{
    "name": "SAPETDAlerts",
    "apiVersion": "2022-09-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
      "connectorUiConfig": {
        "id": "SAPETDAlerts",
        "title": "SAP Enterprise Threat Detection, cloud edition",
        "logo": "SapLogo.svg",
        "publisher": "SAP",
        "descriptionMarkdown": "The SAP Enterprise Threat Detection, cloud edition (ETD) data connector enables ingestion of security alerts from ETD into Microsoft Sentinel, supporting cross-correlation, alerting, and threat hunting.",
        "graphQueries": [
          {
            "metricName": "Total alerts received",
            "legend": "ETD Alerts",
            "baseQuery": "SAPETDAlerts_CL"
          },
          {
            "metricName": "Total investigations received",
            "legend": "ETD Investigations",
            "baseQuery": "SAPETDInvestigations_CL"
          }
        ],
        "sampleQueries": [
          {
            "description": "Get Sample of ETD Events",
            "query": "SAPETDAlerts_CL\n | take 10"
          }
        ],
        "dataTypes": [
          {
            "name": "SAPETDAlerts_CL",
            "lastDataReceivedQuery": "SAPETDAlerts_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
          },
          {
            "name": "SAPETDInvestigations_CL",
            "lastDataReceivedQuery": "SAPETDInvestigations_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
          }
        ],
        "connectivityCriteria": [
          {
            "type": "HasDataConnectors"
          }
        ],
        "permissions": {
          "resourceProvider": [
            {
              "provider": "Microsoft.OperationalInsights/workspaces",
              "permissionsDisplayText": "Read and Write permissions are required.",
              "providerDisplayName": "Workspace",
              "scope": "Workspace",
              "requiredPermissions": {
                "write": true,
                "read": true,
                "delete": true
              }
            },
            {
              "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
              "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)",
              "providerDisplayName": "Keys",
              "scope": "Workspace",
              "requiredPermissions": {
                "action": true
              }
            }
          ],
          "customs": [
            {
              "name": "Client Id and Client Secret for ETD Retrieval API",
              "description": "Enable API access in ETD."
            }
          ]
        },
        "instructionSteps": [
          {
            "description": "**Step 1 - Configuration steps for the SAP ETD Audit Retrieval API**\n\nFollow the steps provided by SAP [see ETD docs](https://help.sap.com/docs/ETD/sap-business-technology-platform/audit-log-retrieval-api-for-global-accounts-in-cloud-foundry-environment/). Take a note of the **url** (Audit Retrieval API URL), **uaa.url** (User Account and Authentication Server url) and the associated **uaa.clientid**.\n\n>**NOTE:** You can onboard one or more ETD subaccounts by following the steps provided by SAP [see ETD docs](https://help.sap.com/docs/ETD/sap-business-technology-platform/audit-log-retrieval-api-usage-for-subaccounts-in-cloud-foundry-environment/). Add a connection for each subaccount.\n\n>**TIP:** Use the [shared blog series](https://community.sap.com/t5/enterprise-resource-planning-blog-posts-by-sap/sap-enterprise-threat-detection-cloud-edition-joins-forces-with-microsoft/ba-p/13942075) for additional info."
          },
          {
            "description": "Connect using OAuth client credentials",
            "title": "Connect events from SAP ETD to Microsoft Sentinel",
            "instructions": [
              {
                "type": "ContextPane",
                "parameters": {
                  "contextPaneType": "DataConnectorsContextPane",
                  "label": "Add account",
                  "isPrimary": true,
                  "title": "ETD connection",
                  "instructionSteps": [
                    {
                      "title": "Account Details",
                      "instructions": [
                        {
                          "type": "Textbox",
                          "parameters": {
                            "label": "SAP ETD Client ID",
                            "placeholder": "Client ID",
                            "type": "text",
                            "name": "clientId"
                          }
                        },
                        {
                          "type": "Textbox",
                          "parameters": {
                            "label": "SAP ETD Client Secret",
                            "placeholder": "Client Secret",
                            "type": "password",
                            "name": "clientSecret"
                          }
                        },
                        {
                          "type": "Textbox",
                          "parameters": {
                            "label": "Authorization server URL (UAA server)",
                            "placeholder": "https://your-tenant.authentication.region.hana.ondemand.com/oauth/token",
                            "type": "text",
                            "name": "authServerUrl"
                          }
                        },
                        {
                          "type": "Textbox",
                          "parameters": {
                            "label": "SAP ETD data retrieval API URL",
                            "placeholder": "https://your-etd-cloud-data-retrieval-service.cfapps.region.hana.ondemand.com",
                            "type": "text",
                            "name": "etdHost"
                          }
                        }
                      ]
                    }
                  ]
                }
              }
            ]
          },
          {
            "title": "ETD accounts",
            "description": "Each row represents a connected ETD account",
            "instructions": [
              {
                "type": "DataConnectorsGrid",
                "parameters": {
                  "mapping": [
                    {
                      "columnName": "Data retrieval endpoint",
                      "columnValue": "properties.request.apiEndpoint"
                    }
                  ],
                  "menuItems": [
                    "DeleteConnector"
                  ]
                }
              }
            ]
          }
        ]
      }
    }
}