{
	"Name": "CiscoDuoSecurity",
	"Author": "CiscoDuoSecurity - support@duosecurity.com",
	"Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/cisco-logo-72px.svg\" width=\"75px\" height=\"75px\">",
	"Description": "The [Cisco Duo Security](https://duo.com/) solution allows you to ingest [authentication logs](https://duo.com/docs/adminapi#authentication-logs), [activity logs](https://duo.com/docs/adminapi#activity-logs), [administrator logs](https://duo.com/docs/adminapi#administrator-logs), [telephony logs](https://duo.com/docs/adminapi#telephony-logs), [offline enrolment logs](https://duo.com/docs/adminapi#offline-enrollment-logs) and [Trust Monitor events](https://duo.com/docs/adminapi#trust-monitor) into Microsoft Sentinel using the Cisco Duo Admin API. Refer to [API documentation](https://duo.com/docs/adminapi) for more information.\r\n  \r\n  **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n  a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n \r\n\n  b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview)\r\n\n",
	"Workbooks": [
		"Workbooks/CiscoDuo.json"
	],
	"Parsers": [
		"Parsers/CiscoDuo.yaml"
	],
	"Hunting Queries": [
		"Hunting Queries/CiscoDuoAdmin2FAFailure.yaml",
		"Hunting Queries/CiscoDuoAdminDeleteActions.yaml",
		"Hunting Queries/CiscoDuoAdminFailure.yaml",
		"Hunting Queries/CiscoDuoAuthenticationErrorEvents.yaml",
		"Hunting Queries/CiscoDuoAuthenticationErrorReasons.yaml",
		"Hunting Queries/CiscoDuoDeletedUsers.yaml",
		"Hunting Queries/CiscoDuoFraudAuthentication.yaml",
		"Hunting Queries/CiscoDuoNewUsers.yaml",
		"Hunting Queries/CiscoDuoUnpatchedAccessDevices.yaml",
		"Hunting Queries/CiscoDuoUnsecuredDevices.yaml"
	],
	"Data Connectors": [
		"Data Connectors/CiscoDuoAuth_CCF/CiscoDuoAuth_ConnectorDefinition.json",
		"Data Connectors/CiscoDuoActivity_CCF/CiscoDuoActivity_ConnectorDefinition.json",
		"Data Connectors/CiscoDuoTelephony_CCF/CiscoDuoTelephony_ConnectorDefinition.json"
	],
	"Analytic Rules": [
		"Analytic Rules/CiscoDuoADSyncFailed.yaml",
		"Analytic Rules/CiscoDuoAdminDeleted.yaml",
		"Analytic Rules/CiscoDuoAdminMFAFailures.yaml",
		"Analytic Rules/CiscoDuoAdminPasswordReset.yaml",
		"Analytic Rules/CiscoDuoMultipleUserLoginFailures.yaml",
		"Analytic Rules/CiscoDuoMultipleUsersDeleted.yaml",
		"Analytic Rules/CiscoDuoNewAccessDevice.yaml",
		"Analytic Rules/CiscoDuoNewAdmin.yaml",
		"Analytic Rules/CiscoDuoNewAuthDeviceLocation.yaml",
		"Analytic Rules/CiscoDuoUnexpectedAuthFactor.yaml"
	],
	"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\CiscoDuoSecurity",
	"Version": "3.1.2",
	"Metadata": "SolutionMetadata.json",
	"TemplateSpec": true,
	"Is1Pconnector": false
}