{
  "name": "IllumioInsightsGraphCCP",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "availability": {
    "isPreview": true
  },
  "properties": {
    "connectorUiConfig": {
      "id": "SentinelIllumioInsightsGraphCCP",
      "title": "Illumio Insights Graph",
      "publisher": "Illumio",
      "descriptionMarkdown": "The Illumio Insights Graph connector Publishes AI-powered threat discovery and anomaly reports generated by the Illumio Insights Agent. Leveraging the MITRE ATT&CK framework, these reports surface high-fidelity insights into emerging threats and risky behaviors, directly into the Data Lake.",
      "graphQueriesTableName": "IllumioInsightsGraph",
      "graphQueries": [
        {
          "metricName": "Total reports received",
          "legend": "Illumio Insights Graph Reports",
          "baseQuery": "{{graphQueriesTableName}}"
        },
        {
          "metricName": "Threat Hunter reports",
          "legend": "Threat Hunter Reports",
          "baseQuery": "{{graphQueriesTableName}} | where Persona == \"threat_hunter\""
        },
        {
          "metricName": "Compliance Manager reports",
          "legend": "Compliance Manager Reports",
          "baseQuery": "{{graphQueriesTableName}} | where Persona == \"compliance_manager\""
        }
      ],
      "sampleQueries": [
        {
          "description": "All Illumio insights graph reports",
          "query": "{{graphQueriesTableName}}\n| sort by TimeGenerated desc"
        },
        {
          "description": "Get sample of Illumio insights graph reports",
          "query": "{{graphQueriesTableName}}\n| take 10"
        },
        {
          "description": "Summary by persona type",
          "query": "{{graphQueriesTableName}}\n| summarize count() by Persona"
        }
      ],
      "dataTypes": [
        {
          "name": "IllumioInsightsGraph_CL",
          "lastDataReceivedQuery": "IllumioInsightsGraph_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true
            }
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "1. Configuration",
          "description": "Configure the Illumio Insights Graph connector.",
          "instructions": [

            {
              "type": "Markdown",
              "parameters": {
                "content": "> This data connector may take 24 hrs for the latest report after onboarding"
              }
            },
            {
                "type": "Markdown",
                "parameters": {
                                "content": "#### Configuration steps for the Illumio Insights Graph Connector\n\n**Prerequisites**\n- Register and Login to Illumio Console with valid credentials\n- Purchase Illumio Insights or Start a free Trial for Illumio Insights\n- Enable The Illumio Insights Agent\n\n**Step 1: Register the Service Account**\n1. Go to **Illumio Console → Access → Service Accounts**\n2. Create a service account for the tenant\n3. Once you create a service account, you will receive the client credentials\n4. Copy the **auth_username** (Illumio Insights API Key) and the **Secret** (API Secret)\n\n**Step 2: Add Client Credentials to Sentinel Account**\n- Add the API key and secret to Sentinel Account for tenant authentication\n- These credentials will be used to authenticate calls to the Illumio SaaS API \n\nPlease fill in the required fields below with the credentials obtained from the Illumio Console:"
                            }
                        },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Illumio Insights Api Key",
                "placeholder": "api_XXXXXX",
                "type": "password",
                "name": "apiKey"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Api Secret",
                "placeholder": "API Secret",
                "type": "password",
                "name": "apiToken"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Illumio Tenant ID",
                "placeholder": "{IllumioTenantId - Optional}",
                "type": "text",
                "name": "illumioTenantId"
              }
            }
          ]
        },
        {
          "title": "2. Connect",
          "description": "Enable the Illumio Insights Graph connector.",
          "instructions": [
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "connectLabel": "Connect",
                "disconnectLabel": "Disconnect",
                "name": "toggle"
              }
            }
          ]
        }
      ]
    }
  }
}