{
    "id": "ProviderNameAppliance",
    "title": "PROVIDER NAME APPLIANCE NAME",
    "publisher": "PROVIDER NAME",
    "descriptionMarkdown": "The PROVIDER NAME APPLIANCE NAME data connector ingests Syslog events from APPLIANCE NAME into Microsoft Sentinel. Logs are collected using the Azure Monitor Agent (AMA) via the Microsoft **Syslog via AMA** solution, which must be installed in your workspace before configuring this connector.\n\n[Learn more about the Syslog via AMA connector >](https://learn.microsoft.com/azure/sentinel/connect-syslog)",
    "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected. The [**KUSTO_FUNCTION_ALIAS**](LINK_TO_PARSER_ON_GITHUB) parser is deployed with the Microsoft Sentinel solution. If your connector does not use a custom parser, remove this field.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "DATATYPE_NAME",
            "baseQuery": "Syslog\n| where ProcessName == \"PROCESS_NAME\""
        }
    ],
    "sampleQueries": [
        {
            "description": "All APPLIANCE NAME events",
            "query": "Syslog\n| where ProcessName == \"PROCESS_NAME\"\n| sort by TimeGenerated desc"
        },
        {
            "description": "APPLIANCE NAME events – last 24 hours",
            "query": "Syslog\n| where ProcessName == \"PROCESS_NAME\"\n| where TimeGenerated > ago(24h)\n| sort by TimeGenerated desc"
        }
    ],
    "dataTypes": [
        {
            "name": "Syslog (DATATYPE_NAME)",
            "lastDataReceivedQuery": "Syslog\n| where ProcessName == \"PROCESS_NAME\"\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "Syslog\n| where ProcessName == \"PROCESS_NAME\"\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "write permission is required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "delete": true
                }
            }
        ],
        "customs": [
            {
                "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install)"
            },
            {
                "description": "The **Syslog via AMA** solution must be installed in your Microsoft Sentinel workspace. [Install from Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/azuresentinel.azure-sentinel-solution-syslog)"
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "1. Configure APPLIANCE NAME to forward Syslog messages",
            "description": "Configure APPLIANCE NAME to forward Syslog messages to a Linux log forwarder machine on port 514 UDP/TCP.\n\n> Replace this step with your product-specific instructions for enabling Syslog output. Include the relevant facility and severity settings your product uses, the destination IP/hostname of the log forwarder, and any product-side configuration steps the customer must complete."
        },
        {
            "title": "2. Install the Syslog via AMA solution",
            "description": "This connector relies on the Microsoft **Syslog via AMA** solution to collect Syslog data into your workspace using the Azure Monitor Agent. If you have not already installed it, install it from the Microsoft Marketplace and create a Data Collection Rule (DCR) that includes the Syslog facilities forwarded by APPLIANCE NAME.\n\n[Install Syslog via AMA from Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/azuresentinel.azure-sentinel-solution-syslog)"
        }
    ],
    "metadata": {
        "id": "Unique Identifier (GUID) used to identify dependencies and content from solutions or community.",
        "version": "This is an optional field. Default and recommended format for kind value as **community or solutions** is string eg. \"1.0.0\" aligning with solutions which makes it easier to manage the content. Whereas, for kind value as **sourceRepository** the recommended format is numeric (eg. 1, 1.0,1.0.0, etc) aligning to ARM template best practices.",
        "kind": "dataConnector",
        "source": {
            "kind": "source type of the content. Value must be one of these : localWorkspace | community | solution | sourceRepository",
            "name": "Name of the content source. The repo name, solution name, LA workspace name etc."
        },
        "author": {
            "name": "Name of the author. For localWorkspace it is automatically the workspace user"
        },
        "support": {
            "tier": "Type of support for content item: microsoft | developer | community",
            "name": "Name of support contact or company",
            "email": "Optional: Email of support contact",
            "link":"Optional: Link for support help, like to support page to open a ticket etc"
        }
    }
}