{
  "name": "AgariConnector",
  "apiVersion": "2023-04-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "AgariConnector",
      "title": "Fortra Agari Data Connector (via Codeless Connector Framework)",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The [Fortra Agari Data Connector](https://www.agari.com/) allows ingesting logs from Fortra Agari Brand Protection (BP) and Phishing Defense (APD) APIs into Microsoft Sentinel. It supports DCR-based ingestion time transformations for efficient query execution. Refer to [Agari API documentation](https://developers.agari.com/agari-platform/reference/overview) for more information.",
      "graphQueries": [
        {
          "metricName": "Total Brand Protection alert logs received",
          "legend": "Agari Brand Protection Alert Logs",
          "baseQuery": "AgariBPAlertsLog_CL"
        },
        {
          "metricName": "Total Phishing Defense policy logs received",
          "legend": "Agari Phishing Defense Policy Logs",
          "baseQuery": "AgariAPDPolicyLog_CL"
        },
        {
          "metricName": "Total Phishing Defense threat category logs received",
          "legend": "Agari Phishing Defense Threat Category Logs",
          "baseQuery": "AgariAPDTCLog_CL"
        },
        {
          "metricName": "Total Brand Protection threat feed URL submissions received",
          "legend": "Agari Brand Protection Threat Feed Submissions",
          "baseQuery": "AgariBPThreatFeedSubs_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get sample of Agari Brand Protection alert logs",
          "query": "AgariBPAlertsLog_CL\n | take 10"
        },
        {
          "description": "Get sample of Agari Phishing Defense policy logs",
          "query": "AgariAPDPolicyLog_CL\n | take 10"
        },
        {
          "description": "Get sample of Agari Phishing Defense threat category logs",
          "query": "AgariAPDTCLog_CL\n | take 10"
        },
        {
          "description": "Get sample of Agari Brand Protection threat feed URL submissions",
          "query": "AgariBPThreatFeedSubs_CL\n | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "AgariBPAlertsLog_CL",
          "lastDataReceivedQuery": "AgariBPAlertsLog_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        },
        {
          "name": "AgariAPDPolicyLog_CL",
          "lastDataReceivedQuery": "AgariAPDPolicyLog_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        },
        {
          "name": "AgariAPDTCLog_CL",
          "lastDataReceivedQuery": "AgariAPDTCLog_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        },
        {
          "name": "AgariBPThreatFeedSubs_CL",
          "lastDataReceivedQuery": "AgariBPThreatFeedSubs_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "isPreview": false,
        "status": 1
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true,
              "action": false
            }
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Agari API connections",
          "description": "Add and manage independent Agari tenant connections.",
          "instructions": [
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnName": "Tenant",
                    "columnValue": "properties.addOnAttributes.friendlyName"
                  },
                  {
                    "columnName": "Data Stream",
                    "columnValue": "properties.dataType"
                  },
                  {
                    "columnName": "API URL",
                    "columnValue": "properties.request.apiEndpoint"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "label": "Add Connection",
                "title": "Add Agari Tenant Connection",
                "subtitle": "Configure a separate Agari tenant connection.",
                "contextPaneType": "DataConnectorsContextPane",
                "instructionSteps": [
                  {
                    "instructions": [
                      {
                        "type": "Markdown",
                        "parameters": {
                          "content": "#### API Credentials\nObtain the Client ID and Client Secret for the Agari tenant you want to connect. Select one or more data streams for this tenant connection."
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Tenant Name",
                          "placeholder": "e.g. Contoso Production",
                          "type": "text",
                          "name": "friendlyName",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Base API URL",
                          "placeholder": "https://api.agari.com",
                          "type": "text",
                          "name": "apiUrl",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Client ID",
                          "placeholder": "Your Client ID",
                          "type": "text",
                          "name": "clientId",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Client Secret",
                          "placeholder": "Your Client Secret",
                          "type": "password",
                          "name": "clientSecret",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Dropdown",
                        "parameters": {
                          "label": "Data Stream",
                          "name": "dataStream",
                          "options": [
                            {
                              "key": "BPAlerts",
                              "text": "Brand Protection Alerts (with nested details)"
                            },
                            {
                              "key": "APDPolicy",
                              "text": "Phishing Defense Policy Events"
                            },
                            {
                              "key": "APDThreatCategories",
                              "text": "Phishing Defense Threat Categories"
                            },
                            {
                              "key": "BPThreatFeedSubmissions",
                              "text": "Brand Protection Threat Feed URL Submissions (IoC)"
                            }
                          ],
                          "isMultiSelect": true,
                          "defaultAllSelected": true,
                          "required": true
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ],
      "isConnectivityCriteriasMatchSome": false
    }
  }
}