{
    "id": "Datalake2SentinelConnector",
    "title": "Datalake2Sentinel",
    "publisher": "Orange Cyberdefense",
    "descriptionMarkdown": "This solution installs the Datalake2Sentinel connector which is built using the Codeless Connector Platform and allows you to automatically ingest threat intelligence indicators from **Datalake Orange Cyberdefense's CTI platform** into Microsoft Sentinel via the Upload Indicators REST API. After installing the solution, configure and enable this data connector by following guidance in Manage solution view.",
    "graphQueries": [
        {
            "metricName": "Total indicators received",
            "legend": "Connection Events",
            "baseQuery": "ThreatIntelligenceIndicator | where SourceSystem == 'Datalake - OrangeCyberdefense'"
        }
    ],
    "sampleQueries": [
        {
            "description": "All Threat Intelligence APIs Indicators",
            "query": "ThreatIntelligenceIndicator | where SourceSystem == 'Datalake - OrangeCyberdefense'| sort by TimeGenerated desc"
        }
    ],
    "dataTypes": [
        {
            "name": "ThreatIntelligenceIndicator",
            "lastDataReceivedQuery": "ThreatIntelligenceIndicator| where isnotempty(TimeGenerated) and SourceSystem == 'Datalake - OrangeCyberdefense' | summarize Time = max(TimeGenerated)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "ThreatIntelligenceIndicator| where SourceSystem == 'Datalake - OrangeCyberdefense' | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "Read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Installation and setup instructions",
            "description": "Use the documentation from this Github repository to install and configure the Datalake to Microsoft Sentinel connector. \n\nhttps://github.com/cert-orangecyberdefense/datalake2sentinel"
        }
    ]
}