{
  "name": "TrendAIVisionOneOAT",
  "apiVersion": "2024-01-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "TrendAIVisionOneOAT",
      "title": "TrendAI Vision One™ - OAT Detections (via Codeless Connector Framework)",
      "publisher": "TrendAI",
      "logo": "data:image/svg+xml;base64,PHN2ZyB2aWV3Qm94PSIwIDAgMjQgMjQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxwYXRoIGQ9Ik01LjI1MDEzIDkuNzM3MjdDNi4yMjk1NCAxMC43MzY3IDcuMTgzNzEgMTEuOTc0IDcuNDA1NTMgMTMuMjgwM0M3LjgwNDc2IDExLjA0MTIgMTAuODE3MiA3Ljk5MzM4IDEzLjA2NTcgNy42MDczMUMxMC44MzE4IDcuMjQ1MjkgNy43NjA0OSA0LjE3MjUxIDcuNDA1NyAxLjkyOTY5QzcuMDAzNDcgNC4xNDI2MiAzLjk3MDAzIDcuMjE3ODIgMS43NDUzNyA3LjYwNDAzQzMuMDQxOTIgNy44Mjc1OSA0LjI1NDcyIDguNzY0NjggNS4yNTAxMyA5LjczNzI3WiIgZmlsbD0iI0Q3MTkyMCIvPgo8cGF0aCBkPSJNMjMuMDgyMyAzLjMyNzY0QzIwLjc3MDcgMC41NjYwOTMgMTYuNDczMyAxLjQwOTQ5IDEzLjE1NCAyLjc1OTNDMTguNDIxOCAxLjA5NDcyIDIzLjI1MjQgMy4yODUwMiAyMC43MzE3IDkuNTQ2MTFDMTkuNDgzIDEyLjYyNDMgMTYuMzQyMSAxNS43NzI4IDEzLjMzMjIgMTcuNTUyNkMxMS43NDI4IDE4LjU4MDEgMTAuMDQyNyAxOS40NDU1IDguMTkwMDYgMTkuNzA0NkM1LjMzOTggMjAuMDk1NyAzLjYzMTY1IDE4LjYyNDIgNC4zNTY2MyAxNS42ODM3QzQuNTM5NDUgMTQuOTY1NyA0Ljg3MjI2IDE0LjI0MDggNS4yMDI2OCAxMy41MzU2QzQuNjU4NzIgMTIuMjQ0NiAzLjQ4ODM3IDEwLjkyMzkgMi4yMzIzOCAxMC41NTY5QzEuNTU1MzMgMTEuNTc1NiAxLjA2MjcyIDEyLjQ5NzcgMC41NjE0OTUgMTMuOTIzNUMtMC41NzI4MTIgMTYuOTg3OCAtMC4yMDIzMDIgMjEuNDg3MyAzLjY3MzY1IDIyLjQ2MDlDMTAuNzY2OCAyMy44NzQxIDIwLjM2MiAxNi4zMzQ2IDIzLjA5MzEgMTAuMDUxNUMyNC4yNjIgNy40MDM0NSAyNC4zNDU2IDQuOTU1ODggMjMuMDgyMyAzLjMyNzY0WiIgZmlsbD0iI0Q3MTkyMCIvPgo8L3N2Zz4K",
      "descriptionMarkdown": "The [TrendAI Vision One™](https://www.trendmicro.com/en_us/business/products/detection-response/xdr.html) OAT data connector ingests Observed Attack Techniques (OAT) detections from TrendAI Vision One™ into Microsoft Sentinel. Detections include full process trees, file hashes, network indicators, and MITRE ATT&CK mappings.",
      "graphQueries": [
        {
          "metricName": "Total OAT detections received",
          "legend": "TrendAI Vision One™ OAT Detections",
          "baseQuery": "TrendAI_XDR_OAT_V2_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get sample of OAT detections",
          "query": "TrendAI_XDR_OAT_V2_CL | take 10"
        },
        {
          "description": "High risk detections with process details",
          "query": "TrendAI_XDR_OAT_V2_CL | where detail_filterRiskLevel_s == 'high' | project TimeGenerated, detail_endpointHostName_s, detail_processCmd_s, detail_processFileHashSha256_s"
        }
      ],
      "dataTypes": [
        {
          "name": "TrendAI_XDR_OAT_V2_CL",
          "lastDataReceivedQuery": "TrendAI_XDR_OAT_V2_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": true,
              "action": false
            }
          }
        ]
      },
      "instructionSteps": [
        {
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "**⚠️ IMPORTANT: Token Rotation & Data Loss**\n>\n> When your API token expires or needs rotation, you must disconnect and reconnect this connector with the new token. **Events generated during the disconnected period will NOT be automatically collected.**\n>\n> **To minimize data loss:**\n> 1. Generate a new API token **before** the current one expires\n> 2. Minimize the disconnect/reconnect window (seconds, not hours)\n> 3. After reconnection, if needed, manually query the TrendAI Vision One API for events during the gap period using the [OAT Detections API](https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-oat-detections-list_001)"
