Skip to content

Commit 25d76f7

Browse files
v-dvedakv-dvedak
authored
Merge pull request #14382 from zgiftson-vasanth/zimperium-incident-data
add tables and modify data collection rules to ingest zimperium incident log
2 parents bdce8b8 + 1225571 commit 25d76f7

15 files changed

Lines changed: 629 additions & 10 deletions

‎Solutions/Zimperium Mobile Threat Defense/Data Connectors/ZimperiumMTD_CCF/ZimperiumIncidentLog_table.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"name": "ZimperiumIncidentLog_CL",
3+
"type": "Microsoft.OperationalInsights/workspaces/tables",
4+
"apiVersion": "2025-07-01",
5+
"properties": {
6+
"schema": {
7+
"name": "ZimperiumIncidentLog_CL",
8+
"columns": [
9+
{
10+
"name": "TimeGenerated",
11+
"type": "datetime"
12+
},
13+
{
14+
"name": "incident_id",
15+
"type": "string"
16+
},
17+
{
18+
"name": "incident_name",
19+
"type": "string"
20+
},
21+
{
22+
"name": "incident_confidence_level",
23+
"type": "string"
24+
},
25+
{
26+
"name": "incident_ai_summary",
27+
"type": "string"
28+
},
29+
{
30+
"name": "incident_link",
31+
"type": "string"
32+
},
33+
{
34+
"name": "device_id",
35+
"type": "string"
36+
},
37+
{
38+
"name": "device_group",
39+
"type": "string"
40+
},
41+
{
42+
"name": "device_owner",
43+
"type": "string"
44+
},
45+
{
46+
"name": "countries",
47+
"type": "dynamic"
48+
},
49+
{
50+
"name": "mitre_tactics",
51+
"type": "dynamic"
52+
},
53+
{
54+
"name": "related_threats",
55+
"type": "dynamic"
56+
},
57+
{
58+
"name": "incident_created_date",
59+
"type": "datetime"
60+
},
61+
{
62+
"name": "incident_status",
63+
"type": "string"
64+
}
65+
]
66+
}
67+
}
68+
}

‎Solutions/Zimperium Mobile Threat Defense/Data Connectors/ZimperiumMTD_CCF/ZimperiumIncidentMitigationLog_table.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"name": "ZimperiumIncidentMitigationLog_CL",
3+
"type": "Microsoft.OperationalInsights/workspaces/tables",
4+
"apiVersion": "2025-07-01",
5+
"properties": {
6+
"schema": {
7+
"name": "ZimperiumIncidentMitigationLog_CL",
8+
"columns": [
9+
{
10+
"name": "TimeGenerated",
11+
"type": "datetime"
12+
},
13+
{
14+
"name": "incident_id",
15+
"type": "string"
16+
},
17+
{
18+
"name": "incident_updated_date",
19+
"type": "datetime"
20+
},
21+
{
22+
"name": "incident_status",
23+
"type": "string"
24+
},
25+
{
26+
"name": "incident_link",
27+
"type": "string"
28+
},
29+
{
30+
"name": "fix_reason",
31+
"type": "string"
32+
}
33+
]
34+
}
35+
}
36+
}

‎Solutions/Zimperium Mobile Threat Defense/Data Connectors/ZimperiumMTD_CCF/ZimperiumMTD_DCR.json‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -544,6 +544,86 @@
544544
"type": "string"
545545
}
546546
]
547+
},
548+
"Custom-ZimperiumIncidentLog": {
549+
"columns": [
550+
{
551+
"name": "incident_id",
552+
"type": "string"
553+
},
554+
{
555+
"name": "incident_name",
556+
"type": "string"
557+
},
558+
{
559+
"name": "incident_confidence_level",
560+
"type": "string"
561+
},
562+
{
563+
"name": "incident_ai_summary",
564+
"type": "string"
565+
},
566+
{
567+
"name": "incident_link",
568+
"type": "string"
569+
},
570+
{
571+
"name": "device_id",
572+
"type": "string"
573+
},
574+
{
575+
"name": "device_group",
576+
"type": "string"
577+
},
578+
{
579+
"name": "device_owner",
580+
"type": "string"
581+
},
582+
{
583+
"name": "countries",
584+
"type": "dynamic"
585+
},
586+
{
587+
"name": "mitre_tactics",
588+
"type": "dynamic"
589+
},
590+
{
591+
"name": "related_threats",
592+
"type": "dynamic"
593+
},
594+
{
595+
"name": "incident_created_date",
596+
"type": "datetime"
597+
},
598+
{
599+
"name": "incident_status",
600+
"type": "string"
601+
}
602+
]
603+
},
604+
"Custom-ZimperiumIncidentMitigationLog": {
605+
"columns": [
606+
{
607+
"name": "incident_id",
608+
"type": "string"
609+
},
610+
{
611+
"name": "incident_updated_date",
612+
"type": "datetime"
613+
},
614+
{
615+
"name": "incident_status",
616+
"type": "string"
617+
},
618+
{
619+
"name": "incident_link",
620+
"type": "string"
621+
},
622+
{
623+
"name": "fix_reason",
624+
"type": "string"
625+
}
626+
]
547627
}
548628
},
549629
"destinations": {
@@ -574,6 +654,26 @@
574654
],
575655
"transformKql": "source | extend TimeGenerated = now()",
576656
"outputStream": "Custom-ZimperiumMitigationLogV2_CL"
657+
},
658+
{
659+
"streams": [
660+
"Custom-ZimperiumIncidentLog"
661+
],
662+
"destinations": [
663+
"clv2ws1"
664+
],
665+
"transformKql": "source | extend TimeGenerated = now()",
666+
"outputStream": "Custom-ZimperiumIncidentLog_CL"
667+
},
668+
{
669+
"streams": [
670+
"Custom-ZimperiumIncidentMitigationLog"
671+
],
672+
"destinations": [
673+
"clv2ws1"
674+
],
675+
"transformKql": "source | extend TimeGenerated = now()",
676+
"outputStream": "Custom-ZimperiumIncidentMitigationLog_CL"
577677
}
578678
],
579679
"dataCollectionEndpointId": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]"

