{
  "name": "CTM360HackerViewConnectorDefinition",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "CTM360HackerViewConnectorDefinition",
      "title": "CTM360 HackerView (Serverless)",
      "publisher": "CTM360",
      "descriptionMarkdown": "The CTM360 HackerView connector enables you to ingest security issues and vulnerabilities from your HackerView External Attack Surface Management platform into Microsoft Sentinel. This serverless connector uses the REST API to automatically pull issue data for analysis and correlation with other security events.",
      "graphQueriesTableName": "HackerViewLog_AzureV2_CL",
      "graphQueries": [
        {
          "metricName": "Total Issues Received",
          "legend": "HackerView Issues",
          "baseQuery": "HackerViewLog_AzureV2_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "All HackerView Issues",
          "query": "HackerViewLog_AzureV2_CL\n| take 10"
        },
        {
          "description": "High Severity Issues",
          "query": "HackerViewLog_AzureV2_CL\n| where Severity == 'High'\n| summarize count() by Category"
        },
        {
          "description": "Recent Issues (Last 24 Hours)",
          "query": "HackerViewLog_AzureV2_CL\n| where TimeGenerated > ago(24h)\n| project TimeGenerated, Title, Severity, Status, Category"
        }
      ],
      "dataTypes": [
        {
          "name": "HackerViewLog_AzureV2_CL",
          "lastDataReceivedQuery": "HackerViewLog_AzureV2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": false
            }
          }
        ],
        "customs": [
          {
            "name": "HackerView API Key",
            "description": "A valid HackerView API key with permissions to access issues data is required."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect CTM360 HackerView to Microsoft Sentinel",
          "description": "This connector uses the HackerView REST API to automatically ingest security issues into Microsoft Sentinel.",
          "instructions": [
            {
              "type": "InfoMessage",
              "parameters": {
                "text": "This is a serverless connector that uses Azure's Codeless Connector Platform (CCP). No Azure Function deployment is required."
              }
            }
          ]
        },
        {
          "title": "Step 1: Obtain CTM360 API Keys",
          "description": "To setup this integration, you will need HackerView API Key. You can get these keys using the following links:\n\nHackerView API Key found from this link: https://platform.ctm360.com/start/integrations after logging with you account"
        },
        {
          "title": "Step 2: Configure the Connector",
          "description": "Enter your HackerView API key and click Connect to begin data ingestion.",
          "instructions": [
            {
              "type": "Textbox",
              "parameters": {
                "label": "API Key",
                "placeholder": "Enter your HackerView API Key",
                "type": "password",
                "name": "apiKey"
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "connectLabel": "Connect",
                "disconnectLabel": "Disconnect",
                "name": "connect"
              }
            }
          ]
        },
        {
          "title": "Step 3: Verify Data Ingestion",
          "description": "After connecting, data should start flowing within 5-10 minutes. Run the following query to verify:",
          "instructions": [
            {
              "type": "InfoMessage",
              "parameters": {
                "text": "HackerViewLog_AzureV2_CL\n| take 10"
              }
            }
          ]
        }
      ]
    }
  }
}