{
    "name": "BitwardenEventLogs",
    "apiVersion": "2024-01-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "BitwardenEventLogs",
            "title": "Bitwarden Event Logs",
            "publisher": "Bitwarden Inc",
            "descriptionMarkdown": "This connector provides insight into activity of your Bitwarden organization such as user's activity (logged in, changed password, 2fa, etc.), cipher activity (created, updated, deleted, shared, etc.), collection activity, organization activity, and more.",
            "graphQueriesTableName": "BitwardenEventLogs",
            "graphQueries": [
                {
                    "metricName": "Total event logs received",
                    "legend": "Bitwarden Event Logs",
                    "baseQuery": "BitwardenEventLogs_CL"
                }
            ],
            "sampleQueries": [
                {
                    "name": "Get sample of Bitwarden Event Logs",
                    "query": "BitwardenEventLogs",
                    "description": "Get sample of Bitwarden Event Logs"
                }
            ],
            "dataTypes": [
                {
                    "name": "EventLogs",
                    "lastDataReceivedQuery": "BitwardenEventLogs_CL\n | summarize Time = max(TimeGenerated) | where isnotempty(Time)"
                },
                {
                    "name": "Members",
                    "lastDataReceivedQuery": "BitwardenMembers_CL\n | summarize Time = max(TimeGenerated) | where isnotempty(Time)"
                },
                {
                    "name": "Groups",
                    "lastDataReceivedQuery": "BitwardenGroups_CL\n | summarize Time = max(TimeGenerated) | where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "availability": {
                "isPreview": false
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "write": true,
                            "read": true,
                            "delete": true
                        }
                    },
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                        "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)",
                        "providerDisplayName": "Keys",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "action": true
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "Bitwarden Client Id and Client Secret",
                        "description": "Your API key can be found in the Bitwarden organization admin console. Please see [Bitwarden documentation](https://bitwarden.com/help/public-api/#authentication) for more information."
                    }
                ]
            },
            "instructionSteps": [
                {
                    "description": "Your API key can be found in the Bitwarden organization admin console.\nPlease see [Bitwarden documentation](https://bitwarden.com/help/public-api/#authentication) for more information.\nSelf-hosted Bitwarden servers may need to reconfigure their installation's URL.",
                    "instructions": [
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Bitwarden Identity Url",
                                "placeholder": "https://identity.bitwarden.com",
                                "type": "text",
                                "name": "identityEndpoint"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Bitwarden Api Url",
                                "placeholder": "https://api.bitwarden.com",
                                "type": "text",
                                "name": "apiEndpoint"
                            }
                        },
                        {
                            "type": "OAuthForm",
                            "parameters": {
                                "clientIdLabel": "Client ID",
                                "clientSecretLabel": "Client Secret",
                                "connectButtonLabel": "Connect",
                                "disconnectButtonLabel": "Disconnect"
                            }
                        }
                    ],
                    "title": "Connect Bitwarden Event Logs to Microsoft Sentinel"
                }
            ]
        }
    }
}