{
  "name": "WithSecureElementsCCF",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "WithSecureElementsCCF",
      "title": "WithSecure Elements (CCF)",
      "publisher": "WithSecure",
      "descriptionMarkdown": "WithSecure Elements security events ingested via Microsoft Sentinel's Codeless Connector Framework (CCF) \u2014 a fully SaaS deployment with no Azure Function, Storage Account or Key Vault to manage.\n\nThe connector polls the [WithSecure Elements security-events API](https://connect.withsecure.com/api-reference/elements#post-/security-events/v1/security-events) and stores normalized events in the `WsSecurityEvents_CL` Log Analytics table.",
      "graphQueriesTableName": "WsSecurityEvents_CL",
      "graphQueries": [
        {
          "metricName": "Total events received",
          "legend": "WithSecure Elements events",
          "baseQuery": "WsSecurityEvents_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "All WithSecure events (most recent first)",
          "query": "WsSecurityEvents_CL\n| sort by TimeGenerated desc"
        },
        {
          "description": "Events grouped by engine",
          "query": "WsSecurityEvents_CL\n| summarize Count = count() by DeviceEventClassID\n| sort by Count desc"
        }
      ],
      "dataTypes": [
        {
          "name": "WsSecurityEvents_CL",
          "lastDataReceivedQuery": "WsSecurityEvents_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "read and write permissions on the workspace are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true
            }
          }
        ],
        "customs": [
          {
            "name": "WithSecure Elements API client credentials",
            "description": "Client credentials are required. See the [user guide](https://connect.withsecure.com/getting-started/elements#getting-client-credentials) for details."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Create WithSecure Elements API credentials",
          "description": "Follow the [user guide](https://connect.withsecure.com/getting-started/elements#getting-client-credentials) to create Elements API credentials. Save the client id and client secret in a safe place."
        },
        {
          "title": "Connect WithSecure Elements to Microsoft Sentinel",
          "description": "Provide the Elements API URL together with the client id and client secret you created in the previous step, then click **Connect** to start ingesting events.",
          "instructions": [
            {
              "type": "Textbox",
              "parameters": {
                "label": "Elements API URL",
                "placeholder": "https://api.connect.withsecure.com",
                "type": "text",
                "name": "elementsApiUrl"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Engine (optional)",
                "placeholder": "default",
                "type": "text",
                "name": "engine"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Engine Group (optional)",
                "placeholder": "default",
                "type": "text",
                "name": "engineGroup"
              }
            },
            {
              "type": "OAuthForm",
              "parameters": {
                "clientIdLabel": "Elements API Client Id",
                "clientSecretLabel": "Elements API Client Secret",
                "connectButtonLabel": "Connect",
                "disconnectButtonLabel": "Disconnect"
              }
            }
          ]
        }
      ]
    }
  }
}