{
    "name": "TaniumConnector",
    "apiVersion": "2022-09-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "[parameters('location')]",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "TaniumConnector",
            "title": "Tanium's CCF Push Connector",
            "publisher": "Tanium Inc.",
            "logo": "Tanium.svg",
            "descriptionMarkdown": "This data feeds Microsoft Sentinel workbooks and playbooks so analysts can enrich incidents, visualize endpoint risk and health, and automate investigation and response workflows. For more details about Tanium, head to [https://www.tanium.com/contact-us/](https://www.tanium.com/contact-us/)",
            "graphQueries": [
                {
                    "metricName": "Compliance Findings",
                    "legend": "TaniumComplyCompliance_CL",
                    "baseQuery": "TaniumComplyCompliance_CL"
                },
                {
                    "metricName": "Compliance Vulnerabilities",
                    "legend": "TaniumComplyVulnerabilities_CL",
                    "baseQuery": "TaniumComplyVulnerabilities_CL"
                },
                {
                    "metricName": "Defender Health",
                    "legend": "TaniumDefenderHealth_CL",
                    "baseQuery": "TaniumDefenderHealth_CL"
                },
                {
                    "metricName": "Discover Unmanaged Assets",
                    "legend": "TaniumDiscoverUnmanagedAssets_CL",
                    "baseQuery": "TaniumDiscoverUnmanagedAssets_CL"
                },
                {
                    "metricName": "High Uptime",
                    "legend": "TaniumHighUptime_CL",
                    "baseQuery": "TaniumHighUptime_CL"
                },
                {
                    "metricName": "Patch Coverage Status",
                    "legend": "TaniumPatchCoverageStatus_CL",
                    "baseQuery": "TaniumPatchCoverageStatus_CL"
                },
                {
                    "metricName": "Patch List Applicability",
                    "legend": "TaniumPatchListApplicability_CL",
                    "baseQuery": "TaniumPatchListApplicability_CL"
                },
                {
                    "metricName": "Patch List Compliance",
                    "legend": "TaniumPatchListCompliance_CL",
                    "baseQuery": "TaniumPatchListCompliance_CL"
                },
                {
                    "metricName": "SCCM Client Health",
                    "legend": "TaniumSCCMClientHealth_CL",
                    "baseQuery": "TaniumSCCMClientHealth_CL"
                },
                {
                    "metricName": "Threat Response Alerts",
                    "legend": "TaniumThreatResponse_CL",
                    "baseQuery": "TaniumThreatResponse_CL"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Tanium - Compliance Findings",
                    "query": "TaniumComplyCompliance_CL\n | sort by TimeGenerated desc"
                },
                {
                    "description": "Tanium - Compliance Vulnerabilities",
                    "query": "TaniumComplyVulnerabilities_CL\n | sort by TimeGenerated desc"
                },
                {
                    "description": "Tanium - Defender Health",
                    "query": "TaniumDefenderHealth_CL\n | sort by TimeGenerated desc"
                },
                {
                    "description": "Tanium - Discover Unmanaged Assets",
                    "query": "TaniumDiscoverUnmanagedAssets_CL\n | sort by TimeGenerated desc"
                },
                {
                    "description": "Tanium - High Uptime",
                    "query": "TaniumHighUptime_CL\n | sort by TimeGenerated desc"
                },
                {
                    "description": "Tanium - Patch Coverage Status",
                    "query": "TaniumPatchCoverageStatus_CL\n | sort by TimeGenerated desc"
                },
                {
                    "description": "Tanium - Patch List Applicability",
                    "query": "TaniumPatchListApplicability_CL\n | sort by TimeGenerated desc"
                },
                {
                    "description": "Tanium - Patch List Compliance",
                    "query": "TaniumPatchListCompliance_CL\n | sort by TimeGenerated desc"
                },
                {
                    "description": "Tanium - SCCM Client Health",
                    "query": "TaniumSCCMClientHealth_CL\n | sort by TimeGenerated desc"
                },
