{
  "id": "SonraiDataConnector",
  "title": "Sonrai Data Connector",
  "publisher": "Sonrai",
  "descriptionMarkdown": "Use this data connector to integrate with Sonrai Security and get Sonrai tickets sent directly to Microsoft Sentinel.",
  "graphQueries": [
    {
      "metricName": "Sonrai Tickets",
      "legend": "Sonrai_Tickets_CL",
      "baseQuery": "Sonrai_Tickets_CL"
    }
  ],
  "sampleQueries": [
    {
      "description" : "Query for tickets with AWSS3ObjectFingerprint resource type.",
      "query": "Sonrai_Tickets_CL \n| where digest_resourceType_s == \"AWSS3ObjectFingerprint\"\n| limit 10"
    }
  ],
  "dataTypes": [
    {
      "name": "Sonrai_Tickets_CL",
      "lastDataReceivedQuery": "Sonrai_Tickets_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
    }
  ],
  "connectivityCriterias": [
    {
      "type": "IsConnectedQuery",
      "value": [
        "Sonrai_Tickets_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
      ]
    }
  ],
  "availability": {
    "status": 1,
    "isPreview": false
  },
  "permissions": {
    "resourceProvider": [
      {
        "provider": "Microsoft.OperationalInsights/workspaces",
        "permissionsDisplayText": "read and write permissions are required.",
        "providerDisplayName": "Workspace",
        "scope": "Workspace",
        "requiredPermissions": {
          "write": true,
          "read": true,
          "delete": true
        }
      },
      {
        "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
        "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
        "providerDisplayName": "Keys",
        "scope": "Workspace",
        "requiredPermissions": {
          "action": true
        }
      }
    ]
  },
  "instructionSteps": [
    {
      "title": "Sonrai Security Data Connector",
      "description": "1. Navigate to Sonrai Security dashboard.\n2. On the bottom left panel, click on integrations.\n3. Select Microsoft Sentinel from the list of available Integrations.\n4. Fill in the form using the information provided below.",
      "instructions": [
        {
          "parameters": {
            "fillWith": [
              "WorkspaceId"
            ],
            "label": "Workspace ID"
          },
          "type": "CopyableLabel"
        },
        {
          "parameters": {
            "fillWith": [
              "PrimaryKey"
            ],
            "label": "Primary Key"
          },
          "type": "CopyableLabel"
        }
      ]
    }
  ],
  "metadata": {
    "id": "08ecd257-473b-43e5-83ed-6fdd1f0df413",
    "version": "1.0.0",
    "kind": "dataConnector",
    "source": {
      "kind": "solution",
      "name": "SonraiSecuritySolution"
    },
    "author": {
      "name": "SonraiSecurity"
    },
    "support": {
      "tier": "developer",
      "name": "Sonrai",
      "email": "support@sonraisecurity.com"
    }
  }
}