{
  "name": "RedCanary_ConnectorDefinition",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "RedCanary_ConnectorDefinition",
      "title": "Red Canary Threat Detection (via Codeless Connector Framework)",
      "publisher": "Red Canary",
      "descriptionMarkdown": "The [Red Canary](https://www.redcanary.com/) data connector enables Red Canary to publish detections into Microsoft Sentinel using the Codeless Connector Framework push pattern and the Azure Monitor Logs Ingestion API.",
      "graphQueries": [
        {
          "metricName": "Red Canary Detections",
          "legend": "RedCanaryDetections_CL",
          "baseQuery": "RedCanaryDetections_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "All Red Canary Detections",
          "query": "RedCanaryDetections_CL\n| sort by TimeGenerated desc"
        },
        {
          "description": "Red Canary Detections by severity",
          "query": "RedCanaryDetections_CL\n| summarize Detections = count() by detection_severity_s\n| sort by Detections desc"
        }
      ],
      "dataTypes": [
        {
          "name": "RedCanaryDetections_CL",
          "lastDataReceivedQuery": "RedCanaryDetections_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "IsConnectedQuery",
          "value": [
            "RedCanaryDetections_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)"
          ]
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": true
            }
          }
        ],
        "customs": [
          {
            "name": "Microsoft Entra",
            "description": "Permission to create an app registration in Microsoft Entra ID. Typically requires the Application Developer role or higher."
          },
          {
            "name": "Microsoft Azure",
            "description": "Permission to assign the Monitoring Metrics Publisher role on the data collection rule. Typically requires Azure RBAC Owner or User Access Administrator."
          },
          {
            "name": "Red Canary",
            "description": "Access to configure the Microsoft Sentinel response action in Red Canary."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "1. Create connector resources",
          "description": "Deploy the CCF push resources required for Red Canary detection ingestion.",
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### Automated configuration and secure data ingestion\nClicking **Deploy** creates the Log Analytics table, Data Collection Rule (DCR), Data Collection Endpoint (DCE), Microsoft Entra application, application secret, and role assignment required to ingest Red Canary detections through the Azure Monitor Logs Ingestion API."
              }
            },
            {
              "type": "DeployPushConnectorButton",
              "parameters": {
                "label": "Deploy Red Canary connector resources",
                "applicationDisplayName": "Red Canary Microsoft Sentinel Connector"
              }
            }
          ]
        },
        {
          "title": "2. Configure Red Canary",
          "description": "Use the generated values to configure Red Canary to send detections to this Microsoft Sentinel workspace.",
          "instructions": [
            {
              "type": "CopyableLabel",
              "parameters": {
                "label": "Tenant ID (Directory ID)",
                "fillWith": [
                  "TenantId"
                ]
              }
            },
            {
              "type": "CopyableLabel",
              "parameters": {
                "label": "Entra App Registration Application ID",
                "fillWith": [
                  "ApplicationId"
                ],
                "placeholder": "Deploy the connector to get the Application ID"
              }
            },
            {
              "type": "CopyableLabel",
              "parameters": {
                "label": "Entra App Registration Secret",
                "fillWith": [
                  "ApplicationSecret"
                ],
                "placeholder": "Deploy the connector to get the application secret"
              }
            },
            {
              "type": "CopyableLabel",
              "parameters": {
                "label": "Data Collection Endpoint URI",
                "fillWith": [
                  "DataCollectionEndpoint"
                ],
                "placeholder": "Deploy the connector to get the Data Collection Endpoint URI"
              }
            },
            {
              "type": "CopyableLabel",
              "parameters": {
                "label": "Data Collection Rule Immutable ID",
                "fillWith": [
                  "DataCollectionRuleId"
                ],
                "placeholder": "Deploy the connector to get the Data Collection Rule Immutable ID"
              }
            },
            {
              "type": "CopyableLabel",
              "parameters": {
                "label": "Detections Stream Name",
                "value": "Custom-RedCanaryDetections"
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "Configure the Red Canary Microsoft Sentinel response action with the values above. Red Canary should post detection records to the Logs Ingestion API endpoint using the stream name `Custom-RedCanaryDetections`."
              }
            }
          ]
        }
      ]
    }
  }
}