{
  "name": "CheckPointEMIOCIntelligence",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "CheckPointEMIOCIntelligence",
      "title": "Check Point EM ThreatCloud Intelligence Feed Connector",
      "publisher": "Check Point",
      "descriptionMarkdown": "Check Point provides a Microsoft Sentinel integration to ingest high-fidelity Indicators of Compromise (IoCs) from the Infinity External Risk Management solution into Microsoft Sentinel. This connector incrementally pulls the premium IOC feed — including malicious IPs, domains, URLs, and file hashes — enriched with confidence, severity, malicious classification, kill chain stage, blocking and uniqueness flags, malware types, and CVE/campaign associations.",
      "graphQueriesTableName": "emiocintel_CL",
      "graphQueries": [
        {
          "metricName": "ThreatCloud Intelligence received",
          "legend": "Check Point EM ThreatCloud Intelligence Feed",
          "baseQuery": "{{graphQueriesTableName}}"
        }
      ],
      "sampleQueries": [
        {
          "description": "All ThreatCloud Intelligence logs",
          "query": "{{graphQueriesTableName}} \n | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "{{graphQueriesTableName}}",
          "lastDataReceivedQuery": "{{graphQueriesTableName}} \n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read/Write/Delete permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true
            }
          }
        ],
        "customs": [
          {
            "name": "Check Point Cyberint API Key, Argos URL, and Customer Name",
            "description": "The connector API key, Argos URL, and Customer Name are required"
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect Check Point EM ThreatCloud Intelligence Feed to Microsoft Sentinel",
          "description": "To enable the connector provide the required information below and click on Connect.\n\n**Argos URL** — Cyberint API URL for your tenant (e.g. `https://your_tenant.cyberint.io`)\n\n**API Token** — Cyberint API access token\n\n**Customer Name** — Company (client) name associated with your Cyberint instance\n",
          "instructions": [
            {
              "type": "Textbox",
              "parameters": {
                "label": "Argos URL",
                "placeholder": "https://your-company.cyberint.io",
                "type": "text",
                "name": "argosurl"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "API Token",
                "placeholder": "API Token",
                "type": "password",
                "name": "apikey"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Customer Name",
                "placeholder": "Company (client) name associated with your Cyberint instance",
                "type": "text",
                "name": "customername"
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "connectLabel": "Connect",
                "name": "Connect"
              }
            }
          ]
        }
      ]
    }
  }
}