{
  "name": "AirlockDigitalSaas",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "AirlockDigitalSaas",
      "title": "Airlock Digital (Poll - SaaS)",
      "publisher": "Airlock Digital",
      "descriptionMarkdown": "The [Airlock Digital](https://www.airlockdigital.com/) **SaaS** connector periodically pulls execution history and server activity logs from the Airlock Digital SaaS API, authenticating with a user API key together with your directory and tenant identifiers. It is the polling connector for Airlock Digital's hosted SaaS offering, and it does not collect policy change logs. For self-hosted servers or Airlock Digital SaaS running v7.0 or higher, the **Airlock Digital (Push)** connector delivers events in near real time and also collects policy changes. For self-hosted servers older than v7.0, use the **Airlock Digital (Poll)** connector.\n\n>**NOTE:** Use one connector per Airlock Digital server. If the same server is collected by more than one Airlock Digital connector, duplicate data is populated in the tables.",
      "graphQueries": [
        {
          "metricName": "Execution history events received",
          "legend": "Execution History",
          "baseQuery": "AirlockDigitalExecutionHistories_CL"
        },
        {
          "metricName": "Server activity events received",
          "legend": "Server Activity",
          "baseQuery": "AirlockDigitalServerActivities_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "Recent execution history events",
          "query": "AirlockDigitalExecutionHistories_CL | sort by TimeGenerated desc | take 10"
        },
        {
          "description": "Recent server activity events",
          "query": "AirlockDigitalServerActivities_CL | sort by TimeGenerated desc | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "AirlockDigitalExecutionHistories_CL",
          "lastDataReceivedQuery": "AirlockDigitalExecutionHistories_CL | summarize Time = max(TimeGenerated) | where isnotempty(Time)"
        },
        {
          "name": "AirlockDigitalServerActivities_CL",
          "lastDataReceivedQuery": "AirlockDigitalServerActivities_CL | summarize Time = max(TimeGenerated) | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        },
        {
          "type": "IsConnectedQuery",
          "value": [
            "AirlockDigitalExecutionHistories_CL | where TimeGenerated > ago(1h) | take 1"
          ]
        }
      ],
      "availability": {
        "status": 1
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": true
            }
          }
        ],
        "customs": [
          {
            "name": "Airlock Digital SaaS API credentials",
            "description": "A user API key, directory ID, and tenant ID for your Airlock Digital SaaS instance."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Configure access to the Airlock Digital SaaS API",
          "description": "Set up API access in your Airlock Digital SaaS tenant before connecting.",
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "Your server URL comes from your portal address: take `https://portal.au.YourDomain.com/tenant/XYZ/dashboard` and drop the `portal.` prefix and everything after the top-level domain, leaving `https://au.YourDomain.com`.\n\nThe user API key, directory ID and tenant ID are in Airlock Digital under **User Menu** > **My Profile**.\n\nLogs are polled every five minutes."
              }
            }
          ]
        },
        {
          "title": "Connect Airlock Digital SaaS instances to Microsoft Sentinel",
          "description": "This connector supports multiple simultaneous connections. Add one connection per Airlock Digital SaaS instance; each connection ingests the selected data types in parallel. Use the grid below to review existing connections or add a new one.",
          "instructions": [
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnName": "Connector Name",
                    "columnValue": "properties.addOnAttributes.friendlyName"
                  },
                  {
                    "columnName": "Data Type",
                    "columnValue": "properties.addOnAttributes.dataType"
                  },
                  {
                    "columnName": "Endpoint",
                    "columnValue": "properties.request.apiEndpoint"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "isPrimary": true,
                "label": "Add Connection",
                "title": "Connect an Airlock Digital SaaS instance",
                "subtitle": "Airlock Digital",
                "contextPaneType": "DataConnectorsContextPane",
                "instructionSteps": [
                  {
                    "instructions": [
                      {
                        "type": "Markdown",
                        "parameters": {
                          "content": "## Connection details\n\nProvide the SaaS URL, user API key, directory ID and tenant ID, then choose which data types to collect. Create a separate connection for each Airlock Digital SaaS instance."
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Airlock Digital SaaS URL",
                          "placeholder": "https://au.YourDomain.com",
                          "type": "text",
                          "name": "BaseUrl",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "User API key",
                          "placeholder": "Enter your Airlock Digital user API key",
                          "type": "password",
                          "name": "apiKey",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Directory ID",
                          "placeholder": "Enter your Airlock Digital directory ID",
                          "type": "text",
                          "name": "directoryId",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Tenant ID",
                          "placeholder": "Enter your Airlock Digital tenant ID",
                          "type": "text",
                          "name": "tenantId",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Dropdown",
                        "parameters": {
                          "label": "Data Types",
                          "name": "selectedDataTypes",
                          "options": [
                            {
                              "key": "AirlockDigitalExecutionHistories",
                              "text": "Execution Histories"
                            },
                            {
                              "key": "AirlockDigitalServerActivities",
                              "text": "Server Activities"
                            }
                          ],
                          "placeholder": "Select data types to collect...",
                          "isMultiSelect": true,
                          "defaultAllSelected": true,
                          "required": true
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Connector Friendly Name",
                          "placeholder": "Enter a unique friendly name for this connection",
                          "type": "text",
                          "name": "friendlyName",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "InfoMessage",
                        "parameters": {
                          "text": "The friendly name helps you identify this connection in the grid and appears in the ConnectorName column of the collected data.",
                          "visible": true,
                          "inline": true
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ],
      "isConnectivityCriteriasMatchSome": true
    }
  }
}