{
  "name": "CyrenThreatIntel",
  "apiVersion": "2025-09-01",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "CyrenThreatIntel",
      "connectorId": "CyrenThreatIntel",
      "title": "Cyren Threat Intelligence",
      "publisher": "Cyren",
      "descriptionMarkdown": "Ingest IP reputation and malware URL indicators from Cyren using the Common Connector Framework (CCF).",
      "graphQueriesTableName": "Cyren_Indicators_CL",
      "graphQueries": [
        {
          "metricName": "Total Cyren indicators received",
          "legend": "Cyren Indicators",
          "baseQuery": "Cyren_Indicators_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "High-risk indicators (last 7 days)",
          "query": "Cyren_Indicators_CL | where TimeGenerated >= ago(7d) | where risk_d >= 70 | project TimeGenerated, indicator_s, type_s, risk_d, category_s, source_s"
        }
      ],
      "dataTypes": [
        {
          "name": "Cyren_Indicators_CL",
          "lastDataReceivedQuery": "Cyren_Indicators_CL | summarize Time = max(TimeGenerated) | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "status": "Available",
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and write permissions required",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": false
            }
          }
        ],
        "customs": [
          {
            "name": "Cyren JWT Tokens",
            "description": "JWT tokens stored in Azure Key Vault or provided at deployment time."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect Cyren Threat Intelligence",
          "description": "To enable the Cyren Threat Intelligence connector, provide your JWT tokens below and click Connect.\n\n>For enhanced security, you can enable Key Vault integration to store and retrieve the JWT tokens.",
          "instructions": [
            {
              "type": "Textbox",
              "parameters": {
                "label": "IP Reputation JWT Token",
                "placeholder": "Enter your IP Reputation feed JWT token",
                "type": "password",
                "name": "cyrenIpReputationToken"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Malware URL JWT Token",
                "placeholder": "Enter your Malware URL feed JWT token",
                "type": "password",
                "name": "cyrenMalwareUrlToken"
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "connectLabel": "Connect",
                "name": "connect"
              }
            }
          ]
        }
      ]
    }
  }
}