From e698cc80948c467295230562fbb0f47ba1b38e98 Mon Sep 17 00:00:00 2001 From: gallen-ms <87649349+gallen-ms@users.noreply.github.com> Date: Thu, 27 Aug 2026 10:52:47 +0100 Subject: [PATCH 1/5] Update S3 Bucket Prefix notes and requirements --- .../CiscoUmbrella_DataConnectorDefinition.json | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/Solutions/CiscoUmbrella/Data Connectors/CiscoUmbrella_CCP/CiscoUmbrella_DataConnectorDefinition.json b/Solutions/CiscoUmbrella/Data Connectors/CiscoUmbrella_CCP/CiscoUmbrella_DataConnectorDefinition.json index a444194380b..566cc5602ac 100644 --- a/Solutions/CiscoUmbrella/Data Connectors/CiscoUmbrella_CCP/CiscoUmbrella_DataConnectorDefinition.json +++ b/Solutions/CiscoUmbrella/Data Connectors/CiscoUmbrella_CCP/CiscoUmbrella_DataConnectorDefinition.json @@ -200,6 +200,12 @@ "content": "> **NOTE:**\n> This connector supports both Cisco-managed and customer-managed Amazon S3 buckets." } }, + { + "type": "Markdown", + "parameters": { + "content": "> **NOTE:**\n> For Customer managed paths, you can leave the S3 Bucket Prefix empty if you want to use the root of the bucket. If you specify a prefix, make sure to include the trailing slash." + } + }, { "type": "Markdown", "parameters": { @@ -227,7 +233,7 @@ { "type": "Markdown", "parameters": { - "content": "For example, the Data Path provided by Cisco is `cisco-managed-us-west-1/2003477-12345`. For the AWS S3 Bucket Name, the input S3 Bucket Name will be `cisco-managed-us-west-1`. The S3 Bucket Region will be `us-west-1`. The S3 Bucket Prefix will be `2003477-12345`." + "content": "For example, the Data Path provided by Cisco is `cisco-managed-us-west-1/2003477-12345`. For the AWS S3 Bucket Name, the input S3 Bucket Name will be `cisco-managed-us-west-1`. The S3 Bucket Region will be `us-west-1`. The S3 Bucket Prefix will be `2003477-12345/`." } }, { @@ -376,7 +382,7 @@ "type": "text", "name": "s3BucketPrefix", "validations": { - "required": true + "required": false } } } @@ -390,4 +396,4 @@ ] } } -} \ No newline at end of file +} From f332580b2ccd79a9a9277ac3653bb031d5d633db Mon Sep 17 00:00:00 2001 From: gallen-ms <87649349+gallen-ms@users.noreply.github.com> Date: Thu, 27 Aug 2026 11:02:30 +0100 Subject: [PATCH 2/5] Bump solution and data connector version to 3.3.2 Updated version numbers for solution and data connector. Updated connector to accept an empty s3BucketPrefix value and when provided the user should supply a trailing slash --- .../CiscoUmbrella/Package/mainTemplate.json | 52 ++++++++++++------- 1 file changed, 32 insertions(+), 20 deletions(-) diff --git a/Solutions/CiscoUmbrella/Package/mainTemplate.json b/Solutions/CiscoUmbrella/Package/mainTemplate.json index 426ad0be98d..cb45d2c6466 100644 --- a/Solutions/CiscoUmbrella/Package/mainTemplate.json +++ b/Solutions/CiscoUmbrella/Package/mainTemplate.json @@ -55,7 +55,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "CiscoUmbrella", - "_solutionVersion": "3.3.1", + "_solutionVersion": "3.3.2", "solutionId": "azuresentinel.azure-sentinel-solution-ciscoumbrella", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "CiscoUmbrellaDataConnector", @@ -77,7 +77,7 @@ "dataConnectorVersion2": "1.0.0", "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "dataConnectorCCPVersion": "3.3.1", + "dataConnectorCCPVersion": "3.3.2", "_dataConnectorContentIdConnectorDefinition3": "CiscoUmbrellaConnector", "dataConnectorTemplateNameConnectorDefinition3": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition3')))]", "_dataConnectorContentIdConnections3": "CiscoUmbrellaConnectorConnections", @@ -1928,6 +1928,12 @@ "content": "> **NOTE:**\n> This connector supports both Cisco-managed and customer-managed Amazon S3 buckets." } }, + { + "type": "Markdown", + "parameters": { + "content": "> **NOTE:**\n> For Customer managed paths, you can leave the S3 Bucket Prefix empty if you want to use the root of the bucket. If you specify a prefix, make sure to include the trailing slash." + } + }, { "type": "Markdown", "parameters": { @@ -1955,7 +1961,7 @@ { "type": "Markdown", "parameters": { - "content": "For example, the Data Path provided by Cisco is `cisco-managed-us-west-1/2003477-12345`. For the AWS S3 Bucket Name, the input S3 Bucket Name will be `cisco-managed-us-west-1`. The S3 Bucket Region will be `us-west-1`. The S3 Bucket Prefix will be `2003477-12345`." + "content": "For example, the Data Path provided by Cisco is `cisco-managed-us-west-1/2003477-12345`. For the AWS S3 Bucket Name, the input S3 Bucket Name will be `cisco-managed-us-west-1`. The S3 Bucket Region will be `us-west-1`. The S3 Bucket Prefix will be `2003477-12345/`." } }, { @@ -2100,11 +2106,11 @@ "type": "Textbox", "parameters": { "label": "AWS S3 Bucket Prefix", - "placeholder": "S3 Bucket Prefix", + "placeholder": "S3 Bucket Prefix (include trailing slash if not empty)", "type": "text", "name": "s3BucketPrefix", "validations": { - "required": true + "required": false } } } @@ -5583,6 +5589,12 @@ "content": "> **NOTE:**\n> This connector supports both Cisco-managed and customer-managed Amazon S3 buckets." } }, + { + "type": "Markdown", + "parameters": { + "content": "> **NOTE:**\n> For Customer managed paths, you can leave the S3 Bucket Prefix empty if you want to use the root of the bucket. If you specify a prefix, make sure to include the trailing slash." + } + }, { "type": "Markdown", "parameters": { @@ -5610,7 +5622,7 @@ { "type": "Markdown", "parameters": { - "content": "For example, the Data Path provided by Cisco is `cisco-managed-us-west-1/2003477-12345`. For the AWS S3 Bucket Name, the input S3 Bucket Name will be `cisco-managed-us-west-1`. The S3 Bucket Region will be `us-west-1`. The S3 Bucket Prefix will be `2003477-12345`." + "content": "For example, the Data Path provided by Cisco is `cisco-managed-us-west-1/2003477-12345`. For the AWS S3 Bucket Name, the input S3 Bucket Name will be `cisco-managed-us-west-1`. The S3 Bucket Region will be `us-west-1`. The S3 Bucket Prefix will be `2003477-12345/`." } }, { @@ -5755,11 +5767,11 @@ "type": "Textbox", "parameters": { "label": "AWS S3 Bucket Prefix", - "placeholder": "S3 Bucket Prefix", + "placeholder": "S3 Bucket Prefix (include trailing slash if not empty)", "type": "text", "name": "s3BucketPrefix", "validations": { - "required": true + "required": false } } } @@ -5875,8 +5887,8 @@ }, "s3BucketPrefix": { "defaultValue": "s3BucketPrefix", - "type": "securestring", - "minLength": 1 + "type": "securestring" + } }, "variables": { @@ -5935,7 +5947,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/auditlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'auditlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaAdminAudit_CL", @@ -5976,7 +5988,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/firewalllogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'firewalllogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaCloudFirewall_CL", @@ -6017,7 +6029,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/dlplogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'dlplogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaDLP_CL", @@ -6058,7 +6070,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/dnslogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'dnslogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaDNS_CL", @@ -6099,7 +6111,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/fileeventlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'fileeventlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaFileEvent_CL", @@ -6140,7 +6152,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/intrusionlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'intrusionlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaIPS_CL", @@ -6181,7 +6193,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/ravpnlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'ravpnlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaRemoteAccessVPN_CL", @@ -6222,7 +6234,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/proxylogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'proxylogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaWebTraffic_CL", @@ -6263,7 +6275,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/ztnalogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'ztnalogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaZeroTrustAccess_CL", @@ -6304,7 +6316,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/ztnaflowlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'ztnaflowlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaZeroTrustAccessFlow_CL", From fae822751a365f1f700cb1ecca7970e333987229 Mon Sep 17 00:00:00 2001 From: gallen-ms <87649349+gallen-ms@users.noreply.github.com> Date: Thu, 27 Aug 2026 11:06:54 +0100 Subject: [PATCH 3/5] Add release notes for version 3.3.2 Updated the release notes to include version 3.3.2 changes. --- Solutions/CiscoUmbrella/ReleaseNotes.md | 1 + 1 file changed, 1 insertion(+) diff --git a/Solutions/CiscoUmbrella/ReleaseNotes.md b/Solutions/CiscoUmbrella/ReleaseNotes.md index 55fc0d46992..638c5f194b8 100644 --- a/Solutions/CiscoUmbrella/ReleaseNotes.md +++ b/Solutions/CiscoUmbrella/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|-------------------------------------------------------------| +| 3.3.2 | 27-08-2026 | Updated the Cisco Umbrella template to allow the S3 bucket prefix to be