{
    "name": "MiroAuditLogsDataConnector",
    "apiVersion": "2025-09-01",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "MiroAuditLogsDataConnector",
            "title": "Miro Audit Logs (Enterprise Plan)",
            "publisher": "Miro",
            "descriptionMarkdown": "The [Miro Audit Logs](https://help.miro.com/hc/en-us/articles/360017571434-Audit-logs) data connector enables you to ingest organization-wide audit events from Miro into Microsoft Sentinel. Monitor user activities, security events, content access, team changes, and administrative actions to enhance your security operations and compliance capabilities.\n\n**Key features:**\n- Track user authentication and access patterns.\n- Monitor content creation, sharing, and deletion.\n- Audit team and organization configuration changes.\n- Detect suspicious activities and policy violations.\n- Meet compliance and regulatory requirements.\n\n**Requirements:**\n- **Miro Plan**: [Enterprise Plan](https://miro.com/pricing/).\n- **OAuth scope**: `auditlogs:read`.\n- **Role**: Company Admin in your Miro organization.\n\n💡 **Not on Enterprise Plan yet?** Upgrade to [Miro Enterprise](https://miro.com/enterprise/) to unlock audit logs and gain comprehensive visibility into your team's activities in Microsoft Sentinel.\n\nFor detailed instructions, refer to the [documentation](https://help.miro.com/hc/en-us/articles/31325908249362).",
            "graphQueriesTableName": "MiroAuditLogs_CL",
            "graphQueries": [
                {
                    "metricName": "Miro Audit Logs",
                    "legend": "MiroAuditLogs_CL",
                    "baseQuery": "MiroAuditLogs_CL"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Recent audit events",
                    "query": "MiroAuditLogs_CL\n| sort by TimeGenerated desc\n| take 10"
                },
                {
                    "description": "Events by category",
                    "query": "MiroAuditLogs_CL\n| summarize count() by category\n| render piechart"
                }
            ],
            "dataTypes": [
                {
                    "name": "MiroAuditLogs_CL",
                    "lastDataReceivedQuery": "MiroAuditLogs_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
                }
            ],
            "availability": {
                "isPreview": false
            },
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "write": true,
                            "read": true,
                            "delete": true
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "Miro Enterprise Plan",
                        "description": "Miro Enterprise Plan subscription is required."
                    },
                    {
                        "name": "Miro OAuth Application",
                        "description": "Miro OAuth application with auditlogs:read scope and Company Admin role is required."
                    }
                ]
            },
            "instructionSteps": [
                {
                    "description": "**Step 1: Verify your Miro plan**\n\n1. Ensure your organization has an active [Miro Enterprise Plan](https://miro.com/pricing/).\n2. If you need to upgrade, contact [Miro Sales](https://miro.com/contact/sales/) or your account manager.\n3. You must be a **Company Admin** to set up this integration."
                },
                {
                    "description": "**Step 2: Choose your setup option**\n\nThere are two ways to set up the Miro Audit Logs connector.\n\n**Option 1 (recommended):** Use Enterprise integrations\n- Simplest setup with automatic token generation.\n- Recommended for most users.\n- See Option 1 below.\n\n**Option 2 (alternative):** Create custom OAuth application\n- More control over OAuth app configuration.\n- For advanced users or custom integration needs.\n- See Option 2 below.\n\n**Note:** When using Option 1, the integration is automatically tied to the team with the largest number of users in your organization. When using Option 2, you can choose which team to install the app to. However, **the team selection does not affect which logs are collected**—both options provide organization-wide log access. All integration-relevant events from all teams are included in your logs."
                },
                {
                    "description": "**Option 1: Enterprise integrations (recommended)**\n\n1. Open [Miro Company Settings](https://miro.com/app/settings/).\n2. Expand the **Apps and integrations** section.\n3. Click **Enterprise integrations**.\n4. Enable the **SIEM** toggle.\n5. Copy the **Access Token** value that appears.\n6. **Important:** Store the token securely—it provides full access to audit logs.\n7. The token will work until you disable the toggle.\n8. Proceed to Step 3."
                },
                {
                    "description": "**Option 2: Custom OAuth application (alternative)**\n\n1. Go to [Miro App Settings](https://miro.com/app/settings/user-profile/apps).\n2. Click **Create new app**.\n3. Select **Non-expiring access token** option during app creation.\n4. Enable the OAuth scope: **`auditlogs:read`**.\n5. Click **Install app and get OAuth token**.\n6. Authorize the app to access your organization.\n7. Copy the **Access Token** that is displayed.\n8. **Important:** Store the token securely—it provides full access to audit logs.\n9. The token will work until you uninstall the app."
                },
                {
                    "description": "**Step 3: Learn more**\n\nFor detailed information about Miro audit logs:\n- [Miro Audit Logs documentation](https://help.miro.com/hc/en-us/articles/360017571434-Audit-logs)\n- [Miro API reference](https://developers.miro.com/reference/enterprise-get-audit-logs)\n- [OAuth non-expiring tokens](https://developers.miro.com/reference/authorization-flow-for-expiring-access-tokens)\n- [Enterprise integrations settings](https://miro.com/app/settings/)"
                },
                {
                    "description": "**Step 4: Connect to Miro**\n\nProvide your Miro access token below to complete the connection.",
                    "instructions": [
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Access token",
                                "placeholder": "Enter your Miro Access Token",
                                "type": "password",
                                "name": "AccessToken"
                            }
                        },
                        {
                            "type": "ConnectionToggleButton",
                            "parameters": {
                                "label": "toggle",
                                "name": "toggle"
                            }
                        }
                    ],
                    "title": "Connect to Miro to start collecting audit logs in Microsoft Sentinel."
                }
            ]
        }
    }
}