{
  "name": "CybersixgillAlertsCCFConnector",
  "apiVersion": "2025-07-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "CybersixgillAlertsCCFConnector",
      "title": "Cybersixgill Actionable Alerts (via Codeless Connector Framework)",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The Cybersixgill Actionable Alerts data connector provides the capability to ingest [Cybersixgill](https://cybersixgill.com/) actionable alerts into Microsoft Sentinel through the REST API. The connector provides the ability to get actionable alerts from the Cybersixgill platform and analyze them in Microsoft Sentinel.",
      "graphQueriesTableName": "CyberSixgillAlertsV2_CL",
      "graphQueries": [
        {
          "metricName": "Total Actionable Alerts collected",
          "legend": "All Actionable Alerts",
          "baseQuery": "CyberSixgillAlertsV2_CL"
        },
        {
          "metricName": "High Severity Alerts",
          "legend": "High Severity Alerts",
          "baseQuery": "CyberSixgillAlertsV2_CL | where Severity >= 7"
        },
        {
          "metricName": "Sub-alerts expanded (parser)",
          "legend": "Parent + Sub-alerts (fan-out)",
          "baseQuery": "CyberSixgillAlertsExpanded"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get sample of 20 recent Actionable Alerts",
          "query": "CyberSixgillAlertsV2_CL\n| take 20"
        },
        {
          "description": "Alerts by Threat Level",
          "query": "CyberSixgillAlertsV2_CL\n| summarize count() by ThreatLevel"
        }
      ],
      "dataTypes": [
        {
          "name": "CyberSixgillAlertsV2_CL",
          "lastDataReceivedQuery": "CyberSixgillAlertsV2_CL\n| where TimeGenerated > ago(6h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "isPreview": true,
        "status": 1
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true,
              "action": false
            }
          }
        ],
        "customs": [
          {
            "name": "Cybersixgill API Credentials",
            "description": "**Client ID**, **Client Secret**, and **Organization ID** are required for OAuth 2.0 authentication. These credentials can be generated from the [Cybersixgill portal](https://portal.cybersixgill.com/) under the **API Configuration** section."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect Cybersixgill Actionable Alerts to Microsoft Sentinel",
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "To gather data from Cybersixgill, you need to provide the following credentials:"
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "**1. API Base URL** - The base URL for the Cybersixgill API (e.g. `https://api.cybersixgill.com`)."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "**2. Client ID** - OAuth 2.0 Client ID for API authentication."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "**3. Client Secret** - OAuth 2.0 Client Secret for API authentication."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "**4. Organization ID** - The Cybersixgill organization identifier for the tenant whose alerts you want to ingest."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "To obtain these credentials, log in to the [Cybersixgill portal](https://portal.cybersixgill.com/) and navigate to **API Configuration**. Create a new API application to generate the Client ID and Client Secret. Your Organization ID is available in your account settings."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "**Multi-tenant support:** This connector supports ingesting Actionable Alerts from multiple Cybersixgill organizations in parallel. Click **Add Connection** once per organization, supplying that organization's API Base URL, credentials, and Organization ID. Each connection is tracked and managed independently in the grid below."
              }
            },
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnName": "Organization ID",
                    "columnValue": "properties.addOnAttributes.organizationId"
                  },
                  {
                    "columnName": "API Base URL",
                    "columnValue": "properties.addOnAttributes.baseUrl"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "isPrimary": true,
                "label": "Add Connection",
                "title": "Configure Cybersixgill API Connection",
                "subtitle": "Connect to a Cybersixgill organization to ingest Actionable Alerts",
                "contextPaneType": "DataConnectorsContextPane",
                "instructionSteps": [
                  {
                    "instructions": [
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "API Base URL",
                          "placeholder": "https://api.cybersixgill.com",
                          "type": "text",
                          "name": "baseUrl",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Client ID",
                          "placeholder": "Your Cybersixgill Client ID",
                          "type": "text",
                          "name": "clientId",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Client Secret",
                          "placeholder": "Your Cybersixgill Client Secret",
                          "type": "password",
                          "name": "clientSecret",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Organization ID",
                          "placeholder": "Your Cybersixgill Organization ID",
                          "type": "text",
                          "name": "organizationId",
                          "validations": {
                            "required": true
                          }
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ],
      "isConnectivityCriteriasMatchSome": true
    }
  }
}