{
    "name": "CitrixAnalyticsDefinition",
    "apiVersion": "2022-09-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "CitrixAnalyticsDefinition",
            "title": "Citrix Analytics (via Codeless Connector Framework)",
            "publisher": "Citrix",
            "descriptionMarkdown": "Citrix Analytics integration with Microsoft Sentinel helps you to export data analyzed for the events(SPA, Security) from Citrix Analytics into Microsoft Sentinel environment. You can create custom dashboards, analyze data from other sources along with that from Citrix Analytics and create custom workflows using Logic Apps to monitor and mitigate the events.",
            "graphQueries": [
                {
                    "metricName": "Total SPA Events received",
                    "legend": "CitrixAnalytics_SPA_Events_V1_CL",
                    "baseQuery": "CitrixAnalytics_SPA_Events_V1_CL"
                },
                {
                    "metricName": "Total Risk Indicator Summary Events received",
                    "legend": "CitrixAnalytics_indicatorSummary_V1_CL",
                    "baseQuery": "CitrixAnalytics_indicatorSummary_V1_CL"
                },
                {
                    "metricName": "Total Risk Indicator Detail Events received",
                    "legend": "CitrixAnalytics_indicatorEventDetails_V1_CL",
                    "baseQuery": "CitrixAnalytics_indicatorEventDetails_V1_CL"
                },
                {
                    "metricName": "Total Risk Score Change Events received",
                    "legend": "CitrixAnalytics_riskScoreChange_V1_CL",
                    "baseQuery": "CitrixAnalytics_riskScoreChange_V1_CL"
                },
                {
                    "metricName": "Total User Profile Events received",
                    "legend": "CitrixAnalytics_userProfile_V1_CL",
                    "baseQuery": "CitrixAnalytics_userProfile_V1_CL"
                },
                {
                    "metricName": "Total CVAD Events received",
                    "legend": "CitrixAnalytics_CVAD_Events_V1_CL",
                    "baseQuery": "CitrixAnalytics_CVAD_Events_V1_CL"
                }
            ],
            "sampleQueries": [
                {
                    "description" : "High Risk Users",
                    "query": "CitrixAnalytics_userProfile_V1_CL\n  | where cur_riskscore >= 65\n | where cur_riskscore <= 100\n | summarize arg_max(TimeGenerated, cur_riskscore) by entity_id\n | count "
                },
                {
                    "description" : "Medium Risk Users",
                    "query": "CitrixAnalytics_userProfile_V1_CL\n  | where cur_riskscore >= 35\n | where cur_riskscore <= 64\n | summarize arg_max(TimeGenerated, cur_riskscore) by entity_id\n | count "
                },
                {
                    "description" : "Low Risk Users",
                    "query": "CitrixAnalytics_userProfile_V1_CL\n  | where cur_riskscore >= 1\n | where cur_riskscore <= 34\n | summarize arg_max(TimeGenerated, cur_riskscore) by entity_id\n | count "
                }
            ],
            "dataTypes": [
                {
                    "name": "CitrixAnalytics_SPA_Events_V1_CL",
                    "lastDataReceivedQuery": "CitrixAnalytics_SPA_Events_V1_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CitrixAnalytics_CVAD_Events_V1_CL",
                    "lastDataReceivedQuery": "CitrixAnalytics_CVAD_Events_V1_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CitrixAnalytics_indicatorSummary_V1_CL",
                    "lastDataReceivedQuery": "CitrixAnalytics_indicatorSummary_V1_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CitrixAnalytics_indicatorEventDetails_V1_CL",
                    "lastDataReceivedQuery": "CitrixAnalytics_indicatorEventDetails_V1_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CitrixAnalytics_riskScoreChange_V1_CL",
                    "lastDataReceivedQuery": "CitrixAnalytics_riskScoreChange_V1_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CitrixAnalytics_userProfile_V1_CL",
                    "lastDataReceivedQuery": "CitrixAnalytics_userProfile_V1_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "IsConnectedQuery",
                    "value": [
                        "CitrixAnalytics_SPA_Events_V1_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)",
                        "CitrixAnalytics_userProfile_V1_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)",
                        "CitrixAnalytics_indicatorSummary_V1_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)",
                        "CitrixAnalytics_indicatorEventDetails_V1_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)",
                        "CitrixAnalytics_riskScoreChange_V1_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)",
                        "CitrixAnalytics_CVAD_Events_V1_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
                    ]
                }
            ],
            "availability": {
                "status": 1,
                "isPreview": false
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "read and write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "write": true,
                            "read": true,
                            "delete": true
                        }
                    },
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                        "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                        "providerDisplayName": "Keys",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "action": true
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "Microsoft Entra",
                        "description": "Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher."
