{
    "id": "Symantec",
    "title": "Symantec Integrated Cyber Defense Exchange",
    "publisher": "Symantec",
    "descriptionMarkdown": "Symantec ICDx connector allows you to easily connect your Symantec security solutions logs with Microsoft Sentinel, to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization’s network and improves your security operation capabilities.",
    "logo": "SymantecLogo.svg",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "SymantecICDx",
            "baseQuery": "SymantecICDx_CL"
        }
    ],
    "sampleQueries": [
        {
            "description": "Summarize by connection source ip",
            "query": "SymantecICDx_CL\n            | summarize count() by connection_src_ip_s"
        },
        {
            "description": "Summarize by threat id",
            "query": "SymantecICDx_CL\n            | summarize count() by threat_id_d"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "SymantecICDx_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
            ]
        }
    ],
    "dataTypes": [
        {
            "name": "SymantecICDx_CL",
            "lastDataReceivedQuery": "SymantecICDx_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Configure and connect Symantec ICDx",
            "description": "1. On the ICDx navigation bar, click **Configuration**.\n2. At the top of the **Configuration** screen, click **Forwarders**, and next to Microsoft Sentinel (Log Analytics), click **Add**.\n3. In the Microsoft Sentinel (Log Analytics) window that opens, click **Show Advanced**. [See the documentation to set advanced features](https://aka.ms/SymantecICDX-learn-more).\n4. Make sure that you set a name for the forwarder and under Azure Destination, set these required fields:\n  -   Workspace ID: Paste the Workspace ID from the Microsoft Sentinel portal connector page.\n  -   Primary Key: Paste the Primary Key from the Microsoft Sentinel portal connector page.\n  -   Custom Log Name: Type the custom log name in the Microsoft Azure portal Log Analytics workspace to which you are going to forward events. The default is SymantecICDx.\n5. Click Save and to start the forwarder, go to Options > More and click **Start**.",
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                            "PrimaryKey"
                        ],
                        "label": "Primary Key"
                    },
                    "type": "CopyableLabel"
                }
            ]
        }
    ]
}