{
    "id": "ProviderNameApplianceName",
    "title": "PROVIDER NAME APPLIANCE NAME",
    "publisher": "PROVIDER NAME",
    "descriptionMarkdown": "The PROVIDER NAME APPLIANCE NAME data connector ingests Common Event Format (CEF) logs from APPLIANCE NAME into Microsoft Sentinel. CEF is an industry standard format on top of Syslog messages, used by many security vendors to allow event interoperability. Logs are collected using the Azure Monitor Agent (AMA) via the Microsoft **Common Event Format (CEF) via AMA** solution, which must be installed in your workspace before configuring this connector.\n\n[Learn more about the CEF via AMA connector >](https://learn.microsoft.com/azure/sentinel/connect-cef-ama)",
    "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected. The [**KUSTO_FUNCTION_ALIAS**](LINK_TO_PARSER_ON_GITHUB) parser is deployed with the Microsoft Sentinel solution. If your connector does not use a custom parser, remove this field.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "DATATYPE_NAME",
            "baseQuery": "CommonSecurityLog\n| where DeviceVendor == \"PROVIDER NAME\"\n| where DeviceProduct == \"APPLIANCE NAME\""
        }
    ],
    "sampleQueries": [
        {
            "description": "All APPLIANCE NAME events",
            "query": "CommonSecurityLog\n| where DeviceVendor == \"PROVIDER NAME\"\n| where DeviceProduct == \"APPLIANCE NAME\"\n| sort by TimeGenerated desc"
        },
        {
            "description": "APPLIANCE NAME events – last 24 hours",
            "query": "CommonSecurityLog\n| where DeviceVendor == \"PROVIDER NAME\"\n| where DeviceProduct == \"APPLIANCE NAME\"\n| where TimeGenerated > ago(24h)\n| sort by TimeGenerated desc"
        }
    ],
    "dataTypes": [
        {
            "name": "CommonSecurityLog (DATATYPE_NAME)",
            "lastDataReceivedQuery": "CommonSecurityLog\n| where DeviceVendor == \"PROVIDER NAME\"\n| where DeviceProduct == \"APPLIANCE NAME\"\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "CommonSecurityLog\n| where DeviceVendor == \"PROVIDER NAME\"\n| where DeviceProduct == \"APPLIANCE NAME\"\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            }
        ],
        "customs": [
            {
                "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install)"
            },
            {
                "description": "The **Common Event Format (CEF) via AMA** solution must be installed in your Microsoft Sentinel workspace. [Install from Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/saas/azuresentinel.azure-sentinel-solution-commoneventformat)"
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "1. Configure APPLIANCE NAME to forward CEF logs",
            "description": "Configure APPLIANCE NAME to forward Syslog messages in CEF format to a Linux log forwarder machine on port 514 TCP.\n\n> Replace this step with your product-specific instructions for enabling CEF output. Include the destination IP/hostname of the log forwarder and any product-side configuration steps the customer must complete."
        },
        {
            "title": "2. Install the Common Event Format (CEF) via AMA solution",
            "description": "This connector relies on the Microsoft **Common Event Format (CEF) via AMA** solution to collect CEF data into your workspace using the Azure Monitor Agent. If you have not already installed it, install it from the Microsoft Marketplace and create a Data Collection Rule (DCR) to collect CEF logs from your log forwarder.\n\n[Install Common Event Format (CEF) via AMA from Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/saas/azuresentinel.azure-sentinel-solution-commoneventformat)"
        }
    ],
    "metadata": {
        "id": "Unique Identifier (GUID) used to identify dependencies and content from solutions or community.",
        "version": "This is an optional field. Default and recommended format for kind value as **community or solutions** is string eg. \"1.0.0\" aligning with solutions which makes it easier to manage the content. Whereas, for kind value as **sourceRepository** the recommended format is numeric (eg. 1, 1.0,1.0.0, etc) aligning to ARM template best practices.",
        "kind": "dataConnector",
        "source": {
            "kind": "source type of the content. Value must be one of these : localWorkspace | community | solution | sourceRepository",
            "name": "Name of the content source. The repo name, solution name, LA workspace name etc."
        },
        "author": {
            "name": "Name of the author. For localWorkspace it is automatically the workspace user"
        },
        "support": {
            "tier": "Type of support for content item: microsoft | developer | community",
            "name": "Name of support contact or company",
            "email": "Optional: Email of support contact",
            "link":"Optional: Link for support help, like to support page to open a ticket etc"
        }
    }
}