{
    "name": "MiroContentLogsDataConnector",
    "apiVersion": "2025-09-01",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "MiroContentLogsDataConnector",
            "title": "Miro Content Logs (Enterprise Plan + Enterprise Guard)",
            "publisher": "Miro",
            "descriptionMarkdown": "The [Miro Content Logs](https://help.miro.com/hc/en-us/articles/17774729839378-Content-Logs-overview) data connector enables you to ingest content activity logs from Miro into Microsoft Sentinel. Part of Miro's Enterprise Guard eDiscovery capabilities, this connector provides content-level visibility for compliance, legal hold, and advanced threat detection.\n\n**Key features:**\n- Track all content item changes.\n- Monitor content modifications by user and timestamp.\n- Support compliance and eDiscovery requirements.\n- Detect data exfiltration and insider threats.\n- Meet regulatory and legal hold obligations.\n\n**Requirements:**\n- **Miro Plan**: [Enterprise Plan](https://miro.com/pricing/) + **Enterprise Guard** add-on.\n- **OAuth scope**: `contentlogs:export`.\n- **Role**: Company Admin in your Miro organization.\n- **Organization ID**: Your Miro organization identifier.\n\n💡 **Not on Enterprise Plan yet?** Upgrade to [Miro Enterprise](https://miro.com/enterprise/) to unlock advanced security and compliance features for your team's collaboration activities in Microsoft Sentinel.\n\n💡 **Need Content Logs?** Content activity logging is part of [Miro Enterprise Guard](https://miro.com/enterprise-guard/), which provides advanced security, compliance, and eDiscovery features. Contact your Miro account manager to add Enterprise Guard to your Enterprise Plan and unlock content-level monitoring in Microsoft Sentinel.\n\n**Note:** If you only have the base Enterprise Plan (without Enterprise Guard), please use the **Miro Audit Logs** connector instead for organization-level event monitoring.\n\nFor detailed instructions, refer to the [documentation](https://help.miro.com/hc/en-us/articles/31325908249362).",
            "graphQueriesTableName": "MiroContentLogs_CL",
            "graphQueries": [
                {
                    "metricName": "Miro Content Logs",
                    "legend": "MiroContentLogs_CL",
                    "baseQuery": "MiroContentLogs_CL"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Recent content changes",
                    "query": "MiroContentLogs_CL\n| sort by TimeGenerated desc\n| take 10"
                },
                {
                    "description": "Activity by action type",
                    "query": "MiroContentLogs_CL\n| summarize count() by actionType\n| render piechart"
                },
                {
                    "description": "Most active users",
                    "query": "MiroContentLogs_CL\n| summarize events = count() by actor_name\n| top 10 by events desc"
                }
            ],
            "dataTypes": [
                {
                    "name": "MiroContentLogs_CL",
                    "lastDataReceivedQuery": "MiroContentLogs_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
                }
            ],
            "availability": {
                "isPreview": false
            },
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "write": true,
                            "read": true,
                            "delete": true
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "Miro Enterprise Plan with Enterprise Guard",
                        "description": "Miro Enterprise Plan with Enterprise Guard add-on is required. Content logs are part of Miro's eDiscovery features and are not available on base Enterprise Plan or lower tiers."
                    },
                    {
                        "name": "Miro OAuth Application",
                        "description": "Miro OAuth application with contentlogs:export scope and Company Admin role is required."
                    },
                    {
                        "name": "Miro Organization ID",
                        "description": "Your Miro organization ID is required to access content logs."
                    }
                ]
            },
            "instructionSteps": [
                {
                    "description": "**Step 1: Verify your Miro plan and Enterprise Guard**\n\n1. Ensure your organization has [Miro Enterprise Plan](https://miro.com/pricing/) with **Enterprise Guard** add-on.\n2. Content logs are part of Miro's eDiscovery (Enterprise Guard) features.\n3. If you don't have Enterprise Guard yet, contact your [Miro account manager](https://miro.com/contact/sales/) to upgrade.\n4. Without Enterprise Guard, use the **Miro Audit Logs** connector for organization-level monitoring.\n5. You must be a **Company Admin** to set up this integration."
