{
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "apiVersion": "2022-09-01-preview",
    "name": "PaloAltoPrismaCloudCSPMCCPDefinition",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "PaloAltoPrismaCloudCSPMCCPDefinition",
            "title": "Palo Alto Prisma Cloud CSPM (via Codeless Connector Framework)",
            "publisher": "Microsoft",
            "descriptionMarkdown": "The Palo Alto Prisma Cloud CSPM data connector allows you to connect to your Palo Alto Prisma Cloud CSPM instance and ingesting Alerts (https://pan.dev/prisma-cloud/api/cspm/alerts/) & Audit Logs(https://pan.dev/prisma-cloud/api/cspm/audit-logs/) into Microsoft Sentinel.",
            "graphQueriesTableName": "PaloAltoPrismaCloudAlertV2_CL",
            "graphQueries": [
                {
                    "metricName": "Total Alerts received",
                    "legend": "Prisma Alert ",
                    "baseQuery": "{{graphQueriesTableName}}"
                },
                {
                    "metricName": "Total Audit received",
                    "legend": "Prisma Audit ",
                    "baseQuery": "PaloAltoPrismaCloudAuditV2_CL"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Get Sample of Prisma Alerts Events",
                    "query": "{{graphQueriesTableName}}\n | take 10"
                },
                {
                    "description": "Get Sample of Prisma Alerts Events",
                    "query": "PaloAltoPrismaCloudAuditV2_CL\n | take 10"
                }
            ],
            "dataTypes": [
                {
                    "name": "{{graphQueriesTableName}}",
                    "lastDataReceivedQuery": "{{graphQueriesTableName}}\n   | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "PaloAltoPrismaCloudAuditV2_CL",
                    "lastDataReceivedQuery": "PaloAltoPrismaCloudAuditV2_CL\n   | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "availability": {
                "isPreview": false
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "write": true,
                            "read": true,
                            "delete": true
                        }
                    },
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                        "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)",
                        "providerDisplayName": "Keys",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "action": true
                        }
                    }
                ]
            },
            "instructionSteps": [
                {
                    "description": "To get more information on how to obtain the Prisma Cloud Access Key, Secret Key, and Base URL, please refer to the[connector tutorial](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoPrismaCloud/Data%20Connectors/Readme.md), provide the required information below and click on Connect.\n>",
                    "instructions": [
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Prisma Cloud Access Key",
                                "placeholder": "Enter Access Key",
                                "type": "text",
                                "name": "username"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Prisma Cloud Secret Key",
                                "placeholder": "Enter Secret Key",
                                "type": "password",
                                "name": "password"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Prisma Cloud Base URL",
                                "placeholder": "https://api2.eu.prismacloud.io",
                                "type": "text",
                                "name": "baseurl"
                            }
                        },
                        {
                            "parameters": {
                                "label": "toggle",
                                "name": "toggle"
                            },
                            "type": "ConnectionToggleButton"
                        },
                        {
                            "type": "DataConnectorsGrid",
                            "parameters": {
                                "mapping": [
                                    {
                                        "columnName": "PaloAltoPrismaCloudCSPM Api Endpoints",
                                        "columnValue": "properties.request.apiEndpoint"
                                    }
                                ]
                            }
                        }
                    ],
                    "title": "Connect Palo Alto Prisma Cloud CSPM Events to Microsoft Sentinel"
                }
            ]
        }
    }
}