{
    "id": "MicrosoftDefenderAdvancedThreatProtection",
    "title": "Microsoft Defender for Endpoint",
    "publisher": "Microsoft",
    "logo": "MdatpLogo.svg",
    "descriptionMarkdown": "Microsoft Defender for Endpoint is a security platform designed to prevent, detect, investigate, and respond to advanced threats. The platform creates alerts when suspicious security events are seen in an organization. Fetch alerts generated in Microsoft Defender for Endpoint to Microsoft Sentinel so that you can effectively analyze security events. You can create rules, build dashboards and author playbooks for immediate response. For more information, see the [Microsoft Sentinel documentation >](https://go.microsoft.com/fwlink/p/?linkid=2220128&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "SecurityAlert (MDATP)",
            "baseQuery": "SecurityAlert | where ProviderName == \"MDATP\""
        }
    ],
    "sampleQueries": [
        {
            "description": "All logs",
            "query": "SecurityAlert | where ProviderName == \"MDATP\"\n            | sort by TimeGenerated"
        }
    ],
    "isConnectivityCriteriasMatchSome": true,
    "connectivityCriterias": [
        {
            "type": "MtpAlerts",
            "value": [
                "MicrosoftDefenderAdvancedThreatProtection"
            ]
        }
    ],
    "dataTypes": [
        {
            "name": "SecurityAlert (MDATP)",
            "lastDataReceivedQuery": "SecurityAlert | where ProviderName == \"MDATP\"\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 2,
        "isPreview": false        
    },
    "permissions": {
        "tenant": [
            "GlobalAdmin",
            "SecurityAdmin"
        ],
        "licenses": [
            "Mdatp"
        ],
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Connect Microsoft Defender for Endpoint alerts to Microsoft Sentinel",
            "description": "> Connecting Microsoft Defender for Endpoint will cause your data that is collected by Microsoft Defender for Endpoint service to be stored and processed in the location that you have configured your Microsoft Sentinel workspace.",
            "instructions": [
                {
                    "parameters": {},
                    "type": "MicrosoftDefenderATP"
                },
                {
                    "parameters": {
                        "text": "Microsoft Defender for Endpoint Advanced Hunting raw logs are available as part of the Microsoft 365 Defender (Preview) connector",
                        "visible": true,
                        "inline": true
                    },
                    "type": "InfoMessage"
                }
            ]
        }
    ],
    "caseGenerationSteps": [
        {
            "instructions": [
                {
                    "parameters": {
                        "filterProduct": "Microsoft Defender Advanced Threat Protection"
                    },
                    "type": "FilterAlert"
                }
            ],
            "featureFlag": {
                "feature": "MDATPProductFilter",
                "featureStates": {
                    "1": 2,
                    "2": 2,
                    "3": 2,
                    "4": 2,
                    "5": 2
                }
            }
        }
    ]
}