{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workspace": {
            "defaultValue": "",
            "type": "string",
            "metadata": {
                "description": "the log analytics workspace enabled for Microsoft Sentinel"
            }
        }
    },
    "variables": {
        "DCRName": "DruvaDCR",
        "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
        "_solutionName": "Druva Events Connector",
        "_solutionVersion": "1.0.0",
        "_solutionAuthor": "Druva",
        "_packageIcon": "icon icon icon icon",  
        "_solutionId": "azuresentinel.azure-sentinel-solution-azuresentinel.azure-sentinel-Druva", 
        "dataConnectorVersionConnectorDefinition": "1.0.0",
        "dataConnectorVersionConnections": "1.0.0",
        "_solutionTier": "Druva",
        "_dataConnectorContentIdConnectorDefinition": "DruvaDataConnectorDefinition", 
        "dataConnectorTemplateNameConnectorDefinition": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition')))]",
        "_dataConnectorContentIdConnections": "DruvaDataConnections",
        "dataConnectorTemplateNameConnections": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections')))]",
        "location": "[resourceGroup().location]",
        "subscriptionId": "[last(split(subscription().id, '/'))]",
        "druvaSecurityEventsTableName": "DruvaSecurityEvents_CL",
        "druvaPlatformEventsTableName": "DruvaPlatformEvents_CL",
        "druvaInsyncEventsTableName": "DruvaInsyncEvents_CL"
    },
    
