{
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "apiVersion": "2022-09-01-preview",
    "name": "NetskopeAlertsEvents",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "NetskopeAlertsEvents",
            "title": "Netskope Alerts and Events (via Codeless Connector Framework)",
            "publisher": "Netskope",
            "descriptionMarkdown": "Netskope Security Alerts and Events",
            "graphQueriesTableName": "NetskopeAlerts_CL",
            "graphQueries": [
                {
                    "metricName": "Total Netskope Alerts received",
                    "legend": "Netskope Alerts",
                    "baseQuery": "NetskopeAlerts_CL"
                },
                {
                    "metricName": "Total Netskope Application Events",
                    "legend": "Netskope Application Events",
                    "baseQuery": "NetskopeEventsApplication_CL"
                },
                {
                    "metricName": "Total Netskope Audit Events",
                    "legend": "Netskope Audit Events",
                    "baseQuery": "NetskopeEventsAudit_CL"
                },
                {
                    "metricName": "Total Netskope Connection Events",
                    "legend": "Netskope Connection Events",
                    "baseQuery": "NetskopeEventsConnection_CL"
                },
                {
                    "metricName": "Total Netskope DLP Events",
                    "legend": "Netskope DLP Events",
                    "baseQuery": "NetskopeEventsDLP_CL"
                },
                {
                    "metricName": "Total Netskope Endpoint Events",
                    "legend": "Netskope Endpoint Events",
                    "baseQuery": "NetskopeEventsEndpoint_CL"
                },
                {
                    "metricName": "Total Netskope Infrastructure Events",
                    "legend": "Netskope Infrastructure Events",
                    "baseQuery": "NetskopeEventsInfrastructure_CL"
                },
                {
                    "metricName": "Total Netskope Network Events",
                    "legend": "Netskope Network Events",
                    "baseQuery": "NetskopeEventsNetwork_CL"
                },
                {
                    "metricName": "Total Netskope Page Events",
                    "legend": "Netskope Page Events",
                    "baseQuery": "NetskopeEventsPage_CL"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Get Sample of Netskope events",
                    "query": "NetskopeAlerts_CL\n | take 10"
                }
            ],
            "dataTypes": [
                {
                    "name": "NetskopeAlerts_CL",
                    "lastDataReceivedQuery": "NetskopeAlerts_CL \n | where TimeGenerated > ago(7d) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                },
                {
                    "name": "NetskopeEventsApplication_CL",
                    "lastDataReceivedQuery": "NetskopeEventsApplication_CL \n | where TimeGenerated > ago(7d) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                },
                {
                    "name": "NetskopeEventsAudit_CL",
                    "lastDataReceivedQuery": "NetskopeEventsAudit_CL \n | where TimeGenerated > ago(7d) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                },
                {
                    "name": "NetskopeEventsConnection_CL",
                    "lastDataReceivedQuery": "NetskopeEventsConnection_CL \n | where TimeGenerated > ago(7d) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                },
                {
                    "name": "NetskopeEventsDLP_CL",
                    "lastDataReceivedQuery": "NetskopeEventsDLP_CL \n | where TimeGenerated > ago(7d) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                },
                {
                    "name": "NetskopeEventsEndpoint_CL",
                    "lastDataReceivedQuery": "NetskopeEventsEndpoint_CL \n | where TimeGenerated > ago(7d) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                },
                {
                    "name": "NetskopeEventsInfrastructure_CL",
                    "lastDataReceivedQuery": "NetskopeEventsInfrastructure_CL \n | where TimeGenerated > ago(7d) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                },
                {
                    "name": "NetskopeEventsNetwork_CL",
                    "lastDataReceivedQuery": "NetskopeEventsNetwork_CL \n | where TimeGenerated > ago(7d) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                },
                {
                    "name": "NetskopeEventsPage_CL",
                    "lastDataReceivedQuery": "NetskopeEventsPage_CL \n | where TimeGenerated > ago(7d) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "availability": {
                "isPreview": false
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "write": true,
                            "read": true,
                            "delete": true
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "Netskope organisation url",
                        "description": "The Netskope data connector requires you to provide your organisation url. You can find your organisation url by signing into the Netskope portal."
                    },
                    {
                        "name": "Netskope API key",
                        "description": "The Netskope data connector requires you to provide a valid API key. You can create one by following the [Netskope documentation](https://docs.netskope.com/en/rest-api-v2-overview-312207/)."
                    }
                ]
            },
            "instructionSteps": [
                {
                    "title": "STEP 1 - Create a Netskope API key.",
                    "description": "Follow the [Netskope documentation](https://docs.netskope.com/en/rest-api-v2-overview-312207/) for guidance on this step."
