{
    "id": "SecurityEvents",
    "title": "Security Events via Legacy Agent",
    "publisher": "Microsoft",
    "descriptionMarkdown": "You can stream all security events from the Windows machines connected to your Microsoft Sentinel workspace using the Windows agent. This connection enables you to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization’s network and improves your security operation capabilities. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2220093&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "SecurityEvents",
            "baseQuery": "SecurityEvent"
        }
    ],
    "sampleQueries": [
        {
            "description": "All logs",
            "query": "SecurityEvent\n            | sort by TimeGenerated"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "SecurityEvents",
            "value": null
        }
    ],
    "dataTypes": [
        {
            "name": "SecurityEvents",
            "lastDataReceivedQuery": "SecurityEvent\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/datasources",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace data sources",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "1. Download and install the agent",
            "description": ">  Security Events logs are collected only from **Windows** agents.",
            "instructions": [
                {
                    "parameters": {
                        "title": "Choose where to install the agent:",
                        "instructionSteps": [
                            {
                                "title": "Install agent on Azure Windows Virtual Machine",
                                "description": "Download the agent on the relevant machine and follow the instructions.",
                                "instructions": [
                                    {
                                        "parameters": {
                                            "linkType": "InstallAgentOnVirtualMachine"
                                        },
                                        "type": "InstallAgent"
                                    }
                                ]
                            },
                            {
                                "title": "Install agent on non-Azure Windows Machine",
                                "description": "Select the machine to install the agent and then click **Connect**.",
                                "instructions": [
                                    {
                                        "parameters": {
                                            "linkType": "InstallAgentOnNonAzure"
                                        },
                                        "type": "InstallAgent"
                                    }
                                ]
                            }
                        ]
                    },
                    "type": "InstructionStepsGroup"
                }
            ]
        },
        {
            "title": "2. Select which events to stream",
            "description": "- All events - All Windows security and AppLocker events.\n- Common - A standard set of events for auditing purposes.\n- Minimal - A small set of events that might indicate potential threats. By enabling this option, you won't be able to have a full audit trail.\n- None - No security or AppLocker events.",
            "instructions": [
                {
                    "type": "SecurityEvents"
                }
            ]
        }
    ]
}