Onapsis.json

{
    "id": "Onapsis",
    "title": "Onapsis Defend Integration",
    "publisher": "Onapsis Platform",
    "logo": "Onapsis.svg",
    "descriptionMarkdown": "Onapsis Defend Integration is aimed at forwarding alerts and logs collected and detected by Onapsis Platform into Microsoft Sentinel SIEM",
    "graphQueriesTableName": "Onapsis_Defend_CL",
    "graphQueries": [
        {
            "metricName": "Total events received",
            "legend": "Onapsis_SID",
            "baseQuery": "{{graphQueriesTableName}} | project TimeGenerated, Onapsis_SID= sid"
        }
    ],
    "sampleQueries": [
        {
            "description": "Get Sample Events",
            "query": "{{graphQueriesTableName}}\n | take 10"
        }
    ],
    "dataTypes": [
        {
            "name": "{{graphQueriesTableName}}",
            "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | where name_s == \"no data test\" | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        }
    ],
    "connectivityCriteria": [
        {
            "type": "HasDataConnectors"
        }
    ],
    "availability": {
        "isPreview": true
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "Read and Write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ],
        "customs": [
            {
                "name": "Microsoft Entra",
                "description": "Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher."
            },
            {
                "name": "Microsoft Azure",
                "description": "Permission to assign Monitoring Metrics Publisher role on data collection rules. Typically requires Azure RBAC Owner or User Access Administrator role."
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "1. Create ARM Resources and Provide the Required Permissions",
            "description": "We will create data collection rule (DCR) and data collection endpoint (DCE) resources. We will also create a Microsoft Entra app registration and assign the required permissions to it.",
            "instructions": [
                {
                    "type": "Markdown",
                    "parameters": {
                        "content": "#### Automated deployment of Azure resources\nClicking on \"Deploy push connector resources\" will trigger the creation of DCR and DCE resources.\nIt will then create a Microsoft Entra app registration with client secret and grant permissions on the DCR. This setup enables data to be sent securely to the DCR using a OAuth v2 client credentials."
                    }
                },
                {
                    "parameters": {
                        "label": "Deploy push connector resources",
                        "applicationDisplayName": "Onapsis Defend Integration push to Microsoft Sentinel"
                    },
                    "type": "DeployPushConnectorButton_test"
                }
            ]
        },
        {
            "title": "2. Maintain the data collection endpoint details and authentication info in Onapsis Defend Integration",
            "description": "Share the data collection endpoint URL and authentication info with the Onapsis Defend Integration administrator to configure the Onapsis Defend Integration to send data to the data collection endpoint.",
            "instructions": [
                {
                    "parameters": {
                        "label": "Use this value to configure as Tenant ID in the LogIngestionAPI credential.",
                        "fillWith": [
                            "TenantId"
                        ]
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "label": "Entra Application ID",
                        "fillWith": [
                            "ApplicationId"
                        ],
                        "placeholder": "Deploy push connector to get the Application ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "label": "Entra Application Secret",
                        "fillWith": [
                            "ApplicationSecret"
                        ],
                        "placeholder": "Deploy push connector to get the Application Secret"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "label": "Use this value to configure the LogsIngestionURL parameter when deploying the IFlow.",
                        "fillWith": [
                            "DataCollectionEndpoint"
                        ],
                        "placeholder": "Deploy push connector to get the DCE URI"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "label": "DCR Immutable ID",
                        "fillWith": [
                            "DataCollectionRuleId"
                        ],
                        "placeholder": "Deploy push connector to get the DCR ID"
                    },
                    "type": "CopyableLabel"
                }
            ]
        }
    ],
    "metadata": {
        "id": "Onapsis",
        "version": "1.0.0",
        "kind": "dataConnector",
        "source": {
            "kind": "solution",
            "name": "Onapsis Defend Integration for Microsoft Sentinel"
        },
        "author": {
            "name": "Onapsis Platform",
            "email": "support@onapsis.com"
        },
        "support": {
            "tier": "Partner",
            "name": "Onapsis Platform",
            "email": "support@onapsis.com",
            "link": "https://onapsis.com/support/"
        }
    }
}