{
  "name": "InfobloxSOCInsightsConnector",
  "apiVersion": "2025-07-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "InfobloxSOCInsightsConnector",
      "title": "Infoblox SOC Insights (via Codeless Connector Framework)",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The [Infoblox SOC Insights](https://www.infoblox.com/products/bloxone-threat-defense/) data connector enables seamless integration of Infoblox BloxOne SOC Insight data with Microsoft Sentinel, allowing security teams to leverage advanced search, correlation, alerting, and threat intelligence enrichment capabilities. This connector provides comprehensive visibility into active security insights and threat detections, DNS security events with threat classifications, threat family and class categorizations, persistent and spreading threats across your network, and event blocking statistics. By aggregating Infoblox's advanced threat intelligence with Sentinel's powerful analytics, organizations can gain deeper insights into their security posture and respond more effectively to emerging threats. For detailed information about the underlying data sources and API capabilities, refer to the [Infoblox SOC Insights documentation](https://docs.infoblox.com/space/BloxOneThreatDefense/501514252/SOC+Insights).",
      "graphQueries": [
        {
          "metricName": "Total SOC Insights received",
          "legend": "Infoblox SOC Insights",
          "baseQuery": "InfobloxInsight"
        }
      ],
      "sampleQueries": [
        {
          "description": "Return all logs involving DNS Tunneling",
          "query": "InfobloxInsight\n | where ThreatType == \"DNS Tunneling\""
        },
        {
          "description": "Return all logs involving a configuration issue",
          "query": "InfobloxInsight\n | where TClass == \"TI-CONFIGURATIONISSUE\""
        },
        {
          "description": "Return count of critical priority insights",
          "query": "InfobloxInsight\n | where PriorityText == \"CRITICAL\"\n | summarize dcount(InsightId) by PriorityText"
        },
        {
          "description": "Return insights summary by ThreatClass",
          "query": "InfobloxInsight\n | summarize dcount(InsightId), sum(toint(NumEvents)) by TClass"
        },
        {
          "description": "Return each Insight by ThreatFamily",
          "query": "InfobloxInsight\n | summarize dcount(InsightId) by TFamily"
        }
      ],
      "dataTypes": [
        {
          "name": "InfobloxInsight",
          "lastDataReceivedQuery": "InfobloxInsight\n | where TimeGenerated > ago(3d) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "isPreview": true,
        "status": 1
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true,
              "action": false
            }
          }
        ],
        "customs": [
          {
            "name": "Infoblox API access",
            "description": "**Infoblox API Key** is required to access the SOC Insights API"
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "1. Connector Management",
          "description": "Manage your Infoblox SOC Insights connector instances",
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "## Infoblox SOC Insights Instances\n\nManage multiple Infoblox connector instances. Each instance can connect to different Infoblox environments or regions."
              }
            },
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnName": "Connector Name",
                    "columnValue": "properties.addOnAttributes.friendlyName"
                  },
                  {
                    "columnName": "API URL",
                    "columnValue": "properties.request.apiEndpoint"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "label": "Add Connector",
                "title": "Add Infoblox SOC Insights Connector",
                "subtitle": "Connect to Infoblox BloxOne Threat Defense API",
                "contextPaneType": "DataConnectorsContextPane",
                "instructionSteps": [
                  {
                    "instructions": [
                      {
                        "type": "Markdown",
                        "parameters": {
                          "content": "## API Credentials\r\n\r\nTo configure this connector, you need an Infoblox API key with SOC Insights access.\r\n\r\n#### Generate API Key\r\n\r\n1. Log in to your [Infoblox Cloud Services Portal](https://csp.infoblox.com/atlas/app/welcome)\r\n2. Navigate to **Administration** > **API Keys**\r\n3. Click **Create API Key**\r\n4. Provide a descriptive name (e.g., 'Microsoft Sentinel Integration')\r\n5. Select appropriate permissions for SOC Insights access\r\n6. Copy and securely store the generated API key\r\n\r\n**Note**: The API key is displayed only once. Store it securely.\r\n\r\nFor detailed instructions, see [How to Create an API Key](https://docs.infoblox.com/space/BloxOneThreatDefense/230394187/How+Do+I+Create+an+API+Key%3F)."
                        }
                      },
                      {
                        "type": "Markdown",
                        "parameters": {
                          "content": "## API Configuration"
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Infoblox API Base URL",
                          "placeholder": "https://csp.infoblox.com",
                          "type": "url",
                          "name": "infobloxApiUrl",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "InfoMessage",
                        "parameters": {
                          "text": "**API URL by Region:**\n- **US Region**: `https://csp.infoblox.com`\n- **EU Region**: `https://csp.eu.infoblox.com`\n- **Custom/On-Premises**: Contact your Infoblox administrator",
                          "visible": true,
                          "inline": false
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "API Key",
                          "placeholder": "Your Infoblox API Key",
                          "type": "password",
                          "name": "apiKey",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Connector Friendly Name",
                          "placeholder": "Enter a unique friendly name for this connector",
                          "type": "text",
                          "name": "friendlyName",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "InfoMessage",
                        "parameters": {
                          "text": "The friendly name helps you identify this connector instance in the grid and in the collected data.",
                          "visible": true,
                          "inline": true
                        }
                      },
                      {
                        "type": "InfoMessage",
                        "parameters": {
                          "text": "**Data Collection Schedule**: The connector will poll for new insights every 5 minutes.",
                          "visible": true,
                          "inline": true
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ],
      "isConnectivityCriteriasMatchSome": false
    }
  }
}