{
    "id": "Authomize",
    "title": "Authomize Data Connector",
    "publisher": "Authomize",
    "descriptionMarkdown": "The Authomize Data Connector provides the capability to ingest custom log types from Authomize into Microsoft Sentinel.",
    "additionalRequirementBanner": "This data connector is not currently dependant on a parser. You will need to follow the steps to use the alias **Authomize_v2_CL** in queries and workbooks. [Follow steps to get this log event file](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Authomize/Data%20Connectors/readme.md)",
    "graphQueries": [
      {
        "metricName": "Total data received",
        "legend": "Authomize_v2_CL",
        "baseQuery": "Authomize_v2_CL"
      }
    ],
    "sampleQueries": [
      {
        "description" : "Number of Incidents by Severity (Critical, High, Medium, Low",
        "query": "Authomize_v2_CL\n | summarize count() by severity_s"
      },
      {
        "description" : "Top 10 policies and number of incidents",
        "query": "Authomize_v2_CL\n | summarize count() by policy_name_s\n | top 10 by count_"
      }
    ],
    "dataTypes": [
      {
        "name": "Authomize_v2_CL",
        "lastDataReceivedQuery": "Authomize_v2_CL\n | summarize TimeGenerated=max(TimeGenerated)"
      }
    ],
    "connectivityCriterias": [
      {
        "type": "IsConnectedQuery",
        "value": [
          "Authomize_v2_CL\n | summarize LastLogReceived=max(TimeGenerated)\n | project ConnectionState=iff(LastLogReceived > ago(30d), 'Connected', 'Disconnected')"
        ]
      }
    ],
    "availability": {
      "status": 1,
      "isPreview": false
    },
    "permissions": {
      "resourceProvider": [
        {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
      ],
      "customs": [
        {
                "name": "Include custom pre-requisites if the connectivity requires - else delete customs",
                "description": "Description for any custom pre-requisite"
        }
    ]
    },
    "instructionSteps": [
      {
        "title": "1. Locate your Authomize API key",
        "description": "Follow the setup instructions [located under Data Connectors for Authomize](https://github.com/authomize/Open-ITDR/blob/main/Open-Connectors/Platform/Azure-Sentinel/Data%20Connectors/readme.md)."
      },
      {
        "title": "2. Deploy the Authomize data connector using the setup instructions.",
        "description": "Follow the Instructions on [deploying the data connector to ingest data from Authomize](https://github.com/authomize/Open-ITDR/blob/main/Open-Connectors/Platform/Azure-Sentinel/Data%20Connectors/readme.md)."
      },
      {
        "title": "3. Finalize your setup",
        "description": "Validate that your script is running. Simple instructions are located under the [Authomize Data Connector area](https://github.com/authomize/Open-ITDR/blob/main/Open-Connectors/Platform/Azure-Sentinel/Data%20Connectors/readme.md)."
      }
    ],
    "metadata": {
      "version": "1.0.0",
      "kind": "dataConnector"
    }
  }