    "resources": [
       
        {
            "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
            "apiVersion": "2023-04-01-preview",
            "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition'), variables('dataConnectorVersionConnectorDefinition'))]",
            "location": "[variables('location')]",
            "dependsOn": [
                "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
            ],
            "properties": {
                "contentId": "[variables('_dataConnectorContentIdConnectorDefinition')]",
                "displayName": "[concat(variables('_solutionName'), variables('dataConnectorTemplateNameConnectorDefinition'))]",
                "contentKind": "DataConnector",
                "mainTemplate": {
                    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                    "contentVersion": "[variables('dataConnectorVersionConnectorDefinition')]",
                    "parameters": {},
                    "variables": {},
                    "resources": [
                        {
                            "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition')))]",
                            "apiVersion": "2022-01-01-preview",
                            "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
                            "properties": {
                                "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition'))]",
                                "contentId": "[variables('_dataConnectorContentIdConnectorDefinition')]",
                                "kind": "DataConnector",
                                "version": "[variables('dataConnectorVersionConnectorDefinition')]",
                                "source": {
                                    "sourceId": "[variables('_solutionId')]",
                                    "name": "[variables('_solutionName')]",
                                    "kind": "Solution"
                                },
                                "author": {
                                    "name": "[variables('_solutionAuthor')]"
                                },
                                "support": {
                                    "name": "[variables('_solutionAuthor')]",
                                    "tier": "[variables('_solutionTier')]"
                                },
                                "dependencies": {
                                    "criteria": [
                                        {
                                            "version": "[variables('dataConnectorVersionConnections')]",
                                            "contentId": "[variables('_dataConnectorContentIdConnections')]",
                                            "kind": "ResourcesDataConnector"
                                        }
                                    ]
                                }
                            }
                        },
                        {
                            "name": "[variables('DCRName')]",
                            "apiVersion": "2021-09-01-preview",
                            "type": "Microsoft.Insights/dataCollectionRules",
                            "location": "[variables('location')]",
                            "properties": {                                
                                "dataCollectionEndpointId": "[concat('/subscriptions/',variables('subscriptionID'),'/resourceGroups/',resourceGroup().name,'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]",
                                "streamDeclarations": {
                                    "[concat('Custom-', variables('druvaSecurityEventsTableName'))]": {
                                        "columns": [
                                            {
                                                "name": "TimeGenerated",
                                                "type": "datetime"
                                            },
                                            {
                                                "name": "id",
                                                "type": "int"
                                            },
                                            {
                                                "name": "globalCustomerId",
                                                "type": "string"
                                            },
                                            {
                                                "name": "occurenceTime",
                                                "type": "int"
                                            },
                                            {
                                                "name": "area",
                                                "type": "string"
                                            },
                                            {
                                                "name": "category",
                                                "type": "string"
                                            },
                                            {
                                                "name": "type",
                                                "type": "string"
                                            },
                                            {
                                                "name": "syslogSeverity",
                                                "type": "int"
                                            },
                                            {
                                                "name": "syslogFacility",
                                                "type": "int"
                                            },
                                            {
                                                "name": "details",
                                                "type": "string"
                                            }
                                        ]
                                    },
                                    "[concat('Custom-', variables('druvaPlatformEventsTableName'))]": {
                                        "columns": [
                                            {
                                                "name": "TimeGenerated",
                                                "type": "datetime"
                                            },
                                            {
                                                "name": "category",
                                                "type": "string"
                                            },
                                            {
                                                "name": "details",
                                                "type": "dynamic"
                                            },
                                            {
                                                "name": "feature",
                                                "type": "string"
                                            },
                                            {
                                                "name": "globalID",
                                                "type": "string"
                                            },
                                            {
                                                "name": "timeStamp",
                                                "type": "int"
                                            },
                                            {
                                                "name": "productID",
                                                "type": "int"
                                            },
                                            {
                                                "name": "syslogFacility",
                                                "type": "int"
                                            },
                                            {
                                                "name": "syslogSeverity",
                                                "type": "int"
                                            },
                                            {
                                                "name": "type",
                                                "type": "string"
                                            }
                                        ]
                                    },
                                    "[concat('Custom-', variables('druvaInsyncEventsTableName'))]": {
                                        "columns": [
                                            {
                                                "name": "eventType",
                                                "type": "string"
                                            },
                                            {
                                                "name": "eventState",
                                                "type": "string"
                                            },
                                            {
                                                "name": "eventID",
                                                "type": "int"
                                            },
                                            {
                                                "name": "eventDetails",
                                                "type": "string"
                                            },
                                            {
                                                "name": "timestamp",
                                                "type": "datetime"
                                            },
                                            {
                                                "name": "initiator",
                                                "type": "string"
                                            },
                                            {
                                                "name": "ip",
                                                "type": "string"
                                            },
                                            {
                                                "name": "profileID",
                                                "type": "string"
                                            },
                                            {
                                                "name": "profileName",
                                                "type": "string"
                                            },
                                            {
                                                "name": "inSyncUserID",
                                                "type": "string"
                                            },
                                            {
                                                "name": "inSyncUserName",
                                                "type": "string"
                                            },
                                            {
                                                "name": "inSyncUserEmail",
                                                "type": "string"
                                            },
                                            {
                                                "name": "inSyncDataSourceID",
                                                "type": "string"
                                            },
                                            {
                                                "name": "inSyncDataSourceName",
                                                "type": "string"
                                            },
                                            {
                                                "name": "clientOS",
                                                "type": "string"
                                            },
                                            {
                                                "name": "clientVersion",
                                                "type": "string"
                                            },
                                            {
                                                "name": "severity",
                                                "type": "int"
                                            },
                                            {
                                                "name": "facility",
                                                "type": "int"
                                            }
                                        ]
                                    }
                                },
                               "destinations": {
                                    "logAnalytics": [
                                        {
                                            "workspaceResourceId": "[variables('workspaceResourceId')]",
                                            "name": "clv2ws1"
                                        }
                                    ]
                                },
                               "dataFlows": [
                                    {
                                        "streams": [
                                            "[concat('Custom-', variables('druvaSecurityEventsTableName'))]"
                                        ],
                                        "destinations": [
                                            "clv2ws1"
                                        ],
                                        "transformKql": "source\n| extend TimeGenerated = datetime_add('second',occurenceTime,make_datetime(1970,1,1)) \n| extend event_type = type\n| project-away occurenceTime, type\n| extend id = tostring(id)  // Convert 'id' to string and rename to EventUid\n| project-rename EventUid = id\n\n",
                                        "outputStream": "[concat('Custom-', variables('druvaSecurityEventsTableName'))]"
                                    },

                                    {
                                        "streams": [
                                            "[concat('Custom-', variables('druvaPlatformEventsTableName'))]"
                                        ],
                                        "destinations": [
                                            "clv2ws1"
                                        ],
                                        "transformKql": "source\n| extend TimeGenerated = datetime_add('second',timeStamp,make_datetime(1970,1,1))\n| extend event_type = type\n| project-away timeStamp, type\n",
                                        "outputStream": "[concat('Custom-', variables('druvaPlatformEventsTableName'))]"
                                    },

