{
    "name": "CyfirmaBrandIntelligenceAlertsDC",
    "apiVersion": "2024-01-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "CyfirmaBrandIntelligenceAlertsDC",
            "title": "CYFIRMA Brand Intelligence",
            "publisher": "Microsoft",
            "isConnectivityCriteriasMatchSome": false,
            "DescriptionMarkdown": "The CYFIRMA Brand Intelligence data connector enables seamless log ingestion from the DeCYFIR/DeTCT API into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform, it leverages the DeCYFIR/DeTCT Alerts API to retrieve logs. Additionally, it supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview), which parse security data into a custom table during ingestion. This eliminates the need for query-time parsing, enhancing performance and efficiency.",
            "graphQueries": [
                {
                    "metricName": "Total Domain IT Asset Alerts logs received",
                    "legend": "Domain IT Asset Alerts Logs",
                    "baseQuery": "CyfirmaBIDomainITAssetAlerts_CL"
                },
                {
                    "metricName": "Total Executive People Alerts logs received",
                    "legend": "Executive People Alerts Logs",
                    "baseQuery": "CyfirmaBIExecutivePeopleAlerts_CL"
                },
                {
                    "metricName": "Total Product Solution Alerts logs received",
                    "legend": "Product Solution Alerts Logs",
                    "baseQuery": "CyfirmaBIProductSolutionAlerts_CL"
                },
                {
                    "metricName": "Total Social Handlers Alerts logs received",
                    "legend": "Social Handlers Alerts Logs",
                    "baseQuery": "CyfirmaBISocialHandlersAlerts_CL"
                },
                {
                    "metricName": "Total Malicious Mobile Apps Alerts logs received",
                    "legend": "Malicious Mobile Apps Alerts Logs",
                    "baseQuery": "CyfirmaBIMaliciousMobileAppsAlerts_CL"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Get Sample of Domain IT Asset Alerts logs",
                    "query": "CyfirmaBIDomainITAssetAlerts_CL| take 10"
                },
                {
                    "description": "Get Sample of Executive People Alerts logs",
                    "query": "CyfirmaBIExecutivePeopleAlerts_CL| take 10"
                },
                {
                    "description": "Get Sample of Product Solution Alerts logs",
                    "query": "CyfirmaBIProductSolutionAlerts_CL| take 10"
                },
                {
                    "description": "Get Sample of Social Handlers Alerts logs",
                    "query": "CyfirmaBISocialHandlersAlerts_CL| take 10"
                },
                {
                    "description": "Get Sample of Malicious Mobile Apps Alerts logs",
                    "query": "CyfirmaBIMaliciousMobileAppsAlerts_CL| take 10"
                }
            ],
            "dataTypes": [
                {
                    "name": "CyfirmaBIDomainITAssetAlerts_CL",
                    "lastDataReceivedQuery": "CyfirmaBIDomainITAssetAlerts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CyfirmaBIExecutivePeopleAlerts_CL",
                    "lastDataReceivedQuery": "CyfirmaBIExecutivePeopleAlerts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CyfirmaBIProductSolutionAlerts_CL",
                    "lastDataReceivedQuery": "CyfirmaBIProductSolutionAlerts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CyfirmaBISocialHandlersAlerts_CL",
                    "lastDataReceivedQuery": "CyfirmaBISocialHandlersAlerts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CyfirmaBIMaliciousMobileAppsAlerts_CL",
                    "lastDataReceivedQuery": "CyfirmaBIMaliciousMobileAppsAlerts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "availability": {
                "status": 1,
                "isPreview": false
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "read": true,
                            "write": true,
                            "delete": true,
                            "action": false
                        }
                    }
                ]
            },
            "instructionSteps": [
                {
                    "title": "CYFIRMA Brand Intelligence",
                    "description": "Connect to CYFIRMA Brand Intelligence to ingest alerts data into Microsoft Sentinel. This connector uses the DeCYFIR/DeTCT Alerts API to retrieve logs and supports DCR-based ingestion time transformations, parsing security data into custom tables during ingestion. This enhances performance and efficiency by eliminating the need for query-time parsing.",
                    "estimatedTime": "5 minutes",
                    "icon": "https://www.microsoft.com/favicon.ico",
                    "instructions": [
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "CYFIRMA API URL",
                                "placeholder": "https://decyfir.cyfirma.com",
                                "type": "text",
                                "name": "cyfirmaAPIURL"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "CYFIRMA API Key",
                                "placeholder": "CYFIRMA API Key",
                                "type": "password",
                                "name": "cyfirmaAPIKey"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "API Delta",
                                "placeholder": "API Delta",
                                "type": "text",
                                "name": "apiDelta",
                                "description": "True: First call returns last 30 days, then only incremental data. False: Returns all data on every call."
                            }
                        },
                        {
                            "type": "ConnectionToggleButton",
                            "parameters": {
                                "connectLabel": "Connect",
                                "name": "connect"
                            }
                        }
                    ]
                }
            ]
        }
    }
}