{
  "name": "SpeculusThreatIntel",
  "apiVersion": "2025-09-01",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "SpeculusThreatIntel",
      "connectorId": "SpeculusThreatIntel",
      "title": "Speculus Threat Intelligence",
      "publisher": "Speculus",
      "descriptionMarkdown": "Ingest STIX 2.1 threat intelligence indicators from the Speculus TAXII 2.1 server using the Codeless Connector Framework (CCF). The Speculus feed provides IP indicators enriched with risk scoring, named attribution, scanner/Tor/proxy classification, and geo/network context.",
      "graphQueriesTableName": "Speculus_Indicators_CL",
      "graphQueries": [
        {
          "metricName": "Total Speculus indicators received",
          "legend": "Speculus Indicators",
          "baseQuery": "Speculus_Indicators_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "Very high risk indicators (last 7 days)",
          "query": "Speculus_Indicators_CL | where TimeGenerated >= ago(7d) | where RiskScore >= 75 | project TimeGenerated, IndicatorValue, RiskScore, Activity, Attribution, Labels"
        },
        {
          "description": "Indicators with named attribution",
          "query": "Speculus_Indicators_CL | where TimeGenerated >= ago(7d) | where isnotempty(Attribution) | summarize Indicators = dcount(IndicatorValue) by Attribution | order by Indicators desc"
        }
      ],
      "dataTypes": [
        {
          "name": "Speculus_Indicators_CL",
          "lastDataReceivedQuery": "Speculus_Indicators_CL | summarize Time = max(TimeGenerated) | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "status": "Available",
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and write permissions required",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": false
            }
          }
        ],
        "customs": [
          {
            "name": "Speculus API key",
            "description": "A Speculus API key with access to the IOC feed. The key is sent as a Bearer token in the Authorization header. Contact Speculus to obtain one."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect Speculus Threat Intelligence",
          "description": "Provide your Speculus TAXII server details and API key, then click Connect.\n\n>Unless Speculus has provided different values, use the default TAXII base URL `https://feed.speculus.co/api1` and collection ID `f3a1c2d4-5b6e-4a7f-8c9d-0e1f2a3b4c5d` (the `speculus-ioc-feed` collection).\n\n>Note: TAXII polling is not metered against your Speculus API quota — only the single-IP REST lookup used by the incident-enrichment playbook is quota-metered.",
          "instructions": [
            {
              "type": "Textbox",
              "parameters": {
                "label": "TAXII Base URL (including API root)",
                "placeholder": "https://feed.speculus.co/api1",
                "type": "text",
                "name": "taxiiBaseUrl"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Collection ID",
                "placeholder": "f3a1c2d4-5b6e-4a7f-8c9d-0e1f2a3b4c5d",
                "type": "text",
                "name": "collectionId"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "API Key",
                "placeholder": "Enter your Speculus API key",
                "type": "password",
                "name": "apiKey"
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "connectLabel": "Connect",
                "name": "connect"
              }
            }
          ]
        }
      ]
    }
  }
}