                                    {
                                        "streams": [
                                            "[concat('Custom-', variables('druvaInsyncEventsTableName'))]"
                                        ],
                                        "destinations": [
                                            "clv2ws1"
                                        ],
                                        "transformKql": "source\n| extend TimeGenerated = timestamp\n| extend eventID = tostring(eventID)\n| project-rename EventUid = eventID\n| project-away timestamp\n",
                                        "outputStream": "[concat('Custom-', variables('druvaInsyncEventsTableName'))]"
                                    }
                                ]
							}
                        },
                        {
                            "name": "[variables('druvaSecurityEventsTableName')]",
                            "apiVersion": "2021-03-01-privatepreview",
                            "type": "Microsoft.OperationalInsights/workspaces",
                            "location": "[variables('location')]",
                            "properties": {								
                                "schema": {
                                    "name": "[variables('druvaSecurityEventsTableName')]",
                                    "columns": [
                                        {
                                        "name": "area",
                                        "type": "string",
                                        "isDefaultDisplay": false,
                                        "isHidden": false
                                        },
                                        {
                                        "name": "category",
                                        "type": "string",
                                        "isDefaultDisplay": false,
                                        "isHidden": false
                                        },
                                        {
                                        "name": "details",
                                        "type": "string",
                                        "isDefaultDisplay": false,
                                        "isHidden": false
                                        },
                                        {
                                        "name": "globalCustomerId",
                                        "type": "string",
                                        "isDefaultDisplay": false,
                                        "isHidden": false
                                        },
                                        {
                                        "name": "syslogFacility",
                                        "type": "int",
                                        "isDefaultDisplay": false,
                                        "isHidden": false
                                        },
                                        {
                                        "name": "syslogSeverity",
                                        "type": "int",
                                        "isDefaultDisplay": false,
                                        "isHidden": false
                                        },
                                        {
                                        "name": "TimeGenerated",
                                        "type": "datetime",
                                        "isDefaultDisplay": false,
                                        "isHidden": false
                                        },
                                        {
                                        "name": "event_type",
                                        "type": "string",
                                        "isDefaultDisplay": false,
                                        "isHidden": false
                                        },
                                        {
                                        "name": "EventUid",
                                        "type": "string",
                                        "isDefaultDisplay": false,
                                        "isHidden": false
                                        }
                                    ]
							    }                            
                            }
                        },
						
                        {
                            "name": "[variables('druvaPlatformEventsTableName')]",
                            "apiVersion": "2021-03-01-privatepreview",
                            "type": "Microsoft.OperationalInsights/workspaces",
                            "location": "[variables('location')]",
                            "properties": {								
                                "schema": {
                                    "name": "[variables('druvaPlatformEventsTableName')]",
                                    "columns": [
                                        {
                                            "name": "category",
                                            "type": "string",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "details",
                                            "type": "dynamic",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "feature",
                                            "type": "string",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "globalID",
                                            "type": "string",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "productID",
                                            "type": "int",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "syslogFacility",
                                            "type": "int",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "syslogSeverity",
                                            "type": "int",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "TimeGenerated",
                                            "type": "datetime",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "event_type",
                                            "type": "string",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        }
                                    ]
							    }                           
                            }
                        },
                        
                        {
                            "name": "[variables('druvaInsyncEventsTableName')]",
                            "apiVersion": "2021-03-01-privatepreview",
                            "type": "Microsoft.OperationalInsights/workspaces",
                            "location": "[variables('location')]",
                            "kind": null,
                            "properties": {								
                                "schema": {
                                    "name": "[variables('druvaInsyncEventsTableName')]",
                                    "columns": [
                                        {
                                            "name": "clientOS",
                                            "type": "string",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "clientVersion",
                                            "type": "string",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "eventDetails",
                                            "type": "string",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "eventState",
                                            "type": "string",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "eventType",
                                            "type": "string",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "facility",
                                            "type": "int",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "initiator",
                                            "type": "string",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "inSyncDataSourceID",
                                            "type": "string",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "inSyncDataSourceName",
                                            "type": "string",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "inSyncUserEmail",
                                            "type": "string",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "inSyncUserID",
                                            "type": "string",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "inSyncUserName",
                                            "type": "string",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "ip",
                                            "type": "string",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "profileID",
                                            "type": "string",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "profileName",
                                            "type": "string",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "severity",
                                            "type": "int",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "TimeGenerated",
                                            "type": "datetime",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        },
                                        {
                                            "name": "EventUid",
                                            "type": "string",
                                            "isDefaultDisplay": false,
                                            "isHidden": false
                                        }
                                    ]
							    }                            
                            }
                        }
                    ]
                },
                "packageKind": "Solution",
                "packageVersion": "[variables('_solutionVersion')]",
                "packageName": "[variables('_solutionName')]",
                "contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition'),'-', variables('dataConnectorVersionConnectorDefinition'))))]",
                "packageId": "[variables('_solutionId')]",
                "contentSchemaVersion": "3.0.0",
                "version": "[variables('_solutionVersion')]"
            }
        },

