{
	"name": "ProofpointCCPDefinition",
	"apiVersion": "2022-09-01-preview",
	"type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
	"location": "{{location}}",
	"kind": "Customizable",
	"properties": {
		"connectorUiConfig": {
			"id": "ProofpointCCPDefinition",
			"title": "Proofpoint On Demand Email Security (via Codeless Connector Platform)",
			"publisher": "Proofpoint",
			"descriptionMarkdown": "Proofpoint On Demand Email Security data connector provides the capability to get Proofpoint on Demand Email Protection data, allows users to check message traceability, monitoring into email activity, threats,and data exfiltration by attackers and malicious insiders. The connector provides ability to review events in your org on an accelerated basis, get event log files in hourly increments for recent activity.",
			"additionalRequirementBanner": "These queries and workbooks are dependent on a parser based on Kusto to work as expected. Follow the steps to use this Kusto functions alias **ProofpointPOD** in queries and workbooks [Follow steps to get this Kusto functions>](https://aka.ms/sentinel-proofpointpod-parser)",
			"graphQueries": [
				{
					"metricName": "Total data received",
					"legend": "ProofpointPODMailLog_CL",
					"baseQuery": "ProofpointPODMailLog_CL"
				},
				{
					"metricName": "Total data received",
					"legend": "ProofpointPODMessage_CL",
					"baseQuery": "ProofpointPODMessage_CL"
				}
			],
			"sampleQueries": [
				{
					"description": "Last ProofpointPOD message Events",
					"query": "ProofpointPODMessage_CL\n | where EventType == 'message'\n | sort by TimeGenerated desc"
				},
				{
					"description": "Last ProofpointPOD maillog Events",
					"query": "ProofpointPODMailLog_CL\n | where EventType == 'maillog'\n | sort by TimeGenerated desc"
				}
			],
			"dataTypes": [
				{
					"name": "ProofpointPODMailLog_CL",
					"lastDataReceivedQuery": "ProofpointPODMailLog_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
				},
				{
					"name": "ProofpointPODMessage_CL",
					"lastDataReceivedQuery": "ProofpointPODMessage_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
				}
			],
			"connectivityCriteria": [
				{
					"type": "HasDataConnectors",
					"value": null
				}
			],
			"availability": {
				"status": 1,
				"isPreview": false
			},
			"permissions": {
				"resourceProvider": [
					{
						"provider": "Microsoft.OperationalInsights/workspaces",
						"permissionsDisplayText": "read and write permissions on the workspace are required.",
						"providerDisplayName": "Workspace",
						"scope": "Workspace",
						"requiredPermissions": {
							"read": true,
							"write": true,
							"delete": true,
							"action": false
						}
					}
				],
				"customs": [
					{
						"name": "Websocket API Credentials/permissions",
						"description": "**ProofpointClusterID**, and **ProofpointToken** are required. [See the documentation to learn more about API](https://proofpointcommunities.force.com/community/s/article/Proofpoint-on-Demand-Pod-Log-API)."
					}
				]
			},
			"instructionSteps": [
				{
					"instructions": [
						{
							"type": "Markdown",
							"parameters": {
								"content": "#### Configuration steps for the Proofpoint POD Websocket API \n ####  The PoD Log API does not allow use of the same token for more than one session at the same time, so make sure your token isn't used anywhere. \n Proofpoint Websocket API service requires Remote Syslog Forwarding license. Please refer the [documentation](https://proofpointcommunities.force.com/community/s/article/Proofpoint-on-Demand-Pod-Log-API) on how to enable and check PoD Log API. \n You must provide your cluster id and security token."
							}
						},
						{
							"type": "Markdown",
							"parameters": {
								"content": "#### 1. Retrieve the cluster id\n   1.1. Log in to the [proofpoint](https://admin.proofpoint.com/) [**Management Console**] with Admin user credentials\n\n   1.2. In the **Management Console**, the cluster id is displayed in the upper-right corner."
							}
						},
						{
							"type": "Markdown",
							"parameters": {
								"content": "#### 2. Retrieve the API token\n   2.1. Log in to the [proofpoint](https://admin.proofpoint.com/) [**Management Console**] with Admin user credentials\n\n  2.2. In the **Management Console**, click **Settings** -> **API Key Management** \n\n  2.3. Under **API Key Management** click on the **PoD Logging** tab.\n\n   2.4. Get or create a new API key."
							}
						},
						{
							"parameters": {
								"label": "Cluster Id",
								"placeholder": "cluster_id",
								"type": "text",
								"name": "clusterId"
							},
							"type": "Textbox"
						},
						{
							"parameters": {
								"label": "API Key",
								"placeholder": "API Key",
								"type": "text",
								"name": "apiKey"
							},
							"type": "Textbox"
						},
						{
							"parameters": {
								"label": "toggle",
								"name": "toggle"
							},
							"type": "ConnectionToggleButton"
						}
					],
					"innerSteps": null
				}
			],
			"isConnectivityCriteriasMatchSome": false
		}
	}
}