{
  "Name": "Vaikora-O365",
  "Author": "Data443 Risk Mitigation, Inc. - support@data443.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/vaikora_logo.svg\" width=\"75px\" height=\"75px\">",
  "Description": "The [Vaikora](https://vaikora.com) for O365 solution ships the Microsoft Sentinel content that pairs with the Vaikora-O365 black-box Azure VM. The VM scans Microsoft 365 mailboxes via Microsoft Graph API, classifies messages with the CTASD inference engine, and writes quarantine events into a custom Log Analytics table (VaikoraO365_Quarantine_CL). This solution adds a Logic App playbook that turns each quarantine event into a Microsoft Sentinel incident, plus analytic rules over the custom table that fire on high-confidence phishing scores and tenant-wide quarantine rate anomalies.",
  "Playbooks": [
    "Playbooks/VaikoraO365ToQuarantine/azuredeploy.json"
  ],
  "Analytic Rules": [
    "Analytic Rules/Vaikora - High score quarantine.yaml",
    "Analytic Rules/Vaikora - Quarantine rate spike.yaml",
    "Analytic Rules/Vaikora - Engine offline.yaml"
  ],
  "Workbooks": [
    "Workbooks/VaikoraO365QuarantineDashboard.json"
  ],
  "WorkbookDescription": "Quarantine dashboard for Vaikora for O365. Shows volume over time, action breakdown, confidence distribution, top sender domains, top targeted recipients, recent high-risk quarantines, and per-tenant activity, all derived from the VaikoraO365_Quarantine_CL custom Log Analytics table.",
  "WorkbookBladeDescription": "Visualization for Microsoft 365 mailbox quarantine events classified by Vaikora-O365.",
  "Metadata": "SolutionMetadata.json",
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Vaikora-O365",
  "Version": "3.0.0",
  "TemplateSpec": true,
  "Is1Pconnector": false
}