        {
            "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition'))]",
            "apiVersion": "2022-09-01-preview",
            "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
            "location": "[variables('location')]",
            "kind": "Customizable",
            "properties": 
			{
                "connectorUiConfig": {
                    "title": "Druva Events Connector",
                    "publisher" : "Microsoft",
                    "descriptionMarkdown" : "Provides capability to ingest the Druva events from Druva APIs",
                    "graphQueriesTableName" : "[variables('druvaSecurityEventsTableName')]",
                    "graphQueries": [
                        {
                            "metricName":"Total Security Events",
                            "legend":"Druva Security events received",
                            "baseQuery": "{{graphQueriesTableName}}"
                        },

                        {
                            "metricName":"Total Platform events",
                            "legend":"Druva Platform events received",
                            "baseQuery": "DruvaPlatformEvents_CL"
                        },
                        {
                            "metricName":"Total inSync events",
                            "legend":"Druva inSync events received",
                            "baseQuery": "DruvaInsyncEvents_CL"
                        }
                    ],
                   "sampleQueries":[
                        {
                            "description": "Sample of Druva Security events",
                            "query": "{{graphQueriesTableName}}\n| take 10"
                        },
                        {
                            "description": "Sample of Druva Platform events",
                            "query": "DruvaPlatformEvents_CL\n| take 10"
                        },
                        {
                            "description": "Sample of Druva inSync events",
                            "query": "DruvaInsyncEvents_CL\n| take 10"
                        }
                    ],
                    "dataTypes":[
                        {
                            "name": "{{graphQueriesTableName}}",
                            "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | summarize Time=max(TimeGenerated) \n | where isnotempty(Time)"
                        },
                        {
                            "name": "DruvaPlatformEvents_CL",
                            "lastDataReceivedQuery": "DruvaPlatformEvents_CL\n | summarize Time=max(TimeGenerated) \n | where isnotempty(Time)"
                        },
                        {
                            "name": "DruvaInsyncEvents_CL",
                            "lastDataReceivedQuery": "DruvaInsyncEvents_CL\n | summarize Time=max(TimeGenerated) \n | where isnotempty(Time)"
                        }
                    ],
                    "connectivityCriteria":[
                        {
                            "type": "HasDataConnectors"
                        }
                    ],
                    "permissions":{
                        "resourceProvider":[
                            {
                                "provider": "Microsoft.OperationalInsights/workspaces",
                                "permissionsDisplayText":"Read and Write permission are required",
                                "providerDisplayName":"Workspace",
                                "scope":"Workspace",
                                "requiredPermissions":{
                                    "write": true,
                                    "read":true,
                                    "delete": true
                                }
                            }
                        ],
                        "customs":[
                            {
                                "name": "Druva API credential",
                                "description":"Druva API requires a client id and client secret to authenticate"
                            }
                        ]
                    },
                    "instructionSteps":[
                        {
                            "description": ">Note: Configurations to connect to Druva Rest API\n"
                        },
                        {
                            "description": "Step 1: Create credentials from Druva console. Refer this doc for steps:- https://help.druva.com/en/articles/8580838-create-and-manage-api-credentials\n"
                        },
                        {
                            "description": "Step 2: Enter the hostname. For public cloud its apis.druva.com\n"
                        },
                        {
                            "description": "Step 3: Enter client id and client secret key\n"
                        },
                        {
                            "description": "Provide required values:\n",
                            "instructions":[

