{
    "_comment": "Keep in sync with azuredeploy-alert-importer.json (used by the standalone README / Deploy to Azure button path).",
    "id": "RecordedFutureIdentityAlertImporter",
    "title": "Recorded Future Identity - Playbook Alert Importer",
    "publisher": "Recorded Future",
    "descriptionMarkdown": "Imports Recorded Future Identity Playbook Alerts into Microsoft Sentinel. Enables incident creation via Analytic Rules on the `RFI_PlaybookAlertResults_V2_CL` table. For full installation details, see the [readme](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Recorded%20Future%20Identity/Playbooks/readme.md).",
    "graphQueries": [
        {
            "metricName": "Playbook Alert Results",
            "legend": "RFI_PlaybookAlertResults_V2_CL",
            "baseQuery": "RFI_PlaybookAlertResults_V2_CL"
        }
    ],
    "sampleQueries": [
        {
            "description": "All playbook alert results",
            "query": "RFI_PlaybookAlertResults_V2_CL\n| sort by TimeGenerated desc"
        },
        {
            "description": "High priority exposures",
            "query": "RFI_PlaybookAlertResults_V2_CL\n| where panel_status_priority == 'High'\n| sort by TimeGenerated desc"
        },
        {
            "description": "New alerts only",
            "query": "RFI_PlaybookAlertResults_V2_CL\n| where panel_status_status == 'New'\n| sort by TimeGenerated desc"
        }
    ],
    "dataTypes": [
        {
            "name": "RFI_PlaybookAlertResults_V2_CL",
            "lastDataReceivedQuery": "RFI_PlaybookAlertResults_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
    ],
    "connectivityCriteria": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "RFI_PlaybookAlertResults_V2_CL\n| summarize LastLog = max(TimeGenerated)\n| where LastLog >= ago(24h)"
            ]
        }
    ],
    "availability": {
        "status": 1
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "Read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true
                }
            }
        ],
        "customs": [
            {
                "name": "Azure Subscription",
                "description": "Step 1 (Data Connectors infrastructure) requires **Monitoring Contributor** and **Log Analytics Contributor** on the resource group. Step 3 (playbook) requires **Owner** or **Role Based Access Control Administrator** when deploying with automatic role assignment (`create_role_assignment=true`), otherwise **Contributor** suffices."
            },
            {
                "name": "Recorded Future API Token",
                "description": "A Recorded Future Identity API token is required to authorize the RFI Custom Connector used by the playbook."
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Step 1 \u2014 Deploy Data Connectors infrastructure",
            "description": "Deploys the shared Data Collection Endpoint (DCE), Data Collection Rule (DCR), Log Analytics table (`RFI_PlaybookAlertResults_V2_CL`), and this connector definition tile.\n\n[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FRecorded%20Future%20Identity%2FData%20Connectors%2Fazuredeploy-alert-importer.json)"
        },
        {
            "title": "Step 2 \u2014 Deploy RFI-CustomConnector",
            "description": "The custom connector handles authentication towards the Recorded Future API. Deploy it once \u2014 it is shared by the playbook.\n\n[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FRecorded%20Future%20Identity%2FPlaybooks%2FConnectors%2FRFI-CustomConnector-0-2-0%2Fazuredeploy.json)"
        },
        {
            "title": "Step 3 \u2014 Deploy RFI-Playbook-Alert-Importer-LAW",
            "description": "Deploys the Logic App that imports Recorded Future Identity Playbook Alerts and writes them to the Log Analytics table using Managed Identity. Set `create_role_assignment=false` if your organization requires manual role assignment (see permissions above). After deployment, authorize the connectors and enable the Logic App.\n\n[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FRecorded%20Future%20Identity%2FPlaybooks%2FRFI-Playbook-Alert-Importer-LAW%2Fazuredeploy.json)"
        },
        {
            "title": "Step 4 \u2014 Deploy Analytics Rule",
            "description": "Creates Microsoft Sentinel incidents from the `RFI_PlaybookAlertResults_V2_CL` table. The rule is also available under **Microsoft Sentinel \u2192 Configuration \u2192 Analytics \u2192 Rule Templates**.\n\n[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FRecorded%20Future%20Identity%2FData%20Connectors%2Fazuredeploy-incident-creation-analytic-rule.json)"
        }
    ]
}