{
  "name": "AkamaiGuardicore",
  "apiVersion": "2025-09-01",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "[parameters('workspace-location')]",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "AkamaiGuardicore",
      "title": "Akamai Guardicore",
      "publisher": "Akamai",
      "descriptionMarkdown": "The Akamai Guardicore connector uses the Codeless Connector Framework (CCF) to import Agents, Assets, Applications, and Policy Rules from a Guardicore Centra instance into Microsoft Sentinel via Data Collection Rule (DCR) ingestion. The connector polls every 10 minutes via Microsoft Sentinel's CCF runtime; no Azure Function App is deployed.",
      "graphQueries": [
        {
          "metricName": "Total assets",
          "legend": "GuardicoreAssets_CL",
          "baseQuery": "GuardicoreAssets_CL"
        },
        {
          "metricName": "Total agents",
          "legend": "GuardicoreAgents_CL",
          "baseQuery": "GuardicoreAgents_CL"
        },
        {
          "metricName": "Total policy rules",
          "legend": "GuardicorePolicyRules_CL",
          "baseQuery": "GuardicorePolicyRules_CL"
        },
        {
          "metricName": "Project and Application status",
          "legend": "GuardicoreApplications_CL",
          "baseQuery": "GuardicoreApplications_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "All Applications",
          "query": "GuardicoreApplications_CL\n| summarize arg_max(TimeGenerated, *)"
        },
        {
          "description": "All Assets",
          "query": "GuardicoreAssets_CL\n| summarize arg_max(TimeGenerated, *)"
        },
        {
          "description": "All Agents",
          "query": "GuardicoreAgents_CL\n| summarize arg_max(TimeGenerated, *)"
        },
        {
          "description": "All Policy Rules",
          "query": "GuardicorePolicyRules_CL\n| summarize arg_max(TimeGenerated, *)"
        }
      ],
      "dataTypes": [
        {
          "name": "GuardicoreApplications_CL",
          "lastDataReceivedQuery": "GuardicoreApplications_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
          "name": "GuardicoreAssets_CL",
          "lastDataReceivedQuery": "GuardicoreAssets_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
          "name": "GuardicoreAgents_CL",
          "lastDataReceivedQuery": "GuardicoreAgents_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
          "name": "GuardicorePolicyRules_CL",
          "lastDataReceivedQuery": "GuardicorePolicyRules_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and write permissions on the workspace are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": true,
              "action": false
            }
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect Akamai Guardicore to Microsoft Sentinel",
          "description": "**Prerequisites**\n\n1. You must have a reachable Akamai Guardicore Centra management instance with API access enabled.\n2. Create (or obtain) an API user in Guardicore Centra with the **Read-only** role. This account must be authorized to call `/api/v3.0/authenticate`, `/api/v3.0/agents`, `/api/v3.0/assets`, `/api/v3.0/workflow/projects`, and `/api/v3.0/visibility/policy/rules`.\n3. Have the Guardicore management URL (for example `https://<tenant>.cloud.guardicore.com`) and the service-account username and password ready.\n4. The connector polls every 10 minutes via Microsoft Sentinel's CCF runtime. No Azure Function App is deployed.\n\nProvide your Guardicore Centra service-account details and click **Connect** to start polling.",
          "instructions": [
            {
              "type": "Textbox",
              "parameters": {
                "label": "Guardicore Management URL",
                "placeholder": "https://<tenant>.cloud.guardicore.com",
                "type": "text",
                "name": "guardicoreUrl"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Guardicore Username",
                "placeholder": "service-account username",
                "type": "text",
                "name": "guardicoreUser"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Guardicore Password",
                "placeholder": "service-account password",
                "type": "password",
                "name": "guardicorePassword"
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "connectLabel": "Connect",
                "disconnectLabel": "Disconnect",
                "name": "toggle"
              }
            }
          ]
        }
      ]
    }
  }
}