{
  "name": "AirlockDigitalConnector",
  "apiVersion": "2025-07-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "AirlockDigitalConnector",
      "title": "Airlock Digital connector (via Codeless Connector Framework)",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The Airlock Digital connector collects application control and execution logs from your Airlock Digital server, providing visibility into file executions, server activities, and security event summaries in Microsoft Sentinel.",
      "graphQueries": [
        {
          "metricName": "Total Server Activities received",
          "legend": "Server Activities",
          "baseQuery": "AirlockDigitalServerActivities"
        },
        {
          "metricName": "Total Execution Histories received",
          "legend": "All Executions",
          "baseQuery": "AirlockDigitalExecutionHistories"
        },
        {
          "metricName": "Total File Activity Summaries received",
          "legend": "File Activity Summary",
          "baseQuery": "AirlockDigitalFileActivitySummary"
        },
        {
          "metricName": "Blocked Executions",
          "legend": "Blocked Only",
          "baseQuery": "AirlockDigitalExecutionHistories | where ExecutionType == 1"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get sample of 20 recent events",
          "query": "AirlockDigitalExecutionHistories\n| top 20 by TimeGenerated desc"
        }
      ],
      "dataTypes": [
        {
          "name": "AirlockDigitalServerActivities",
          "lastDataReceivedQuery": "AirlockDigitalServerActivities\n| where TimeGenerated > ago(6h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "AirlockDigitalExecutionHistories",
          "lastDataReceivedQuery": "AirlockDigitalExecutionHistories\n| where TimeGenerated > ago(6h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "AirlockDigitalFileActivitySummary",
          "lastDataReceivedQuery": "AirlockDigitalFileActivitySummary\n| where TimeGenerated > ago(6h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        },
        {
          "type": "IsConnectedQuery",
          "value": [
            "AirlockDigitalExecutionHistories | where TimeGenerated > ago(1h) | take 1"
          ]
        }
      ],
      "availability": {
        "isPreview": false,
        "status": 1
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true,
              "action": false
            }
          }
        ],
        "customs": [
          {
            "name": "Airlock Digital API Key",
            "description": "API Key with read access to logging endpoints. Generate from Airlock Digital Web UI: User Menu > Settings > API Keys."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "1. Configure Airlock Digital API Access",
          "description": "Provide API connection details for Airlock Digital",
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "**Before you begin:**\r\n- Access to your Airlock Digital server\r\n- API Key from Airlock Digital (User Menu > Settings > API Keys)\r\n- Server must be accessible from Azure (ensure firewall allows connections)\r\n\r\n**Base URL:** Enter your Airlock Digital server URL. Default port is 3129 for REST API.\r\nExample: `https://airlock.company.com:3129`\r\n\r\n**The connector collects:**\r\n- **Server Activities**: Administrative actions, policy changes, agent check-ins, and repository updates\r\n- **Execution Histories**: File execution events including blocked, audited, and trusted executions with file hashes, publishers, and user details\r\n- **File Activity Summary**: Aggregated statistics on file activity, security events, and execution trends\r\n\r\n**Data refresh:** Logs are retrieved every 5 minutes. Data should appear within 5-10 minutes after connection."
              }
            }
          ]
        },
        {
          "title": "2. Connect Airlock Digital servers to Microsoft Sentinel",
          "description": "This connector supports multiple simultaneous connections. Add one connection per Airlock Digital server; each connection ingests the selected data types in parallel. Use the grid below to review existing connections or add a new one.",
          "instructions": [
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnName": "Connector Name",
                    "columnValue": "properties.addOnAttributes.friendlyName"
                  },
                  {
                    "columnName": "Data Type",
                    "columnValue": "properties.addOnAttributes.dataType"
                  },
                  {
                    "columnName": "Endpoint",
                    "columnValue": "properties.request.apiEndpoint"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "isPrimary": true,
                "label": "Add Connection",
                "title": "Connect an Airlock Digital server",
                "subtitle": "Airlock Digital",
                "contextPaneType": "DataConnectorsContextPane",
                "instructionSteps": [
                  {
                    "instructions": [
                      {
                        "type": "Markdown",
                        "parameters": {
                          "content": "## Connection details\n\nProvide the Airlock Digital server URL and API key, then choose which data types to collect. Create a separate connection for each Airlock Digital server."
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Base URL",
                          "placeholder": "https://server.name:3129",
                          "type": "text",
                          "name": "BaseUrl",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "API Key",
                          "placeholder": "Enter your Airlock Digital API Key",
                          "type": "password",
                          "name": "apiKey",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Dropdown",
                        "parameters": {
                          "label": "Data Types",
                          "name": "selectedDataTypes",
                          "options": [
                            {
                              "key": "AirlockDigitalServerActivities",
                              "text": "Server Activities"
                            },
                            {
                              "key": "AirlockDigitalExecutionHistories",
                              "text": "Execution Histories"
                            },
                            {
                              "key": "AirlockDigitalFileActivitySummary",
                              "text": "File Activity Summary"
                            }
                          ],
                          "placeholder": "Select data types to collect...",
                          "isMultiSelect": true,
                          "defaultAllSelected": true,
                          "required": true
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Connector Friendly Name",
                          "placeholder": "Enter a unique friendly name for this connection",
                          "type": "text",
                          "name": "friendlyName",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "InfoMessage",
                        "parameters": {
                          "text": "The friendly name helps you identify this connection in the grid and in the collected data.",
                          "visible": true,
                          "inline": true
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ],
      "isConnectivityCriteriasMatchSome": true
    }
  }
}