{
    "id": "PostgreSQL",
    "title": "[Deprecated] PostgreSQL Events",
    "publisher": "PostgreSQL",
    "descriptionMarkdown": "PostgreSQL data connector provides the capability to ingest [PostgreSQL](https://www.postgresql.org/) events into Microsoft Sentinel. Refer to [PostgreSQL documentation](https://www.postgresql.org/docs/current/index.html) for more information.",
    "additionalRequirementBanner": "This data connector depends on a parser based on Kusto Function to work as expected. Follow the steps to use this Kusto Function alias **PostgreSQLEvent** in queries and workbooks. [Follow steps to get this Kusto Function>](https://aka.ms/sentinel-postgresql-parser)",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "PostgreSQL_CL",
            "baseQuery": "PostgreSQLEvent"
        }
    ],
    "sampleQueries": [
        {
            "description" : "PostgreSQL errors",
            "query": "PostgreSQLEvent\n | where EventSeverity in~ ('ERROR', 'FATAL')\n | sort by EventEndTime"
        }
    ],
    "dataTypes": [
        {
            "name": "PostgreSQL_CL",
            "lastDataReceivedQuery": "PostgreSQLEvent\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "PostgreSQLEvent\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "",
            "description": ">**NOTE:** This data connector depends on PostgreSQL parser based on a Kusto Function to work as expected. This parser is installed along with solution installation.",
            "instructions": [
            ]
        },
        {
            "title": "1. Install and onboard the agent for Linux or Windows",
            "description": "Install the agent on the Tomcat Server where the logs are generated.\n\n> Logs from PostgreSQL Server deployed on Linux or Windows servers are collected by **Linux** or **Windows** agents.",
            "instructions": [
                {
                "parameters": {
                "title": "Choose where to install the Linux agent:",
    "instructionSteps": [
            {
            "title": "Install agent on Azure Linux Virtual Machine",
            "description": "Select the machine to install the agent on and then click **Connect**.",
            "instructions": [
                {
                "parameters": {
                "linkType": "InstallAgentOnLinuxVirtualMachine"
                },
                "type": "InstallAgent"
                }
            ]
        },
            {
            "title": "Install agent on a non-Azure Linux Machine",
            "description": "Download the agent on the relevant machine and follow the instructions.",
            "instructions": [
                {
                "parameters": {
                "linkType": "InstallAgentOnLinuxNonAzure"
                },
                "type": "InstallAgent"
                }
            ]
        }
    ]
        },
            "type": "InstructionStepsGroup"
            }
        ]
            },
            {
                "instructions": [
                    {
                    "parameters": {
                    "title": "Choose where to install the Windows agent:",
        "instructionSteps": [
                {
                "title": "Install agent on Azure Windows Virtual Machine",
                "description": "Select the machine to install the agent on and then click **Connect**.",
                "instructions": [
                    {
                    "parameters": {
                    "linkType": "InstallAgentOnVirtualMachine"
                    },
                    "type": "InstallAgent"
                    }
                ]
            },
                {
                "title": "Install agent on a non-Azure Windows Machine",
                "description": "Download the agent on the relevant machine and follow the instructions.",
                "instructions": [
                    {
                    "parameters": {
                    "linkType": "InstallAgentOnNonAzure"
                    },
                    "type": "InstallAgent"
                    }
                ]
            }
        ]
            },
                "type": "InstructionStepsGroup"
                }
            ]
                },
    {
                    "title": "2. Configure PostgreSQL to write logs to files",
                    "description":"1. Edit postgresql.conf file to write logs to files:\n\n>**log_destination** = 'stderr'\n\n>**logging_collector** = on\n\nSet the following parameters: **log_directory** and **log_filename**. Refer to the [PostgreSQL documentation for more details](https://www.postgresql.org/docs/current/runtime-config-logging.html)"
                },
    {
            "title": "3. Configure the logs to be collected",
            "description": "Configure the custom log directory to be collected" ,
            "instructions": [
                {
                    "parameters": {
                        "linkType": "OpenCustomLogsSettings"
                    },
                    "type": "InstallAgent"
                }
            ]
        },
    {
        "title": "",
        "description":"1. Select the link above to open your workspace advanced settings \n2. From the left pane, select **Settings**, select **Custom Logs** and click **+Add custom log**\n3. Click **Browse** to upload a sample of a PostgreSQL log file. Then, click **Next >**\n4. Select **Timestamp** as the record delimiter and click **Next >**\n5. Select **Windows** or **Linux** and enter the path to PostgreSQL logs based on your configuration(e.g. for some Linux distros the default path is /var/log/postgresql/) \n6. After entering the path, click the '+' symbol to apply, then click **Next >** \n7. Add **PostgreSQL** as the custom log Name (the '_CL' suffix will be added automatically) and click **Done**."
    },
    {
        "title": "Validate connectivity",
        "description":"It may take upwards of 20 minutes until your logs start to appear in Microsoft Sentinel."
    }
],
"metadata" : {
    "id": "046d5618-89c8-4441-a680-0e839970dcd2",
    "version": "1.0.0",
    "kind": "dataConnector",
    "source": {
        "kind": "community"
    },
    "author": {
        "name": "PostgreSQL"
    },
    "support": {
        "name": "PostgreSQL",
        "link": "https://www.postgresql.org/support/",
        "tier": "developer"
    }
}
}