{
    "id": "McAfeeNSP",
    "title": "[Deprecated] McAfee Network Security Platform",
    "publisher": "McAfee",
    "descriptionMarkdown": "The [McAfee® Network Security Platform](https://www.mcafee.com/enterprise/en-us/products/network-security-platform.html) data connector provides the capability to ingest [McAfee® Network Security Platform events](https://docs.mcafee.com/bundle/network-security-platform-10.1.x-integration-guide-unmanaged/page/GUID-8C706BE9-6AC9-4641-8A53-8910B51207D8.html) into Microsoft Sentinel. Refer to [McAfee® Network Security Platform](https://docs.mcafee.com/bundle/network-security-platform-10.1.x-integration-guide-unmanaged/page/GUID-F7D281EC-1CC9-4962-A7A3-5A9D9584670E.html) for more information.",
    "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**McAfeeNSPEvent**](https://aka.ms/sentinel-mcafeensp-parser) which is deployed with the Microsoft Sentinel Solution.",
    "graphQueries": [{
        "metricName": "Total data received",
        "legend": "McAfeeNSP",
        "baseQuery": "McAfeeNSPEvent"
    }],
    "sampleQueries": [{
        "description": "Top 10 Sources",
        "query": "McAfeeNSPEvent\n | summarize count() by tostring(DvcHostname)\n | top 10 by count_"
    }],
    "dataTypes": [{
        "name": "Syslog (McAfeeNSPEvent)",
        "lastDataReceivedQuery": "McAfeeNSPEvent\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
    }],
    "connectivityCriterias": [{
        "type": "IsConnectedQuery",
        "value": [
            "McAfeeNSPEvent\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
        ]
    }],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [{
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "delete": true
                }
            }
        ]
    },
    "instructionSteps": [{
            "title": "",
            "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**McAfeeNSPEvent**](https://aka.ms/sentinel-mcafeensp-parser) which is deployed with the Microsoft Sentinel Solution.",
            "instructions": []
        },
        {
            "title": "",
            "description": ">**NOTE:** This data connector has been developed using McAfee® Network Security Platform version: 10.1.x",
            "instructions": []
        },
        {
            "title": "1. Install and onboard the agent for Linux or Windows",
            "description": "Install the agent on the Server where the McAfee® Network Security Platform logs are forwarded.\n\n> Logs from McAfee® Network Security Platform Server deployed on Linux or Windows servers are collected by **Linux** or **Windows** agents.",
            "instructions": [{
                "parameters": {
                    "title": "Choose where to install the Linux agent:",
                    "instructionSteps": [{
                            "title": "Install agent on Azure Linux Virtual Machine",
                            "description": "Select the machine to install the agent on and then click **Connect**.",
                            "instructions": [{
                                "parameters": {
                                    "linkType": "InstallAgentOnLinuxVirtualMachine"
                                },
                                "type": "InstallAgent"
                            }]
                        },
                        {
                            "title": "Install agent on a non-Azure Linux Machine",
                            "description": "Download the agent on the relevant machine and follow the instructions.",
                            "instructions": [{
                                "parameters": {
                                    "linkType": "InstallAgentOnLinuxNonAzure"
                                },
                                "type": "InstallAgent"
                            }]
                        }
                    ]
                },
                "type": "InstructionStepsGroup"
            }]
        },
        {
            "instructions": [{
                "parameters": {
                    "title": "Choose where to install the Windows agent:",
                    "instructionSteps": [{
                            "title": "Install agent on Azure Windows Virtual Machine",
                            "description": "Select the machine to install the agent on and then click **Connect**.",
                            "instructions": [{
                                "parameters": {
                                    "linkType": "InstallAgentOnVirtualMachine"
                                },
                                "type": "InstallAgent"
                            }]
                        },
                        {
                            "title": "Install agent on a non-Azure Windows Machine",
                            "description": "Download the agent on the relevant machine and follow the instructions.",
                            "instructions": [{
                                "parameters": {
                                    "linkType": "InstallAgentOnNonAzure"
                                },
                                "type": "InstallAgent"
                            }]
                        }
                    ]
                },
                "type": "InstructionStepsGroup"
            }]
        },
        {
            "title": "2. Configure McAfee® Network Security Platform event forwarding",
            "description": "Follow the configuration steps below to get McAfee® Network Security Platform logs into Microsoft Sentinel.\n1. [Follow these instructions](https://docs.mcafee.com/bundle/network-security-platform-10.1.x-product-guide/page/GUID-E4A687B0-FAFB-4170-AC94-1D968A10380F.html) to forward alerts from the Manager to a syslog server.\n2. Add a syslog notification profile, [more details here](https://docs.mcafee.com/bundle/network-security-platform-10.1.x-product-guide/page/GUID-5BADD5D7-21AE-4E3B-AEE2-A079F3FD6A38.html). This is mandatory. While creating profile, to make sure that events are formatted correctly, enter the following text in the Message text box:\n\t\t<SyslogAlertForwarderNSP>:|SENSOR_ALERT_UUID|ALERT_TYPE|ATTACK_TIME|ATTACK_NAME|ATTACK_ID\n\t\t|ATTACK_SEVERITY|ATTACK_SIGNATURE|ATTACK_CONFIDENCE|ADMIN_DOMAIN|SENSOR_NAME|INTERFACE\n\t\t|SOURCE_IP|SOURCE_PORT|DESTINATION_IP|DESTINATION_PORT|CATEGORY|SUB_CATEGORY\n\t\t|DIRECTION|RESULT_STATUS|DETECTION_MECHANISM|APPLICATION_PROTOCOL|NETWORK_PROTOCOL|"
        }
    ]
}