{
    "id": "ZeroFoxCTIDataConnector",
    "title": "ZeroFox CTI",
    "publisher": "ZeroFox",
    "descriptionMarkdown": "The ZeroFox CTI data connectors provide the capability to ingest the different [ZeroFox](https://www.zerofox.com/threat-intelligence/) cyber threat intelligence alerts into Microsoft Sentinel.",
    "graphQueries": [
        {
            "metricName": "ZeroFox CTI Advanced Dark Web Logs",
            "legend": "ZeroFox_CTI_advanced_dark_web_CL",
            "baseQuery": "ZeroFox_CTI_advanced_dark_web_CL"
        },
        {
            "metricName": "ZeroFox CTI Botnet Logs",
            "baseQuery": "ZeroFox_CTI_botnet_CL"
        },
        {
            "metricName": "ZeroFox CTI Breaches Logs",
            "legend": "ZeroFox_CTI_breaches_CL",
            "baseQuery": "ZeroFox_CTI_breaches_CL"
        },
        {
            "metricName": "ZeroFox CTI C2 Domains Logs",
            "legend": "ZeroFox_CTI_C2_CL",
            "baseQuery": "ZeroFox_CTI_C2_CL"
        },
        {
            "metricName": "ZeroFox CTI Compromised Credentials Logs",
            "legend": "ZeroFox_CTI_compromised_credentials_CL",
            "baseQuery": "ZeroFox_CTI_compromised_credentials_CL"
        },
        {
            "metricName": "ZeroFox CTI Credit Cards Logs",
            "legend": "ZeroFox_CTI_credit_cards_CL",
            "baseQuery": "ZeroFox_CTI_credit_cards_CL"
        },
        {
            "metricName": "ZeroFox CTI Dark Web Logs",
            "legend": "ZeroFox_CTI_dark_web_CL",
            "baseQuery": "ZeroFox_CTI_dark_web_CL"
        },
        {
            "metricName": "ZeroFox CTI Discord Logs",
            "legend": "ZeroFox_CTI_discord_CL",
            "baseQuery": "ZeroFox_CTI_discord_CL"
        },
        {
            "metricName": "ZeroFox CTI Disruption Logs",
            "legend": "ZeroFox_CTI_disruption_CL",
            "baseQuery": "ZeroFox_CTI_disruption_CL"
        },
        {
            "metricName": "ZeroFox CTI Email Addresses Logs",
            "legend": "ZeroFox_CTI_email_addresses_CL",
            "baseQuery": "ZeroFox_CTI_email_addresses_CL"
        },
        {
            "metricName": "ZeroFox CTI Exploits Logs",
            "legend": "ZeroFox_CTI_exploits_CL",
            "baseQuery": "ZeroFox_CTI_exploits_CL"
        },
        {
            "metricName": "ZeroFox CTI IRC Logs",
            "legend": "ZeroFox_CTI_irc_CL",
            "baseQuery": "ZeroFox_CTI_irc_CL"
        },
        {
            "metricName": "ZeroFox CTI Malware Logs",
            "legend": "ZeroFox_CTI_malware_CL",
            "baseQuery": "ZeroFox_CTI_malware_CL"
        },
        {
            "metricName": "ZeroFox CTI National Ids Logs",
            "legend": "ZeroFox_CTI_national_ids_CL",
            "baseQuery": "ZeroFox_CTI_national_ids_CL"
        },
        {
            "metricName": "ZeroFox CTI Phishing Logs",
            "legend": "ZeroFox_CTI_phishing_CL",
            "baseQuery": "ZeroFox_CTI_phishing_CL"
        },
        {
            "metricName": "ZeroFox CTI Phone Numbers Logs",
            "legend": "ZeroFox_CTI_phone_numbers_CL",
            "baseQuery": "ZeroFox_CTI_phone_numbers_CL"
        },
        {
            "metricName": "ZeroFox CTI Ransomware Logs",
            "legend": "ZeroFox_CTI_ransomware_CL",
            "baseQuery": "ZeroFox_CTI_ransomware_CL"
        },
        {
            "metricName": "ZeroFox CTI Telegram Logs",
            "legend": "ZeroFox_CTI_telegram_CL",
            "baseQuery": "ZeroFox_CTI_telegram_CL"
        },
        {
            "metricName": "ZeroFox CTI Threat Actors Logs",
            "legend": "ZeroFox_CTI_threat_actors_CL",
            "baseQuery": "ZeroFox_CTI_threat_actors_CL"
        },
        {
            "metricName": "ZeroFox CTI Vulnerabilities Logs",
            "legend": "ZeroFox_CTI_vulnerabilities_CL",
            "baseQuery": "ZeroFox_CTI_vulnerabilities_CL"
        }     
        
