{
    "id": "SophosCloudOptix",
    "title": "Sophos Cloud Optix",
    "publisher": "Sophos",
    "descriptionMarkdown": "The [Sophos Cloud Optix](https://www.sophos.com/products/cloud-optix.aspx) connector allows you to easily connect your Sophos Cloud Optix logs with Microsoft Sentinel, to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization's cloud security and compliance posture and improves your cloud security operation capabilities.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "SophosCloudOptix_CL",
            "baseQuery": "SophosCloudOptix_CL"
        }
    ],
    "sampleQueries": [
        {
            "description" : "Top 10 Optix alerts raised for your cloud environment(s)",
            "query": "SophosCloudOptix_CL\n | summarize count() by alertDescription_s\n | top 10 by count_"
        },
        {
            "description" : "Top 5 environments with High severity Optix alerts raised",
            "query": "SophosCloudOptix_CL\n | where severity_s == 'HIGH'\n | summarize count() by accountId_s\n | top 5 by count_"
        }
    ],
    "dataTypes": [
        {
            "name": "SophosCloudOptix_CL",
            "lastDataReceivedQuery": "SophosCloudOptix_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "SophosCloudOptix_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "1. Get the Workspace ID and the Primary Key",
            "description": "Copy the Workspace ID and Primary Key for your workspace.\n",
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                            "PrimaryKey"
                        ],
                        "label": "Primary Key"
                    },
                    "type": "CopyableLabel"
                }
            ]
        },
        {
            "title": "2. Configure the Sophos Cloud Optix Integration",
            "description": "In Sophos Cloud Optix go to [Settings->Integrations->Microsoft Sentinel](https://optix.sophos.com/#/integrations/sentinel) and enter the Workspace ID and Primary Key copied in Step 1.\n"
        },
        {
            "title": "3. Select Alert Levels",
            "description": "In Alert Levels, select which Sophos Cloud Optix alerts you want to send to Microsoft Sentinel.\n"
        },
        {
            "title": "4. Turn on the integration",
            "description": "To turn on the integration, select Enable, and then click Save.\n"
        }
    ],
    "metadata": {
        "id": "a3646b81-9e6a-4f4b-beb1-9d2eba8ab669",
        "version": "1.0.0",
        "kind": "dataConnector",
        "source": {
            "kind": "community"
        },
        "author": {
            "name": "Sophos"
        },
        "support": {
            "name": "Sophos",
            "link": "https://secure2.sophos.com/en-us/support.aspx",
            "tier": "developer"
        }
    }
}