{
  "name": "CTM360CBSConnectorDefinition",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "apiVersion": "2022-09-01-preview",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "CTM360CBSConnectorDefinition",
      "title": "CTM360 CyberBlindSpot (Serverless)",
      "publisher": "CTM360",
      "descriptionMarkdown": "The CTM360 Cyber Blind Spot (CBS) connector provides integration with CTM360's CBS platform to ingest security data across 6 module types: incidents, malware logs, breached credentials, compromised cards, domain infringement, and subdomain infringement. This connector uses the Codeless Connector Framework (CCF) for serverless data collection.\n\n**Data Types:**\n- CBSLog_AzureV2_CL\n- CBS_MalwareLogs_AzureV2_CL\n- CBS_BreachedCredentials_AzureV2_CL\n- CBS_CompromisedCards_AzureV2_CL\n- CBS_DomainInfringement_AzureV2_CL\n- CBS_SubdomainInfringement_AzureV2_CL",
      "graphQueriesTableName": "CBSLog_AzureV2_CL",
      "graphQueries": [
        {
          "metricName": "Incidents",
          "legend": "CBSLog_AzureV2_CL",
          "baseQuery": "CBSLog_AzureV2_CL"
        },
        {
          "metricName": "Malware Logs",
          "legend": "CBS_MalwareLogs_AzureV2_CL",
          "baseQuery": "CBS_MalwareLogs_AzureV2_CL"
        },
        {
          "metricName": "Breached Credentials",
          "legend": "CBS_BreachedCredentials_AzureV2_CL",
          "baseQuery": "CBS_BreachedCredentials_AzureV2_CL"
        },
        {
          "metricName": "Compromised Cards",
          "legend": "CBS_CompromisedCards_AzureV2_CL",
          "baseQuery": "CBS_CompromisedCards_AzureV2_CL"
        },
        {
          "metricName": "Domain Infringement",
          "legend": "CBS_DomainInfringement_AzureV2_CL",
          "baseQuery": "CBS_DomainInfringement_AzureV2_CL"
        },
        {
          "metricName": "Subdomain Infringement",
          "legend": "CBS_SubdomainInfringement_AzureV2_CL",
          "baseQuery": "CBS_SubdomainInfringement_AzureV2_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "All Incidents",
          "query": "CBSLog_AzureV2_CL\n| sort by TimeGenerated desc\n| take 10"
        },
        {
          "description": "All Malware Logs",
          "query": "CBS_MalwareLogs_AzureV2_CL\n| sort by TimeGenerated desc\n| take 10"
        },
        {
          "description": "Breached Credentials",
          "query": "CBS_BreachedCredentials_AzureV2_CL\n| sort by TimeGenerated desc\n| take 10"
        },
        {
          "description": "Compromised Cards",
          "query": "CBS_CompromisedCards_AzureV2_CL\n| sort by TimeGenerated desc\n| take 10"
        },
        {
          "description": "Recent Domain Infringements",
          "query": "CBS_DomainInfringement_AzureV2_CL\n| sort by TimeGenerated desc\n| take 10"
        },
        {
          "description": "Recent Subdomain Infringements",
          "query": "CBS_SubdomainInfringement_AzureV2_CL\n| sort by TimeGenerated desc\n| take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "CBSLog_AzureV2_CL",
          "lastDataReceivedQuery": "CBSLog_AzureV2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "CBS_MalwareLogs_AzureV2_CL",
          "lastDataReceivedQuery": "CBS_MalwareLogs_AzureV2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "CBS_BreachedCredentials_AzureV2_CL",
          "lastDataReceivedQuery": "CBS_BreachedCredentials_AzureV2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "CBS_CompromisedCards_AzureV2_CL",
          "lastDataReceivedQuery": "CBS_CompromisedCards_AzureV2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "CBS_DomainInfringement_AzureV2_CL",
          "lastDataReceivedQuery": "CBS_DomainInfringement_AzureV2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "CBS_SubdomainInfringement_AzureV2_CL",
          "lastDataReceivedQuery": "CBS_SubdomainInfringement_AzureV2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true
            }
          },
          {
            "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
            "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
            "providerDisplayName": "Keys",
            "scope": "Workspace",
            "requiredPermissions": {
              "action": true
            }
          }
        ],
        "customs": [
          {
            "name": "CTM360 CBS API Key",
            "description": "A valid CTM360 Cyber Blind Spot API key is required to connect to the CBS API endpoint."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect CTM360 Cyber Blind Spot to Microsoft Sentinel",
          "description": "This connector uses the Codeless Connector Framework (CCF) to ingest data from CTM360 CBS into Microsoft Sentinel. Data is collected every 5 minutes across 6 different module types.",
          "instructions": [
            {
              "type": "InfoMessage",
              "parameters": {
                "text": "This connector creates 6 separate tables for different CBS module types: Incidents, Malware Logs, Breached Credentials, Compromised Cards, Domain Infringement, and Subdomain Infringement.",
                "inline": true
              }
            }
          ]
        },
        {
          "title": "Step 1: Obtain CTM360 API Keys",
          "description": "To setup this integration, you will need CBS API Key. You can get these keys using the following links:\n\nCBS API Key found from this link: https://platform.ctm360.com/start/integrations after logging with you account"
        },
        {
          "title": "Step 2: Configure Connection",
          "description": "Enter your CTM360 CBS API key and connect to start data ingestion.",
          "instructions": [
            {
              "type": "Textbox",
              "parameters": {
                "label": "CTM360 CBS API Key",
                "placeholder": "Enter your CTM360 CBS API Key",
                "type": "password",
                "name": "apiKey"
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "connectLabel": "Connect",
                "disconnectLabel": "Disconnect",
                "name": "connect"
              }
            }
          ]
        },
        {
          "title": "Step 3: Verify Data Ingestion",
          "description": "After connecting, data should start flowing within 5-10 minutes. Use the sample queries above to verify data ingestion for each module type.",
          "instructions": [
            {
              "type": "InfoMessage",
              "parameters": {
                "text": "Note: Initial data ingestion may take up to 30 minutes. The connector polls every 5 minutes with a 5-minute rolling window.",
                "inline": true
              }
            }
          ]
        }
      ]
    }
  }
}