{
    "id": "Citrix",
    "title": "CITRIX SECURITY ANALYTICS",
    "publisher": "CITRIX",
    "descriptionMarkdown": "Citrix Analytics (Security) integration with Microsoft Sentinel helps you to export data analyzed for risky events from Citrix Analytics (Security) into Microsoft Sentinel environment. You can create custom dashboards, analyze data from other sources along with that from Citrix Analytics (Security) and create custom workflows using Logic Apps to monitor and mitigate security events.",
    "graphQueries": [
        {
            "metricName": "Total Risk Indicator Summary Events received",
            "legend": "CitrixAnalytics_indicatorSummary_CL",
            "baseQuery": "CitrixAnalytics_indicatorSummary_CL"
        },
        {
            "metricName": "Total Risk Indicator Detail Events received",
            "legend": "CitrixAnalytics_indicatorEventDetails_CL",
            "baseQuery": "CitrixAnalytics_indicatorSummary_CL"
        },
        {
            "metricName": "Total Risk Score Change Events received",
            "legend": "CitrixAnalytics_riskScoreChange_CL",
            "baseQuery": "CitrixAnalytics_indicatorSummary_CL"
        },
        {
            "metricName": "Total User Profile Events received",
            "legend": "CitrixAnalytics_userProfile_CL",
            "baseQuery": "CitrixAnalytics_userProfile_CL"
        }
    ],
    "sampleQueries": [
        {
            "description" : "High Risk Users",
            "query": "CitrixAnalytics_userProfile_CL\n  | where cur_riskscore_d > 64\n | where cur_riskscore_d < 100\n | summarize arg_max(TimeGenerated, cur_riskscore_d) by entity_id_s\n | count "
        },
        {
            "description" : "Medium Risk Users",
            "query": "CitrixAnalytics_userProfile_CL\n  | where cur_riskscore_d > 34\n | where cur_riskscore_d < 63\n | summarize arg_max(TimeGenerated, cur_riskscore_d) by entity_id_s\n | count "
        },
        {
            "description" : "Low Risk Users",
            "query": "CitrixAnalytics_userProfile_CL\n  | where cur_riskscore_d > 1\n | where cur_riskscore_d < 33\n | summarize arg_max(TimeGenerated, cur_riskscore_d) by entity_id_s\n | count "
        }
    ],
    "dataTypes": [
        {
            "name": "CitrixAnalytics_indicatorSummary_CL",
            "lastDataReceivedQuery": "CitrixAnalytics_indicatorSummary_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "CitrixAnalytics_indicatorEventDetails_CL",
            "lastDataReceivedQuery": "CitrixAnalytics_indicatorEventDetails_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "CitrixAnalytics_riskScoreChange_CL",
            "lastDataReceivedQuery": "CitrixAnalytics_riskScoreChange_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "CitrixAnalytics_userProfile_CL",
            "lastDataReceivedQuery": "CitrixAnalytics_userProfile_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "CitrixAnalytics_userProfile_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ],
        "customs": [
            {
                "name": "Licensing",
                "description": "Entitlements to Citrix Security Analytics in Citrix Cloud. Please review [Citrix Tool License Agreement.](https://aka.ms/sentinel-citrixanalyticslicense-readme)"
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "",
            "description": "To get access to this capability and the configuration steps on Citrix Analytics, please visit: [Connect Citrix to Microsoft Sentinel.](https://aka.ms/Sentinel-Citrix-Connector)​\n",
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                            "PrimaryKey"
                        ],
                        "label": "Primary Key"
                    },
                    "type": "CopyableLabel"
                }
            ]
        }
    ],
    "metadata": {
        "id": "54468043-90ac-4b79-8036-f5b7d0402aae",
        "version": "2.0.0",
        "kind": "dataConnector",
        "source": {
            "kind": "sourceRepository"
        },
        "author": {
            "name": "Citrix Systems Inc."
        },
        "support": {
            "tier": "developer",
            "name": "Citrix Systems Inc.",
            "email": "CAS-PM-Ext@citrix.com",
            "link":"https://www.citrix.com/support/"
        }
    }
}