{
    "id": "MailGuard365",
    "title": "MailGuard 365",
    "publisher": "MailGuard365",
    "descriptionMarkdown": "MailGuard 365 Enhanced Email Security for Microsoft 365. Exclusive to the Microsoft marketplace, MailGuard 365 is integrated with Microsoft 365 security (incl. Defender) for enhanced protection against advanced email threats like phishing, ransomware and sophisticated BEC attacks.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "MailGuard365_Threats_CL",
            "baseQuery": "MailGuard365_Threats_CL"
        }
    ],
    "sampleQueries": [
        {
            "description" : "All phishing threats stopped by MailGuard 365",
            "query": "MailGuard365_Threats_CL \n | where Category == \"Phishing\""
        },
        {
            "description" : "All threats summarized by sender email address",
            "query": "MailGuard365_Threats_CL \n | summarize count() by Sender_Email_s"
        },
        {
            "description" : "All threats summarized by category",
            "query": "MailGuard365_Threats_CL \n | summarize count() by Category"
        }
    ],
    "dataTypes": [
        {
            "name": "MailGuard365_Threats_CL",
            "lastDataReceivedQuery": "MailGuard365_Threats_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "MailGuard365_Threats_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Configure and connect MailGuard 365",
            "description": "1. In the MailGuard 365 Console, click **Settings** on the navigation bar.\n2. Click the **Integrations** tab.\n3. Click the **Enable Microsoft Sentinel**.\n4. Enter your workspace id and primary key from the fields below, click **Finish**.\n5. For additional instructions, please contact MailGuard 365 support.",
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                        "PrimaryKey"
                        ],
                        "label": "Primary Key"
                    },
                    "type": "CopyableLabel"
                }
            ]
        }
    ],
    "metadata": {
        "id": "310bcb08-38be-4257-b4d5-035e1ae3f256",
        "version": "1.0.0",
        "kind": "dataConnector",
        "author": {
            "name": "MailGuard 365"
        },
        "support": {
            "name": "MailGuard 365",
            "link": "https://www.mailguard365.com/support",
            "tier": "developer"
        }
    }
}