{
  "Name": "AbnormalSecurity",
  "Author": "AbnormalSecurity - support@abnormalsecurity.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/AbnormalSecurity/Data%20Connectors/Logo/abnormalsecurity.svg\" width=\"60px\" height=\"60px\">",
  "Description": "The Abnormal Security solution provides real-time security event ingestion from Abnormal's cloud email security platform into Microsoft Sentinel. Supports both push-based (CCF Push) and pull-based (Azure Functions) connectors. The push connector routes events to per-event-type tables (threats, cases, audit logs, abuse mailbox, posture changes, ATO cases, remediations, vendor cases) using the Codeless Connector Framework.",
  "Data Connectors": [
    "Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_connectorDefinition.json",
    "Data Connectors/AbnormalSecurity_API_FunctionApp.json"
  ],
  "Parsers": [
    "Parsers/AbnormalSecurityThreatLog.yaml",
    "Parsers/AbnormalSecurityAtoCases.yaml",
    "Parsers/AbnormalSecurityAbuseMailbox.yaml",
    "Parsers/AbnormalSecurityVendorCases.yaml"
  ],
  "Analytic Rules": [
    "Analytic Rules/AbnormalSecurity_HighRiskEmailAttack.yaml",
    "Analytic Rules/AbnormalSecurity_AccountTakeover.yaml",
    "Analytic Rules/AbnormalSecurity_AbuseMailboxMalicious.yaml",
    "Analytic Rules/AbnormalSecurity_VendorCompromise.yaml"
  ],
  "Hunting Queries": [
    "Hunting Queries/AbnormalSecurity_UnremediatedThreats.yaml",
    "Hunting Queries/AbnormalSecurity_TopAttackTargets.yaml",
    "Hunting Queries/AbnormalSecurity_AbuseMailboxCampaigns.yaml",
    "Hunting Queries/AbnormalSecurity_NewVendorDomains.yaml"
  ],
  "Workbooks": [
    "Workbooks/AbnormalSecurityOverview.json"
  ],
  "WorkbookDescription": [
    "Summarizes email threats, account takeover cases, user-reported messages, and vendor cases ingested from the Abnormal Security CCF Push connector."
  ],
  "Playbooks": [
    "Playbooks/AbnormalSecurity-AddIncidentComment/azuredeploy.json"
  ],
  "PlaybookDescription": [
    "Triggered on Microsoft Sentinel incident creation; adds a comment summarizing the Abnormal Security alert (provider, severity, title) to the incident. Uses only the Microsoft Sentinel connector with a managed identity."
  ],
  "WorkbookBladeDescription": "This Microsoft Sentinel Solution installs workbooks. Workbooks provide a flexible canvas for data monitoring, analysis, and the creation of rich visual reports within the Azure portal. They allow you to tap into one or many data sources from Microsoft Sentinel and combine them into unified interactive experiences.",
  "HuntingQueryBladeDescription": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in Manage solution view.",
  "PlaybooksBladeDescription": "This solution installs the following Playbook templates. After installing the solution, playbooks can be managed in the Manage solution view.",
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\AbnormalSecurity",
  "Version": "3.1.0",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": true,
  "Is1PConnector": false
}