{
    "id": "Dynamics365",
    "title": "Dynamics 365",
    "publisher": "Microsoft",
    "descriptionMarkdown": "The Dynamics 365 Common Data Service (CDS) activities connector provides insight into admin, user, and support activities, as well as Microsoft Social Engagement logging events. By connecting Dynamics 365 CRM logs into Microsoft Sentinel, you can view this data in workbooks, use it to create custom alerts, and improve your investigation process. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com//fwlink/p/?linkid=2226719&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
    "logo": "DynamicsLogo.svg",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "Dynamics365",
            "baseQuery": "Dynamics365Activity\n| where OfficeWorkload == \"CRM\""
        }
    ],
    "sampleQueries": [
        {
            "description": "Dynamics365 logs",
            "query": "Dynamics365Activity\n| where OfficeWorkload == \"CRM\"\n            | sort by TimeGenerated"
        }
    ],
    "dataTypes": [
        {
            "name": "Dynamics365Activity",
            "lastDataReceivedQuery": "Dynamics365Activity\n| where OfficeWorkload == \"CRM\"\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "SentinelKinds",
            "value": [
                "Dynamics365"
            ]
        }
    ],
    "availability": {
        "status": 2,
        "isPreview": false,
        "availableInDoDCloud": false 
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            }
        ],
        "customs": [
            {
                "name": "Tenant Permissions",
                "description": "'Security Administrator' or 'Global Administrator' on the workspace's tenant."
            },
            {
                "name": "License",
                "description": "[Microsoft Dynamics 365 production license](https://docs.microsoft.com/office365/servicedescriptions/microsoft-dynamics-365-online-service-description) (This connector is available for production environments only, not for sandbox). Also, a Microsoft 365 Enterprise [E3 or E5](https://docs.microsoft.com/power-platform/admin/enable-use-comprehensive-auditing#requirements) subscription is required for Activity Logging."
            }
        ]
    },
    "instructionSteps": [
        {
            "description": "Connect [Dynamics 365 CRM](https://aka.ms/Sentinel/Dynamics365) activity logs to your Microsoft Sentinel workspace.",
            "instructions": [
                {
                    "parameters": {
                        "connectorKind": "Dynamics365",
                        "title": "Dynamics365",
                        "enable": true
                    },
                    "type": "SentinelResourceProvider"
                }
            ]
        }
    ]
}