{
    "name": "CiscoDuoActivityConnectorDefinition",
    "apiVersion": "2022-09-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "availability": {
        "isPreview": true,
        "status": 1
    },
    "properties": {
        "connectorUiConfig": {
            "id": "CiscoDuoActivityConnectorDefinition",
            "title": "Cisco Duo Activity Logs",
            "publisher": "Cisco Systems, Inc.",
            "descriptionMarkdown": "The Cisco Duo Activity Logs connector ingests admin and user activity log data from the Cisco Duo Admin API into Microsoft Sentinel.\n\nActivity logs capture admin panel actions such as user creation, modification, deletion, admin logins, and configuration changes.\n\nSupports HMAC-based API Key authentication (Integration Key and Secret Key).\n\nFor more information, visit [Cisco Duo Admin API Docs](https://duo.com/docs/adminapi#activity-logs).",
            "graphQueriesTableName": "DuoActivity_CL",
            "graphQueries": [
                {
                    "metricName": "Total events received",
                    "legend": "{{graphQueriesTableName}}",
                    "baseQuery": "{{graphQueriesTableName}} | where TimeGenerated > ago(14d) | summarize count() by bin(TimeGenerated, 1d)"
                }
            ],
            "dataTypes": [
                {
                    "name": "{{graphQueriesTableName}}",
                    "lastDataReceivedQuery": "{{graphQueriesTableName}} | summarize Time = max(TimeGenerated) | where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "sampleQueries": [
                {
                    "description": "All activity events from the last 24 hours",
                    "query": "DuoActivity_CL | where TimeGenerated > ago(24h) | project TimeGenerated, ActionName, ActorName, ActorType, TargetName, TargetType, OutcomeResult | take 100"
                },
                {
                    "description": "Admin login events",
                    "query": "DuoActivity_CL | where ActionName == 'admin_login' | project TimeGenerated, ActorName, OutcomeResult, AccessDeviceIp, AccessDeviceCountry | order by TimeGenerated desc"
                },
                {
                    "description": "Failed activity outcomes",
                    "query": "DuoActivity_CL | where OutcomeResult == 'FAILURE' | project TimeGenerated, ActionName, ActorName, TargetName, TargetType, AccessDeviceIp | order by TimeGenerated desc"
                },
                {
                    "description": "User management actions (create, update, delete)",
                    "query": "DuoActivity_CL | where ActionName in ('user_create', 'user_update', 'user_delete') | project TimeGenerated, ActionName, ActorName, TargetName, TargetDetails | order by TimeGenerated desc"
                },
                {
                    "description": "Activity by actor over last 7 days",
                    "query": "DuoActivity_CL | where TimeGenerated > ago(7d) | summarize ActionCount = count() by ActorName, ActorType | order by ActionCount desc | take 20"
                }
            ],
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "read and write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "write": true,
                            "read": true,
                            "delete": false
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "Cisco Duo API Key",
                        "description": "A Cisco Duo Integration Key and Secret Key are required. These are obtained by creating an Admin API application in the Duo Admin Panel with 'Grant read log' permission. [See documentation](https://duo.com/docs/adminapi#activity-logs)."
                    }
                ]
            },
            "instructionSteps": [
                {
                    "title": "Connect Cisco Duo Activity Logs to Microsoft Sentinel",
                    "description": "To enable the Cisco Duo Activity Logs connector, provide your Duo Admin API credentials below.\n\n1. Log in to the [Duo Admin Panel](https://admin.duosecurity.com).\n2. Navigate to **Applications > Protect an Application**.\n3. Find **Admin API** and click **Protect**.\n4. Ensure the application has **Grant read log** permission enabled.\n5. Copy the **Integration Key**, **Secret Key**, and **API Hostname** and enter them below.",
                    "instructions": [
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Integration Key (ikey)",
                                "placeholder": "DIXXXXXXXXXXXXXXXXXX",
                                "type": "text",
                                "name": "ikey"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Secret Key (skey)",
                                "placeholder": "your_secret_key",
                                "type": "password",
                                "name": "skey"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "API Base URL",
                                "placeholder": "https://api-XXXXXXXX.duosecurity.com",
                                "type": "text",
                                "name": "BaseUrl"
                            }
                        },
                        {
                            "type": "ConnectionToggleButton",
                            "parameters": {
                                "connectLabel": "Connect",
                                "name": "connect"
                            }
                        }
                    ]
                }
            ]
        }
    }
}