{
  "name": "CyberArkAuditCCPDefinition",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "CyberArkAuditCCPDefinition",
      "title": "Idira Audit",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The [Idira Audit](https://docs.cyberark.com/Audit/Latest/en/Content/Resources/_TopNav/cc_Home.htm) data connector enables Microsoft Sentinel to ingest security event logs and other events from the Idira Audit service via REST API. This integration helps you detect potential security risks, monitor user activity, analyze collaboration patterns, troubleshoot configuration issues, and gain deeper insights into your environment.",
      "graphQueriesTableName": "CyberArk_AuditEvents_CL",
      "graphQueries": [
        {
          "metricName": "Total data received",
          "legend": "Idira Audit Events",
          "baseQuery": "{{graphQueriesTableName}}"
        }
      ],
      "sampleQueries": [
        {
          "description": "Idira Audit Events - All Activities.",
          "query": "{{graphQueriesTableName}}\n | sort by TimeGenerated desc"
        }
      ],
      "dataTypes": [
        {
          "name": "{{graphQueriesTableName}}",
          "lastDataReceivedQuery": "{{graphQueriesTableName}}\n|summarize Time = max  (TimeGenerated)\n|where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true
            }
          }
        ],
        "customs": [
          {
            "name": "Idira Audit Service Platform",
            "description": "Access to perform required configurations in Idira Audit platform"
          }
        ]
      },
      "instructionSteps": [
        {
          "description": "Follow the steps below to integrate Microsoft Sentinel with Idira Audit and enable centralized monitoring of system and user activities within Microsoft Sentinel. You can also refer to the [Idira Audit documentation](https://docs.cyberark.com/admin-space/latest/en/content/siem-integration/siem-export-ms-sentinel.htm?tocpath=Integrations%7CExport%20Audit%20activities%20to%20a%20SIEM%20application%7C_____2#CreateandconfigureaSIEMintegration) and follow till Step 5.",
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "# Step1: Create new SIEM integration\n1. On Idira portal, go to `Administration`.\n2. Select `My environment` > `Integrations` > `Export to SIEM`.\n3. In the SIEM integrations page, select `Create` > `Create SIEM integration`\n4. In the `Create a SIEM integration` page, select the `Identity Administration` link to create an OAuth server web in Identity Administration.\n# Step 2: Create an OAuth2 server web app in Identity Administration\n1. On `Identity Administration` page, from the left menu select `Apps & Widgets` > `Web Apps`\n2. Select `Add Web Apps` and create an `OAuth2 server` type web app from the `Custom` tab.\n3. Enter `IdiraAuditforMicrosoftSentinel` in the `ApplicationID` and `Name` fields.\n4. In the `Tokens` tab, ensure that the value in the `Token Type` field is `jwtR256` and only the `Client Creds` authorization method is selected.\n5. Click `Add` in the `Scope` tab and enter `isp.audit.events:read`.\n6. In the `Advanced` tab, copy and paste the following script and then click Save.\n```javascript\n\t\tsetClaim('tenant_id', TenantData.Get(\"CybrTenantID\"));\n\t\tsetClaim('aud', 'cyberark.isp.audit');\n```\n7. Click `Save`.\n# Step 3: Create a service user in Identity Administration\n1. Go to the `Core Services` > `Users`, select `Add User`.\n2. In the `Account` section, enter the `Login name` and `Display name` as `MicrosoftSentinel`. Add a new password or generate the password automatically.\n3. Select `OAuth confidential client`.\n4. In the `Application Settings` tab, click `Add`.\n5. Select the `IdiraAuditforMicrosoftSentinel` application. This is the name you created in the web service.\n# Step 4: Grant web app permissions to the service user\n1. Go to the `IdiraAuditforMicrosoftSentinel` web app you created.\n2. In the `Permissions` tab, click `Add` to find your user `MicrosoftSentinel` and then click `Add`.\n3. Set the following permissions for the user:\n   - Grant\n   - View\n   - Run\n   - Automatically deploy\n# Step 5: Define the integration description\n1. Go to `Administration`.\n2. Select `My environment` > `Integrations` > `Export to SIEM`.\n3. Select `Create` > `Create SIEM integration`.\n4. Enter the name as `Microsoft Sentinel Integration` and optionally add a description.\n5. Click `Apply`.\n# Step 6: Connect Idira Audit Service with Microsoft Sentinel Data Connector\n> **Note:** Copy all the details you captured in the previous steps and connect with the Idira Audit service."
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "OAuth2 Server App Name",
                "validations": {
                  "required": true
                },
                "placeholder": "e.g. AuditforMicrosoftSentinel",
                "type": "text",
                "name": "OAuth2ServerAppName"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Audit API Key",
                "validations": {
                  "required": true
                },
                "placeholder": "The API Key can be retrieved from the Audit service",
                "type": "password",
                "name": "AuditAPIKey"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Identity Endpoint",
                "validations": {
                  "required": true
                },
                "placeholder": "e.g. kln9281.id.cyberark.cloud",
                "type": "text",
                "name": "CyberArkIdentityEndPoint"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Audit API Base URL",
                "validations": {
                  "required": true
                },
                "placeholder": "e.g. org-test.audit.cyberark.cloud",
                "type": "text",
                "name": "CyberArkAPIBaseURL"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Audit Query Filter Action (Optional)",
                "validations": {
                  "required": false
                },
                "placeholder": "e.g. {\"op\":\"include\",\"params\":[\"cloud.core.login\",\"cloud.core.mfasummary\"]}",
                "description": "The optional filter parameters to filter logs based on specific 'Action' values.",
                "type": "text",
                "name": "AuditQueryFilterAction"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Audit Query Filter Application Code (Optional)",
                "validations": {
                  "required": false
                },
                "placeholder": "e.g. {\"op\":\"include\",\"params\":[\"IDP\",\"CMS\"]}",
                "description": "The optional filter parameters to filter logs based on specific 'ApplicationCode' values.",
                "type": "text",
                "name": "AuditQueryFilterApplicationCode"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Audit Query Filter Audit Type (Optional)",
                "validations": {
                  "required": false
                },
                "placeholder": "e.g. {\"op\":\"include\",\"params\":[\"Failure\"]}",
                "description": "The optional filter parameters to filter logs based on specific 'AuditType' values.",
                "type": "text",
                "name": "AuditQueryFilterAuditType"
              }
            },
            {
              "type": "OAuthForm",
              "parameters": {
                "clientIdLabel": "Oauth Username",
                "clientSecretLabel": "Oauth Password",
                "clientIdPlaceholder": "The service user created in Identity Administration",
                "clientSecretPlaceholder": "The user password created in Identity Administration",
                "connectButtonLabel": "Connect",
                "disconnectButtonLabel": "Disconnect"
              }
            }
          ],
          "title": "Connect to Idira Audit API to start collecting event logs in Microsoft Sentinel"
        }
      ]
    }
  }
}