{
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "apiVersion": "2022-09-01-preview",
  "name": "CiscoETDConnectorDefinition",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "CiscoETDConnectorDefinition",
      "title": "Cisco Email Threat Defense (ETD)",
      "publisher": "Cisco",
      "descriptionMarkdown": "The [Cisco Email Threat Defense (ETD)](https://docs.cmd.cisco.com/en/Content/secure-email-threat-defense-user-guide/homeUG.htm) data connector provides the capability to ingest [message events](https://docs.cmd.cisco.com/en/Content/secure-email-threat-defense-user-guide/Messages/messages.htm) from Cisco ETD into Microsoft Sentinel using the [Log Export API](https://developer.cisco.com/docs/message-search-api/log-export-api/).",
      "graphQueriesTableName": "CiscoETDv2_CL",
      "graphQueries": [
        {
          "metricName": "Total messages received",
          "legend": "Cisco ETD Messages",
          "baseQuery": "CiscoETDv2_CL"
        },
        {
          "metricName": "Malicious messages",
          "legend": "Malicious Threats",
          "baseQuery": "CiscoETDv2_CL | where message_verdict_verdict == 'malicious'"
        },
        {
          "metricName": "Phishing messages",
          "legend": "Phishing Threats",
          "baseQuery": "CiscoETDv2_CL | where message_verdict_verdict == 'phishing'"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get all Cisco ETD threat messages",
          "query": "CiscoETDv2_CL\n| sort by TimeGenerated desc"
        },
        {
          "description": "Get recent malicious messages",
          "query": "CiscoETDv2_CL\n| where message_verdict_verdict == 'malicious'\n| take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "CiscoETDv2_CL",
          "lastDataReceivedQuery": "CiscoETDv2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors",
          "value": []
        }
      ],
      "availability": {
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true
            }
          }
        ],
        "customs": [
          {
            "name": "Cisco ETD API Credentials",
            "description": "Cisco ETD API credentials are required. Refer to the [Cisco ETD API Authentication documentation](https://developer.cisco.com/docs/message-search-api/authentication/) for more information."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect to Cisco ETD API",
          "description": "Provide your Cisco ETD API endpoint, Client ID, Client Secret, and API Key. These credentials can be obtained from your Cisco ETD administrator or through the Cisco ETD management console.",
          "instructions": [
            {
              "type": "Textbox",
              "parameters": {
                "label": "Base Endpoint URL",
                "placeholder": "https://api.us.etd.cisco.com",
                "type": "text",
                "name": "baseEndpoint",
                "validations": {
                  "required": true
                }
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Client ID",
                "placeholder": "Enter OAuth2 Client ID",
                "type": "text",
                "name": "clientId",
                "validations": {
                  "required": true
                }
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Client Secret",
                "placeholder": "Enter OAuth2 Client Secret",
                "type": "password",
                "name": "clientSecret",
                "validations": {
                  "required": true
                }
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "API Key",
                "placeholder": "Enter Cisco ETD API Key",
                "type": "password",
                "name": "apiKey",
                "validations": {
                  "required": true
                }
              }
            },
            {
              "parameters": {
                "label": "Connect",
                "name": "toggle"
              },
              "type": "ConnectionToggleButton"
            }
          ]
        }
      ]
    }
  }
}