{
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "apiVersion": "2024-09-01",
    "name": "MicrosoftCopilot",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "MicrosoftCopilot",
            "title": "Microsoft Copilot",
            "publisher": "Microsoft",
            "logo": "Copilot.svg",
            "descriptionMarkdown": "The Microsoft Copilot logs connector in Microsoft Sentinel enables seamless ingestion of Copilot-generated activity logs from M365 Copilot and Security Copilot into Microsoft Sentinel for advanced threat detection, investigation and response. It collects telemetry from Microsoft Copilot services such as usage data and system responses and ingests into Microsoft Sentinel, allowing security teams to monitor for misuse, detect anomalies, and maintain compliance with organizational policies.",
            "graphQueries": [
                {
                    "metricName": "Total data received",
                    "legend": "Microsoft Copilot",
                    "baseQuery": "CopilotActivity"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Microsoft Copilot Logs",
                    "query": "CopilotActivity\n            | sort by TimeGenerated"
                }
            ],
            "connectivityCriteria": [
                {
                "type": "HasDataConnectors"
                }
            ],
            "dataTypes": [
                {
                    "name": "CopilotActivity",
                    "lastDataReceivedQuery": "CopilotActivity\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                }
            ],
            "availability": {
                "status": 1,
                "isPreview": false
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "read and write permissions.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "read": true,
                            "write": true,
                            "delete": true
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "Tenant Permissions",
                        "description": "'Security Administrator' or 'Global Administrator' on the workspace's tenant."
                    }
                ]
            },
            "instructionSteps": [
                {
                    "title": "Connect Microsoft Copilot audit logs to Microsoft Sentinel",
                    "description": "This connector uses the Office Management API to get your Microsoft Copilot audit logs. The logs will be stored and processed in your existing Microsoft Sentinel workspace. You can find the data in the **CopilotActivity** table.",
                    "instructions": [
                        {
                            "type": "ConnectionToggleButton",
                            "parameters": {
                                "connectLabel": "Connect",
                                "name": "toggle"
                            }
                        }
                    ]
                }
            ]
        }
    }
}