{
    "id": "GitLab",
    "title": "[Deprecated] GitLab",
    "publisher": "Microsoft",
    "descriptionMarkdown": "The [GitLab](https://about.gitlab.com/solutions/devops-platform/) connector allows you to easily connect your GitLab (GitLab Enterprise Edition - Standalone) logs with Microsoft Sentinel. This gives you more security insight into your organization's DevOps pipelines.",
    "additionalRequirementBanner": "This data connector depends on three parsers based on a Kusto Function to work as expected [**GitLab Access Logs**](https://aka.ms/sentinel-GitLabAccess-parser), [**GitLab Audit Logs**](https://aka.ms/sentinel-GitLabAudit-parser) and [**GitLab Application Logs**](https://aka.ms/sentinel-GitLabApp-parser) which are deployed with the Microsoft Sentinel Solution.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "GitLabApp",
            "baseQuery": "GitLabApp"
        },
        {
            "metricName": "Total data received",
            "legend": "GitLabAudit",
            "baseQuery": "GitLabAudit"
        },
        {
            "metricName": "Total data received",
            "legend": "GitLabAccess",
            "baseQuery": "GitLabAccess"
        }
    ],
    "sampleQueries": [
        {
            "description" : "GitLab Application Logs",
            "query": "GitLabApp | sort by TimeGenerated"
        },
        {
            "description" : "GitLab Audit Logs",
            "query": "GitLabAudit | sort by TimeGenerated"
        },
        {
            "description" : "GitLab Access Logs",
            "query": "GitLabAccess | sort by TimeGenerated"
        }
    ],
    "dataTypes": [
        {
            "name": "Syslog (GitlabAccess)",
            "lastDataReceivedQuery": "GitLabAccess\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "Syslog (GitlabAudit)",
            "lastDataReceivedQuery": "GitLabAudit\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "Syslog (GitlabApp)",
            "lastDataReceivedQuery": "GitLabApp\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "GitLabApp\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)",
                "GitLabAudit\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)",
                "GitLabAccess\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "write permission is required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "delete": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Configuration", 
            "description": ">This data connector depends on three parsers based on a Kusto Function to work as expected [**GitLab Access Logs**](https://aka.ms/sentinel-GitLabAccess-parser), [**GitLab Audit Logs**](https://aka.ms/sentinel-GitLabAudit-parser) and [**GitLab Application Logs**](https://aka.ms/sentinel-GitLabApp-parser) which are deployed with the Microsoft Sentinel Solution.",
            "instructions": [ 
            ]    
        }, 
        {
            "title": "1. Install and onboard the agent for Linux",
            "description": "Typically, you should install the agent on a different computer from the one on which the logs are generated.\n\n>  Syslog logs are collected only from **Linux** agents.",
            "instructions": [
                {
                    "parameters": {
                        "title": "Choose where to install the agent:",
                        "instructionSteps": [
                            {
                                "title": "Install agent on Azure Linux Virtual Machine",
                                "description": "Select the machine to install the agent on and then click **Connect**.",
                                "instructions": [
                                    {
                                        "parameters": {
                                            "linkType": "InstallAgentOnLinuxVirtualMachine"
                                        },
                                        "type": "InstallAgent"
                                    }
                                ]
                            },
                            {
                                "title": "Install agent on a non-Azure Linux Machine",
                                "description": "Download the agent on the relevant machine and follow the instructions.",
                                "instructions": [
                                    {
                                        "parameters": {
                                            "linkType": "InstallAgentOnLinuxNonAzure"
                                        },
                                        "type": "InstallAgent"
                                    }
                                ]
                            }
                        ]
                    },
                    "type": "InstructionStepsGroup"
                }
            ]
        },
        {
            "title": "2. Configure the logs to be collected",
            "description": "Configure the facilities you want to collect and their severities.\n\n1.  Under workspace advanced settings **Configuration**, select **Data** and then **Syslog**.\n2.  Select **Apply below configuration to my machines** and select the facilities and severities.\n3.  Click **Save**.",
            "instructions": [
                {
                    "parameters": {
                        "linkType": "OpenSyslogSettings"
                    },
                    "type": "InstallAgent"
                }
            ]
        }
    ],
    "metadata": {
        "id": "Unique Identifier (GUID) used to identify dependencies and content from solutions or community.",
        "version": "1.0.0",
        "kind": "dataConnector",
        "source": {
            "kind": "community"
        },
        "author": {
            "name": "Guillaume Benats"
        },
        "support": {
            "tier": "community",
            "name": "Guillaume Benats",
            "link":"https://github.com/Azure/Azure-Sentinel/issues"
        }
    }
}