null or provided with a trailing slash, allowing customer root directories to work | | 3.3.1 | 26-08-2026 | Fixed Cisco Umbrella CCF connection resource naming to include the S3 bucket, region, and prefix, preventing connections for different account prefixes from overwriting each other. | | 3.3.0 | 14-08-2026 | Updated **CCF Data Connector** for Cisco Cloud Security log schema version 16: enabled Gzip decompression for all log streams, added **DestinationSgtOriginId** and **FwBlockReason** columns to CiscoUmbrellaCloudFirewall, added **IsolationProfileId** column to CiscoUmbrellaWebTraffic, and added connector instruction notes for optional headers and Cisco-managed/customer-managed Amazon S3 buckets. | | 3.2.2 | 04-08-2026 | Fixed broken **Deploy to Azure Gov** button link in **Data Connectors** and **Playbooks**. | From b458abfca66ec8be661d777303b36bd2ea32b6f6 Mon Sep 17 00:00:00 2001 From: gallen-ms <87649349+gallen-ms@users.noreply.github.com> Date: Thu, 27 Aug 2026 11:10:05 +0100 Subject: [PATCH 4/5] Update Cisco Umbrella solution version to 3.3.2 --- Solutions/CiscoUmbrella/Data/Solution_CiscoUmbrella.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/CiscoUmbrella/Data/Solution_CiscoUmbrella.json b/Solutions/CiscoUmbrella/Data/Solution_CiscoUmbrella.json index 08b3eabcb92..11102015451 100644 --- a/Solutions/CiscoUmbrella/Data/Solution_CiscoUmbrella.json +++ b/Solutions/CiscoUmbrella/Data/Solution_CiscoUmbrella.json @@ -46,7 +46,7 @@ "Playbooks/CiscoUmbrellaPlaybooks/CiscoUmbrella-GetDomainInfo/azuredeploy.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\CiscoUmbrella", - "Version": "3.3.1", + "Version": "3.3.2", "Metadata": "SolutionMetadata.json", "TemplateSpec": true } From e2c4e3e04725f5bc0c1d250e8798c906381aa6b1 Mon Sep 17 00:00:00 2001 From: gallen-ms <87649349+gallen-ms@users.noreply.github.com> Date: Thu, 27 Aug 2026 12:08:20 +0100 Subject: [PATCH 5/5] removing the leading slash after S3BucketPrefix --- .../CiscoUmbrella_PollingConfig.json | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/Solutions/CiscoUmbrella/Data Connectors/CiscoUmbrella_CCP/CiscoUmbrella_PollingConfig.json b/Solutions/CiscoUmbrella/Data Connectors/CiscoUmbrella_CCP/CiscoUmbrella_PollingConfig.json index 8562c84ad09..051db87bdd8 100644 --- a/Solutions/CiscoUmbrella/Data Connectors/CiscoUmbrella_CCP/CiscoUmbrella_PollingConfig.json +++ b/Solutions/CiscoUmbrella/Data Connectors/CiscoUmbrella_CCP/CiscoUmbrella_PollingConfig.json @@ -25,7 +25,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/auditlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'auditlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaAdminAudit_CL", @@ -66,7 +66,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/firewalllogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'firewalllogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaCloudFirewall_CL", @@ -107,7 +107,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/dlplogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'dlplogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaDLP_CL", @@ -148,7 +148,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/dnslogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'dnslogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaDNS_CL", @@ -189,7 +189,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/fileeventlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'fileeventlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaFileEvent_CL", @@ -230,7 +230,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/intrusionlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'intrusionlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaIPS_CL", @@ -271,7 +271,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/ravpnlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'ravpnlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaRemoteAccessVPN_CL", @@ -312,7 +312,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/proxylogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'proxylogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaWebTraffic_CL", @@ -353,7 +353,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/ztnalogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'ztnalogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaZeroTrustAccess_CL", @@ -394,7 +394,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/ztnaflowlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'ztnaflowlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaZeroTrustAccessFlow_CL", @@ -409,4 +409,4 @@ }, "condition": "[[equals(parameters('selectedDataType')[0], 'CiscoUmbrellaZeroTrustAccessFlow')]" } -] \ No newline at end of file +]