{
  "Name": "CiscoUmbrella",
  "Author": "Microsoft - support@microsoft.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/cisco-logo-72px.svg\" width=\"75px\" height=\"75px\">",
  "Description": "The Cisco Cloud Security solution for Microsoft Sentinel enables you to ingest [Cisco Secure Access](https://docs.sse.cisco.com/sse-user-guide/docs/welcome-cisco-secure-access) and [Cisco Umbrella](https://docs.umbrella.com/umbrella-user-guide/docs/getting-started) [logs](https://docs.sse.cisco.com/sse-user-guide/docs/manage-your-logs) stored in Amazon S3 into Microsoft Sentinel using the Amazon S3 REST API",
  "Data Connectors": [
    "Data Connectors/CiscoUmbrella_API_FunctionApp.json",
    "Data Connectors/CiscoUmbrella_API_FunctionApp_elasticpremium.json",
    "Data Connectors/CiscoUmbrella_CCP/CiscoUmbrella_DataConnectorDefinition.json"
  ],
  "Workbooks": [
    "Workbooks/CiscoUmbrella.json"
  ],
  "Analytic Rules": [
    "Analytic Rules/CiscoUmbrellaConnectionNon-CorporatePrivateNetwork.yaml",
    "Analytic Rules/CiscoUmbrellaConnectionToUnpopularWebsiteDetected.yaml",
    "Analytic Rules/CiscoUmbrellaCryptoMinerUserAgentDetected.yaml",
    "Analytic Rules/CiscoUmbrellaEmptyUserAgentDetected.yaml",
    "Analytic Rules/CiscoUmbrellaHackToolUserAgentDetected.yaml",
    "Analytic Rules/CiscoUmbrellaPowershellUserAgentDetected.yaml",
    "Analytic Rules/CiscoUmbrellaRareUserAgentDetected.yaml",
    "Analytic Rules/CiscoUmbrellaRequestAllowedHarmfulMaliciousURICategory.yaml",
    "Analytic Rules/CiscoUmbrellaRequestBlocklistedFileType.yaml",
    "Analytic Rules/CiscoUmbrellaURIContainsIPAddress.yaml"
  ],
  "Hunting Queries": [
    "Hunting Queries/CiscoUmbrellaAnomalousFQDNsforDomain.yaml",
    "Hunting Queries/CiscoUmbrellaBlockedUserAgents.yaml",
    "Hunting Queries/CiscoUmbrellaDNSErrors.yaml",
    "Hunting Queries/CiscoUmbrellaDNSRequestsUunreliableCategory.yaml",
    "Hunting Queries/CiscoUmbrellaHighCountsOfTheSameBytesInSize.yaml",
    "Hunting Queries/CiscoUmbrellaHighValuesOfUploadedData.yaml",
    "Hunting Queries/CiscoUmbrellaPossibleConnectionC2.yaml",
    "Hunting Queries/CiscoUmbrellaPossibleDataExfiltration.yaml",
    "Hunting Queries/CiscoUmbrellaProxyAllowedUnreliableCategory.yaml",
    "Hunting Queries/CiscoUmbrellaRequestsUncategorizedURI.yaml"
  ],
  "Parsers": [
    "Parsers/Cisco_Umbrella.yaml"
  ],
  "Playbooks": [
    "Playbooks/CustomConnector/EnforcementAPICustomConnector/azuredeploy.json",
    "Playbooks/CiscoUmbrellaPlaybooks/CiscoUmbrella-BlockDomain/azuredeploy.json",
    "Playbooks/CiscoUmbrellaPlaybooks/CiscoUmbrella-AddIpToDestinationList/azuredeploy.json",
    "Playbooks/CiscoUmbrellaPlaybooks/CiscoUmbrella-AssignPolicyToIdentity/azuredeploy.json",
    "Playbooks/CiscoUmbrellaPlaybooks/CiscoUmbrella-GetDomainInfo/azuredeploy.json"
  ],
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\CiscoUmbrella",
  "Version": "3.3.2",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": true
}