{
  "name": "VaikoraSentinel",
  "apiVersion": "2025-09-01",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "VaikoraSentinel",
      "connectorId": "VaikoraSentinel",
      "title": "Vaikora AI Agent Behavioral Signals",
      "publisher": "Data443 Risk Mitigation, Inc.",
      "descriptionMarkdown": "Ingest AI agent behavioral signals from the Vaikora API into Microsoft Sentinel using the Codeless Connector Framework (CCF). Monitor agent actions, policy decisions, anomaly scores, and risk levels to detect suspicious AI activity in your environment.",
      "graphQueriesTableName": "Vaikora_AgentSignals_CL",
      "graphQueries": [
        {
          "metricName": "Total Vaikora agent signals received",
          "legend": "Vaikora Agent Signals",
          "baseQuery": "Vaikora_AgentSignals_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "High severity agent actions (last 24 hours)",
          "query": "Vaikora_AgentSignals_CL | where TimeGenerated >= ago(24h) | where severity_s in ('high', 'critical') | project TimeGenerated, agent_id_s, action_type_s, severity_s, policy_decision_s, anomaly_score_d"
        },
        {
          "description": "Anomalous agent behavior (last 7 days)",
          "query": "Vaikora_AgentSignals_CL | where TimeGenerated >= ago(7d) | where is_anomaly_b == true | summarize AnomalyCount=count(), AvgAnomalyScore=avg(anomaly_score_d) by agent_id_s, action_type_s | order by AnomalyCount desc"
        },
        {
          "description": "Blocked policy decisions (last 48 hours)",
          "query": "Vaikora_AgentSignals_CL | where TimeGenerated >= ago(48h) | where policy_decision_s == 'block' | project TimeGenerated, agent_id_s, action_type_s, resource_type_s, policy_id_s, log_hash_s"
        }
      ],
      "dataTypes": [
        {
          "name": "Vaikora_AgentSignals_CL",
          "lastDataReceivedQuery": "Vaikora_AgentSignals_CL | summarize Time = max(TimeGenerated) | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "status": "Available",
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": false
            }
          }
        ],
        "customs": [
          {
            "name": "Vaikora API Key",
            "description": "A Vaikora API key (vk_xxxxx) with read access to the actions endpoint. Obtain this from your Vaikora dashboard under Settings > API Keys."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect Vaikora AI Agent Behavioral Signals",
          "description": "To enable the Vaikora connector, enter your Vaikora API key below and click Connect. The Agent ID is optional; use it to scope ingestion to a single agent, or leave it blank to ingest actions from all agents the key can see.\n\nYour API key is available in the [Vaikora dashboard](https://vaikora.com) under **Settings > API Keys**. The Agent ID is the UUID shown on each agent's detail page.",
          "instructions": [
            {
              "type": "Textbox",
              "parameters": {
                "label": "Vaikora API Key",
                "placeholder": "vk_xxxxxxxxxxxxxxxxxxxxxxxx",
                "type": "password",
                "name": "vaikoraApiKey"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Vaikora Agent ID (optional)",
                "placeholder": "Leave blank to monitor all agents",
                "type": "text",
                "name": "vaikoraAgentId"
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "connectLabel": "Connect",
                "name": "connect"
              }
            }
          ]
        }
      ]
    }
  }
}