{
    "name": "RSAIDPlus_AdmingLogs_Connector",
    "apiVersion": "2025-07-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "id": "RSAIDPlus_AdmingLogs_Connector",
    "properties": {
        "connectorUiConfig": {
            "id": "RSAIDPlus_AdmingLogs_Connector",
            "title": "RSA ID Plus Admin Logs Connector",
            "publisher": "RSA",
            "descriptionMarkdown": "The RSA ID Plus AdminLogs Connector provides the capability to ingest [Cloud Admin Console Audit Events](https://community.rsa.com/s/article/Cloud-Administration-Event-Log-API-5d22ba17) into Microsoft Sentinel using Cloud Admin APIs.",
            "graphQueriesTableName": "RSAIDPlus_AdminLogs_CL",
            "graphQueries": [
                {
                    "metricName": "Events Received",
                    "legend": "RSA ID Plus Admin Activity Events Received",
                    "baseQuery": "{{graphQueriesTableName}}"
                }
            ],
            "sampleQueries": [
                {
                    "description": "All RSA ID Plus Admin Activity Logs",
                    "query": "{{graphQueriesTableName}}\n| sort by TimeGenerated desc"
                },
                {
                    "description": "Total Events",
                    "query": "{{graphQueriesTableName}}\n| summarize count() by eventId"
                }
            ],
            "dataTypes": [
                {
                    "name": "{{graphQueriesTableName}}",
                    "lastDataReceivedQuery": "{{graphQueriesTableName}}\n| summarize Time = max(TimeGenerated)\n| where isnoempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "defaultDataCollectionConfiguration": {
                "dataCollectionEndpoint": "{{dataCollectionEndpoint}}",
                "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}"
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "write": true,
                            "read": true,
                            "delete": true
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "RSA ID Plus API Authentication",
                        "description": "To access the Admin APIs, a valid Base64URL encoded JWT token, signed with the client's Legacy Administration API key is required."
                    }
                ]
            },
            "instructionSteps": [
                {
                    "description": ">**NOTE:** This connector uses Codeless Connector Framework (CCF) to connect to the RSA ID Plus Cloud Admin APIs to pull logs into Microsoft Sentinel."
                },
                {
                    "title": "**STEP 1** - Create Legacy Admin API Client in Cloud Admin Console.",
                    "description": "Follow steps mentioned in this [page](https://community.rsa.com/s/article/Manage-Legacy-Clients-API-Keys-a89c9cbc#)."
                },
                {
                    "title": "**STEP 2** - Generate the Base64URL encoded JWT Token.",
                    "description": "Follow the steps mentioned in this [page](https://community.rsa.com/s/article/Authentication-for-the-Cloud-Administration-APIs-a04e3fb9) under the header 'Legacy Administration API'."
                },
                {
                    "title": "**STEP 3** - Configure the Cloud Admin API to start ingesting Admin event logs into Microsoft Sentinel.",
                    "description" : "Provide the required values below:\n",
                    "instructions": [
                        {
                            "type": "Textbox",
                            "parameters" : {
                                "label": "Admin API URL",
                                "placeholder": "https://<tenantName>.access.securid.com/AdminInterface/restapi/v1/adminlog/exportLogs",
                                "type": "text",
                                "name": "Admin-API-URL"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters" : {
                                "label": "JWT Token",
                                "placeholder": "Enter your JWT Token",
                                "type": "password",
                                "name": "access_token"
                            }
                        }
                    ]
                },
                {
                    "title": "**STEP 4** - Click Connect",
                    "description": "Verify all the fields above were filled in correctly. Press Connect to start the connector.",
                    "instructions": [
                        {
                            "type": "ConnectionToggleButton",
                            "parameters": {
                                "connectLabel": "Connect",
                                "name": "connect"
                            }
                        }
                    ]
                }

            ]
        }
    }
}