{
    "id": "InfoSecDataConnector",
    "title": "InfoSecGlobal Data Connector",
    "publisher": "InfoSecGlobal",
    "descriptionMarkdown": "Use this data connector to integrate with InfoSec Crypto Analytics and get data sent directly to Microsoft Sentinel.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "InfoSecAnalytics_CL",
            "baseQuery": "InfoSecAnalytics_CL"
        }
    ],
    "sampleQueries": [
        {
            "description" : "List all artifacts",
            "query": "InfoSecAnalytics_CL"
        }
    ],
    "dataTypes": [
        {
            "name": "InfoSecAnalytics_CL",
            "lastDataReceivedQuery": "InfoSecAnalytics_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "InfoSecAnalytics_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "InfoSecGlobal Crypto Analytics Data Connector",
            "description": "1. Data is sent to Microsoft Sentinel through Logstash\n 2. Required Logstash configuration is included with Crypto Analytics installation\n 3. Documentation provided with the Crypto Analytics installation explains how to enable sending data to Microsoft Sentinel\n",
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                            "PrimaryKey"
                        ],
                        "label": "Primary Key"
                    },
                    "type": "CopyableLabel"
                }
            ]
        }
    ],
    "metadata": {
        "id": "38ead227-273e-33e3-43ad-8f3e230df413",
        "version": "1.0.0",
        "kind": "dataConnector",
        "source": {
            "kind": "solution",
            "name": "InfoSecGlobalSolution"
        },
        "author": {
            "name": "InfoSecGlobal"
        },
        "support": {
            "tier": "developer",
            "name": "InfoSecGlobal"
        }
    }
}