{
    "name": "ImpervaCloudWAFCCFDefinition",
    "apiVersion": "2025-07-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "ImpervaCloudWAFLogsCCFDefinition",
            "title": "Imperva Cloud WAF (via Codeless Connector Framework)",
            "publisher": "Microsoft",
            "descriptionMarkdown": "The Imperva WAF Cloud data connector provides the capability to ingest logs into Microsoft Sentinel using the Imperva Log Integration via AWS S3 with SQS notifications. The connector parses CEF-formatted WAF events including access logs and security alerts for threat detection and investigation.Refer to [Imperva WAF Cloud Log Integration](https://docs.imperva.com/bundle/cloud-application-security/page/settings/log-integration.htm) for more information.",
            "graphQueries": [
                {
                    "metricName": "Total events received",
                    "legend": "Imperva WAF Events",
                    "baseQuery": "ImpervaWAFCloud"
                },
                {
                    "metricName": "Security events",
                    "legend": "Security Events",
                    "baseQuery": "ImpervaWAFCloud | where AttackSeverity != \"0\""
                }
            ],
            "sampleQueries": [
                {
                    "description": "Get sample of Imperva WAF events",
                    "query": "ImpervaWAFCloud\n| take 20"
                },
                {
                    "description": "Imperva WAF events by attack type",
                    "query": "ImpervaWAFCloud\n| where AttackSeverity != \"0\"\n| summarize count() by AttackName\n| render piechart"
                },
                {
                    "description": "Imperva WAF events by action",
                    "query": "ImpervaWAFCloud\n| summarize count() by Act\n| render piechart"
                }
            ],
            "dataTypes": [
                {
                    "name": "SentinelImpervaWAFCloudV2Logs",
                    "lastDataReceivedQuery": "SentinelImpervaWAFCloudV2Logs\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                },
                {
                    "type": "IsConnectedQuery",
                    "value": [
                        "SentinelImpervaWAFCloudV2Logs | where TimeGenerated > ago(1h) | take 1"
                    ]
                }
            ],
            "availability": {
                "isPreview": false,
                "status": 1
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "read": true,
                            "write": true,
                            "delete": true,
                            "action": false
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "AWS IAM Role",
                        "description": "An AWS IAM Role with cross-account trust policy is required."
                    }
                ]
            },
            "instructionSteps": [
                {
                    "title": "Connect Imperva WAF Cloud to Microsoft Sentinel\n\n",
                    "instructions": [
                        {
                            "type": "Markdown",
                            "parameters": {
                                "content": ">**NOTE:** This connector fetches the Imperva Cloud WAF logs from AWS S3 bucket"
                            }
                        },
                        {
                            "type": "Markdown",
                            "parameters": {
                                "content": "To gather data from Imperva, you need to configure the following resources"
                            }
                        },
                        {
                            "type": "Markdown",
                            "parameters": {
                                "content": "#### 1. AWS Role ARN \n To gather data from Imperva, you'll need AWS Role ARN."
                            }
                        },
                        {
                            "type": "Markdown",
                            "parameters": {
                                "content": "#### 2. AWS SQS Queue URL \n To gather data from Imperva, you'll need AWS SQS Queue URL.\n\n"
                            }
                        },
                        {
                            "type": "Markdown",
                            "parameters": {
                                "content": "For detailed steps to retrieve the AWS Role ARN, SQS Queue URL, and configure Imperva log forwarding to the Amazon S3 bucket, refer to the [Connector Setup Guide](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ImpervaCloudWAF/Data%20Connectors/Readme.md)."
                            }
                        },
                        {
                            "type": "DataConnectorsGrid",
                            "parameters": {
                                "mapping": [
                                    {
                                        "columnValue": "properties.roleArn",
                                        "columnName": "AWS Role ARN"
                                    },
                                    {
                                        "columnValue": "properties.sqsUrls[0]",
                                        "columnName": "AWS SQS Queue URL"
                                    }
                                ],
                                "menuItems": [
                                    "DeleteConnector"
                                ]
                            }
                        },
                        {
                            "type": "ContextPane",
                            "parameters": {
                                "isPrimary": true,
                                "label": "Add Account",
                                "title": "Add Account",
                                "subtitle": "Add Account",
                                "contextPaneType": "DataConnectorsContextPane",
                                "instructionSteps": [
                                    {
                                        "instructions": [
                                            {
                                                "type": "Textbox",
                                                "parameters": {
                                                    "label": "Role ARN",
                                                    "placeholder": "Enter Role ARN",
                                                    "type": "text",
                                                    "name": "roleArn",
                                                    "required": true
                                                }
                                            },
                                            {
                                                "type": "Textbox",
                                                "parameters": {
                                                    "label": "Queue URL",
                                                    "placeholder": "Enter SQS Queue URL",
                                                    "type": "text",
                                                    "name": "queueUrl",
                                                    "required": true
                                                }
                                            }
                                        ]
                                    }
                                ]
                            }
                        }
                    ]
                }
            ]
        }
    }
}