{
    "name": "CyfirmaCyberIntelligenceDC",
    "apiVersion": "2024-01-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "CyfirmaCyberIntelligenceDC",
            "title": "CYFIRMA Cyber Intelligence",
            "publisher": "Microsoft",
            "isConnectivityCriteriasMatchSome": false,
            "descriptionMarkdown": "The CYFIRMA Cyber Intelligence data connector enables seamless log ingestion from the DeCYFIR API into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform, it leverages the DeCYFIR Alerts API to retrieve logs. Additionally, it supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview), which parse security data into a custom table during ingestion. This eliminates the need for query-time parsing, enhancing performance and efficiency.",
            "graphQueries": [
                {
                    "metricName": "Total Indicators logs received",
                    "legend": "Indicators Logs",
                    "baseQuery": "CyfirmaIndicators_CL"
                },
                {
                    "metricName": "Total Threat Actors logs received",
                    "legend": "Threat Actors Logs",
                    "baseQuery": "CyfirmaThreatActors_CL"
                },
                {
                    "metricName": "Total Campaigns logs received",
                    "legend": "Campaigns Logs",
                    "baseQuery": "CyfirmaCampaigns_CL"
                },
                {
                    "metricName": "Total Malware logs received",
                    "legend": "Malware Logs",
                    "baseQuery": "CyfirmaMalware_CL"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Get Sample of Indicators logs",
                    "query": "CyfirmaIndicators_CL | take 10"
                },
                {
                    "description": "Get Sample of Threat Actors logs",
                    "query": "CyfirmaThreatActors_CL | take 10"
                },
                {
                    "description": "Get Sample of Campaigns logs",
                    "query": "CyfirmaCampaigns_CL | take 10"
                },
                {
                    "description": "Get Sample of Malware logs",
                    "query": "CyfirmaMalware_CL | take 10"
                }
            ],
            "dataTypes": [
                {
                    "name": "CyfirmaIndicators_CL",
                    "lastDataReceivedQuery": "CyfirmaIndicators_CL\n | where TimeGenerated > ago(5m) | summarize Time = max(TimeGenerated)\n  | where isnotempty(Time)"
                },
                {
                    "name": "CyfirmaThreatActors_CL",
                    "lastDataReceivedQuery": "CyfirmaThreatActors_CL\n | where TimeGenerated > ago(5m) | summarize Time = max(TimeGenerated)\n  | where isnotempty(Time)"
                },
                {
                    "name": "CyfirmaCampaigns_CL",
                    "lastDataReceivedQuery": "CyfirmaCampaigns_CL\n | where TimeGenerated > ago(5m) | summarize Time = max(TimeGenerated)\n  | where isnotempty(Time)"
                },
                {
                    "name": "CyfirmaMalware_CL",
                    "lastDataReceivedQuery": "CyfirmaMalware_CL\n | where TimeGenerated > ago(5m) | summarize Time = max(TimeGenerated)\n  | where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "availability": {
                "status": 1,
                "isPreview": false
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "read": true,
                            "write": true,
                            "delete": true,
                            "action": false
                        }
                    }
                ]
            },
            "instructionSteps": [
                {
                    "title": "CYFIRMA Cyber Intelligence",
                    "description": "This connector provides the Indicators, Threat actors, Malware and Campaigns logs from CYFIRMA Cyber Intelligence. The connector uses the DeCYFIR API to retrieve logs and supports DCR-based ingestion time transformations, parsing security data into a custom table during ingestion. This eliminates the need for query-time parsing, enhancing performance and efficiency.",
                    "descriptionMarkdown": "This connector provides the Indicators, Threat actors, Malware and Campaigns logs from CYFIRMA Cyber Intelligence. The connector uses the DeCYFIR API to retrieve logs and supports DCR-based ingestion time transformations, parsing security data into a custom table during ingestion. This eliminates the need for query-time parsing, enhancing performance and efficiency.",
                    "estimatedTime": "5 minutes",
                    "icon": "https://www.microsoft.com/favicon.ico",
                    "instructions": [
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "CYFIRMA API URL",
                                "placeholder": "https://decyfir.cyfirma.com",
                                "type": "text",
                                "name": "cyfirmaAPIURL"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "CYFIRMA API Key",
                                "placeholder": "CYFIRMA API Key",
                                "type": "password",
                                "name": "cyfirmaAPIKey"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Pull all IoC's Or Tailored IoC's",
                                "placeholder": "All IoC's or Tailored IoC's",
                                "type": "text",
                                "name": "apiAll",
                                "defaultValue": "false",
                                "description": "Set to true to pull all IoC's, set to false to pull tailoried IoC's"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "API Delta",
                                "placeholder": "API Delta",
                                "type": "text",
                                "name": "apiDelta",
                                "defaultValue": "false",
                                "description": "Setting it to true returns only data added since the last API call, while false returns data from the last 24 hours."
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Recommended Actions",
                                "placeholder": "Recommended Action can be any one of:All/Monitor/Block",
                                "type": "text",
                                "name": "recommendedActions",
                                "defaultValue": "All",
                                "description": "Recommended Action can be any one of:All/Monitor/Block",
                                
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Threat Actor Associated",
                                "placeholder": "Is any Threat Actor Associated with the IoC's",
                                "type": "text",
                                "name": "isThreatActorExists",
                                "defaultValue": "false",
                                "description": "Is any Threat Actor Associated with the IoC's"
                            }
                        },
                        {
                            
                            "type": "ConnectionToggleButton",
                            "parameters": {
                                "connectLabel": "Connect",
                                "name": "toggle"
                            }
                        }
                    ]
                }
            ]
        }
    }
}