{
  "name": "CheckPointCyberintAlerts",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "CheckPointCyberintAlerts",
      "title": "Check Point Cyberint Alerts Connector (via Codeless Connector Platform)",
      "publisher": "Checkpoint Cyberint",
      "descriptionMarkdown": "Cyberint, a Check Point company, provides a Microsoft Sentinel integration to streamline critical Alerts and bring enriched threat intelligence from the Infinity External Risk Management solution into Microsoft Sentinel. This simplifies the process of tracking the status of tickets with automatic sync updates across systems. Using this new integration for Microsoft Sentinel, existing Cyberint and Microsoft Sentinel customers can easily pull logs based on Cyberint's findings into Microsoft Sentinel platform.",
      "graphQueriesTableName": "argsentdc_CL",
      "graphQueries": [
        {
          "metricName": "Alerts received",
          "legend": "My data connector alerts",
          "baseQuery": "{{graphQueriesTableName}}"
        }
      ],
      "sampleQueries": [
        {
          "description": "All alert logs",
          "query": "{{graphQueriesTableName}} \n | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "{{graphQueriesTableName}}",
          "lastDataReceivedQuery": "{{graphQueriesTableName}} \n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true
            }
          }
        ],
        "customs": [
          {
            "name": "Check Point Cyberint API Key, Argos URL, Customer Name",
            "description": "The connector API key, Argos URL, and Customer Name are required. Include CSV Attachments as JSON is optional."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect Checkpoint Cyberint Alerts to Microsoft Sentinel",
          "description": "To enable the connector provide the required information below and click on Connect.\n\n**Argos URL** — Cyberint API URL for your tenant (e.g. `https://your_tenant.cyberint.io`)\n\n**API Token** — Cyberint API access token\n\n**Customer Name** — Company (client) name associated with your Cyberint instance\n\n**Severity** — Comma-separated list of severities to fetch (low, medium, high, very_high). If empty, all severities are fetched.\n\n**Environments** — Comma-separated list of environments to fetch (e.g. Production,Staging). If empty, all environments are fetched.\n\n**Polling Interval** — How often to poll for new alerts, in minutes (default: 5)\n\n**Include CSV Attachments as JSON** — Whether to include CSV attachments as JSON content in alerts (default: false)\n>",
          "instructions": [
            {
              "type": "Textbox",
              "parameters": {
                "label": "Argos URL",
                "placeholder": "https://your_tenant.cyberint.io",
                "type": "text",
                "name": "argosurl"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "API Token",
                "placeholder": "Cyberint API access token",
                "type": "password",
                "name": "apikey"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Customer Name",
                "placeholder": "Company (client) name associated with your Cyberint instance",
                "type": "text",
                "name": "customername"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Severity",
                "placeholder": "Comma-separated list (e.g. low,medium,high,very_high)",
                "type": "text",
                "name": "severity"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Environments",
                "placeholder": "Comma-separated list",
                "type": "text",
                "name": "environments"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Polling Interval (Minutes)",
                "placeholder": "Polling frequency in minutes",
                "type": "text",
                "name": "pollinginterval",
                "defaultValue": "5"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Include CSV Attachments as JSON",
                "placeholder": "true or false",
                "type": "text",
                "name": "includecsvattachments",
                "defaultValue": "false"
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "connectLabel": "Connect",
                "name": "Connect"
              }
            }
          ]
        }
      ]
    }
  }
}