{
  "id": "NucleusCyberNCProtect",
  "title": "NC Protect",
  "publisher": "archTIS",
  "descriptionMarkdown": "[NC Protect Data Connector (archtis.com)](https://info.archtis.com/get-started-with-nc-protect-sentinel-data-connector) provides the capability to ingest user activity logs and events into Microsoft Sentinel. The connector provides visibility into NC Protect user activity logs and events in Microsoft Sentinel to improve monitoring and investigation capabilities",
  "graphQueries": [
    {
      "metricName": "Total data received",
      "legend": "NCProtectUAL_CL",
      "baseQuery": "NCProtectUAL_CL"
    }
  ],
  "sampleQueries": [
    {
      "description": "Get last 7 days records",
      "query": "\nNCProtectUAL_CL\n | where TimeGenerated > ago(7d)\n | order by TimeGenerated desc"
    },
    {
      "description": "Login failed consecutively for more than 3 times in an hour by user",
      "query": "\nNCProtectUAL_CL\n | where TimeGenerated > ago(1h) and Type_s == 'LoginFailure'\n | summarize FailedRequestCount = count() by bin(TimeGenerated, 1h), UserDisplayName_s, UserEmail_s, UserLoginName_s, Type_s, JSONExtra_s\n | where  FailedRequestCount > 3"
    },
    {
      "description": "Download failed consecutively for more than 3 times in an hour by user",
      "query": "\nNCProtectUAL_CL\n | where TimeGenerated > ago(1h) and Type_s == 'Open' and Status_s == 'Fail'\n | summarize FailedRequestCount = count() by bin(TimeGenerated, 1h), UserDisplayName_s, UserEmail_s, UserLoginName_s, Type_s, JSONExtra_s, DocumentUrl_s\n | where  FailedRequestCount > 3"
    },
    {
      "description": "Get logs for rule created or modified or deleted records in last 7 days",
      "query": "\nNCProtectUAL_CL\n | where TimeGenerated > ago(7d) and (Type_s == 'Create' or Type_s == 'Modify' or Type_s == 'Delete') and isnotempty(RuleName_s)\n | order by TimeGenerated desc"
    }
  ],
  "dataTypes": [
    {
      "name": "NCProtectUAL_CL",
      "lastDataReceivedQuery": "\nNCProtectUAL_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
    }
  ],
  "connectivityCriterias": [
    {
      "type": "IsConnectedQuery",
      "value": [
        "\nNCProtectUAL_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
      ]
    }
  ],
  "availability": {
    "status": 1,
    "isPreview": false
  },
  "permissions": {
    "resourceProvider": [
      {
        "provider": "Microsoft.OperationalInsights/workspaces",
        "permissionsDisplayText": "read and write permissions are required.",
        "providerDisplayName": "Workspace",
        "scope": "Workspace",
        "requiredPermissions": {
          "write": true,
          "read": true,
          "delete": true
        }
      },
      {
        "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
        "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
        "providerDisplayName": "Keys",
        "scope": "Workspace",
        "requiredPermissions": {
          "action": true
        }
      }
    ],
    "customs": [
      {
        "name": "NC Protect",
        "description": "You must have a running instance of NC Protect for O365. Please [contact us](https://www.archtis.com/data-discovery-classification-protection-software-secure-collaboration/)."
      }
    ]
  },
  "instructionSteps": [
    {
      "title": "",
      "description": "1. Install NC Protect into your Azure Tenancy\n2. Log into the NC Protect Administration site\n3. From the left hand navigation menu, select General -> User Activity Monitoring\n4. Tick the checkbox to Enable SIEM and click the Configure button\n5. Select Microsoft Sentinel as the Application and complete the configuration using the information below\n6. Click Save to activate the connection\n",
      "instructions": [
        {
          "parameters": {
            "fillWith": [
              "WorkspaceId"
            ],
            "label": "Workspace ID"
          },
          "type": "CopyableLabel"
        },
        {
          "parameters": {
            "fillWith": [
              "PrimaryKey"
            ],
            "label": "Primary Key"
          },
          "type": "CopyableLabel"
        }
      ]
    }
  ],
  "metadata": {
    "id": "3161ee3b-2ddd-4902-aeff-5e297b98bc00",
    "version": "8.0.0",
    "kind": "dataConnector",
    "source": {
      "kind": "community"
    },
    "author": {
      "name": "archTIS"
    },
    "support": {
      "name": "archTIS",
      "link": "https://www.archtis.com/nc-protect-support/",
      "tier": "developer"
    }
  }
}