{
  "name": "GCPNATLogsCCPDefinition",
  "apiVersion": "2025-03-01",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "GCPNATLogsCCPDefinition",
      "title": "Google Cloud Platform NAT (via Codeless Connector Framework)",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The Google Cloud Platform NAT data connector provides the capability to ingest Cloud NAT Audit logs and Cloud NAT Traffic logs into Microsoft Sentinel using the Compute Engine API. Refer the [Product overview](https://cloud.google.com/nat/docs/overview) document for more details.",
      "graphQueries": [
        {
          "metricName": "Total events received",
          "legend": "GCP NAT Audit Logs",
          "baseQuery": "GCPNATAudit"
        },
        {
          "metricName": "Total events received",
          "legend": "GCP NAT Logs",
          "baseQuery": "GCPNAT"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get Sample of GCP NAT logs",
          "query": "GCPNAT\n | take 10"
        },
        {
          "description": "Get Sample of GCP NAT Audit logs",
          "query": "GCPNATAudit\n | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "GCPNAT",
          "lastDataReceivedQuery": "GCPNAT\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "GCPNATAudit",
          "lastDataReceivedQuery": "GCPNATAudit\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": true,
              "action": false
            }
          }
        ]
      },
      "instructionSteps": [
        {
          "instructions": [
            {
              "type": "MarkdownControlEnvBased",
              "parameters": {
                "prodScript": "#### 1. Setup the GCP environment \n Ensure to have the following resources from the GCP Console:\n Project ID, Project Name, GCP Subscription name for the project, Workload Identity Pool ID, Workspace Identity Provider ID, and a Service Account to establish the connection.\n For more information, refer the [Connector tutorial](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformNAT/Data%20Connectors/README.md) for log setup and authentication setup tutorial.\n\n Find the Log set up script [**here**](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPCloudNATLogsSetup/GCPCloudNATLogsSetup.tf)\n & the Authentication set up script [**here**](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPInitialAuthenticationSetup)",
                "govScript": "#### 1. Setup the GCP environment \n Ensure to have the following resources from the GCP Console:\n Project ID, Project Name, GCP Subscription name for the project, Workload Identity Pool ID, Workspace Identity Provider ID, and a Service Account to establish the connection.\n For more information, refer the [Connector tutorial](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformNAT/Data%20Connectors/README.md) for log setup and authentication setup tutorial.\n\n Find the Log set up script [**here**](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov/GCPCloudNATLogsSetup/GCPCloudNATLogsSetup.tf)\n & the Authentication set up script [**here**](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov/GCPInitialAuthenticationSetupGov)"
              }
            },
            {
              "type": "CopyableLabel",
              "parameters": {
                "label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.",
                "fillWith": [
                  "TenantId"
                ],
                "name": "TenantId",
                "disabled": true
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### 2. Enable NAT logs \n In the Google Cloud Console, enable cloud logging if not enabled previously, and save the changes. Navigate to Cloud NAT section and click on Add origin to create backends as per link provided below. \n\n Reference Link: [Link to documentation](https://cloud.google.com/nat/docs/monitoring)"
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### 3. Connect new collectors \n To enable GCP Cloud NAT Logs for Microsoft Sentinel, click on Add new collector button, provide the required information in the pop up and click on Connect."
              }
            },
            {
              "type": "GCPGrid",
              "parameters": {}
            },
            {
              "type": "GCPContextPane",
              "parameters": {}
            }
          ],
          "title": "Connect GCP NAT to Microsoft Sentinel\n"
        }
      ]
    }
  }
}