如何通过CLI或Terraform安装Azure Sentinel解决方案？

我已通过以下Terraform代码创建Azure Sentinel并连接数据源：

创建Sentinel与Azure安全中心数据连接器 #

resource "azurerm_sentinel_data_connector_azure_security_center" "main" {
  name                       = "data-connector-azure-security-center"
  log_analytics_workspace_id = azurerm_log_analytics_workspace.ws.id
  subscription_id            = data.azurerm_subscription.current.subscription_id
}

连接Microsoft Entra ID数据源 #

resource "azurerm_sentinel_data_connector_azure_active_directory" "aad" {
  name                       = "Microsoft Entra ID"
  log_analytics_workspace_id = azurerm_sentinel_log_analytics_workspace_onboarding.sential.workspace_id
}

接下来我需要基于规则模板创建告警规则，代码如下，但该操作要求先安装Azure Activity Solution，我希望通过CLI或Terraform自动完成安装，而非手动操作：

### 基于规则模板创建定时告警规则（需先安装Azure Activity Solution）
data "azurerm_sentinel_alert_rule_template" "analytics_rule_template" {
  log_analytics_workspace_id = azurerm_log_analytics_workspace.ws.id
  display_name               = "Rare subscription-level operations in Azure"
}

resource "azurerm_sentinel_alert_rule_scheduled" "rare_operations" {
  name                       = data.azurerm_sentinel_alert_rule_template.analytics_rule_template.name
  log_analytics_workspace_id = azurerm_log_analytics_workspace.ws.id
  alert_rule_template_guid   = data.azurerm_sentinel_alert_rule_template.analytics_rule_template.name
  display_name               = data.azurerm_sentinel_alert_rule_template.analytics_rule_template.display_name
  severity                   = data.azurerm_sentinel_alert_rule_template.analytics_rule_template.scheduled_template.0.severity
  query                      = data.azurerm_sentinel_alert_rule_template.analytics_rule_template.scheduled_template.0.query
  description                = data.azurerm_sentinel_alert_rule_template.analytics_rule_template.scheduled_template.0.description
  query_frequency            = data.azurerm_sentinel_alert_rule_template.analytics_rule_template.scheduled_template.0.query_frequency
  query_period               = data.azurerm_sentinel_alert_rule_template.analytics_rule_template.scheduled_template.0.query_period
  tactics                    = data.azurerm_sentinel_alert_rule_template.analytics_rule_template.scheduled_template.0.tactics
  trigger_operator           = data.azurerm_sentinel_alert_rule_template.analytics_rule_template.scheduled_template.0.trigger_operator
  trigger_threshold          = data.azurerm_sentinel_alert_rule_template.analytics_rule_template.scheduled_template.0.trigger_threshold
}

可以通过Terraform或Azure CLI自动安装Azure Activity Solution，具体方法如下：

1. 使用Terraform安装 #

Azure Activity Solution属于Log Analytics工作区的解决方案，可通过azurerm_log_analytics_solution资源实现安装，将以下代码添加到你的Terraform配置中：

resource "azurerm_log_analytics_solution" "azure_activity" {
  name                = "AzureActivity"
  location            = azurerm_log_analytics_workspace.ws.location
  resource_group_name = azurerm_log_analytics_workspace.ws.resource_group_name
  solution_name       = "AzureActivity"
  publisher           = "Microsoft"
  plan_name           = "AzureActivity"

  workspace_resource_id = azurerm_log_analytics_workspace.ws.id
  workspace_name        = azurerm_log_analytics_workspace.ws.name

  sku {
    name = "pergb2018"
  }
}

说明：sku.name需与你的Log Analytics工作区SKU保持一致，若工作区使用旧版SKU，可替换为对应名称（如"Free"、"Standalone"等）。

2. 使用Azure CLI安装 #

执行以下Azure CLI命令完成安装，替换占位符为你的实际资源信息：

az monitor log-analytics solution create \
  --name "AzureActivity" \
  --resource-group "<你的资源组名称>" \
  --workspace "<你的Log Analytics工作区名称>" \
  --plan-publisher "Microsoft" \
  --plan-product "OMSGallery/AzureActivity"

内容的提问来源于stack exchange，提问作者One Developer