{
    "definition": {
        "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
        "contentVersion": "1.0.0.0",
        "triggers": {
            "HTTP_Request": {
                "type": "Request",
                "kind": "Http",
                "inputs": {
                    "schema": {
                        "type": "object",
                        "properties": {
                            "urls": {
                                "type": "array"
                            },
                            "incidentId": {
                                "type": "string"
                            }
                        }
                    }
                }
            }
        },
        "actions": {
            "Initialize_NSURLResults": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "NSURLResults",
                            "type": "array",
                            "value": []
                        }
                    ]
                }
            },
            "Initialize_NSURLTableHTML": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "NSURLTableHTML",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Initialize_NSClickResults": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "NSClickResults",
                            "type": "array",
                            "value": []
                        }
                    ]
                }
            },
            "Initialize_NSClickTableHTML": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "NSClickTableHTML",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Initialize_KQLSectionHTML": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "KQLSectionHTML",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Condition_ValidateKey": {
                "actions": {
                    "For_each_URL_NS_Lookup": {
                        "foreach": "@triggerBody()?['urls']",
                        "actions": {
                            "Compose_URL_Host": {
                                "type": "Compose",
                                "inputs": "@toLower(split(if(contains(item()?['Url'], '://'), split(split(item()?['Url'], '://')[1], '/')[0], split(item()?['Url'], '/')[0]), ':')[0])"
                            },
                            "Compose_URL_IsExcluded": {
                                "runAfter": {
                                    "Compose_URL_Host": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "Compose",
                                "inputs": "@or(contains(parameters('ExcludedDomains'), toLower(split(if(contains(item()?['Url'], '://'), split(split(item()?['Url'], '://')[1], '/')[0], split(item()?['Url'], '/')[0]), ':')[0])), contains(parameters('ExcludedDomains'), concat('*.', last(skip(split(toLower(split(if(contains(item()?['Url'], '://'), split(split(item()?['Url'], '://')[1], '/')[0], split(item()?['Url'], '/')[0]), ':')[0]), '.'), sub(length(split(toLower(split(if(contains(item()?['Url'], '://'), split(split(item()?['Url'], '://')[1], '/')[0], split(item()?['Url'], '/')[0]), ':')[0]), '.')), 2))))), contains(parameters('ExcludedDomains'), concat('*.', join(skip(split(toLower(split(if(contains(item()?['Url'], '://'), split(split(item()?['Url'], '://')[1], '/')[0], split(item()?['Url'], '/')[0]), ':')[0]), '.'), 1), '.'))))"
                            },
                            "Condition_URL_Not_Excluded": {
                                "actions": {
                                    "NS_URL_Lookup": {
                                        "type": "Http",
                                        "inputs": {
                                            "uri": "https://<NETSKOPE-TENANT>.goskope.com/api/v2/nsiq/urllookup",
                                            "method": "POST",
                                            "headers": {
                                                "Authorization": "@concat('Bearer ', parameters('NetskopeApiToken'))",
                                                "Content-Type": "application/json"
                                            },
                                            "body": {
                                                "query": {
                                                    "urls": [
                                                        "@{item()?['Url']}"
                                                    ],
                                                    "category": "swg",
                                                    "disable_dns_lookup": false
                                                }
                                            },
                                            "runtimeConfiguration": {
                                                "contentTransfer": {
                                                    "transferMode": "Chunked"
                                                }
                                            }
                                        }
                                    },
                                    "Run_URL_Click_KQL": {
                                        "type": "ApiConnection",
                                        "inputs": {
                                            "host": {
                                                "connection": {
                                                    "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                                }
                                            },
                                            "method": "post",
                                            "body": "@concat('UrlClickEvents | where TimeGenerated > ago(30d) | where Url has \"', item()?['Url'], '\" or Url startswith \"', item()?['Url'], '\" | project TimeGenerated, Url, ActionType, AccountUpn, NetworkMessageId, IPAddress, IsClickedThrough, Workload, UrlChain | order by TimeGenerated desc | take 25')",
                                            "path": "/queryData",
                                            "queries": {
                                                "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                                "resourcegroups": "<RESOURCE-GROUP>",
                                                "resourcetype": "Log Analytics Workspace",
                                                "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                                "timerange": "30d"
                                            }
                                        }
                                    },
                                    "Run_URL_Network_KQL": {
