{
  "name": "ZeroFoxCreditCardsDefinition",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "ZeroFoxCreditCardsDefinition",
      "title": "ZeroFox Enterprise - Credit Cards",
      "publisher": "ZeroFox Enterprise",
      "descriptionMarkdown": "Collects credit cards data from the [ZeroFox](https://www.zerofox.com/threat-intelligence/) API into Microsoft Sentinel.",
      "graphQueriesTableName": "ZeroFoxCreditCards_CL",
      "graphQueries": [
        {
          "metricName": "Total alerts received",
          "legend": "ZeroFox Credit Cards",
          "baseQuery": "ZeroFoxCreditCards_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "List all ZeroFox Credit Cards entries",
          "query": "ZeroFoxCreditCards_CL\n| sort by TimeGenerated asc"
        }
      ],
      "dataTypes": [
        {
          "name": "ZeroFoxCreditCards_CL",
          "lastDataReceivedQuery": "ZeroFoxCreditCards_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        { "type": "HasDataConnectors" }
      ],
      "availability": {
        "status": 1,
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true
            }
          }
        ],
        "customs": [
          {
            "name": "ZeroFox Personal Access Token (PAT)",
            "description": "A ZeroFox PAT is required. You can get it in Data Connectors > [API Data Feeds](https://cloud.zerofox.com/data_connectors/api)."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect ZeroFox to Microsoft Sentinel",
          "description": "To enable the connector, provide the required information below and click Connect.",
          "instructions": [
            {
              "type": "Textbox",
              "parameters": {
                "label": "Provide your ZeroFox account username",
                "placeholder": "Zerofox Account name",
                "type": "text",
                "name": "username",
                "validations": { "required": true }
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Provide your ZeroFox PAT",
                "placeholder": "Zerofox PAT",
                "type": "password",
                "name": "apikey",
                "validations": { "required": true }
              }
            },
            {
              "type": "Dropdown",
              "parameters": {
                "label": "Polling Frequency",
                "name": "pollingFrequency",
                "options": [
                  { "key": "15", "text": "Every 15 minutes" },
                  { "key": "30", "text": "Every 30 minutes" },
                  { "key": "60", "text": "Every hour" },
                  { "key": "120", "text": "Every 2 hours" },
                  { "key": "360", "text": "Every 6 hours" },
                  { "key": "720", "text": "Every 12 hours" },
                  { "key": "1440", "text": "Every day" }
                ],
                "placeholder": "Select polling frequency",
                "required": true,
                "defaultValue": "60"
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "connectLabel": "Connect",
                "name": "Connect"
              }
            }
          ]
        }
      ]
    }
  }
}