{
  "Name": "SOCRadar",
  "Author": "SOCRadar - integration@socradar.io",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/socradar.svg\" width=\"75px\" height=\"75px\">",
  "Description": "The [SOCRadar](https://socradar.io/) solution for Microsoft Sentinel provides bidirectional integration between SOCRadar XTI Platform and Microsoft Sentinel. Import alarms as incidents, sync closed incidents back to SOCRadar with classification mapping.",
  "WorkbookBladeDescription": "This solution installs a workbook to visualize SOCRadar alarm data imported into Microsoft Sentinel.",
  "HuntingQueryBladeDescription": "This solution installs hunting queries to help investigate SOCRadar alarm data in Microsoft Sentinel.",
  "AnalyticalRuleBladeDescription": "This solution installs analytic rule templates to detect critical SOCRadar alarms, alarm volume anomalies, and sync failures.",
  "PlaybooksBladeDescription": "This solution installs playbooks to automate alarm import and sync between SOCRadar and Microsoft Sentinel.",
  "Version": "3.0.1",
  "BasePath": "C:\\\\GitHub\\\\Azure-Sentinel\\\\Solutions\\\\SOCRadar",
  "TemplateSpec": true,
  "Is1Pconnector": false,
  "Metadata": "SolutionMetadata.json",
  "Workbooks": [
    "Workbooks/SOCRadar-Dashboard.json"
  ],
  "WorkbookDescription": [
    "SOCRadar Dashboard provides visibility into alarms imported from SOCRadar, alarm trends, severity distribution, and audit logs."
  ],
  "Hunting Queries": [
    "Hunting Queries/SOCRadar-Alarm-Overview.yaml",
    "Hunting Queries/SOCRadar-Critical-Alarms.yaml",
    "Hunting Queries/SOCRadar-Alarm-Trends.yaml",
    "Hunting Queries/SOCRadar-Incident-Correlation.yaml",
    "Hunting Queries/SOCRadar-Audit-Analysis.yaml"
  ],
  "Analytic Rules": [
    "Analytic Rules/SOCRadarCriticalAlarmDetection.yaml",
    "Analytic Rules/SOCRadarAlarmVolumeSpike.yaml",
    "Analytic Rules/SOCRadarUnsyncedClosedIncident.yaml"
  ],
  "Playbooks": [
    "Playbooks/SOCRadar-Alarm-Import/azuredeploy.json",
    "Playbooks/SOCRadar-Alarm-Sync/azuredeploy.json"
  ],
  "PlaybookDescription": [
    "Imports SOCRadar alarms as Microsoft Sentinel incidents with deduplication and pagination. Provisions the Data Collection Endpoint, custom log tables (SOCRadar_Alarms_CL and SOCRadarAuditLog_CL) and Data Collection Rules required for alarm storage and audit logging.",
    "Syncs closed Microsoft Sentinel incidents back to SOCRadar with classification mapping."
  ]
}