{
  "id": "BeyondTrustPMCloud",
  "title": "BeyondTrust PM Cloud",
  "publisher": "BeyondTrust",
  "descriptionMarkdown": "The BeyondTrust Privilege Management Cloud data connector provides the capability to ingest activity audit logs and client event logs from BeyondTrust PM Cloud into Microsoft Sentinel.\n\nThis connector uses Azure Functions to pull data from the BeyondTrust PM Cloud API and ingest it into custom Log Analytics tables.",
  "graphQueries": [
    {
      "metricName": "Total Activity Audits received",
      "legend": "BeyondTrustPM_ActivityAudits_CL",
      "baseQuery": "BeyondTrustPM_ActivityAudits_CL"
    },
    {
      "metricName": "Total Client Events received",
      "legend": "BeyondTrustPM_ClientEvents_CL",
      "baseQuery": "BeyondTrustPM_ClientEvents_CL"
    }
  ],
  "sampleQueries": [
    {
      "description": "All Activity Audits",
      "query": "BeyondTrustPM_ActivityAudits_CL\n| sort by TimeGenerated desc"
    },
    {
      "description": "All Client Events",
      "query": "BeyondTrustPM_ClientEvents_CL\n| sort by TimeGenerated desc"
    }
  ],
  "dataTypes": [
    {
      "name": "BeyondTrustPM_ActivityAudits_CL",
      "lastDataReceivedQuery": "BeyondTrustPM_ActivityAudits_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
    },
    {
      "name": "BeyondTrustPM_ClientEvents_CL",
      "lastDataReceivedQuery": "BeyondTrustPM_ClientEvents_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
    }
  ],
  "connectivityCriterias": [
    {
      "type": "IsConnectedQuery",
      "value": [
        "BeyondTrustPM_ActivityAudits_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)"
      ]
    },
    {
      "type": "IsConnectedQuery",
      "value": [
        "BeyondTrustPM_ClientEvents_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)"
      ]
    }
  ],
  "availability": {
    "status": 1,
    "isPreview": false
  },
  "permissions": {
    "resourceProvider": [
      {
        "provider": "Microsoft.OperationalInsights/workspaces",
        "permissionsDisplayText": "read and write permissions on the workspace are required.",
        "providerDisplayName": "Workspace",
        "scope": "Workspace",
        "requiredPermissions": {
          "write": true,
          "read": true,
          "delete": true
        }
      },
      {
        "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
        "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
        "providerDisplayName": "Keys",
        "scope": "Workspace",
        "requiredPermissions": {
          "action": true
        }
      }
    ],
    "customs": [
      {
        "name": "Microsoft.Web/sites permissions",
        "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)."
      },
      {
        "name": "BeyondTrust PM Cloud API credentials",
        "description": "BeyondTrust PM Cloud OAuth Client ID and Client Secret are required. The API account requires the following permissions: Audit - Read Only and Reporting - Read Only"
      }
    ]
  },
  "instructionSteps": [
    {
      "title": "",
      "description": ">**NOTE:** This connector uses Azure Functions to connect to the BeyondTrust PM Cloud API to pull logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details."
    },
    {
      "title": "",
      "description": ">**NOTE:** This connector uses the OAuth 2.0 client credentials flow to authenticate with the BeyondTrust PM Cloud API."
    },
    {
      "title": "STEP 1 - Obtain BeyondTrust PM Cloud API credentials",
      "description": "Create an API Account in your BeyondTrust PM Cloud instance with OAuth API credentials (Client ID and Client Secret). The API account requires the following permissions:\n\n- **Audit** - Read Only\n- **Reporting** - Read Only"
    },
    {
      "title": "STEP 2 - Deploy the connector and the associated Azure Function",
      "description": "Use this method for automated deployment of the BeyondTrust PM Cloud data connector using an ARM Template.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FBeyondTrustPMCloud%2FData%2520Connectors%2Fazuredeploy_BeyondTrustPMCloud_API_FunctionApp.json)\n2. Select the preferred **Subscription**, **Resource Group** (must contain your Log Analytics workspace), and **Location**. \n3. Enter the required parameters:\n   - **Workspace Name**: Name of your Log Analytics workspace (e.g., `beyondtrust-pmcloud`)\n   - **BeyondTrust PM Cloud Base URL**: Your tenant URL (e.g., `https://yourcompany.beyondtrustcloud.com`)\n   - **BeyondTrust Client ID**: OAuth Client ID from Step 1\n   - **BeyondTrust Client Secret**: OAuth Client Secret from Step 1\n   - **Activity Audits Polling Interval**: How often to collect Activity Audits (default: 15 minutes)\n   - **Client Events Polling Interval**: How often to collect Client Events (default: 5 minutes)\n   - **Log Level**: Logging level for troubleshooting (default: Information)\n   - **Historical Data Timeframe**: How far back to collect data on first run (default: 1 day)\n4. Review advanced settings (Hosting Plan SKU, Storage Account Type) and adjust if needed.\n5. Mark the checkbox labeled **I agree to the terms and conditions stated above**.\n6. Click **Purchase** to deploy.\n7. The deployment creates all required resources: Function App, Storage Account, Data Collection Endpoint, Data Collection Rules, and custom Log Analytics tables.\n8. Data should begin flowing within 15-30 minutes of deployment."
    }
  ]
}