{ 
    "id": "BlackberryCylancePROTECT",
    "title": "Blackberry CylancePROTECT", 
    "publisher": "Blackberry", 
    "descriptionMarkdown": "The [Blackberry CylancePROTECT](https://www.blackberry.com/us/en/products/blackberry-protect) connector allows you to easily connect your CylancePROTECT logs with Azure Sentinel. This gives you more insight into your organization's network and improves your security operation capabilities.", 
    "additionalRequirementBanner":"These queries and workbooks are dependent on a parser based on a Kusto Function to work as expected. Follow the steps to use this Kusto functions alias **CylancePROTECT** in queries and workbooks. [Follow these steps to get this Kusto functions.](https://aka.ms/sentinel-cylanceprotect-parser)",
    "graphQueries": [ 
     { 
         "metricName": "Total data received", 
         "legend": "CylancePROTECT", 
         "baseQuery": "CylancePROTECT" 
     } 
    ], 
          "sampleQueries": [ 
           { 
               "description" : "Top 10 Event Types", 
               "query": "CylancePROTECT \n | summarize count() by EventName \n| top 10 by count_"    
           },
            {
                "description" : "Top 10 Triggered Policies",
                "query": "CylancePROTECT \n | where EventType == \"Threat\" \n | summarize count() by PolicyName \n | top 10 by count_"
            }
        ], 
            "dataTypes": [ 
            { 
               "name": "Syslog (CylancePROTECT)", 
               "lastDataReceivedQuery": "CylancePROTECT \n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)" 
            } 
        ], 
             "connectivityCriterias": [ 
                { 
                    "type": "IsConnectedQuery", 
                    "value": [ 
                    "CylancePROTECT \n      | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)" 
             ] 
                } 
            ], 
            "availability": { 
            "status": 1,
            "isPreview": true 
            }, 
            "permissions": { 
            "resourceProvider": [ 
                   { 
                       "provider": "Microsoft.OperationalInsights/workspaces", 
                       "permissionsDisplayText": "write permission is required.", 
                       "providerDisplayName": "Workspace", 
                       "scope": "Workspace", 
                       "requiredPermissions": { 
                       "write": true, 
                       "delete": true 
                    } 
                } 
            ],
            "customs": [
                {
                    "name": "CylancePROTECT",
                    "description": "must be configured to export logs via Syslog."
                }
            ]
    }, 
            "instructionSteps": [
                { 
                    "title": "", 
                    "description": ">This data connector depends on a parser based on a Kusto Function to work as expected. [Follow the steps](https://aka.ms/sentinel-cylanceprotect-parser) to use the Kusto function alias, **CylancePROTECT**",
                    "instructions": [ 
                    ]    
                },  
                { 
                    "title": "1. Install and onboard the agent for Linux", 
                    "description": "Typically, you should install the agent on a different computer from the one on which the logs are generated.\n\n>  Syslog logs are collected only from **Linux** agents.", 
                    "instructions": [ 
                        { 
                        "parameters": { 
                        "title": "Choose where to install the agent:", 
            "instructionSteps": [ 
                    { 
                    "title": "Install agent on Azure Linux Virtual Machine", 
                    "description": "Select the machine to install the agent on and then click **Connect**.", 
                    "instructions": [ 
                        { 
                        "parameters": { 
                        "linkType": "InstallAgentOnLinuxVirtualMachine" 
                        }, 
                        "type": "InstallAgent" 
                        } 
                    ]    
                }, 
                    { 
                    "title": "Install agent on a non-Azure Linux Machine", 
                    "description": "Download the agent on the relevant machine and follow the instructions.", 
                    "instructions": [ 
                        { 
                        "parameters": { 
                        "linkType": "InstallAgentOnLinuxNonAzure" 
                        }, 
                        "type": "InstallAgent" 
                        } 
                    ] 
                } 
            ] 
                }, 
                    "type": "InstructionStepsGroup" 
                    } 
                ] 
                    }, 
            { 
                    "title": "2. Configure the logs to be collected", 
                    "description": "Configure the facilities you want to collect and their severities.\n 1. Under workspace advanced settings **Configuration**, select **Data** and then **Syslog**.\n 2. Select **Apply below configuration to my machines** and select the facilities and severities.\n 3.  Click **Save**.",
                    "instructions": [
                        {
                            "parameters": { 
                                "linkType": "OpenSyslogSettings"
                            },
                            "type": "InstallAgent"
                        }
                    ]
                },
            {
                "title": "3. Configure and connect the CylancePROTECT",
                "description":"[Follow these instructions](https://docs.blackberry.com/content/dam/docs-blackberry-com/release-pdfs/en/cylance-products/syslog-guides/Cylance%20Syslog%20Guide%20v2.0%20rev12.pdf) to configure the CylancePROTECT to forward syslog. Use the IP address or hostname for the Linux device with the Linux agent installed as the Destination IP address."
            }
        ]
}