{
    "id": "ValenceSecurity",
    "title": "SaaS Security",
    "publisher": "Valence Security",
    "descriptionMarkdown": "Connects the Valence SaaS security platform Azure Log Analytics via the REST API interface.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "Valence Alerts",
            "baseQuery": "ValenceAlert_CL"
        }
    ],
    "sampleQueries": [
        {
            "description" : "All Valence Security alerts",
            "query": "ValenceAlert_CL"
        },
        {
            "description" : "All critical Valence Security alerts",
            "query": "ValenceAlert_CL | where alertType_severity_s == \"Critical\""
        }
    ],
    "dataTypes": [
        {
            "name": "ValenceAlert_CL",
            "lastDataReceivedQuery": "ValenceAlert_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "ValenceAlert_CL\n| summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(7d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": true
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Step 1 : Read the detailed documentation",
            "description": "The installation process is documented in great detail in [Valence Security's knowledge base](https://support.valencesecurity.com). The user should consult this documentation further to understand installation and debug of the integration."
        },
        {
            "title": "Step 2: Retrieve the workspace access credentials",
            "description": "The first installation step is to retrieve both your **Workspace ID** and **Primary Key** from the Microsoft Sentinel platform.\nCopy the values shown below and save them for configuration of the API log forwarder integration.",
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                            "PrimaryKey"
                        ],
                        "label": "Primary Key"
                    },
                    "type": "CopyableLabel"
                }
            ]
        },
        {
            "title": "Step 3: Configure Sentinel integration on the Valence Security Platform",
            "description": "As a Valence Security Platform admin, go to the [configuration screen](https://app.valencesecurity.com/settings/configuration), click Connect in the SIEM Integration card, and choose Microsoft Sentinel. Paste the values from the previous step and click Connect. Valence will test the connection so when success is reported, the connection worked."
        }
    ],
    "metadata": {
        "id": "0116a50c-9282-4237-9962-5da1dfcbfb55",
        "version": "1.0.0",
        "kind": "dataConnector",
        "source": {
            "kind": "community"
        },
        "author": {
            "name": "Valence Security"
        },
        "support": {
            "tier": "community",
            "name": "Valence Security",
            "email": "info@valencesecurity.com",
            "link": "https://www.valencesecurity.com"
        }
    }
}