                },
                {
                    "description": "**Step 2: Choose your setup option**\n\nThere are two ways to set up the Miro Content Logs connector.\n\n**Option 1 (recommended):** Use Enterprise integrations\n- Simplest setup with automatic token generation.\n- Recommended for most users.\n- See Option 1 below.\n\n**Option 2 (alternative):** Create custom OAuth application\n- More control over OAuth app configuration.\n- For advanced users or custom integration needs.\n- See Option 2 below.\n\n**Note:** When using Option 1, the integration is automatically tied to the team with the largest number of users in your organization. When using Option 2, you can choose which team to install the app to. However, **the team selection does not affect which logs are collected**—both options provide organization-wide log access. All integration-relevant events from all teams are included in your logs."
                },
                {
                    "description": "**Option 1: Enterprise integrations (recommended)**\n\n1. Open [Miro Company Settings](https://miro.com/app/settings/).\n2. Expand the **Apps and integrations** section.\n3. Click **Enterprise integrations**.\n4. Enable the **eDiscovery** toggle.\n5. Copy the **Access Token** value that appears.\n6. Get your **Organization ID** from the browser URL:\n   - Look at the browser URL to find your Organization ID.\n   - The URL format is: `https://miro.com/app/settings/company/{ORGANIZATION_ID}/`.\n   - Copy your Organization ID from the URL (the numeric value).\n7. **Important:** Store both the token and Organization ID securely—they provide full access to content logs.\n8. The token will work until you disable the toggle.\n9. Proceed to Step 3."
                },
                {
                    "description": "**Option 2: Custom OAuth application (alternative)**\n\n1. Go to [Miro App Settings](https://miro.com/app/settings/user-profile/apps).\n2. Click **Create new app**.\n3. Select **Non-expiring access token** option during app creation.\n4. Enable the OAuth scope: **`contentlogs:export`**.\n5. Click **Install app and get OAuth token**.\n6. Authorize the app to access your organization.\n7. Copy the **Access Token** that is displayed.\n8. Get your **Organization ID**:\n   - Go to [Miro Company Settings](https://miro.com/app/settings/).\n   - Look at the browser URL to find your Organization ID.\n   - The URL format is: `https://miro.com/app/settings/company/{ORGANIZATION_ID}/`.\n   - Copy your Organization ID from the URL (the numeric value).\n9. **Important:** Store both the token and Organization ID securely—they provide full access to content logs.\n10. The token will work until you uninstall the app."
                },
                {
                    "description": "**Step 3: Learn more**\n\nFor detailed information about Miro content logs and eDiscovery:\n- [Miro Content Logs overview](https://help.miro.com/hc/en-us/articles/17774729839378-Content-Logs-overview)\n- [Miro Enterprise Guard](https://miro.com/enterprise-guard/)\n- [Miro API reference](https://developers.miro.com/reference/enterprise-board-content-item-logs-fetch)\n- [OAuth non-expiring tokens](https://developers.miro.com/reference/authorization-flow-for-expiring-access-tokens)\n- [Enterprise integrations settings](https://miro.com/app/settings/)"
                },
                {
                    "description": "**Step 4: Connect to Miro**\n\nProvide the required values below to complete the connection.",
                    "instructions": [
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Organization ID",
                                "placeholder": "Enter your Miro Organization ID",
                                "type": "text",
                                "name": "organizationId"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Access token",
                                "placeholder": "Enter your Miro Access Token",
                                "type": "password",
                                "name": "AccessToken"
                            }
                        },
                        {
                            "type": "ConnectionToggleButton",
                            "parameters": {
                                "label": "toggle",
                                "name": "toggle"
                            }
                        }
                    ],
                    "title": "Connect to Miro to start collecting content logs in Microsoft Sentinel."
                }
            ]
        }
    }
}