{
    "id": "ZimperiumMtdAlerts",
    "title": "Zimperium Mobile Threat Defense",
    "publisher": "Zimperium",
    "descriptionMarkdown": "Zimperium Mobile Threat Defense connector gives you the ability to connect the Zimperium threat log with Microsoft Sentinel to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization's mobile threat landscape and enhances your security operation capabilities.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "ZimperiumThreatLog_CL",
            "baseQuery": "ZimperiumThreatLog_CL"
        }
    ],
    "sampleQueries": [
        {
            "description" : "All threats with threat vector equal to Device",
            "query": "ZimperiumThreatLog_CL \n | where threat_vector_s  == \"Device\" \n | limit 100"
        },
        {
            "description" : "All threats for devices running iOS",
            "query": "ZimperiumThreatLog_CL \n | where device_os_s == \"ios\" \n | order by event_timestamp_s  desc nulls last"
        },
        {
            "description" : "View latest mitigations",
            "query": "ZimperiumMitigationLog_CL \n | order by event_timestamp_s  desc nulls last"
        }
    ],
    "dataTypes": [
        {
            "name": "ZimperiumThreatLog_CL",
            "lastDataReceivedQuery": "ZimperiumThreatLog_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZimperiumMitigationLog_CL",
            "lastDataReceivedQuery": "ZimperiumMitigationLog_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "ZimperiumThreatLog_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false 
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Configure and connect Zimperium MTD",
            "description": "1. In zConsole, click **Manage** on the navigation bar.\n2. Click the **Integrations** tab.\n3. Click the **Threat Reporting** button and then the **Add Integrations** button.\n4. Create the Integration:\n  - From the available integrations, select Microsoft Sentinel.\n  - Enter your workspace id and primary key from the fields below, click **Next**.\n  - Fill in a name for your Microsoft Sentinel integration.\n  - Select a Filter Level for the threat data you wish to push to Microsoft Sentinel.\n  - Click **Finish**\n5. For additional instructions, please refer to the [Zimperium customer support portal](https://support.zimperium.com).",
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                        "PrimaryKey"
                        ],
                        "label": "Primary Key"
                    },
                    "type": "CopyableLabel"
                }
            ]
        }
    ],
    "metadata": {
        "id": "26bcf619-26b2-44aa-a7ad-212da52deeb8",
        "version": "1.0.0",
        "kind": "dataConnector",
        "source": {
            "kind": "community"
        },
        "author": {
            "name": "Zimperium"
        },
        "support": {
            "name": "Zimperium",
            "link": "https://www.zimperium.com/support",
            "tier": "developer"
        }
    }
}