                {
                    "description": "Tanium - Threat Response Alerts",
                    "query": "TaniumThreatResponse_CL\n | sort by TimeGenerated desc"
                }
            ],
            "dataTypes": [
                {
                    "name": "TaniumComplyCompliance_CL",
                    "lastDataReceivedQuery": "TaniumComplyCompliance_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
                },
                {
                    "name": "TaniumComplyVulnerabilities_CL",
                    "lastDataReceivedQuery": "TaniumComplyVulnerabilities_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
                },
                {
                    "name": "TaniumDefenderHealth_CL",
                    "lastDataReceivedQuery": "TaniumDefenderHealth_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
                },
                {
                    "name": "TaniumDiscoverUnmanagedAssets_CL",
                    "lastDataReceivedQuery": "TaniumDiscoverUnmanagedAssets_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
                },
                {
                    "name": "TaniumHighUptime_CL",
                    "lastDataReceivedQuery": "TaniumHighUptime_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
                },
                {
                    "name": "TaniumPatchCoverageStatus_CL",
                    "lastDataReceivedQuery": "TaniumPatchCoverageStatus_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
                },
                {
                    "name": "TaniumPatchListApplicability_CL",
                    "lastDataReceivedQuery": "TaniumPatchListApplicability_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
                },
                {
                    "name": "TaniumPatchListCompliance_CL",
                    "lastDataReceivedQuery": "TaniumPatchListCompliance_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
                },
                {
                    "name": "TaniumSCCMClientHealth_CL",
                    "lastDataReceivedQuery": "TaniumSCCMClientHealth_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
                },
                {
                    "name": "TaniumThreatResponse_CL",
                    "lastDataReceivedQuery": "TaniumThreatResponse_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "IsConnectedQuery",
                    "value": [
                        "union withsource=SourceTable\n\tTaniumComplyCompliance_CL,\n\tTaniumComplyVulnerabilities_CL,\n\tTaniumDefenderHealth_CL,\n\tTaniumDiscoverUnmanagedAssets_CL,\n\tTaniumHighUptime_CL,\n\tTaniumPatchCoverageStatus_CL,\n\tTaniumPatchListApplicability_CL,\n\tTaniumPatchListCompliance_CL,\n\tTaniumSCCMClientHealth_CL,\n\tTaniumThreatResponse_CL\n| summarize LastLogReceived = max(TimeGenerated) by SourceTable\n| summarize IsConnected = min(LastLogReceived) >= ago(24h)"
                    ]
                }
            ],
            "availability": {
                "status": 1
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "read and write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "write": true,
                            "read": true
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "Microsoft Entra",
                        "description": "Permission to create an app registration in Microsoft Entra ID."
                    },
                    {
                        "name": "Microsoft Azure",
                        "description": "Permission to assign Monitoring Metrics Publisher role on data collection rule (DCR)."
                    }
                ]
            },
            "instructionSteps": [
                {
                    "title": "1. Create ARM Resources and Provide the Required Permissions",
                    "description": "This connector enables your Tanium Server to push Basic Inventory data directly to Microsoft Sentinel via the Azure Monitor Ingestion API.",
                    "instructions": [
                        {
                            "type": "Markdown",
                            "parameters": {
                                "content": "#### Automated Configuration and Secure Data Ingestion with Entra Application \nClicking on \"Deploy\" will trigger the creation of Log Analytics table and a Data Collection Rule (DCR). \nIt will then create an Entra application, link the DCR to it, and set the entered secret in the application. This setup enables the Tanium data to be sent securely to the DCR using an Entra token."