                                {
                                    "type": "Textbox",
                                    "parameters": {
                                        "label": "Hostname",
                                        "placeholder": "Example: apis.druva.com",
                                        "type": "text",
                                        "name": "hostname"
                                    }
                                },

                                {
                                    "type": "OAuthForm",
                                    "parameters":{
                                        "clientIdLabel":"Client ID",
                                        "clientSecretLabel" : "Client Secret",
                                        "connectButtonLabel":"Connect",
                                        "disconnectButtonLabel": "Disconnect"
                                    }
                                }
                            ],
                            "title": "Connect to Druva API to start collecting logs in Microsoft Sentinel"
                        }
                    ]                     
                }
			}
        },

        {
            "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition')))]",
            "apiVersion": "2022-01-01-preview",
            "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
            "properties": {
                "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition'))]",
                "contentId": "[variables('_dataConnectorContentIdConnectorDefinition')]",
                "kind": "DataConnector",
                "version": "[variables('dataConnectorVersionConnectorDefinition')]",
                "source": {
                    "sourceId": "[variables('_solutionId')]",
                    "name": "[variables('_solutionName')]",
                    "kind": "Solution"
                },
                "author": {
                    "name": "[variables('_solutionAuthor')]"
                },
                "support": {
                    "name": "[variables('_solutionAuthor')]",
                    "tier": "[variables('_solutionTier')]"
                },
                "dependencies": {
                    "criteria": [
                        {
                            "version": "[variables('dataConnectorVersionConnections')]",
                            "contentId": "[variables('_dataConnectorContentIdConnections')]",
                            "kind": "ResourcesDataConnector"
                        }
                    ]
                }
            }
        },

        {
            "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
            "apiVersion": "2023-04-01-preview",
            "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections'), variables('dataConnectorVersionConnections'))]",
            "location": "[variables('location')]",
            "dependsOn": [
                "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
            ],
            "properties": {
                "contentId": "[variables('_dataConnectorContentIdConnections')]",
                "displayName": "[concat(variables('_solutionName'), variables('dataConnectorTemplateNameConnections'))]",
                "contentKind": "ResourcesDataConnector",
                "mainTemplate": {
                    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                    "contentVersion": "[variables('dataConnectorVersionConnections')]",
                    "parameters":{
                        "connectorDefinitionName": {
                            "defaultValue": "connectorDefinitionName",
                            "type": "string",
                            "minLength": 1
                        },

                        "hostname":{
                            "defaultValue": "apis.druva.com",
                            "type":"string",
                            "minlength": 1,
                            "metadata":{
                                "description": "hostname"
                            }
                        },

                        "clientId":{
                            "defaultValue": "-NA-",
                            "type":"string",
                            "minlength": 1,
                            "metadata":{
                                "description": "clientId"
                            }
                        },

                        "clientSecret":{
                            "defaultValue": "-NA-",
                            "type":"string",
                            "minlength": 1,
                            "metadata":{
                                "description": "clientSecret"
                            }
                        },

                        "workspace": {
                            "defaultValue": "[parameters('workspace')]",
                            "type": "string"
                        },
                        "dcrConfig": {
                            "defaultValue": {
                                "dataCollectionEndpoint": "data collection Endpoint",
                                "dataCollectionRuleImmutableId": "data collection rule immutableId"
                            },
                            "type": "object"
                        }
						
                    },
                    "variables": {
                        "_dataConnectorContentIdConnections": "[variables('_dataConnectorContentIdConnections')]",
                        "clientAuthBase64": "[[base64(concat(parameters('clientId'), ':', parameters('clientSecret')))]"
                    },
                    "resources": [
                        {
                            "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections')))]",
                            "apiVersion": "2022-01-01-preview",
                            "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
                            "properties": {
                                "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections'))]",
                                "contentId": "[variables('_dataConnectorContentIdConnections')]",
                                "kind": "ResourcesDataConnector",
                                "version": "[variables('dataConnectorVersionConnections')]",
                                "source": {
                                    "sourceId": "[variables('_solutionId')]",
                                    "name": "[variables('_solutionName')]",
                                    "kind": "Solution"
                                },
                                "author": {
                                    "name": "[variables('_solutionAuthor')]"
                                },
                                "support": {
                                    "name": "[variables('_solutionAuthor')]",
                                    "tier": "[variables('_solutionTier')]"
                                }
                            }
                        },
                    
