{
  "id": "TalonLogs",
  "title": "Talon Insights",
  "publisher": "Talon Security",
  "descriptionMarkdown": "The Talon Security Logs connector allows you to easily connect your Talon events and audit logs with Microsoft Sentinel, to view dashboards, create custom alerts, and improve investigation.",
  "graphQueries": [
    {
      "metricName": "Total data received",
      "legend": "Talon_CL",
      "baseQuery": "Talon_CL"
    }
  ],
  "sampleQueries": [
    {
      "description": "Blocked user activities",
      "query": "Talon_CL | where action_s != \"blocked\""
    },
    {
      "description": "Failed login user ",
      "query": "Talon_CL | where  eventType_s == \"loginFailed\""
    },
    {
      "description": "Audit logs changes ",
      "query": "    Talon_CL | where  type_s == \"audit\""
    }
  ],
  "dataTypes": [
    {
      "name": "Talon_CL",
      "lastDataReceivedQuery": "Talon_CL | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
    }
  ],
  "connectivityCriterias": [
    {
      "type": "IsConnectedQuery",
      "value": [
        "Talon_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)"
      ]
    }
  ],
  "availability": {
    "status": 1,
    "isPreview": false
  },
  "permissions": {
    "resourceProvider": [
      {
        "provider": "Microsoft.OperationalInsights/workspaces",
        "permissionsDisplayText": "read and write permissions are required.",
        "providerDisplayName": "Workspace",
        "scope": "Workspace",
        "requiredPermissions": {
          "write": true,
          "read": true,
          "delete": true
        }
      },
      {
        "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
        "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
        "providerDisplayName": "Keys",
        "scope": "Workspace",
        "requiredPermissions": {
          "action": true
        }
      }
    ]
  },
  "instructionSteps": [
    {
      "title": "",
      "description": "Please note the values below and follow the instructions <a href='https://docs.console.talon-sec.com/en/articles/254-microsoft-sentinel-integration'>here</a> to connect your Talon Security events and audit logs with Microsoft Sentinel.",
      "instructions": [
        {
          "parameters": {
            "fillWith": [
              "WorkspaceId"
            ],
            "label": "Workspace ID"
          },
          "type": "CopyableLabel"
        },
        {
          "parameters": {
            "fillWith": [
              "PrimaryKey"
            ],
            "label": "Primary Key"
          },
          "type": "CopyableLabel"
        }
      ]
    }
  ],
  "metadata": {
    "id": "1d2958e9-6149-478b-bbc3-5cf65ad81d89",
    "version": "2.0.0",
    "kind": "dataConnector",
    "source": {
      "kind": "community"
    },
    "author": {
      "name": "Talon Security"
    },
    "support": {
      "name": "Talon Security",
      "link": "https://talon-sec.com/",
      "tier": "developer"
    }
  }
}