{
  "name": "SemperisLightningCCFConnector",
  "apiVersion": "2025-07-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "SemperisLightningCCFConnector",
      "title": "Semperis Lightning (via Codeless Connector Framework)",
      "publisher": "Semperis",
      "descriptionMarkdown": "The [Semperis Lightning](https://www.semperis.com/platform/) connector uses the Codeless Connector Framework to ingest Semperis Lightning identity security data into Microsoft Sentinel. One configured instance represents one Semperis zone/API-key pair and deploys one RestApiPoller per supported stream into dedicated `*V2_CL` tables, so it can run alongside the Azure Functions connector.",
      "graphQueries": [
        {
          "metricName": "LightningTier0NodesV2_CL",
          "legend": "LightningTier0NodesV2_CL",
          "baseQuery": "LightningTier0NodesV2_CL"
        },
        {
          "metricName": "LightningAttackPathsV2_CL",
          "legend": "LightningAttackPathsV2_CL",
          "baseQuery": "LightningAttackPathsV2_CL"
        },
        {
          "metricName": "LightningAttackPathLinksV2_CL",
          "legend": "LightningAttackPathLinksV2_CL",
          "baseQuery": "LightningAttackPathLinksV2_CL"
        },
        {
          "metricName": "LightningTier0AttackersV2_CL",
          "legend": "LightningTier0AttackersV2_CL",
          "baseQuery": "LightningTier0AttackersV2_CL"
        },
        {
          "metricName": "LightningIndicatorExecutionsV2_CL",
          "legend": "LightningIndicatorExecutionsV2_CL",
          "baseQuery": "LightningIndicatorExecutionsV2_CL"
        },
        {
          "metricName": "LightningIOEsMetadataV2_CL",
          "legend": "LightningIOEsMetadataV2_CL",
          "baseQuery": "LightningIOEsMetadataV2_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "Recent LightningTier0NodesV2_CL data",
          "query": "LightningTier0NodesV2_CL | take 10"
        },
        {
          "description": "Recent LightningAttackPathsV2_CL data",
          "query": "LightningAttackPathsV2_CL | take 10"
        },
        {
          "description": "Recent LightningAttackPathLinksV2_CL data",
          "query": "LightningAttackPathLinksV2_CL | take 10"
        },
        {
          "description": "Recent LightningTier0AttackersV2_CL data",
          "query": "LightningTier0AttackersV2_CL | take 10"
        },
        {
          "description": "Recent LightningIndicatorExecutionsV2_CL data",
          "query": "LightningIndicatorExecutionsV2_CL | take 10"
        },
        {
          "description": "Recent LightningIOEsMetadataV2_CL data",
          "query": "LightningIOEsMetadataV2_CL | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "LightningTier0NodesV2_CL",
          "lastDataReceivedQuery": "LightningTier0NodesV2_CL | summarize Time=max(TimeGenerated) | where isnotempty(Time)"
        },
        {
          "name": "LightningAttackPathsV2_CL",
          "lastDataReceivedQuery": "LightningAttackPathsV2_CL | summarize Time=max(TimeGenerated) | where isnotempty(Time)"
        },
        {
          "name": "LightningAttackPathLinksV2_CL",
          "lastDataReceivedQuery": "LightningAttackPathLinksV2_CL | summarize Time=max(TimeGenerated) | where isnotempty(Time)"
        },
        {
          "name": "LightningTier0AttackersV2_CL",
          "lastDataReceivedQuery": "LightningTier0AttackersV2_CL | summarize Time=max(TimeGenerated) | where isnotempty(Time)"
        },
        {
          "name": "LightningIndicatorExecutionsV2_CL",
          "lastDataReceivedQuery": "LightningIndicatorExecutionsV2_CL | summarize Time=max(TimeGenerated) | where isnotempty(Time)"
        },
        {
          "name": "LightningIOEsMetadataV2_CL",
          "lastDataReceivedQuery": "LightningIOEsMetadataV2_CL | summarize Time=max(TimeGenerated) | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": true
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": true,
              "action": false
            }
          }
        ],
        "customs": [
          {
            "name": "Semperis Lightning API key",
            "description": "A valid API key and the matching Semperis zone are required. The key is collected as a password field and is not stored in this repository."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Manage Semperis Lightning connections",
          "description": "Add one instance for each Semperis tenant/zone/API-key pair.",
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "This candidate uses the CCF multi-instance grid/context-pane pattern. Each instance appears as six poller rows in the grid. IOE execution results are not active because the public connector performs a dynamic second request per execution, which RestApiPoller cannot represent."
              }
            },
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnName": "Connection Name",
                    "columnValue": "properties.addOnAttributes.SemperisInstanceName"
                  },
                  {
                    "columnName": "Zone",
                    "columnValue": "properties.addOnAttributes.SemperisZone"
                  },
                  {
                    "columnName": "Data Stream",
                    "columnValue": "properties.addOnAttributes.SemperisDataStream"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "isPrimary": true,
                "label": "Add new instance",
                "title": "Add Semperis Lightning instance",
                "subtitle": "Configure a Semperis tenant connection",
                "contextPaneType": "DataConnectorsContextPane",
                "instructionSteps": [
                  {
                    "title": "Instance details",
                    "instructions": [
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Connection Name",
                          "placeholder": "Semperis-Production",
                          "type": "text",
                          "name": "connectionName",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Dropdown",
                        "parameters": {
                          "label": "Semperis Zone",
                          "name": "zone",
                          "options": [
                            {
                              "key": "na",
                              "text": "North America (na)"
                            },
                            {
                              "key": "eu",
                              "text": "Europe (eu)"
                            }
                          ],
                          "placeholder": "Select a zone",
                          "isMultiSelect": false,
                          "required": true,
                          "defaultAllSelected": false
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Semperis API Key",
                          "placeholder": "API key",
                          "type": "password",
                          "name": "apiKey",
                          "validations": {
                            "required": true
                          }
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ],
      "isConnectivityCriteriasMatchSome": false
    }
  }
}