{
    "name": "CyfirmaAttackSurfaceAlertsConnector",
    "apiVersion": "2024-01-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "CyfirmaAttackSurfaceAlertsConnector",
            "title": "CYFIRMA Attack Surface",
            "publisher": "Microsoft",
            "isConnectivityCriteriasMatchSome": false,
            "DescriptionMarkdown": "The CYFIRMA Attack Surface Alerts data connector enables seamless log ingestion from the DeCYFIR/DeTCT API into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform, it leverages the DeCYFIR Alerts API to retrieve logs. Additionally, it supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview), which parse security data into a custom table during ingestion. This eliminates the need for query-time parsing, enhancing performance and efficiency.", 
            "graphQueries": [
                {
                    "metricName": "Total Certificates Alerts logs received",
                    "legend": "Certificates Alerts Logs",
                    "baseQuery": "CyfirmaASCertificatesAlerts_CL"
                },
                {
                    "metricName": "Total Configuration Alerts logs received",
                    "legend": "Configuration Alerts Logs",
                    "baseQuery": "CyfirmaASConfigurationAlerts_CL"
                },
                {
                    "metricName": "Total Domain-IP Reputation Alerts logs received",
                    "legend": "Domain-IP Reputation Logs",
                    "baseQuery": "CyfirmaASDomainIPReputationAlerts_CL"
                },
                {
                    "metricName": "Total Open ports Alerts logs received",
                    "legend": "Open Ports Alerts Logs",
                    "baseQuery": "CyfirmaASOpenPortsAlerts_CL"
                },
                {
                    "metricName": "Total CloudWeakness Alerts logs received",
                    "legend": "CloudWeakness Logs",
                    "baseQuery": "CyfirmaASCloudWeaknessAlerts_CL"
                },
                {
                    "metricName": "Total Domain/IP Vulnerability Alerts logs received",
                    "legend": "Domain/IP Vulnerability Alerts Logs",
                    "baseQuery": "CyfirmaASDomainIPVulnerabilityAlerts_CL"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Get Sample of Attack Surface Certificates Alerts logs",
                    "query": "CyfirmaASCertificatesAlerts_CL| take 10"
                },
                {
                    "description": "Get Sample of Attack Surface Configuration Alerts logs",
                    "query": "CyfirmaASConfigurationAlerts_CL| take 10"
                },
                {
                    "description": "Get Sample of Attack Surface Domain IP Reputation Alerts logs",
                    "query": "CyfirmaASDomainIPReputationAlerts_CL| take 10"
                },
                {
                    "description": "Get Sample of Attack Surface Open Ports Alerts logs",
                    "query": "CyfirmaASOpenPortsAlerts_CL| take 10"
                },
                {
                    "description": "Get Sample of Attack Surface CloudWeakness Alerts logs",
                    "query": "CyfirmaASCloudWeaknessAlerts_CL| take 10"
                },
                {
                    "description": "Get Sample of Attack Surface Domain IP Vulnerability Alerts logs",
                    "query": "CyfirmaASDomainIPVulnerabilityAlerts_CL| take 10"
                }
            ],
            "dataTypes": [
                {
                    "name": "CyfirmaASCertificatesAlerts_CL",
                    "lastDataReceivedQuery": "CyfirmaASCertificatesAlerts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CyfirmaASConfigurationAlerts_CL",
                    "lastDataReceivedQuery": "CyfirmaASConfigurationAlerts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CyfirmaASDomainIPReputationAlerts_CL",
                    "lastDataReceivedQuery": "CyfirmaASDomainIPReputationAlerts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CyfirmaASOpenPortsAlerts_CL",
                    "lastDataReceivedQuery": "CyfirmaASOpenPortsAlerts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CyfirmaASCloudWeaknessAlerts_CL",
                    "lastDataReceivedQuery": "CyfirmaASCloudWeaknessAlerts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "CyfirmaASDomainIPVulnerabilityAlerts_CL",
                    "lastDataReceivedQuery": "CyfirmaASDomainIPVulnerabilityAlerts_CL\n       | where TimeGenerated > ago(12h)                | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "availability": {
                "status": 1,
                "isPreview": false
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "read": true,
                            "write": true,
                            "delete": true,
                            "action": false
                        }
                    }
                ]
            },
            "instructionSteps": [
                {
                    "title": "CYFIRMA Attack Surface",
                    "description": "Connect to CYFIRMA Attack Surface to ingest alerts into Microsoft Sentinel. This connector uses the DeCYFIR/DeTCT API to retrieve logs and supports DCR-based ingestion time transformations, parsing security data into custom tables during ingestion. This eliminates the need for query-time parsing, enhancing performance and efficiency.",
                    "estimatedTime": "5 minutes",
                    "icon": "https://www.microsoft.com/favicon.ico",
                    "instructions": [
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "CYFIRMA API URL",
                                "placeholder": "https://decyfir.cyfirma.com",
                                "type": "text",
                                "name": "cyfirmaAPIURL"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "CYFIRMA API Key",
                                "placeholder": "CYFIRMA API Key",
                                "type": "password",
                                "name": "cyfirmaAPIKey"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "API Delta",
                                "placeholder": "API Delta",
                                "type": "text",
                                "name": "apiDelta", 
                                "description": "True: First call returns last 30 days, then only incremental data. False: Returns all data on every call."
                            }
                        },
                        
                        {
                            "type": "ConnectionToggleButton",
                            "parameters": {
                                 "connectLabel": "Connect",
                                 "name": "connect"
                            }
                        }
                    ]
                }
            ]
        }
    }
}