                        {
                            "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', 'RealizeConnector')]",
                            
                            "apiVersion": "2022-12-01-preview",
                            "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
                            "location": "[variables('location')]",
                            "kind": "RestApiPoller",
                            "properties": 
							{
								
								"dataType": "[variables('druvaSecurityEventsTableName')]",
                                "response": {
                                    "eventsJsonPaths": [
                                            "$.events"
                                    ],
                                    "format": "json"
                                },
                                "paging": {
                                    "pagingType" : "PersistentToken",
                                    "nextPageTokenJsonPath": "$.nextTrackerToken",
                                    "nextPageParaName": "trackerToken"
                                },
                                "connectorDefinitionName": "[[parameters('connectorDefinitionName')]",
                                "auth": {
                                    "type" : "OAuth2",
                                    "clientSecret": "[[parameters('clientSecret')]",
                                    "clientId": "[[parameters('clientId')]",
                                    "tokenEndpoint": "[[concat('https://', parameters('hostname'), '/token')]",
                                    "tokenEndpointHeaders": {
                                        "Accept": "application/json",
                                        "Content-Type": "application/x-www-form-urlencoded",
                                        "Authorization" : "[[concat('Basic ', variables('clientAuthBase64'))]",
                                        "User-Agent": "Druva-Sentinel-Connector"
                                    },
                                    "TokenEndpointQueryParameters": {},
                                    "grantType": "client_credentials"
                                },

                                "request": {
                                "apiEndpoint": "[[concat('https://', parameters('hostname'), '/realize/eventmanagement/v1/events/tracker')]",
                                "rateLimitQPS": 10,
                                "queryWindowInMin": 15,
                                "httpMethod": "GET",
                                "retryCount": 3,
                                "timeoutInSeconds": 30,
                                "headers": {
                                    "Accept": "application/json",
                                    "User-Agent": "Druva-Sentinel-Connector"
                                }
                            },                
                            "dcrConfig": {
                                "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]",
                                "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]",
                                "streamName": "[concat('Custom-', variables('druvaSecurityEventsTableName'))]"
                            },
                            "isActive": true
                            }
                        },
                        
                        {
                            "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', 'PlatformConnector')]",
                            
                            "apiVersion": "2022-12-01-preview",
                            "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
                            "location": "[variables('location')]",
                            "kind": "RestApiPoller",
                            "properties": 
							{
								
								"dataType": "[variables('druvaPlatformEventsTableName')]",
                                "response": {
                                    "eventsJsonPaths": [
                                            "$.events"
                                    ],
                                    "format": "json"
                                },
                                "paging": {
                                    "pagingType" : "PersistentToken",
                                    "nextPageTokenJsonPath": "$.nextPageToken",
                                    "nextPageParaName": "pageToken"
                                },
                                "connectorDefinitionName": "[[parameters('connectorDefinitionName')]",
                                "auth": {
                                    "type" : "OAuth2",
                                    "clientSecret": "[[parameters('clientSecret')]",
                                    "clientId": "[[parameters('clientId')]",
                                    "tokenEndpoint": "[[concat('https://', parameters('hostname'), '/token')]",
                                    "tokenEndpointHeaders": {
                                        "Accept": "application/json",
                                        "Content-Type": "application/x-www-form-urlencoded",
                                        "Authorization" : "[[concat('Basic ', variables('clientAuthBase64'))]",
                                        "User-Agent": "Druva-Sentinel-Connector"
                                    },
                                    "TokenEndpointQueryParameters": {},
                                    "grantType": "client_credentials"
                                },

                                "request": {
                                "apiEndpoint": "[[concat('https://', parameters('hostname'), '/platform/eventmanagement/v2/events')]",
                                "rateLimitQPS": 10,
                                "queryWindowInMin": 15,
                                "httpMethod": "GET",
                                "retryCount": 3,
                                "timeoutInSeconds": 30,
                                "headers": {
                                    "Accept": "application/json",
                                    "User-Agent": "Druva-Sentinel-Connector"
                                },
                                "queryParameters": {
                                    "ignoreTrackerExpiry": "True",
                                    "source": "Platform"
                                }
                            },         
                                "dcrConfig": {
                                    "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]",
                                    "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]",
                                    "streamName": "[concat('Custom-', variables('druvaPlatformEventsTableName'))]"
                                },
                                "isActive": true
                            }
                        },

