{
  "name": "ZoomReportsConnector",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "ZoomReportsConnector",
      "title": "Zoom Reports Connector (via Codeless Connector Framework)",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The [Zoom Reports](https://developers.zoom.us/docs/api/) data connector enables you to ingest Zoom Reports data into Microsoft Sentinel through the Zoom REST API v2, allowing you to monitor and audit Zoom usage across your organization. This connector uses server-to-server OAuth account credentials for authentication and supports ingestion of multiple report types including Daily Usage Reports for meeting statistics and usage metrics, User Reports for active/inactive user host information, Telephony Reports for telephony usage statistics, Cloud Recording Usage Reports for cloud storage and recording usage, Operation Logs for administrative operations and audit trail, and Activity Logs for user sign-in/sign-out activities. Each report type is collected in a separate polling configuration with automatic pagination support using NextPageToken. The data connector is built on Microsoft Sentinel Codeless Connector Platform and supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) for optimized query performance.",
      "graphQueriesTableName": "ZoomV2_CL",
      "graphQueries": [
        {
          "metricName": "Total Records",
          "legend": "Zoom Reports",
          "baseQuery": "{{graphQueriesTableName}}"
        }
      ],
      "sampleQueries": [
        {
          "description": "All Zoom Reports",
          "query": "{{graphQueriesTableName}}\n| sort by TimeGenerated desc"
        },
        {
          "description": "Sample Zoom Reports",
          "query": "{{graphQueriesTableName}}\n| take 10"
        },
        {
          "description": "Reports by type",
          "query": "{{graphQueriesTableName}}\n| summarize count() by EventType"
        }
      ],
      "dataTypes": [
        {
          "name": "ZoomV2_CL",
          "lastDataReceivedQuery": "ZoomV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "isPreview": false,
        "status": 1
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true,
              "action": false
            }
          }
        ],
        "customs": [
          {
            "name": "Zoom API access",
            "description": "Access to Zoom REST API v2 with account credentials"
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "1. Zoom Configuration",
          "description": "Configure Server-to-Server OAuth App and gather credentials",
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "## Step 1: Set up Zoom Server-to-Server OAuth App, follow [Create an app](https://developers.zoom.us/docs/internal-apps/create/). \r\nPlease make sure to add Reports related scopes to your app:\r\n- report:read:list_users:admin\r\n- report:read:cloud_recording:admin\r\n- report:read:daily_usage:admin\r\n- report:read:operation_logs:admin\r\n- report:read:telephone:admin\r\n- report:read:user_activities:admin\r\n\r\nFor more information, see [Zoom Server-to-Server OAuth Documentation](https://developers.zoom.us/docs/internal-apps/) and [Reports APIs](https://developers.zoom.us/docs/api/rest/reference/zoom-api/methods/#tag/Reports).\r\n## Step 2: Get Your App Credentials\r\n\r\nFind your app credentials (Account ID, Client ID and Client Secret) on your `Personal app management` page on the Zoom App Marketplace\r\n\r\n## Security Notes\r\n\r\n- Store Account ID, Client ID and Client Secret securely\r\n- Regularly rotate credentials for enhanced security"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Client ID",
                "placeholder": "Zoom App Client ID",
                "type": "text",
                "name": "ClientId",
                "validations": {
                  "required": true
                }
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Client Secret",
                "placeholder": "Zoom App Client Secret",
                "type": "password",
                "name": "ClientSecret",
                "validations": {
                  "required": true
                }
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Account ID",
                "placeholder": "Your Zoom Account ID",
                "type": "text",
                "name": "AccountId",
                "validations": {
                  "required": true
                }
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Token Base URL",
                "placeholder": "https://zoom.us/oauth/token",
                "type": "text",
                "name": "TokenBaseUrl",
                "validations": {
                  "required": true
                }
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "API Base URL",
                "placeholder": "https://api.zoom.us/v2",
                "type": "text",
                "name": "ApiBaseUrl",
                "validations": {
                  "required": true
                }
              }
            }
          ]
        },
        {
          "title": "2. Connect",
          "description": "Enable the Zoom Reports connector",
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "### Activate the Connector\r\n\r\nReview your Zoom App credentials found in Step 2, then enable the connector to begin collecting Zoom Reports data.\r\n\r\n### Monitoring\r\n\r\nCheck data arrival using these queries:\r\n\r\n**Check all report types:**\r\n```kusto\r\nZoomV2_CL\r\n| where TimeGenerated > ago(30m)\r\n| summarize Records = count() by EventType\r\n```\r\n\r\n**Check specific report type:**\r\n```kusto\r\nZoomV2_CL\r\n| where EventType == 'dates'\r\n| where TimeGenerated > ago(1h)\r\n| limit 10\r\n```\r\n\r\n**Monitor connector health:**\r\n```kusto\r\nZoomV2_CL\r\n| where TimeGenerated > ago(24h)\r\n| summarize LastRecord = max(TimeGenerated), RecordCount = count() by EventType\r\n| order by LastRecord desc\r\n```"
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "connectLabel": "Connect",
                "disconnectLabel": "Disconnect",
                "name": "toggle"
              }
            }
          ]
        }
      ]
    }
  }
}