{
    "id": "AlsidForAD",
    "title": "Alsid for Active Directory",
    "publisher": "Alsid",
    "descriptionMarkdown": "Alsid for Active Directory connector allows to export Alsid Indicators of Exposures, trailflow and Indicators of Attacks logs to Azure Sentinel in real time.\nIt provides a data parser to manipulate the logs more easily. The different workbooks ease your Active Directory monitoring and provide different ways to visualize the data. The analytic templates allow to automate responses regarding different events, exposures, or attacks.",
    "additionalRequirementBanner": "This data connector depends on a parser based on Kusto Function to work as expected. Follow the steps to use this Kusto Function alias **afad_parser** in queries and workbooks. [Follow steps to get this Kusto Function>](https://aka.ms/sentinel-alsidforad-parser)  ",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "AlsidForADLog_CL",
            "baseQuery": "AlsidForADLog_CL"
        }
    ],
    "sampleQueries": [
        {
            "description" : "Get the number of alerts triggered by each IoE",
            "query": "afad_parser\n | where MessageType == 0\n | summarize AlertCount = count() by Codename"
        },
        {
            "description" : "Get all IoE alerts with severity superior to the threshold",
            "query" : "let threshold = 2;\n let SeverityTable=datatable(Severity:string,Level:int) [\n \"low\", 1,\n \"medium\", 2,\n \"high\", 3,\n \"critical\", 4\n ];\n afad_parser\n | where MessageType == 0\n | lookup kind=leftouter SeverityTable on Severity\n | where Level >= ['threshold']"
        },
        {
            "description" : "Get all IoE alerts for the last 24 hours",
            "query" : "afad_parser\r\n| where MessageType == 0 and TimeGenerated > ago(1d)"
        },
        {
            "description" : "Get all IoE alerts for the last 7 days",
            "query" : "afad_parser\r\n| where MessageType == 0 and TimeGenerated > ago(7d)"
        },
        {
            "description" : "Get all IoE alerts for the last 30 days",
            "query" : "afad_parser\r\n| where MessageType == 0 and TimeGenerated > ago(30d)"
        },
        {
            "description" : "Get all trailflow changes for the last 24 hours",
            "query" : "afad_parser\r\n| where MessageType == 1 and TimeGenerated > ago(1d)"
        },
        {
            "description" : "Get all trailflow changes for the last 7 days",
            "query" : "afad_parser\r\n| where MessageType == 1 and TimeGenerated > ago(7d)"
        }
    ],
    "dataTypes": [
        {
            "name": "AlsidForADLog_CL",
            "lastDataReceivedQuery": "AlsidForADLog_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "afad_parser\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "", 
            "description": ">This data connector depends on a parser based on a Kusto Function to work as expected. [Follow these steps](https://aka.ms/sentinel-alsidforad-parser) to create the Kusto Functions alias, **afad_parser**",
            "instructions": [ 
            ]    
        }, 
        {
            "title": "1. Configure the Syslog server",
            "description": "You will first need a **linux Syslog** server that Alsid for AD will send logs to. Typically you can run **rsyslog** on **Ubuntu**.\n You can then configure this server as you wish, but it is recommended to be able to output AFAD logs in a separate file.\nAlternatively you can use [this Quickstart template](https://azure.microsoft.com/resources/templates/alsid-syslog-proxy/) which will deploy the Syslog server and the Microsoft agent for you. If you do use this template, you can skip step 3."
        },
        {
            "title": "2. Configure Alsid to send logs to your Syslog server",
            "description": "On your **Alsid for AD** portal, go to *System*, *Configuration* and then *Syslog*.\nFrom there you can create a new Syslog alert toward your Syslog server.\n\nOnce this is done, check that the logs are correctly gathered on your server in a seperate file (to do this, you can use the *Test the configuration* button in the Syslog alert configuration in AFAD).\nIf you used the Quickstart template, the Syslog server will by default listen on port 514 in UDP and 1514 in TCP, without TLS."
        },
        {
            "title": "3. Install and onboard the Microsoft agent for Linux",
            "description": "You can skip this step if you used the Quickstart template in step 1",
            "instructions": [
                {
                    "parameters": {
                        "title": "Choose where to install the agent:",
                        "instructionSteps": [
                            {
                                "title": "Install agent on Azure Linux Virtual Machine",
                                "description": "Select the machine to install the agent on and then click **Connect**.",
                                "instructions": [
                                    {
                                        "parameters": {
                                            "linkType": "InstallAgentOnLinuxVirtualMachine"
                                        },
                                        "type": "InstallAgent"
                                    }
                                ]
                            },
                            {
                                "title": "Install agent on a non-Azure Linux Machine",
                                "description": "Download the agent on the relevant machine and follow the instructions.",
                                "instructions": [
                                    {
                                        "parameters": {
                                            "linkType": "InstallAgentOnLinuxNonAzure"
                                        },
                                        "type": "InstallAgent"
                                    }
                                ]
                            }
                        ]
                    },
                    "type": "InstructionStepsGroup"
                }
            ]
        },
        {
            "title": "4. Configure the logs to be collected by the agents",
            "description": "Configure the agent to collect the logs.\n\n1. Under workspace advanced settings **Configuration**, select **Data** and then **Custom Logs**.\n2. Select **Apply below configuration to my machines** and click **Add**.\n3. Upload a sample AFAD Syslog file from the **Linux** machine running the **Syslog** server and click **Next**, for your convenience, you can find such a file [here](https://github.com/Azure/azure-quickstart-templates/blob/master/alsid-syslog-proxy/logs/AlsidForAD.log).\n4. Set the record delimiter to **New Line** if not already the case and click **Next**.\n5. Select **Linux** and enter the file path to the **Syslog** file, click **+** then **Next**. If you used the Quickstart template in step 1, the default location of the file is `/var/log/AlsidForAD.log`.\n6. Set the **Name** to *AlsidForADLog_CL* then click **Done** (Azure automatically adds *_CL* at the end of the name, there must be only one, make sure the name is not *AlsidForADLog_CL_CL*).\n\nAll of these steps are showcased [here](https://www.youtube.com/watch?v=JwV1uZSyXM4&feature=youtu.be) as an example",
            "instructions": [
                {
                    "parameters": {
                        "linkType": "OpenSyslogSettings"
                    },
                    "type": "InstallAgent"
                }
            ]
        },
        {
            "title": "",
            "description": "> You should now be able to receive logs in the *AlsidForADLog_CL* table, logs data can be parse using the **afad_parser()** function, used by all query samples, workbooks and analytic templates."
        }
    ],
    "metadata": {
        "id": "12ff1831-b733-4861-a3e7-6115d20106f4",
        "version": "1.0.0",
        "kind": "dataConnector",
        "source": {
            "kind": "community"
        },
        "author": {
            "name": "Alsid"
        },
        "support": {
            "name": "Alsid",
            "link": "https://www.alsid.com/contact-us/",
            "tier": "developer"
        }
    }
}