Set up Automated Deployment of Microsoft Sentinel

// Define the parameters for the deployment
param dataState string = 'Enabled'
param _solutionId string = 'azuresentinel.azure-sentinel-solution-azureactivedirectory'
param _solutionVersion string = '3.2.9'
param _solutionSufix string = '${_solutionId}-Solution-${_solutionId}-${_solutionVersion}'

// Reference existing Log Analytics Workspace instance
resource law 'Microsoft.OperationalInsights/workspaces@2023-09-01' existing = {
  name: 'law-SOC-${resourceGroup().location}'
}

// Reference existing Microsoft Sentinel instance
resource sentinel 'Microsoft.SecurityInsights/onboardingStates@2024-09-01' existing = {
  name: 'default'
  scope: law
}
// Deploy Content Package for Azure Active Directory
resource ContentHub_AzureActiveDirectory 'Microsoft.SecurityInsights/contentPackages@2024-09-01' = {
  name: 'Microsoft Entra ID'
  scope: law
  properties: {
   contentSchemaVersion: '3.0.0'
   contentId: _solutionId
   contentProductId: '${take(_solutionId,50)}-sl-${uniqueString(_solutionSufix)}'
   contentKind: 'Solution'
   displayName: 'Microsoft Entra ID'
   version: _solutionVersion
   }
  dependsOn: [
   sentinel
 ]
 }
 resource azureADDataConnector 'Microsoft.SecurityInsights/dataConnectors@2024-09-01' = {
  name: 'Microsoft Entra ID'
  kind: 'AzureActiveDirectory'
  scope: law
  properties: {
    dataTypes: {
      alerts: {
        state: dataState
      }
    }
    tenantId: subscription().tenantId
  }
  dependsOn: [
    ContentHub_AzureActiveDirectory
  ]
}