                                        "type": "ApiConnection",
                                        "inputs": {
                                            "host": {
                                                "connection": {
                                                    "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                                }
                                            },
                                            "method": "post",
                                            "body": "@concat('DeviceNetworkEvents | where TimeGenerated > ago(30d) | where RemoteUrl has \"', item()?['Url'], '\" or RemoteUrl startswith \"', item()?['Url'], '\" | project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, RemotePort, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName | order by TimeGenerated desc | take 25')",
                                            "path": "/queryData",
                                            "queries": {
                                                "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                                "resourcegroups": "<RESOURCE-GROUP>",
                                                "resourcetype": "Log Analytics Workspace",
                                                "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                                "timerange": "30d"
                                            }
                                        }
                                    },
                                    "Compose_NS_First_Result": {
                                        "runAfter": {
                                            "NS_URL_Lookup": [
                                                "Succeeded",
                                                "Failed",
                                                "TimedOut"
                                            ]
                                        },
                                        "type": "Compose",
                                        "inputs": "@coalesce(body('NS_URL_Lookup')?['result']?[0], createObject('url', '', 'categories', json('[]'), 'url_lists', json('[]'), 'dynamic_classification', false, 'site', '', 'app', ''))"
                                    },
                                    "Compose_NS_Categories_String": {
                                        "runAfter": {
                                            "Compose_NS_First_Result": [
                                                "Succeeded"
                                            ]
                                        },
                                        "type": "Compose",
                                        "inputs": "@{join(body('NS_URL_Lookup')?['result']?[0]?['categories'], ', ')}"
                                    },
                                    "Compose_NS_Predefined_Category": {
                                        "runAfter": {
                                            "Compose_NS_First_Result": [
                                                "Succeeded"
                                            ]
                                        },
                                        "type": "Compose",
                                        "inputs": "@{if(greater(length(coalesce(body('NS_URL_Lookup')?['result']?[0]?['categories'], json('[]'))), 0), body('NS_URL_Lookup')?['result']?[0]?['categories']?[0]?['name'], 'Unknown')}"
                                    },
                                    "Compose_NS_URL_Lists_String": {
                                        "runAfter": {
                                            "Compose_NS_First_Result": [
                                                "Succeeded"
                                            ]
                                        },
                                        "type": "Compose",
                                        "inputs": "@{if(greater(length(coalesce(body('NS_URL_Lookup')?['result']?[0]?['url_lists'], json('[]'))), 0), join(body('NS_URL_Lookup')?['result']?[0]?['url_lists'], ', '), 'None')}"
                                    },
                                    "Append_NS_URL_Result": {
                                        "runAfter": {
                                            "Compose_NS_Categories_String": [
                                                "Succeeded"
                                            ],
                                            "Compose_NS_Predefined_Category": [
                                                "Succeeded"
                                            ],
                                            "Compose_NS_URL_Lists_String": [
                                                "Succeeded"
                                            ]
                                        },
                                        "type": "AppendToArrayVariable",
                                        "inputs": {
                                            "name": "NSURLResults",
                                            "value": {
                                                "url": "@item()?['Url']",
                                                "host": "@outputs('Compose_URL_Host')",
                                                "excluded": false,
                                                "site": "@coalesce(outputs('Compose_NS_First_Result')?['site'], 'Unknown')",
                                                "app": "@coalesce(outputs('Compose_NS_First_Result')?['app'], '')",
                                                "primaryCategory": "@outputs('Compose_NS_Predefined_Category')",
                                                "allCategories": "@outputs('Compose_NS_Categories_String')",
                                                "urlLists": "@outputs('Compose_NS_URL_Lists_String')",
                                                "dynamicClassification": "@string(coalesce(outputs('Compose_NS_First_Result')?['dynamic_classification'], false))",
                                                "lookupSuccess": "@if(equals(string(body('NS_URL_Lookup')?['status']), 'success'), true, false)"
                                            }
                                        }
                                    },
                                    "Append_NS_URL_HTML_Row": {
                                        "runAfter": {
                                            "Append_NS_URL_Result": [
                                                "Succeeded"
                                            ]
