{
    "id": "ElasticAgent",
    "title": "Elastic Agent",
    "publisher": "Elastic",
    "descriptionMarkdown": "The [Elastic Agent](https://www.elastic.co/security) data connector provides the capability to ingest Elastic Agent logs, metrics, and security data into Microsoft Sentinel.",
    "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**ElasticAgentEvent**](https://aka.ms/sentinel-ElasticAgent-parser) which is deployed with the Microsoft Sentinel Solution.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "Elastic Agent Events",
            "baseQuery": "ElasticAgentEvent"
        }
    ],
    "sampleQueries": [
        {
            "description" : "Top 10 Devices",
            "query": "ElasticAgentEvent\n | summarize count() by DvcIpAddr\n | top 10 by count_"
        }
    ],
    "dataTypes": [
        {
            "name": "ElasticAgentLogs_CL",
            "lastDataReceivedQuery": "ElasticAgentEvent\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "ElasticAgentEvent\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
					"read": true,
                    "delete": true
                }
            },
			{
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
       ],
        "customs": [
            {
                "name": "Include custom pre-requisites if the connectivity requires - else delete customs",
                "description": "Description for any custom pre-requisite"
            }
        ]
    },
    "instructionSteps": [{
        "title": "",
        "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**ElasticAgentEvent**](https://aka.ms/sentinel-ElasticAgent-parser) which is deployed with the Microsoft Sentinel Solution.",
        "instructions": []
    },
    {
        "title": "",
        "description": ">**NOTE:** This data connector has been developed using **Elastic Agent 7.14**.",
        "instructions": []
    },
    {
        "title": "1. Install and onboard the agent for Linux or Windows",
        "description": "Install the agent on the Server where the Elastic Agent logs are forwarded.\n\n> Logs from Elastic Agents deployed on Linux or Windows servers are collected by **Linux** or **Windows** agents.",
        "instructions": [{
            "parameters": {
                "title": "Choose where to install the Linux agent:",
                "instructionSteps": [{
                        "title": "Install agent on Azure Linux Virtual Machine",
                        "description": "Select the machine to install the agent on and then click **Connect**.",
                        "instructions": [{
                            "parameters": {
                                "linkType": "InstallAgentOnLinuxVirtualMachine"
                            },
                            "type": "InstallAgent"
                        }]
                    },
                    {
                        "title": "Install agent on a non-Azure Linux Machine",
                        "description": "Download the agent on the relevant machine and follow the instructions.",
                        "instructions": [{
                            "parameters": {
                                "linkType": "InstallAgentOnLinuxNonAzure"
                            },
                            "type": "InstallAgent"
                        }]
                    }
                ]
            },
            "type": "InstructionStepsGroup"
        }]
    },
    {
        "instructions": [{
            "parameters": {
                "title": "Choose where to install the Windows agent:",
                "instructionSteps": [{
                        "title": "Install agent on Azure Windows Virtual Machine",
                        "description": "Select the machine to install the agent on and then click **Connect**.",
                        "instructions": [{
                            "parameters": {
                                "linkType": "InstallAgentOnVirtualMachine"
                            },
                            "type": "InstallAgent"
                        }]
                    },
                    {
                        "title": "Install agent on a non-Azure Windows Machine",
                        "description": "Download the agent on the relevant machine and follow the instructions.",
                        "instructions": [{
                            "parameters": {
                                "linkType": "InstallAgentOnNonAzure"
                            },
                            "type": "InstallAgent"
                        }]
                    }
                ]
            },
            "type": "InstructionStepsGroup"
        }]
    },
    {
        "title": "2. Configure Elastic Agent (Standalone)",
        "description": "[Follow the instructions](https://www.elastic.co/guide/en/fleet/current/elastic-agent-configuration.html) to configure Elastic Agent to output to Logstash"
    },
    {
        "title": "3. Configure Logstash to use Microsoft Logstash Output Plugin",
        "description": "Follow the steps to configure Logstash to use microsoft-logstash-output-azure-loganalytics plugin:\n\n3.1) Check if the plugin is already installed:\n> ./logstash-plugin list | grep 'azure-loganalytics'\n**(if the plugin is installed go to step 3.3)**\n\n3.2) Install plugin:\n> ./logstash-plugin install microsoft-logstash-output-azure-loganalytics\n\n3.3) [Configure Logstash](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/microsoft-logstash-output-azure-loganalytics) to use the plugin"
    },
    {
        "title": "4. Validate log ingestion",
        "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using custom table specified in step 3.3 (e.g. ElasticAgentLogs_CL).\n\n>It may take about 30 minutes until the connection streams data to your workspace."
    }
]
}