{
    "id": "InfobloxSOCInsightsDataConnector_API",
    "title": "Infoblox SOC Insight Data Connector via REST API",
    "publisher": "Infoblox",
    "descriptionMarkdown": "The Infoblox SOC Insight Data Connector allows you to easily connect your Infoblox BloxOne SOC Insight data with Microsoft Sentinel. By connecting your logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log.",
    "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxInsight**](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Infoblox%20SOC%20Insights/Parsers/InfobloxInsight.yaml) which is deployed with the Microsoft Sentinel Solution.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "InfobloxInsight",
            "baseQuery": "InfobloxInsight_CL"
        }
    ],
    "sampleQueries": [
        {
            "description" : "Return all logs involving DNS Tunneling",
            "query": "InfobloxInsight_CL\n| where threatType_s == \"DNS Tunneling\""
        },
        {
            "description" : "Return all logs involving a configuration issue",
            "query": "InfobloxInsight_CL\n| where tClass_s == \"TI-CONFIGURATIONISSUE\""
        },
        {
            "description" : "Return count of critical priority insights",
            "query": "InfobloxInsight_CL\n| where priorityText_s == \"CRITICAL\"\n | summarize dcount(insightId_g) by priorityText_s"
        },
        {
            "description" : "Return each spreading insight by ThreatClass",
            "query": "InfobloxInsight_CL\n| where isnotempty(spreadingDate_t)\n | summarize dcount(insightId_g) by tClass_s"
        },
        {
            "description" : "Return each Insight by ThreatFamily",
            "query": "InfobloxInsight_CL\n| | summarize dcount(insightId_g) by tFamily_s"
        }
    ],
    "dataTypes": [
        {
            "name": "InfobloxInsight_CL",
            "lastDataReceivedQuery": "InfobloxInsight_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "InfobloxInsight_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(3d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Workspace Keys",
            "description": "In order to use the playbooks as part of this solution, find your **Workspace ID** and **Workspace Primary Key** below for your convenience.", 
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                            "PrimaryKey"
                        ],
                        "label": "Workspace Key"
                    },
                    "type": "CopyableLabel"
                }
            ]
        },
        {
            "title": "Parsers",
            "description": ">This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxInsight**](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Infoblox%20SOC%20Insights/Parsers/InfobloxInsight.yaml) which is deployed with the Microsoft Sentinel Solution.",
            "instructions": []
        },
        {
            "title": "SOC Insights",
            "description": ">This data connector assumes you have access to Infoblox BloxOne Threat Defense SOC Insights. You can find more information about SOC Insights [**here**](https://docs.infoblox.com/space/BloxOneThreatDefense/501514252/SOC+Insights).",
            "instructions": []
        },
       
        {
            "title": "Follow the steps below to configure this data connector",
            "description": "",
            "instructions": [
				       {
                    "parameters": {
                        "instructionSteps": [
                            {
                                "title": "1.  Generate an Infoblox API Key and copy it somewhere safe",
                                "description": "In the [Infoblox Cloud Services Portal](https://csp.infoblox.com/atlas/app/welcome), generate an API Key and copy it somewhere safe to use in the next step. You can find instructions on how to create API keys [**here**](https://docs.infoblox.com/space/BloxOneThreatDefense/230394187/How+Do+I+Create+an+API+Key%3F).",
                                "instructions": [
                                ]
                            },
                            {
                                "title": "2.  Configure the Infoblox-SOC-Get-Open-Insights-API playbook",
                                "description": "Create and configure the **Infoblox-SOC-Get-Open-Insights-API** playbook which is deployed with this solution. Enter your Infoblox API key in the appropriate parameter when prompted.",
                                "instructions": [
                                ]
                            }				
                        ]
                    },
                    "type": "InstructionStepsGroup"
                }
			]
        }
    ]
}