{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workspace": {
            "type": "string",
            "defaultValue": ""
        }
    },
    "resources": [
        {
            "id": "[concat('/subscriptions/',subscription().subscriptionId,'/resourceGroups/',resourceGroup().name,'/providers/Microsoft.OperationalInsights/workspaces/',parameters('workspace'),'/providers/Microsoft.SecurityInsights/dataConnectors/',guid(resourceGroup().id, deployment().name))]",
            "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',guid(resourceGroup().id, deployment().name))]",
            "apiVersion": "2021-03-01-preview",
            "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
	"kind": "APIPolling",
	"properties": {
		"connectorUiConfig": {
			"id": "GitHubEcAuditLogPolling",
			"title": "[Deprecated] GitHub Enterprise Audit Log",
			"publisher": "GitHub",
			"descriptionMarkdown": "The GitHub audit log connector provides the capability to ingest GitHub logs into Microsoft Sentinel. By connecting GitHub audit logs into Microsoft Sentinel, you can view this data in workbooks, use it to create custom alerts, and improve your investigation process. \n\n **Note:** If you intended to ingest GitHub subscribed events into Microsoft Sentinel, please refer to GitHub (using Webhooks) Connector from \"**Data Connectors**\" gallery.\n\n<p><span style='color:red; font-weight:bold;'>NOTE</span>: This data connector has been deprecated, consider moving to the CCF data connector available in the solution which replaces ingestion via the <a href='https://learn.microsoft.com/en-us/azure/azure-monitor/logs/custom-logs-migrate' style='color:#1890F1;'>deprecated HTTP Data Collector API</a>.</p>",
			"graphQueriesTableName": "GitHubAuditLogPolling_CL",
			"graphQueries": [
				{
					"metricName": "Total events received",
					"legend": "GitHub audit log events",
					"baseQuery": "{{graphQueriesTableName}}"
				}
			],
			"sampleQueries": [
				{
					"description": "All logs",
					"query": "{{graphQueriesTableName}}\n | take 10"
				}
			],
			"dataTypes": [
				{
					"name": "GitHubAuditData",
					"lastDataReceivedQuery": "GitHubAuditData\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
				}
			],
			"connectivityCriterias": [
				{
					"type": "SentinelKindsV2",
					"value": []
				}
			],
			"availability": {
				"status": 1,
				"isPreview": true
			},
			"permissions": {
				"resourceProvider": [
					{
						"provider": "Microsoft.OperationalInsights/workspaces",
						"permissionsDisplayText": "read and write permissions are required.",
						"providerDisplayName": "Workspace",
						"scope": "Workspace",
						"requiredPermissions": {
							"write": true,
							"read": true,
							"delete": true
						}
					}
				],
				"customs": [
					{
						"name": "GitHub API personal access token",
						"description": "You need a GitHub personal access token to enable polling for the organization audit log. You may use either a classic token with 'read:org' scope OR a fine-grained token with 'Administration: Read-only' scope."
					},
					{
						"name": "GitHub Enterprise type",
						"description": "This connector will only function with GitHub Enterprise Cloud; it will not support GitHub Enterprise Server. "
					}
				]
			},
			"instructionSteps": [
				{
					"title": "Connect the GitHub Enterprise Organization-level Audit Log to Microsoft Sentinel",
					"description": "Enable GitHub audit logs. \n Follow [this guide](https://docs.github.com/en/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token) to create or find your personal access token.",
					"instructions": [
						{
							"parameters": {
								"enable": "true",
								"userRequestPlaceHoldersInput": [
									{
										"displayText": "Organization Name",
										"requestObjectKey": "apiEndpoint",
										"placeHolderName": "{{placeHolder1}}",
										"placeHolderValue": ""
									}
								]
							},
							"type": "APIKey"
						}
					]
				}
			]
		},
		"pollingConfig": {
			"owner": "ASI",
			"version": "2.0",
			"source": "PaaS",
			"templateFilePath": "",
			"templateFileName": "",
			"auth": {
				"authType": "APIKey",
				"APIKeyName": "Authorization",
				"APIKeyIdentifier": "token"
			},
			"request": {
				"apiEndpoint": "https://api.github.com/organizations/{{placeHolder1}}/audit-log?include=all",
				"rateLimitQPS": 50,
				"queryWindowInMin": 15,
				"httpMethod": "Get",
				"queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
				"retryCount": 2,
				"timeoutInSeconds": 60,
				"headers": {
					"Accept": "application/json",
					"User-Agent": "Scuba"
				},
				"queryParameters": {
					"phrase": "created:{_QueryWindowStartTime}..{_QueryWindowEndTime}"
				}
			},
			"paging": {
				"pagingType": "LinkHeader",
				"pageSizeParaName": "per_page"
			},
			"response": {
				"eventsJsonPaths": [
					"$"
				]
			}
		}
	}
            }
    ]
}