{
    "id": "ESI-ExchangeOnPremisesCollector",
    "title": "Exchange Security Insights On-Premises Collector",
    "publisher": "Microsoft",
    "descriptionMarkdown": "Connector used to push Exchange On-Premises Security configuration for Microsoft Sentinel Analysis",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "ESIExchangeConfig_CL",
            "baseQuery": "ESIExchangeConfig_CL"
        }
    ],
    "sampleQueries": [
        {
            "description" : "View how many Configuration entries exist on the table",
            "query": "ESIExchangeConfig_CL | summarize by GenerationInstanceID_g, EntryDate_s, ESIEnvironment_s"
        }
    ],
    "dataTypes": [
        {
            "name": "ESIExchangeConfig_CL",
            "lastDataReceivedQuery": "ESIExchangeConfig_CL | summarize Time = max(todatetime(EntryDate_s)) by GenerationInstanceID_g, ESIEnvironment_s | where isnotempty(Time) |summarize Time = max(Time) | project Time"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "ESIExchangeConfig_CL | summarize LastLogReceived = max(todatetime(EntryDate_s)) by GenerationInstanceID_g, ESIEnvironment_s |take 1 | project IsConnected = true"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ],
        "customs": [
            {
                "name": "Service Account with Organization Management role",
                "description": "The service Account that launch the script as scheduled task needs to be Organization Management to be able to retrieve all the needed security Information."
            },
            {
                "name": "Detailled documentation",
                "description": ">**NOTE:** Detailled documentation on Installation procedure and usage can be found [here](https://aka.ms/MicrosoftExchangeSecurityGithub)"
            }            
        ]
    },
    "instructionSteps": [
        {
            "title": "1. Install the ESI Collector Script on a server with Exchange Admin PowerShell console",
            "description": "This is the script that will collect Exchange Information to push content in Microsoft Sentinel.\n ",
            "instructions": [
                {
                    "parameters": {
                        "title": "Script Deployment",
                        "instructionSteps": [
                            {
                                "title": "Download the latest version of ESI Collector",
                                "description": "The latest version can be found here : https://aka.ms/ESI-ExchangeCollector-Script. The file to download is CollectExchSecIns.zip"
                            },
                            {
                                "title": "Copy the script folder",
                                "description": "Unzip the content and copy the script folder on a server where Exchange PowerShell Cmdlets are present."
                            },
                            {
                                "title": "Unblock the PS1 Scripts",
                                "description": "Click right on each PS1 Script and go to Properties tab.\n If the script is marked as blocked, unblock it. You can also use the Cmdlet 'Unblock-File *.* in the unzipped folder using PowerShell."
                            },
                            {
                                "title": "Configure Network Access ",
                                "description": "Ensure that the script can contact Azure Analytics (*.ods.opinsights.azure.com)."
                            }
                        ]
                    },
                    "type": "InstructionStepsGroup"
                }
            ]
        },
        {
            "title": "2. Configure the ESI Collector Script",
            "description": "Be sure to be local administrator of the server.\nIn 'Run as Administrator' mode, launch the 'setup.ps1' script to configure the collector.\n Fill the Log Analytics (Microsoft Sentinel) Workspace information.\n Fill the Environment name or leave empty. By default, choose 'Def' as Default analysis. The other choices are for specific usage.",
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                            "PrimaryKey"
                        ],
                        "label": "Primary Key"
                    },
                    "type": "CopyableLabel"
                }
            ]
        },
        {
            "title": "3. Schedule the ESI Collector Script (If not done by the Install Script due to lack of permission or ignored during installation)",
            "description": "The script needs to be scheduled to send Exchange configuration to Microsoft Sentinel.\n We recommend to schedule the script once a day.\n The account used to launch the Script needs to be member of the group Organization Management"
        },
        {
            "title": "",
            "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected. Parsers are automatically deployed with the solution. Follow the steps to create the Kusto Functions alias : [**ExchangeAdminAuditLogs**](https://aka.ms/sentinel-ESI-ExchangeCollector-ExchangeAdminAuditLogs-parser)",
            "instructions": [
                {
                    "parameters": {
                        "title": "Parsers are automatically deployed during Solution deployment. If you want to deploy manually, follow the steps below",
                        "instructionSteps": [
                            {
                                "title": "Manual Parser Deployment",
                                "instructions": [
                                    {
                                        "parameters": {
                                            "instructionSteps": [
                                                {
                                                    "title": "1. Download the Parser file",
                                                    "description": "The latest version of the file [**ExchangeAdminAuditLogs**](https://aka.ms/sentinel-ESI-ExchangeCollector-ExchangeAdminAuditLogs-parser)"
                                                },
                                                {
                                                    "title": "2. Create Parser **ExchangeAdminAuditLogs** function",
                                                    "description": "In 'Logs' explorer of your Microsoft Sentinel's log analytics, copy the content of the file to Log explorer"
                                                },
                                                {
                                                    "title": "3. Save Parser **ExchangeAdminAuditLogs** function",
                                                    "description": "Click on save button.\n No parameter is needed for this parser.\nClick save again."
                                                }
                                            ]
                                        },
                                        "type": "InstructionStepsGroup"
                                    }
                                ]
                            }
                        ]
                    },
                    "type": "InstructionStepsGroup"
                }
            ]
        }
    ],
    "metadata": {
        "id": "ed950fd7-e457-4a59-88f0-b9c949aa280d",
        "version": "1.2.2",
        "kind": "dataConnector",
        "source": {
            "kind": "solution",
            "name": "ESI - Exchange Security Configuration Analyzer"
        },
        "support": {
            "name": "Community",
            "tier": "Community",
            "link": "https://github.com/Azure/Azure-Sentinel/issues"
        },
        "author": {
            "name": "Microsoft"
        }
    }
}