{
  "name": "NetskopeAlertEventsConnector",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "NetskopeAlertEventsConnector",
      "title": "Netskope Alerts & Events (via Log Streaming)",
      "publisher": "Netskope",
      "descriptionMarkdown": "The Netskope Alerts & Events data connector enables ingestion of alert and event logs from Netskope into Microsoft Sentinel using Netskope Log Streaming (NLS) capability. Alerts & Events logs provide visibility into DLP incidents, malware and threat detections, policy violations, anomalous behavior, compromised credentials, and application activity across the Netskope Security Cloud.\n\nThis connector uses Azure Blob Storage and Event Grid to ingest the gzip-compressed CSV logs that Netskope streams to your storage account. The logs are mapped to columns positionally, so the Netskope Log Streaming configuration must use the matching field order.",
      "graphQueries": [
        {
          "metricName": "Total logs received",
          "legend": "Netskope Alerts & Events Logs",
          "baseQuery": "NetskopeAlertEvents_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get Sample of Netskope Alerts & Events Logs",
          "query": "NetskopeAlertEvents_CL | take 10"
        },
        {
          "description": "High Severity Alerts",
          "query": "NetskopeAlertEvents_CL | where Alert =~ 'yes' | where Severity =~ 'high' | summarize Count = count() by AlertName | top 10 by Count"
        },
        {
          "description": "DLP Incidents by Profile",
          "query": "NetskopeAlertEvents_CL | where isnotempty(DlpProfile) | summarize Count = count() by DlpProfile | top 10 by Count"
        }
      ],
      "dataTypes": [
        {
          "name": "NetskopeAlertEvents_CL",
          "lastDataReceivedQuery": "NetskopeAlertEvents_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors",
          "value": null
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": true,
              "action": false
            }
          },
          {
            "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
            "permissionsDisplayText": "Read permissions to shared keys for the workspace are required.",
            "providerDisplayName": "Keys",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": false,
              "write": false,
              "delete": false,
              "action": true
            }
          }
        ],
        "customs": [
          {
            "name": "Subscription permissions",
            "description": "You need permissions to create the data flow resources:\n- Storage queues (notification queue and dead-letter queue)\n- Event Grid topic and subscription (to send 'blob created event' notifications)\n- Role assignments (to grant access for Microsoft Sentinel app to the blob container and storage queues)"
          },
          {
            "name": "Netskope Log Streaming Configuration",
            "description": "Configure Netskope Log Streaming (NLS) to send Alerts & Events logs to your Azure Blob Storage container. Follow the [Netskope NLS documentation](https://docs.netskope.com/en/netskope-help/data-security/netskope-log-streaming/) for setup instructions."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect Netskope Alerts & Events Logs to Microsoft Sentinel",
          "description": "To enable the Netskope Alerts & Events Logs for Microsoft Sentinel, provide the required information below and click on Connect.\n\n**Prerequisites:**\n1. Configure Netskope NLS to send Alerts & Events logs to an Azure Blob Storage container\n2. Ensure you have the required permissions on the storage account",
          "instructions": [
            {
              "type": "ServicePrincipalIDTextBox_test",
              "parameters": {
                "tenantId": "[subscription().tenantId]",
                "name": "principalId",
                "appId": "4f05ce56-95b6-4612-9d98-a45c8cc33f9f"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Blob Container URL",
                "type": "text",
                "name": "blobContainerUri"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Blob Folder Name (Optional)",
                "placeholder": "Leave empty if logs are at container root",
                "type": "text",
                "name": "blobFolderName"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Storage Account Location",
                "placeholder": "e.g., eastus",
                "type": "text",
                "name": "StorageAccountLocation"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Storage Account Resource Group Name",
                "type": "text",
                "name": "StorageAccountResourceGroupName"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Storage Account Subscription ID",
                "type": "text",
                "name": "StorageAccountSubscription"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Event Grid Topic Name (if exists)",
                "description": "The data flow uses Event Grid to send 'blob-created event' notifications. There can be only one Event Grid topic per storage account. Go to your storage account's 'Events' section. If you already have a topic, provide its name. Otherwise, leave empty to create a new one.",
                "placeholder": "Leave empty to create new topic",
                "type": "text",
                "name": "EGSystemTopicName"
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "label": "toggle",
                "name": "toggle"
              }
            }
          ]
        }
      ],
      "isConnectivityCriteriasMatchSome": false
    }
  }
}