{
    "name": "ZimperiumMTDPush",
    "apiVersion": "2022-09-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "[parameters('workspace-location')]",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "ZimperiumMTDPush",
            "title": "Zimperium Mobile Threat Defense CCF",
            "publisher": "Zimperium",
            "descriptionMarkdown": "Zimperium Mobile Threat Defense connector gives you the ability to connect the Zimperium threat log with Microsoft Sentinel to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization's mobile threat landscape and enhances your security operation capabilities.",
            "graphQueries": [
                {
                    "metricName": "Threats",
                    "legend": "ZimperiumThreatLogV2_CL",
                    "baseQuery": "ZimperiumThreatLogV2_CL"
                },
                {
                    "metricName": "Mitigations",
                    "legend": "ZimperiumMitigationLogV2_CL",
                    "baseQuery": "ZimperiumMitigationLogV2_CL"
                },
                {
                    "metricName": "Incidents",
                    "legend": "ZimperiumIncidentLog_CL",
                    "baseQuery": "ZimperiumIncidentLog_CL"
                },
                {
                    "metricName": "Incident Mitigations",
                    "legend": "ZimperiumIncidentMitigationLog_CL",
                    "baseQuery": "ZimperiumIncidentMitigationLog_CL"
                }
            ],
            "sampleQueries": [
                {
                    "description" : "All threats with threat vector equal to Device",
                    "query": "ZimperiumThreatLogV2_CL\n | where threat_vector == \"Device\" \n | order by TimeGenerated desc | limit 100"
                },
                {
                    "description" : "All threats for devices running iOS",
                    "query": "ZimperiumThreatLogV2_CL\n | where device_os == \"ios\" \n | order by TimeGenerated desc nulls last"
                },
                {
                    "description" : "View latest mitigations",
                    "query": "ZimperiumMitigationLogV2_CL\n | order by TimeGenerated desc nulls last"
                }
            ],
            "dataTypes": [
                {
                    "name": "ZimperiumThreatLogV2_CL",
                    "lastDataReceivedQuery": "ZimperiumThreatLogV2_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                },
                {
                    "name": "ZimperiumMitigationLogV2_CL",
                    "lastDataReceivedQuery": "ZimperiumMitigationLogV2_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                },
                {
                    "name": "ZimperiumIncidentLog_CL",
                    "lastDataReceivedQuery": "ZimperiumIncidentLog_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                },
                {
                    "name": "ZimperiumIncidentMitigationLog_CL",
                    "lastDataReceivedQuery": "ZimperiumIncidentMitigationLog_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                }            
            ],
            "connectivityCriteria": [
                {
                    "type": "IsConnectedQuery",
                    "value": [
                        "ZimperiumThreatLogV2_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)"
                    ]
                }
            ],
            "availability": {
                "status": 1
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "read and write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "write": true,
                            "read": true,
                            "delete": true
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "Microsoft Entra",
                        "description": "Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher."
                    },
                    {
                        "name": "Microsoft Azure",
                        "description": "Permission to assign Monitoring Metrics Publisher role on data collection rule (DCR). Typically requires Azure RBAC Owner or User Access Administrator role."
                    }
                ]
            },
            "instructionSteps": [
                {
                    "title": "1. Create ARM Resources and Provide the Required Permissions",
                    "description": "This connector enables your Zimperium MTD application to push device threats directly to Microsoft Sentinel via the Azure Monitor Ingestion API.",
                    "instructions": [
                        {
                            "type": "Markdown",
                            "parameters": {
                                "content": "#### Automated Configuration and Secure Data Ingestion with Entra Application \nClicking on \"Deploy\" will trigger the creation of a Log Analytics table and a Data Collection Rule (DCR). \nIt will then create an Entra application, link the DCR to it, and set the entered secret in the application. This setup enables data to be sent securely to the DCR using an Entra token."
                            }
                        },
                        {
                            "type": "DeployPushConnectorButton",
                            "parameters": {
                                "label": "Deploy Zimperium MTD Push connector resources",
                                "applicationDisplayName": "Zimperium MTD Push Connector Application"
                            }
                        }
                    ]
                },
                {
                    "title": "2. Configure and connect Zimperium MTD",
                    "description": "1. In zConsole, click **Account Management** on the navigation bar.\n2. Click the **Data Export** side tab.\n3. Click the **Add Data Export Configuration** button.\n4. Create the Configuration:\n    - **Name:** Name to describe this configuration.\n    - **Description:** Description to describe this configuration.\n    - **Data Type:** Select datatype as _Threats_ or _Incidents_ depending on the data you want to export.\n    - **Destination Type:** From the available destination types, select Microsoft Sentinel.\n    - **Severity Criteria:** Select a Filter Level for the threat data you wish to push to Microsoft Sentinel.(**Note:** This field is applicable only for _threats_ datatype)\n    - **Team Criteria:** This is an optional criterion to filter data based on teams.\n   - **External Tracking Id 1:** This is an optional criterion to match for exported data.\n    - **External Tracking Id 2:** This is an optional criterion to match for exported data.\n    - **Tenant Id:** Enter from the fields below.\n    - **Entra App Registration Application ID:** Enter from the fields below.\n    - **Entra App Registration Secret:** Enter from the fields below.\n    - **Data Collection Endpoint Uri:** Enter from the fields below.\n    - **Data Collection Rule Immutable ID:** Enter from the fields below.\n    - Click **Save Configuration**.\n5. For additional instructions, please refer to the [Zimperium customer support portal](https://support.zimperium.com).",
                    "instructions": [
                        {
                            "type": "CopyableLabel",
                            "parameters": {
                                "label": "Tenant ID (Directory ID)",
                                "fillWith": [
                                    "TenantId"
                                ]
                            }
                        },
                        {
                            "type": "CopyableLabel",
                            "parameters": {
                                "label": "Entra App Registration Application ID",
                                "fillWith": [
                                    "ApplicationId"
                                ],
                                "placeholder": "Deploy push connector to get the App Registration Application ID"
                            }
                        },
                        {
                            "type": "CopyableLabel",
                            "parameters": {
                                "label": "Entra App Registration Secret",
                                "fillWith": [
                                    "ApplicationSecret"
                                ],
                                "placeholder": "Deploy push connector to get the App Registration Secret"
                            }
                        },
                        {
                            "type": "CopyableLabel",
                            "parameters": {
                                "label": "Data Collection Endpoint Uri",
                                "fillWith": [
                                    "DataCollectionEndpoint"
                                ],
                                "placeholder": "Deploy push connector to get the Data Collection Endpoint Uri"
                            }
                        },
                        {
                            "type": "CopyableLabel",
                            "parameters": {
                                "label": "Data Collection Rule Immutable ID",
                                "fillWith": [
                                    "DataCollectionRuleId"
                                ],
                                "placeholder": "Deploy push connector to get the Data Collection Rule Immutable ID"
                            }
                        }
                    ]
                }
            ]
        }
    }
}