{
  "id": "Cribl",
  "title": "Cribl",
  "publisher": "Cribl",
  "descriptionMarkdown": "The [Cribl](https://cribl.io/accelerate-cloud-migration/) connector allows you to easily connect your Cribl (Cribl Enterprise Edition - Standalone) logs with Microsoft Sentinel. This gives you more security insight into your organization's data pipelines.",
  "additionalRequirementBanner": "This data connector depends on three parsers based on a Kusto Function to work as expected [**Cribl Access Logs**](https://aka.ms/sentinel-CriblAccess-parser), [**Cribl Audit Logs**](https://aka.ms/sentinel-CriblAudit-parser) and [**Cribl Application Logs**](https://aka.ms/sentinel-CriblInternal-parser) which are deployed with the Microsoft Sentinel Solution.",
  "graphQueries": [
      {
          "metricName": "Total data received",
          "legend": "CriblInternal",
          "baseQuery": "CriblInternal"
      },
      {
          "metricName": "Total data received",
          "legend": "CriblAudit",
          "baseQuery": "CriblAudit"
      },
      {
          "metricName": "Total data received",
          "legend": "CriblAccess",
          "baseQuery": "CriblAccess"
      }
  ],
  "sampleQueries": [
      {
          "description" : "Cribl Application Logs",
          "query": "CriblInternal | sort by TimeGenerated"
      },
      {
          "description" : "Cribl Audit Logs",
          "query": "CriblAudit | sort by TimeGenerated"
      },
      {
          "description" : "Cribl Access Logs",
          "query": "CriblAccess | sort by TimeGenerated"
      }
  ],
  "dataTypes": [
      {
          "name": "Syslog (CriblAccess)",
          "lastDataReceivedQuery": "CriblAccess\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
      },
      {
          "name": "Syslog (CriblAudit)",
          "lastDataReceivedQuery": "CriblAudit\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
      },
      {
          "name": "Syslog (CriblInternal)",
          "lastDataReceivedQuery": "CriblInternal\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
      }
  ],
  "connectivityCriterias": [
      {
          "type": "IsConnectedQuery",
          "value": [
              "CriblInternal\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)",
              "CriblAudit\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)",
              "CriblAccess\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
          ]
      }
  ],
  "availability": {
      "status": 1,
      "isPreview": false
  },
  "permissions": {
      "resourceProvider": [
          {
              "provider": "Microsoft.OperationalInsights/workspaces",
              "permissionsDisplayText": "write permission is required.",
              "providerDisplayName": "Workspace",
              "scope": "Workspace",
              "requiredPermissions": {
                  "write": true,
                  "delete": true
              }
          }
      ]
  },
"instructionSteps": [
                    {
                      "step": "Create Credentials for a New Azure Application",
                      "actions": [
                        "Log into the Azure portal as an Administrator",
                        "Navigate to the portal's App registration section",
                        "Click New registration to register an application",
                        "Register a new application with the name 'Cribl Stream'",
                        "Click Register",
                        "Store the Application (client) ID and Directory (tenant) ID",
                        "In the newly registered application, select the Certificates & secrets tab",
                        "Create a New client secret",
                        "Store the secret Value"
                      ]
                    },
                    {
                      "step": "Create a Data Collection Endpoint",
                      "actions": [
                        "Navigate to the Azure portal's Monitor service",
                        "Under Settings, select Data Collection Endpoints",
                        "Select Create to add a new endpoint named 'Cribl-Stream-Ingestion'",
                        "Select the appropriate Subscription and Resource Group",
                        "Select Review + create, review changes, then select Create",
                        "Open the newly created endpoint in the list of Data Collection Endpoints",
                        "Navigate to the Overview page, copy and store the Logs Ingestion URL",
                        "Select JSON view, store the value of the Resource ID"
                      ]
                    },
                    {
                      "step": "Find the Log Analytics Workspace Resource ID",
                      "actions": [
                        "Navigate to the Azure portal's Log Analytics workspaces service",
                        "Select the workspace that will receive data",
                        "From the Overview page, select JSON view, store the value of the Resource ID"
                      ]
                    },
                    {
                      "step": "Create Data Collection Rule",
                      "actions": [
                        "Navigate to the Azure portal's Deploy a custom template service",
                        "Select Build your own template in the editor",
                        "Select Load file and upload the DCR Template",
                        "Click Save",
                        "Select the appropriate Subscription and Resource Group",
                        "Name the new Data Collection Rule 'Cribl-Stream-Ingestion-Rule'",
                        "Enter the Log Analytics Workspace Resource ID and Data Collection Endpoint Resource ID",
                        "Click Review + create, followed by Create"
                      ]
                    },
                    {
                      "step": "Add Role Assignment",
                      "actions": [
                        "Once the template has been deployed, click Go to resource",
                        "From the Overview page, select JSON view, store the immutableId from the JSON body",
                        "Click the Data Collection Rule's Access control (IAM)",
                        "Click Add role assignment",
                        "Select the Monitoring Metrics Publisher role, then click Next",
                        "Click + Select members",
                        "Search for and select 'Cribl Stream', then click Select to confirm",
                        "Click Review + assign to review changes",
                        "Click Review + assign again to implement the permissions update"
                      ]
                    }
                  ],
  "metadata": {
      "id": "Unique Identifier (GUID) used to identify dependencies and content from solutions or community.",
      "version": "1.0.0",
      "kind": "dataConnector",
      "source": {
          "kind": "community"
      },
      "author": {
          "name": "Guillaume Benats"
      },
      "support": {
          "tier": "community",
          "name": "Guillaume Benats",
          "link":"https://github.com/Azure/Azure-Sentinel/issues"
      }
  }
}