{
    "id": "FortinetFortiNdrCloudDataConnector",
    "title": "Fortinet FortiNDR Cloud",
    "publisher": "Fortinet",
    "descriptionMarkdown": "The Fortinet FortiNDR Cloud data connector provides the capability to ingest [Fortinet FortiNDR Cloud](https://docs.fortinet.com/product/fortindr-cloud) data into Microsoft Sentinel using the FortiNDR Cloud API",
    "additionalRequirementBanner": "These queries and workbooks are dependent on a parser based on Kusto to work as expected. Follow the steps to use this Kusto functions alias **Fortinet_FortiNDR_Cloud** in queries and workbooks. [Follow steps to get this Kusto functions>](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Fortinet%20FortiNDR%20Cloud/Parsers/Fortinet_FortiNDR_Cloud.md) ",
    "graphQueries": [
        {
            "metricName": "Fortinet FortiNDR Cloud Suricata Logs",
            "legend": "Fortinet_FortiNDR_Cloud",
            "baseQuery": "FortinetFortiNdrCloudRaw_CL | where LogTypeSuffix == 'suricata'"
        },
        {
            "metricName": "Fortinet FortiNDR Cloud Observation Logs",
            "legend": "Fortinet_FortiNDR_Cloud",
            "baseQuery": "FortinetFortiNdrCloudRaw_CL | where LogTypeSuffix == 'observation'"
        },
        {
            "metricName": "Fortinet FortiNDR Cloud Detections Logs",
            "legend": "Fortinet_FortiNDR_Cloud",
            "baseQuery": "FortinetFortiNdrCloudRaw_CL | where LogTypeSuffix == 'detections'"
        }
    ],
    "sampleQueries": [
        {
            "description" : "Fortinet FortiNDR Cloud Suricata Logs",
            "query": "FortinetFortiNdrCloudRaw_CL | where LogTypeSuffix == 'suricata'\n | sort by TimeGenerated desc"
        },
        {
            "description" : "Fortinet FortiNDR Cloud Observation Logs",
            "query": "FortinetFortiNdrCloudRaw_CL | where LogTypeSuffix == 'observation'\n | sort by TimeGenerated desc"
        },
        {
            "description" : "Fortinet FortiNDR Cloud Detections Logs",
            "query": "FortinetFortiNdrCloudRaw_CL | where LogTypeSuffix == 'detections'\n | sort by TimeGenerated desc"
        }
    ],
    "dataTypes": [
        {
            "name": "FncEventsSuricata_CL",
            "lastDataReceivedQuery": "FortinetFortiNdrCloudRaw_CL | where LogTypeSuffix == 'suricata'\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "FncEventsObservation_CL",
            "lastDataReceivedQuery": "FortinetFortiNdrCloudRaw_CL | where LogTypeSuffix == 'observation'\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "FncEventsDetections_CL",
            "lastDataReceivedQuery": "FortinetFortiNdrCloudRaw_CL | where LogTypeSuffix == 'detections'\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "FortinetFortiNdrCloudRaw_CL | where LogTypeSuffix == 'suricata'\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "FortinetFortiNdrCloudRaw_CL | where LogTypeSuffix == 'observation'\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "FortinetFortiNdrCloudRaw_CL | where LogTypeSuffix == 'detections'\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": true
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions on the workspace are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
			{
				"provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
				"permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
				"providerDisplayName": "Keys",
				"scope": "Workspace",
				"requiredPermissions": {
					"action": true
				}
			}
        ],
        "customs": [
            {
                "name": "Microsoft.Web/sites permissions",
                "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)."
            },            
            {
                "name": "MetaStream Credentials",
                "description": "**AWS Access Key Id**, **AWS Secret Access Key**, **FortiNDR Cloud Account Code** are required to retrieve event data."
            },
            {
                "name": "API Credentials",
                "description": "**FortiNDR Cloud API Token**, **FortiNDR Cloud Account UUID** are required to retrieve detection data."
            }
        ]
    },
    "instructionSteps": [
        {
            "description": ">**NOTE:** This connector uses an enterprise application integration model via Azure Functions to securely pull logs from the FortiNDR Cloud API into Microsoft Sentinel. This deployment may incur data ingestion and compute costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details."
        },
        {
            "title": "",
            "description": ">**(Optional Step)** Securely store **API authorization key(s) or token(s)** in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App."
        },
        {
            "title": "",
            "description": ">**NOTE:** This connector uses a parser based on a Kusto Function to normalize fields. [Follow these steps](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Fortinet%20FortiNDR%20Cloud/Parsers/Fortinet_FortiNDR_Cloud.md) to create the Kusto function alias **Fortinet_FortiNDR_Cloud**."
        },
        {
            "description": "**STEP 1 - Deploy the connector and the associated Azure Function**\n\n>**IMPORTANT:** Before deploying the Fortinet FortiNDR Cloud connector, have the value below, readily available.",
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                }
            ]
        },
        {
            "description": "**STEP 2 - Azure Resource Manager (ARM) Template**\n\nUse this method for automated deployment of the Fortinet FortiNDR Cloud connector.\n\n1. Click the **Deploy to Azure** button below.\n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-FortinetFortiNDR-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**.\n3. Click **Create** to deploy."
        }
        ]
}