{
    "id": "IPinfoCoreDataConnector",
    "title": "IPinfo Core Data Connector",
    "publisher": "IPinfo",
    "descriptionMarkdown": "This IPinfo data connector installs an Azure Function app to download Core datasets and insert it into custom log table in Microsoft Sentinel",
    "graphQueries": [
        {
            "metricName": "Core Data",
            "legend": "Ipinfo_CORE_CL",
            "baseQuery": "Ipinfo_CORE_CL"
        }
    ],
    "sampleQueries": [
        {
            "description": "Ipinfo_CORE_CL",
            "query": "Ipinfo_CORE_CL"
        }
    ],
    "dataTypes": [
        {
            "name": "Ipinfo_CORE_CL",
            "lastDataReceivedQuery": "Ipinfo_CORE_CL | summarize Time = max(TimeGenerated)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "Ipinfo_CORE_CL | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": true
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions on the workspace are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ],
        "customs": [
            {
                "name": "Microsoft.Web/sites permissions",
                "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)."
            },
            {
                "name": "IPinfo API Token",
                "description": "Retrieve your IPinfo API Token [here](https://ipinfo.io/)."
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "1. Retrieve API Token",
            "description": "Retrieve your IPinfo API Token [here](https://ipinfo.io/)."
        },
        {
            "title": "2. In your Azure AD tenant, create an Azure Active Directory (AAD) application",
            "description": "In your Azure AD tenant, create an Azure Active Directory (AAD) application and acquire Tenant ID, Client ID, and Client Secret: Use this Link."
        },
        {
            "title": "3. Assign the AAD application the Microsoft Sentinel Contributor Role.",
            "description": "Assign the AAD application you just created to the Contributor(Privileged administrator roles) and Monitoring Metrics Publisher(Job function roles) in the same “Resource Group” you use for “Log Analytic Workspace” on which “Microsoft Sentinel” is added: Use this Link."
        },
        {
            "title": "4. Get Workspace Resource ID",
            "description": "Use the Log Analytic Workspace -> Properties blade having the 'Resource ID' property value. This is a fully qualified resourceId which is in the format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}'"
        },
        {
            "title": "5. Deploy the Azure Function",
            "description": "Use this for automated deployment of the IPinfo data connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-IPinfo-Core-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **RESOURCE_ID**, **IPINFO_TOKEN**, **TENANT_ID**, **CLIENT_ID**, **CLIENT_SECRET**."
        },
        {
            "title": "Manual Deployment of Azure Functions",
            "description": "Use the following step-by-step instructions to deploy the IPinfo data connector manually with Azure Functions (Deployment via Visual Studio Code).",
            "instructions": [
                {
                    "parameters": {
                        "instructionSteps": [
                            {
                                "title": "Step 1 - Deploy a Function App",
                                "description": "1. Download the Azure Function App file. Extract the archive to your local development computer [Azure Function App](https://aka.ms/sentinel-Ipinfo-Core-functionapp). \n2. Create Function App using Hosting Functions Premium or App service plan using advanced option using VSCode. \n3. Follow the function app manual deployment instructions to deploy the Azure Functions app using VSCode. \n4. After successful deployment of the function app, follow the next steps for configuring it."
                            },
                            {
                                "title": "Step 2 - Configure the Function App",
                                "description": "1. Go to Azure Portal for the Function App configuration.\n2. In the Function App, select the Function App Name and select **Settings** -> **Configuration** or **Environment variables**. \n3. In the **Application settings** tab, select **+ New application setting**.\n4. Add each of the following application settings individually, with their respective string values (case-sensitive):\n\t\tRESOURCE_ID\n\t\tIPINFO_TOKEN\n\t\tTENANT_ID\n\t\tCLIENT_ID\n\t\tCLIENT_SECRET\n\t\tRETENTION_IN_DAYS\n\t\tTOTAL_RETENTION_IN_DAYS\n\t\tSCHEDULE\n\t\tLOCATION \n5. Once all application settings have been entered, click **Save**."
                            }
                        ]
                    },
                    "type": "InstructionStepsGroup"
                }
            ]
        }
    ]
}