{
    "name": "IllumioSaasCCFDefinition",
    "apiVersion": "2025-03-01",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "IllumioSaasCCFDefinition",
            "title": "Illumio Saas",
            "publisher": "Microsoft",
            "descriptionMarkdown": "The Illumio Saas Cloud data connector provides the capability to ingest Flow logs into Microsoft Sentinel using the Illumio Saas Log Integration through AWS S3 Bucket. Refer to [Illumio Saas Log Integration](https://product-docs-repo.illumio.com/Tech-Docs/CloudSecure/out/en/administer-cloudsecure/connector.html#UUID-c14edaab-9726-1f23-9c4c-bc2937be39ee_section-idm234556433515698) for more information.",
            "graphQueries": [
                {
                    "metricName": "Total Illumio Flow events received",
                    "legend": "Illumio Flow Logs",
                    "baseQuery": "IllumioFlowEventsV2_CL"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Get Sample of Illumio Flow logs",
                    "query": "IllumioFlowEventsV2_CL\n | take 10"
                }
            ],
            "dataTypes": [
                {
                    "name": "IllumioFlowEventsV2_CL",
                    "lastDataReceivedQuery": "IllumioFlowEventsV2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "availability": {
                "status": 1,
                "isPreview": false
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "read": true,
                            "write": true,
                            "delete": true,
                            "action": false
                        }
                    }
                ]
            },
            "instructionSteps": [
                {
                    "title": "Connect Illumio Saas to Microsoft Sentinel\n\n",
                    "instructions": [
                        {
                            "type": "Markdown",
                            "parameters": {
                                "content": ">**NOTE:** This connector fetches the Illumio Saas Flow logs from AWS S3 bucket"
                            }
                        },
                        {
                            "type": "Markdown",
                            "parameters": {
                                "content": "To gather data from Illumio, you need to configure the following resources"
                            }
                        },
                        {
                            "type": "Markdown",
                            "parameters": {
                                "content": "#### 1. AWS Role ARN \n To gather data from Illumio, you'll need AWS Role ARN."
                            }
                        },
                        {
                            "type": "Markdown",
                            "parameters": {
                                "content": "#### 2. AWS SQS Queue URL \n To gather data from Illumio, you'll need AWS SQS Queue URL.\n\n"
                            }
                        },
                        {
                            "type": "Markdown",
                            "parameters": {
                                "content": "For detailed steps to retrieve the AWS Role ARN, SQS Queue URL, and configure Illumio log forwarding to the Amazon S3 bucket, refer to the [Connector Setup Guide](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IllumioSaaS/Data%20Connectors/IllumioSaasLogs_ccf/Readme.md)."
                            }
                        },
                        {
                            "type": "DataConnectorsGrid",
                            "parameters": {
                                "mapping": [
                                    {
                                        "columnValue": "properties.roleArn",
                                        "columnName": "AWS Role ARN"
                                    },
                                    {
                                        "columnValue": "properties.sqsUrls[0]",
                                        "columnName": "AWS SQS Queue URL"
                                    },
                                    {
                                        "columnValue": "properties.destinationTable",
                                        "columnName": "Table Name"
                                    }
                                ],
                                "menuItems": [
                                    "DeleteConnector"
                                ]
                            }
                        },
                        {
                            "type": "ContextPane",
                            "parameters": {
                                "isPrimary": true,
                                "label": "Add Account",
                                "title": "Add Account",
                                "subtitle": "Add Account",
                                "contextPaneType": "DataConnectorsContextPane",
                                "instructionSteps": [
                                    {
                                        "instructions": [
                                            {
                                                "type": "Textbox",
                                                "parameters": {
                                                    "label": "Role ARN",
                                                    "placeholder": "Enter Role ARN",
                                                    "type": "text",
                                                    "name": "roleArn",
                                                    "required": true
                                                }
                                            },
                                            {
                                                "type": "Textbox",
                                                "parameters": {
                                                    "label": "Flow Log Queue URL",
                                                    "placeholder": "Enter Flow log SQL Queue URL",
                                                    "type": "text",
                                                    "name": "queueUrl",
                                                    "required": true
                                                }
                                            }
                                        ]
                                    }
                                ]
                            }
                        }
                    ]
                }
            ]
        }
    }
}