Microsoft.Authorization_policyDefinitions-Deploy-Diagnostics-NetworkSecurityGroups.parameters.json

{
  "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "input": {
      "value": {
        "Name": "Deploy-Diagnostics-NetworkSecurityGroups",
        "ResourceType": "Microsoft.Authorization/policyDefinitions",
        "SubscriptionId": null,
        "Properties": {
          "Description": "Apply diagnostic settings for Network Security Groups - Log Analytics",
          "DisplayName": "Deploy-Diagnostics-NetworkSecurityGroups",
          "Mode": "All",
          "Parameters": {
            "logAnalytics": {
              "type": "String",
              "metadata": {
                "displayName": "Log Analytics workspace",
                "description": "Select the Log Analytics workspace from dropdown list",
                "strongType": "omsWorkspace"
              }
            }
          },
          "PolicyRule": {
            "if": {
              "field": "type",
              "equals": "Microsoft.Network/networkSecurityGroups"
            },
            "then": {
              "effect": "deployIfNotExists",
              "details": {
                "type": "Microsoft.Insights/diagnosticSettings",
                "name": "setByPolicy",
                "existenceCondition": {
                  "allOf": [
                    {
                      "field": "Microsoft.Insights/diagnosticSettings/logs.enabled",
                      "equals": "true"
                    },
                    {
                      "field": "Microsoft.Insights/diagnosticSettings/workspaceId",
                      "equals": "[parameters('logAnalytics')]"
                    }
                  ]
                },
                "roleDefinitionIds": [
                  "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
                ],
                "deployment": {
                  "properties": {
                    "mode": "incremental",
                    "template": {
                      "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                      "contentVersion": "1.0.0.0",
                      "parameters": {
                        "resourceName": {
                          "type": "string"
                        },
                        "logAnalytics": {
                          "type": "string"
                        },
                        "location": {
                          "type": "string"
                        }
                      },
                      "variables": {},
                      "resources": [
                        {
                          "type": "Microsoft.Network/networkSecurityGroups/providers/diagnosticSettings",
                          "apiVersion": "2017-05-01-preview",
                          "name": "[concat(parameters('resourceName'), '/', 'Microsoft.Insights/setByPolicy')]",
                          "location": "[parameters('location')]",
                          "dependsOn": [],
                          "properties": {
                            "workspaceId": "[parameters('logAnalytics')]",
                            "metrics": [],
                            "logs": [
                              {
                                "category": "NetworkSecurityGroupEvent",
                                "enabled": true
                              },
                              {
                                "category": "NetworkSecurityGroupRuleCounter",
                                "enabled": true
                              }
                            ]
                          }
                        }
                      ],
                      "outputs": {}
                    },
                    "parameters": {
                      "logAnalytics": {
                        "value": "[parameters('logAnalytics')]"
                      },
                      "location": {
                        "value": "[field('location')]"
                      },
                      "resourceName": {
                        "value": "[field('name')]"
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}