‎Solutions/Zimperium Mobile Threat Defense/Data Connectors/ZimperiumMTD_CCF/ZimperiumMTD_connectorDefinition.json‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,16 @@
2020
"metricName": "Mitigations",
2121
"legend": "ZimperiumMitigationLogV2_CL",
2222
"baseQuery": "ZimperiumMitigationLogV2_CL"
23+
},
24+
{
25+
"metricName": "Incidents",
26+
"legend": "ZimperiumIncidentLog_CL",
27+
"baseQuery": "ZimperiumIncidentLog_CL"
28+
},
29+
{
30+
"metricName": "Incident Mitigations",
31+
"legend": "ZimperiumIncidentMitigationLog_CL",
32+
"baseQuery": "ZimperiumIncidentMitigationLog_CL"
2333
}
2434
],
2535
"sampleQueries": [
@@ -44,6 +54,14 @@
4454
{
4555
"name": "ZimperiumMitigationLogV2_CL",
4656
"lastDataReceivedQuery": "ZimperiumMitigationLogV2_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
57+
},
58+
{
59+
"name": "ZimperiumIncidentLog_CL",
60+
"lastDataReceivedQuery": "ZimperiumIncidentLog_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
61+
},
62+
{
63+
"name": "ZimperiumIncidentMitigationLog_CL",
64+
"lastDataReceivedQuery": "ZimperiumIncidentMitigationLog_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
4765
}
4866
],
4967
"connectivityCriteria": [
@@ -104,7 +122,7 @@
104122
},
105123
{
106124
"title": "2. Configure and connect Zimperium MTD",
107-
"description": "1. In zConsole, click **Account Management** on the navigation bar.\n2. Click the **Data Export** side tab.\n3. Click the **Add Data Export Configuration** button.\n4. Create the Configuration:\n - **Name:** Name to describe this configuration.\n - **Description:** Description to describe this configuration.\n - **Data Type:** Select datatype as Threat.\n - **Destination Type:** From the available destination types, select Microsoft Sentinel.\n - **Severity Criteria:** Select a Filter Level for the threat data you wish to push to Microsoft Sentinel.\n - **External Tracking Id 1:** This is an optional criterion to match for exported data.\n - **External Tracking Id 2:** This is an optional criterion to match for exported data.\n - **Tenant Id:** Enter from the fields below.\n - **Entra App Registration Application ID:** Enter from the fields below.\n - **Entra App Registration Secret:** Enter from the fields below.\n - **Data Collection Endpoint Uri:** Enter from the fields below.\n - **Data Collection Rule Immutable ID:** Enter from the fields below.\n - Click **Save Configuration**.\n5. For additional instructions, please refer to the [Zimperium customer support portal](https://support.zimperium.com).",
125+
"description": "1. In zConsole, click **Account Management** on the navigation bar.\n2. Click the **Data Export** side tab.\n3. Click the **Add Data Export Configuration** button.\n4. Create the Configuration:\n - **Name:** Name to describe this configuration.\n - **Description:** Description to describe this configuration.\n - **Data Type:** Select datatype as _Threats_ or _Incidents_ depending on the data you want to export.\n - **Destination Type:** From the available destination types, select Microsoft Sentinel.\n - **Severity Criteria:** Select a Filter Level for the threat data you wish to push to Microsoft Sentinel.(**Note:** This field is applicable only for _threats_ datatype)\n - **Team Criteria:** This is an optional criterion to filter data based on teams.\n - **External Tracking Id 1:** This is an optional criterion to match for exported data.\n - **External Tracking Id 2:** This is an optional criterion to match for exported data.\n - **Tenant Id:** Enter from the fields below.\n - **Entra App Registration Application ID:** Enter from the fields below.\n - **Entra App Registration Secret:** Enter from the fields below.\n - **Data Collection Endpoint Uri:** Enter from the fields below.\n - **Data Collection Rule Immutable ID:** Enter from the fields below.\n - Click **Save Configuration**.\n5. For additional instructions, please refer to the [Zimperium customer support portal](https://support.zimperium.com).",
108126
"instructions": [
109127
{
110128
"type": "CopyableLabel",

‎Solutions/Zimperium Mobile Threat Defense/Data/Solution_ZimperiumMTD.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
"Workbooks/ZimperiumMTDCCFWorkbooks.json"
1111
],
1212
"BasePath": "C:\\GitHub\\azure\\Solutions\\Zimperium Mobile Threat Defense",
13-
"Version": "3.0.0",
13+
"Version": "3.1.0",
1414
"Metadata": "SolutionMetadata.json",
1515
"TemplateSpec": true,
1616
"Is1Pconnector": false

‎Solutions/Zimperium Mobile Threat Defense/Package/3.1.0.zip‎

12.6 KB
Binary file not shown.

0 commit comments

Comments
 (0)