{
    "name": "DTRunVulnCCPDefinition",
    "apiVersion": "2022-09-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "DTRunVulnCCPDefinition",
            "title": "Dynatrace Runtime Vulnerabilities V2",
            "publisher": "Dynatrace",
            "descriptionMarkdown": "This connector uses the [Dynatrace Security Problem REST API](https://docs.dynatrace.com/docs/dynatrace-api/environment-api/application-security/vulnerabilities/get-vulnerabilities) to ingest detected runtime vulnerabilities into Microsoft Sentinel Log Analytics.",
            "additionalRequirementBanner": "This data connector depends on a parser based on Kusto Function to work as expected which is deployed with the Microsoft Sentinel Solution.",
            "graphQueriesTableName": "DynatraceSecurityProblemsV2_CL",
            "graphQueries": [
                {
                    "metricName": "Total data received",
                    "legend": "Dynatrace Vulnerabilities Events",
                    "baseQuery": "{{graphQueriesTableName}}"
                }
            ],
            "sampleQueries": [
                {
                    "description": "All Vulnerability Events",
                    "query": "DynatraceSecurityProblems\n| summarize  arg_max(LastUpdatedTimeStamp, *) by SecurityProblemId\n|  take 10"
                },
                {
                    "description": "All Third-Party Vulnerability Events",
                    "query": "DynatraceSecurityProblems\n| where VulnerabilityType == \"THIRD_PARTY\"\n| summarize  arg_max(LastUpdatedTimeStamp, *) by SecurityProblemId\n|  take 10"
                },
                {
                    "description": "All Code-level Vulnerability Events",
                    "query": "DynatraceSecurityProblems\n| where VulnerabilityType == \"CODE_LEVEL\"\n| summarize  arg_max(LastUpdatedTimeStamp, *) by SecurityProblemId\n|  take 10"
                },
                {
                    "description": "All Runtime Vulnerability Events",
                    "query": "DynatraceSecurityProblems\n| where VulnerabilityType == \"RUNTIME\"\n| summarize  arg_max(LastUpdatedTimeStamp, *) by SecurityProblemId\n|  take 10"
                },
                {
                    "description": "Critical Vulnerability Events",
                    "query": "DynatraceSecurityProblems\n| where DAVISRiskLevel == \"CRITICAL\"\n| summarize  arg_max(LastUpdatedTimeStamp, *) by SecurityProblemId\n| take 10"
                },
                {
                    "description": "High Vulnerability Events",
                    "query": "DynatraceSecurityProblems\n| where DAVISRiskLevel == \"HIGH\"\n| summarize  arg_max(LastUpdatedTimeStamp, *) by SecurityProblemId\n| take 10"
                },
                {
                    "description": "Count Vulnerability Events by Technology and Vulnerability",
                    "query": "DynatraceSecurityProblems\n| summarize  arg_max(LastUpdatedTimeStamp, *) by SecurityProblemId\n| summarize count() by Technology, ExternalVulnerabilityId\n| take 10"
                }
            ],
            "dataTypes": [
                {
                    "name": "{{graphQueriesTableName}}",
                    "lastDataReceivedQuery": "{{graphQueriesTableName}}\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors",
                    "value": null
                }
            ],
            "availability": {
                "status": 1,
                "isPreview": false
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "read and write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "write": true,
                            "read": true,
                            "delete": true
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "Dynatrace tenant (ex. xyz.dynatrace.com)",
                        "description": "You need a valid Dynatrace tenant with [Application Security](https://www.dynatrace.com/platform/application-security/) enabled, learn more about the [Dynatrace platform](https://www.dynatrace.com/)."
                    },
                    {
                        "name": "Dynatrace Access Token",
                        "description": "You need a Dynatrace Access Token, the token should have ***Read security problems*** (securityProblems.read) scope."
                    }
                ]
            },
            "instructionSteps": [
                {
                    "title": "Dynatrace Vulnerabilities Events to Microsoft Sentinel",
                    "description": "Configure and Enable Dynatrace [Application Security](https://www.dynatrace.com/platform/application-security/). \n Follow [these instructions](https://docs.dynatrace.com/docs/shortlink/token#create-api-token) to generate an access token.",
                    "instructions": [
                        {
                            "parameters": {
                                "enable": "true",
                                "type": "text",
                                "label": "Dynatrace tenant (ex. xyz.dynatrace.com)",
                                "placeholder": "{{dynatraceEnvironmentUrl}}",
                                "name": "dynatraceEnvironmentUrl"
                            },
                            "type": "Textbox"
                        },
                        {
                            "parameters": {
                                "enable": "true",
                                "type": "password",
                                "label": "Dynatrace Access Token",
                                "placeholder": "{{dynatraceAccessToken}}",
                                "name": "dynatraceAccessToken"
                            },
                            "type": "Textbox"
                        },
                        {
                            "type": "ConnectionToggleButton",
                            "parameters": {
                                "connectLabel": "connect",
                                "name": "toggle"
                            }
                        }
                    ]
                }
            ],
            "metadata": {
                "version": "1.0.2",
                "kind": "dataConnector"
            }
        }
    }
}