{
  "id": "ibossAma",
  "title": "iboss via AMA",
  "publisher": "iboss",
  "descriptionMarkdown": "The [iboss](https://www.iboss.com) data connector enables you to seamlessly connect your Threat Console to Microsoft Sentinel and enrich your instance with iboss URL event logs. Our logs are forwarded in Common Event Format (CEF) over Syslog and the configuration required can be completed on the iboss platform without the use of a proxy. Take advantage of our connector to garner critical data points and gain insight into security threats.",
  "graphQueries": [
    {
      "metricName": "Total data received",
      "legend": "ibossUrlEvent",
      "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'iboss' and AdditionalExtensions contains 'amaExternalLogService=true'"
    }
  ],
  "sampleQueries": [
    {
      "description": "Logs Received from the past week",
      "query": "CommonSecurityLog\n | where DeviceVendor =~ 'iboss' and TimeGenerated > ago(7d) and AdditionalExtensions contains 'amaExternalLogService=true'"
    }
  ],
  "dataTypes": [
    {
      "name": "ibossUrlEvent",
      "lastDataReceivedQuery": "CommonSecurityLog\n | where DeviceVendor =~ 'iboss' and AdditionalExtensions contains 'amaExternalLogService=true'\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
    }
  ],
  "connectivityCriterias": [
    {
      "type": "IsConnectedQuery",
      "value": [
        "CommonSecurityLog\n | where DeviceVendor =~ 'iboss'\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(30d)"
      ]
    }
  ],
  "availability": {
    "status": 1,
    "isPreview": false
  },
  "permissions": {
    "resourceProvider": [
      {
        "provider": "Microsoft.OperationalInsights/workspaces",
        "permissionsDisplayText": "read and write permissions are required.",
        "providerDisplayName": "Workspace",
        "scope": "Workspace",
        "requiredPermissions": {
          "read": true,
          "write": true,
          "delete": true
        }
      },
      {
        "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
        "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
        "providerDisplayName": "Keys",
        "scope": "Workspace",
        "requiredPermissions": {
          "action": true
        }
      }
    ]
  },
  "instructionSteps": [
    {
      "title": "Configure AMA Data Connector",
      "description": "Steps to configure the iboss AMA Data Connector",
         "instructions": [
			       {
                    "parameters": {
                        "title": "Kindly follow the steps to configure the data connector",
                        "instructionSteps": [
                          {
                            "title": "Step A. Gather Required Configuration Details in Azure Arc",
                            "description": "1. Navigate to Azure Arc ---> Azure Arc Resources ---> Machines.\n\n2. Add a machine ---> Add a single server ---> Generate script.\n\n3. Select the resource group, this should be the same group as the Log Analytics Workspace for your Microsoft Sentinel instance you will be using\n\n4. Select a region and ensure it is in the same region as your Log Analytics Workspace\n\n5. Select Linux as Operating System\n\n6. Click Next\n\n7. Download the script and use this information for the next step when configuring your Microsoft Sentinel AMA integration iboss side.\n\n8. Navigate to the Log Analytics Workspace of your Microsoft Sentinel instance and find it's resource group, workspace name, and workspace id"
                          },
                          {
                            "title": "Step B. Forward Common Event Format (CEF) logs",
                            "description": "Set your Threat Console to send Syslog messages in CEF format to your Azure workspace. (Ensure you have the information gathered from the previous section)\n\n>1. Navigate to the Integrations Marketplace inside your iboss Console\n\n>2. Select Microsoft Sentinel AMA Log Forwarding\n\n>3. Select Add Integration\n\n4. Use the information from the script and your log analytics workspace to configure the integration.\n\n5. Add the integration\n\n>6. An email with be sent to your iboss alerts email to authenticate. Please do so within five minutes\n\n7. After authenticating, wait 15 to 20 minutes and ensure the Microsoft Sentinel Status of your integration is successful."
                          },
                          {
                            "title": "Step C. Validate connection",
                            "description": "1. Follow the instructions to validate your connectivity:\n\n2. Open Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n3. It may take about 20 minutes until the connection streams data to your workspace."
                          }
                        ]
                    },
                    "type": "InstructionStepsGroup"
                }
            ]    
    }
  ],
  "metadata": {
    "id": "f8c448b1-3df4-444d-aded-63e4ad2aec08",
    "version": "1.0.2",
    "kind": "dataConnector",
    "author": {
      "name": "iboss"
    },
    "support": {
      "tier": "Type of support for content item: microsoft | developer | community",
      "name": "iboss",
      "link": "https://www.iboss.com/"
    }
  }
}