                    },
                    {
                        "name": "Microsoft Azure",
                        "description": "Permission to assign Monitoring Metrics Publisher role on data collection rules. Typically requires Azure RBAC Owner or User Access Administrator role."
                    },
                    {
                        "name": "Licensing",
                        "description": "Entitlements to Citrix Analytics in Citrix Cloud. Please review [Citrix Tool License Agreement.](https://aka.ms/sentinel-citrixanalyticslicense-readme)"
                    }
                ]
            },
            "instructionSteps": [
                {
                    "title": "1. Create ARM Resources and Provision Required Permissions",
                    "description": "Click Deploy to provision the required Azure resources (Log Analytics tables, Data Collection Rule, and Entra app registration) and enable Citrix Analytics to securely push data into Microsoft Sentinel via the Azure Monitor Logs Ingestion API.",
                    "instructions": [
                        {
                            "type": "Markdown",
                            "parameters": {
                            "content": "#### Automated Configuration and Secure Data Ingestion with Entra Application \nClicking on \"Deploy\" will trigger the creation of Log Analytics tables and a Data Collection Rule (DCR). \nIt will then create an Entra application, link the DCR to it, and set the entered secret in the application. This setup enables data to be sent securely to the DCR using an Entra token."
                            }
                        },
                        {
                            "parameters": {
                            "label": "Deploy Citrix Analytics Connector Resources",
                            "applicationDisplayName": "Citrix Analytics Connector Application"
                            },
                            "type": "DeployPushConnectorButton"
                        }
                    ]
                },
                {
                    "title": "2. Configure your integration in the Citrix Analytics Platform",
                    "description": "Use the following parameters to configure your integration in the Citrix Analytics Platform.",
                    "instructions": [
                        {
                            "parameters": {
                            "label": "Directory ID (Tenant ID)",
                            "fillWith": [
                                "TenantId"
                            ]
                            },
                            "type": "CopyableLabel"
                        },
                        {
                            "parameters": {
                            "label": "Entra App Registration Application ID (Client ID)",
                            "fillWith": [
                                "ApplicationId"
                            ],
                            "placeholder": "Deploy the Push Connector to get the App Registration Application ID"
                            },
                            "type": "CopyableLabel"
                        },
                        {
                            "parameters": {
                            "label": "Entra App Registration Secret (Credential Secret) (THIS SECRET WILL NOT BE VISIBLE AFTER LEAVING THIS PAGE)",
                            "fillWith": [
                                "ApplicationSecret"
                            ],
                            "placeholder": "Deploy the Push Connector to get the App Registration Secret"
                            },
                            "type": "CopyableLabel"
                        },
                        {
                            "parameters": {
                            "label": "Data Collection Endpoint (URL)",
                            "fillWith": [
                                "DataCollectionEndpoint"
                            ],
                            "placeholder": "Deploy the Push Connector to get the Data Collection Endpoint"
                            },
                            "type": "CopyableLabel"
                        },
                        {
                            "parameters": {
                            "label": "Data Collection Rule Immutable ID (Rule ID)",
                            "fillWith": [
                                "DataCollectionRuleId"
                            ],
                            "placeholder": "Deploy the Push Connector to get the Data Collection Rule ID"
                            },
                            "type": "CopyableLabel"
                        }
                    ]
                }
            ],
            "isConnectivityCriteriasMatchSome": true
        }
    }
}