{
    "name": "IllumioInsightsDefinition",
    "apiVersion": "2022-09-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "IllumioInsightsDefinition",
            "title": "Illumio Insights",
            "descriptionMarkdown": "Illumio Insights Connector sends workload and security graph data from Illumio Insights into the Azure Microsoft Sentinel Data Lake, providing deep context for threat detection, lateral movement analysis, and real-time investigation.",
            "publisher": "Microsoft",
            "graphQueries": [
                {
                    "metricName": "Total incident logs received",
                    "legend": "Illumio Insights incident Logs",
                    "baseQuery": "IllumioInsights_CL"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Get Sample of Illumio Insights logs",
                    "query": "IllumioInsights_CL| take 10"
                }
            ],
            "dataTypes": [
                {
                    "name": "IllumioInsights_CL",
                    "lastDataReceivedQuery": "IllumioInsights_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors",
                    "value": null
                }
            ],
            "availability": {
                "status": 1,
                "isPreview": false
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "read": true,
                            "write": true,
                            "delete": true,
                            "action": false
                        }
                    }
                ]
            },
            "instructionSteps": [
                {
                    "instructions": [
                        {
                            "type": "Markdown",
                            "parameters": {
                                "content": "#### Configuration steps for the Illumio Insights Connector\n\n**Prerequisites**\n- Register and Login to Illumio Console with valid credentials\n- Purchase Illumio Insights or Start a free Trial for Illumio Insights\n\n**Step 1: Register the Service Account**\n1. Go to **Illumio Console → Access → Service Accounts**\n2. Create a service account for the tenant\n3. Once you create a service account, you will receive the client credentials\n4. Copy the **auth_username** (Illumio Insights API Key) and the **Secret** (API Secret)\n\n**Step 2: Add Client Credentials to Sentinel Account**\n- Add the API key and secret to Sentinel Account for tenant authentication\n- These credentials will be used to authenticate calls to the Illumio SaaS API\n\nPlease fill in the required fields below with the credentials obtained from the Illumio Console:"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Illumio Insights Api Key",
                                "placeholder": "api_XXXXXX",
                                "type": "password",
                                "name": "apiKey"
                            }
                        },
                        {
                        "type": "Textbox",
                        "parameters": {
                            "label": "Api Secret",
                            "placeholder": "API Secret",
                            "type": "password",
                            "name": "apiToken"
                          }
                        },
                     {
                            "parameters": {
                                "label": "Illumio Tenant Id",
                                "placeholder": "{IllumioTenantId - Optional}",
                                "type": "text",
                                "name": "illumioTenantId"
                            },
                            "type": "Textbox"
                        },                        
                        {
                            "parameters": {
                                "label": "toggle",
                                "name": "toggle"
                            },
                            "type": "ConnectionToggleButton"
                        }
                    ]
                }
            ],
            "isConnectivityCriteriasMatchSome": false
        }
    }
}