Skip to content

Commit 5c8d4fd

Browse files
v-atulyadavv-atulyadav
committed
Merge branch 'master' into dependabot/pip/Solutions/PaloAltoPrismaCloud/Data-Connectors/aiohttp-3.13.4
2 parents 0347bcf + a4597d4 commit 5c8d4fd

239 files changed

Lines changed: 19060 additions & 1649 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/instructions/detections.instructions.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -317,6 +317,26 @@ Analytic Rules are YAML files that define scheduled queries to detect threats, s
317317
- Must include all connectors required for query execution
318318
- Specify exact data types needed
319319
- Use official connector IDs
320+
321+
#### **connectorId Validation**
322+
- **Source of Truth**: All `connectorId` values must be validated against the official list:
323+
```
324+
https://github.com/Azure/Azure-Sentinel/blob/master/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json
325+
```
326+
- **Validation Process**:
327+
- Check if the `connectorId` value exists in ValidConnectorIds.json
328+
- If NOT found: Flag as invalid and request update to ValidConnectorIds.json
329+
- Case-sensitive matching required
330+
- **Valid Examples**:
331+
- `CiscoDuoSecurity` ✅ (exists in valid list)
332+
- `AzureActiveDirectory` ✅ (exists in valid list)
333+
- `CiscoASA` ✅ (exists in valid list)
334+
- **Invalid Examples**:
335+
- `CiscoDuo` ❌ (correct ID is `CiscoDuoSecurity`)
336+
- `AzureAD` ❌ (correct ID is `AzureActiveDirectory`)
337+
- `CustomConnectorXYZ` ❌ (not in official list - needs to be added to ValidConnectorIds.json)
338+
- **Action if Invalid**:
339+
- Comment: "connectorId `[value]` is not found in the ValidConnectorIds.json file. Please update ValidConnectorIds.json to include this connector or use a valid connector ID from the official list."
320340
321341
#### **entityMappings** (Entity Extraction)
322342
- **Required**: Yes for Detections

‎.script/tests/KqlvalidationsTests/CustomFunctions/_ASIM_LookupSyslogSeverityLevel.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"FunctionName": "_ASIM_LookupSyslogSeverityLevel",
3+
"FunctionParameters": [
4+
{
5+
"Name": "SeverityLevelInput",
6+
"Type": "string",
7+
"IsRequired": true
8+
}
9+
],
10+
"FunctionResultColumns": [
11+
{
12+
"Name": "EventSeverity",
13+
"Type": "string"
14+
}
15+
]
16+
}

‎.script/tests/KqlvalidationsTests/CustomTables/AVSVcSyslog.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"Name": "AVSVcSyslog",
3+
"Properties": [
4+
{
5+
"Name": "AppName",
6+
"Type": "string"
7+
},
8+
{
9+
"Name": "_BilledSize",
10+
"Type": "real"
11+
},
12+
{
13+
"Name": "Facility",
14+
"Type": "string"
15+
},
16+
{
17+
"Name": "HostName",
18+
"Type": "string"
19+
},
20+
{
21+
"Name": "_IsBillable",
22+
"Type": "string"
23+
},
24+
{
25+
"Name": "LogCreationTime",
26+
"Type": "datetime"
27+
},
28+
{
29+
"Name": "Message",
30+
"Type": "string"
31+
},
32+
{
33+
"Name": "MsgId",
34+
"Type": "string"
35+
},
36+
{
37+
"Name": "ProcId",
38+
"Type": "string"
39+
},
40+
{
41+
"Name": "_ResourceId",
42+
"Type": "string"
43+
},
44+
{
45+
"Name": "Severity",
46+
"Type": "string"
47+
},
48+
{
49+
"Name": "SourceSystem",
50+
"Type": "string"
51+
},
52+
{
53+
"Name": "_SubscriptionId",
54+
"Type": "string"
55+
},
56+
{
57+
"Name": "TenantId",
58+
"Type": "string"
59+
},
60+
{
61+
"Name": "TimeGenerated",
62+
"Type": "datetime"
63+
},
64+
{
65+
"Name": "Type",
66+
"Type": "string"
67+
}
68+
]
69+
}

