{
  "name": "SentinelOne",
  "apiVersion": "2024-01-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "SentinelOneCCP",
      "title": "SentinelOne (via Codeless Connector Framework)",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The [SentinelOne](https://usea1-nessat.sentinelone.net/api-doc/overview) data connector allows ingesting logs from the SentinelOne API into Microsoft Sentinel. The data connector is built on Microsoft Sentinel Codeless Connector Platform. It uses the SentinelOne API to fetch logs and it supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security data into a custom table so that queries don't need to parse it again, thus resulting in better performance.",
      "graphQueries": [
        {
          "metricName": "Total activities logs received",
          "legend": "SentinelOne Activities Logs",
          "baseQuery": "SentinelOneActivities_CL"
        },
        {
          "metricName": "Total agents logs received",
          "legend": "SentinelOne Agents Logs",
          "baseQuery": "SentinelOneAgents_CL"
        },
        {
          "metricName": "Total groups logs received",
          "legend": "SentinelOne Groups Logs",
          "baseQuery": "SentinelOneGroups_CL"
        },
        {
          "metricName": "Total threats logs received",
          "legend": "SentinelOne Threats Logs",
          "baseQuery": "SentinelOneThreats_CL"
        },
        {
          "metricName": "Total alerts logs received",
          "legend": "SentinelOne Alerts Logs",
          "baseQuery": "SentinelOneAlerts_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get Sample of SentinelOne activities logs",
          "query": "SentinelOneActivities_CL| take 10"
        },
        {
          "description": "Get Sample of SentinelOne groups logs",
          "query": "SentinelOneGroups_CL| take 10"
        },
        {
          "description": "Get Sample of SentinelOne threats logs",
          "query": "SentinelOneThreats_CL| take 10"
        },
        {
          "description": "Get Sample of SentinelOne agents logs",
          "query": "SentinelOneAgents_CL| take 10"
        },
        {
          "description": "Get Sample of SentinelOne alerts logs",
          "query": "SentinelOneAlerts_CL| take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "SentinelOneActivities_CL",
          "lastDataReceivedQuery": "SentinelOneActivities_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
          "name": "SentinelOneAgents_CL",
          "lastDataReceivedQuery": "SentinelOneAgents_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
          "name": "SentinelOneGroups_CL",
          "lastDataReceivedQuery": "SentinelOneGroups_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
          "name": "SentinelOneThreats_CL",
          "lastDataReceivedQuery": "SentinelOneThreats_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
          "name": "SentinelOneAlerts_CL",
          "lastDataReceivedQuery": "SentinelOneAlerts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": true,
              "action": false
            }
          }
        ]
      },
      "instructionSteps": [
        {
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### Configuration steps for the SentinelOne API \n Follow the instructions to obtain the credentials. You can also follow the [guide](https://usea1-nessat.sentinelone.net/docs/en/how-to-automate-api-token-generation.html#how-to-automate-api-token-generation) to generate API key."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### 1. Retrieve SentinelOne Management URL\n   1.1. Log in to the SentinelOne [**Management Console**] with Admin user credentials\n   1.2. In the [**Management Console**] copy the URL link above without the URL path."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### 2. Retrieve API Token\n   2.1. Log in to the SentinelOne [**Management Console**] with Admin user credentials\n 2.2. In the [**Management Console**], click [**Settings**]\n  2.3. In [**Settings**] view click on [**USERS**].\n   2.4. In the [**USERS**] Page click on [**Service Users**] -> [**Actions**] -> [**Create new service user**].\n   2.5. Choose [**Expiration date**] and [**scope**] (by site) and click on [**Create User**].\n   2.6. Once the [**Service User**] is created copy the [**API Token**] from page and press [**Save**]"
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### 3. Connect new instances \n To enable the SentinelOne connector for Microsoft Sentinel, click the **Add new instance** button, fill in the required information in the context pane and click on **Connect**."
              }
            },
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnValue": "properties.request.apiEndpoint",
                    "columnName": "Management URL"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "contextPaneType": "DataConnectorsContextPane",
                "title": "Add new instance",
                "subtitle": "SentinelOne connector",
                "label": "Add new instance",
                "instructionSteps": [
                  {
                    "title": "Instance details",
                    "instructions": [
                      {
                        "parameters": {
                          "label": "SentinelOne Management URL",
                          "placeholder": "https://example.sentinelone.net/",
                          "type": "text",
                          "name": "managementUrl",
                          "validations": {
                            "required": true
                          }
                        },
                        "type": "Textbox"
                      },
                      {
                        "parameters": {
                          "label": "API Token",
                          "placeholder": "API Token",
                          "type": "securestring",
                          "name": "apitoken",
                          "validations": {
                            "required": true
                          }
                        },
                        "type": "Textbox"
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ],
      "isConnectivityCriteriasMatchSome": false
    }
  }
}