{
    "id": "SevcoDevices",
    "title": "Sevco Platform - Devices",
    "publisher": "Sevco Security",
    "descriptionMarkdown": "The Sevco Platform - Devices connector allows you to easily connect your Sevco Device Assets with Microsoft Sentinel, to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization’s assets and improves your security operation capabilities.\n\n[For more information >​](https://docs.sev.co/docs/microsoft-sentinel-inventory)",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "Sevco Devices CL",
            "baseQuery": "Sevco_Devices_CL"
        }
    ],
    "sampleQueries": [
        {
            "description": "Summarize by local IP address",
            "query": "Sevco_Devices_CL​\n\n| summarize arg_max(TimeGenerated, *) by asset_id_g\n\n| extend IPs = parse_json(asset_attributes_ips_s), asset_attributes_hostname_s\n\n| mv-expand IPs\n\n| summarize count() by tostring(IPs)"
        },
        {
            "description": "Summarize by public IP address",
            "query": "Sevco_Devices_CL\n\n| summarize arg_max(TimeGenerated, *) by asset_id_g\n\n| extend source = parse_json(asset_source_ids_s), asset_attributes_hostname_s\n\n| mv-expand source\n\n| summarize count() by tostring(source)"
        },
        {
            "description": "Most recent inventory",
            "query": "Sevco_Devices_CL​\n\n| summarize arg_max(TimeGenerated, *) by asset_id_g\n\n"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "Sevco_Devices_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
            ]
        }
    ],
    "dataTypes": [
        {
            "name": "Sevco_Devices_CL",
            "lastDataReceivedQuery": "Sevco_Devices_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": true
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Configure and connect to Sevco",
            "description": "The Sevco Platform can integrate with and export assets directly to Microsoft Sentinel..​\n\n1.  Go to [Sevco - Microsoft Sentinel Integration](https://docs.sev.co/docs/microsoft-sentinel-inventory), and follow the instructions, using the parameters below to set up the connection:.\n\n",
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                            "PrimaryKey"
                        ],
                        "label": "Primary Key"
                    },
                    "type": "CopyableLabel"
                }
            ]
        }
    ]
}