{
    "id": "ESI-Opt34DomainControllersSecurityEventLogs",
    "title": " Microsoft Active-Directory Domain Controllers Security Event Logs",
    "publisher": "Microsoft",
    "descriptionMarkdown": "[Option 3 & 4] - Using Azure Monitor Agent -You can stream a part or all Domain Controllers Security Event logs from the Windows machines connected to your Microsoft Sentinel workspace using the Windows agent. This connection enables you to create custom alerts, and improve investigation.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "Domain Controllers Security Logs",
            "baseQuery": "SecurityEvent"
        }
    ],
    "sampleQueries": [
        {
            "description": "All Audit logs",
            "query": "SecurityEvent | sort by TimeGenerated"
        }
    ],
    "dataTypes": [
        {
            "name": "SecurityEvent",
            "lastDataReceivedQuery": "SecurityEvent | summarize Time = max(TimeGenerated) | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "SecurityEvent | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7h)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ],
        "customs": [
            {
                "description": "Azure Log Analytics will be deprecated, to collect data from non-Azure VMs, Azure Arc is recommended. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)"
            },
            {
                "name": "Detailled documentation",
                "description": ">**NOTE:** Detailled documentation on Installation procedure and usage can be found [here](https://aka.ms/MicrosoftExchangeSecurityGithub)"
            }     
        ]
    },
    "instructionSteps": [
        {
            "description": ">**NOTE:** This solution is based on options. This allows you to choose which data will be ingest as some options can generate a very high volume of data. Depending on what you want to collect, track in your Workbooks, Analytics Rules, Hunting capabilities you will choose the option(s) you will deploy. Each options are independant for one from the other. To learn more about each option: ['Microsoft Exchange Security' wiki](https://aka.ms/ESI_DataConnectorOptions)\n\n>This Data Connector is the **option 3 and 4** of the wiki."
        },
        {
            "title": "1.  Download and install the agents needed to collect logs for Microsoft Sentinel",
            "description": "Type of servers (Exchange Servers, Domain Controllers linked to Exchange Servers or all Domain Controllers) depends on the option you want to deploy.",
            "instructions": [
                {
                    "parameters": {
                        "instructionSteps": [
                            {
                                "title": "Deploy Monitor Agents",
                                "description": "This step is required only if it's the first time you onboard your Exchange Servers/Domain Controllers\n**Deploy the Azure Arc Agent**\n> [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)"
                            }
                        ]
                    },
                    "type": "InstructionStepsGroup"
                }
            ]
        },
        {
            "title": "Security logs of Domain Controllers",
            "description": "Select how to stream Security logs of Domain Controllers. If you want to implement Option 3, you just need to select DC on same site as Exchange Servers. If you want to implement Option 4, you can select all DCs of your forest.",
            "instructions": [
                {
                    "parameters": {
                        "instructionSteps": [
                            {
                                "title": "[Option 3] List only Domain Controllers on the same site as Exchange Servers for next step",
                                "description": "**This limits the quantity of data injested but some incident can't be detected.**"
                            },
                            {
                                "title": "[Option 4] List all Domain Controllers of your Active-Directory Forest for next step",
                                "description": "**This allows collecting all security events**"
                            }
                        ]
                    },
                    "type": "InstructionStepsGroup"
                },
                {
                    "parameters": {
                        "title": "Security Event log collection",
                        "instructionSteps": [
                            {
                                "title": "Data Collection Rules - Security Event logs",
                                "description": "**Enable data collection rule for Security Logs**\nSecurity Events logs are collected only from **Windows** agents.\n1. Add chosen DCs on *Resources* tab.\n2. Select Security log level\n\n>  **Common level** is the minimum required. Please select 'Common' or 'All Security Events' on DCR definition.",
                                "instructions": [
                                    {
                                        "parameters": {
                                            "linkType": "OpenCreateDataCollectionRule",
                                            "dataCollectionRuleType": 0
                                        },
                                        "type": "InstallAgent"
                                    }
                                ]
                            }
                        ]
                    },
                    "type": "InstructionStepsGroup"
                }
            ]
        }
    ],
    "metadata": {
        "id": "036e16af-5a27-465a-8662-b7ac385a8d45",
        "version": "1.0.0",
        "kind": "dataConnector",
        "source": {
            "kind": "solution",
            "name": "Microsoft Exchange Security - Exchange On-Premises"
        },
        "support": {
            "name": "Community",
            "tier": "Community",
            "link": "https://github.com/Azure/Azure-Sentinel/issues"
        },
        "author": {
            "name": "Microsoft"
        }
    }
}