{
    "id": "ForescoutHostPropertyMonitor",
    "title": "Forescout Host Property Monitor",
    "publisher": "Forescout",
    "descriptionMarkdown": "The Forescout Host Property Monitor connector allows you to connect host/policy/compliance properties from Forescout platform with Microsoft Sentinel, to view, create custom incidents, and improve investigation. This gives you more insight into your organization network and improves your security operation capabilities.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "ForescoutHostProperties_CL",
            "baseQuery": "ForescoutHostProperties_CL"
        }
    ],
    "sampleQueries": [
        {
            "description" : "Get 5 latest host property entries",
            "query": "ForescoutHostProperties_CL | take 5"
        },
        {
            "description" : "Get 5 latest host policy entries",
            "query": "ForescoutPolicyStatus_CL | take 5"
        },
        {
            "description" : "Get 5 latest host compliance entries",
            "query": "ForescoutComplianceStatus_CL | take 5"
        }
    ],
    "dataTypes": [
        {
            "name": "ForescoutHostProperties_CL",
            "lastDataReceivedQuery": "ForescoutHostProperties_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ForescoutPolicyStatus_CL",
            "lastDataReceivedQuery": "ForescoutPolicyStatus_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ForescoutComplianceStatus_CL",
            "lastDataReceivedQuery": "ForescoutComplianceStatus_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "ForescoutHostProperties_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)",
                "ForescoutPolicyStatus_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)",
                "ForescoutComplianceStatus_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ],
        "customs": [
            {
                "name": "Forescout Plugin requirement",
                "description": "Please make sure Forescout Microsoft Sentinel plugin is running on Forescout platform"
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "",
            "description": "Instructions on how to configure Forescout Microsoft Sentinel plugin are provided at Forescout Documentation Portal (https://docs.forescout.com)",
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                            "PrimaryKey"
                        ],
                        "label": "Primary Key"
                    },
                    "type": "CopyableLabel"
                }
            ]
        }
    ],
    "metadata": {
        "id": "1430b3a9-a48c-40d5-bb81-029f6c63c2ad",
        "version": "3.0.0",
        "kind": "dataConnector",
        "source": {
            "kind": "community"
        },
        "author": {
            "name": "Forescout Technologies"
        },
        "support": {
            "tier": "developer",
            "name": "Forescout Technologies",
            "link":"https://www.forescout.com/support"
        }
    }
}