{
    "id": "WindowsSecurityEvents",
    "title": "Windows Security Events via AMA",
    "publisher": "Microsoft",
    "descriptionMarkdown": "You can stream all security events from the Windows machines connected to your Microsoft Sentinel workspace using the Windows agent. This connection enables you to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization’s network and improves your security operation capabilities. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2220225&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "SecurityEvents",
            "baseQuery": "SecurityEvent"
        }
    ],
    "sampleQueries": [
        {
            "description": "All logs",
            "query": "SecurityEvent\n            | sort by TimeGenerated"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "WindowsSecurityEvents",
            "value": null
        }
    ],
    "dataTypes": [
        {
            "name": "SecurityEvents",
            "lastDataReceivedQuery": "SecurityEvent\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 2,
        "featureFlag": {
            "feature": "WindowsSecurityEventsFeature",
            "featureStates": {
                "1": 2,
                "2": 2,
                "3": 2,
                "4": 2,
                "5": 2,
                "6": 1,
                "7": 1
            }
        }
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces/datasources",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace data sources",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true
                }
            }
        ],
        "customs": [
            {
                "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)"
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Enable data collection rule​",
            "description": ">  Security Events logs are collected only from **Windows** agents.",
            "instructions": [
                {
                    "type": "WindowsSecurityEvents"
                }
            ]
        },
        {
            "instructions": [
                {
                    "parameters": {
                        "linkType": "OpenCreateDataCollectionRule",
                        "dataCollectionRuleType": 0
                    },
                    "type": "InstallAgent"
                }
            ]
        }
    ]
}