{
  "name": "UniqkeyEventsConnector",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "UniqkeyEventsConnector",
      "title": "Uniqkey Security Events",
      "publisher": "Uniqkey",
      "logo": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Uniqkey.svg",
      "descriptionMarkdown": "The Uniqkey connector ingests security and audit events from the [Uniqkey](https://uniqkey.eu/) business password management platform into Microsoft Sentinel. Events cover authentication, credential access, credential management, sharing, policy management, threat detection and other administrative activity across your organization.\n\n**Prerequisites:**\n1. An active Uniqkey organization\n2. A Uniqkey SIEM integration API token generated by your Uniqkey administrator",
      "graphQueriesTableName": "UniqkeyEvents_CL",
      "graphQueries": [
        {
          "metricName": "Total events received",
          "legend": "Uniqkey Events",
          "baseQuery": "UniqkeyEvents_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "Latest Uniqkey events",
          "query": "UniqkeyEvents_CL\n| project TimeGenerated, Category, Action, ActorEmail, ActorType, ClientSystem, Outcome, TargetType, TargetName\n| sort by TimeGenerated desc\n| take 100"
        },
        {
          "description": "Authentication events by user",
          "query": "UniqkeyEvents_CL\n| where Category == \"authentication\"\n| summarize EventCount = count() by ActorEmail, Action\n| sort by EventCount desc"
        },
        {
          "description": "Credential access activity",
          "query": "UniqkeyEvents_CL\n| where Category == \"credential_access\"\n| project TimeGenerated, ActorEmail, Action, TargetType, TargetName, SrcIpAddr\n| sort by TimeGenerated desc"
        },
        {
          "description": "Threat detection events",
          "query": "UniqkeyEvents_CL\n| where Category == \"threat_detection\"\n| project TimeGenerated, ActorEmail, ActorType, Action, TargetType, TargetName\n| sort by TimeGenerated desc"
        },
        {
          "description": "Vault sharing activity",
          "query": "UniqkeyEvents_CL\n| where Category == \"sharing\" and TargetType == \"vault\"\n| project TimeGenerated, ActorEmail, Action, TargetName\n| sort by TimeGenerated desc"
        },
        {
          "description": "Events by source system",
          "query": "UniqkeyEvents_CL\n| summarize EventCount = count() by ClientSystem, Category\n| sort by EventCount desc"
        }
      ],
      "dataTypes": [
        {
          "name": "UniqkeyEvents_CL",
          "lastDataReceivedQuery": "UniqkeyEvents_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": true
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": true
            }
          }
        ],
        "customs": [
          {
            "name": "Uniqkey SIEM API token",
            "description": "A Uniqkey SIEM integration API token is required. Your Uniqkey administrator can generate one in the Uniqkey admin portal under Settings > Integrations > SIEM."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "1. Obtain your Uniqkey SIEM API token",
          "description": "1. Sign in to the Uniqkey admin portal as an administrator\n2. Go to **Settings** > **Integrations** > **SIEM**\n3. Generate a new API token\n4. Copy the token and store it securely - it authorizes read access to your organization's event feed. Each Uniqkey organization uses its own token."
        },
        {
          "title": "2. Connect",
          "description": "Enter your Uniqkey SIEM API token below, then select **Connect**. Microsoft Sentinel will begin polling the Uniqkey events endpoint on your behalf.",
          "instructions": [
            {
              "type": "Textbox",
              "parameters": {
                "label": "Uniqkey SIEM API token",
                "placeholder": "Enter your API token",
                "type": "password",
                "name": "apiToken"
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "connectLabel": "Connect",
                "disconnectLabel": "Disconnect"
              }
            }
          ]
        }
      ]
    }
  }
}