                                        },
                                        "type": "AppendToStringVariable",
                                        "inputs": {
                                            "name": "NSURLTableHTML",
                                            "value": "@concat('<tr style=\"background:#f9f9f9\"><td style=\"padding:6px 10px;border:1px solid #ddd;word-break:break-all;max-width:300px\">', item()?['Url'], '</td><td style=\"padding:6px 10px;border:1px solid #ddd\">', coalesce(outputs('Compose_NS_First_Result')?['site'], 'Unknown'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-weight:bold;color:', if(or(contains(toLower(outputs('Compose_NS_Predefined_Category')), 'malware'), contains(toLower(outputs('Compose_NS_Predefined_Category')), 'phishing'), contains(toLower(outputs('Compose_NS_Predefined_Category')), 'command'), contains(toLower(outputs('Compose_NS_Predefined_Category')), 'botnet')), 'red', '#333'), '\">', outputs('Compose_NS_Predefined_Category'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px;color:#555\">', outputs('Compose_NS_Categories_String'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px;color:', if(equals(outputs('Compose_NS_URL_Lists_String'), 'None'), '#888', '#c0392b'), ';font-weight:', if(equals(outputs('Compose_NS_URL_Lists_String'), 'None'), 'normal', 'bold'), '\">', outputs('Compose_NS_URL_Lists_String'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-size:11px\">', if(equals(string(coalesce(outputs('Compose_NS_First_Result')?['dynamic_classification'], false)), 'true'), '<span style=\"color:orange\">Dynamic</span>', '<span style=\"color:#888\">Static</span>'), '</td></tr>')"
                                        }
                                    },
                                    "Append_NS_Click_Result": {
                                        "runAfter": {
                                            "Run_URL_Click_KQL": [
                                                "Succeeded",
                                                "Failed",
                                                "TimedOut"
                                            ],
                                            "Run_URL_Network_KQL": [
                                                "Succeeded",
                                                "Failed",
                                                "TimedOut"
                                            ]
                                        },
                                        "type": "AppendToArrayVariable",
                                        "inputs": {
                                            "name": "NSClickResults",
                                            "value": {
                                                "url": "@item()?['Url']",
                                                "host": "@outputs('Compose_URL_Host')",
                                                "excluded": false,
                                                "emailClickEvents": "@coalesce(body('Run_URL_Click_KQL')?['value'], json('[]'))",
                                                "emailClickCount": "@length(coalesce(body('Run_URL_Click_KQL')?['value'], json('[]')))",
                                                "networkEvents": "@coalesce(body('Run_URL_Network_KQL')?['value'], json('[]'))",
                                                "networkEventCount": "@length(coalesce(body('Run_URL_Network_KQL')?['value'], json('[]')))"
                                            }
                                        }
                                    },
                                    "Append_NS_Click_HTML_Row": {
                                        "runAfter": {
                                            "Append_NS_Click_Result": [
                                                "Succeeded"
                                            ]
                                        },
                                        "type": "AppendToStringVariable",
                                        "inputs": {
                                            "name": "NSClickTableHTML",
                                            "value": "@concat('<tr style=\"background:#f9f9f9\"><td style=\"padding:6px 10px;border:1px solid #ddd;word-break:break-all;max-width:280px;font-family:monospace;font-size:11px\">', item()?['Url'], '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(length(coalesce(body('Run_URL_Click_KQL')?['value'], json('[]'))), 0), '#c0392b', '#27ae60'), '\">', string(length(coalesce(body('Run_URL_Click_KQL')?['value'], json('[]')))), ' click(s)</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', if(greater(length(coalesce(body('Run_URL_Click_KQL')?['value'], json('[]'))), 0), string(body('Run_URL_Click_KQL')?['value']), '<em style=\"color:#888\">No email clicks found</em>'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(length(coalesce(body('Run_URL_Network_KQL')?['value'], json('[]'))), 0), '#c0392b', '#27ae60'), '\">', string(length(coalesce(body('Run_URL_Network_KQL')?['value'], json('[]')))), ' connection(s)</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', if(greater(length(coalesce(body('Run_URL_Network_KQL')?['value'], json('[]'))), 0), string(body('Run_URL_Network_KQL')?['value']), '<em style=\"color:#888\">No endpoint connections found</em>'), '</td></tr>')"
                                        }
                                    },
                                    "Compose_URL_KQL_Block": {
                                        "runAfter": {
                                            "Append_NS_Click_HTML_Row": [
                                                "Succeeded",
                                                "Failed",
                                                "Skipped",
                                                "TimedOut"
                                            ],
                                            "Append_NS_URL_HTML_Row": [
                                                "Succeeded",
                                                "Failed",
                                                "Skipped",
                                                "TimedOut"
                                            ]
                                        },
                                        "type": "Compose",
