{
  "id": "CiscoAsaAma",
  "title": "Cisco ASA/FTD via AMA",
  "publisher": "Microsoft",
  "descriptionMarkdown": "The Cisco ASA firewall connector allows you to easily connect your Cisco ASA logs with Microsoft Sentinel, to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization's network and improves your security operation capabilities.",
  "graphQueries": [
    {
      "metricName": "Total data received",
      "legend": "CommonSecurityLog",
       "baseQuery": "CommonSecurityLog\n| where DeviceVendor == \"Cisco\"\n| where DeviceProduct in (\"ASA\", \"FTD\")\n| extend ingestion_time = bin(TimeGenerated, 1m)\n| join kind=inner (Heartbeat \n| where Category == \"Azure Monitor Agent\" \n| project TimeGenerated, _ResourceId\n| summarize by _ResourceId, ingestion_time = bin(TimeGenerated, 1m)) on _ResourceId, ingestion_time\n| project-away  _ResourceId1, ingestion_time, ingestion_time1"
    }
  ],
  "sampleQueries": [
    {
      "description": "All logs",
       "query": "CommonSecurityLog\n| where DeviceVendor == \"Cisco\"\n| where DeviceProduct in (\"ASA\", \"FTD\")\n| extend ingestion_time = bin(TimeGenerated, 1m)\n| join kind=inner (Heartbeat \n| where Category == \"Azure Monitor Agent\" \n| project TimeGenerated, _ResourceId\n| summarize by _ResourceId, ingestion_time = bin(TimeGenerated, 1m)) on _ResourceId, ingestion_time\n| project-away  _ResourceId1, ingestion_time, ingestion_time1 \n            | sort by TimeGenerated"
    }
  ],
  "connectivityCriterias": [
    {
      "type": "CiscoAsaAMA"
    }
  ],
  "dataTypes": [
    {
      "name": "CommonSecurityLog",
      "lastDataReceivedQuery": "CommonSecurityLog\n| where DeviceVendor == \"Cisco\"\n| where DeviceProduct in (\"ASA\", \"FTD\")\n| extend ingestion_time = bin(TimeGenerated, 1m)\n| join kind=inner (Heartbeat \n| where Category == \"Azure Monitor Agent\" \n| project TimeGenerated, _ResourceId\n| summarize by _ResourceId, ingestion_time = bin(TimeGenerated, 1m)) on _ResourceId, ingestion_time\n| project-away  _ResourceId1, ingestion_time, ingestion_time1 \n             | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
    }
  ],
  "availability": {
    "status": 1
  },
  "permissions": {
    "resourceProvider": [
      {
        "provider": "Microsoft.OperationalInsights/workspaces/datasources",
        "permissionsDisplayText": "read and write permissions.",
        "providerDisplayName": "Workspace data sources",
        "scope": "Workspace",
        "requiredPermissions": {
          "read": true,
          "write": true
        }
      }
    ],
    "customs": [
      {
        "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)"
      }
    ]
  },
  "instructionSteps": [
    {
      "title": "Enable data collection rule​",
      "description": "> Cisco ASA/FTD event logs are collected only from **Linux** agents.",
      "instructions": [
        {
          "type": "CiscoAsaAma"
        }
      ]
    },
    {
      "instructions": [
        {
          "parameters": {
            "linkType": "OpenCreateDataCollectionRule",
            "dataCollectionRuleType": 4
          },
          "type": "InstallAgent"
        }
      ]
    },
    {
      "title": "Run the following command to install and apply the Cisco ASA/FTD collector:",
      "instructions": [
        {
          "parameters": {
            "fillWith": [
              "WorkspaceId",
              "PrimaryKey"
            ],
            "label": "",
            "value": "sudo wget -O Forwarder_AMA_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Forwarder_AMA_installer.py&&sudo python Forwarder_AMA_installer.py"
          },
          "type": "CopyableLabel"
        }
      ]
    }
  ]
}