{
    "id": "CyborgSecurity_HUNTER",
    "title": "Cyborg Security HUNTER Hunt Packages",
    "publisher": "Cyborg Security",
    "descriptionMarkdown": "Cyborg Security is a leading provider of advanced threat hunting solutions, with a mission to empower organizations with cutting-edge technology and collaborative tools to proactively detect and respond to cyber threats. Cyborg Security's flagship offering, the HUNTER Platform, combines powerful analytics, curated threat hunting content, and comprehensive hunt management capabilities to create a dynamic ecosystem for effective threat hunting operations.\n\nFollow the steps to gain access to Cyborg Security's Community and setup the 'Open in Tool' capabilities in the HUNTER Platform.",
    "availability": {
        "status": 1,
        "isPreview": true 
    },
    "graphQueries": [
        {
            "metricName": "Total SecurityEvents received",
            "legend": "SecurityEvent",
            "baseQuery": "SecurityEvent"
        }
    ],
    "sampleQueries": [
        {
            "description": "All Alerts",
            "query": "SecurityEvent"
        }
    ],
    "dataTypes": [
        {
            "name": "SecurityEvents",
            "lastDataReceivedQuery": "SecurityEvent\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "SecurityEvent\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions on the workspace are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "instructions": [
                {
                    "parameters": {
                        "text": "Use the following link to find your Azure Tentant ID <a href=\"https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/how-to-find-tenant\">How to find your Azure Active Directory tenant ID</a>",
                        "visible": true,
                        "inline": true
                    },
                "type": "InfoMessage"
                },
                {
                    "parameters": {
                        "fillWith": [
                            "workspaceName"
                            ],
                        "label": "ResourceGroupName & WorkspaceName",
                        "value": "{0}"
                    },
                "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                            ],
                        "label": "WorkspaceID",
                        "value": "{0}"
                    },
                "type": "CopyableLabel"
                }
              ]
        },
        {
            "title": "1. Sign up for Cyborg Security's HUNTER Community Account",
            "description": "Cyborg Security offers Community Memebers access to a subset of the Emerging Threat Collections and hunt packages.\n\nCreate a Free Commuinity Account to get access to Cyborg Security's Hunt Packages: [Sign Up Now!](https://www.cyborgsecurity.com/user-account-creation/)"
        },
        {
            "title": "2. Configure the Open in Tool Feature",
            "description": "\n\n1.  Navigate to the [Environment](https://hunter.cyborgsecurity.io/environment) section of the HUNTER Platform.\n2.  Fill in te **Root URI** of your environment in the section labeled **Microsoft Sentinel**. Replace the <bolded items> with the IDs and Names of your Subscription, Resource Groups and Workspaces.\n\n    https[]()://portal.azure.com#@**AzureTenantID**/blade/Microsoft_OperationsManagementSuite_Workspace/Logs.ReactView/resourceId/%2Fsubscriptions%2F**AzureSubscriptionID**%2Fresourcegroups%2F**ResourceGroupName**%2Fproviders%2Fmicrosoft.operationalinsights%2Fworkspaces%2F<**WorkspaceName**>/\n3.  Click **Save**."
        },
        {
            "title": "3. Execute a HUNTER hunt pacakge in Microsoft Sentinel",
            "description": "\n\nIdentify a Cyborg Security HUNTER hunt package to deploy and use the **Open In Tool** button to quickly open Microsoft Sentinel and stage the hunting content.\n\n![image](https://7924572.fs1.hubspotusercontent-na1.net/hubfs/7924572/HUNTER/Screenshots/openintool-ms-new.png)"
        }
    ]
}