{
	"id": "F5BigIp",
	"title": "F5 BIG-IP",
	"publisher": "F5 Networks",
	"descriptionMarkdown": "The F5 firewall connector allows you to easily connect your F5 logs with Microsoft Sentinel, to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization's network and improves your security operation capabilities.",
	"logo": "ffive_logo.png",
	"graphQueries": [
		{
			"metricName": "Total data received",
			"legend": "F5Telemetry_LTM_CL",
			"baseQuery": "F5Telemetry_LTM_CL"
		},
		{
			"metricName": "Total data received",
			"legend": "F5Telemetry_system_CL",
			"baseQuery": "F5Telemetry_system_CL"
		},
		{
			"metricName": "Total data received",
			"legend": "F5Telemetry_ASM_CL",
			"baseQuery": "F5Telemetry_ASM_CL"
		}
	],
	"sampleQueries": [
		{
			"description": "Count how many LTM logs have been generated from different client IP addresses over time",
			"query": "F5Telemetry_LTM_CL\n            | summarize count() by client_ip_s, TimeGenerated\n            | sort by TimeGenerated"
		},
		{
			"description": "Present the System Telemetry host names",
			"query": "F5Telemetry_system_CL\n            | project hostname_s, TimeGenerated\n            | sort by TimeGenerated"
		},
		{
			"description": "Count how many ASM logs have been generated from different locations",
			"query": "F5Telemetry_ASM_CL\n            | summarize count() by geo_location_s"
		}
	],
	"connectivityCriterias": [
		{
			"type": "IsConnectedQuery",
			"value": [
				"F5Telemetry_system_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
			]
		}
	],
	"dataTypes": [
		{
			"name": "F5Telemetry_LTM_CL",
			"lastDataReceivedQuery": "F5Telemetry_LTM_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
		},
		{
			"name": "F5Telemetry_system_CL",
			"lastDataReceivedQuery": "F5Telemetry_system_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
		},
		{
			"name": "F5Telemetry_ASM_CL",
			"lastDataReceivedQuery": "F5Telemetry_ASM_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
		}
	],
	"availability": {
		"status": 1,
		"isPreview": false
	},
	"permissions": {
		"resourceProvider": [
			{
				"provider": "Microsoft.OperationalInsights/workspaces",
				"permissionsDisplayText": "read and write permissions are required.",
				"providerDisplayName": "Workspace",
				"scope": "Workspace",
				"requiredPermissions": {
					"write": true,
					"read": true,
					"delete": true
				}
			},
			{
				"provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
				"permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
				"providerDisplayName": "Keys",
				"scope": "Workspace",
				"requiredPermissions": {
					"action": true
				}
			}
		]
	},
	"instructionSteps": [
		{
			"title": "Configure and connect F5 BIGIP",
			"description": "To connect your F5 BIGIP, you have to post a JSON declaration to the system’s API endpoint. For instructions on how to do this, see [Integrating the F5 BGIP with Microsoft Sentinel](https://aka.ms/F5BigIp-Integrate).",
			"instructions": [
				{
					"parameters": {
						"fillWith": [
							"WorkspaceId"
						],
						"label": "Workspace ID"
					},
					"type": "CopyableLabel"
				},
				{
					"parameters": {
						"fillWith": [
							"PrimaryKey"
						],
						"label": "Primary Key"
					},
					"type": "CopyableLabel"
				}
			]
		}
	],
	"metadata": {
		"id": "bf5e4cc6-398a-48a0-a75b-a072362ff27a",
		"version": "1.0.0",
		"kind": "dataConnector",
		"source": {
			"kind": "community"
		},
		"author": {
			"name": "F5"
		},
		"support": {
			"name": "F5",
			"link": "https://support.f5.com/csp/home",
			"tier": "developer"
		}
	}
}