                                        "inputs": "@concat('<div style=\"border-left:4px solid #8e44ad;padding:10px 14px;margin-bottom:20px;background:#fdf8ff\"><strong style=\"color:#6c3483;font-size:13px\">&#128279; ', item()?['Url'], '</strong><span style=\"color:#7f8c8d;font-size:11px;margin-left:10px\">(', outputs('Compose_URL_Host'), ')</span><br><br><strong style=\"font-size:12px;color:#7d3c98\">&#128140; UrlClickEvents (30d lookback)</strong><br><span style=\"font-family:Consolas,Courier New,monospace;font-size:11px;color:#1c2833;white-space:pre\">UrlClickEvents<br>| where TimeGenerated &gt; ago(30d)<br>| where Url has \"', item()?['Url'], '\"<br>    or Url startswith \"', item()?['Url'], '\"<br>| project TimeGenerated, Url, ActionType, AccountUpn, NetworkMessageId,<br>         IPAddress, IsClickedThrough, Workload, UrlChain<br>| order by TimeGenerated desc<br>| take 25</span><br><br><strong style=\"font-size:12px;color:#7d3c98\">&#127760; DeviceNetworkEvents (30d lookback)</strong><br><span style=\"font-family:Consolas,Courier New,monospace;font-size:11px;color:#1c2833;white-space:pre\">DeviceNetworkEvents<br>| where TimeGenerated &gt; ago(30d)<br>| where RemoteUrl has \"', item()?['Url'], '\"<br>    or RemoteUrl startswith \"', item()?['Url'], '\"<br>| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, RemotePort, ActionType,<br>         InitiatingProcessFileName, InitiatingProcessCommandLine,<br>         InitiatingProcessAccountName<br>| order by TimeGenerated desc<br>| take 25</span></div>')"
                                    },
                                    "Append_URL_KQL_Section": {
                                        "runAfter": {
                                            "Compose_URL_KQL_Block": [
                                                "Succeeded"
                                            ]
                                        },
                                        "type": "AppendToStringVariable",
                                        "inputs": {
                                            "name": "KQLSectionHTML",
                                            "value": "@outputs('Compose_URL_KQL_Block')"
                                        }
                                    }
                                },
                                "runAfter": {
                                    "Compose_URL_IsExcluded": [
                                        "Succeeded"
                                    ]
                                },
                                "else": {
                                    "actions": {
                                        "Append_NS_URL_Result_Excluded": {
                                            "type": "AppendToArrayVariable",
                                            "inputs": {
                                                "name": "NSURLResults",
                                                "value": {
                                                    "url": "@item()?['Url']",
                                                    "host": "@outputs('Compose_URL_Host')",
                                                    "excluded": true,
                                                    "site": "Excluded",
                                                    "primaryCategory": "Excluded",
                                                    "allCategories": "Excluded - trusted domain",
                                                    "urlLists": "N/A",
                                                    "lookupSuccess": false
                                                }
                                            }
                                        },
                                        "Append_NS_URL_HTML_Row_Excluded": {
                                            "runAfter": {
                                                "Append_NS_URL_Result_Excluded": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "AppendToStringVariable",
                                            "inputs": {
                                                "name": "NSURLTableHTML",
                                                "value": "@concat('<tr style=\"background:#f0f0f0\"><td style=\"padding:6px 10px;border:1px solid #ddd;word-break:break-all;max-width:300px;color:#888\">', item()?['Url'], '</td><td style=\"padding:6px 10px;border:1px solid #ddd;color:#888\">', outputs('Compose_URL_Host'), '</td><td colspan=\"4\" style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;color:#888\"><em>⊘ Excluded — trusted domain (', outputs('Compose_URL_Host'), ')</em></td></tr>')"
                                            }
                                        },
                                        "Append_NS_Click_Result_Excluded": {
                                            "runAfter": {
                                                "Append_NS_URL_HTML_Row_Excluded": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "AppendToArrayVariable",
                                            "inputs": {
                                                "name": "NSClickResults",
                                                "value": {
                                                    "url": "@item()?['Url']",
                                                    "host": "@outputs('Compose_URL_Host')",
                                                    "excluded": true,
                                                    "emailClickCount": 0,
                                                    "emailClickEvents": [],
                                                    "networkEventCount": 0,
                                                    "networkEvents": []
                                                }
                                            }
                                        },
                                        "Append_NS_Click_HTML_Row_Excluded": {
                                            "runAfter": {
                                                "Append_NS_Click_Result_Excluded": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "AppendToStringVariable",
                                            "inputs": {
                                                "name": "NSClickTableHTML",
                                                "value": "@concat('<tr style=\"background:#f0f0f0\"><td style=\"padding:6px 10px;border:1px solid #ddd;word-break:break-all;max-width:280px;font-family:monospace;font-size:11px;color:#888\">', item()?['Url'], '</td><td colspan=\"4\" style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;color:#888\"><em>⊘ Excluded — trusted domain (', outputs('Compose_URL_Host'), ') — KQL not executed</em></td></tr>')"
                                            }
                                        },
