{
    "id": "AzureSecurityCenter",
    "title": "Subscription-based Microsoft Defender for Cloud (Legacy)",
    "publisher": "Microsoft",
    "descriptionMarkdown": "Microsoft Defender for Cloud is a security management tool that allows you to detect and quickly respond to threats across Azure, hybrid, and multi-cloud workloads. This connector allows you to stream your security alerts from Microsoft Defender for Cloud into Microsoft Sentinel, so you can view Defender data in workbooks, query it to produce alerts, and investigate and respond to incidents.\n\n[For more information>](https://aka.ms/ASC-Connector)",
    "logo": "AzureSecurityCenter.svg",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "SecurityAlerts",
            "baseQuery": "SecurityAlert | where ProductName == \"Azure Security Center\""
        }
    ],
    "sampleQueries": [
        {
            "description": "All logs",
            "query": "SecurityAlert | where ProductName == \"Azure Security Center\"\n            | sort by TimeGenerated"
        },
        {
            "description": "Summarize by severity",
            "query": "(SecurityAlert\n| where ProductName == \"Azure Security Center\")\n| summarize count() by AlertSeverity​"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "SentinelKinds",
            "value": [
                "AzureSecurityCenter"
            ]
        }
    ],
    "dataTypes": [
        {
            "name": "SecurityAlert (ASC)",
            "lastDataReceivedQuery": "SecurityAlert | where ProductName == \"Azure Security Center\"\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 1
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            }
        ],
        "customs": [
            {
                "name": "License",
                "description": "The connector is available for all deployments of Microsoft Defender for Cloud."
            },
            {
                "name": "Subscription",
                "description": "[read security data](https://docs.microsoft.com/azure/security-center/security-center-permissions)."
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Connect Microsoft Defender for Cloud to Microsoft Sentinel",
            "description": "Mark the check box of each Azure subscription whose alerts you want to import into Microsoft Sentinel, then select **Connect** above the list.\n\n> The connector can be enabled only on subscriptions that have at least one Microsoft Defender plan enabled in Microsoft Defender for Cloud, and only by users with Security Reader permissions on the subscription.",
            "instructions": [
                {
                    "parameters": {},
                    "type": "AzureSecurityCenterSubscriptions"
                }
            ]
        }
    ],
    "caseGenerationSteps": [
        {
            "instructions": [
                {
                    "parameters": {
                        "filterProduct": "Azure Security Center"
                    },
                    "type": "FilterAlert"
                }
            ]
        }
    ]
}