{
  "id": "CyeraDSPMCCF",
  "kind": "Customizable",
  "name": "CyeraDSPMCCF",
  "properties": {
    "connectorUiConfig": {
      "availability": {
        "isPreview": false,
        "status": 1
      },
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors",
          "value": null
        }
      ],
      "dataTypes": [
        {
          "lastDataReceivedQuery": "CyeraClassifications_CL\n       | where TimeGenerated > ago(48h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)",
          "name": "CyeraClassifications_CL"
        },
        {
          "lastDataReceivedQuery": "CyeraAssets_CL\n       | where TimeGenerated > ago(48h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)",
          "name": "CyeraAssets_CL"
        },
        {
          "lastDataReceivedQuery": "CyeraAssets_MS_CL\n       | where TimeGenerated > ago(48h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)",
          "name": "CyeraAssets_MS_CL"
        },
        {
          "lastDataReceivedQuery": "CyeraIssues_CL\n       | where TimeGenerated > ago(48h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)",
          "name": "CyeraIssues_CL"
        },
        {
          "lastDataReceivedQuery": "CyeraIdentities_CL\n       | where TimeGenerated > ago(48h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)",
          "name": "CyeraIdentities_CL"
        }
      ],
      "descriptionMarkdown": "The [Cyera DSPM](https://api.cyera.io/) data connector allows you to connect to your Cyera's DSPM tenant and ingesting Classifications, Assets, Issues, and Identity Resources/Definitions into Microsoft Sentinel. The data connector is built on Microsoft Sentinel's Codeless Connector Framework and uses the Cyera's API to fetch Cyera's [DSPM Telemetry](https://www.cyera.com/) once received can be correlated with security events creating custom columns so that queries don't need to parse it again, thus resulting in better performance.",
      "graphQueries": [
        {
          "baseQuery": "CyeraClassifications_CL",
          "legend": "Total Cyera Classification Records",
          "metricName": "cyera_functions_classifications"
        },
        {
          "baseQuery": "CyeraAssets_CL",
          "legend": "Total Cyera Assets Records",
          "metricName": "cyera_functions_assets"
        },
        {
          "baseQuery": "CyeraAssets_MS_CL",
          "legend": "Total Cyera Asset MS Records",
          "metricName": "cyera_functions_assets_ms"
        },
        {
          "baseQuery": "CyeraIssues_CL",
          "legend": "Total Cyera Issue Records",
          "metricName": "cyera_functions_issues"
        },
        {
          "baseQuery": "CyeraIdentities_CL",
          "legend": "Total Cyera Identities Records",
          "metricName": "cyera_functions_identities"
        }
      ],
      "sampleQueries": [
                        {
                            "description": "Get Sample of Cyera DSPM Classification Definitions",
                            "query": "CyeraClassifications_CL | take 10"
                        },
                        {
                            "description": "Get Sample of Cyera DSPM Datastore Assets",
                            "query": "CyeraAssets_CL | take 10"
                        },
                        {
                            "description": "Get Sample of Cyera DSPM Table Assets",
                            "query": "CyeraAssets_MS_CL | take 10"
                        },
                        {
                            "description": "Get Sample of Cyera DSPM Issues Identified",
                            "query": "CyeraIssues_CL | take 10"
                        },
                        {
                            "description": "Get Sample of Cyera DSPM Identities",
                            "query": "CyeraIdentities_CL | take 10"
                        }
                    ],
      "id": "CyeraDSPMCCF",
      "instructionSteps": [
        {
          "description": "Connect to your Cyera DSPM tenenant via Personal Access Tokens",
          "instructions": [
            {
              "parameters": {
                "label": "Cyera Personal Access Token Client ID",
                "name": "clientId",
                "placeholder": "client_id",
                "type": "text"
              },
              "type": "Textbox"
            },
            {
              "parameters": {
                "label": "Cyera Personal Access Token Secret Key",
                "name": "clientSecret",
                "placeholder": "secret_key",
                "type": "password"
              },
              "type": "Textbox"
