{
  "name": "BitSightStatisticsConnector",
  "apiVersion": "2023-04-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "BitSightStatisticsConnector",
      "title": "BitSight Security Statistics (via Codeless Connector Framework)",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The [BitSight](https://www.bitsight.com/) data connector provides the capability to ingest security statistics, company profiles, rating details, diligence history, risk vector statistics, and vulnerability data from your BitSight portfolio into Microsoft Sentinel through the BitSight REST API. Refer to the [BitSight API documentation](https://help.bitsighttech.com/hc/en-us/articles/115014888388-API-Token-Management) for more information.",
      "graphQueriesTableName": "BitSightCompanyDetails",
      "graphQueries": [
        {
          "metricName": "Total Company Detail records received",
          "legend": "BitSight Company Details",
          "baseQuery": "{{graphQueriesTableName}}"
        },
        {
          "metricName": "Total Company Rating Details received",
          "legend": "BitSight Company Rating Details",
          "baseQuery": "BitSightCompanyRatingDetails"
        },
        {
          "metricName": "Total Diligence Historical Statistics received",
          "legend": "BitSight Diligence Historical Statistics",
          "baseQuery": "BitSightDiligenceHistoricalStatistics"
        },
        {
          "metricName": "Total Diligence Statistics received",
          "legend": "BitSight Diligence Statistics",
          "baseQuery": "BitSightDiligenceStatistics"
        },
        {
          "metricName": "Total Observations Statistics received",
          "legend": "BitSight Observations Statistics",
          "baseQuery": "BitSightObservationStatistics"
        },
        {
          "metricName": "Total Industries Statistics received",
          "legend": "BitSight Industries Statistics",
          "baseQuery": "BitsightIndustrialStatistics"
        },
        {
          "metricName": "Total Findings Summary records received",
          "legend": "BitSight Findings Summary",
          "baseQuery": "BitSightFindingsSummary"
        },
        {
          "metricName": "Total Vulnerabilities received",
          "legend": "BitSight Vulnerabilities",
          "baseQuery": "BitsightVulnerabilitiesFindingsSummary"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get sample of BitSight Company Details",
          "query": "{{graphQueriesTableName}}\n | take 10"
        },
        {
          "description": "Get company security ratings over time",
          "query": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(90d)\n | summarize LatestRating = arg_max(TimeGenerated, CurrentRating) by Name\n | order by LatestRating asc"
        },
        {
          "description": "Get sample of BitSight Company Rating Details",
          "query": "BitSightCompanyRatingDetails\n | take 10"
        },
        {
          "description": "Get findings summary with latest data per company/stat",
          "query": "BitSightFindingsSummary\n | where TimeGenerated > ago(1d)\n | take 10"
        },
        {
          "description": "Get sample of BitSight Vulnerabilities",
          "query": "BitsightVulnerabilitiesFindingsSummary\n | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "{{graphQueriesTableName}}",
          "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        },
        {
          "name": "BitSightCompanyRatingDetails",
          "lastDataReceivedQuery": "BitSightCompanyRatingDetails\n | where TimeGenerated > ago(12h)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        },
        {
          "name": "BitSightFindingsSummary",
          "lastDataReceivedQuery": "BitSightFindingsSummary\n | where TimeGenerated > ago(12h)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        },
        {
          "name": "BitSightDiligenceHistoricalStatistics",
          "lastDataReceivedQuery": "BitSightDiligenceHistoricalStatistics\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "BitSightDiligenceStatistics",
          "lastDataReceivedQuery": "BitSightDiligenceStatistics\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "BitSightObservationStatistics",
          "lastDataReceivedQuery": "BitSightObservationStatistics\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "BitsightIndustrialStatistics",
          "lastDataReceivedQuery": "BitsightIndustrialStatistics\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "BitsightVulnerabilitiesFindingsSummary",
          "lastDataReceivedQuery": "BitsightVulnerabilitiesFindingsSummary\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "isPreview": true,
        "status": 1
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true,
              "action": false
            }
          }
        ],
        "customs": [
          {
            "name": "BitSight API Token",
            "description": "A BitSight API Token is required to authenticate requests to the BitSight REST API. [See the documentation](https://help.bitsighttech.com/hc/en-us/articles/115014888388-API-Token-Management) to learn more about API Token management."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "1. Connection Management",
          "description": "Manage your BitSight statistics data stream connections",
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "## BitSight Statistics Connections\n\nManage multiple BitSight statistics connections. Each connection selects one or more **data streams** to ingest and assigns a **Connection Name** stored in the `connectionName` column of every ingested record.\n\n> **Authentication**: BitSight uses HTTP Basic Authentication where the API token is used as **both** the username and password."