                            }
                        },
                        {
                            "parameters": {
                                "label": "Deploy Tanium data connector resources",
                                "applicationDisplayName": "Tanium Connector Application"
                            },
                            "type": "DeployPushConnectorButton"
                        }
                    ]
                },
                {
                    "title": "2. Configure Tanium Connections",
                    "description": "Use the following parameters to configure the your Tanium Connections to push data to the workspace.",
                    "instructions": [
                        {
                            "parameters": {
                                "label": "Tenant ID (Directory ID)",
                                "fillWith": [
                                    "TenantId"
                                ]
                            },
                            "type": "CopyableLabel"
                        },
                        {
                            "parameters": {
                                "label": "Entra App Registration Application ID",
                                "fillWith": [
                                    "ApplicationId"
                                ],
                                "placeholder": "Deploy push connector to get the App Registration Application ID (aka Client Id)"
                            },
                            "type": "CopyableLabel"
                        },
                        {
                            "parameters": {
                                "label": "Entra App Registration Secret",
                                "fillWith": [
                                    "ApplicationSecret"
                                ],
                                "placeholder": "Deploy push connector to get the App Registration Secret (aka Client Secret)"
                            },
                            "type": "CopyableLabel"
                        },
                        {
                            "parameters": {
                                "label": "Data Collection Endpoint Uri",
                                "fillWith": [
                                    "DataCollectionEndpoint"
                                ],
                                "placeholder": "Deploy push connector to get the Data Collection Endpoint Uri"
                            },
                            "type": "CopyableLabel"
                        },
                        {
                            "parameters": {
                                "label": "Data Collection Rule Immutable ID",
                                "fillWith": [
                                    "DataCollectionRuleId"
                                ],
                                "placeholder": "Deploy push connector to get the Data Collection Rule Immutable ID"
                            },
                            "type": "CopyableLabel"
                        },
                        {
                            "parameters": {
                                "label": "Compliance Findings Logs Stream Name",
                                "value": "Custom-TaniumComplyCompliance"
                            },
                            "type": "CopyableLabel"
                        },
                        {
                            "parameters": {
                                "label": "Compliance Vulnerabilities Logs Stream Name",
                                "value": "Custom-TaniumComplyVulnerabilities"
                            },
                            "type": "CopyableLabel"
                        },
                        {
                            "parameters": {
                                "label": "Defender Health Logs Stream Name",
                                "value": "Custom-TaniumDefenderHealth"
                            },
                            "type": "CopyableLabel"
                        },
                        {
                            "parameters": {
                                "label": "Discover Unmanaged Assets Health Logs Stream Name",
                                "value": "Custom-TaniumDiscoverUnmanagedAssets"
                            },
                            "type": "CopyableLabel"
                        },
                        {
                            "parameters": {
                                "label": "High Uptime Logs Stream Name",
                                "value": "Custom-TaniumHighUptime"
                            },
                            "type": "CopyableLabel"
                        },
                        {
                            "parameters": {
                                "label": "Patch Coverage Status Logs Stream Name",
                                "value": "Custom-TaniumPatchCoverageStatus"
                            },
                            "type": "CopyableLabel"
                        },
                        {
                            "parameters": {
                                "label": "Patch List Applicability Logs Stream Name",
                                "value": "Custom-TaniumPatchListApplicability"
                            },
                            "type": "CopyableLabel"
                        },
                        {
                            "parameters": {
                                "label": "Patch List Compliance Logs Stream Name",
                                "value": "Custom-TaniumPatchListCompliance"
                            },
                            "type": "CopyableLabel"
                        },
                        {
                            "parameters": {
                                "label": "SCCM Client Health Logs Stream Name",
                                "value": "Custom-TaniumSCCMClientHealth"
                            },
                            "type": "CopyableLabel"
                        },
                        {
                            "parameters": {
                                "label": "Threat Response Alerts Logs Stream Name",
                                "value": "Custom-TaniumThreatResponse"
                            },
                            "type": "CopyableLabel"
                        }
                    ]
                },
                {
                    "title": "3. Create the Connection in Tanium",
                    "description": "After you've successfully deployed the data connector in Azure, create the required connection in your Tanium server in the Connect Module. For more information regarding the Connect module see [Tanium Help](https://help.tanium.com/bundle/ug_connect_cloud/page/connect/overview.html)",
                    "instructions": [
                        {
                            "type": "Markdown",
                            "parameters": {
                                "content": "1. Download the [connection import file](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tanium/Data%20Connectors/connect-module-connections.json).\n1. Replace the placeholders with the parameters displayed above.\n1. In your Tanium Server open the Connect Module.\n1. Use the import functionality to import you new connections."
                            }
                        }
                    ]
                }
            ]
        }
    }
}