{
    "id": "GarrisonULTRARemoteLogs",
    "title": "Garrison ULTRA Remote Logs",
    "publisher": "Garrison",
    "descriptionMarkdown": "The [Garrison ULTRA](https://www.garrison.com/en/garrison-ultra-cloud-platform) Remote Logs connector allows you to ingest Garrison ULTRA Remote Logs into Microsoft Sentinel.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "Garrison_ULTRARemoteLogs_CL",
            "baseQuery": "Garrison_ULTRARemoteLogs_CL"
        }
    ],
    "sampleQueries": [
        {
            "description" : "Last 10 logs",
            "query": "Garrison_ULTRARemoteLogs_CL\n | top 10 by TimeGenerated desc"
        }
    ],
    "dataTypes": [
        {
            "name": "Garrison_ULTRARemoteLogs_CL",
            "lastDataReceivedQuery": "Garrison_ULTRARemoteLogs_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "Garrison_ULTRARemoteLogs_CL \n    |take 1\n   | project IsConnected = true  "
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions on the workspace are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
			{
				"provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
				"permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
				"providerDisplayName": "Keys",
				"scope": "Workspace",
				"requiredPermissions": {
					"action": true
				}
			}
        ],
        "customs": [
            {
                "name": "Garrison ULTRA",
                "description": "To use this data connector you must have an active [Garrison ULTRA](https://www.garrison.com/en/garrison-ultra-cloud-platform) license."
            }
        ]
    },
    "instructionSteps": [
		{
			"title": "Deployment - Azure Resource Manager (ARM) Template",
			"description": "These steps outline the automated deployment of the Garrison ULTRA Remote Logs data connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Frefs%2Fheads%2Fmaster%2FSolutions%2FGarrison%2520ULTRA%2FData%2520Connectors%2FGarrisonULTRARemoteLogs%2Fazuredeploy_DataCollectionResources.json) \t\t\t\n2. Provide the required details such as Resource Group, Microsoft Sentinel Workspace and ingestion configurations \n> **NOTE:** It is recommended to create a new Resource Group for deployment of these resources.\n3. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n4. Click **Purchase** to deploy."
		}
    ],
    "metadata": {
        "id": "919e2355-136a-4bbd-ade7-1956e5f61f83",
        "version": "1.0.0",
        "kind": "dataConnector",
        "source": {
            "kind": "solution",
            "name": "Garrison ULTRA Remote Logs"
        },
        "author": {
            "name": "Garrison"
        },
        "support": {
            "tier": "developer",
            "name": "Garrison"
        }
    }
}