{
    "id": "CynerioSecurityEvents",
    "title": "Cynerio Security Events",
    "publisher": "Cynerio",
    "descriptionMarkdown": "The [Cynerio](https://www.cynerio.com/) connector allows you to easily connect your Cynerio Security Events with Microsoft Sentinel, to view IDS Events. This gives you more insight into your organization network security posture and improves your security operation capabilities. ",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "CynerioEvent_CL",
            "baseQuery": "CynerioEvent_CL"
        }
    ],
    "sampleQueries": [
        {
            "description" : "SSH Connections events in the last 24 hours",
            "query": "CynerioEvent_CL\n | where date_t > ago(24h) and title_s == 'SSH Connection'"
        }
    ],
    "dataTypes": [
        {
            "name": "CynerioEvent_CL",
            "lastDataReceivedQuery": "CynerioEvent_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "CynerioEvent_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": true
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Configure and connect Cynerio",
            "description": "Cynerio can integrate with and export events directly to Microsoft Sentinel via Azure Server. Follow these steps to establish integration:\n\n1. In the Cynerio console, go to Settings > Integrations tab (default), and click on the **+Add Integration** button at the top right.\n\n2. Scroll down to the **SIEM** section.\n\n3. On the Microsoft Sentinel card, click the Connect button.\n\n4. The Integration Details window opens. Use the parameters below to fill out the form and set up the connection.",
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                            "PrimaryKey"
                        ],
                        "label": "Primary Key"
                    },
                    "type": "CopyableLabel"
                }
            ]
        }
    ],
    "metadata": {
        "id": "Unique Identifier (GUID) used to identify dependencies and content from solutions or community.",
        "version": "1.0.0",
        "kind": "dataConnector",
        "source": {
            "kind": "solution",
            "name": "Cynerio"
        },
        "author": {
            "name": "Cynerio"
        },
        "support": {
            "tier": "Type of support for content item: microsoft | developer | community",
            "name": "Name of support contact or company",
            "email": "Optional: Email of support contact",
            "link":"Optional: Link for support help, like to support page to open a ticket etc"
        }
    }
}