{
    "name": "CyfirmaCompromisedAccountsDataConnector",
    "apiVersion": "2024-01-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "CyfirmaCompromisedAccountsDataConnector",
            "title": "CYFIRMA Compromised Accounts",
            "publisher": "Microsoft",
            "isConnectivityCriteriasMatchSome": false,
            "descriptionMarkdown": "The CYFIRMA Compromised Accounts data connector enables seamless log ingestion from the DeCYFIR/DeTCT API into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform, it leverages the DeCYFIR/DeTCT API to retrieve logs. Additionally, it supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview), which parse security data into a custom table during ingestion. This eliminates the need for query-time parsing, enhancing performance and efficiency.",
            "graphQueries": [
                {
                    "metricName": "Total Compromised Accounts logs received",
                    "legend": "Compromised Accounts Logs",
                    "baseQuery": "CyfirmaCompromisedAccounts_CL"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Get Sample of Compromised Accounts logs",
                    "query": "CyfirmaCompromisedAccounts_CL| take 10"
                }
            ],
            "dataTypes": [
                {
                    "name": "CyfirmaCompromisedAccounts_CL",
                    "lastDataReceivedQuery": "CyfirmaCompromisedAccounts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "availability": {
                "status": 1,
                "isPreview": false
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "read": true,
                            "write": true,
                            "delete": true,
                            "action": false
                        }
                    }
                ]
            },
            "instructionSteps": [
                {
                    "title": "CYFIRMA Compromised Accounts",
                    "description": "The CYFIRMA Compromised Accounts Data Connector enables seamless log ingestion from the DeCYFIR/DeTCT API into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform, it leverages the DeCYFIR/DeTCT API to retrieve logs. Additionally, it supports DCR-based ingestion time transformations, which parse security data into a custom table during ingestion. This eliminates the need for query-time parsing, enhancing performance and efficiency.",
                    "estimatedTime": "5 minutes",
                    "icon": "https://www.microsoft.com/favicon.ico",
                    "instructions": [
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "CYFIRMA API URL",
                                "placeholder": "https://decyfir.cyfirma.com",
                                "type": "text",
                                "name": "cyfirmaAPIURL"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "CYFIRMA API Key",
                                "placeholder": "CYFIRMA API Key",
                                "type": "password",
                                "name": "cyfirmaAPIKey"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "API Delta",
                                "placeholder": "API Delta",
                                "type": "text",
                                "name": "apiDelta",
                                "description": "Setting it to true returns only data added since the last API call, while false returns all available data."
                            }
                        },
                        
                        {
                            "type": "ConnectionToggleButton",
                            "parameters": {
                                "connectLabel": "Connect",
                                "name": "connect"
                            }
                        }
                    ]
                }
            ]
        }
    }
}