{
    "id": "Exabeam",
    "title": "[Deprecated] Exabeam Advanced Analytics",
    "publisher": "Exabeam",
    "descriptionMarkdown": "The [Exabeam Advanced Analytics](https://www.exabeam.com/ueba/advanced-analytics-and-mitre-detect-and-stop-threats/) data connector provides the capability to ingest Exabeam Advanced Analytics events into Microsoft Sentinel. Refer to [Exabeam Advanced Analytics documentation](https://docs.exabeam.com/) for more information.",
    "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "Exabeam",
            "baseQuery": "ExabeamEvent"
        }
    ],
    "sampleQueries": [
        {
            "description" : "Top 10 Clients (Source IP)",
            "query": "ExabeamEvent\n | summarize count() by SrcIpAddr\n | top 10 by count_"
        }
    ],
    "dataTypes": [
        {
            "name": "Syslog (Exabeam)",
            "lastDataReceivedQuery": "ExabeamEvent\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "ExabeamEvent\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "write permission is required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "delete": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "",
            "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias Exabeam Advanced Analytics and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Exabeam%20Advanced%20Analytics/Parsers/ExabeamEvent.txt), on the second line of the query, enter the hostname(s) of your Exabeam Advanced Analytics device(s) and any other unique identifiers for the logstream. The function usually takes 10-15 minutes to activate after solution installation/update.",
            "instructions": [
            ]
        },
        {
            "title": "",
            "description": ">**NOTE:** This data connector has been developed using Exabeam Advanced Analytics i54 (Syslog)",
            "instructions": [
            ]
        },
        {
            "title": "1. Install and onboard the agent for Linux or Windows",
            "description": "Install the agent on the server where the Exabeam Advanced Analytic logs are generated or forwarded.\n\n> Logs from Exabeam Advanced Analytic deployed on Linux or Windows servers are collected by **Linux** or **Windows** agents.",
            "instructions": [
                {
                "parameters": {
                "title": "Choose where to install the Linux agent:",
    "instructionSteps": [
            {
            "title": "Install agent on Azure Linux Virtual Machine",
            "description": "Select the machine to install the agent on and then click **Connect**.",
            "instructions": [
                {
                "parameters": {
                "linkType": "InstallAgentOnLinuxVirtualMachine"
                },
                "type": "InstallAgent"
                }
            ]
        },
            {
            "title": "Install agent on a non-Azure Linux Machine",
            "description": "Download the agent on the relevant machine and follow the instructions.",
            "instructions": [
                {
                "parameters": {
                "linkType": "InstallAgentOnLinuxNonAzure"
                },
                "type": "InstallAgent"
                }
            ]
        }
    ]
        },
            "type": "InstructionStepsGroup"
            }
        ]
            },
            {
                "instructions": [
                    {
                    "parameters": {
                    "title": "Choose where to install the Windows agent:",
        "instructionSteps": [
                {
                "title": "Install agent on Azure Windows Virtual Machine",
                "description": "Select the machine to install the agent on and then click **Connect**.",
                "instructions": [
                    {
                    "parameters": {
                    "linkType": "InstallAgentOnVirtualMachine"
                    },
                    "type": "InstallAgent"
                    }
                ]
            },
                {
                "title": "Install agent on a non-Azure Windows Machine",
                "description": "Download the agent on the relevant machine and follow the instructions.",
                "instructions": [
                    {
                    "parameters": {
                    "linkType": "InstallAgentOnNonAzure"
                    },
                    "type": "InstallAgent"
                    }
                ]
            }
        ]
            },
                "type": "InstructionStepsGroup"
                }
            ]
                },
    {
            "title": "2. Configure the logs to be collected",
            "description": "Configure the custom log directory to be collected" ,
            "instructions": [
                {
                    "parameters": {
                        "linkType": "OpenCustomLogsSettings"
                    },
                    "type": "InstallAgent"
                }
            ]
        },
        {
            "title": "3. Configure Exabeam event forwarding to Syslog",
            "description": "[Follow these instructions](https://docs.exabeam.com/en/advanced-analytics/i56/advanced-analytics-administration-guide/125351-advanced-analytics.html#UUID-7ce5ff9d-56aa-93f0-65de-c5255b682a08) to send Exabeam Advanced Analytics activity log data via syslog."
        }
]
}