{
  "Name": "SlackAudit",
  "Author": "Microsoft - support@microsoft.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SlackAudit/Data%20Connectors/Logo/slacklogo.svg\" width=\"75px\" height=\"75px\">",
  "WorkbookDescription": "",
  "Description": "The [Slack](https://slack.com/intl/en-in/) Audit solution provides the capability to ingest [Slack Audit Records](https://api.slack.com/admins/audit-logs) events into Microsoft Sentinel through the REST API. Refer to [API documentation](https://api.slack.com/admins/audit-logs-call) for more information.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n \r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n \r\n  • [Microsoft Sentinel Codeless Connector Framework](https://aka.ms/Sentinel-CCP_Platform)",
  "Workbooks": [
    "Workbooks/SlackAudit.json"
  ],
  "Analytic Rules": [
    "Analytic Rules/SlackAuditEmptyUA.yaml",
    "Analytic Rules/SlackAuditMultipleArchivedFilesUploadedInShortTimePeriod.yaml",
    "Analytic Rules/SlackAuditMultipleFailedLoginsForUser.yaml",
    "Analytic Rules/SlackAuditSensitiveFile.yaml",
    "Analytic Rules/SlackAuditSuspiciousFileDownloaded.yaml",
    "Analytic Rules/SlackAuditUnknownUA.yaml",
    "Analytic Rules/SlackAuditUserChangedToAdminOrOwner.yaml",
    "Analytic Rules/SlackAuditUserEmailChanged.yaml",
    "Analytic Rules/SlackAuditUserLoginAfterDeactivated.yaml"
  ],
  "Data Connectors": [
    "Data Connectors/SlackAuditLog_CCP/SlackAuditLog_ConnectorDefinition.json"
  ],
  "Parsers": [
    "Parsers/SlackAudit.yaml"
  ],
  "Hunting Queries": [
    "Hunting Queries/SlackAuditApplicationsInstalled.yaml",
    "Hunting Queries/SlackAuditDeactivatedUsers.yaml",
    "Hunting Queries/SlackAuditDownloadedFilesByUser.yaml",
    "Hunting Queries/SlackAuditFailedLoginsUnknownUsername.yaml",
    "Hunting Queries/SlackAuditNewUsers.yaml",
    "Hunting Queries/SlackAuditSuspiciousFilesDownloaded.yaml",
    "Hunting Queries/SlackAuditUploadedFilesByUser.yaml",
    "Hunting Queries/SlackAuditUserLoginsByIP.yaml",
    "Hunting Queries/SlackAuditUserPermissionsChanged.yaml",
    "Hunting Queries/SlackAuditUsersJoinedChannelsWithoutInvites.yaml"
  ],
  "Metadata": "SolutionMetadata.json",
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\SlackAudit",
  "Version": "3.0.5",
  "TemplateSpec": true,
  "Is1PConnector": false
}