{
    "name": "GCPFirewallLogsCCPDefinition",
    "apiVersion": "2022-09-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "GCPFirewallLogsCCPDefinition",
            "title": "GCP Pub/Sub Firewall Logs",
            "publisher": "Microsoft",
            "descriptionMarkdown": "The Google Cloud Platform (GCP) firewall logs, enable you to capture network inbound and outbound activity to monitor access and detect potential threats across Google Cloud Platform (GCP) resources.",
            "graphQueriesTableName": "GCPFirewallLogs",
            "graphQueries": [
                {
                    "metricName": "Total events received",
                    "legend": "GCP Pub/Sub Firewall Logs",
                    "baseQuery": "{{graphQueriesTableName}}"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Get Sample of GCP Firewall Logs",
                    "query": "{{graphQueriesTableName}}\n | take 10"
                }
            ],
            "dataTypes": [
                {
                    "name": "{{graphQueriesTableName}}",
                    "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                }
            ],
            "availability": {
                "status": 1,
                "isPreview": false
            },
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "read": true,
                            "write": true,
                            "delete": true,
                            "action": false
                        }
                    }
                  
                ]
            },
            "instructionSteps": [
                {
                    "instructions": [
                        {
                            "type": "MarkdownControlEnvBased",
                            "parameters": {
                                "prodScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation)\n Connector tutorial: [Link to tutorial](https://learn.microsoft.com/en-us/azure/sentinel/connect-google-cloud-platform?tabs=terraform%2Cauditlogs#gcp-authentication-setup) .",
                                "govScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Gov Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov)\n Connector tutorial: [Link to tutorial](https://learn.microsoft.com/en-us/azure/sentinel/connect-google-cloud-platform?tabs=terraform%2Cauditlogs#gcp-authentication-setup)."
                            }
                        },
                        {
                            "type": "CopyableLabel",
                            "parameters": {
                                "label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.",
                                "fillWith": [
                                    "TenantId"
                                ],
                                "name": "TenantId",
                                "disabled": true
                            }
                        },
                        {
                            "type": "Markdown",
                            "parameters": {
                                "content": "#### 2. Enable Firewall logs \nIn your GCP account, navigate to the Firewall section. Here, you can either create a new rule or edit an existing one that you want to monitor. Once you open the rule, switch the toggle button under the **Logs** section to **On**, and save the changes.\n\nFor more information: [Link to documentation](https://cloud.google.com/firewall/docs/using-firewall-rules-logging?_gl=1*1no0nhk*_ga*NDMxNDIxODI3LjE3MjUyNjUzMzc.*_ga_WH2QY8WWF5*MTcyNTUyNzc4MS4xMS4xLjE3MjU1MjgxNTIuNDYuMC4w)"
                            }
                        },
                        {
                            "type": "Markdown",
                            "parameters": {
                                "content": "#### 3. Connect new collectors \n To enable GCP Firewall Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect."
                            }
                        },
                        {
                            "type": "GCPGrid",
                            "parameters": {}
                        },
                        {
                            "type": "GCPContextPane",
                            "parameters": {}
                        }
                    ]
                }
            ]
        }
    }
}