[QUESTION] Is there or are you able to provide a template.json for STAT deployment for GCCH?

[zjb1003]

Hi Brian,

Do you have a template.json for STAT deployment for GCCH available, or are you able to provide one? I am a cybersecurity analyst and my team and I use STAT within our commercial environment and absolutely love it! We work in a split environment and we have not been able to get STAT working on our GCCH side of the house.

Thank you,

Zach

[briandelmsft]

Hi @zjb1003,

Glad to hear you love it Zach. We have not tested in GCC-H, only in Commercial and GCC. Though I do believe it's been used in GCC-H, I can't be certain.

We do not have a specific template to deploy there, the existing template does allow for the configuration of other endpoints, but not the change to login.microsoftonline.com to .us. That may be what you're missing. This can however bet set manually after deployment via environment variable.

The environment variables for STAT in GCC-H, though untested, have been documented here. If you set them during deployment, the one you may be missing is the AZURE_AUTHORITY_HOST which is not need for GCC but would be needed for GCC-H.

Where are you encountering errors? Any details you can share? If you'd like to setup a time for a teams meeting I can arrange something as I'd also like to figure out if we're missing anything on the GCC-H side.

[briandelmsft]

One other note, it won't deploy to USGov Texas, as according to service availability, that region does not have the Azure Functions Consumption plan for Linux (nor the premium plan). If you have Sentinel deployed in Texas you can still run STAT in another region, you'll just have to also build you playbooks in the region with STAT, instead of the region with Sentinel.

[piaudonn]

@zjb1003 does this help?

[puliamic]

Hey Brian/Pierre,
I am taking over this from Zjb1003 we work together.
USGov Virginia is where our sentinel deployment is located.
Do you know what I need to change to be able to deploy there and test for you so we can give you any feedback you need?
Also, does anything change with STaT based on the migrations to the security.microsoft.--- portals? It runs great in commercial and we love it! Due to the sensitivity of the data in our GCCH I have to be careful what I share but we should be able to provide you good feedback.

Thank you for all your help and for creating a great tool!
Mike Puliafico

[briandelmsft]

Hi @puliamic ,

The main change should really just be the environment variables on the function app, for GCC-H it should look like this:

Environment Variable	Value
ARM_ENDPOINT	management.usgovcloudapi.net
GRAPH_ENDPOINT	graph.microsoft.us
LOGANALYTICS_ENDPOINT	api.loganalytics.us
MDE_ENDPOINT	api-gov.securitycenter.microsoft.us
M365_ENDPOINT	api-gov.security.microsoft.us
AZURE_AUTHORITY_HOST	https://login.microsoftonline.us

The AZURE_AUTHORITY_HOST one won't be there, you'll need to add it as it isn't necessary in commercial.

There are some modules that won't work in GCC-H for sure, like the newer exposure modules, and some of the permissions grants may fail in GCC-H related to newer capabilities, but the majority of it should work but we may have some bugs to work through as we haven't been able to conduct any testing in that environment.

[puliamic]

Thank you Brian,
Let me get this setup and I will let you know where it fails.

[puliamic]

Brian just too be sure on the template where I need to add the Azure_Authority_Host it should look like this?

    "AzureAuthorityHost": {
        "type": "string",
        "defaultValue": "https://login.microsoftonline.us",
        "metadata": {
            "description": "Azure Authority Host"
        }
    },

[puliamic]

It looks like that was correct as shown below but what is the

• Service Principal Client Id
• Service Principal Secret
• Identity Type
• User Identity Resource Id
• Deployment Branch

Was I supposed to register an Enterprise App for Stat?