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### 1. Retrieve your TrendAI Vision One™ API Token\n1. Log in to the TrendAI Vision One™ Console\n2. Navigate to **Administration → API Keys**\n3. Click **Add API Key**, select the **SIEM** role, and copy the token"
              }
            },
            {
              "type": "Dropdown",
              "parameters": {
                "label": "API Domain (Select your region)",
                "name": "apiDomain",
                "required": true,
                "isMultiSelect": false,
                "options": [
                  { "key": "api.xdr.trendmicro.com", "text": "United States (api.xdr.trendmicro.com)" },
                  { "key": "api.eu.xdr.trendmicro.com", "text": "Europe (api.eu.xdr.trendmicro.com)" },
                  { "key": "api.sg.xdr.trendmicro.com", "text": "Singapore (api.sg.xdr.trendmicro.com)" },
                  { "key": "api.xdr.trendmicro.co.jp", "text": "Japan (api.xdr.trendmicro.co.jp)" },
                  { "key": "api.au.xdr.trendmicro.com", "text": "Australia (api.au.xdr.trendmicro.com)" },
                  { "key": "api.in.xdr.trendmicro.com", "text": "India (api.in.xdr.trendmicro.com)" },
                  { "key": "api.mea.xdr.trendmicro.com", "text": "Middle East & Africa (api.mea.xdr.trendmicro.com)" },
                  { "key": "api.uk.xdr.trendmicro.com", "text": "United Kingdom (api.uk.xdr.trendmicro.com)" },
                  { "key": "api.ca.xdr.trendmicro.com", "text": "Canada (api.ca.xdr.trendmicro.com)" },
                  { "key": "api.za.xdr.trendmicro.com", "text": "South Africa (api.za.xdr.trendmicro.com)" }
                ],
                "placeholder": "Select your Vision One region"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "API Token",
                "placeholder": "Paste your TrendAI Vision One™ API token here",
                "type": "password",
                "name": "apiToken",
                "required": true
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "TMV1-Filter (Optional)",
                "placeholder": "(riskLevel eq 'high') and (endpointName eq 'my-computer')",
                "type": "text",
                "name": "oatFilter",
                "required": false
              }
            },
            {
              "type": "Dropdown",
              "parameters": {
                "label": "Exclude third-party OAT detections (productCode = 'tlc')",
                "name": "excludeThirdPartyOat",
                "required": true,
                "isMultiSelect": false,
                "options": [
                  { "key": "true", "text": "Yes - Exclude third-party detections (Recommended)" },
                  { "key": "false", "text": "No - Include all detections" }
                ],
                "placeholder": "Yes - Exclude third-party detections",
                "defaultValue": ["true"]
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "label": "toggle",
                "name": "toggle"
              }
            }
          ]
        }
      ],
      "isConnectivityCriteriasMatchSome": false
    }
  }
}