{
    "name": "CyfirmaDigitalRiskAlertsConnector",
    "apiVersion": "2024-01-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "CyfirmaDigitalRiskAlertsConnector",
            "title": "CYFIRMA Digital Risk",
            "publisher": "Microsoft",
            "isConnectivityCriteriasMatchSome": false,
            "descriptionMarkdown": "The CYFIRMA Digital Risk Alerts data connector enables seamless log ingestion from the DeCYFIR/DeTCT API into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform, it leverages the DeCYFIR Alerts API to retrieve logs. Additionally, it supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview), which parse security data into a custom table during ingestion. This eliminates the need for query-time parsing, enhancing performance and efficiency.",
            "graphQueries": [
                {
                    "metricName": "Total Phishing Alerts logs received",
                    "legend": "Phishing Alerts Logs",
                    "baseQuery": "CyfirmaDBWMPhishingAlerts_CL"
                },
                {
                    "metricName": "Total Ransomware Alerts logs received",
                    "legend": "Ransomware Alerts Logs",
                    "baseQuery": "CyfirmaDBWMRansomwareAlerts_CL"
                },
                {
                    "metricName": "Total DarkWeb Alerts logs received",
                    "legend": "DarkWeb Alerts Logs",
                    "baseQuery": "CyfirmaDBWMDarkWebAlerts_CL"
                }, 
                {
                    "metricName": "Total SourceCode Alerts logs received",
                    "legend": "SourceCode Alerts Logs",
                    "baseQuery": "CyfirmaSPESourceCodeAlerts_CL"
                },
                {
                    "metricName": "Total ConfidentialFiles Alerts logs received",
                    "legend": "ConfidentialFiles Alerts Logs",
                    "baseQuery": "CyfirmaSPEConfidentialFilesAlerts_CL"
                },
                {
                    "metricName": "Total PII-CII Alerts logs received",
                    "legend": "PII-CII Alerts Logs",
                    "baseQuery": "CyfirmaSPEPIIAndCIIAlerts_CL"
                },
                {
                    "metricName": "Total Social Threat Alerts logs received",
                    "legend": "SocialThreat Alerts Logs",
                    "baseQuery": "CyfirmaSPESocialThreatAlerts_CL"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Get Sample of Phishing Alerts logs",
                    "query": "CyfirmaDBWMPhishingAlerts_CL| take 10"
                },
                {
                    "description": "Get Sample of Ransomware Alerts logs",
                    "query": "CyfirmaDBWMRansomwareAlerts_CL| take 10"
                },
                {
                    "description": "Get Sample of DarkWeb Alerts logs",
                    "query": "CyfirmaDBWMDarkWebAlerts_CL| take 10"
                },{
                    "description": "Get Sample of SourceCode Alerts logs",
                    "query": "CyfirmaSPESourceCodeAlerts_CL| take 10"
                },
                {
                    "description": "Get Sample of ConfidentialFiles Alerts logs",
                    "query": "CyfirmaSPEConfidentialFilesAlerts_CL| take 10"
                },
                {
                    "description": "Get Sample of PIIAndCII Alerts logs",
                    "query": "CyfirmaSPEPIIAndCIIAlerts_CL| take 10"
                },
                {
                    "description": "Get Sample of Social Threats Alerts logs",
                    "query": "CyfirmaSPESocialThreatAlerts_CL| take 10"
                }
            ],
            "dataTypes": [
                {
                    "name": "CyfirmaDBWMPhishingAlerts_CL",
                    "lastDataReceivedQuery": "CyfirmaDBWMPhishingAlerts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CyfirmaDBWMRansomwareAlerts_CL",
                    "lastDataReceivedQuery": "CyfirmaDBWMRansomwareAlerts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CyfirmaDBWMDarkWebAlerts_CL",
                    "lastDataReceivedQuery": "CyfirmaDBWMDarkWebAlerts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CyfirmaSPESourceCodeAlerts_CL",
                    "lastDataReceivedQuery": "CyfirmaSPESourceCodeAlerts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CyfirmaSPEConfidentialFilesAlerts_CL",
                    "lastDataReceivedQuery": "CyfirmaSPEConfidentialFilesAlerts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CyfirmaSPEPIIAndCIIAlerts_CL",
                    "lastDataReceivedQuery": "CyfirmaSPEPIIAndCIIAlerts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CyfirmaSPESocialThreatAlerts_CL",
                    "lastDataReceivedQuery": "CyfirmaSPESocialThreatAlerts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "availability": {
                "status": 1,
                "isPreview": false
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "read": true,
                            "write": true,
                            "delete": true,
                            "action": false
                        }
                    }
                ]
            },
            "instructionSteps": [
                {
                    "title": "CYFIRMA Digital Risk",
                    "description": "Connect to CYFIRMA Digital Risk Alerts to ingest logs into Microsoft Sentinel. This connector uses the DeCYFIR/DeTCT API to retrieve alerts and supports DCR-based ingestion time transformations for efficient log parsing.",
                    "estimatedTime": "5 minutes",
                    "icon": "https://www.microsoft.com/favicon.ico",
                    "instructions": [
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "CYFIRMA API URL",
                                "placeholder": "https://decyfir.cyfirma.com",
                                "type": "text",
                                "name": "cyfirmaAPIURL"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "CYFIRMA API Key",
                                "placeholder": "CYFIRMA API Key",
                                "type": "password",
                                "name": "cyfirmaAPIKey"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "API Delta",
                                "placeholder": "API Delta",
                                "type": "text",
                                "name": "apiDelta",
                                "description": "True: First call returns last 30 days, then only incremental data. False: Returns all data on every call."
                            }
                        },
                        
                        {
                            "type": "ConnectionToggleButton",
                            "parameters": {
                                "connectLabel": "Connect",
                                "name": "connect"
                            }
                        }
                    ]
                }
            ]
        }
    }
}