                        {
                            "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', 'InsyncConnector')]",
                            
                            "apiVersion": "2022-12-01-preview",
                            "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
                            "location": "[variables('location')]",
                            "kind": "RestApiPoller",
                            "properties": 
							{
								
								"dataType": "[variables('druvaInsyncEventsTableName')]",
                                "response": {
                                    "eventsJsonPaths": [
                                            "$.events"
                                    ],
                                    "format": "json"
                                },

                                "paging": {
                                    "pagingType" : "PersistentToken",
                                    "nextPageTokenJsonPath": "$.tracker",
                                    "nextPageParaName": "tracker"
                                },

                                "connectorDefinitionName": "[[parameters('connectorDefinitionName')]",
                                "auth": {
                                    "type" : "OAuth2",
                                    "clientSecret": "[[parameters('clientSecret')]",
                                    "clientId": "[[parameters('clientId')]",
                                    "tokenEndpoint": "[[concat('https://', parameters('hostname'), '/token')]",
                                    "tokenEndpointHeaders": {
                                        "Accept": "application/json",
                                        "Content-Type": "application/x-www-form-urlencoded",
                                        "Authorization" : "[[concat('Basic ', variables('clientAuthBase64'))]",
                                        "User-Agent": "Druva-Sentinel-Connector"
                                    },
                                    "TokenEndpointQueryParameters": {},
                                    "grantType": "client_credentials"
                                },

                                "request": {
                                "apiEndpoint": "[[concat('https://', parameters('hostname'), '/insync/eventmanagement/v2/events')]",
                                "rateLimitQPS": 10,
                                "queryWindowInMin": 15,
                                "httpMethod": "GET",
                                "retryCount": 3,
                                "timeoutInSeconds": 30,
                                "headers": {
                                    "Accept": "application/json",
                                    "User-Agent": "Druva-Sentinel-Connector"
                                },
                                "queryParameters": {
                                    "ignoreTrackerExpiry": "True"
                                }                
                            },      
                            "dcrConfig": {
                                "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]",
                                "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]",
                                "streamName": "[concat('Custom-', variables('druvaInsyncEventsTableName'))]"
                            },
                            "isActive": true
                            }
                        }

                    ]                  
                },
                "packageKind": "Solution",
                "packageVersion": "[variables('_solutionVersion')]",
                "packageName": "[variables('_solutionName')]",
                "contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections'),'-', variables('dataConnectorVersionConnections'))))]",
                "packageId": "[variables('_solutionId')]",
                "contentSchemaVersion": "3.0.0",
                "version": "[variables('_solutionVersion')]"
            }
        },
       
        {
            "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
            "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]",
            "location": "[variables('location')]",
            "apiVersion": "2023-04-01-preview",
            "properties": {
                "version": "[variables('_solutionVersion')]",
                "kind": "Solution",
                "contentSchemaVersion": "3.0.0",
                "contentId": "[variables('_solutionId')]",
                "source": {
                    "kind": "Solution",
                    "name": "[variables('_solutionName')]",
                    "sourceId": "[variables('_solutionId')]"
                },
                "author": {
                    "name": "[variables('_solutionAuthor')]"
                },
                "support": {
                    "name": "[variables('_solutionAuthor')]"
                },
                "dependencies": {
                    "operator": "AND",
                    "criteria": [
                        {
                            "kind": "DataConnector",
                            "contentId": "[variables('dataConnectorVersionConnectorDefinition')]",
                            "version": "[variables('_dataConnectorContentIdConnectorDefinition')]"
                        }
                    ]
                },
                "firstPublishDate": "2023-12-05",
                "providers": [
                    "[variables('_solutionAuthor')]"
                ],
                "contentKind": "Solution",
                "packageId": "[variables('_solutionId')]",
                "contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]",
                "displayName": "[variables('_solutionName')]",
                "publisherDisplayName": "[variables('_solutionId')]",
                "descriptionHtml": "test",
                "icon": "[variables('_packageIcon')]"
            }
        }

    ]
}