{
  "Name": "Cybereinforce",
  "Author": "Cybeurope - support@cybeurope.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Cybereinforce/Logo/cybereinforce-logo.png\" width=\"75px\" height=\"75px\">",
  "Description": "The [Cybereinforce Threat Enforcement](https://cybereinforce.com) solution for Microsoft Sentinel ingests browser-level URL blocking, threat-intelligence match, and audit/administration events via a scheduled Logic App and the Azure Monitor Logs Ingestion API. It includes a data connector with deployment instructions, a workbook for SOC operational visibility, and analytics rules covering URL enforcement, threat-intel matches, device risk patterns, and license/capacity health.",
  "WorkbookDescription": "Operational visibility for SOC teams: ingestion health, URL blocks, audit activity, and IOC synchronization.",
  "Workbooks": [
    "Workbooks/CybereinforceCTE.json"
  ],
  "Analytic Rules": [
    "Analytic Rules/BlockedURLAttempted.yaml",
    "Analytic Rules/CTIBlockedURLAttempted.yaml",
    "Analytic Rules/RiskyDeviceMultipleIOCURLHits.yaml",
    "Analytic Rules/SuddenBlockSpikeDetected.yaml",
    "Analytic Rules/DeviceRepeatedlyBlockedAcrossMultipleDays.yaml",
    "Analytic Rules/CompromisedDeviceSuspectedHighVolumeIOCBlocks.yaml",
    "Analytic Rules/PossibleCompanyWideC2CampaignMultipleDevicesSameDestination.yaml",
    "Analytic Rules/DeviceEnrolledButOnHold.yaml",
    "Analytic Rules/AdminLoginDetected.yaml",
    "Analytic Rules/EnrollmentTokenGenerated.yaml",
    "Analytic Rules/SecurityRuleChangedCreatedUpdatedDeleted.yaml",
    "Analytic Rules/LicenseExpiringSoon30Days.yaml",
    "Analytic Rules/LicenseExpiringCritically7Days.yaml",
    "Analytic Rules/DeviceLicenseCapacityHigh95.yaml",
    "Analytic Rules/DeviceLicenseCapacityCritical99.yaml",
    "Analytic Rules/RuleCapacityHigh90.yaml",
    "Analytic Rules/RuleCapacityCritical95.yaml",
    "Analytic Rules/StaleDeviceNoHeartbeatIn30Days.yaml"
  ],
  "Data Connectors": [
    "Data Connectors/cybereinforce_cte.json"
  ],
  "BasePath": "C:\\Users\\enisv\\Documents\\GitHub\\Azure-Sentinel\\Solutions\\Cybereinforce",
  "Version": "3.0.0",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": false,
  "Is1PConnector": false
}