{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workspaceName": {
            "type": "string",
            "metadata": {
                "description": "Name of the Log Analytics workspace",
                "strongType": "Microsoft.OperationalInsights/workspaces"
            }
        },
        "baseTime": {
            "type": "string",
            "defaultValue": "[utcNow('u')]",
            "metadata": {
                "description": "Base time for the deployment (Do Not Change)",
                "hidden": true
            }
        }
    },
    "variables": {
        "location": "[resourceGroup().location]",
        "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))]",
        "dcrName": "CS-WorkspaceTransformation-Standard-DCR"
    },
    "resources": [
        {
            "type": "Microsoft.Insights/dataCollectionRules",
            "name": "[variables('dcrName')]",
            "location": "[variables('location')]",
            "apiVersion": "2021-09-01-preview",
            "kind": "WorkspaceTransforms",
            "tags": {
                "deploymentTime": "[parameters('baseTime')]",
                "createdBy": "Critical Start Repository"
            },
            "properties": {
                "destinations": {
                    "logAnalytics": [
                        {
                            "workspaceResourceId": "[variables('workspaceResourceId')]",
                            "name": "clv2ws1"
                        }
                    ]
                },
                "dataFlows": [
                    {
                        "streams": ["Microsoft-Table-AADNonInteractiveUserSignInLogs"],
                        "destinations": ["clv2ws1"],
                        "transformKql": "source\n| extend ConditionalAccessPolicies = iif(ConditionalAccessPolicies has_cs \"failure\", ConditionalAccessPolicies, \"[]\")\n| extend ConditionalPoliciesRemoved_CF = iif(ConditionalAccessPolicies has_cs \"failure\", false, true)\n| project-away TenantId, SourceSystem, OperationName, OperationVersion, Category, DurationMs, ResourceGroup, Identity, Level, Location, AlternateSignInName, AuthenticationContextClassReferences, AuthenticationProcessingDetails, AuthenticationRequirementPolicies, HomeTenantName, IsInteractive, IsTenantRestricted, IsThroughGlobalSecureAccess, CreatedDateTime, FederatedCredentialId, GlobalSecureAccessIpAddress, ProcessingTimeInMs, OriginalRequestId, SessionLifetimePolicies, SignInIdentifierType, TokenIssuerName, TokenProtectionStatusDetails"
                    },
                    {
                        "streams": ["Microsoft-Table-SigninLogs"],
                        "destinations": ["clv2ws1"],
                        "transformKql": "source\n| extend ConditionalAccessPolicies = iif(tostring(ConditionalAccessPolicies) has_cs \"failure\", tostring(ConditionalAccessPolicies), \"[]\")\n| extend ConditionalPoliciesRemoved_CF = iif(tostring(ConditionalAccessPolicies) has_cs \"failure\", false, true)\n| project-away TenantId, SourceSystem, OperationName, OperationVersion, Category, DurationMs, ResourceGroup, Identity, Level, Location, AlternateSignInName, AuthenticationContextClassReferences, AuthenticationProcessingDetails, AuthenticationRequirementPolicies, HomeTenantName, IsInteractive, IsTenantRestricted, IsThroughGlobalSecureAccess, CreatedDateTime, FederatedCredentialId, GlobalSecureAccessIpAddress, OriginalRequestId, SessionLifetimePolicies, SignInIdentifierType, TokenIssuerName,TokenProtectionStatusDetails"
                    }
                ]
            }
        },
        {
            "type": "Microsoft.OperationalInsights/workspaces",
            "apiVersion": "2021-12-01-preview",
            "name": "[parameters('workspaceName')]",
            "location": "[variables('location')]",
            "properties": {
                "defaultDataCollectionRuleResourceId": "[resourceId('Microsoft.Insights/dataCollectionRules', variables('dcrName'))]"
            },
            "dependsOn": [
                "[resourceId('Microsoft.Insights/dataCollectionRules', variables('dcrName'))]"
            ]
        }
    ]
}