                                        "Append_URL_KQL_Section_Excluded": {
                                            "runAfter": {
                                                "Append_NS_Click_HTML_Row_Excluded": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "AppendToStringVariable",
                                            "inputs": {
                                                "name": "KQLSectionHTML",
                                                "value": "@concat('<div style=\"border-left:4px solid #bdc3c7;padding:8px 14px;margin-bottom:12px;background:#f8f8f8\"><span style=\"color:#95a5a6;font-size:12px\">&#8856; <strong>', item()?['Url'], '</strong> — excluded (trusted domain: ', outputs('Compose_URL_Host'), ') — KQL not executed</span></div>')"
                                            }
                                        }
                                    }
                                },
                                "expression": {
                                    "and": [
                                        {
                                            "equals": [
                                                "@outputs('Compose_URL_IsExcluded')",
                                                false
                                            ]
                                        }
                                    ]
                                },
                                "type": "If"
                            }
                        },
                        "type": "Foreach",
                        "operationOptions": "Sequential"
                    },
                    "Response_Success": {
                        "runAfter": {
                            "For_each_URL_NS_Lookup": [
                                "Succeeded",
                                "Failed",
                                "Skipped",
                                "TimedOut"
                            ]
                        },
                        "type": "Response",
                        "kind": "Http",
                        "inputs": {
                            "statusCode": 200,
                            "headers": {
                                "Content-Type": "application/json"
                            },
                            "body": {
                                "nsURLTableHTML": "@variables('NSURLTableHTML')",
                                "nsClickTableHTML": "@variables('NSClickTableHTML')",
                                "nsURLResults": "@variables('NSURLResults')",
                                "nsClickResults": "@variables('NSClickResults')",
                                "kqlSectionHTML": "@variables('KQLSectionHTML')"
                            }
                        }
                    }
                },
                "runAfter": {
                    "Initialize_NSURLResults": [
                        "Succeeded"
                    ],
                    "Initialize_NSURLTableHTML": [
                        "Succeeded"
                    ],
                    "Initialize_NSClickResults": [
                        "Succeeded"
                    ],
                    "Initialize_NSClickTableHTML": [
                        "Succeeded"
                    ],
                    "Initialize_KQLSectionHTML": [
                        "Succeeded"
                    ]
                },
                "else": {
                    "actions": {
                        "Response_Unauthorized": {
                            "type": "Response",
                            "kind": "Http",
                            "inputs": {
                                "statusCode": 401,
                                "body": {
                                    "error": "Unauthorized - invalid worker key"
                                }
                            }
                        }
                    }
                },
                "expression": {
                    "and": [
                        {
                            "equals": [
                                "@triggerOutputs()?['headers']?['x-worker-key']",
                                "@parameters('WorkerSharedKey')"
                            ]
                        }
                    ]
                },
                "type": "If"
            }
        },
        "outputs": {},
        "parameters": {
            "NetskopeApiToken": {
                "defaultValue": "<NETSKOPE-API-TOKEN>",
                "type": "String"
            },
            "WorkerSharedKey": {
                "defaultValue": "<WORKER-SHARED-KEY>",
                "type": "String"
            },
            "ExcludedDomains": {
                "defaultValue": [
                    "*.microsoft.com",
                    "*.windows.com",
                    "*.office.com",
                    "*.office365.com",
                    "*.live.com",
                    "*.azure.com",
                    "*.microsoftonline.com",
                    "*.windowsupdate.com",
                    "*.bing.com",
                    "*.msftconnecttest.com",
                    "*.msauth.net",
                    "*.msauthimages.net",
                    "*.msecnd.net",
                    "*.msocdn.com",
                    "*.sharepoint.com",
                    "*.sharepointonline.com",
                    "*.teams.microsoft.com",
                    "*.skype.com",
                    "*.outlook.com",
                    "*.googleapis.com",
                    "*.gstatic.com",
                    "*.google.com",
                    "*.apple.com",
                    "*.icloud.com",
                    "*.akamaized.net",
                    "*.akamai.net",
                    "*.cloudflare.com",
                    "*.amazonaws.com"
                ],
                "type": "Array"
            },
            "$connections": {
                "type": "Object",
                "defaultValue": {}
            }
        }
    },
    "parameters": {
        "$connections": {
            "type": "Object",
            "value": {
                "azuremonitorlogs": {
                    "id": "/subscriptions/<AZURE-SUBSCRIPTION-ID>/providers/Microsoft.Web/locations/westus2/managedApis/azuremonitorlogs",
                    "connectionId": "/subscriptions/<AZURE-SUBSCRIPTION-ID>/resourceGroups/<RESOURCE-GROUP>/providers/Microsoft.Web/connections/azuremonitorlogs-1",
                    "connectionName": "azuremonitorlogs-1",
                    "connectionProperties": {}
                }
            }
        }
    }
}