‎.script/tests/KqlvalidationsTests/CustomTables/SOCPrimeAuditLogs_CL.json‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"Name": "SOCPrimeAuditLogs_CL",
3+
"Properties": [
4+
{
5+
"name": "TimeGenerated",
6+
"type": "Datetime"
7+
},
8+
{
9+
"name": "EventVendor",
10+
"type": "string"
11+
},
12+
{
13+
"name": "EventType",
14+
"type": "string"
15+
},
16+
{
17+
"name": "EventProduct",
18+
"type": "string"
19+
},
20+
{
21+
"name": "EventName",
22+
"type": "string"
23+
},
24+
{
25+
"name": "UserEmail",
26+
"type": "string"
27+
},
28+
{
29+
"name": "UserName",
30+
"type": "string"
31+
},
32+
{
33+
"name": "Uri",
34+
"type": "string"
35+
},
36+
{
37+
"name": "SourceIp",
38+
"type": "string"
39+
},
40+
{
41+
"name": "HttpUserAgent",
42+
"type": "string"
43+
},
44+
{
45+
"name": "Type",
46+
"type": "string"
47+
}
48+
]
49+
}

‎.script/tests/KqlvalidationsTests/CustomTables/vcenter_CL.json‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"Name": "vcenter_CL",
3+
"Properties": [
4+
{
5+
"Name": "TimeGenerated",
6+
"Type": "datetime"
7+
},
8+
{
9+
"Name": "Message",
10+
"Type": "string"
11+
}
12+
]
13+
}

‎.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -292,5 +292,7 @@
292292
"KnowBe4Defend",
293293
"CTM360CBSConnectorDefinition",
294294
"CTM360HackerViewConnectorDefinition",
295-
"XbowSecurityConnector"
295+
"XbowSecurityConnector",
296+
"NetskopeWebTxConnector",
297+
"SOCPrimeAuditLogsDataConnector"
296298
]

