{
    "_comment": "Keep in sync with the Customizable dataConnectorDefinitions resource in azuredeploy.json (used by the standalone Deploy to Azure button / connector self-deployment instruction step). This file exists solely so the connector tile is discovered by the solution packaging tool via Data/Solution_RecordedFuture.json's \"Data Connectors\" list.",
    "id": "RecordedFuture",
    "title": "Recorded Future - Log Ingestion",
    "publisher": "Recorded Future",
    "descriptionMarkdown": "Imports Recorded Future data into Microsoft Sentinel via the Log Ingestion API. Writes playbook alerts to `RecordedFuturePlaybookAlerts_V2_CL`, classic alerts to `RecordedFutureClassicAlerts_V2_CL`, threat map data to `RecordedFutureThreatMap_V2_CL` and `RecordedFutureThreatMapMalware_V2_CL`, and sandbox results to `RecordedFutureSandboxResults_V2_CL`.",
    "graphQueries": [
        {
            "metricName": "Playbook Alerts",
            "legend": "RecordedFuturePlaybookAlerts_V2_CL",
            "baseQuery": "RecordedFuturePlaybookAlerts_V2_CL"
        },
        {
            "metricName": "Classic Alerts",
            "legend": "RecordedFutureClassicAlerts_V2_CL",
            "baseQuery": "RecordedFutureClassicAlerts_V2_CL"
        },
        {
            "metricName": "Threat Map",
            "legend": "RecordedFutureThreatMap_V2_CL",
            "baseQuery": "RecordedFutureThreatMap_V2_CL"
        },
        {
            "metricName": "Threat Map Malware",
            "legend": "RecordedFutureThreatMapMalware_V2_CL",
            "baseQuery": "RecordedFutureThreatMapMalware_V2_CL"
        },
        {
            "metricName": "Sandbox Results",
            "legend": "RecordedFutureSandboxResults_V2_CL",
            "baseQuery": "RecordedFutureSandboxResults_V2_CL"
        }
    ],
    "sampleQueries": [
        {
            "description": "Recent playbook alerts",
            "query": "RecordedFuturePlaybookAlerts_V2_CL\n| sort by TimeGenerated desc"
        },
        {
            "description": "Recent classic alerts",
            "query": "RecordedFutureClassicAlerts_V2_CL\n| sort by TimeGenerated desc"
        },
        {
            "description": "Recent threat map entries",
            "query": "RecordedFutureThreatMap_V2_CL\n| sort by TimeGenerated desc"
        },
        {
            "description": "Recent sandbox results",
            "query": "RecordedFutureSandboxResults_V2_CL\n| sort by TimeGenerated desc"
        }
    ],
    "dataTypes": [
        {
            "name": "RecordedFuturePlaybookAlerts_V2_CL",
            "lastDataReceivedQuery": "RecordedFuturePlaybookAlerts_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
            "name": "RecordedFutureClassicAlerts_V2_CL",
            "lastDataReceivedQuery": "RecordedFutureClassicAlerts_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
            "name": "RecordedFutureThreatMap_V2_CL",
            "lastDataReceivedQuery": "RecordedFutureThreatMap_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
            "name": "RecordedFutureThreatMapMalware_V2_CL",
            "lastDataReceivedQuery": "RecordedFutureThreatMapMalware_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
            "name": "RecordedFutureSandboxResults_V2_CL",
            "lastDataReceivedQuery": "RecordedFutureSandboxResults_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
    ],
    "connectivityCriteria": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "RecordedFuturePlaybookAlerts_V2_CL\n| summarize LastLog = max(TimeGenerated)\n| project IsConnected = LastLog >= ago(24h)",
                "RecordedFutureClassicAlerts_V2_CL\n| summarize LastLog = max(TimeGenerated)\n| project IsConnected = LastLog >= ago(24h)",
                "RecordedFutureThreatMap_V2_CL\n| summarize LastLog = max(TimeGenerated)\n| project IsConnected = LastLog >= ago(24h)",
                "RecordedFutureThreatMapMalware_V2_CL\n| summarize LastLog = max(TimeGenerated)\n| project IsConnected = LastLog >= ago(24h)",
                "RecordedFutureSandboxResults_V2_CL\n| summarize LastLog = max(TimeGenerated)\n| project IsConnected = LastLog >= ago(24h)"
            ]
        }
    ],
    "availability": {
        "status": 1
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "Read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true
                }
            }
        ],
        "customs": [
            {
                "name": "Azure Subscription",
                "description": "Monitoring Contributor and Log Analytics Contributor permissions required to deploy the Data Connectors infrastructure. Owner or Role Based Access Control Administrator required to deploy playbooks with automatic role assignment."
            },
            {
                "name": "Recorded Future API Token",
                "description": "A Recorded Future API token is required to authorize the Recorded Future Custom Connector used by the playbooks."
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Step 1 \u2014 Deploy Data Connectors infrastructure",
            "description": "Deploys the shared Data Collection Endpoint (DCE), Data Collection Rules (DCRs), Log Analytics tables, and this connector definition tile. Deploy this into the same resource group as your Log Analytics Workspace.\n\n[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-RecordedFutureDataConnector-azuredeploy)"
        },
        {
            "title": "Step 2 \u2014 Deploy the Recorded Future Custom Connector",
            "description": "The custom connector handles authentication towards the Recorded Future API. Deploy it once \u2014 it is shared by the playbooks.\n\n[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-RecordedFuture2FPlaybooksConnector-azuredeploy)"
        },
        {
            "title": "Step 3 \u2014 Deploy playbooks",
            "description": "Deploy one or more playbooks depending on your use case. No manual configuration is needed \u2014 each playbook connects to the Data Connectors infrastructure deployed in Step 1 automatically."
        }
    ]
}