{
  "id": "Perimeter81ActivityLogs",
  "title": "Perimeter 81 Activity Logs",
  "publisher": "Perimeter 81",
  "descriptionMarkdown": "The Perimeter 81 Activity Logs connector allows you to easily connect your Perimeter 81 activity logs with Microsoft Sentinel, to view dashboards, create custom alerts, and improve investigation.",
  "graphQueries": [
    {
      "metricName": "Total data received",
      "legend": "Perimeter81_CL",
      "baseQuery": "Perimeter81_CL"
    }
  ],
  "sampleQueries": [
    {
      "description" : "User login failures",
      "query": "Perimeter81_CL | where eventName_s == \"api.activity.login.fail\""
    },
    {
      "description" : "Application authorization failures",
      "query": "Perimeter81_CL | where eventName_s == \"api.activity.application.auth.fail\""
    },
    {
      "description": "Application session start",
      "query": "Perimeter81_CL | where eventName_s == \"api.activity.application.session.start\""
    },
    {
      "description": "Authentication failures by IP & email (last 24 hours)",
      "query": "Perimeter81_CL\n| where TimeGenerated > ago(24h) and eventName_s in (\"api.activity.login.fail\", \"api.activity.vpn.auth.fail\", \"api.activity.application.auth.fail\")\n| summarize count() by ip_s, releasedBy_email_s\n| where count_ > 1"
    },
    {
      "description": "Resource deletions by IP & email (last 24 hours)",
      "query": "Perimeter81_CL\n| where TimeGenerated > ago(24h) and eventName_s matches regex \"api.activity.*.remove*|api.activity.*.delete*|api.activity.*.destroy*\"  \n| summarize count() by ip_s, releasedBy_email_s\n| where count_ > 1"
    }
  ],
  "dataTypes": [
    {
      "name": "Perimeter81_CL",
      "lastDataReceivedQuery": "Perimeter81_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
    }
  ],
  "connectivityCriterias": [
    {
      "type": "IsConnectedQuery",
      "value": [
        "Perimeter81_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)"
      ]
    }
  ],
  "availability": {
    "status": 1,
    "isPreview": false
  },
  "permissions": {
    "resourceProvider": [
      {
        "provider": "Microsoft.OperationalInsights/workspaces",
        "permissionsDisplayText": "read and write permissions are required.",
        "providerDisplayName": "Workspace",
        "scope": "Workspace",
        "requiredPermissions": {
          "write": true,
          "read": true,
          "delete": true
        }
      },
			{
				"provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
				"permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
				"providerDisplayName": "Keys",
				"scope": "Workspace",
				"requiredPermissions": {
					"action": true
				}
			}
    ]
  },
  "instructionSteps": [
    {
      "title": "",
      "description": "Please note the values below and follow the instructions <a href='https://support.perimeter81.com/hc/en-us/articles/360012680780'>here</a> to connect your Perimeter 81 activity logs with Microsoft Sentinel.",
      "instructions": [
        {
          "parameters": {
            "fillWith": [
              "WorkspaceId"
            ],
            "label": "Workspace ID"
          },
          "type": "CopyableLabel"
        },
        {
          "parameters": {
            "fillWith": [
              "PrimaryKey"
            ],
            "label": "Primary Key"
          },
          "type": "CopyableLabel"
        }
      ]
    }
  ],
  "metadata": {
    "id": "1d855d54-0f17-43b3-ad33-93a0ab7b6ce8",
    "version": "1.0.0",
    "kind": "dataConnector",
    "source": {
        "kind": "community"
    },
    "author": {
        "name": "Perimeter 81"
    },
    "support": {
        "name": "Perimeter 81",
        "link": "https://support.perimeter81.com/",
        "tier": "developer"
    }
}
}