Merge pull request #11280 from eset-enterprise-integration/eset-prote…

…ct-platform-solution-3.0.0

ESET Protect Platform solution 3.0.0.

.script/tests/KqlvalidationsTests/CustomTables/IntegrationTable_CL.json

@@ -0,0 +1,61 @@
+{
+    "Name": "IntegrationTable_CL",
+    "Properties": [
+        {
+          "name": "TimeGenerated",
+          "type": "datetime"
+        },
+        {
+          "name": "typeName",
+          "type": "string"
+        },
+        {
+          "name": "objectName",
+          "type": "string"
+        },
+        {
+          "name": "networkCommunication",
+          "type": "dynamic"
+        },
+        {
+          "name": "customUuid",
+          "type": "string"
+        },
+        {
+          "name": "objectTypeName",
+          "type": "string"
+        },
+        {
+          "name": "occurTime",
+          "type": "string"
+        },
+        {
+          "name": "displayName",
+          "type": "string"
+        },
+        {
+          "name": "responses",
+          "type": "dynamic"
+        },
+        {
+          "name": "objectHashSha1",
+          "type": "string"
+        },
+        {
+          "name": "severityLevel",
+          "type": "string"
+        },
+        {
+          "name": "category",
+          "type": "string"
+        },
+        {
+          "name": "objectUrl",
+          "type": "string"
+        },
+        {
+          "name": "context",
+          "type": "dynamic"
+        }
+    ]
+}

Solutions/ESET Protect Platform/Data Connectors/ESETProtectPlatform_API_FunctionApp.json

@@ -0,0 +1,80 @@
+{
+    "id": "ESETProtectPlatform",
+    "title": "ESET Protect Platform",
+    "publisher": "ESET",
+    "descriptionMarkdown": "The ESET Protect Platform data connector enables users to inject detections data from [ESET Protect Platform](https://www.eset.com/int/business/protect-platform/) using the provided [Integration REST API](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ESET%20Protect%20Platform/Data%20Connectors). Integration REST API runs as scheduled Azure Function App.",
+    "graphQueries": [{"metricName": "Total data received", "legend": "IntegrationTable_CL", "baseQuery": "IntegrationTable_CL"}],
+    "sampleQueries": [
+        {"description": "All table records sorted by time", "query": "IntegrationTable_CL\n| sort by TimeGenerated desc"}
+    ],
+    "dataTypes": [
+        {
+            "name": "IntegrationTable_CL",
+            "lastDataReceivedQuery": "IntegrationTable_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+        }
+    ],
+    "connectivityCriterias": [
+        {
+            "type": "IsConnectedQuery",
+            "value": [
+                "IntegrationTable_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
+            ]
+        }
+    ],
+    "availability": {"status": 1, "isPreview": false},
+    "permissions": {
+        "resourceProvider": [
+            {
+                "provider": "Microsoft.OperationalInsights/workspaces",
+                "permissionsDisplayText": "read and write permissions on the workspace are required.",
+                "providerDisplayName": "Workspace",
+                "scope": "Workspace",
+                "requiredPermissions": {
+                    "write": true,
+                    "read": true,
+                    "delete": true
+                }
+            },
+			{
+				"provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
+				"permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
+				"providerDisplayName": "Keys",
+				"scope": "Workspace",
+				"requiredPermissions": {
+					"action": true
+				}
+			}
+        ],
+        "customs": [
+            {
+                "name": "Microsoft.Web/sites permissions",
+                "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)."
+            },
+            {
+                "name": "Permission to register an application in Microsoft Entra ID",
+                "description": "Sufficient permissions to register an application with your Microsoft Entra tenant are required."
+            },
+            {
+                "name": "Permission to assign a role to the registered application",
+                "description": "Permission to assign the Monitoring Metrics Publisher role to the registered application in Microsoft Entra ID is required."
+            }
+        ]
+    },
+    "instructionSteps": [
+        {
+            "description": ">**NOTE:** The ESET Protect Platform data connector uses Azure Functions to connect to the ESET Protect Platform via Eset Connect API to pull detections logs into Microsoft Sentinel. This process might result in additional data ingestion costs. See details on the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/)."
+        },
+        {
+            "title": "Step 1 -  Create an API user",
+            "description": "Use this [instruction](https://help.eset.com/eset_connect/en-US/create_api_user_account.html) to create an ESET Connect API User account with **Login** and **Password**."
+        },
+        {
+            "title": "Step 2 -  Create a registered application",
+            "description": "Create a Microsoft Entra ID registered application by following the steps in the [Register a new application instruction.](https://learn.microsoft.com/en-us/azure/healthcare-apis/register-application#register-a-new-application)"
+        },
+        {
+            "title": "Step 3 - Deploy the ESET Protect Platform data connector using the Azure Resource Manager (ARM) template",
+            "description": "\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-EsetProtectionPlatform-azuredeploy)\n\n2. Select the name of the **Log Analytics workspace** associated with your Microsoft Sentinel. Select the same **Resource Group** as the Resource Group of the Log Analytics workspace.\n\n3. Type the parameters of the registered application in Microsoft Entra ID: **Azure Client ID**, **Azure Client Secret**, **Azure Tenant ID**, **Object ID**. You can find the **Object ID** on Azure Portal by following this path \n> Microsoft Entra ID -> Manage (on the left-side menu) -> Enterprise applications -> Object ID column (the value next to your registered application name).\n\n4. Provide the ESET Connect API user account **Login** and **Password** obtained in **Step 1**."
+        }
+    ]
+}