{
    "id": "OfficeIRM",
    "title": "Microsoft 365 Insider Risk Management",
    "publisher": "Microsoft",
    "logo": {
        "type": 258,
        "options": null
    },
    "descriptionMarkdown": "Microsoft 365 Insider Risk Management is a compliance solution in Microsoft 365 that helps minimize internal risks by enabling you to detect, investigate, and act on malicious and inadvertent activities in your organization. Risk analysts in your organization can quickly take appropriate actions to make sure users are compliant with your organization's compliance standards.\n\nInsider risk policies allow you to:\n\n-   define the types of risks you want to identify and detect in your organization.\n-   decide on what actions to take in response, including escalating cases to Microsoft Advanced eDiscovery if needed.\n\nThis solution produces alerts that can be seen by Office customers in the Insider Risk Management solution in Microsoft 365 Compliance Center.\n[Learn More](https://aka.ms/OfficeIRMConnector) about Insider Risk Management.\n\nThese alerts can be imported into Microsoft Sentinel with this connector, allowing you to see, investigate, and respond to them in a broader organizational threat context. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2223721&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "SecurityAlert (Microsoft 365 Insider Risk Management)",
            "baseQuery": "SecurityAlert\n    | where ProductName == \"Microsoft 365 Insider Risk Management\"\n        | extend alertWasCustomized = bag_has_key(todynamic(ExtendedProperties), \"OriginalProductName\")\n        | where alertWasCustomized == false"
        }
    ],
    "sampleQueries": [
        {
            "description": "Security Alert Logs",
            "query": "SecurityAlert\n    | where ProductName == \"Microsoft 365 Insider Risk Management\"\n        | extend alertWasCustomized = bag_has_key(todynamic(ExtendedProperties), \"OriginalProductName\")\n        | where alertWasCustomized == false\n        | extend alertWasCustomized = bag_has_key(todynamic(ExtendedProperties), \"OriginalProductName\")\n        | where alertWasCustomized == false\n            | sort by TimeGenerated"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "MtpAlerts",
            "value": [
                "OfficeIRM"
            ]
        }
    ],
    "dataTypes": [
        {
            "name": "SecurityAlert (OfficeIRM)",
            "lastDataReceivedQuery": "SecurityAlert\n    | where ProductName == \"Microsoft 365 Insider Risk Management\"\n        | extend alertWasCustomized = bag_has_key(todynamic(ExtendedProperties), \"OriginalProductName\")\n        | where alertWasCustomized == false\n        | extend alertWasCustomized = bag_has_key(todynamic(ExtendedProperties), \"OriginalProductName\")\n        | where alertWasCustomized == false\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 2,
        "featureFlag": {
            "feature": "OfficeIRMConnector",
            "featureStates": {
                "1": 2,
                "2": 2,
                "3": 2,
                "4": 2,
                "5": 2
            }
        },
        "isPreview": true
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            }
        ],
        "tenant": [
            "GlobalAdmin",
            "SecurityAdmin"
        ],
        "licenses": [
            "OfficeIRM"
        ],
        "customs": [
            {
                "description": "Enable export of Insider Risk Management alerts to the Office 365 Management Activity API to receive alerts through the connector. [Learn More](https://aka.ms/OfficeIRMRequirement)"
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Connect Microsoft 365 Insider Risk Management alerts to Microsoft Sentinel",
            "description": "Connecting Microsoft 365 Insider Risk Management will cause your data that is collected by Microsoft 365 Insider Risk Management service to be stored and processed in the location that you have configured your Microsoft Sentinel workspace.",
            "instructions": [
                {
                    "parameters": {
                        "connectorKind": "OfficeIRM",
                        "title": "Microsoft 365 Insider Risk Management",
                        "enable": true
                    },
                    "type": "SentinelResourceProvider"
                }
            ]
        }
    ],
    "caseGenerationSteps": [
        {
            "instructions": [
                {
                    "parameters": {
                        "filterProduct": "Microsoft 365 Insider Risk Management"
                    },
                    "type": "FilterAlert"
                }
            ]
        }
    ]
}