{
    "name": "SophosEndpointProtectionCCPDefinition",
    "apiVersion": "2022-09-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "SophosEndpointProtectionCCPDefinition",
            "title": "Sophos Endpoint Protection (via Codeless Connector Platform)",
            "publisher": "Microsoft",
            "descriptionMarkdown": "The [Sophos Endpoint Protection](https://www.sophos.com/en-us/products/endpoint-antivirus.aspx) data connector provides the capability to ingest [Sophos events](https://developer.sophos.com/docs/siem-v1/1/routes/events/get) and [Sophos alerts](https://developer.sophos.com/docs/siem-v1/1/routes/alerts/get) into Microsoft Sentinel. Refer to [Sophos Central Admin documentation](https://docs.sophos.com/central/Customer/help/en-us/central/Customer/concepts/Logs.html) for more information.",
            "graphQueriesTableName": "SophosEPEvents_CL",
            "graphQueries": [
                {
                    "metricName": "Total events received",
                    "legend": "Sophos Endpoint Protection Event logs",
                    "baseQuery": "{{graphQueriesTableName}}"
                },
                {
                    "metricName": "Total alerts received",
                    "legend": "Sophos Endpoint Protection Alert logs",
                    "baseQuery": "SophosEPAlerts_CL"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Get a sample of Sophos Endpoint Protection Event logs",
                    "query": "{{graphQueriesTableName}}\n| take 10"
                },
                {
                    "description": "Get a sample of Sophos Endpoint Protection Alert logs",
                    "query": "SophosEPAlerts_CL\n| take 10"
                }
            ],
            "dataTypes": [
                {
                    "name": "{{graphQueriesTableName}}",
                    "lastDataReceivedQuery": "{{graphQueriesTableName}}\n|summarize Time = max  (TimeGenerated)\n|where isnotempty(Time)"
                },
                {
                    "name": "SophosEPAlerts_CL",
                    "lastDataReceivedQuery": "SophosEPAlerts_CL\n|summarize Time = max  (TimeGenerated)\n|where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "write": true,
                            "read": true,
                            "delete": true
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "Sophos Endpoint Protection API access",
                        "description": "Access to the Sophos Endpoint Protection API through a service principal is required."
                    }
                ]
            },
            "instructionSteps": [
                {
                    "description": "Follow [Sophos instructions](https://developer.sophos.com/getting-started-tenant) to create a service principal with access to the Sophos API. It will need the Service Principal ReadOnly role.\n Through those instructions, you should get the Client ID, Client Secret, Tenant ID and data region.\n Fill the form bellow with that information.",
                    "instructions": [
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Sophos Tenant ID",
                                "placeholder": "Sophos Tenant ID",
                                "type": "text",
                                "name": "sophosTenantId"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Sophos Tenant Data Region",
                                "placeholder": "eu01, eu02, us01, us02 or us03",
                                "type": "text",
                                "name": "sophosRegion"
                            }
                        },
                        {
                            "type": "OAuthForm",
                            "parameters": {
                                "clientIdLabel": "Client ID",
                                "clientSecretLabel": "Client Secret",
                                "connectButtonLabel": "Connect",
                                "disconnectButtonLabel": "Disconnect"
                            }
                        },
                        {
                            "type": "DataConnectorsGrid",
                            "parameters": {
                                "mapping": [
                                    {
                                        "columnValue": "name",
                                        "columnName": "Name"
                                    },
                                    {
                                        "columnValue": "id",
                                        "columnName": "ID"
                                    }
                                ]
                            }
                        }
                    ],
                    "title": "Connect to Sophos Endpoint Protection API to start collecting event and alert logs in Microsoft Sentinel"
                }
            ]
        }
    }
}