{
    "name": "ProofpointTAPv2",
    "apiVersion": "2022-09-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "ProofpointTAPv2",
            "title": "Proofpoint TAP (via Codeless Connector Platform)",
            "publisher": "Proofpoint",
            "descriptionMarkdown": "The [Proofpoint Targeted Attack Protection (TAP)](https://www.proofpoint.com/us/products/advanced-threat-protection/targeted-attack-protection) connector provides the capability to ingest Proofpoint TAP logs and events into Microsoft Sentinel. The connector provides visibility into Message and Click events in Microsoft Sentinel to view dashboards, create custom alerts, and to improve monitoring and investigation capabilities.",
            "graphQueries": [
                {
                    "metricName": "Total data received",
                    "legend": "Proofpoint TAP Messages Delivered",
                    "baseQuery": "ProofPointTAPMessagesDeliveredV2_CL"
                },
                {
                    "metricName": "Total data received",
                    "legend": "Proofpoint TAP Messages Blocked",
                    "baseQuery": "ProofPointTAPMessagesBlockedV2_CL"
                },
                {
                    "metricName": "Total data received",
                    "legend": "Proofpoint TAP Clicks Permitted",
                    "baseQuery": "ProofPointTAPClicksPermittedV2_CL"
                },
                {
                    "metricName": "Total data received",
                    "legend": "Proofpoint TAP Clicks Blocked",
                    "baseQuery": "ProofPointTAPClicksBlockedV2_CL"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Malware click events permitted",
                    "query": "ProofPointTAPClicksPermittedV2_CL\n | where classification_s == \"malware\" \n | take 10"
                },
                {
                    "description": "Phishing click events blocked",
                    "query": "ProofPointTAPClicksBlockedV2_CL\n | where classification_s == \"phish\" \n | take 10"
                },
                {
                    "description": "Malware messages events delivered",
                    "query": "ProofPointTAPMessagesDeliveredV2_CL\n | mv-expand todynamic(threatsInfoMap_s)\n | extend classification = tostring(threatsInfoMap_s.classification)\n | where classification == \"malware\" \n | take 10"
                },
                {
                    "description": "Phishing message events blocked",
                    "query": "ProofPointTAPMessagesBlockedV2_CL\n | mv-expand todynamic(threatsInfoMap_s)\n | extend classification = tostring(threatsInfoMap_s.classification)\n | where classification == \"phish\""
                }
            ],
            "dataTypes": [
                {
                    "name": "ProofPointTAPClicksPermittedV2_CL",
                    "lastDataReceivedQuery": "ProofPointTAPClicksPermittedV2_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "ProofPointTAPClicksBlockedV2_CL",
                    "lastDataReceivedQuery": "ProofPointTAPClicksBlockedV2_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "ProofPointTAPMessagesDeliveredV2_CL",
                    "lastDataReceivedQuery": "ProofPointTAPMessagesDeliveredV2_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                },
                {
                    "name": "ProofPointTAPMessagesBlockedV2_CL",
                    "lastDataReceivedQuery": "ProofPointTAPMessagesBlockedV2_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "availability": {
                "status": 1,
                "isPreview": false
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "read and write permissions on the workspace are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "write": true,
                            "read": true,
                            "delete": true
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "Proofpoint TAP API Key",
                        "description": "A Proofpoint TAP API service principal and secret is required to access Proofpoint's SIEM API. [See the documentation to learn more about Proofpoint SIEM API](https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/SIEM_API)."
                    }
                ]
            },
            "instructionSteps": [
                {
                    "description": "**Configuration steps for the Proofpoint TAP API**\n\n1. Log into the [Proofpoint TAP dashboard](https://threatinsight.proofpoint.com/) \n2. Navigate to **Settings** and go to **Connected Applications** tab \n 3. Click on **Create New Credential** \n 4. Provide a name and click **Generate** \n 5. Copy **Service Principal** and **Secret** values"
                },
                {
                    "description": ">**NOTE:** This connector depends on a parser based on Kusto Function to work as expected [**ProofpointTAPEvent**](https://aka.ms/sentinel-ProofpointTAPDataConnector-parser) which is deployed with the Microsoft Sentinel Solution."
                },
                {
                    "instructions": [
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Service Principal",
                                "placeholder": "123456",
                                "type": "text",
                                "name": "username"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Secret",
                                "placeholder": "123456",
                                "type": "password",
                                "name": "password"
                            }
                        },
                        {
                            "type": "ConnectionToggleButton",
                            "parameters": {
                                "connectLabel": "Connect",
                                "disconnectLabel": "Disconnect",
                                "name": "connectionToggle"
                            }
                        }
                    ]
                }
            ]
        }
    }
}