Skip to content

Commit 04a98f4

Browse files
p-osmanp-osman
committed
svg and kql parser function fix
1 parent 4a15564 commit 04a98f4

5 files changed

Lines changed: 129 additions & 45 deletions

File tree

‎.script/tests/KqlvalidationsTests/CustomFunctions/PRODAFTUstaCompromisedCredentials.json‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
{
2+
"FunctionName": "PRODAFTUstaCompromisedCredentials",
3+
"FunctionParameters": [],
4+
"FunctionResultColumns": [
5+
{
6+
"name": "TimeGenerated",
7+
"type": "datetime"
8+
},
9+
{
10+
"name": "TicketId",
11+
"type": "long"
12+
},
13+
{
14+
"name": "Status",
15+
"type": "string"
16+
},
17+
{
18+
"name": "StatusTimestamp",
19+
"type": "datetime"
20+
},
21+
{
22+
"name": "Created",
23+
"type": "datetime"
24+
},
25+
{
26+
"name": "ContentType",
27+
"type": "string"
28+
},
29+
{
30+
"name": "CompanyId",
31+
"type": "int"
32+
},
33+
{
34+
"name": "CompanyName",
35+
"type": "string"
36+
},
37+
{
38+
"name": "Username",
39+
"type": "string"
40+
},
41+
{
42+
"name": "Url",
43+
"type": "string"
44+
},
45+
{
46+
"name": "Source",
47+
"type": "string"
48+
},
49+
{
50+
"name": "IsCorporate",
51+
"type": "boolean"
52+
},
53+
{
54+
"name": "PasswordScore",
55+
"type": "string"
56+
},
57+
{
58+
"name": "PasswordLength",
59+
"type": "int"
60+
},
61+
{
62+
"name": "VictimUid",
63+
"type": "string"
64+
},
65+
{
66+
"name": "VictimUsername",
67+
"type": "string"
68+
},
69+
{
70+
"name": "VictimCountry",
71+
"type": "string"
72+
},
73+
{
74+
"name": "VictimIp",
75+
"type": "string"
76+
},
77+
{
78+
"name": "VictimComputerName",
79+
"type": "string"
80+
},
81+
{
82+
"name": "VictimOs",
83+
"type": "string"
84+
},
85+
{
86+
"name": "VictimMalware",
87+
"type": "string"
88+
},
89+
{
90+
"name": "InfectionDate",
91+
"type": "datetime"
92+
}
93+
]
94+
}

‎Logos/PRODAFTUstaATP.svg‎

Lines changed: 1 addition & 6 deletions
Loading

‎Solutions/PRODAFT USTA - Account Takeover Prevention/Package/3.0.0.zip‎

11 Bytes
Binary file not shown.

‎Solutions/PRODAFT USTA - Account Takeover Prevention/Package/mainTemplate.json‎

Lines changed: 33 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -235,10 +235,10 @@
235235
"status": "Available",
236236
"requiredDataConnectors": [
237237
{
238+
"connectorId": "PRODAFTUstaATPCCPDefinition",
238239
"dataTypes": [
239240
"PRODAFTUstaCompromisedCredentials_CL"
240-
],
241-
"connectorId": "PRODAFTUstaATPCCPDefinition"
241+
]
242242
}
243243
],
244244
"tactics": [
@@ -251,51 +251,51 @@
251251
],
252252
"entityMappings": [
253253
{
254+
"entityType": "Account",
254255
"fieldMappings": [
255256
{
256257
"columnName": "Username",
257258
"identifier": "FullName"
258259
}
259-
],
260-
"entityType": "Account"
260+
]
261261
},
262262
{
263+
"entityType": "Host",
263264
"fieldMappings": [
264265
{
265266
"columnName": "VictimComputerName",
266267
"identifier": "HostName"
267268
}
268-
],
269-
"entityType": "Host"
269+
]
270270
},
271271
{
272+
"entityType": "IP",
272273
"fieldMappings": [
273274
{
274275
"columnName": "VictimIp",
275276
"identifier": "Address"
276277
}
277-
],
278-
"entityType": "IP"
278+
]
279279
}
280280
],
281281
"customDetails": {
282-
"Source": "Source",
283282
"Malware": "VictimMalware",
283+
"Ticket": "TicketId",
284284
"PasswordScore": "PasswordScore",
285-
"Company": "CompanyName",
286-
"Ticket": "TicketId"
285+
"Source": "Source",
286+
"Company": "CompanyName"
287287
},
288288
"incidentConfiguration": {
289+
"createIncident": true,
289290
"groupingConfiguration": {
290-
"lookbackDuration": "1h",
291+
"enabled": true,
292+
"matchingMethod": "Selected",
293+
"reopenClosedIncident": false,
291294
"groupByEntities": [
292295
"Account"
293296
],
294-
"matchingMethod": "Selected",
295-
"reopenClosedIncident": false,
296-
"enabled": true
297-
},
298-
"createIncident": true
297+
"lookbackDuration": "1h"
298+
}
299299
}
300300
}
301301
},
@@ -378,16 +378,16 @@
378378
"status": "Available",
379379
"requiredDataConnectors": [
380380
{
381+
"connectorId": "PRODAFTUstaATPCCPDefinition",
381382
"dataTypes": [
382383
"PRODAFTUstaCompromisedCredentials_CL"
383-
],
384-
"connectorId": "PRODAFTUstaATPCCPDefinition"
384+
]
385385
},
386386
{
387+
"connectorId": "AzureActiveDirectory",
387388
"dataTypes": [
388389
"SigninLogs"
389-
],
390-
"connectorId": "AzureActiveDirectory"
390+
]
391391
}
392392
],
393393
"tactics": [
@@ -400,40 +400,40 @@
400400
],
401401
"entityMappings": [
402402
{
403+
"entityType": "Account",
403404
"fieldMappings": [
404405
{
405406
"columnName": "UserPrincipalName",
406407
"identifier": "FullName"
407408
}
408-
],
409-
"entityType": "Account"
409+
]
410410
},
411411
{
412+
"entityType": "IP",
412413
"fieldMappings": [
413414
{
414415
"columnName": "IPAddress",
415416
"identifier": "Address"
416417
}
417-
],
418-
"entityType": "IP"
418+
]
419419
}
420420
],
421421
"customDetails": {
422+
"Ticket": "TicketId",
422423
"Source": "Source",
423-
"Company": "CompanyName",
424-
"Ticket": "TicketId"
424+
"Company": "CompanyName"
425425
},
426426
"incidentConfiguration": {
427+
"createIncident": true,
427428
"groupingConfiguration": {
428-
"lookbackDuration": "1d",
429+
"enabled": true,
430+
"matchingMethod": "Selected",
431+
"reopenClosedIncident": false,
429432
"groupByEntities": [
430433
"Account"
431434
],
432-
"matchingMethod": "Selected",
433-
"reopenClosedIncident": false,
434-
"enabled": true
435-
},
436-
"createIncident": true
435+
"lookbackDuration": "1d"
436+
}
437437
}
438438
}
439439
},

‎Workbooks/Images/Logos/PRODAFTUstaATP.svg‎

Lines changed: 1 addition & 6 deletions
Loading

0 commit comments

Comments
 (0)