````plaintext
## Bicep Template for FRR-CCM (Collaborative Continuous Monitoring)

```bicep
// frr_ccm.bicep - Collaborative Continuous Monitoring Infrastructure
// Implements FRR-CCM family requirements for real-time security monitoring,
// automated alerting, incident detection, and continuous compliance validation
//
// FRR-CCM Requirements Supported:
// - FRR-CCM-01 to CCM-07: Core continuous monitoring requirements
// - FRR-CCM-AG-01 to AG-07: Agency-specific monitoring and reporting
// - FRR-CCM-QR-01 to QR-11: Quarterly review and assessment requirements
//
// Related KSIs:
// - KSI-CMT-01: Change management tracking
// - KSI-INR-01: Incident response and notification
// - KSI-CED-01: Continuous evidence collection

targetScope = 'resourceGroup'

param location string = resourceGroup().location
param workspaceName string = 'law-ccm-${uniqueString(resourceGroup().id)}'
param sentinelName string = 'sentinel-ccm-${uniqueString(resourceGroup().id)}'
param storageAccountName string = 'ccmevidence${uniqueString(resourceGroup().id)}'
param actionGroupEmail string = 'security@contoso.com'

// Log Analytics Workspace for all security logs
// MANDATORY: Central logging for FedRAMP 20x compliance
// Retention: 730 days minimum (FRR-CCM-01, FRR-CCM-02)
resource logAnalytics 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
  name: workspaceName
  location: location
  properties: {
    sku: {
      name: 'PerGB2018'
    }
    retentionInDays: 730  // MANDATORY: 2-year retention for FedRAMP 20x
    features: {
      enableLogAccessUsingOnlyResourcePermissions: true
      immediatePurgeDataOn30Days: false  // Preserve logs for compliance
    }
    publicNetworkAccessForIngestion: 'Enabled'
    publicNetworkAccessForQuery: 'Enabled'
  }
}

// Microsoft Sentinel for SIEM capabilities
// Supports: FRR-CCM-01 (continuous monitoring), FRR-CCM-02 (incident detection)
resource sentinel 'Microsoft.OperationsManagement/solutions@2015-11-01-preview' = {
  name: 'SecurityInsights(${logAnalytics.name})'
  location: location
  plan: {
    name: 'SecurityInsights(${logAnalytics.name})'
    publisher: 'Microsoft'
    product: 'OMSGallery/SecurityInsights'
    promotionCode: ''
  }
  properties: {
    workspaceResourceId: logAnalytics.id
  }
}

// Storage Account for continuous monitoring evidence
// Supports: FRR-CCM-AG-01 (agency reporting), FRR-CCM-QR-01 (quarterly reviews)
resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: storageAccountName
  location: location
  sku: {
    name: 'Standard_GRS'
    tier: 'Standard'
  }
  kind: 'StorageV2'
  properties: {
    minimumTlsVersion: 'TLS1_2'
    supportsHttpsTrafficOnly: true
    allowBlobPublicAccess: false
    networkAcls: {
      defaultAction: 'Deny'
      bypass: 'AzureServices'
    }
    encryption: {
      requireInfrastructureEncryption: true
      services: {
        blob: {
          enabled: true
          keyType: 'Account'
        }
      }
      keySource: 'Microsoft.Storage'
    }
  }
}

// Blob containers for monitoring evidence categories
// Supports: FRR-CCM-QR quarterly review requirements
resource securityAlertsContainer 'Microsoft.Storage/storageAccounts/blobServices/containers@2023-01-01' = {
  name: '${storageAccount.name}/default/security-alerts'
  properties: {
    publicAccess: 'None'
    metadata: {
      purpose: 'FRR-CCM-01 security alert archive'
      retention: '3 years'
    }
  }
}

resource incidentReportsContainer 'Microsoft.Storage/storageAccounts/blobServices/containers@2023-01-01' = {
  name: '${storageAccount.name}/default/incident-reports'
  properties: {
    publicAccess: 'None'
    metadata: {
      purpose: 'FRR-CCM-02 incident detection and response'
      retention: '7 years'
    }
  }
}

resource quarterlyReviewsContainer 'Microsoft.Storage/storageAccounts/blobServices/containers@2023-01-01' = {
  name: '${storageAccount.name}/default/quarterly-reviews'
  properties: {
    publicAccess: 'None'
    metadata: {
      purpose: 'FRR-CCM-QR-01 to QR-11 quarterly assessment artifacts'
      retention: '7 years'
    }
  }
}

resource agencyReportsContainer 'Microsoft.Storage/storageAccounts/blobServices/containers@2023-01-01' = {
  name: '${storageAccount.name}/default/agency-reports'
  properties: {
    publicAccess: 'None'
    metadata: {
      purpose: 'FRR-CCM-AG-01 to AG-07 agency-specific monitoring reports'
      retention: '7 years'
    }
  }
}

