{
  "name": "DomainToolsCCFDefinition",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "DomainToolsCCFDefinition",
      "title": "DomainTools Threat Intelligence Domain Feed",
      "publisher": "DomainTools",
      "descriptionMarkdown": "The DomainTools CCF Domain Data Connector retrieves threat-intelligence domain data from multiple DomainTools APIs—including Newly Observed Domains (NOD), Newly Active Domains (NAD), Newly Observed Hostnames (NOH), and Domain Discovery—and ingests it into Microsoft Sentinel for analysis and detection",
      "graphQueriesTableName": "DomainToolsThreatIntelDomains_CL",
      "graphQueries": [
        {
          "metricName": "Total domains",
          "legend": "DomainTools Threat Intelligence",
          "baseQuery": "{{graphQueriesTableName}}"
        }
      ],
      "sampleQueries": [
        {
          "description": "All Domains",
          "query": "{{graphQueriesTableName}} | sort by TimeGenerated desc"
        }
      ],
      "dataTypes": [
        {
          "name": "{{graphQueriesTableName}}",
          "lastDataReceivedQuery": "{{graphQueriesTableName}} |summarize Time = max(TimeGenerated) | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and write permissions are required to ingest data into the Log Analytics workspace.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": true
            }
          }
        ],
        "customs": [
          {
            "name": "DomainTools API Key is Required",
            "description": "To access DomainTools Real Time Feed APIs We need the DomainTools API Key "
          }
        ]
      },
      "instructionSteps": [
        {
          "description": "Enter your DomainTools API key.",
          "instructions": [
            {
              "type": "Textbox",
              "parameters": {
                "label": "API Key",
                "name": "apiKey",
                "type": "password",
                "placeholder": "Enter your DomainTools API Key",
                "validations": {
                  "required": true
                }
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "connectLabel": "connect",
                "name": "toggle"
              }
            }
          ],
          "title": "Configure DomainTools API"
        }
      ]
    }
  }
}