{
    "name": "DTAttacksV3CCPDefinition",
    "apiVersion": "2022-09-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "DTAttacksV3CCPDefinition",
            "title": "Dynatrace Attacks V3",
            "publisher": "Dynatrace",
            "descriptionMarkdown": "This connector uses the [Dynatrace DQL Storage Query API](https://docs.dynatrace.com/docs/platform/grail/dynatrace-query-language) to ingest detected application security attacks into Microsoft Sentinel Log Analytics.",
            "additionalRequirementBanner": "This data connector depends on a parser based on Kusto Function to work as expected which is deployed with the Microsoft Sentinel Solution.",
            "graphQueriesTableName": "DynatraceAttacksV3_CL",
            "graphQueries": [
                {
                    "metricName": "Total data received",
                    "legend": "Dynatrace Attack Events",
                    "baseQuery": "{{graphQueriesTableName}}"
                }
            ],
            "sampleQueries": [
                {
                    "description": "All Attack Events",
                    "query": "DynatraceAttacks\n| summarize arg_max(TimeGenerated, *) by AttackId\n| take 10"
                },
                {
                    "description": "Critical Attack Events",
                    "query": "DynatraceAttacks\n| where Severity == \"High\"\n| summarize arg_max(TimeGenerated, *) by AttackId\n| take 10"
                },
                {
                    "description": "SQL Injection Attacks",
                    "query": "DynatraceAttacks\n| where AttackType == \"SQL_INJECTION\"\n| summarize arg_max(TimeGenerated, *) by AttackId\n| take 10"
                },
                {
                    "description": "Attacks by Source IP",
                    "query": "DynatraceAttacks\n| summarize arg_max(TimeGenerated, *) by AttackId\n| summarize count() by sourceIp\n| sort by count_ desc\n| take 10"
                },
                {
                    "description": "Attacks by Country",
                    "query": "DynatraceAttacksV3_CL\n| summarize arg_max(TimeGenerated, *) by event_id\n| summarize count() by actor_geo_country_name\n| sort by count_ desc\n| take 10"
                }
            ],
            "dataTypes": [
                {
                    "name": "{{graphQueriesTableName}}",
                    "lastDataReceivedQuery": "{{graphQueriesTableName}}\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors",
                    "value": null
                }
            ],
            "availability": {
                "status": 1,
                "isPreview": true
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "read and write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "write": true,
                            "read": true,
                            "delete": true
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "Dynatrace SaaS environment (ex. xyz.apps.dynatrace.com)",
                        "description": "You need a Dynatrace SaaS environment (xxx.apps.dynatrace.com) with [Application Security](https://www.dynatrace.com/platform/application-security/) enabled. Classic Dynatrace environments (xxx.live.dynatrace.com) are not supported."
                    },
                    {
                        "name": "Dynatrace Platform Token",
                        "description": "You need a Dynatrace platform token with the ***storage:buckets:read*** and ***storage:security.events:read*** scopes. See [Dynatrace platform tokens](https://docs.dynatrace.com/docs/manage/identity-access-management/access-tokens-and-oauth-clients/platform-tokens) for instructions."
                    }
                ]
            },
            "instructionSteps": [
                {
                    "title": "Dynatrace Attack Events to Microsoft Sentinel",
                    "description": "Configure and Enable Dynatrace [Application Security](https://www.dynatrace.com/platform/application-security/). \n 1. Create a platform token with the ***storage:buckets:read*** and ***storage:security.events:read*** scopes following [these instructions](https://docs.dynatrace.com/docs/manage/identity-access-management/access-tokens-and-oauth-clients/platform-tokens). \n 2. Use your Dynatrace SaaS environment URL in the format ***xyz.apps.dynatrace.com***.",
                    "instructions": [
                        {
                            "parameters": {
                                "enable": "true",
                                "type": "text",
                                "label": "Dynatrace environment (ex. xyz.apps.dynatrace.com)",
                                "placeholder": "{{dynatraceEnvironmentUrl}}",
                                "name": "dynatraceEnvironmentUrl"
                            },
                            "type": "Textbox"
                        },
                        {
                            "parameters": {
                                "enable": "true",
                                "type": "password",
                                "label": "Dynatrace Platform Token",
                                "placeholder": "{{dynatracePlatformToken}}",
                                "name": "dynatracePlatformToken"
                            },
                            "type": "Textbox"
                        },
                        {
                            "type": "ConnectionToggleButton",
                            "parameters": {
                                "connectLabel": "connect",
                                "name": "toggle"
                            }
                        }
                    ]
                }
            ],
            "metadata": {
                "version": "1.0.0",
                "kind": "dataConnector"
            }
        }
    }
}