{
    "name": "GCPFLoadBalancerLogsCCPDefinition",
    "apiVersion": "2022-09-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
    "connectorUiConfig": {
        "id": "GCPFLoadBalancerLogsCCPDefinition",
        "title": "GCP Pub/Sub Load Balancer Logs (via Codeless Connector Platform).",
        "publisher": "Microsoft",
        "descriptionMarkdown": "Google Cloud Platform (GCP) Load Balancer logs provide detailed insights into network traffic, capturing both inbound and outbound activities. These logs are used for monitoring access patterns and identifying potential security threats across GCP resources. Additionally, these logs also include GCP Web Application Firewall (WAF) logs, enhancing the ability to detect and mitigate risks effectively.",
        "graphQueriesTableName": "GCPLoadBalancerLogs_CL",
        "graphQueries": [
            {
                "metricName": "Total events received",
                "legend": "GCP Pub/Sub Load Balancer Logs",
                "baseQuery": "{{graphQueriesTableName}}"
            }
        ],
        "sampleQueries": [
            {
                "description": "Get Sample of GCP Load Balancer Logs",
                "query": "{{graphQueriesTableName}}\n | take 10"
            }
        ],
        "dataTypes": [
            {
                "name": "{{graphQueriesTableName}}",
                "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
            }
        ],
        "availability": {
            "status": 1,
            "isPreview": false
        },
        "connectivityCriteria": [
            {
                "type": "HasDataConnectors"
            }
        ],
        "permissions": {
            "resourceProvider": [
                {
                    "provider": "Microsoft.OperationalInsights/workspaces",
                    "permissionsDisplayText": "Read and Write permissions are required.",
                    "providerDisplayName": "Workspace",
                    "scope": "Workspace",
                    "requiredPermissions": {
                        "read": true,
                        "write": true,
                        "delete": true,
                        "action": false
                    }
                }
            ]
        },
        "instructionSteps": [
            {
                "instructions": [
                    {
                        "type": "MarkdownControlEnvBased",
                        "parameters": {
                            "prodScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation).",
                            "govScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Gov Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov)."
                        }
                    },
                    {
                        "type": "CopyableLabel",
                        "parameters": {
                            "label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.",
                            "fillWith": [
                                "TenantId"
                            ],
                            "name": "PoolId",
                            "disabled": true
                        }
                    },
                    {
                        "type": "Markdown",
                        "parameters": {
                            "content": "#### 2. Enable Load Balancer logs \nIn your GCP account, navigate to the Load Balancer section. In here you can nevigate to [**Backend Service**] -> [**Edit**], once you are in the [**Backend Service**]  on the [**Logging**] section **enable** the checkbox of [**Enable Logs**]. Once you open the rule, switch the toggle button under the **Logs** section to **On**, and save the changes.\n\nFor more information: [Link to documentation](https://cloud.google.com/load-balancing/docs/https/https-logging-monitoring)"
                        }
                    },
                    {
                        "type": "Markdown",
                        "parameters": {
                            "content": "#### 3. Connect new collectors \n To enable GCP Load Balancer Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect."
                        }
                    },
                    {
                        "type": "GCPGrid",
                    "parameters": {}
                    },
                    {
                        "type": "GCPContextPane",
                    "parameters": {}
                    }
                ]
            }
        ]
    }
 }
}