{
	"id": "SenservaPro",
	"title": "SenservaPro (Preview)",
	"publisher": "Senserva",
	"descriptionMarkdown": "The SenservaPro data connector provides a viewing experience for your SenservaPro scanning logs. View dashboards of your data, use queries to hunt & explore, and create custom alerts.",
	"graphQueries": [
		{
			"metricName": "Total data received",
			"legend": "SenservaPro_CL",
			"baseQuery": "SenservaPro_CL"
		}
	],
	"sampleQueries": [
		{
			"description": "All SenservaPro data",
			"query": "SenservaPro_CL"
		},
		{
			"description": "All SenservaPro data received in the last 24 hours",
			"query": "SenservaPro_CL\n            | where TimeGenerated > ago(1d)"
		},
		{
			"description": "All SenservaPro data with 'High' Severity, ordered by the most recent received",
			"query": "SenservaPro_CL\n            | where Severity == 3\n            | order by TimeGenerated desc"
		},
		{
			"description": "All 'ApplicationNotUsingClientCredentials' controls received in the last 14 days",
			"query": "let timeframe = 14d;\n            SenservaPro_CL\n            | where TimeGenerated >= ago(timeframe)\n            | where ControlName_s == 'ApplicationNotUsingClientCredentials'"
		},
		{
			"description": "All 'AzureSecureScoreAdminMFAV2' controls received in the last 14 days",
			"query": "let timeframe = 14d;\n            SenservaPro_CL\n            | where TimeGenerated >= ago(timeframe)\n            | where ControlName_s == 'AzureSecureScoreAdminMFAV2'"
		},
		{
			"description": "All 'AzureSecureScoreBlockLegacyAuthentication' controls received in the last 14 days",
			"query": "let timeframe = 14d;\n            SenservaPro_CL\n            | where TimeGenerated >= ago(timeframe)\n            | where ControlName_s == 'AzureSecureScoreBlockLegacyAuthentication'"
		},
		{
			"description": "All 'AzureSecureScoreIntegratedApps' controls received in the last 14 days",
			"query": "let timeframe = 14d;\n            SenservaPro_CL\n            | where TimeGenerated >= ago(timeframe)\n            | where ControlName_s == 'AzureSecureScoreIntegratedApps'"
		},
		{
			"description": "All 'AzureSecureScoreMFARegistrationV2' controls received in the last 14 days",
			"query": "let timeframe = 14d;\n            SenservaPro_CL\n            | where TimeGenerated >= ago(timeframe)\n            | where ControlName_s == 'AzureSecureScoreMFARegistrationV2'"
		},
		{
			"description": "All 'AzureSecureScoreOneAdmin' controls received in the last 14 days",
			"query": "let timeframe = 14d;\n            SenservaPro_CL\n            | where TimeGenerated >= ago(timeframe)\n            | where ControlName_s == 'AzureSecureScoreOneAdmin'"
		},
		{
			"description": "All 'AzureSecureScorePWAgePolicyNew' controls received in the last 14 days",
			"query": "let timeframe = 14d;\n            SenservaPro_CL\n            | where TimeGenerated >= ago(timeframe)\n            | where ControlName_s == 'AzureSecureScorePWAgePolicyNew'"
		},
		{
			"description": "All 'AzureSecureScoreRoleOverlap' controls received in the last 14 days",
			"query": "let timeframe = 14d;\n            SenservaPro_CL\n            | where TimeGenerated >= ago(timeframe)\n            | where ControlName_s == 'AzureSecureScoreRoleOverlap'"
		},
		{
			"description": "All 'AzureSecureScoreSelfServicePasswordReset' controls received in the last 14 days",
			"query": "let timeframe = 14d;\n            SenservaPro_CL\n            | where TimeGenerated >= ago(timeframe)\n            | where ControlName_s == 'AzureSecureScoreSelfServicePasswordReset'"
		},
		{
			"description": "All 'AzureSecureScoreSigninRiskPolicy' controls received in the last 14 days",