‎ASIM/dev/ASimTester/ASimTester.csv‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -606,10 +606,11 @@ EntityLastModifiedTime,datetime,Mandatory,AssetEntity,,,,,
606606
EntityName,string,Mandatory,AssetEntity,,,,,
607607
EntityNameType,string,Recommended,AssetEntity,,,,,
608608
EntityOriginalId,string,Optional,AssetEntity,,,,,
609+
EntityOriginalSource,string,Optional,AssetEntity,,,,,
609610
EntityProduct,string,Mandatory,AssetEntity,,,,,
610611
EntitySchema,string,Mandatory,AssetEntity,,,,,
611612
EntitySchemaVersion,string,Mandatory,AssetEntity,,,,,
612-
EntitySource,string,Mandatory,AssetEntity,,,,,
613+
EntitySource,string,Mandatory,AssetEntity,Enumerated,Azure|Microsoft365|GCP|AWS|Snowflake|Databricks|Salesforce|Other,,,
613614
EntitySubProduct,string,Mandatory,AssetEntity,,,,,
614615
EntityUpdatedTime,datetime,Mandatory,AssetEntity,,,,,
615616
EntityVendor,string,Mandatory,AssetEntity,,,,,
@@ -722,12 +723,12 @@ EventOwner,string,Optional,UserManagement,,,,,
722723
EventOwner,string,Optional,WebSession,,,,,
723724
EventProduct,string,Mandatory,AlertEvent,Enumerated,Defender XDR|Singularity,,,
724725
EventProduct,string,Mandatory,AuditEvent,Enumerated,Azure|WAF|Security Events|Exchange 365|Dataminr Pulse|ISE|XDR|Meraki|FalconHost|SentinelOne|Carbon Black Cloud|BloxOne|Core|Azure Key Vault|SQL Audit Logs,,,
725-
EventProduct,string,Mandatory,Authentication,Enumerated,Service Cloud|Auth0|CloudTrail|AAD|ASA|Microsoft Defender for IoT|ISE|M365 Defender for Endpoint|Meraki|Security Events|Okta|PostgreSQL|OpenSSH|su|sudo|Vectra XDR|SentinelOne|WAF|FalconHost|Carbon Black Cloud|Cortex Data Lake|Workspace|Core|Fortigate,,,
726+
EventProduct,string,Mandatory,Authentication,Enumerated,Service Cloud|Auth0|CloudTrail|AAD|ASA|Microsoft Defender for IoT|ISE|M365 Defender for Endpoint|Meraki|Security Events|Okta|PostgreSQL|OpenSSH|su|sudo|Vectra XDR|SentinelOne|WAF|FalconHost|Carbon Black Cloud|Cortex Data Lake|Workspace|Core|Fortigate|IOS|vCenter,,,
726727
EventProduct,string,Mandatory,Common,,,,,
727728
EventProduct,string,Mandatory,DhcpEvent,,BloxOne,,,
728729
EventProduct,string,Mandatory,Dns,Enumerated,Umbrella|Azure Firewall|DNS Server|Sysmon|Sysmon for Linux|ZIA DNS|NIOS|Cloud DNS|Zeek|Vectra Stream|SentinelOne|FortiGate|BloxOne,,,
729730
EventProduct,string,Mandatory,FileEvent,Enumerated,Security Events|Sysmon for Linux|Sysmon|M365 Defender for Endpoint|Azure File Storage|SharePoint|OneDrive|SentinelOne|Carbon Black Cloud|Workspace|Cloudtrail,,,
730-
EventProduct,string,Mandatory,NetworkSession,Enumerated,Fortigate|IOS|ISE|SDP|Vectra Stream|NSGFlow|Fireware|VPC|Azure Defender for IoT|Azure Firewall|M365 Defender for Endpoint|Sysmon|Sysmon for Linux|Windows Firewall|WireData|ZIA Firewall|CDL|PanOS|VMConnection|Meraki|Zeek|Firewall|ASA|Cynerio|SentinelOne|WAF|Firepower|FalconHost|Carbon Black Cloud|Cortex Data Lake|Core|Azure NSG flows,,,
731+
EventProduct,string,Mandatory,NetworkSession,Enumerated,Fortigate|IOS|ISE|SDP|Vectra Stream|NSGFlow|Fireware|VPC|Azure Defender for IoT|Azure Firewall|M365 Defender for Endpoint|Sysmon|Sysmon for Linux|Windows Firewall|WireData|ZIA Firewall|CDL|PanOS|VMConnection|Meraki|Zeek|Firewall|ASA|Cynerio|SentinelOne|WAF|Firepower|FalconHost|Carbon Black Cloud|Cortex Data Lake|Core|Azure NSG flows|Smart Defense,,,
731732
EventProduct,string,Mandatory,ProcessEvent,Enumerated,M365 Defender for Endpoint|Sysmon for Linux|Sysmon|Azure Defender for IoT|Security Events|SentinelOne|Carbon Black Cloud|Vision One,,,
732733
EventProduct,string,Mandatory,RegistryEvent,Enumerated,M365 Defender for Endpoint|Security Events|Sysmon|Windows Event|SentinelOne|Carbon Black Cloud|Vision One,,,
733734
EventProduct,string,Mandatory,UserManagement,Enumerated,Security Events|Authpriv|ISE|SentinelOne|CloudTrail,,,

‎DataConnectors/AWS-SecurityHubFindings/requirements.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ asn1crypto
77
azure-common
88
azure-core
99
botocore
10-
cryptography==46.0.5
10+
cryptography==46.0.6
1111
pyasn1
1212
pyasn1-modules
1313
cffi

‎Logos/citrix_logo.svg‎

Lines changed: 41 additions & 0 deletions
Loading

0 commit comments

Comments
 (0)