{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
         "workspace": {
            "defaultValue": "Sentinel-Dev",
            "type": "string",
            "metadata": {
                "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
            }
        }
    },
    "resources": [
        {
            "id": "[concat('/subscriptions/',subscription().subscriptionId,'/resourceGroups/',resourceGroup().name,'/providers/Microsoft.OperationalInsights/workspaces/',parameters('workspace'),'/providers/Microsoft.SecurityInsights/dataConnectors/',guid(subscription().subscriptionId))]",
            "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',guid(subscription().subscriptionId))]",
            "apiVersion": "2023-06-01-preview",
            "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
            "kind": "APIPolling",
            "properties": {
                "connectorUiConfig": {
                    "id": "KnowBe4DefendPolling",
                    "title": "KnowBe4 Defend",
                    "publisher": "KnowBe4",
                    "descriptionMarkdown": "The KnowBe4 Defend audit connector provides the capability to ingest KnowBe4 Defend Data into Microsoft Sentinel.",
                    "graphQueriesTableName": "KnowBe4Defend_CL",
                    "graphQueries": [
                        {
                            "metricName": "Total data received",
                            "legend": "KnowBe4 Defend Events",
                            "baseQuery": "{{graphQueriesTableName}}"
                        }
                    ],
                    "sampleQueries": [
                        {
                            "description": "All logs",
                            "query": "DefendAuditData"
                        }
                    ],
                    "dataTypes": [
                        {
                            "name": "{{graphQueriesTableName}}",
                            "lastDataReceivedQuery": "{{graphQueriesTableName}}\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
                        }
                    ],
                    "connectivityCriteria": [
                        {
                            "type": "SentinelKindsV2",
                            "value": [
                                "APIPolling"
                            ]
                        }
                    ],
                    "availability": {
                        "status": 1,
                        "isPreview": true
                    },
                    "permissions": {
                        "resourceProvider": [
                            {
                                "provider": "Microsoft.OperationalInsights/workspaces",
                                "permissionsDisplayText": "Read and Write permissions on the Log Analytics workspace are required to enable the data connector.",
                                "providerDisplayName": "Workspace",
                                "scope": "Workspace",
                                "requiredPermissions": {
                                    "action": true,
                                    "write": true,
                                    "read": true,
                                    "delete": true
                                }
                            }
                        ],
                        "customs": [
                            {
                                "name": "KnowBe4 API Token",
                                "description": "A KnowBe4 API token is required to ingest audit records to Microsoft Sentinel."
                            }
                        ]
                    },
                    "instructionSteps": [
                        {
                            "title": "Connect KnowBe4 Defend with Microsoft Sentinel",
                            "description": "Enter your KnowBe4 Defend API URl, KnowBe4 Domain and API token.",
                            "instructions": [
                                {
                                    "parameters": {
                                        "enable": "true",
                                        "userRequestPlaceHoldersInput": [
                                            {
                                                "displayText": "API URL",
                                                "requestObjectKey": "apiEndpoint",
                                                "placeHolderName": "{{apiUrl}}"
                                            },
                                            {
                                                "displayText": "Domain name",
                                                "requestObjectKey": "apiEndpoint",
                                                "placeHolderName": "{{domain}}"
                                            }
                                        ]
                                    },
                                    "type": "APIKey"
                                }
                            ]
                        }
                    ]
                },
                "pollingConfig": {
                    "auth": {
                        "authType": "APIKey",
                        "APIKeyName": "X-Api-Key",
                        "IsAPIKeyInPostPayload": false
                    },
                    "request": {
                        "apiEndpoint": "https://{{apiUrl}}/V1/events/?pagingMode=offset&domain={{domain}}",
                        "httpMethod": "Get",
                        "startTimeAttributeName": "startTime",
                        "endTimeAttributeName":"endTime",
                        "queryTimeFormat": "yyyy-MM-ddTHH:mm:ss.fffZ",
                        "retryCount": 2,
                        "queryWindowInMin": 5,
                        "timeoutInSeconds": 120,
                        "headers": {
				        	"Accept": "application/json"
				        }
                    },
                    "paging": {
                        "pagingType": "Offset",
                        "offsetParaName": "offset",
                        "pageSizeParaName": "limit",
                        "pageSize": 100
                    },
                    "response": {
                        "eventsJsonPaths": [
                            "$..items"
                        ]
                    }
                }
            }
        }
    ]
}