{
    "name": "IONIXDefinition",
    "apiVersion": "2022-09-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "IONIXDefinition",
            "title": "IONIX Security Logs (via Codeless Connector Framework)",
            "publisher": "IONIX",
            "descriptionMarkdown": "The IONIX connector allows you to ingest action items from your IONIX Attack Surface Management platform into Microsoft Sentinel using the Codeless Connector Framework (CCF). Action items represent security findings and vulnerabilities that require remediation.\n\n**This connector automatically polls the IONIX API and writes data to the CyberpionActionItems_CL table.**",
            "graphQueriesTableName": "CyberpionActionItems_CL",
            "graphQueries": [
                {
                    "metricName": "Total action items received",
                    "legend": "IONIX Action Items",
                    "baseQuery": "{{graphQueriesTableName}}"
                }
            ],
            "sampleQueries": [
                {
                    "description": "All open high urgency action items",
                    "query": "{{graphQueriesTableName}}\n| where is_open_b == true and urgency_d >= 9\n| project TimeGenerated, host_s, Category, urgency_d, summary_s"
                },
                {
                    "description": "Action items by category",
                    "query": "{{graphQueriesTableName}}\n| where is_open_b == true\n| summarize count() by Category"
                }
            ],
            "dataTypes": [
                {
                    "name": "{{graphQueriesTableName}}",
                    "lastDataReceivedQuery": "{{graphQueriesTableName}}\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "availability": {
                "status": 1,
                "isPreview": false
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "read": true,
                            "write": true,
                            "delete": true,
                            "action": false
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "IONIX API Token",
                        "description": "An API token from IONIX Portal is required. Create one in **Settings > API** in your [IONIX Portal](https://portal.ionix.io/)."
                    }
                ]
            },
            "instructionSteps": [
                {
                    "title": "Connect IONIX to Microsoft Sentinel",
                    "description": "This connector uses the IONIX API to automatically poll for action items and ingest them into Microsoft Sentinel. You need an API token from your IONIX Portal.\n>",
                    "instructions": [
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "IONIX API Token",
                                "placeholder": "Enter your JWT API token from IONIX Settings > API",
                                "type": "password",
                                "name": "apiToken",
                                "validations": {
                                    "required": true
                                }
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "IONIX Account Name",
                                "placeholder": "cyberpion",
                                "type": "text",
                                "name": "accountName",
                                "validations": {
                                    "required": true
                                }
                            }
                        },
                        {
                            "parameters": {
                                "label": "toggle",
                                "name": "toggle"
                            },
                            "type": "ConnectionToggleButton"
                        }
                    ]
                }
            ],
            "isConnectivityCriteriasMatchSome": false
        }
    }
}