{
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "apiVersion": "2022-09-01-preview",
    "name": "ZNSegmentPushCCPDefinition",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "ZNSegmentPushCCPDefinition",
            "title": "Zero Networks Segment (Push)",
            "publisher": "Zero Networks",
            "descriptionMarkdown": "The [Zero Networks Segment](https://zeronetworks.com/) push connector allows Zero Networks to send Audits, Network Activities, Identity Activities, and RPC Activities directly to Microsoft Sentinel in real time. Deploy the connector to create a Data Collection Rule (DCR) and Microsoft Entra app; then configure your Zero Networks application with the connection details to push events.",
            "graphQueries": [
                { "metricName": "Audits", "legend": "ZNAudit", "baseQuery": "ZNAudit_CL" },
                { "metricName": "Network Activities", "legend": "ZNNetworkActivity", "baseQuery": "ZNNetworkActivity_CL" },
                { "metricName": "Identity Activities", "legend": "ZNIdentityActivity", "baseQuery": "ZNIdentityActivity_CL" },
                { "metricName": "RPC Activities", "legend": "ZNRPCActivity", "baseQuery": "ZNRPCActivity_CL" }
            ],
            "sampleQueries": [
                { "description": "Recent Audits", "query": "ZNAudit_CL\n| sort by TimeGenerated desc\n| take 10" },
                { "description": "Recent Network Activities", "query": "ZNNetworkActivity_CL\n| sort by TimeGenerated desc\n| take 10" },
                { "description": "Recent Identity Activities", "query": "ZNIdentityActivity_CL\n| sort by TimeGenerated desc\n| take 10" },
                { "description": "Recent RPC Activities", "query": "ZNRPCActivity_CL\n| sort by TimeGenerated desc\n| take 10" }
            ],
            "dataTypes": [
                { "name": "ZNAudit_CL", "lastDataReceivedQuery": "ZNAudit_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" },
                { "name": "ZNNetworkActivity_CL", "lastDataReceivedQuery": "ZNNetworkActivity_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" },
                { "name": "ZNIdentityActivity_CL", "lastDataReceivedQuery": "ZNIdentityActivity_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" },
                { "name": "ZNRPCActivity_CL", "lastDataReceivedQuery": "ZNRPCActivity_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }
            ],
            "connectivityCriteria": [
                { "type": "HasDataConnectors" }
            ],
            "availability": { "isPreview": false },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": { "write": true, "read": true, "delete": true }
                    },
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                        "permissionsDisplayText": "Read permissions to shared keys for the workspace are required.",
                        "providerDisplayName": "Keys",
                        "scope": "Workspace",
                        "requiredPermissions": { "action": true }
                    }
                ],
                "customs": [
                    { "name": "Microsoft Entra", "description": "Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher." },
                    { "name": "Microsoft Azure", "description": "Permission to assign Monitoring Metrics Publisher role on data collection rule (DCR). Typically requires Azure RBAC Owner or User Access Administrator role." }
                ]
            },
            "instructionSteps": [
                {
                    "title": "1. Create ARM Resources and Provide the Required Permissions",
                    "description": "Deploy the push connector to create a Log Analytics table, Data Collection Rule (DCR), Data Collection Endpoint (DCE), and Microsoft Entra app. Then configure your Zero Networks application with the connection details.",
                    "instructions": [
                        {
                            "type": "Markdown",
                            "parameters": {
                                "content": "#### Automated Configuration\nClicking \"Deploy\" will create a DCR and DCE, then a Microsoft Entra app registration with client secret and grant permissions on the DCR. Your application can then send data securely using OAuth 2.0 client credentials."
                            }
                        },
                        {
                            "type": "DeployPushConnectorButton_test",
                            "parameters": {
                                "label": "Deploy Zero Networks Push connector resources",
                                "applicationDisplayName": "Zero Networks Segment Push Connector"
                            }
                        }
                    ]
                },
                {
                    "title": "2. Configure Your Zero Networks Application",
                    "description": "Use the following values to configure your Zero Networks application to push Audits, Network Activities, Identity Activities, and RPC Activities to Microsoft Sentinel.",
                    "instructions": [
                        { "type": "CopyableLabel", "parameters": { "label": "Tenant ID (Directory ID)", "fillWith": ["TenantId"] } },
                        { "type": "CopyableLabel", "parameters": { "label": "Entra Application ID", "fillWith": ["ApplicationId"], "placeholder": "Deploy push connector to get the Application ID" } },
                        { "type": "CopyableLabel", "parameters": { "label": "Entra Application Secret", "fillWith": ["ApplicationSecret"], "placeholder": "Deploy push connector to get the Application Secret" } },
                        { "type": "CopyableLabel", "parameters": { "label": "Data Collection Endpoint URI", "fillWith": ["DataCollectionEndpoint"], "placeholder": "Deploy push connector to get the DCE URI" } },
                        { "type": "CopyableLabel", "parameters": { "label": "Data Collection Rule Immutable ID", "fillWith": ["DataCollectionRuleId"], "placeholder": "Deploy push connector to get the DCR ID" } },
                        { "type": "CopyableLabel", "parameters": { "label": "Stream: Audits", "value": "Custom-ZNAudit_CL" } },
                        { "type": "CopyableLabel", "parameters": { "label": "Stream: Network Activities", "value": "Custom-ZNNetworkActivity_CL" } },
                        { "type": "CopyableLabel", "parameters": { "label": "Stream: Identity Activities", "value": "Custom-ZNIdentityActivity_CL" } },
                        { "type": "CopyableLabel", "parameters": { "label": "Stream: RPC Activities", "value": "Custom-ZNRPCActivity_CL" } }
                    ]
                }
            ]
        }
    }
}