PingOneAuditLogs__PollingConfig.json

[
  {
    "type": "Microsoft.SecurityInsights/dataConnectors",
    "apiVersion": "2025-03-01",
    "name": "{{innerWorkspace}}/Microsoft.SecurityInsights/PingOneAuditActivitiesPoller_{{environmentId}}",
    "kind": "RestApiPoller",
    "properties": {
        "connectorDefinitionName": "PingOneAuditLogsCCPDefinition",
        "dataType": "PingOne_AuditActivitiesV2_CL",
        "addOnAttributes": {
        "EnvironmentId": "[[parameters('environmentId')]"
      },
        "auth":  {
            "type": "OAuth2",
            "ClientId": "[[parameters('clientId')]",
            "ClientSecret": "[[parameters('clientSecret')]",
            "grantType": "client_credentials",
            "tokenEndpoint": "[[concat('https://auth.',parameters('apidomain'),'/',parameters('environmentId'),'/as/token')]",
            "tokenEndpointHeaders": {
              "Content-Type": "application/x-www-form-urlencoded"
            }
          },
        "request": {
            "apiEndpoint": "[[concat('https://api.', parameters('apidomain'), '/v1/environments/', parameters('environmentId'), '/activities')]",
            "httpMethod": "GET",
            "queryWindowInMin": 10,
            "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",     
            "headers": {
                    "Accept": "application/json",
                    "User-Agent": "Scuba"
            },
           "queryParameters": {
    "filter": "recordedat gt \"{_QueryWindowStartTime}\" and recordedat lt \"{_QueryWindowEndTime}\""
  }
        },
        "response": {
      "eventsJsonPaths": [
        "$._embedded.activities"
      ],
      "format": "json"
    },
        "dcrConfig": {
            "streamName": "Custom-PingOne_AuditActivitiesV2_CL",
            "dataCollectionEndpoint": "{{dataCollectionEndpoint}}",
            "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}"
        },
        "paging": {
      "pagingType": "LinkHeader",
      "linkHeaderTokenJsonPath": "$._links.next.href"
    }
    }
}
]