{
  "name": "Auth0ConnectorCCPDefinition",
  "apiVersion": "2025-07-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "Auth0ConnectorCCPDefinition",
      "title": "Auth0 Logs (via Codeless Connector Framework)",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The [Auth0](https://auth0.com/docs/api/management/v2/logs/get-logs) data connector ingests tenant log events from the Auth0 Management API into Microsoft Sentinel. Built on the Codeless Connector Framework, it supports connecting multiple Auth0 hosts and tags each record with its Auth0 domain.",
      "graphQueries": [
        {
          "metricName": "Total logs received",
          "legend": "Auth0 Logs",
          "baseQuery": "Auth0Logs_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "All Auth0 logs",
          "query": "Auth0Logs_CL\n| sort by TimeGenerated desc"
        },
        {
          "description": "Get sample of 10 Auth0 logs",
          "query": "Auth0Logs_CL\n| take 10"
        },
        {
          "description": "Summary by Auth0 host",
          "query": "Auth0Logs_CL\n| summarize count() by Auth0Domain"
        }
      ],
      "dataTypes": [
        {
          "name": "Auth0Logs_CL",
          "lastDataReceivedQuery": "Auth0Logs_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "isPreview": false,
        "status": 1
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true,
              "action": false
            }
          }
        ],
        "customs": [
          {
            "name": "Auth0 API credentials",
            "description": "**Auth0 Management API** credentials are required: Domain, Client ID, and Client Secret from a Machine-to-Machine application authorized for `read:logs` and `read:logs_users`."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Configure the Auth0 Management API application",
          "description": "Follow these steps to obtain the credentials:\n1. In the Auth0 Dashboard, go to **Applications > Applications**.\n2. Select (or create) a **Machine-to-Machine** application authorized against the Auth0 Management API with at least the **read:logs** and **read:logs_users** permissions.\n3. From the application settings, copy the **Domain** (it must start with `https://`), **Client ID**, and **Client Secret**.\n\nTo collect logs from multiple Auth0 hosts, add a separate connection for each host. Every record is tagged with its **Auth0Domain** so you can differentiate hosts.",
          "instructions": [
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnName": "Auth0 Domain",
                    "columnValue": "properties.addOnAttributes.Auth0Domain"
                  },
                  {
                    "columnName": "Data Type",
                    "columnValue": "properties.dataType"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "label": "Add Auth0 host",
                "title": "Add Auth0 Connection",
                "subtitle": "Connect to the Auth0 Management API",
                "contextPaneType": "DataConnectorsContextPane",
                "instructionSteps": [
                  {
                    "instructions": [
                      {
                        "type": "Markdown",
                        "parameters": {
                          "content": "## Authentication\n\nProvide the credentials from your Auth0 Machine-to-Machine application. These are used to obtain an OAuth2 access token for the Management API."
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Domain",
                          "placeholder": "e.g. https://example.auth0.com",
                          "type": "text",
                          "name": "domain",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Client ID",
                          "placeholder": "Auth0 application Client ID",
                          "type": "text",
                          "name": "clientId",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Client Secret",
                          "placeholder": "Auth0 application Client Secret",
                          "type": "password",
                          "name": "clientSecret",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "InfoMessage",
                        "parameters": {
                          "text": "Create a separate connection for each Auth0 host you want to collect logs from.",
                          "visible": true,
                          "inline": true
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ]
    }
  }
}