{
    "id": "MISP2SentinelConnector",
    "title": "MISP2Sentinel",
    "publisher": "MISP project & cudeso.be",
    "descriptionMarkdown": "This solution installs the MISP2Sentinel connector that allows you to automatically push threat indicators from MISP to Microsoft Sentinel via the Upload Indicators REST API. After installing the solution, configure and enable this data connector by following guidance in Manage solution view.",
    "graphQueries": [
        {
            "metricName": "Total indicators received",
            "legend": "Connection Events",
            "baseQuery": "ThreatIntelIndicators | where SourceSystem == 'MISP'"
        }
    ],
    "sampleQueries": [
        {
            "description": "All Threat Intelligence APIs Indicators",
            "query": "ThreatIntelIndicators | where SourceSystem == 'MISP'| sort by TimeGenerated desc"
        }
    ],
    "dataTypes": [
        {
            "name": "ThreatIntelIndicators",
            "lastDataReceivedQuery": "ThreatIntelIndicators| where isnotempty(TimeGenerated) and SourceSystem == 'MISP' | summarize Time = max(TimeGenerated)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "ThreatIntelIndicators| where SourceSystem == 'MISP' | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": true
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.SecurityInsights/threatintelligence/write",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Installation and setup instructions",
            "description": "Use the documentation from this GitHub repository to install and configure the MISP to Microsoft Sentinel connector: \n\nhttps://github.com/cudeso/misp2sentinel"
        }
    ]
}