{
  "apiVersion": "2023-04-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "name": "FieldEffectCCF",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "FieldEffectCCF",
      "title": "Field Effect MDR Data Connector (via Codeless Connector Framework)",
      "publisher": "Field Effect",
      "descriptionMarkdown": "This solution enables Microsoft Sentinel to ingest Field Effect MDR data using the Codeless Connector Framework (CCF). The connector polls the Field Effect ARO API and sends results to a Log Analytics custom table for hunting, correlation, and alerting within Sentinel.",
      "graphQueriesTableName": "FieldEffectAROAlerts_CL",
      "graphQueries": [
        {
          "metricName": "AROs received",
          "legend": "Field Effect ARO alerts",
          "baseQuery": "{{graphQueriesTableName}}"
        }
      ],
      "sampleQueries": [
        {
          "description": "Review Field Effect AROs",
          "query": "{{graphQueriesTableName}} | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "{{graphQueriesTableName}}",
          "lastDataReceivedQuery": "{{graphQueriesTableName}} | summarize Time = max(TimeGenerated) | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "isPreview": true
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true
            }
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Configure Field Effect Connector",
          "description": "1. In the Field Effect MDR portal, generate an API Key. \n2. Copy your Organization ID from the portal. \n3. Enter both values below and connect.",
          "instructions": [
            {
              "type": "Textbox",
              "parameters": {
                "label": "API Key",
                "placeholder": "Enter your Field Effect API Key",
                "type": "password",
                "name": "bearerToken"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Organization ID",
                "placeholder": "Enter your Field Effect Organization ID",
                "type": "text",
                "name": "organizationId"
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "connectLabel": "Connect to Field Effect",
                "name": "toggle"
              }
            }
          ]
        }
      ]
    }
  }
}