{
  "id": "MicrosoftAzurePurview",
  "title": "Microsoft Purview",
  "publisher": "Microsoft",
  "descriptionMarkdown": "Connect to Microsoft Purview to enable data sensitivity enrichment of Microsoft Sentinel. Data classification and sensitivity label logs from Microsoft Purview scans can be ingested and visualized through workbooks, analytical rules, and more. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2224125&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
  "graphQueries": [
    {
      "metricName": "Total data received",
      "legend": "PurviewDataSensitivityLogs",
      "baseQuery": "PurviewDataSensitivityLogs"
    }
  ],
  "sampleQueries": [
    {
      "description": "View files that contain a specific classification (example shows Social Security Number)",
      "query": "PurviewDataSensitivityLogs\n | where Classification has \"Social Security Number\""
    }
  ],
  "dataTypes": [
    {
      "name": "AzureDiagnostics (PurviewDataSensitivityLogs)",
      "lastDataReceivedQuery": "PurviewDataSensitivityLogs\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
    }
  ],
  "connectivityCriterias": [
    {
      "type": "IsConnectedQuery",
      "value": [
        "PurviewDataSensitivityLogs\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
      ]
    }
  ],
  "availability": {
    "status": 1,
    "isPreview": false
  },
  "permissions": {
    "resourceProvider": [
      {
        "provider": "Microsoft.OperationalInsights/workspaces",
        "permissionsDisplayText": "Microsoft Purview account Owner or Contributor role to set up Diagnostic Settings. Microsoft Contributor role with write permissions to enable data connector, view workbook, and create analytic rules.",
        "providerDisplayName": "Workspace",
        "scope": "Workspace",
        "requiredPermissions": {
          "write": true,
          "read": true,
          "delete": true
        }
      }
    ]
  },
  "instructionSteps": [
    {
      "title": "Connect Microsoft Purview to Microsoft Sentinel",
      "description": "Within the Azure Portal, navigate to your Purview resource:\n 1. In the search bar, search for **Purview accounts.**\n 2. Select the specific account that you would like to be set up with Sentinel.\n\nInside your Microsoft Purview resource:\n 3. Select **Diagnostic Settings.**\n 4. Select **+ Add diagnostic setting.**\n 5. In the **Diagnostic setting** blade:\n   - Select the Log Category as **DataSensitivityLogEvent**.\n   - Select **Send to Log Analytics**.\n   - Chose the log destination workspace. This should be the same workspace that is used by **Microsoft Sentinel.**\n  - Click **Save**.",
      "instructions": []
    }
  ]
}