{
    "apiVersion": "2022-09-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "name": "DragosSitestoreCCP",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "DragosSitestoreCCP",
            "title": " Dragos Notifications via Cloud Sitestore",
            "publisher": "Dragos",
            "descriptionMarkdown": "The [Dragos Platform](https://www.dragos.com/) is the leading Industrial Cyber Security platform it offers a comprehensive Operational Technology (OT) cyber threat detection built by unrivaled industrial cybersecurity expertise. This solution enables Dragos Platform notification data to be viewed in Microsoft Sentinel so that security analysts are able to triage potential cyber security events occurring in their industrial environments.",
            "graphQueriesTableName": "DragosAlerts_CL",
            "graphQueries": [
                {
                    "metricName": "Total data received",
                    "legend": "Dragos Sitestore Alerts",
                    "baseQuery": "{{graphQueriesTableName}}"
                }
            ],
            "sampleQueries": [
                {
                    "description": "All Dragos Sitestore alerts",
                    "query": "{{graphQueriesTableName}}\n| sort by TimeGenerated desc"
                },
                {
                    "description": "Total Alerts",
                    "query": "{{graphQueriesTableName}}\n | summarize count() by id"
                }
            ],
            "dataTypes": [
                {
                    "name": "{{graphQueriesTableName}}",
                    "lastDataReceivedQuery": "{{graphQueriesTableName}}|summarize Time = max  (TimeGenerated)\n|where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "availability": {
                "isPreview": false
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "write": true,
                            "read": true,
                            "delete": true
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "Dragos Sitestore API access",
                        "description": "A Sitestore user account that has the `notification:read` permission. This account also needs to have an API key that can be provided to Sentinel."
                    }
                ]
            },
            "instructionSteps": [
                {
                    "description": "Please provide the following information to allow Microsoft Sentinel to connect to your Dragos Sitestore.",
                    "instructions": [
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Dragos Sitestore Hostname",
                                "placeholder": "dragossitestore.example.com",
                                "type": "text",
                                "name": "dragosSitestoreHostname"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Dragos Sitestore API Key ID",
                                "placeholder": "Enter the API key ID.",
                                "type": "text",
                                "name": "username"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Dragos Sitestore API Key Secret",
                                "placeholder": "Enter the API key secret",
                                "type": "password",
                                "name": "password"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Minimum Notification Severity. Valid values are 0-5 inclusive. Ensure less than or equal to maximum severity.",
                                "placeholder": "Enter the min severity (recommend 0 for all notifications)",
                                "type": "number",
                                "name": "minSeverity"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Maximum Notification Severity. Valid values are 0-5 inclusive. Ensure greater than or equal to minimum severity.",
                                "placeholder": "Enter the max severity (recommend 5 for all notifications)",
                                "type": "number",
                                "name": "maxSeverity"
                            }
                        },
                        {
                            "type": "ConnectionToggleButton",
                            "parameters": {
                                "connectLabel": "Connect to Sitestore",
                                "disconnectLabel": "Disconnect from Sitestore",
                                "name": "connectionToggle"
                            }
                        }
                    ]
                }
            ]
        }
    }
}