// Action Group for security alerts
// Supports: FRR-CCM-01 (real-time alerting), FRR-CCM-02 (incident notification)
resource actionGroup 'Microsoft.Insights/actionGroups@2023-01-01' = {
  name: 'ccm-security-alerts'
  location: 'global'
  properties: {
    groupShortName: 'CCMAlerts'
    enabled: true
    emailReceivers: [
      {
        name: 'Security Operations Center'
        emailAddress: actionGroupEmail
        useCommonAlertSchema: true
      }
      {
        name: 'Compliance Team'
        emailAddress: 'compliance@contoso.com'
        useCommonAlertSchema: true
      }
      {
        name: 'FedRAMP PMO'
        emailAddress: 'fedramp-pmo@contoso.com'
        useCommonAlertSchema: true
      }
    ]
    azureFunctionReceivers: []
    webhookReceivers: []
  }
}

// Sentinel Analytics Rules for FRR-CCM requirements
// Rule 1: Multiple failed authentication attempts (FRR-CCM-01)
resource failedAuthRule 'Microsoft.SecurityInsights/alertRules@2023-12-01-preview' = {
  scope: logAnalytics
  name: 'failed-authentication-attempts'
  kind: 'Scheduled'
  properties: {
    displayName: 'Multiple Failed Authentication Attempts'
    description: 'Detects multiple failed authentication attempts from single source (FRR-CCM-01)'
    severity: 'Medium'
    enabled: true
    query: '''
      SigninLogs
      | where ResultType != 0
      | summarize FailedAttempts = count() by UserPrincipalName, IPAddress, bin(TimeGenerated, 5m)
      | where FailedAttempts >= 5
    '''
    queryFrequency: 'PT5M'
    queryPeriod: 'PT5M'
    triggerOperator: 'GreaterThan'
    triggerThreshold: 0
    suppressionDuration: 'PT1H'
    suppressionEnabled: false
    tactics: ['CredentialAccess']
    techniques: ['T1110']
  }
}

// Rule 2: Privileged role assignments (FRR-CCM-01, FRR-CCM-03)
resource privilegedRoleRule 'Microsoft.SecurityInsights/alertRules@2023-12-01-preview' = {
  scope: logAnalytics
  name: 'privileged-role-assignment'
  kind: 'Scheduled'
  properties: {
    displayName: 'Privileged Role Assignment Detected'
    description: 'Alerts on assignment of privileged Azure roles (FRR-CCM-01, FRR-CCM-03)'
    severity: 'High'
    enabled: true
    query: '''
      AzureActivity
      | where OperationNameValue =~ "Microsoft.Authorization/roleAssignments/write"
      | where CategoryValue == "Administrative"
      | extend RoleName = tostring(parse_json(Properties).roleDefinitionName)
      | where RoleName in ("Owner", "Contributor", "User Access Administrator")
      | project TimeGenerated, Caller, RoleName, ResourceId
    '''
    queryFrequency: 'PT5M'
    queryPeriod: 'PT5M'
    triggerOperator: 'GreaterThan'
    triggerThreshold: 0
    suppressionDuration: 'PT1H'
    suppressionEnabled: false
    tactics: ['PrivilegeEscalation', 'Persistence']
    techniques: ['T1098']
  }
}

// Rule 3: Resource configuration changes (FRR-CCM-04)
resource configChangeRule 'Microsoft.SecurityInsights/alertRules@2023-12-01-preview' = {
  scope: logAnalytics
  name: 'security-configuration-change'
  kind: 'Scheduled'
  properties: {
    displayName: 'Security-Relevant Configuration Change'
    description: 'Detects changes to security-sensitive resources (FRR-CCM-04, FRR-SCN)'
    severity: 'Medium'
    enabled: true
    query: '''
      AzureActivity
      | where OperationNameValue has_any ("write", "delete")
      | where ResourceProviderValue in (
          "Microsoft.Security",
          "Microsoft.Network/networkSecurityGroups",
          "Microsoft.KeyVault",
          "Microsoft.Authorization"
        )
      | project TimeGenerated, Caller, OperationNameValue, ResourceId, ActivityStatusValue
    '''
    queryFrequency: 'PT15M'
    queryPeriod: 'PT15M'
    triggerOperator: 'GreaterThan'
    triggerThreshold: 0
    suppressionDuration: 'PT1H'
    suppressionEnabled: false
    tactics: ['DefenseEvasion']
    techniques: ['T1562']
  }
}

