{
    "id": "ARGOSCloudSecurity",
    "title": "ARGOS Cloud Security",
    "publisher": "ARGOS Cloud Security",
    "descriptionMarkdown": "The ARGOS Cloud Security integration for Microsoft Sentinel allows you to have all your important cloud security events in one place. This enables you to easily create dashboards, alerts, and correlate events across multiple systems. Overall this will improve your organization's security posture and security incident response.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "ARGOS_CL",
            "baseQuery": "ARGOS_CL"
        }
    ],
    "sampleQueries": [
        {
            "description" : "Display all exploitable ARGOS Detections.",
            "query": "ARGOS_CL\n | where exploitable_b"
        },
        {
            "description" : "Display all open, exploitable ARGOS Detections on Azure.",
            "query": "ARGOS_CL\n | where exploitable_b and cloud_s == 'azure' and status_s == 'open'"
        },
        {
            "description" : "Display all open, exploitable ARGOS Detections on Azure.",
            "query": "ARGOS_CL\n | where exploitable_b and cloud_s == 'azure' and status_s == 'open'\n | sort by TimeGenerated"
        },
        {
            "description" : "Render a time chart with all open ARGOS Detections on Azure.",
            "query": "ARGOS_CL\n | where cloud_s == 'azure' and status_s == 'open'\n | summarize count() by TimeGenerated\n | render timechart"
        },
        {
            "description": "Display Top 10, open, exploitable ARGOS Detections on Azure.",
            "query": "ARGOS_CL\n | where cloud_s == 'azure' and status_s == 'open' and exploitable_b\n | summarize count() by ruleId_s\n | top 10 by count_"
        }
    ],
    "dataTypes": [
        {
            "name": "ARGOS_CL",
            "lastDataReceivedQuery": "ARGOS_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "ARGOS_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "1. Subscribe to ARGOS",
            "description": "Ensure you already own an ARGOS Subscription. If not, browse to [ARGOS Cloud Security](https://argos-security.io) and sign up to ARGOS.\n\nAlternatively, you can also purchase ARGOS via the [Azure Marketplace](https://azuremarketplace.microsoft.com/en-au/marketplace/apps/argoscloudsecurity1605618416175.argoscloudsecurity?tab=Overview)."
        },
        {
            "title": "2. Configure Sentinel integration from ARGOS",
            "description": "Configure ARGOS to forward any new detections to your Sentinel workspace by providing ARGOS with your Workspace ID and Primary Key.\n\nThere is **no need to deploy any custom infrastructure**.\n\nEnter the information into the [ARGOS Sentinel](https://app.argos-security.io/account/sentinel) configuration page.\n\nNew detections will automatically be forwarded.\n\n[Learn more about the integration](https://www.argos-security.io/resources#integrations)",
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                            "PrimaryKey"
                        ],
                        "label": "Primary Key"
                    },
                    "type": "CopyableLabel"
                }
            ]
        }
    ],
    "metadata": {
        "id": "e14ac0f5-771f-492e-87fd-cbdca9c2b16e",
        "version": "1.0.0",
        "kind": "dataConnector",
        "source": {
            "kind": "community"
        },
        "author": {
            "name": "ARGOS Cloud Security"
        },
        "support": {
            "tier": "developer",
            "name": "ARGOS Cloud Security",
            "email": "support@argos-security.io",
            "link":"https://www.argos-security.io/contact-us/#"
        }
    }
}