector template.\n6. Recreate and reconnect each Workday connection.\n\nExisting data in `ASimAuditEventLogs` remains unchanged. Only records collected after the updated connector is deployed and reconnected include `AdditionalFields.WorkdayDomain`."
+                          }
+                        },
+                        {
+                          "type": "Markdown",
+                          "parameters": {
+                            "content": "Use the following query to summarize Workday logs by environment. Historical records without an environment value are grouped as `Unknown - record collected before environment tracking`.\n\n```kusto\nASimAuditEventLogs\n| where EventProduct == \"Workday\"\n| extend WorkdayDomain = tostring(AdditionalFields.WorkdayDomain)\n| extend WorkdayEnvironment = iff(isempty(WorkdayDomain), \"Unknown - record collected before environment tracking\", WorkdayDomain)\n| summarize EventCount = count() by WorkdayEnvironment\n```"
+                          }
+                        }
+                      ]
+                    },
                     {
                       "title": "Connect Workday to Microsoft Sentinel",
                       "description": "1) In Workday, access the \"Edit Tenant Setup - Security\" task, verify \"OAuth 2.0 Settings\" section, make sure that the \"OAuth 2.0 Clients Enabled\" check box is ticked. \n2) In Workday, access the \"Edit Tenant Setup - System\" task, verify \"User Activity Logging\" section, make sure that the \"Enable User Activity Logging\" check box is ticked. \n3) In Workday, access the \"Register API Client\" task.\n4) Define the Client Name, select the \"Client Grant Type\": \"Authorization Code Grant\" and then select \"Access Token Type\": \"Bearer\"\n5) Enter the \"Redirection URI\" found in the form below \n6) In section \"Scope (Functional Areas)\", select the appropriate scope for the user activity and click OK at the bottom select \"System\" and click OK at the bottom \n7) Copy the Client ID and Client Secret before navigating away from the page, and store it securely. \n8) In Sentinel, in the connector page - provide required Token, Authorization and User Activity Endpoints, along with Client ID and Client Secret from previous step. Then click \"Connect\". \n9) A Workday pop up will appear to complete the OAuth2 authentication and authorization of the API client. Here you need to provide credentials for Workday account with \"System Auditing\" permissions in Workday (can be either Workday account or Integration System User). \n10) Once that's complete, the message will be displayed to authorize your API client \n",
@@ -424,6 +453,10 @@
                       {
                         "name": "ipAddress",
                         "type": "string"
+                      },
+                      {
+                        "name": "apiEndpoint",
+                        "type": "string"
                       }
                     ]
                   }
@@ -445,7 +478,7 @@
                       "clv2ws1"
                     ],
                     "outputStream": "Microsoft-ASimAuditEventLogs",
-                    "transformKql": "source\n| extend TimeGenerated= requestTime, EventStartTime= requestTime, EventEndTime= requestTime\n | project-rename EventType= activityAction,  DvcIpAddr=ipAddress, DvcDescription=deviceType, EventOriginalUid= taskId, Operation= taskDisplayName, ActorUsername= systemAccount, ActorSessionId=sessionId, HttpUserAgent= userAgent\n | extend Object= tostring(target.descriptor), TargetAppId= tostring(target.id), TargetUrl= tostring(target.href), EventCount= toint(1), EventSchema= \"AuditEvent\", EventResult= \"NA\", EventProduct=\"Workday\", EventVendor=\"Workday\", EventSchemaVersion=\"0.1\",ObjectType=\"Other\", Dvc=DvcIpAddr | extend EventType = case(EventType == \"READ\",\"Read\", EventType == \"WRITE\",\"Set\", \"Other\")\n| project-away requestTime, target, EventSchema, Dvc "
+                    "transformKql": "source\n| extend TimeGenerated= requestTime, EventStartTime= requestTime, EventEndTime= requestTime\n | project-rename EventType= activityAction,  DvcIpAddr=ipAddress, DvcDescription=deviceType, EventOriginalUid= taskId, Operation= taskDisplayName, ActorUsername= systemAccount, ActorSessionId=sessionId, HttpUserAgent= userAgent\n | extend Object= tostring(target.descriptor), TargetAppId= tostring(target.id), TargetUrl= tostring(target.href), EventCount= toint(1), EventSchema= \"AuditEvent\", EventResult= \"NA\", EventProduct=\"Workday\", EventVendor=\"Workday\", EventSchemaVersion=\"0.1\",ObjectType=\"Other\", Dvc=DvcIpAddr, AdditionalFields=bag_pack(\"WorkdayDomain\", apiEndpoint) | extend EventType = case(EventType == \"READ\",\"Read\", EventType == \"WRITE\",\"Set\", \"Other\")\n| project-away requestTime, target, apiEndpoint, EventSchema, Dvc "
                   }
                 ]
               }
@@ -484,6 +517,10 @@
             {
               "description": "Get a sample of Workday User Activity logs",
