{
  "name": "SecurePracticeMailRiskConnector",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "SecurePracticeMailRiskConnector",
      "title": "MailRisk by Secure Practice",
      "publisher": "Secure Practice",
      "descriptionMarkdown": "The MailRisk by Secure Practice connector allows you to ingest email threat intelligence data from the MailRisk API into Microsoft Sentinel. This connector provides visibility into reported emails, risk assessments, and security events related to email threats.",
      "graphQueriesTableName": "MailRiskEventEmails_CL",
      "graphQueries": [
        {
          "metricName": "Total emails received",
          "legend": "MailRisk Emails",
          "baseQuery": "{{graphQueriesTableName}}"
        }
      ],
      "sampleQueries": [
        {
          "description": "All MailRisk emails",
          "query": "{{graphQueriesTableName}}\n| take 10"
        },
        {
          "description": "High risk emails",
          "query": "{{graphQueriesTableName}}\n| where RiskLevel == 'high'\n| sort by TimeGenerated desc"
        },
        {
          "description": "Emails by category",
          "query": "{{graphQueriesTableName}}\n| summarize count() by Category"
        }
      ],
      "dataTypes": [
        {
          "name": "{{graphQueriesTableName}}",
          "lastDataReceivedQuery": "{{graphQueriesTableName}}\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": false,
              "action": false
            }
          }
        ],
        "customs": [
          {
            "name": "API credentials",
            "description": "Your Secure Practice API key pair is also needed, which are created in the [settings in the admin portal](https://manage.securepractice.co/settings/security). Generate a new key pair with description `Microsoft Sentinel`."

          }
        ]
      },
      "instructionSteps": [
        {
          "title": "1. Obtain Secure Practice API Credentials",
          "description": "Log in to your Secure Practice account and generate an API Key and API Secret if you haven't already."
        },
        {
          "title": "2. Connect to MailRisk API",
          "description": "Enter your Secure Practice API credentials below. The credentials will be securely stored and used to authenticate API requests.",
          "instructions": [
            {
              "type": "Textbox",
              "parameters": {
                "label": "API Key",
                "placeholder": "Enter your Secure Practice API Key",
                "type": "text",
                "name": "apiKey"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "API Secret",
                "placeholder": "Enter your Secure Practice API Secret",
                "type": "password",
                "name": "apiSecret"
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "connectLabel": "Connect",
                "disconnectLabel": "Disconnect"
              }
            }
          ]
        }
      ]
    }
  }
}