{
  "properties": {
    "connectorUiConfig": {
      "id": "RubrikProtectionStatus",
      "title": "Rubrik Security Cloud Protection Status (using Codeless Connector Framework)",
      "publisher": "Rubrik, Inc",
      "descriptionMarkdown": "The Rubrik Security Cloud Protection Status data connector allows you to ingest protection and compliance status information from RSC into Microsoft Sentinel.",
      "logo": "rubrikLogo.svg",
      "graphQueriesTableName": "RubrikProtectionStatus_CL",
      "graphQueries": [
        {
          "metricName": "Total data received",
          "legend": "RubrikProtectionStatus_CL",
          "baseQuery": "RubrikProtectionStatus_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "All RSC protection status events with key metrics",
          "query": "RubrikProtectionStatus_CL | take 10 | project AssetName, ComplianceStatus, TotalSnapshots, LocalStorage, DataReduction, ClusterName"
        },
        {
          "description": "Assets out of compliance with storage metrics",
          "query": "RubrikProtectionStatus_CL | where ComplianceStatus != 'Compliant' | project AssetName, ComplianceStatus, ArchivalComplianceStatus, ReplicationComplianceStatus, LastSnapshot, LocalStorage, SlaDomainName"
        },
        {
          "description": "Storage efficiency analysis",
          "query": "RubrikProtectionStatus_CL | where isnotnull(DataReduction) | project AssetName, LogicalBytes, PhysicalBytes, DataReduction, LogicalDataReduction, LocalStorage | order by DataReduction desc"
        },
        {
          "description": "Snapshot distribution summary",
          "query": "RubrikProtectionStatus_CL | summarize TotalAssets = count(), AvgSnapshots = avg(TotalSnapshots), TotalStorage = sum(LocalStorage) by ClusterName, SlaDomainName"
        },
        {
          "description": "Protection status overview",
          "query": "RubrikProtectionStatus_CL | summarize count() by ProtectionStatus, ComplianceStatus | render piechart"
        }
      ],
      "dataTypes": [
        {
          "name": "RubrikProtectionStatus_CL",
          "lastDataReceivedQuery": "RubrikProtectionStatus_CL | summarize Time = max(TimeGenerated) | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors",
          "value": null
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "read and write permissions on the workspace are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true
            }
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "1. Enter Rubrik Security Cloud Credentials",
          "description": "Provide your RSC API credentials to enable data collection.",
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "**Configuration Steps:**\n\n1. **RSC URL** - Your organization's RSC URL (e.g., `https://your-org.my.rubrik.com`)\n2. **Client ID** - Service account client ID from RSC (format: `client|xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`)\n3. **Client Secret** - Service account client secret from RSC\n\n**To create a service account in RSC:**\n- Go to RSC → Settings → Access Management → Service Accounts\n- Create new service account with appropriate API permissions\n- Note the Client ID and Client Secret"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "RSC URL",
                "placeholder": "https://your-org.my.rubrik.com",
                "type": "text",
                "name": "rscUrl"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Client ID",
                "placeholder": "client|xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
                "type": "text",
                "name": "clientId"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Client Secret",
                "placeholder": "Enter Client Secret",
                "type": "password",
                "name": "clientSecret"
              }
            }
          ]
        },
        {
          "title": "2. Connect to Rubrik Security Cloud",
          "description": "Click Connect to start data ingestion.",
          "instructions": [
            {
              "type": "ConnectionToggleButton",
              "parameters": {}
            }
          ]
        }
      ]
    }
  },
  "apiVersion": "2024-01-01-preview",
  "name": "RubrikSecurityCloud",
  "kind": "Customizable",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions"
}