{
    "id": "DATA CONNECTOR ID",
    "title": "DATA CONNECTOR TITLE",
    "publisher": "PROVIDER NAME",
    "descriptionMarkdown": "Use this template if you want to use Upload Indicators REST API to push indicators into Azure Sentinel Threat Intelligence. Please replace the PLACEHOLDERS.",
    "graphQueries": [
        {
            "metricName": "Total indicators received",
            "legend": "Connection Events",
            "baseQuery": "ThreatIntelligenceIndicator | where SourceSystem == 'PROVIDER SOURCE SYSTEM NAME'"
        }
    ],
    "sampleQueries": [
        {
            "description": "All Threat Intelligence APIs Indicators",
            "query": "ThreatIntelligenceIndicator | where SourceSystem == 'PROVIDER SOURCE SYSTEM NAME'| sort by TimeGenerated desc"
        }
    ],
    "dataTypes": [
        {
            "name": "ThreatIntelligenceIndicator",
            "lastDataReceivedQuery": "ThreatIntelligenceIndicator| where isnotempty(TimeGenerated) and SourceSystem == 'PROVIDER SOURCE SYSTEM NAME' | summarize Time = max(TimeGenerated)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "ThreatIntelligenceIndicator| where SourceSystem == 'PROVIDER SOURCE SYSTEM NAME' | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": true
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.SecurityInsights/threatintelligence/write",
                "permissionsDisplayText": "write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "You can connect your threat intelligence data sources to Microsoft Sentinel by either: ",
            "description": "\n>Using an integrated Threat Intelligence Platform (TIP), such as Threat Connect, Palo Alto Networks MineMeld, MISP, and others. \n\n>Calling the Microsoft Sentinel data plane API directly from another application. "
        },
        {
            "title": "Follow These Steps to Connect to your Threat Intelligence: ",
            "description": ""
        },
        {
            "title": "1. Get AAD Access Token",
            "description": "To send request to the APIs, you need to acquire Azure Active Directory access token. You can follow instruction in this page: https://docs.microsoft.com/azure/databricks/dev-tools/api/latest/aad/app-aad-token#get-an-azure-ad-access-token \n  - Notice: Please request AAD access token with scope value: https://management.azure.com/.default  "
        },
        {
            "title": "2. Send indicators to Sentinel",
            "description": "You can send indicators by calling our Upload Indicators API. For more information about the API, click here. \n\n>HTTP method: POST \n\n>Endpoint: https://sentinelus.azure-api.net/workspaces/{WORKSPACEID}/threatintelligenceindicators:upload?api-version=2022-07-01  \n\n>WORKSPACEID: the workspace that the indicators are uploaded to  (can be copied from the following).  \n\n\n>Header Value 1: \"Authorization\" = \"Bearer [AAD Access Token from step 1]\" \n\n\n> Header Value 2: \"Content-Type\" = \"application/json\"  \n \n>Body: The body is a JSON object containing an array of indicators in STIX format. For more information about the API, click here",
            "instructions":[
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                }
            ]
        }
    ]
}