{
    "id": "MicrosoftPurviewInformationProtection",
    "title": "Microsoft Purview Information Protection",
    "publisher": "Microsoft",
    "logo": {
        "type": 258,
        "options": null
    },
    "descriptionMarkdown": "Microsoft Purview Information Protection helps you discover, classify, protect, and govern sensitive information wherever it lives or travels. Using these capabilities enable you to know your data, identify items that are sensitive and gain visibility into how they are being used to better protect your data. Sensitivity labels are the foundational capability that provide protection actions, applying encryption, access restrictions and visual markings.\n    Integrate Microsoft Purview Information Protection logs with Microsoft Sentinel to view dashboards, create custom alerts and improve investigation. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2223811&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "Microsoft Purview Information Protection",
            "baseQuery": "MicrosoftPurviewInformationProtection"
        }
    ],
    "sampleQueries": [
        {
            "description": "Microsoft Purview Information Protection",
            "query": "MicrosoftPurviewInformationProtection\n            | sort by TimeGenerated"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "SentinelKinds",
            "value": [
                "MicrosoftPurviewInformationProtection"
            ]
        }
    ],
    "dataTypes": [
        {
            "name": "MicrosoftPurviewInformationProtection",
            "lastDataReceivedQuery": "MicrosoftPurviewInformationProtection\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 2,
        "featureFlag": {
            "feature": "MicrosoftPurviewInformationProtectionConnector",
            "featureStates": {
                "1": 1,
                "2": 1,
                "3": 1,
                "4": 1
            }
        },
        "isPreview": true
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            }
        ],
        "tenant": [
            "GlobalAdmin",
            "SecurityAdmin"
        ],
        "customs": [
            {
                "name": "License",
                "description": "Enterprise Mobility + Security E5/A5 or Microsoft 365 E5/A5 or P2"
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Connect Microsoft Purview Information Protection audit logs to Microsoft Sentinel",
            "instructions": [
                {
                    "parameters": {
                        "connectorKind": "MicrosoftPurviewInformationProtection",
                        "title": "",
                        "enable": true
                    },
                    "type": "SentinelResourceProvider"
                }
            ]
        }
    ]
}