{
  "Name": "CyberArkEPM",
  "Author": "CyberArk Business Development - business_development@cyberark.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/CyberArk_Logo.svg\" width=\"75px\" height=\"75px\">",
  "Description": "Endpoint Privilege Manager, a critical and foundational endpoint control addresses the underlying weaknesses of endpoint defenses against a privileged attacker and helps enterprises defend against these attacks.",
  "Data Connectors": [
    "Data Connectors/CyberArkEPM_API_FunctionApp.json",
    "Data Connectors/CyberArkEPM_CCP/CyberArkEPM_DataConnectorDefinition.json"
  ],
  "Parsers": [
    "Parsers/CyberArkEPM.yaml"
  ],
  "Hunting Queries": [
    "Hunting Queries/CyberArkEPMElevationRequests.yaml",
    "Hunting Queries/CyberArkEPMPowershellDownloads.yaml",
    "Hunting Queries/CyberArkEPMPowershellExecutionParameters.yaml",
    "Hunting Queries/CyberArkEPMProcessNewHash.yaml",
    "Hunting Queries/CyberArkEPMProcessesAccessedInternet.yaml",
    "Hunting Queries/CyberArkEPMProcessesRunAsAdmin.yaml",
    "Hunting Queries/CyberArkEPMRareProcVendors.yaml",
    "Hunting Queries/CyberArkEPMRareProcessesRunByUsers.yaml",
    "Hunting Queries/CyberArkEPMScriptsExecuted.yaml",
    "Hunting Queries/CyberArkEPMSuspiciousActivityAttempts.yaml"
  ],
  "Analytic Rules": [
    "Analytic Rules/CyberArkEPMAttackAttemptNotBlocked.yaml",
    "Analytic Rules/CyberArkEPMMSBuildLOLBin.yaml",
    "Analytic Rules/CyberArkEPMMultipleAttackAttempts.yaml",
    "Analytic Rules/CyberArkEPMNewProcessStartetFromSystem.yaml",
    "Analytic Rules/CyberArkEPMPossibleExecutionOfPowershellEmpire.yaml",
    "Analytic Rules/CyberArkEPMProcessChangedStartLocation.yaml",
    "Analytic Rules/CyberArkEPMRareProcInternetAccess.yaml",
    "Analytic Rules/CyberArkEPMRenamedWindowsBinary.yaml",
    "Analytic Rules/CyberArkEPMUnexpectedExecutableExtension.yaml",
    "Analytic Rules/CyberArkEPMUnexpectedExecutableLocation.yaml"
  ],
  "Workbooks": [
    "Workbooks/CyberArkEPM.json"
  ],
  "BasePath": "C:/GitHub/Azure-Sentinel/Solutions/CyberArkEPM/",
  "Version": "3.1.0",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": true
}