            },
            {
              "parameters": {
                "connectLabel": "Connect",
                "name": "toggle"
              },
              "type": "ConnectionToggleButton"
            }
          ],
          "title": "Cyera DSPM Authentication"
        }
      ],
      "isConnectivityCriteriasMatchSome": false,
      "logo": "https://raw.githubusercontent.com/joshua-acklin-cyera/Azure-Sentinel/refs/heads/cyera-dspm/Logos/cyera_icon.svg",
      "resources": [
          {
          "type": "Microsoft.Insights/dataCollectionEndpoints",
          "apiVersion": "2022-06-01",
          "name": "CyeraDSPMDataCollectionEndpoint",
          "location": "[parameters('workspace-location')]",
          "properties": {
              "networkAcls": {
                  "publicNetworkAccess": "Enabled"
              }
          }
        },
        {
          "name": "CyeraDSPMPollerClassifications",
          "apiVersion": "2023-02-01-preview",
          "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
          "kind": "RestApiPoller",
          "properties": {
            "connectorDefinitionName": "CyeraDSPMCCF",
            "dcrConfig": {
              "streamName": "Custom-CyeraClassifications_SRC"
            },
            "dataType": "CyeraClassifications_CL",
            "auth": {
              "type": "JwtToken",
              "userName": {
                "key": "clientId",
                "value": "{{clientId}}"
              },
              "password": {
                "key": "secret",
                "value": "{{clientSecret}}"
              },
              "TokenEndpoint": "https://api.cyera.io/v1/login",
              "Headers": {
                "Accept": "application/json",
                "User-Agent": "cyera-sentinel-connector/1.6.1"
              },
              "IsCredentialsInHeaders": false,
              "IsJsonRequest": true,
              "JwtTokenJsonPath": "$.jwt",
              "RequestTimeoutInSeconds": 30
            },
            "request": {
              "apiEndpoint": "https://api.cyera.io/v1/classifications",
              "httpMethod": "GET",
              "queryParameters": {
                "offset": 0,
                "limit": 100
              },
              "queryWindowInMin": 5,
              "queryTimeFormat": "yyyy-MM-ddTHH:mm:ss.000000+00:00",
              "rateLimitQps": 1,
              "retryCount": 3,
              "timeoutInSeconds": 120,
              "headers": {
                "Accept": "application/json",
                "User-Agent": "cyera-sentinel-connector/1.6.1"
              }
            },
            "response": {
              "eventsJsonPaths": [
                "$.results"
              ],
              "format": "json"
            }
          }
        },
        {
          "name": "CyeraDSPMPollerAssets",
          "apiVersion": "2023-02-01-preview",
          "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
          "kind": "RestApiPoller",
          "properties": {
            "connectorDefinitionName": "CyeraDSPMCCF",
            "dcrConfig": {
              "streamName": "Custom-CyeraAssets_SRC"
            },
            "dataType": "CyeraAssets_CL",
            "auth": {
              "type": "JwtToken",
              "userName": {
                "key": "clientId",
                "value": "{{clientId}}"
              },
              "password": {
                "key": "secret",
                "value": "{{clientSecret}}"
              },
              "TokenEndpoint": "https://api.cyera.io/v1/login",
              "Headers": {
                "Accept": "application/json",
                "User-Agent": "cyera-sentinel-connector/1.6.1"
              },
              "IsCredentialsInHeaders": false,
              "IsJsonRequest": true,
              "JwtTokenJsonPath": "$.jwt",
              "RequestTimeoutInSeconds": 30
            },
            "request": {
              "apiEndpoint": "https://api.cyera.io/v2/datastores",
              "httpMethod": "GET",
              "queryParameters": {
                "offset": 0,
                "limit": 1000
              },
              "queryWindowInMin": 5,
              "queryTimeFormat": "yyyy-MM-ddTHH:mm:ss.000000+00:00",
              "rateLimitQps": 1,
              "retryCount": 3,
              "timeoutInSeconds": 120,
              "headers": {
                "Accept": "application/json",
                "User-Agent": "cyera-sentinel-connector/1.6.1"
              }
            },
            "response": {
              "eventsJsonPaths": [
                "$.results"
              ],
