add a Bicep Azure Sentinel module

src/bicep/mlz.bicep

@@ -65,7 +65,6 @@ module logAnalyticsWorkspace './modules/logAnalyticsWorkspace.bicep' = {
 }
 
 //// hub and spoke
-
 module hub './modules/hubNetwork.bicep' = {
  name: 'deploy-hub-${nowUtc}'
  scope: resourceGroup(hubSubscriptionId, hubResourceGroupName)

src/bicep/modules/logAnalyticsWorkspace.bicep

@@ -4,6 +4,7 @@ param tags object = {}
 param retentionInDays int = 30
 param skuName string = 'PerGB2018'
 param workspaceCappingDailyQuotaGb int = -1
+param deploySentinel bool = false
 
 resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2021-06-01' = {
  name: name
@@ -20,5 +21,15 @@ resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2021-06
  }
 }
 
+//// sentinel
+module sentinelSolution './sentinelSolution.bicep' = if (deploySentinel) {
+ name: 'sentinelSolution'
+ params: {
+ workspaceName: logAnalyticsWorkspace.name
+ workspaceLocation: location
+ tags: tags
+ }
+}
+
 output id string = logAnalyticsWorkspace.id
 output name string = logAnalyticsWorkspace.name

src/bicep/modules/sentinelSolution.bicep

@@ -0,0 +1,25 @@
+param workspaceName string
+param workspaceLocation string
+param tags object = {}
+
+resource workspace 'Microsoft.OperationalInsights/workspaces@2020-08-01' existing = {
+ name: workspaceName
+}
+
+resource sentinelSolution 'Microsoft.OperationsManagement/solutions@2015-11-01-preview'= {
+ name: 'SecurityInsights(${workspaceName})'
+ location: workspaceLocation
+ tags:tags
+ dependsOn:[
+ workspace
+ ]
+ properties: {
+ workspaceResourceId: workspace.id
+ }
+ plan: {
+ name: 'SecurityInsights(${workspaceName})'
+ publisher: 'Microsoft'
+ product: 'OMSGallery/SecurityInsights'
+ promotionCode: ''
+ }
+}