{
    "id": "DigitalGuardianDLP",
    "title": "[Deprecated] Digital Guardian Data Loss Prevention",
    "publisher": "Digital Guardian",
    "descriptionMarkdown": "[Digital Guardian Data Loss Prevention (DLP)](https://digitalguardian.com/platform-overview) data connector provides the capability to ingest Digital Guardian DLP logs into Microsoft Sentinel.",
    "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**DigitalGuardianDLPEvent**](https://aka.ms/sentinel-DigitalGuardianDLP-parser) which is deployed with the Microsoft Sentinel Solution.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "DigitalGuardianDLPEvent",
            "baseQuery": "DigitalGuardianDLPEvent"
        }
    ],
    "sampleQueries": [
        {
            "description" : "Top 10 Clients (Source IP)",
            "query": "DigitalGuardianDLPEvent\n | where notempty(SrcIpAddr)\n | summarize count() by SrcIpAddr\n | top 10 by count_"
        }
    ],
    "dataTypes": [
        {
            "name": "Syslog (DigitalGuardianDLPEvent)",
            "lastDataReceivedQuery": "DigitalGuardianDLPEvent\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "DigitalGuardianDLPEvent\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "write permission is required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "",
            "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**DigitalGuardianDLPEvent**](https://aka.ms/sentinel-DigitalGuardianDLP-parser) which is deployed with the Microsoft Sentinel Solution.",
            "instructions": [
            ]
        },
        {
            "title": "1. Configure Digital Guardian to forward logs via Syslog to remote server where you will install the agent.",
            "description": "Follow these steps to configure Digital Guardian to forward logs via Syslog:\n\n1.1. Log in to the Digital Guardian Management Console.\n\n1.2. Select **Workspace** > **Data Export** > **Create Export**.\n\n1.3. From the **Data Sources** list, select **Alerts** or **Events** as the data source.\n\n1.4. From the **Export type** list, select **Syslog**.\n\n1.5. From the **Type list**, select **UDP** or **TCP** as the transport protocol.\n\n1.6. In the **Server** field, type the IP address of your Remote Syslog server.\n\n1.7. In the **Port** field, type 514 (or other port if your Syslog server was configured to use non-default port).\n\n1.8. From the **Severity Level** list, select a severity level.\n\n1.9. Select the **Is Active** check box.\n\n1.9. Click **Next**.\n\n1.10. From the list of available fields, add Alert or Event fields for your data export.\n\n1.11. Select a Criteria for the fields in your data export and click **Next**.\n\n1.12. Select a group for the criteria and click **Next**.\n\n1.13. Click **Test Query**.\n\n1.14. Click **Next**.\n\n1.15. Save the data export."
        },
        {
            "title": "2. Install and onboard the agent for Linux or Windows",
            "description": "Install the agent on the Server to which the logs will be forwarded.\n\n> Logs on Linux or Windows servers are collected by **Linux** or **Windows** agents.",
            "instructions": [
                {
                "parameters": {
                "title": "Choose where to install the Linux agent:",
    "instructionSteps": [
            {
            "title": "Install agent on Azure Linux Virtual Machine",
            "description": "Select the machine to install the agent on and then click **Connect**.",
            "instructions": [
                {
                "parameters": {
                "linkType": "InstallAgentOnLinuxVirtualMachine"
                },
                "type": "InstallAgent"
                }
            ]
        },
            {
            "title": "Install agent on a non-Azure Linux Machine",
            "description": "Download the agent on the relevant machine and follow the instructions.",
            "instructions": [
                {
                "parameters": {
                "linkType": "InstallAgentOnLinuxNonAzure"
                },
                "type": "InstallAgent"
                }
            ]
        }
    ]
        },
            "type": "InstructionStepsGroup"
            }
        ]
            },
            {
                "instructions": [
                    {
                    "parameters": {
                    "title": "Choose where to install the Windows agent:",
        "instructionSteps": [
                {
                "title": "Install agent on Azure Windows Virtual Machine",
                "description": "Select the machine to install the agent on and then click **Connect**.",
                "instructions": [
                    {
                    "parameters": {
                    "linkType": "InstallAgentOnVirtualMachine"
                    },
                    "type": "InstallAgent"
                    }
                ]
            },
                {
                "title": "Install agent on a non-Azure Windows Machine",
                "description": "Download the agent on the relevant machine and follow the instructions.",
                "instructions": [
                    {
                    "parameters": {
                    "linkType": "InstallAgentOnNonAzure"
                    },
                    "type": "InstallAgent"
                    }
                ]
            }
        ]
            },
                "type": "InstructionStepsGroup"
                }
            ]
                },
                {
                    "title": "3. Check logs in Microsoft Sentinel",
                    "description": "Open Log Analytics to check if the logs are received using the Syslog schema.\n\n>**NOTE:** It may take up to 15 minutes before new logs will appear in Syslog table.",
                    "instructions": []    
                }
    ]
}