{
    "id": "ContrastADR",
    "title": "ContrastADR",
    "publisher": "Contrast Security",
    "descriptionMarkdown": "The ContrastADR data connector provides the capability to ingest Contrast ADR attack events into Microsoft Sentinel using the ContrastADR Webhook. ContrastADR data connector can enrich the incoming webhook data with ContrastADR API enrichment calls.",
    "graphQueries": [
        {
            "metricName": "Attack event Data",
            "legend": "ContrastADR_CL",
            "baseQuery": "ContrastADR_CL"
        }, 
        {
            "metricName": "Incident event data",
            "legend": "ContrastADRIncident_CL",
            "baseQuery": "ContrastADRIncident_CL"
        }
    ],
    "sampleQueries": [
        {
            "description" : "All ContrastADR Attack event logs",
            "query": "ContrastADR_CL\n| sort by TimeGenerated desc"
        }, 
        {
            "description" : "All ContrastADR incident logs",
            "query": "ContrastADRIncident_CL\n| sort by TimeGenerated desc"
        }
    ],
    "dataTypes": [
        {
            "name": "ContrastADR_CL",
            "lastDataReceivedQuery": "ContrastADR_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }, 
        {
            "name": "ContrastADRIncident_CL",
            "lastDataReceivedQuery": "ContrastADRIncident_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "ContrastADR_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)", 
                "ContrastADRIncident_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": true
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ],
        "customs": [
            {
                "name": "Microsoft.Web/sites permissions",
                "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)."

            }
        ]
        
    },
    "instructionSteps": [
        {
            "title": "",
            "description": "Use these Workspace id and primakey key as shared key in azure function app",
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                            "PrimaryKey"
                        ],
                        "label": "Primary Key"
                    },
                    "type": "CopyableLabel"
                }
            ]
        },
        {
            "title": "Azure Resource Manager (ARM) Template",
            "description": "Use this method to automate deployment of the ContrastADR Data Connector using ARM Template.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-ContrastADR-azuredeploy)\n2. Provide the following parameters: Region, Function Name, LOG_ANALYTICS_SHARED_KEY, LOG_ANALYTICS_WORKSPACE_ID "
        }
    ]
}