{
  "name": "meshStackEventLogsDefinition",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "meshStackEventLogsDefinition",
      "title": "meshStack Event Logs",
      "publisher": "meshcloud",
      "descriptionMarkdown": "The meshStack Event Logs connector provides the capability to ingest meshStack platform events into Microsoft Sentinel. By connecting meshStack event logs into Microsoft Sentinel, you can view this data in workbooks, use it to create custom alerts, and improve your investigation process for cloud platform governance, audit, and compliance monitoring.",
      "graphQueriesTableName": "meshStackEventLogs_CL",
      "graphQueries": [
        {
          "metricName": "Total events received",
          "legend": "meshStack Event Logs",
          "baseQuery": "{{graphQueriesTableName}}"
        }
      ],
      "sampleQueries": [
        {
          "description": "All meshStack Event Logs",
          "query": "{{graphQueriesTableName}}\n| take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "{{graphQueriesTableName}}",
          "lastDataReceivedQuery": "{{graphQueriesTableName}}\n|summarize Time = max(TimeGenerated)\n|where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "isPreview": true
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true
            }
          }
        ],
        "customs": [
          {
            "name": "meshStack OAuth2 API Key",
            "description": "A valid meshStack API Key with the 'Admin: List Event Logs in any Workspace' permission is required. Create the API Key in the meshStack Admin Panel under Access Control > API Keys. The API Key provides OAuth2 credentials (Key ID as client_id and Key Secret as client_secret) for authentication. Note: The API Key is bound to a workspace but can access events from all workspaces."
          },
          {
            "name": "meshStack Instance",
            "description": "Access to a meshStack instance with the Events API enabled."
          }
        ]
      },
      "instructionSteps": [
        {
          "description": "Enter your meshStack instance API URL and OAuth2 credentials from the API Key. The API URL format should be: `https://your-meshstack-instance.io`. Create an API Key in meshStack (Admin Panel > Access Control > API Keys) with the 'Admin: List Event Logs in any Workspace' permission. The API Key provides a **Key ID** (client_id) and **Key Secret** (client_secret) for OAuth2 authentication.",
          "instructions": [
            {
              "type": "Textbox",
              "parameters": {
                "label": "meshStack API URL",
                "placeholder": "https://your-meshstack-instance.io",
                "type": "text",
                "name": "ApiUrl",
                "validations": {
                  "required": true
                }
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Client ID (Key ID)",
                "placeholder": "Enter Key ID from API Key",
                "type": "text",
                "name": "ClientId",
                "validations": {
                  "required": true
                }
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Client Secret (Key Secret)",
                "placeholder": "Enter Key Secret from API Key",
                "type": "password",
                "name": "ClientSecret",
                "validations": {
                  "required": true
                }
              }
            },
            {
              "parameters": {
                "label": "toggle",
                "name": "toggle"
              },
              "type": "ConnectionToggleButton"
            }
          ],
          "title": "Connect meshStack Event Logs to Microsoft Sentinel"
        }
      ]
    }
  }
}