{
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "apiVersion": "2025-06-01",
    "name": "SecurityBridge",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "SecurityBridge",
            "title": "SecurityBridge Solution for SAP",
            "publisher": "SecurityBridge Group GmbH",
            "logo": "SecurityBridge.svg",
            "descriptionMarkdown": "SecurityBridge enhances SAP security by integrating seamlessly with Microsoft Sentinel, enabling real-time monitoring and threat detection across SAP environments. This integration allows Security Operations Centers (SOCs) to consolidate SAP security events with other organizational data, providing a unified view of the threat landscape . Leveraging AI-powered analytics and Microsoft’s Security Copilot, SecurityBridge identifies sophisticated attack patterns and vulnerabilities within SAP applications, including ABAP code scanning and configuration assessments . The solution supports scalable deployments across complex SAP landscapes, whether on-premises, in the cloud, or hybrid environments . By bridging the gap between IT and SAP security teams, SecurityBridge empowers organizations to proactively detect, investigate, and respond to threats, enhancing overall security posture.",
            "graphQueriesTableName": "ABAPAuditLog",
            "graphQueries": [
                {
                    "metricName": "Total events received",
                    "legend": "SAP_SID",
                    "baseQuery": "{{graphQueriesTableName}} | project TimeGenerated, SAP_SID= SystemUniqueId"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Get Sample Events",
                    "query": "{{graphQueriesTableName}}\n | take 10"
                }
            ],
            "dataTypes": [
                {
                    "name": "{{graphQueriesTableName}}",
                    "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "availability": {
                "isPreview": true
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "write": true,
                            "read": true,
                            "delete": true
                        }
                    },
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                        "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)",
                        "providerDisplayName": "Keys",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "action": true
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "Microsoft Entra",
                        "description": "Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher."
                    },
                    {
                        "name": "Microsoft Azure",
                        "description": "Permission to assign Monitoring Metrics Publisher role on data collection rules. Typically requires Azure RBAC Owner or User Access Administrator role."
                    }
                ]
            },
            "instructionSteps": [
                                {
                                    "title": "1. Create ARM Resources and Provide the Required Permissions",
                                    "description": "We will create data collection rule (DCR) and data collection endpoint (DCE) resources. We will also create a Microsoft Entra app registration and assign the required permissions to it.",
                                    "instructions": [
                                        {
                                            "type": "Markdown",
                                            "parameters": {
                                                "content": "#### Automated deployment of Azure resources\nClicking on \"Deploy push connector resources\" will trigger the creation of DCR and DCE resources.\nIt will then create a Microsoft Entra app registration with client secret and grant permissions on the DCR. This setup enables data to be sent securely to the DCR using a OAuth v2 client credentials."
                                            }
                                        },
                                        {
                                            "parameters": {
                                                "label": "Deploy push connector resources",
                                                "applicationDisplayName": "SecurityBridge Solution for SAP"
                                            },
                                            "type": "DeployPushConnectorButton_test"
                                        }
                                    ]
                                },
                                {
                                    "title": "2. Maintain the data collection endpoint details and authentication info in SecurityBridge",
                                    "description": "Share the data collection endpoint URL and authentication info with the SecurityBridge administrator to configure the Securitybridge to send data to the data collection endpoint.\n\nLearn more from our KB Page https://abap-experts.atlassian.net/wiki/spaces/SB/pages/4099309579/REST+Push+Interface",
                                    "instructions": [
                                        {
                                            "parameters": {
                                                "label": "Use this value to configure as Tenant ID in the LogIngestionAPI credential.",
                                                "fillWith": [
                                                    "TenantId"
                                                ]
                                            },
                                            "type": "CopyableLabel"
                                        },
                                        {
                                            "parameters": {
                                                "label": "Entra Application ID",
                                                "fillWith": [
                                                    "ApplicationId"
                                                ],
                                                "placeholder": "Deploy push connector to get the Application ID"
                                            },
                                            "type": "CopyableLabel"
                                        },
                                        {
                                            "parameters": {
                                                "label": "Entra Application Secret",
                                                "fillWith": [
                                                    "ApplicationSecret"
                                                ],
                                                "placeholder": "Deploy push connector to get the Application Secret"
                                            },
                                            "type": "CopyableLabel"
                                        },
                                        {
                                            "parameters": {
                                                "label": "Use this value to configure the LogsIngestionURL parameter when deploying the IFlow.",
                                                "fillWith": [
                                                    "DataCollectionEndpoint"
                                                ],
                                                "placeholder": "Deploy push connector to get the DCE URI"
                                            },
                                            "type": "CopyableLabel"
                                        },
                                        {
                                            "parameters": {
                                                "label": "DCR Immutable ID",
                                                "fillWith": [
                                                    "DataCollectionRuleId"
                                                ],
                                                "placeholder": "Deploy push connector to get the DCR ID"
                                            },
                                            "type": "CopyableLabel"
                                        },
                                          {
                                                  "parameters": {
                                                      "label": "Sentinel for SAP Stream ID",
                                                      "value": "SAP_ABAPAUDITLOG"
                                                  },
                                                  "type": "CopyableLabel"
                                              },
                                        {
                                                  "parameters": {
                                                      "label": "SecurityBridge_CL Stream ID",
                                                      "value": "Custom-SecurityBridge_CL"
                                                  },
                                                  "type": "CopyableLabel"
                                              }
                                    ]
                                }
                            ]
        }
    }
}