{
    "id": "ESETPROTECT",
    "title": "[Deprecated] ESET PROTECT",
    "publisher": "ESET",
    "descriptionMarkdown": "This connector gathers all events generated by ESET software through the central management solution ESET PROTECT (formerly ESET Security Management Center). This includes Anti-Virus detections, Firewall detections but also more advanced EDR detections. For a complete list of events please refer to [the documentation](https://help.eset.com/protect_admin/latest/en-US/events-exported-to-json-format.html).",
    "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "ESETPROTECT",
            "baseQuery": "ESETPROTECT"
        }
    ],
    "sampleQueries": [
        {
            "description" : "ESET threat events",
            "query": "ESETPROTECT\n| where EventType == 'Threat_Event'\n| sort by TimeGenerated desc"
        },
        {
            "description" : "Top 10 detected threats",
            "query": "ESETPROTECT\n| where EventType == 'Threat_Event'\n| summarize ThreatCount = count() by tostring(ThreatName)\n| top 10 by ThreatCount"
        },
        {
            "description" : "ESET firewall events",
            "query": "ESETPROTECT\n| where EventType == 'FirewallAggregated_Event'\n| sort by TimeGenerated desc"
        },
        {
            "description" : "ESET threat events",
            "query": "ESETPROTECT\n| where EventType == 'Threat_Event'\n| sort by TimeGenerated desc"
        },
        {
            "description" : "ESET threat events from Real-time file system protection",
            "query": "ESETPROTECT\n| where EventType == 'Threat_Event'\n| where ScanId == 'Real-time file system protection'\n| sort by TimeGenerated desc"
        },
        {
            "description" : "Query ESET threat events from On-demand scanner",
            "query": "ESETPROTECT\n| where EventType == 'Threat_Event'\n| where ScanId == 'On-demand scanner'\n| sort by TimeGenerated desc"
        },
        {
            "description" : "Top hosts by number of threat events",
            "query": "ESETPROTECT\n| where EventType == 'Threat_Event'\n| summarize threat_events_count = count() by HostName\n| sort by threat_events_count desc"
        },
        {
            "description" : "ESET web sites filter",
            "query": "ESETPROTECT\n| where EventType == 'FilteredWebsites_Event'\n| sort by TimeGenerated desc"
        },
        {
            "description" : "ESET audit events",
            "query": "ESETPROTECT\n| where EventType == 'Audit_Event'\n| sort by TimeGenerated desc"
        }
    ],
    "dataTypes": [
        {
            "name": "Syslog (ESETPROTECT)",
            "lastDataReceivedQuery": "ESETPROTECT\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "ESETPROTECT\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": true
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "write permission is required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "delete": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "", 
            "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ESETPROTECT and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESETPROTECT/Parsers/ESETPROTECT.txt).The function usually takes 10-15 minutes to activate after solution installation/update.",
            "instructions": [ 
            ]    
        }, 
        {
            "title": "1. Install and onboard the agent for Linux",
            "description": "Typically, you should install the agent on a different computer from the one on which the logs are generated.\n\n>  Syslog logs are collected only from **Linux** agents.",
            "instructions": [
                {
                    "parameters": {
                        "title": "Choose where to install the agent:",
                        "instructionSteps": [
                            {
                                "title": "Install agent on Azure Linux Virtual Machine",
                                "description": "Select the machine to install the agent on and then click **Connect**.",
                                "instructions": [
                                    {
                                        "parameters": {
                                            "linkType": "InstallAgentOnLinuxVirtualMachine"
                                        },
                                        "type": "InstallAgent"
                                    }
                                ]
                            },
                            {
                                "title": "Install agent on a non-Azure Linux Machine",
                                "description": "Download the agent on the relevant machine and follow the instructions.",
                                "instructions": [
                                    {
                                        "parameters": {
                                            "linkType": "InstallAgentOnLinuxNonAzure"
                                        },
                                        "type": "InstallAgent"
                                    }
                                ]
                            }
                        ]
                    },
                    "type": "InstructionStepsGroup"
                }
            ]
        },
        {
            "title": "2. Configure the logs to be collected",
            "description": "Configure the facilities you want to collect and their severities.\n\n1.  Under workspace advanced settings **Configuration**, select **Data** and then **Syslog**.\n2.  Select **Apply below configuration to my machines** and select the facilities and severities. The default ESET PROTECT facility is **user**.\n3.  Click **Save**.",
            "instructions": [
                {
                    "parameters": {
                        "linkType": "OpenSyslogSettings"
                    },
                    "type": "InstallAgent"
                }
            ]
        },
        {
            "title": "3. Configure ESET PROTECT",
            "description": "Configure ESET PROTECT to send all events through Syslog.\n\n1.  Follow [these instructions](https://help.eset.com/protect_admin/latest/en-US/admin_server_settings_syslog.html) to configure syslog output. Make sure to select **BSD** as the format and **TCP** as the transport.\n\n2.  Follow [these instructions](https://help.eset.com/protect_admin/latest/en-US/admin_server_settings_export_to_syslog.html) to export all logs to syslog. Select **JSON** as the output format.\n\nNote:- Refer to the [documentation](https://learn.microsoft.com/en-us/azure/sentinel/connect-log-forwarder?tabs=rsyslog#security-considerations) for setting up the log forwarder for both local and cloud storage.",
            "instructions": [
                {
                    "parameters": {
                        "linkType": "OpenSyslogSettings"
                    },
                    "type": "InstallAgent"
                }
            ]
        }
    ],
    "metadata": {
        "id": "eca50d7c-3058-4c91-89cf-bd34c391b12e",
        "version": "1.0.0",
        "kind": "dataConnector",
        "source": {
            "kind": "community"
        },
        "author": {
            "name": "ESET Netherlands"
        },
        "support": {
            "tier": "developer",
            "name": "ESET Netherlands",
            "link":"https://techcenter.eset.nl/en/"
        }
    }
}