{
    "id": "InfobloxSOCInsightsDataConnector_API",
    "title": "Infoblox IQ for Threat Defense Insight Data Connector via REST API",
    "publisher": "Infoblox",
    "descriptionMarkdown": "The Infoblox IQ for Threat Defense Insight Data Connector allows you to easily connect your Infoblox IQ for Threat Defense Insight data with Microsoft Sentinel. By connecting your logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log.",
    "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxInsight**](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Infoblox/Parsers/InfobloxInsight.yaml) which is deployed with the Microsoft Sentinel Solution.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "InfobloxInsight",
            "baseQuery": "InfobloxInsight_CL"
        }
    ],
    "sampleQueries": [
        {
            "description": "Return all Insights involving DNS Tunneling",
            "query": "InfobloxInsight_CL\n| where name == \"DNS Tunneling\""
        },
        {
            "description": "Return all Insights involving a configuration issue",
            "query": "InfobloxInsight_CL\n| where name has \"Configuration\" or tostring(threat_properties) has \"CONFIGURATION\""
        },
        {
            "description": "Return count of critical severity insights",
            "query": "InfobloxInsight_CL\n| where severity == \"Critical\"\n| summarize dcount(insight_id) by severity"
        },
        {
            "description": "Return count of Insights by status",
            "query": "InfobloxInsight_CL\n| summarize dcount(insight_id) by status"
        },
        {
            "description": "Return each Insight by name (threat type)",
            "query": "InfobloxInsight_CL\n| summarize dcount(insight_id) by name"
        }
    ],
    "dataTypes": [
        {
            "name": "InfobloxInsight_CL",
            "lastDataReceivedQuery": "InfobloxInsight_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "InfobloxInsight_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(3d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Parsers",
            "description": ">This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxInsight**](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Infoblox/Parsers/InfobloxInsight.yaml) which is deployed with the Microsoft Sentinel Solution."
        },
        {
            "title": "Infoblox IQ for Threat Defense",
            "description": ">This data connector assumes you have access to Infoblox IQ for Threat Defense. You can find more information about it [**here**](https://docs.infoblox.com/space/BloxOneThreatDefense/2448392230/Infoblox+IQ+for+Threat+Defense)."
        },
        {
            "title": "Follow the steps below to configure this data connector",
            "description": "",
            "instructions": [
                {
                    "parameters": {
                        "instructionSteps": [
                            {
                                "title": "1.  Generate an Infoblox API Key and copy it somewhere safe",
                                "description": "In the [Infoblox Cloud Services Portal](https://csp.infoblox.com/atlas/app/welcome), generate an API Key and copy it somewhere safe to use in the next step. You can find instructions on how to create API keys [**here**](https://docs.infoblox.com/space/BloxOneThreatDefense/230394187/How+Do+I+Create+an+API+Key%3F)."
                            },
                            {
                                "title": "2.  Configure the Infoblox-IQ-for-TD-Get-Insights-API playbook",
                                "description": "Create and configure the **Infoblox-IQ-for-TD-Get-Insights-API** playbook which is deployed with this solution. Enter your Infoblox API key and the Log Analytics Workspace Name in the appropriate parameters when prompted."
                            }
                        ]
                    },
                    "type": "InstructionStepsGroup"
                }
            ]
        }
    ]
}