{
    "id": "UbiquitiUnifi",
    "title": "[Deprecated] Ubiquiti UniFi",
    "publisher": "Ubiquiti",
    "descriptionMarkdown": "The [Ubiquiti UniFi](https://www.ui.com/) data connector provides the capability to ingest [Ubiquiti UniFi firewall, dns, ssh, AP events](https://help.ui.com/hc/en-us/articles/204959834-UniFi-How-to-View-Log-Files) into Microsoft Sentinel.",
    "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**UbiquitiAuditEvent**](https://aka.ms/sentinel-UbiquitiUnifi-parser) which is deployed with the Microsoft Sentinel Solution.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "Ubiquiti_CL",
            "baseQuery": "UbiquitiAuditEvent"
        }
    ],
    "sampleQueries": [
        {
            "description" : "Top 10 Clients (Source IP)",
            "query": "UbiquitiAuditEvent\n | summarize count() by SrcIpAddr\n | top 10 by count_"
        }
    ],
    "dataTypes": [
        {
            "name": "Ubiquiti_CL",
            "lastDataReceivedQuery": "UbiquitiAuditEvent\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "UbiquitiAuditEvent\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ]
    },
    "instructionSteps": [
        { 
            "title": "", 
            "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**UbiquitiAuditEvent**](https://aka.ms/sentinel-UbiquitiUnifi-parser) which is deployed with the Microsoft Sentinel Solution.",
            "instructions": [ 
            ]    
        },
        {
            "title": "",
            "description": ">**NOTE:** This data connector has been developed using Enterprise System Controller Release Version: 5.6.2 (Syslog)",
            "instructions": [
            ]
        },  
        { 
            "title": "1. Install and onboard the agent for Linux or Windows", 
            "description": "Install the agent on the Server to which the Ubiquiti logs are forwarder from Ubiquiti device (e.g.remote syslog server)\n\n> Logs from Ubiquiti Server deployed on Linux or Windows servers are collected by **Linux** or **Windows** agents.", 
            "instructions": [ 
                { 
                "parameters": { 
                "title": "Choose where to install the Linux agent:", 
    "instructionSteps": [ 
            { 
            "title": "Install agent on Azure Linux Virtual Machine", 
            "description": "Select the machine to install the agent on and then click **Connect**.", 
            "instructions": [ 
                { 
                "parameters": { 
                "linkType": "InstallAgentOnLinuxVirtualMachine" 
                }, 
                "type": "InstallAgent" 
                }
            ]    
        }, 
            { 
            "title": "Install agent on a non-Azure Linux Machine", 
            "description": "Download the agent on the relevant machine and follow the instructions.", 
            "instructions": [ 
                { 
                "parameters": { 
                "linkType": "InstallAgentOnLinuxNonAzure" 
                }, 
                "type": "InstallAgent" 
                } 
            ] 
        } 
    ] 
        }, 
            "type": "InstructionStepsGroup" 
            } 
        ] 
            }, 
            { 
                "instructions": [ 
                    { 
                    "parameters": { 
                    "title": "Choose where to install the Windows agent:", 
        "instructionSteps": [ 
                { 
                "title": "Install agent on Azure Windows Virtual Machine", 
                "description": "Select the machine to install the agent on and then click **Connect**.", 
                "instructions": [ 
                    { 
                    "parameters": { 
                    "linkType": "InstallAgentOnVirtualMachine"
                    }, 
                    "type": "InstallAgent" 
                    }
                ]    
            }, 
                { 
                "title": "Install agent on a non-Azure Windows Machine", 
                "description": "Download the agent on the relevant machine and follow the instructions.", 
                "instructions": [ 
                    { 
                    "parameters": { 
                    "linkType": "InstallAgentOnNonAzure"  
                    }, 
                    "type": "InstallAgent" 
                    } 
                ] 
            } 
        ] 
            }, 
                "type": "InstructionStepsGroup" 
                } 
            ] 
                }, 
    { 
            "title": "2. Configure the logs to be collected", 
            "description":"Follow the configuration steps below to get Ubiquiti logs into Microsoft Sentinel. Refer to the [Azure Monitor Documentation](https://docs.microsoft.com/azure/azure-monitor/agents/data-sources-json) for more details on these steps.\n1. Configure log forwarding on your Ubiquiti controller: \n\n\t i. Go to Settings > System Setting > Controller Configuration > Remote Logging and enable the Syslog and Debugging (optional) logs (Refer to [User Guide](https://dl.ui.com/guides/UniFi/UniFi_Controller_V5_UG.pdf) for detailed instructions).\n2. Download config file [Ubiquiti.conf](https://aka.ms/sentinel-UbiquitiUnifi-conf).\n3. Login to the server where you have installed Azure Log Analytics agent.\n4. Copy Ubiquiti.conf to the /etc/opt/microsoft/omsagent/**workspace_id**/conf/omsagent.d/ folder.\n5. Edit Ubiquiti.conf as follows:\n\n\t i. specify port which you have set your Ubiquiti device to forward logs to (line 4)\n\n\t ii. replace **workspace_id** with real value of your Workspace ID (lines 14,15,16,19)\n5. Save changes and restart the Azure Log Analytics agent for Linux service with the following command:\n\t\tsudo /opt/microsoft/omsagent/bin/service_control restart",
            "instructions":[
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                }
            ]
    }
]
}