{
  "name": "NetskopeWebTxConnector",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "NetskopeWebTxConnector",
      "title": "Netskope Web Transactions (via Blob Storage)",
      "publisher": "Netskope",
      "descriptionMarkdown": "The Netskope Web Transactions data connector enables ingestion of web transaction logs from Netskope into Microsoft Sentinel using Netskope Log Streaming (NLS) capability. Web transaction logs provide detailed visibility into all web traffic processed by Netskope, including user activity, application usage, URL categories, policy actions, and network metadata.\n\nThis connector uses Azure Blob Storage and Event Grid to ingest logs that Netskope streams to your storage account.",
      "graphQueries": [
        {
          "metricName": "Total logs received",
          "legend": "Netskope WebTx Logs",
          "baseQuery": "NetskopeWebTransactions_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get Sample of Netskope WebTx Logs",
          "query": "NetskopeWebTransactions_CL | take 10"
        },
        {
          "description": "Top 10 Users by Traffic Volume",
          "query": "NetskopeWebTransactions_CL | summarize TotalBytes = sum(Bytes) by CsUsername | top 10 by TotalBytes"
        },
        {
          "description": "Top Applications by Usage",
          "query": "NetskopeWebTransactions_CL | where isnotempty(XCsApp) | summarize Count = count() by XCsApp | top 10 by Count"
        }
      ],
      "dataTypes": [
        {
          "name": "NetskopeWebTransactions_CL",
          "lastDataReceivedQuery": "NetskopeWebTransactions_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors",
          "value": null
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": true,
              "action": false
            }
          },
          {
            "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
            "permissionsDisplayText": "Read permissions to shared keys for the workspace are required.",
            "providerDisplayName": "Keys",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": false,
              "write": false,
              "delete": false,
              "action": true
            }
          }
        ],
        "customs": [
          {
            "name": "Subscription permissions",
            "description": "You need permissions to create the data flow resources:\n- Storage queues (notification queue and dead-letter queue)\n- Event Grid topic and subscription (to send 'blob created event' notifications)\n- Role assignments (to grant access for Microsoft Sentinel app to the blob container and storage queues)"
          },
          {
            "name": "Netskope Log Streaming Configuration",
            "description": "Configure Netskope Log Streaming (NLS) to send Web Transaction logs to your Azure Blob Storage container. Follow the [Netskope NLS documentation](https://docs.netskope.com/en/log-streaming) for setup instructions."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect Netskope Web Transaction Logs to Microsoft Sentinel",
          "description": "To enable the Netskope Web Transactions Logs for Microsoft Sentinel, provide the required information below and click on Connect.\n\n**Prerequisites:**\n1. Configure Netskope NLS to send Web Transaction logs to an Azure Blob Storage container\n2. Ensure you have the required permissions on the storage account",
          "instructions": [
            {
              "type": "ServicePrincipalIDTextBox_test",
              "parameters": {
                "tenantId": "[subscription().tenantId]",
                "name": "principalId",
                "appId": "4f05ce56-95b6-4612-9d98-a45c8cc33f9f"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Blob Container URL",
                "type": "text",
                "name": "blobContainerUri"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Blob Folder Name (Optional)",
                "placeholder": "Leave empty if logs are at container root",
                "type": "text",
                "name": "blobFolderName"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Storage Account Location",
                "placeholder": "e.g., eastus",
                "type": "text",
                "name": "StorageAccountLocation"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Storage Account Resource Group Name",
                "type": "text",
                "name": "StorageAccountResourceGroupName"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Storage Account Subscription ID",
                "type": "text",
                "name": "StorageAccountSubscription"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Event Grid Topic Name (if exists)",
                "description": "The data flow uses Event Grid to send 'blob-created event' notifications. There can be only one Event Grid topic per storage account. Go to your storage account's 'Events' section. If you already have a topic, provide its name. Otherwise, leave empty to create a new one.",
                "placeholder": "Leave empty to create new topic",
                "type": "text",
                "name": "EGSystemTopicName"
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "label": "toggle",
                "name": "toggle"
              }
            }
          ]
        }
      ],
      "isConnectivityCriteriasMatchSome": false
    }
  }
}