    ],
    "sampleQueries": [
        {
            "description": "ZeroFox CTI C2-domains Logs",
            "query": "ZeroFox_CTI_C2_CL\n | sort by TimeGenerated desc"
        },
        {
            "description": "ZeroFox CTI Email Addresses Logs",
            "query": "ZeroFox_CTI_email_addresses_CL\n | sort by TimeGenerated desc"
        },
        {
            "description": "ZeroFox CTI Malware Logs",
            "query": "ZeroFox_CTI_malware_CL\n | sort by TimeGenerated desc"
        }

        
    ],
    "dataTypes": [
        {
            "name": "ZeroFox_CTI_advanced_dark_web_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_advanced_dark_web_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZeroFox_CTI_botnet_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_botnet_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZeroFox_CTI_breaches_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_breaches_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZeroFox_CTI_C2_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_C2_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZeroFox_CTI_compromised_credentials_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_compromised_credentials_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZeroFox_CTI_credit_cards_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_credit_cards_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZeroFox_CTI_dark_web_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_dark_web_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZeroFox_CTI_discord_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_discord_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZeroFox_CTI_disruption_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_disruption_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZeroFox_CTI_email_addresses_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_email_addresses_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZeroFox_CTI_exploits_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_exploits_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZeroFox_CTI_irc_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_irc_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZeroFox_CTI_malware_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_malware_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZeroFox_CTI_national_ids_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_national_ids_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZeroFox_CTI_phishing_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_phishing_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZeroFox_CTI_phone_numbers_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_phone_numbers_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZeroFox_CTI_ransomware_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_ransomware_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZeroFox_CTI_telegram_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_telegram_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZeroFox_CTI_threat_actors_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_threat_actors_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ZeroFox_CTI_vulnerabilities_CL",
            "lastDataReceivedQuery": "ZeroFox_CTI_vulnerabilities_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
        
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "ZeroFox_CTI_advanced_dark_web_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "ZeroFox_CTI_botnet_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "ZeroFox_CTI_breaches_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "ZeroFox_CTI_C2_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "ZeroFox_CTI_compromised_credentials_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "ZeroFox_CTI_credit_cards_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "ZeroFox_CTI_dark_web_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "ZeroFox_CTI_discord_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "ZeroFox_CTI_disruption_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "ZeroFox_CTI_email_addresses_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "ZeroFox_CTI_exploits_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "ZeroFox_CTI_irc_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "ZeroFox_CTI_malware_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "ZeroFox_CTI_national_ids_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "ZeroFox_CTI_phishing_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "ZeroFox_CTI_phone_numbers_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "ZeroFox_CTI_ransomware_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "ZeroFox_CTI_telegram_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "ZeroFox_CTI_threat_actors_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)",
                "ZeroFox_CTI_vulnerabilities_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(1d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions on the workspace are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ],
        "customs": [
            {
                "name": "Microsoft.Web/sites permissions",
                "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)."
            },
            {
                "name": "ZeroFox API Credentials/permissions",
                "description": "**ZeroFox Username**, **ZeroFox Personal Access Token** are required for ZeroFox CTI REST API."
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "",
            "description": ">**NOTE:** This connector uses Azure Functions to connect to the ZeroFox CTI REST API to pull logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details."
        },
        {
            "title": "",
            "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App."
        },
        {
            "title": "",
            "description": "**STEP 1 - Retrieval of ZeroFox credentials:**\n\n Follow these instructions for set up logging and obtain credentials. \n1. [Log into ZeroFox's website.](https://cloud.zerofox.com/login) using your username and password \n2 - Click into the Settings button and go to the Data Connectors Section. \n3 - Select the API DATA FEEDS tab and head to the bottom of the page, select <<Reset>> in the API Information box, to obtain a Personal Access Token to be used along with your username."
        },
        {
            "title": "",
            "description": "**STEP 2 - Deploy the Azure Function data connectors using the Azure Resource Manager template: **\n\n>**IMPORTANT:** Before deploying the ZeroFox CTI data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following), readily available.",
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                            "PrimaryKey"
                        ],
                        "label": "Primary Key"
                    },
                    "type": "CopyableLabel"
                }
            ]
        },
        {
            "title": "Preparing resources for deployment.",
            "description": "1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-zerofox-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group**, Log analytics Workspace and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **ZeroFox Username**, **ZeroFox Personal Access Token**\n4.\n5. Click **Review + Create** to deploy."
        }
    ]
}