{
  "id": "ESETInspect",
  "title": "ESET Inspect",
  "publisher": "ESET Netherlands",
  "descriptionMarkdown": "This connector will ingest detections from [ESET Inspect](https://www.eset.com/int/business/solutions/xdr-extended-detection-and-response/) using the provided [REST API](https://help.eset.com/ei_navigate/latest/en-US/api.html). This API is present in ESET Inspect version 1.4 and later.",
  "graphQueries": [
    {
      "metricName": "Total data received",
      "legend": "ESETInspect_CL",
      "baseQuery": "ESETInspect_CL"
    }
  ],
  "sampleQueries": [
    {
      "description": "Top 10 rules triggered",
      "query": "ESETInspect_CL\n | where type_s == \"RuleActivated\"\n | summarize count() by ruleName_s\n | top 10 by count_"
    },
    {
      "description": "Detection totals by type",
      "query": "ESETInspect_CL\n | summarize count() by type_s"
    },
    {
      "description": "Top 10 users with detections",
      "query": "ESETInspect_CL\n | extend Username = tolower(processUser_s)\n | where Username !contains \"nt authority\"\n | summarize count() by Username\n | top 10 by count_"
    },
    {
      "description": "Top 10 systems with detections",
      "query": "ESETInspect_CL\n | extend System = tolower(computerName_s)\n | summarize count() by System\n | top 10 by count_"
    },
    {
      "description": "High severity detections",
      "query": "ESETInspect_CL\n | where severityScore_d >= 80\n | order by id_d desc"
    },
    {
      "description": "Top 10 threats",
      "query": "ESETInspect_CL\n | where isnotempty(threatName_s)\n | summarize count() by threatName_s, type_s\n | top 10 by count_"
    },
    {
      "description": "Detections on new executables",
      "query": "ESETInspect_CL\n | where moduleLgAge_d <= 7"
    },
    {
      "description": "User login outside regular office hours",
      "query": "let startOfDay = datetime_part(\"Hour\", datetime(\"09:00\"));\n let endOfDay = datetime_part(\"Hour\", datetime(\"17:00\"));\n let saturday = time(6);\n let sunday = time(0);\n ESETInspect_CL\n | where tolower(ruleName_s) contains \"remote user login\" or tolower(ruleName_s) contains \"detected rdp communication\"\n | where datetime_part(\"Hour\", creationTime_t) !between(startOfDay .. endOfDay)\n or dayofweek(creationTime_t) == saturday or dayofweek(creationTime_t) == sunday"
    }
  ],
  "dataTypes": [
    {
      "name": "ESETInspect_CL",
      "lastDataReceivedQuery": "ESETInspect_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
    }
  ],
  "connectivityCriterias": [
    {
      "type": "IsConnectedQuery",
      "value": [
        "ESETInspect_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
      ]
    }
  ],
  "availability": {
    "status": 1,
    "isPreview": false
  },
  "permissions": {
    "resourceProvider": [
      {
        "provider": "Microsoft.OperationalInsights/workspaces",
        "permissionsDisplayText": "read and write permissions on the workspace are required.",
        "providerDisplayName": "Workspace",
        "scope": "Workspace",
        "requiredPermissions": {
          "write": true,
          "read": true,
          "delete": true
        }
      },
      {
        "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
        "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
        "providerDisplayName": "Keys",
        "scope": "Workspace",
        "requiredPermissions": {
          "action": true
        }
      }
    ],
    "customs": [
      {
        "name": "Microsoft.Web/sites permissions",
        "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)."
      },
      {
        "name": "Access to the ESET PROTECT console",
        "description": "Permissions to add users"
      }
    ]
  },
  "instructionSteps": [
    {
      "title": "",
      "description": ">**NOTE:** This connector uses Azure Functions to connect to ESET Inspect to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details."
    },
    {
      "title": "",
      "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App."
    },
    {
      "title": "Step 1 -  Create an API user",
      "description": "1. Log into the ESET PROTECT console with an administrator account, select the **More** tab and the **Users** subtab. \n2. Click on the **ADD NEW** button and add a **native user**.\n3. Create a new user for the API account. **Optional:** Select a **Home group** other than **All** to limit what detections are ingested. \n4. Under the **Permission Sets** tab, assign the **Inspect reviewer permission set**.\n4. Log out of the administrator account and log into the console with the new API credentials for validation, then log out of the API account. \n5."
    },
    {
      "title": "Step 2 - Copy Workspace ID and Key",
      "description": ">**IMPORTANT:** Before deploying the ESET Inspect connector, have the Workspace ID and Workspace Primary Key (can be copied from the following) readily available.",
      "instructions": [
        {
          "parameters": {
            "fillWith": ["WorkspaceId"],
            "label": "Workspace ID"
          },
          "type": "CopyableLabel"
        },
        {
          "parameters": {
            "fillWith": ["PrimaryKey"],
            "label": "Primary Key"
          },
          "type": "CopyableLabel"
        }
      ]
    },
    {
      "title": "Step 3 - Deploy the Azure Resource Manager (ARM) Template",
      "description": "Use this method for automated deployment of the ESET Inspect connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-ESETInspect-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **API Username**, **API Password** , enter the **Inspect base URL** and the **first ID** to start ingesting detections from.\n - The defailt starting ID is **0**. This means that all detections will be ingested. \n - Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details. \n4. Mark the checkbox labelled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy."
    }
  ],
  "metadata": {
    "id": "c3968094-03b7-43cc-b27e-de8fae820ef0",
    "version": "1.1.0",
    "kind": "dataConnector",
    "source": {
        "kind": "solution",
        "name": "ESET Inspect"
    },
    "author": {
        "name": "Donny Maasland | ESET Netherlands"
    },
    "support": {
        "tier": "developer",
        "name": "ESET Netherlands",
        "link":"https://techcenter.eset.nl/"
    }
}
}