{
  "Name": "SpyCloud Enterprise Protection CCF",
  "Author": "SpyCloud - integrations@spycloud.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/SpyCloud_Enterprise_Protection.svg\" width=\"75px\" height=\"75px\">",
  "Description": "The [SpyCloud Enterprise Threat Protection](https://spycloud.com/) solution for Microsoft Sentinel ingests SpyCloud breach watchlist and catalog data via the Codeless Connector Framework (CCF), including an optional Compass daily feed. The solution includes three built-in analytic rules, two KQL parsers, and three automation playbooks covering Microsoft Defender for Endpoint response, Azure AD / Entra ID Conditional Access enforcement, and sign-in session revocation.\r\n\r\n**Underlying Microsoft Technologies used:**\r\n\r\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Codeless Connector Framework (CCF)](https://learn.microsoft.com/en-us/azure/sentinel/create-codeless-connector)\r\n\n b. [Azure Logic Apps](https://azure.microsoft.com/services/logic-apps/)\r\n\n c. [Microsoft Defender for Endpoint](https://www.microsoft.com/en-us/security/business/endpoint-security/microsoft-defender-endpoint)",
  "Analytic Rules": [
    "Analytic Rules/AR_Breached_Users_20.yaml",
    "Analytic Rules/AR_malware_25.yaml",
    "Analytic Rules/AR_Access_Records_30.yaml"
  ],
  "Data Connectors": [
    "Data Connectors/SpyCloudEnterpriseProtectionLogsV2_ccp/SpyCloudEnterpriseProtectionLogsV2_connectorDefinition.json"
  ],
  "Parsers": [
    "Parsers/get_Spycloud_enriched_data.yaml",
    "Parsers/get_spycloud_compass_data.yaml"
  ],
  "Playbooks": [
    "Playbooks/SpyCloud_MDE_Automation/azuredeploy.json",
    "Playbooks/SpyCloud_Conditional_Access_Playbook/azuredeploy.json",
    "Playbooks/SpyCloud_Session_Revocation/azuredeploy.json"
  ],
  "Metadata": "SolutionMetadata.json",
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\SpyCloud Enterprise Protection CCF\\",
  "Version": "3.0.1",
  "TemplateSpec": true,
  "Is1PConnector": false
}