{
    "id": "PrancerLogData",
    "title": "Prancer Data Connector",
    "publisher": "Prancer",
    "descriptionMarkdown": "The Prancer Data Connector has provides the capability to ingest Prancer (CSPM)[https://docs.prancer.io/web/CSPM/] and [PAC](https://docs.prancer.io/web/PAC/introduction/) data to process through Microsoft Sentinel. Refer to [Prancer Documentation](https://docs.prancer.io/web) for more information.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "Prancer",
            "baseQuery": "prancer_CL"
        }
    ],
    "sampleQueries": [
        {
            "description" : "High Severity Alerts",
            "query": "prancer_CL\n| where severity_s == 'High'"
        }
    ],
    "dataTypes": [
        {
            "name": "prancer_CL",
            "lastDataReceivedQuery": "prancer_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "prancer_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": true
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ],
        "customs": [
            {
                "name": "Include custom pre-requisites if the connectivity requires - else delete customs",
                "description": "Description for any custom pre-requisite"
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "",
            "description": ">**NOTE:** This connector uses Azure Functions to connect to the Prancer REST API to pull logs into Microsoft sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details."
        },
        {
            "title": "",
            "description": "STEP 1: Follow the documentation on the [Prancer Documentation Site](https://docs.prancer.io/web/) in order to set up an scan with an azure cloud connector."
        },
        {
            "title": "",
            "description": "STEP 2: Once the scan is created go to the 'Third Part Integrations' menu for the scan and select Sentinel."
        },
        {
            "title": "",
            "description": "STEP 3: Create follow the configuration wizard to select where in Azure the results should be sent to."
        },
        {
            "title": "",
            "description": "STEP 4: Data should start to get fed into Microsoft Sentinel for processing."
        }
    ],
    "metadata": {
        "id": "b2f8efcc-185e-42d9-9de0-58b1d678de41",
        "version": "1.0.0",
        "kind": "dataConnector",
        "source": {
            "kind": "solution"
        },
        "author": {
            "name": "Prancer"
        },
        "support": {
            "tier": "Partner",
            "name": "Prancer",
            "email": "support@prancer.io"
        }
    }
}