{
  "name": "QscoutAppEventsCCFDefinition",
  "apiVersion": "2025-09-01",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "QscoutAppEventsCCFDefinition",
      "title": "QscoutAppEventsConnector (via Codeless Connector Framework)",
      "publisher": "Quokka",
      "descriptionMarkdown": "Ingest Qscout application events into Microsoft Sentinel",
      "graphQueriesTableName": "QscoutAppEvents_CL",
      "graphQueries": [
        {
           "metricName": "Events received",
           "legend": "Data connector events",
           "baseQuery": "{{graphQueriesTableName}}"
        }
      ],
      "sampleQueries": [
        {
           "description": "All event logs",
           "query": "{{graphQueriesTableName}} | take 10"
        }
       ],
      "dataTypes": [
        {
          "name": "{{graphQueriesTableName}}",
          "lastDataReceivedQuery": "{{graphQueriesTableName}} | summarize Time = max  (TimeGenerated)\n|where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true
            }
          }
        ],
        "customs": [
          {
            "name": "Qscout Organization ID",
            "description": "The API requires your organization ID in Qscout."
          },
          {
            "name": "Qscout Organization API Key",
            "description": "The API requires your organization API key in Qscout."
          }
        ]
      },
      "instructionSteps": [
            {
                "description": ">**NOTE:** This connector uses Codeless Connector Framework (CCF) to connect to the Qscout app events feed and ingest data into Microsoft Sentinel"
            },
            {
                "description": "Provide the required values below:\n",
                "instructions": [
                    {
                        "type": "Textbox",
                        "parameters": {
                            "label": "Qscout Organization ID",
                            "placeholder": "123456",
                            "type": "text",
                            "name": "organizationId"
                        }
                    },
                    {
                        "type": "Textbox",
                        "parameters": {
                            "label": "Qscout Organization API Key",
                            "placeholder": "abcdxyz",
                            "type": "password",
                            "name": "apiKey"
                        }
                    },
                    {
                        "type": "ConnectionToggleButton",
                        "parameters": {
                            "connectLabel": "Connect",
                            "name": "connect"
                        }
                    }
                ]
            }
        ]
    }
  }
}