              }
            },
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnName": "Connection Name",
                    "columnValue": "properties.addOnAttributes.connectionName"
                  },
                  {
                    "columnName": "Active Streams",
                    "columnValue": "properties.addOnAttributes.streams"
                  },
                  {
                    "columnName": "API URL",
                    "columnValue": "properties.request.apiEndpoint"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "isPrimary": true,
                "label": "Add Connection",
                "title": "Add BitSight Statistics Connection",
                "subtitle": "Configure a new BitSight statistics connection",
                "contextPaneType": "DataConnectorsContextPane",
                "instructionSteps": [
                  {
                    "instructions": [
                      {
                        "type": "Markdown",
                        "parameters": {
                          "content": "## 1. Select Data Streams\n\nChoose which BitSight statistics data types to collect for this connection. You can select multiple streams."
                        }
                      },
                      {
                        "type": "Dropdown",
                        "parameters": {
                          "label": "Data Streams",
                          "name": "streams",
                          "options": [
                            {
                              "key": "FindingsSummary",
                              "text": "FindingsSummary"
                            },
                            {
                              "key": "CompanyDetails",
                              "text": "CompanyDetails"
                            },
                            {
                              "key": "CompanyRatingDetails",
                              "text": "CompanyRatingDetails"
                            },
                            {
                              "key": "DiligenceHistoricalStatistics",
                              "text": "DiligenceHistoricalStatistics"
                            },
                            {
                              "key": "RiskVectorStatistics",
                              "text": "RiskVectorStatistics"
                            },
                            {
                              "key": "IndustriesStatistics",
                              "text": "IndustriesStatistics"
                            },
                            {
                              "key": "Vulnerabilities",
                              "text": "Vulnerabilities"
                            },
                            {
                              "key": "ObservationsStatistics",
                              "text": "ObservationsStatistics"
                            }
                          ],
                          "isMultiSelect": true,
                          "defaultAllSelected": false,
                          "required": true
                        }
                      },
                      {
                        "type": "Markdown",
                        "parameters": {
                          "content": "## 2. API Configuration"
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "BitSight API Base URL",
                          "placeholder": "https://api.bitsighttech.com",
                          "type": "text",
                          "name": "bitSightApiUrl",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Markdown",
                        "parameters": {
                          "content": "## 3. Authentication\n\nBitSight uses your API token as **both** the username and password for HTTP Basic Authentication."
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "BitSight API Token (Username)",
                          "placeholder": "Paste your BitSight API Token",
                          "type": "text",
                          "name": "username",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "BitSight API Token (Password)",
                          "placeholder": "Paste your BitSight API Token again",
                          "type": "password",
                          "name": "password",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "InfoMessage",
                        "parameters": {
                          "text": "Obtain your API Token from **Settings > Account > User Preferences > API Token** in the BitSight portal.",
                          "visible": true,
                          "inline": false
                        }
                      },
                      {
                        "type": "Markdown",
                        "parameters": {
                          "content": "## 4. Connection Name\n\nAssign a unique name to identify this connection in the grid and in every ingested log record."
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Connection Name",
                          "placeholder": "e.g. BitSight-Statistics-Prod",
                          "type": "text",
                          "name": "connectionName",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "InfoMessage",
                        "parameters": {
                          "text": "The connection name is stored in the `connectionName` column of every ingested record, enabling you to trace data back to this specific connection.",
                          "visible": true,
                          "inline": true
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ]
    }
  }
}