{
  "id": "ThreatIntelligenceTaxiiExport",
  "title": "Threat intelligence - TAXII Export",
  "publisher": "Microsoft",
  "descriptionMarkdown": "Microsoft Sentinel integrates with TAXII 2.1 servers to enable exporting of your threat intelligence objects. Use this connector to send the supported STIX object types from Microsoft Sentinel to TAXII servers.",
  "graphQueries": [
    {
      "metricName": "Total data received",
      "legend": "ExportThreatIntelligenceLogs",
      "baseQuery": "ThreatIntelExportOperation"
    }
  ],
  "sampleQueries": [],
  "connectivityCriterias": [
    {
      "type": "SentinelKinds",
      "value": [
        "ThreatIntelligenceTaxiiExport"
      ]
    }
  ],
  "dataTypes": [
    {
      "name": "ExportThreatIntelligenceLogs",
      "lastDataReceivedQuery": "ThreatIntelExportOperation | summarize Time = max(TimeGenerated) | where isnotempty(Time)"
    }
  ],
  "availability": {
    "status": 1,
    "isPreview": false
  },
  "permissions": {
    "customs": [
      {
        "name": "TAXII Server",
        "description": "TAXII 2.1 Server URL and Collection ID."
      }
    ],
    "resourceProvider": [
      {
        "provider": "Microsoft.OperationalInsights/workspaces",
        "permissionsDisplayText": "read and write permissions.",
        "providerDisplayName": "Workspace",
        "scope": "Workspace",
        "requiredPermissions": {
          "read": true,
          "write": true,
          "delete": true
        }
      }
    ]
  },
  "instructionSteps": [
    {
      "title": "Configure TAXII servers to export STIX 2.1 objects to. Once configured, you can start exporting STIX objects from your TI repository",
      "instructions": [
        {
          "parameters": {
            "isExport": true
          },
          "type": "ThreatIntelligenceTaxii"
        }
      ]
    }
  ]
}