ARM template for deploying a workbook template to Microsoft Sentinel

Hi Laurie_Rhodes,

When I try to execute your Push-Azureobject, I get the following error:

.

PS C:\WINDOWS\system32> $file = "C:\Users\Jason\OneDrive\Desktop\_ARM-PS-TEMPLATES\WorkspaceUsage.json"

PS C:\WINDOWS\system32> Get-jsonfile -Path $file | Push-Azureobject -authHeader $header -apiversions $AzAPIVersions
Invoke-RestMethod : {"error":{"code":"BadRequest","message":"Unable to translate bytes [A3] at index 943 from specified code page to Unicode."}}
At line:58 char:5
+     Invoke-RestMethod -Uri $uri -Method PUT -Headers $authHeader -Bod ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand

.

.

.

I understand this likely relates to “unknown, unrecognized, or unrepresentable characters” in the JSON file and needs to process an Encoding dependency; how have you dealt with this in your environment or the PowerShell scripting for the AZRest module? 

Hi Jason,

What you are doing is really quite unusual.  The workbook you want to deploy is already in Content Hub so anyone with the right permissions can search for it and enable it there.  

What you can do if deploying this content through code is a necessity is manually enabled the workbook through content hub and then after it succeeds look at the deployments on your resource group and grab the IDs for the Content Package and Content Template. 

Ultimately everything in cloud uses REST API - it doesn't matter if it's Azure, AWS or GCP.  ARM just provides a template for REST and Bicep is templating for ARM.  With Bic ep and ARM looking at the JSON representation of an object lets you see what the property names and values are that you need in a template.

What I posted before is the full representation of a JSON object for creating content that includes a workbook.  If you want to work with REST in getting and pushing objects into Azure, I have published a series of scripts for doing that here.  

Where possible I'd prefer to use Bicep now for creating templates - but you can create ARM templates from Bicep.
Microsoft.SecurityInsights/contentPackages - Bicep, ARM template & Terraform AzAPI reference | Microsoft Learn

Content Hub is intended to be used through the portal... I would just enable the workbook you want that way.  Thats how we have to update the content when new versions come out anyway and if we must use the portal for content management, I don't see the criticality of managing that content through code.

However, if you really must use code, I've included the JSON from my deployments below (with alteration of the Id that points to my subscription).  It's too much data for the chat thread to accept so I've uploaded them to GitHub here.

Hey Jason,

Thanks for the clarification.  You are quite right, what I was referring to was deploying individual workbooks by template - as long as the category is "sentinel", the example on the page you referenced works in deploying custom sourced workbooks.

But this isnt what you were getting at.  Your question was (I believe) about populating the templates section of the Sentinel workbooks blade.  I don't have the right answer for you unfortunately.

From the documentation, something like this I believed would have worked (it doesn't):

{
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workbookDisplayName": {
            "type": "string",
            "defaultValue": "Sentinel Workbook Template",
            "metadata": {
                "description": "The friendly name for the workbook that is used in the Gallery or Saved List. Needs to be unique in the scope of the resource group and source"
            }
        },
        "workbookDescription": {
            "type": "string",
            "defaultValue": "A sample Sentinel workbook template",
            "metadata": {
                "description": "Description for the workbook"
            }
        },
        "workbookSourceId": {
            "type": "string",
            "metadata": {
                "description": "The id of resource instance to which the workbook will be associated"
            }
        },
        "workbookId": {
            "type": "string",
            "defaultValue": "438ebb27-5c19-4dbd-9a88-9424f8a65361",
            "metadata": {
                "description": "The unique guid for this workbook template"
            }
        }
    },
    "resources": [
        {
            "name": "[parameters('workbookId')]",
            "type": "Microsoft.Insights/workbookTemplates",
            "location": "[resourceGroup().location]",
            "apiVersion": "2020-11-20",
            "properties": {
                "priority": 1,
                "galleries": [
                    {
                      "name": "Microsoft Sentinel Example",
                      "category": "Microsoft Sentinel",
                      "order": 100,
                      "type": "workbook",
                      "resourceType": "microsoft.operationalinsights/workspaces"
                    }
                ],
                "templateData": {
                    "strings": {
                        "title": "[parameters('workbookDisplayName')]",
                        "description": "[parameters('workbookDescription')]"
                    },
                    "workbook": {
                        "version": "Notebook/1.0",
                        "items": [
                            {
                                "type": 1,
                                "content": {
                                   "json": "{\"name\": \"Welcome Section\", \"type\": \"markdown\", \"content\": \"## Welcome to your Sentinel workbook!\"}"
                                }
                            }
                        ]
                    }
                }
            },
            "tags": {
                "hidden-title": "[parameters('workbookDisplayName')]",
                "hidden-link": "[parameters('workbookSourceId')]"
            }
        }
    ],
    "outputs": {
        "workbookTemplateId": {
            "type": "string",
            "value": "[resourceId('Microsoft.Insights/workbookTemplates', parameters('workbookId'))]"
        }
    }
}

I'm surprised that the specifics about the properties that are needed to specify the Microsoft Sentinel gallery don't seem to be documented anywhere.  These seem to be case sensitive too.

                "galleries": [
                    {
                      "name": "Microsoft Sentinel Example",
                      "category": "Microsoft Sentinel",
                      "order": 100,
                      "type": "workbook",
                      "resourceType": "microsoft.operationalinsights/workspaces"
                    }
                ],

That page shows eleven combinations for different types of galleries but nothing for Sentinel.
 https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-automate

I had thought that using hidden titles and links might have solved this - but it was of no help.  Hopefully someone from Microsoft can provide some deeper insights!  I'm really curious now too! :)