              "format": "json"
            }
          }
        },
        {
          "name": "CyeraDSPMPollerIssues",
          "apiVersion": "2023-02-01-preview",
          "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
          "kind": "RestApiPoller",
          "properties": {
            "connectorDefinitionName": "CyeraDSPMCCF",
            "dcrConfig": {
              "streamName": "Custom-CyeraIssues_SRC"
            },
            "dataType": "CyeraIssues_CL",
            "auth": {
              "type": "JwtToken",
              "userName": {
                "key": "clientId",
                "value": "{{clientId}}"
              },
              "password": {
                "key": "secret",
                "value": "{{clientSecret}}"
              },
              "TokenEndpoint": "https://api.cyera.io/v1/login",
              "Headers": {
                "Accept": "application/json",
                "User-Agent": "cyera-sentinel-connector/1.6.1"
              },
              "IsCredentialsInHeaders": false,
              "IsJsonRequest": true,
              "JwtTokenJsonPath": "$.jwt",
              "RequestTimeoutInSeconds": 30
            },
            "request": {
              "apiEndpoint": "https://api.cyera.io/v3/issues",
              "httpMethod": "GET",
              "queryParameters": {
                "offset": 0,
                "limit": 100
              },
              "queryWindowInMin": 5,
              "queryTimeFormat": "yyyy-MM-ddTHH:mm:ss.000000+00:00",
              "rateLimitQps": 1,
              "retryCount": 3,
              "timeoutInSeconds": 120,
              "headers": {
                "Accept": "application/json",
                "User-Agent": "cyera-sentinel-connector/1.6.1"
              }
            },
            "response": {
              "eventsJsonPaths": [
                "$.results"
              ],
              "format": "json"
            }
          }
        },
        {
          "name": "CyeraDSPMPollerIdentities",
          "apiVersion": "2023-02-01-preview",
          "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
          "kind": "RestApiPoller",
          "properties": {
            "connectorDefinitionName": "CyeraDSPMCCF",
            "dcrConfig": {
              "streamName": "Custom-CyeraIdentities_SRC"
            },
            "dataType": "CyeraIdentities_CL",
            "auth": {
              "type": "JwtToken",
              "userName": {
                "key": "clientId",
                "value": "{{clientId}}"
              },
              "password": {
                "key": "secret",
                "value": "{{clientSecret}}"
              },
              "TokenEndpoint": "https://api.cyera.io/v1/login",
              "Headers": {
                "Accept": "application/json",
                "User-Agent": "cyera-sentinel-connector/1.6.1"
              },
              "IsCredentialsInHeaders": false,
              "IsJsonRequest": true,
              "JwtTokenJsonPath": "$.jwt",
              "RequestTimeoutInSeconds": 30
            },
            "request": {
              "apiEndpoint": "https://api.cyera.io/v1/identities",
              "httpMethod": "GET",
              "queryParameters": {
                "offset": 0,
                "limit": 100
              },
              "queryWindowInMin": 5,
              "queryTimeFormat": "yyyy-MM-ddTHH:mm:ss.000000+00:00",
              "rateLimitQps": 1,
              "retryCount": 3,
              "timeoutInSeconds": 120,
              "headers": {
                "Accept": "application/json",
                "User-Agent": "cyera-sentinel-connector/1.6.1"
              }
            },
            "response": {
              "eventsJsonPaths": [
                "$.results"
              ],
              "format": "json"
            }
          }
        }
      ],
      "permissions": {
        "resourceProvider": [
          {
            "permissionsDisplayText": "Read and Write permissions are required.",
            "provider": "Microsoft.OperationalInsights/workspaces",
            "providerDisplayName": "Workspace",
            "requiredPermissions": {
              "action": false,
              "delete": true,
              "read": true,
              "write": true
            },
            "scope": "Workspace"
          }
        ]
      },
      "publisher": "Cyera Inc",
      "title": "Cyera DSPM Microsoft Sentinel Data Connector"
    },
    "createdTimeUtc": "2025-10-31T15:13:26.2481931Z",
    "lastModifiedUtc": "2025-10-31T15:13:26.2481931Z"
  },
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions"
}