{
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "apiVersion": "2022-09-01-preview",
    "name": "Strider Shield",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "StriderShieldCCF",
            "title": "Strider Shield",
            "publisher": "NVISO",
            "descriptionMarkdown": "The Strider Shield connector allows the user to ingest Strider Shield EmailAddresses, EmailDomains, RiskSignals, RiskSignalsDefinitions and Terms events into Microsoft Sentinel.",
            "graphQueriesTableName": "StriderShieldEmailAddresses_CL",
            "graphQueries": [
                {
                    "metricName": "Total Email Addresses received",
                    "legend": "Strider Shield Email Addresses",
                    "baseQuery": "StriderShieldEmailAddresses_CL"
                },
                {
                    "metricName": "Total Email Domains received",
                    "legend": "Strider Shield Email Domains Events",
                    "baseQuery": "StriderShieldEmailDomains_CL"
                },
                {
                    "metricName": "Total Risk Signals received",
                    "legend": "Strider Shield Risk Signals",
                    "baseQuery": "StriderShieldRiskSignals_CL"
                },
				{
                    "metricName": "Total Risk Signals Definitions received",
                    "legend": "Strider Shield Risk Signals Definitions",
                    "baseQuery": "StriderShieldRiskSignalsDefinitions_CL"
                },
				{
                    "metricName": "Total Terms received",
                    "legend": "Strider Shield Terms",
                    "baseQuery": "StriderShieldTerms_CL"
                }
            ], 
            "sampleQueries": [
                {
                    "description": "Get Sample of Strider Shield events",
                    "query": "{{graphQueriesTableName}}\n | take 10"
                }
            ],
            "dataTypes": [
                {
                    "name": "StriderShieldEmailAddresses_CL",
                    "lastDataReceivedQuery": "StriderShieldEmailAddresses_CL\n | where TimeGenerated > ago(7d) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                },
                {
                    "name": "StriderShieldEmailDomains_CL",
                    "lastDataReceivedQuery": "StriderShieldEmailDomains_CL\n | where TimeGenerated > ago(7d) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                },
                {
                    "name": "StriderShieldRiskSignals_CL",
                    "lastDataReceivedQuery": "StriderShieldRiskSignals_CL\n | where TimeGenerated > ago(7d) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                },
				{
                    "name": "StriderShieldRiskSignalsDefinitions_CL",
                    "lastDataReceivedQuery": "StriderShieldRiskSignalsDefinitions_CL\n | where TimeGenerated > ago(7d) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                },
				{
                    "name": "StriderShieldTerms_CL",
                    "lastDataReceivedQuery": "StriderShieldTerms_CL\n | where TimeGenerated > ago(7d) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                }
            ], 
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "availability": {
                "isPreview": false
            },
             "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "write": true,
                            "read": true,
                            "delete": true
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "Strider Shield API token",
                        "description": "A Strider Shield API Token is required. See the Strider Shield documentation on how to create an API token."
                    }
                ]
            },
            "instructionSteps": [
                {
                    "title": "STEP 1 - Use an Authentication Strider Shield API endpoint",
                    "description": "Follow the Strider Shield documentation for guidance on this step."
                },
                {
                    "title": "STEP 2 - Choose the correct base URL",
                    "description": "There are multiple Strider Shield servers which might host your events. The correct server depends on your license and region.Input the base URL as displayed by the documentation (including 'https://' and without a trailing '/')."
                },
                {
                    "title": "STEP 3 - Enter your Strider Shield Details",
                    "description": "Enter the Strider Shield Authentication API endpoint, Base URL, Client ID & Client Secret below:",
                    "instructions": [
                        {
                          "type": "Textbox",
                          "parameters": {
                            "label": "Authentication API endpoint",
                            "placeholder": "Enter your Authentication API endpoint",
                            "type": "text",
                            "name": "AuthApiEndpoint"
                          }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Base Url",
                                "placeholder": "Enter your Base Url",
                                "type": "text",
                                "name": "BaseUrl"
                            }
                        },
						 {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Client ID",
                                "placeholder": "Enter your Client ID",
                                "type": "text",
                                "name": "ClientID"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Client Secret",
                                "placeholder": "Enter your Client Secret",
                                "type": "password",
                                "name": "ClientSecret"
                            }
                        },
                        {
                            "type": "ConnectionToggleButton",
                            "parameters": {
                                "connectLabel": "Connect",
                                "disconnectLabel": "Disconnect",
                                "name": "connectionToggle"
                            }
                        }
                    ]
                }
            ]
        }
    }
}