{
  "id": "Cribl",
  "title": "Cribl",
  "publisher": "Cribl",
  "descriptionMarkdown": "The [Cribl](https://cribl.io/accelerate-cloud-migration/) connector allows you to easily connect your Cribl (Cribl Enterprise Edition - Standalone) logs with Microsoft Sentinel. This gives you more security insight into your organization's data pipelines.",
  "additionalRequirementBanner": "This data connector depends on four parsers based on a Kusto Function to work as expected [**Cribl Access Logs**](https://aka.ms/sentinel-CriblAccess-parser), [**Cribl UI Access Logs**](https://aka.ms/sentinel-CriblUIAccess-parser), [**Cribl Audit Logs**](https://aka.ms/sentinel-CriblAudit-parser) and [**Cribl Internal Logs**](https://aka.ms/sentinel-CriblInternal-parser) which are deployed with the Microsoft Sentinel Solution.",
  "graphQueries": [
    {
      "metricName": "Cribl Internal Events",
      "legend": "CriblInternal",
      "baseQuery": "CriblInternal_CL"
    }
  ],
  "sampleQueries": [
    {
      "description": "Cribl Internal Logs",
      "query": "CriblInternal_CL | sort by TimeGenerated"
    },
    {
      "description": "Cribl Audit Logs",
      "query": "CriblAudit_CL | sort by TimeGenerated"
    },
    {
      "description": "Cribl Access Logs",
      "query": "CriblAccess_CL | sort by TimeGenerated"
    },
    {
      "description": "Cribl UI Access Logs",
      "query": "CriblUIAccess_CL | sort by TimeGenerated"
    }
  ],
  "dataTypes": [
      {
          "name": "CriblAccess_CL",
          "lastDataReceivedQuery": "CriblAccess_CL           | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
      },
      {
          "name": "CriblAudit_CL",
          "lastDataReceivedQuery": "CriblAudit_CL            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
      },
      {
        "name": "CriblUIAccess_CL",
        "lastDataReceivedQuery": "CriblUIAccess_CL           | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
    },
    {
        "name": "CriblInternal_CL",
        "lastDataReceivedQuery": "CriblInternal_CL            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
    }
  ],
  "connectivityCriterias": [
      {
          "type": "IsConnectedQuery",
          "value": [
              "CriblInternal_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)",
              "CriblAudit_CL\n           | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)",
              "CriblAccess_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)",
              "CriblUIAccess_CL\n           | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
          ]
      }
  ],
  "availability": {
      "status": 1,
      "isPreview": false
  },
  "permissions": {
      "resourceProvider": [
          {
              "provider": "Microsoft.OperationalInsights/workspaces",
              "permissionsDisplayText": "read and write permissions are required.",
              "providerDisplayName": "Workspace",
              "scope": "Workspace",
              "requiredPermissions": {
                  "read": true,  
                  "write": true,
                  "delete": true
              }
          },
          {
            "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
            "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
            "providerDisplayName": "Keys",
            "scope": "Workspace",
            "requiredPermissions": {
                "action": true
            }
        }
      ]
  },
"instructionSteps": [
                    {
                      "title": "Installation and setup instructions for Cribl Stream for Microsoft Sentinel",
                      "description": "Use the documentation from this Github repository and configure Cribl Stream using \n\nhttps://docs.cribl.io/stream/usecase-azure-workspace/"
                    }
                  ],
  "metadata": {
    "version": "1.0.0",
    "kind": "dataConnector",
    "source": {
      "kind": "community"
    },
    "support": {
      "tier": "Partner",
      "name": "Cribl",
      "link": "https://cribl.io/support"
    }
  }
}