                },
                {
                    "title": "STEP 2 - Enter your Netskope product Details",
                    "description": "Enter your Netskope organisation url & API Token below:",
                    "instructions": [
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Organisation Url",
                                "placeholder": "Enter your organisation url",
                                "type": "text",
                                "name": "OrganisationURL"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "API Key",
                                "placeholder": "Enter your API Key",
                                "type": "password",
                                "name": "apikey"
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Alerts Remediation",
                                "type": "text",
                                "name": "NetskopeAlertsRemediationingestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Alerts Remediation data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Alerts Uba",
                                "type": "text",
                                "name": "NetskopeAlertsUbaingestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Alerts Uba data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Alerts Security Assessment",
                                "type": "text",
                                "name": "NetskopeAlertsSecurityAssessmentingestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Alerts Security Assessment data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Alerts Quarantine",
                                "type": "text",
                                "name": "NetskopeAlertsQuarantineingestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Alerts Quarantine data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Alerts Policy",
                                "type": "text",
                                "name": "NetskopeAlertsPolicyingestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Alerts Policy data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Alerts Malware",
                                "type": "text",
                                "name": "NetskopeAlertsMalwareingestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Alerts Malware data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Alerts Malsite",
                                "type": "text",
                                "name": "NetskopeAlertsMalsiteingestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Alerts Malsite data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Alerts DLP",
                                "type": "text",
                                "name": "NetskopeAlertsDlpingestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Alerts DLP data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Alerts CTEP",
                                "type": "text",
                                "name": "NetskopeAlertsCtepingestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Alerts CTEP data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Alerts Watchlist",
                                "type": "text",
                                "name": "NetskopeAlertsWatchlistingestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Alerts Watchlist data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Alerts Compromised Credentials",
                                "type": "text",
                                "name": "NetskopeAlertsCompromisedCredentialsingestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Alerts Compromised Credentials data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Alerts Content",
                                "type": "text",
                                "name": "NetskopeAlertsContentingestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Alerts Content data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Alerts Device",
                                "type": "text",
                                "name": "NetskopeAlertsDeviceingestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Alerts Device data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Events Application",
                                "type": "text",
                                "name": "NetskopeEventsApplicationingestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Events Application data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Events Audit",
                                "type": "text",
                                "name": "NetskopeEventsAuditioningestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Events Audit data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Events Connection",
                                "type": "text",
                                "name": "NetskopeEventsConnectioningestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Events Connection data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Events DLP",
                                "type": "text",
                                "name": "NetskopeEventsDLPingestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Events DLP data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Events Endpoint",
                                "type": "text",
                                "name": "NetskopeEventsEndpointingestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Events Endpoint data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Events Infrastructure",
                                "type": "text",
                                "name": "NetskopeEventsInfrastructureingestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Events Infrastructure data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Events Network",
                                "type": "text",
                                "name": "NetskopeEventsNetworkingestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Events Network data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Dropdown",
                            "parameters": {
                                "label": "Netskope Events Page",
                                "type": "text",
                                "name": "NetskopeEventsPageingestion",
                                "required": true,
                                "placeholder": "Do you want to ingest Netskope Events Page data?",
                                "options": [
                                    {
                                        "key": "Yes",
                                        "text": "Yes"
                                    },
                                    {
                                        "key": "No",
                                        "text": "No"
                                    }
                                ]
                            }
                        },
                        {
                            "type": "InstructionStepsGroup",
                            "parameters": {
                                "instructionSteps": [
                                    {
                                        "title": "OPTIONAL: Specify the Index the API uses.",
                                        "description": "**Configuring the index is optional and only required in advanced scenario's.** \n Netskope uses an [index](https://docs.netskope.com/en/using-the-rest-api-v2-dataexport-iterator-endpoints/#how-do-iterator-endpoints-function) to retrieve events. In some advanced cases (consuming the event in multiple Microsoft Sentinel workspaces, or pre-fatiguing the index to only retrieve recent data), a customer might want to have direct control over the index.",
                                        "instructions": [
                                            {
                                                "type": "Textbox",
                                                "parameters": {
                                                    "label": "Index",
                                                    "placeholder": "NetskopeCCP",
                                                    "type": "text",
                                                    "name": "Index"
                                                }
                                            }
                                        ]
                                    }
                                ]
                            }
                        }
                    ]
                },
                {
                    "title": "STEP 3 - Click Connect",
                    "description": "Verify all fields above were filled in correctly. Press the Connect to connect Netskope to Microsoft Sentinel.",
                    "instructions": [
                        {
                            "type": "ConnectionToggleButton",
                            "parameters": {
                                "connectLabel": "connect",
                                "name": "connect"
                            }
                        }
                    ]
                }
            ]
        }
    }
}