{
    "name": "SOCPrimeAuditLogsDataConnector",
    "apiVersion": "2022-09-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "SOCPrimeAuditLogsDataConnector",
            "title": "SOC Prime Platform Audit Logs Data Connector",
            "publisher": "Microsoft",
            "descriptionMarkdown": "The [SOC Prime Audit Logs](https://tdm.socprime.com/login) data connector allows ingesting logs from the SOC Prime Platform API into Microsoft Sentinel. The data connector is built on Microsoft Sentinel Codeless Connector Platform. It uses the SOC Prime Platform API to fetch SOC Prime platform audit logs and it supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security data into a custom table, thus resulting in better performance.",
            "graphQueries": [
                {
                    "metricName": "Total Audit Logs received",
                    "legend": "SOC Prime Audit Logs",
                    "baseQuery": "SOCPrimeAuditLogs_CL"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Get Sample of SOC Prime  logs",
                    "query": "SOCPrimeAuditLogs_CL | take 10"
                }
            ],
            "dataTypes": [
                {
                    "name": "SOCPrimeAuditLogs_CL",
                    "lastDataReceivedQuery": "SOCPrimeAuditLogs_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors",
                    "value": null
                }
            ],
            "availability": {
                "status": 1,
                "isPreview": false
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "read": true,
                            "write": true,
                            "delete": true,
                            "action": false
                        }
                    }
                ]
            },
            "instructionSteps": [
                {
                    "instructions": [
                        {
                            "type": "Markdown",
                            "parameters": {
                                "content": "#### Configuration steps for the SOC Prime Platform API \n Follow the instructions to obtain the credentials. you can also follow this [guide](https://tdm.socprime.com/login) to generate personal API key."
                            }
                        },
                        {
                            "type": "Markdown",
                            "parameters": {
                                "content": "#### Retrieve API Key\n   1. Log in to the SOC Prime Platform\n 2. Click [**Account**] icon -> [**Platform Settings**] -> [**API**] \n   3. Click [**Add New Key**] \n   4. In the modal that appears give your key a meaningful name, set expiration date and product APIs the key provides access to \n   5. Click on [**Generate**] \n   6. Copy the key and save it in a safe place. You won't be able to view it again once you close this modal "
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "SOC Prime API Key",
                                "placeholder": "API Key",
                                "type": "password",
                                "name": "apitoken"
                            }
                        },
                        {
                            "parameters": {
                                "label": "toggle",
                                "name": "toggle"
                            },
                            "type": "ConnectionToggleButton"
                        }
                    ]
                 
                }
            ],
            "isConnectivityCriteriasMatchSome": false
        }
    }
}