			"query": "let timeframe = 14d;\n            SenservaPro_CL\n            | where TimeGenerated >= ago(timeframe)\n            | where ControlName_s == 'AzureSecureScoreSignInRiskPolicy'"
		},
		{
			"description": "All 'AzureSecureScoreUserRiskPolicy' controls received in the last 14 days",
			"query": "let timeframe = 14d;\n            SenservaPro_CL\n            | where TimeGenerated >= ago(timeframe)\n            | where ControlName_s == 'AzureSecureScoreUserRiskPolicy'"
		},
		{
			"description": "All 'Disabled' controls received in the last 14 days",
			"query": "let timeframe = 14d;\n            SenservaPro_CL\n            | where TimeGenerated >= ago(timeframe)\n            | where ControlName_s == 'UserDisabled'"
		},
		{
			"description": "All 'NonAdminGuest' controls received in the last 14 days",
			"query": "let timeframe = 14d;\n            SenservaPro_CL\n            | where TimeGenerated >= ago(timeframe)\n            | where ControlName_s == 'UserNonAdminGuest'"
		},
		{
			"description": "All 'ServicePrincipalNotUsingClientCredentials' controls received in the last 14 days",
			"query": "let timeframe = 14d;\n            SenservaPro_CL\n            | where TimeGenerated >= ago(timeframe)\n            | where ControlName_s == 'ServicePrincipalNotUsingClientCredentials'"
		},
		{
			"description": "All 'StaleLastPasswordChange' controls received in the last 14 days",
			"query": "let timeframe = 14d;\n            SenservaPro_CL\n            | where TimeGenerated >= ago(timeframe)\n            | where ControlName_s == 'UserStaleLastPasswordChange'"
		}
	],
	"dataTypes": [
		{
			"name": "SenservaPro_CL",
			"lastDataReceivedQuery": "SenservaPro_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
		}
	],
	"connectivityCriterias": [
		{
			"type": "IsConnectedQuery",
			"value": [
				"SenservaPro_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
			]
		}
	],
	"availability": {
		"status": 1,
		"isPreview": false
	},
	"permissions": {
		"resourceProvider": [
			{
				"provider": "Microsoft.OperationalInsights/workspaces",
				"permissionsDisplayText": "read and write permissions are required.",
				"providerDisplayName": "Workspace",
				"scope": "Workspace",
				"requiredPermissions": {
					"write": true,
					"read": true,
					"delete": true
				}
			},
			{
				"provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
				"permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
				"providerDisplayName": "Keys",
				"scope": "Workspace",
				"requiredPermissions": {
					"action": true
				}
			}
		]
	},
	"instructionSteps": [
		{
			"title": "1. Setup the data connection",
			"description": "Visit [Senserva Setup](https://www.senserva.com/senserva-microsoft-sentinel-edition-setup/) for information on setting up the Senserva data connection, support, or any other questions. The Senserva installation will configure a Log Analytics Workspace for output. Deploy Microsoft Sentinel onto the configured Log Analytics Workspace to finish the data connection setup by following [this onboarding guide.](https://docs.microsoft.com/azure/sentinel/quickstart-onboard)",
			"instructions": [
				{
					"parameters": {
						"fillWith": [
							"WorkspaceId"
						],
						"label": "Workspace ID"
					},
					"type": "CopyableLabel"
				},
				{
					"parameters": {
						"fillWith": [
							"PrimaryKey"
						],
						"label": "Primary Key"
					},
					"type": "CopyableLabel"
				}
			]
		}
	],
	"metadata": {
		"id": "6a9b5994-e3c2-45ad-8a85-6fbfa6fde979",
		"version": "3.0",
		"kind": "dataConnector",
		"source": {
			"kind": "community"
		},
		"author": {
			"name": "Senserva"
		},
		"support": {
			"name": "Senserva",
			"link": "https://www.senserva.com/contact-us/",
			"tier": "developer",
			"email": "support@senserva.com"
		}
	}
}