               "query": "ASimAuditEventLogs\n | where EventProduct == \"Workday\" | take 10"
+            },
+            {
+              "description": "Summarize Workday User Activity logs by environment",
+              "query": "ASimAuditEventLogs\n| where EventProduct == \"Workday\"\n| extend WorkdayDomain = tostring(AdditionalFields.WorkdayDomain)\n| extend WorkdayEnvironment = iff(isempty(WorkdayDomain), \"Unknown - record collected before environment tracking\", WorkdayDomain)\n| summarize EventCount = count() by WorkdayEnvironment"
             }
           ],
           "dataTypes": [
@@ -524,6 +561,31 @@
             ]
           },
           "instructionSteps": [
+            {
+              "title": "Environment identification",
+              "description": "Understand how Workday environments are identified in collected records",
+              "instructions": [
+                {
+                  "type": "MessageBar",
+                  "parameters": {
+                    "text": "Only records collected after this connector update include the Workday environment in `AdditionalFields.WorkdayDomain`. Existing records are not updated.",
+                    "type": "warning"
+                  }
+                },
+                {
+                  "type": "Markdown",
+                  "parameters": {
+                    "content": "### Updating an existing connector\n\nBefore deploying this updated template in a workspace that already has the Workday connector installed:\n\n1. Disconnect all existing Workday connector connections.\n2. Remove the existing Workday connector connections from **Data connectors**.\n3. Remove the installed Workday solution from **Content hub**.\n4. Delete the existing `workdayDCR` data collection rule from the workspace resource group.\n5. Deploy the updated connector template.\n6. Recreate and reconnect each Workday connection.\n\nExisting data in `ASimAuditEventLogs` remains unchanged. Only records collected after the updated connector is deployed and reconnected include `AdditionalFields.WorkdayDomain`."
+                  }
+                },
+                {
+                  "type": "Markdown",
+                  "parameters": {
+                    "content": "Use the following query to summarize Workday logs by environment. Historical records without an environment value are grouped as `Unknown - record collected before environment tracking`.\n\n```kusto\nASimAuditEventLogs\n| where EventProduct == \"Workday\"\n| extend WorkdayDomain = tostring(AdditionalFields.WorkdayDomain)\n| extend WorkdayEnvironment = iff(isempty(WorkdayDomain), \"Unknown - record collected before environment tracking\", WorkdayDomain)\n| summarize EventCount = count() by WorkdayEnvironment\n```"
+                  }
+                }
+              ]
+            },
             {
               "title": "Connect Workday to Microsoft Sentinel",
               "description": "1) In Workday, access the \"Edit Tenant Setup - Security\" task, verify \"OAuth 2.0 Settings\" section, make sure that the \"OAuth 2.0 Clients Enabled\" check box is ticked. \n2) In Workday, access the \"Edit Tenant Setup - System\" task, verify \"User Activity Logging\" section, make sure that the \"Enable User Activity Logging\" check box is ticked. \n3) In Workday, access the \"Register API Client\" task.\n4) Define the Client Name, select the \"Client Grant Type\": \"Authorization Code Grant\" and then select \"Access Token Type\": \"Bearer\"\n5) Enter the \"Redirection URI\" found in the form below \n6) In section \"Scope (Functional Areas)\", select the appropriate scope for the user activity and click OK at the bottom select \"System\" and click OK at the bottom \n7) Copy the Client ID and Client Secret before navigating away from the page, and store it securely. \n8) In Sentinel, in the connector page - provide required Token, Authorization and User Activity Endpoints, along with Client ID and Client Secret from previous step. Then click \"Connect\". \n9) A Workday pop up will appear to complete the OAuth2 authentication and authorization of the API client. Here you need to provide credentials for Workday account with \"System Auditing\" permissions in Workday (can be either Workday account or Integration System User). \n10) Once that's complete, the message will be displayed to authorize your API client \n",
@@ -940,6 +1002,7 @@
                 "addOnAttributes": {
                   "friendlyName": "[[parameters('friendlyName')]",
                   "tenantHost": "[[first(split(replace(replace(parameters('apiEndpoint'),'https://',''),'http://',''),'/'))]",
+                  "apiEndpoint": "[[parameters('apiEndpoint')]",
                   "dataType": "WorkdayUserActivity"
                 }
               }
@@ -960,7 +1023,7 @@
       "apiVersion": "2023-04-01-preview",
       "location": "[parameters('workspace-location')]",
       "properties": {
-        "version": "3.2.0",
+        "version": "3.2.1",
         "kind": "Solution",
         "contentSchemaVersion": "3.0.0",
         "displayName": "Workday",