{
    "id": "Theom",
    "title": "Theom",
    "publisher": "Theom",
    "descriptionMarkdown": "Theom Data Connector enables organizations to connect their Theom environment to Microsoft Sentinel. This solution enables users to receive alerts on data security risks, create and enrich incidents, check statistics and trigger SOAR playbooks in Microsoft Sentinel",
    "graphQueries": [
        {
            "metricName": "Total alerts received",
            "legend": "TheomAlerts_CL",
            "baseQuery": "TheomAlerts_CL"
        }
    ],
    "sampleQueries": [
        {
            "description": "All alerts in the past 24 hour",
            "query": "TheomAlerts_CL\n     | where TimeGenerated > ago(24h)\n  | sort by TimeGenerated\n  | limit 10"
        }
    ],
    "dataTypes": [
        {
            "name": "TheomAlerts_CL",
            "lastDataReceivedQuery": "TheomAlerts_CL\n | summarize Time = max(TimeGenerated)\n  | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "TheomAlerts_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(90d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "",
            "description": "1. In **Theom UI Console** click on **Manage -> Alerts** on the side bar.\n2. Select  **Sentinel** tab.\n3. Click on **Active** button to enable the configuration.\n4. Enter `Primary` key as `Authorization Token`\n5. Enter `Endpoint URL` as `https://<Workspace ID>.ods.opinsights.azure.com/api/logs?api-version=2016-04-01`\n6. Click on `SAVE SETTINGS`\n",
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                            "PrimaryKey"
                        ],
                        "label": "Primary Key"
                    },
                    "type": "CopyableLabel"
                }
            ]
        }
    ],
    "metadata": {
        "id": "6f2e8d0b-7ae8-4fd6-a471-8fda71dd8ae6",
        "version": "1.0.0",
        "kind": "dataConnector",
        "source": {
            "kind": "community"
        },
        "author": {
            "name": "Theom"
        },
        "support": {
            "name": "Theom Support",
            "email": "",
            "tier": "developer",
	    "link": "https://www.theom.ai"
        }
    }
}