{
  "name": "AlibabaCloudNetworkingConnector",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "AlibabaCloudNetworkingConnector",
      "title": "Alibaba Cloud Networking Data Connector (via Codeless Connector Framework)",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The Alibaba Cloud Networking data connector provides the capability to ingest [Alibaba Cloud](https://www.alibabacloud.com/) networking data into Microsoft Sentinel through the Simple Log Service (SLS) REST API. Refer to [API documentation](https://www.alibabacloud.com/help/en/sls/developer-reference/api-sls-2020-12-30-endpoint) for more information. The connector provides the ability to get VPC Flow Logs, WAF Logs, and API Gateway Logs from Alibaba Cloud.",
      "graphQueriesTableName": "AlibabaCloudVPCFlowLogs",
      "graphQueries": [
        {
          "metricName": "Total data received",
          "legend": "Alibaba Cloud Networking Data",
          "baseQuery": "{{graphQueriesTableName}}"
        },
        {
          "metricName": "Total WAF Logs data received",
          "legend": "WAF Logs",
          "baseQuery": "AlibabaCloudWAFLogs"
        },
        {
          "metricName": "Total API Gateway Logs data received",
          "legend": "API Gateway Logs",
          "baseQuery": "AlibabaCloudAPIGatewayLogs"
        }
      ],
      "sampleQueries": [
        {
          "description": "All Alibaba Cloud VPC Flow Logs",
          "query": "{{graphQueriesTableName}}\n| sort by TimeGenerated desc"
        },
        {
          "description": "Get sample of Alibaba Cloud VPC Flow Logs",
          "query": "{{graphQueriesTableName}}\n| take 10"
        },
        {
          "description": "Summary by action",
          "query": "{{graphQueriesTableName}}\n| summarize count() by Action"
        },
        {
          "description": "All Alibaba Cloud WAF Logs",
          "query": "AlibabaCloudWAFLogs\n| sort by TimeGenerated desc"
        },
        {
          "description": "All Alibaba Cloud API Gateway Logs",
          "query": "AlibabaCloudAPIGatewayLogs\n| sort by TimeGenerated desc"
        }
      ],
      "dataTypes": [
        {
          "name": "AlibabaCloudVPCFlowLogs",
          "lastDataReceivedQuery": "AlibabaCloudVPCFlowLogs\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "AlibabaCloudWAFLogs",
          "lastDataReceivedQuery": "AlibabaCloudWAFLogs\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "AlibabaCloudAPIGatewayLogs",
          "lastDataReceivedQuery": "AlibabaCloudAPIGatewayLogs\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "isPreview": false,
        "status": 1
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true,
              "action": false
            }
          }
        ],
        "customs": [
          {
            "name": "Alibaba Cloud SLS API access",
            "description": "**Alibaba Cloud Simple Log Service** access is required for the SLS API."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Configure access to AliCloud SLS API",
          "description": "Before using the API, you need to prepare your identity account and access key pair to effectively access the API.\n1. We recommend that you use a Resource Access Management (RAM) user to call API operations. For more information, see [create a RAM user and authorize the RAM user to access Simple Log Service](https://www.alibabacloud.com/help/sls/create-a-ram-user-and-authorize-the-ram-user-to-access-log-service).\n2. Obtain the access key pair for the RAM user. For details see [get Access Key pair](https://www.alibabacloud.com/help/ram/user-guide/create-an-accesskey-pair).\n\nNote the access key pair details for the next step.",
          "instructions": [
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnName": "LogStore",
                    "columnValue": "properties.addOnAttributes.logStore"
                  },
                  {
                    "columnName": "LogProject",
                    "columnValue": "properties.addOnAttributes.logProject"
                  },
                  {
                    "columnName": "LogRegion",
                    "columnValue": "properties.addOnAttributes.logRegion"
                  },
                  {
                    "columnName": "Stream",
                    "columnValue": "properties.dataType"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "label": "Add stream",
                "title": "Add Alibaba Data Stream",
                "subtitle": "Connect to Alibaba Cloud Data",
                "contextPaneType": "DataConnectorsContextPane",
                "instructionSteps": [
                  {
                    "instructions": [
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Access Key ID",
                          "placeholder": "Alibaba Cloud Access Key ID",
                          "type": "password",
                          "name": "accessKeyId",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Access Key Secret",
                          "placeholder": "Alibaba Cloud Access Key Secret",
                          "type": "password",
                          "name": "accessKeySecret",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Dropdown",
                        "parameters": {
                          "label": "Streams",
                          "name": "dataStream",
                          "options": [
                            {
                              "key": "AlibabaCloudVPCFlowLogs",
                              "text": "VPC Flow Logs"
                            },
                            {
                              "key": "AlibabaCloudWAFLogs",
                              "text": "WAF Flow Logs"
                            },
                            {
                              "key": "AlibabaCloudAPIGatewayLogs",
                              "text": "API Gateway Logs"
                            }
                          ],
                          "required": true
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Log Store name",
                          "placeholder": "Enter Log Store name",
                          "type": "text",
                          "name": "logStore",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Log Project name",
                          "placeholder": "Enter Log Project name",
                          "type": "text",
                          "name": "logProject",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Log Region",
                          "placeholder": "Enter Log Region where the Log Store is located, e.g. cn-shenzhen",
                          "type": "text",
                          "name": "logRegion",
                          "validations": {
                            "required": true
                          }
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ]
    }
  }
}