// Rule 4: Suspicious network traffic (FRR-CCM-01)
resource networkTrafficRule 'Microsoft.SecurityInsights/alertRules@2023-12-01-preview' = {
  scope: logAnalytics
  name: 'suspicious-network-traffic'
  kind: 'Scheduled'
  properties: {
    displayName: 'Suspicious Network Traffic Detected'
    description: 'Alerts on network traffic to known malicious IPs (FRR-CCM-01)'
    severity: 'High'
    enabled: true
    query: '''
      AzureNetworkAnalytics_CL
      | where FlowDirection_s == "O"
      | where DestIP_s in (
          // Known malicious IPs from threat intelligence feeds
          "ThreatIntelligenceIndicator | where ThreatType == 'MaliciousIP' | project DestIP_s = NetworkIP"
        )
      | summarize Count = count() by SrcIP_s, DestIP_s, DestPort_d
    '''
    queryFrequency: 'PT15M'
    queryPeriod: 'PT15M'
    triggerOperator: 'GreaterThan'
    triggerThreshold: 0
    suppressionDuration: 'PT1H'
    suppressionEnabled: false
    tactics: ['CommandAndControl', 'Exfiltration']
    techniques: ['T1071', 'T1041']
  }
}

// Automation Account for quarterly reporting
// Supports: FRR-CCM-QR-01 to QR-11 (quarterly reviews), FRR-CCM-AG-01 (agency reports)
resource automationAccount 'Microsoft.Automation/automationAccounts@2023-11-01' = {
  name: 'automation-ccm-${uniqueString(resourceGroup().id)}'
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    sku: {
      name: 'Basic'
    }
    encryption: {
      keySource: 'Microsoft.Automation'
    }
  }
}

// Scheduled Query Alerts for compliance metrics
// Alert 1: Log retention compliance (FRR-CCM-AG-02)
resource logRetentionAlert 'Microsoft.Insights/scheduledQueryRules@2023-03-15-preview' = {
  name: 'log-retention-compliance'
  location: location
  properties: {
    displayName: 'Log Retention Compliance Check'
    description: 'Validates 730-day log retention requirement (FRR-CCM-AG-02)'
    severity: 0  // Critical
    enabled: true
    evaluationFrequency: 'P1D'
    scopes: [
      logAnalytics.id
    ]
    windowSize: 'P1D'
    criteria: {
      allOf: [
        {
          query: '''
            Usage
            | where DataType == "SecurityEvent"
            | summarize OldestLog = min(TimeGenerated)
            | extend RetentionDays = datetime_diff('day', now(), OldestLog)
            | where RetentionDays < 730
          '''
          timeAggregation: 'Count'
          operator: 'GreaterThan'
          threshold: 0
          failingPeriods: {
            numberOfEvaluationPeriods: 1
            minFailingPeriodsToAlert: 1
          }
        }
      ]
    }
    actions: {
      actionGroups: [
        actionGroup.id
      ]
    }
  }
}

// Alert 2: Incident response time (FRR-CCM-02)
resource incidentResponseAlert 'Microsoft.Insights/scheduledQueryRules@2023-03-15-preview' = {
  name: 'incident-response-time'
  location: location
  properties: {
    displayName: 'Incident Response Time Exceeded'
    description: 'Alerts when incident response time exceeds 1 hour (FRR-CCM-02)'
    severity: 1  // High
    enabled: true
    evaluationFrequency: 'PT15M'
    scopes: [
      logAnalytics.id
    ]
    windowSize: 'PT1H'
    criteria: {
      allOf: [
        {
          query: '''
            SecurityIncident
            | where Status == "New"
            | where TimeGenerated < ago(1h)
            | summarize Count = count() by IncidentName, Severity
          '''
          timeAggregation: 'Count'
          operator: 'GreaterThan'
          threshold: 0
          failingPeriods: {
            numberOfEvaluationPeriods: 1
            minFailingPeriodsToAlert: 1
          }
        }
      ]
    }
    actions: {
      actionGroups: [
        actionGroup.id
      ]
    }
  }
}

