{
    "name": "CyfirmaVulnerabilitiesIntelDC",
    "apiVersion": "2024-01-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "CyfirmaVulnerabilitiesIntelDC",
            "title": "CYFIRMA Vulnerabilities Intelligence",
            "publisher": "Microsoft",
            "isConnectivityCriteriasMatchSome": false,
            "descriptionMarkdown": "The CYFIRMA Vulnerabilities Intelligence data connector enables seamless log ingestion from the DeCYFIR API into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform, it leverages the CYFIRMA API's to retrieve logs. Additionally, it supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview), which parse security data into a custom table during ingestion. This eliminates the need for query-time parsing, enhancing performance and efficiency.",
            "graphQueries": [
                {
                    "metricName": "Total Vulnerabilities logs received",
                    "legend": "Vulnerabilities Logs",
                    "baseQuery": "CyfirmaVulnerabilities_CL"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Get Sample of Vulnerabilities logs",
                    "query": "CyfirmaVulnerabilities_CL | take 10"
                }
            ],
            "dataTypes": [
                {
                    "name": "CyfirmaVulnerabilities_CL",
                    "lastDataReceivedQuery": "CyfirmaVulnerabilities_CL\n | where TimeGenerated > ago(5m) | summarize Time = max(TimeGenerated)\n  | where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "availability": {
                "status": 1,
                "isPreview": false
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "read": true,
                            "write": true,
                            "delete": true,
                            "action": false
                        }
                    }
                ]
            },
            "instructionSteps": [
                {
                    "title": "CYFIRMA Vulnerabilities Intelligence",
                    "description": "This connector provides the Vulnerabilities logs from CYFIRMA Vulnerabilities Intelligence. The connector uses the DeCYFIR API to retrieve logs and supports DCR-based ingestion time transformations, parsing security data into a custom table during ingestion. This eliminates the need for query-time parsing, enhancing performance and efficiency.",
                    "descriptionMarkdown": "This connector provides the Vulnerabilities logs from CYFIRMA Vulnerabilities Intelligence. The connector uses the DeCYFIR API to retrieve logs and supports DCR-based ingestion time transformations, parsing security data into a custom table during ingestion. This eliminates the need for query-time parsing, enhancing performance and efficiency.",
                    "estimatedTime": "5 minutes",
                    "icon": "https://www.microsoft.com/favicon.ico",
                    "instructions": [
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "CYFIRMA API URL",
                                "placeholder": "https://decyfir.cyfirma.com",
                                "type": "text",
                                "name": "cyfirmaAPIURL"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "CYFIRMA API Key",
                                "placeholder": "CYFIRMA API Key",
                                "type": "password",
                                "name": "cyfirmaAPIKey"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "API Delta",
                                "placeholder": "API Delta",
                                "type": "text",
                                "name": "apiDelta",
                                "defaultValue": "false",
                                "description": "API Delta: If true (default), returns data since the last call; if false or unspecified, returns data from the last 24 hours."
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Vendor-Associated Vulnerabilities",
                                "placeholder": "",
                                "type": "text",
                                "name": "isVendor",
                                "defaultValue": "false",
                                "description": "The value for Vendor-Associated Vulnerabilities can be either true or false."
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Product-Associated Vulnerabilities",
                                "placeholder": "",
                                "type": "text",
                                "name": "isProduct",
                                "defaultValue": "false",
                                "description": "The value for Product-Associated Vulnerabilities can be either true or false."
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Product with Version-Associated Vulnerabilities",
                                "placeholder": "",
                                "type": "text",
                                "name": "isVersion",
                                "defaultValue": "false",
                                "description": "The value for Version-Associated Vulnerabilities can be either true or false."
                            }
                        },
                        {
                            "type": "ConnectionToggleButton",
                            "parameters": {
                                "connectLabel": "Connect",
                                "name": "connect"
                            }
                        }
                    ]
                }
            ]
        }
    }
}