{
  "name": "D3SOARConnectorDefinition",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "D3SOARConnectorDefinition",
      "title": "D3 Smart SOAR Incidents",
      "publisher": "D3 Security",
      "descriptionMarkdown": "The D3 Smart SOAR data connector pulls incidents from D3 Smart SOAR into Microsoft Sentinel using the D3 codeless REST API command endpoint.",
      "graphQueries": [
        {
          "metricName": "Total incidents received",
          "legend": "D3 Smart SOAR Incidents",
          "baseQuery": "D3SOARIncidents_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get sample D3 Smart SOAR incidents",
          "query": "D3SOARIncidents_CL | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "D3SOARIncidents_CL",
          "lastDataReceivedQuery": "D3SOARIncidents_CL | where TimeGenerated > ago(12h) | summarize Time=max(TimeGenerated) | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": true,
              "action": false
            }
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect D3 Smart SOAR to Microsoft Sentinel",
          "description": "**Prerequisite:** In D3 Smart SOAR, navigate to **Organization Management → Sites**, select the site you are connecting, and set its **Time Zone** to **(UTC+00:00) Coordinated Universal Time**. This ensures incident timestamps are correctly aligned with Microsoft Sentinel.\n\nEnter your D3 Smart SOAR connection details below. Incidents will be polled every 5 minutes and written to the **D3SOARIncidents_CL** table.\n\n**Server URL** — The base URL of your D3 Smart SOAR deployment, up to and including the site path. Do not include the API path.\n\n**Username** — Your D3 Smart SOAR account username (same as your portal login).\n\n**Site** — The D3 Smart SOAR site name your account belongs to (e.g. `Security Operations`).\n\n**D3 JWT** — A JSON Web Token issued by D3 Smart SOAR for API authentication.",
          "instructions": [
            {
              "type": "Textbox",
              "parameters": {
                "label": "Server URL",
                "placeholder": "https://poc.bemimo.com/ce_site/VSOC",
                "type": "text",
                "name": "BaseUrl"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Username",
                "placeholder": "admin",
                "type": "text",
                "name": "Username"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Site",
                "placeholder": "Security Operations",
                "type": "text",
                "name": "Site"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "D3 JWT",
                "placeholder": "ey...",
                "type": "password",
                "name": "D3Jwt"
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "connectLabel": "Connect",
                "name": "connect"
              }
            }
          ]
        }
      ]
    }
  }
}