{
  "name": "GitHubAuditDefinitionV2",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "GitHubAuditDefinitionV2",
      "title": "GitHub Enterprise Audit Log (via Codeless Connector Framework)",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The GitHub audit log connector provides the capability to ingest GitHub logs into Microsoft Sentinel. By connecting GitHub audit logs into Microsoft Sentinel, you can view this data in workbooks, use it to create custom alerts, and improve your investigation process. \n\n **Note:** If you intended to ingest GitHub subscribed events into Microsoft Sentinel, please refer to GitHub (using Webhooks) Connector from \"**Data Connectors**\" gallery.",
      "graphQueriesTableName": "GitHubAuditLogsV2_CL",
      "graphQueries": [
        {
          "metricName": "Total events received",
          "legend": "GitHubAuditLogEvents",
          "baseQuery": "{{graphQueriesTableName}}"
        }
      ],
      "sampleQueries": [
        {
          "description": "GitHub Audit Logs",
          "query": "{{graphQueriesTableName}}\n | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "{{graphQueriesTableName}}",
          "lastDataReceivedQuery": "{{graphQueriesTableName}}\n|summarize Time = max  (TimeGenerated)\n|where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true
            }
          }
        ],
        "customs": [
          {
            "name": "GitHub API personal access token",
            "description": "To enable polling for the Enterprise audit log, ensure the authenticated user is an Enterprise admin and has a GitHub personal access token (classic) with the `read:audit_log` scope."
          },
          {
            "name": "GitHub Enterprise type",
            "description": "This connector will only function with GitHub Enterprise Cloud; it will not support GitHub Enterprise Server."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect the GitHub Enterprise-level Audit Log to Microsoft Sentinel",
          "description": "Enable GitHub audit logs. \n Follow [this guide](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-personal-access-token-classic) to create or find your personal access token.",
          "instructions": [
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnName": "Github Enterprise API URL",
                    "columnValue": "properties.addOnAttributes.ApiUrl"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "isPrimary": true,
                "label": "Add Enterprise",
                "title": "Add Enterprise",
                "contextPaneType": "DataConnectorsContextPane",
                "instructionSteps": [
                  {
                    "instructions": [
                      {
                        "parameters": {
                          "content": "Enter your Github Enterprise API URL and API key. Github Enterprise API URL formats:\n* `https://api.github.com/enterprises/{enterprise}`\n* `https://api.{subdomain}.ghe.com/enterprises/{enterprise}`"
                        },
                        "type": "Markdown"
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Github Enterprise API URL",
                          "placeholder": "Your Github Enterprise API URL",
                          "type": "text",
                          "name": "ApiUrl"
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "API Key",
                          "placeholder": "Enter API Key",
                          "type": "password",
                          "name": "apikey"
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ]
    }
  }
}