// Data Collection Rules for comprehensive monitoring
// Supports: FRR-CCM-01 (continuous data collection)
resource dataCollectionRule 'Microsoft.Insights/dataCollectionRules@2022-06-01' = {
  name: 'dcr-ccm-security'
  location: location
  properties: {
    description: 'FRR-CCM continuous monitoring data collection'
    dataSources: {
      performanceCounters: [
        {
          name: 'perfCounter-security'
          streams: ['Microsoft-Perf']
          samplingFrequencyInSeconds: 60
          counterSpecifiers: [
            '\\Security System-Wide Statistics\\NTLM Authentications'
            '\\Security System-Wide Statistics\\Kerberos Authentications'
          ]
        }
      ]
      windowsEventLogs: [
        {
          name: 'eventLog-security'
          streams: ['Microsoft-SecurityEvent']
          xPathQueries: [
            'Security!*[System[(EventID=4624 or EventID=4625 or EventID=4648)]]'  // Logon events
            'Security!*[System[(EventID=4720 or EventID=4726 or EventID=4738)]]'  // Account management
            'Security!*[System[(EventID=4732 or EventID=4733 or EventID=4756)]]'  // Group membership
          ]
        }
      ]
    }
    destinations: {
      logAnalytics: [
        {
          workspaceResourceId: logAnalytics.id
          name: 'centralWorkspace'
        }
      ]
    }
    dataFlows: [
      {
        streams: ['Microsoft-Perf', 'Microsoft-SecurityEvent']
        destinations: ['centralWorkspace']
      }
    ]
  }
}

// Outputs for integration
output workspaceId string = logAnalytics.id
output workspaceCustomerId string = logAnalytics.properties.customerId
output sentinelWorkspaceId string = logAnalytics.id
output storageAccountName string = storageAccount.name
output actionGroupId string = actionGroup.id
output automationAccountName string = automationAccount.name
```

## Deployment Instructions

1. **Create Resource Group:**
   ```bash
   az group create --name rg-ccm-compliance --location eastus
   ```

2. **Deploy Template:**
   ```bash
   az deployment group create \
     --resource-group rg-ccm-compliance \
     --template-file frr_ccm.bicep \
     --parameters actionGroupEmail=security@contoso.com
   ```

3. **Enable Data Connectors:**
   - Azure Activity Logs
   - Microsoft Entra ID Sign-in Logs
   - Microsoft Defender for Cloud
   - Azure Firewall Logs
   - Network Security Group Flow Logs

4. **Configure Sentinel Workbooks:**
   - FedRAMP Compliance Dashboard
   - Incident Response Metrics
   - Security Operations Center (SOC) Overview

5. **Set Up Automation Runbooks:**
   - Quarterly compliance report generation (FRR-CCM-QR-01)
   - Agency-specific report generation (FRR-CCM-AG-01)
   - Monthly security metrics aggregation

## Continuous Monitoring Coverage (FRR-CCM-01)

| Category | Data Sources | Retention |
|----------|-------------|-----------|
| **Authentication** | Entra ID Sign-in Logs, Security Events | 730 days |
| **Authorization** | Azure Activity Logs, Role Assignments | 730 days |
| **Network Security** | NSG Flow Logs, Firewall Logs | 730 days |
| **Resource Changes** | Azure Activity Logs, Resource Graph | 730 days |
| **Security Alerts** | Defender for Cloud, Sentinel Incidents | 730 days |
| **Compliance Status** | Policy Compliance, Secure Score | 730 days |

## Quarterly Review Requirements (FRR-CCM-QR)

**FRR-CCM-QR-01 to QR-11 Quarterly Deliverables:**
1. Security control effectiveness assessment
2. Vulnerability scan results summary
3. Incident response metrics and trends
4. Configuration change audit
5. Access review results
6. Security training completion status
7. Contingency plan testing results
8. Third-party service validation
9. Significant change notifications
10. Continuous monitoring metrics
11. Remediation action item tracking

**Automated Collection Schedule:**
- Weekly: Aggregate security metrics
- Monthly: Generate trend reports
- Quarterly: Comprehensive compliance package

## Agency Reporting (FRR-CCM-AG)

**FRR-CCM-AG-01 to AG-07 Requirements:**
- Agency-specific report formats
- Custom dashboards for stakeholders
- Machine-readable data exports (JSON/CSV)
- Real-time compliance posture API
- Escalation procedures for critical findings
````
