{
  "name": "CloudGuardCCPDefinition",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "CloudGuardCCPDefinition",
      "title": "Check Point CloudGuard CNAPP Connector for Microsoft Sentinel",
      "publisher": "CheckPoint",
      "descriptionMarkdown": "The [CloudGuard](https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Overview/CloudGuard-CSPM-Introduction.htm?cshid=help_center_documentation) data connector enables the ingestion of security events from the CloudGuard API into Microsoft Sentinel™, using Microsoft Sentinel’s Codeless Connector Platform. The connector supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) which parses incoming security event data into custom columns. This pre-parsing process eliminates the need for query-time parsing, resulting in improved performance for data queries.",
      "graphQueriesTableName": "CloudGuard_SecurityEvents_CL",
      "graphQueries": [
        {
          "metricName": "Total data received",
          "legend": "CloudGuard Events",
          "baseQuery": "{{graphQueriesTableName}}"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get Sample of CloudGuard Events",
          "query": "{{graphQueriesTableName}}\n | take 10"
        },
        {
          "description": "Total Events by uuid",
          "query": "{{graphQueriesTableName}}\n | summarize count() by OriginalEventUid"
        }
      ],
      "dataTypes": [
        {
          "name": "{{graphQueriesTableName}}",
          "lastDataReceivedQuery": "{{graphQueriesTableName}}|summarize Time = max  (TimeGenerated)\n|where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true
            }
          }
        ],
        "customs": [
          {
            "name": "CloudGuard API Key",
            "description": "Refer to the instructions provided [here](https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Settings/Users-Roles.htm#add_service) to generate an API key."
          }
        ]
      },
      "instructionSteps": [
        {
          "description": "To enable the CloudGuard connector for Microsoft Sentinel, enter the required information below and select Connect.\n>",
          "instructions": [
            {
              "type": "Textbox",
              "parameters": {
                "label": "API Key ID",
                "placeholder": "api_key",
                "type": "text",
                "name": "api_key"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "API Key Secret",
                "placeholder": "api_secret",
                "type": "password",
                "name": "api_secret"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "CloudGuard Endpoint URL",
                "placeholder": "e.g. https://api.dome9.com",
                "type": "text",
                "name": "endpoint_url"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Filter",
                "placeholder": "Paste filter from CloudGuard",
                "type": "text",
                "name": "query_filter"
              }
            },
            {
              "parameters": {
                "label": "toggle",
                "name": "toggle"
              },
              "type": "ConnectionToggleButton"
            }
          ],
          "title": "Connect CloudGuard Security Events to Microsoft Sentinel"
        }
      ]
    }
  }
}