{
  "name": "AliCloudActionTrailCCPDefinition",
  "apiVersion": "2025-03-01",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "AliCloudActionTrailCCPDefinition",
      "title": "Alibaba Cloud ActionTrail (via Codeless Connector Framework)",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The [Alibaba Cloud ActionTrail](https://www.alibabacloud.com/product/actiontrail) data connector provides the capability to retrieve actiontrail events stored into [Alibaba Cloud Simple Log Service](https://www.alibabacloud.com/product/log-service) and store them into Microsoft Sentinel through the [SLS REST API](https://www.alibabacloud.com/help/sls/developer-reference/api-sls-2020-12-30-getlogs). The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.",
      "graphQueriesTableName": "AliCloudActionTrailLogs_CL",
      "graphQueries": [
        {
          "metricName": "Total data received",
          "legend": "AliCloud ActionTrail Events",
          "baseQuery": "{{graphQueriesTableName}}"
        }
      ],
      "sampleQueries": [
        {
          "description": "All AliCloud ActionTrail logs",
          "query": "{{graphQueriesTableName}}\n| sort by TimeGenerated desc"
        },
        {
          "description": "Total Events",
          "query": "{{graphQueriesTableName}}\n | summarize count() by eventId"
        }
      ],
      "dataTypes": [
        {
          "name": "{{graphQueriesTableName}}",
          "lastDataReceivedQuery": "{{graphQueriesTableName}}|summarize Time = max  (TimeGenerated)\n|where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "isPreview": true
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true
            }
          }
        ],
        "customs": [
          {
            "name": "SLS REST API Credentials/permissions",
            "description": "**AliCloudAccessKeyId** and **AliCloudAccessKeySecret** are required for making API calls. RAM policy statement with action of atleast `log:GetLogStoreLogs` over resource `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#LogstoreName}` is needed to grant a RAM user the permissions to call this operation."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Configure access to AliCloud SLS API",
          "description": "Before using the API, you need to prepare your identity account and access key pair to effectively access the API.\n1. We recommend that you use a Resource Access Management (RAM) user to call API operations. For more information, see [create a RAM user and authorize the RAM user to access Simple Log Service](https://www.alibabacloud.com/help/sls/create-a-ram-user-and-authorize-the-ram-user-to-access-log-service).\n2. Obtain the access key pair for the RAM user. For details see [get Access Key pair](https://www.alibabacloud.com/help/ram/user-guide/create-an-accesskey-pair).\n\nNote the access key pair details for the next step."
        },
        {
          "title": "Add ActionTrail Logstore",
          "description": "To enable the Alibaba Cloud ActionTrail connector for Microsoft Sentinel, click upon add ActionTrail Logstore, fill the form with the Alibaba Cloud environment configuration and click Connect.",
          "instructions": [
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnName": "AliCloud SLS Logstore Endpoint URL",
                    "columnValue": "properties.request.apiEndpoint"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "isPrimary": true,
                "label": "Add Logstore",
                "title": "Add ActionTrail Logstore",
                "subtitle": "Add SLS Logstore linked to Alibaba Cloud ActionTrail",
                "contextPaneType": "DataConnectorsContextPane",
                "instructionSteps": [
                  {
                    "instructions": [
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Alibaba Cloud SLS Public Endpoint",
                          "placeholder": "<sls-region>.log.aliyuncs.com",
                          "type": "string",
                          "name": "endpoint"
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Project",
                          "placeholder": "<project>",
                          "type": "string",
                          "name": "project"
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Logstore",
                          "placeholder": "<logstore>",
                          "type": "string",
                          "name": "logstore"
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Access Key ID",
                          "placeholder": "Access Key ID",
                          "type": "password",
                          "name": "accessKeyId"
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Access Key Secret",
                          "placeholder": "Access Key Secret",
                          "type": "password",
                          "name": "accessKeySecret"
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ]
    }
  }
}