Skip to content

Commit 700c28c

Browse files
chkp-kirilllv-maheshbh
chkp-kirilll
and
v-maheshbh
authored
Add Check Point Cyberint Alerts bi-directional sync playbooks (v3.1.0) (#13790)
* add artifacts * add artifacts * fix issues * fix issues * add alert_url column * add alert_url column * add alert_url column * add include_csv_attachments_as_json_content: true to the POST body * add configuration fields * fixes * fixes * fix arm-ttk test issue * fix arm-ttk test issue * fix connection issue * fix closure reasons * fix cyberint ioc connector * add customer name field to IOC connector configuration * update zip package * update zip package * repackage Cyberint Alerts and IOC * review updates * review updates * fix test script * remove: revert Solutions Analyzer to master * add valid connector ids * replace workbook previews * add workbook previews * Fix ValidConnectorIds.json and add connectors Remove leftover merge-conflict markers and duplicate block in .script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json, normalize the JSON array formatting, and append missing connectors (CheckPointCyberintAlerts, CheckPointCyberintIOC). Ensures the file is a valid, de-duplicated list of connector IDs. * fixed solution name and fixed missing playbook * fixed solution name and fixed missing playbook * repackage * repackage * use Microsoft Sentinel branding in solution package descriptions * remove Check_Point_EM_AutomationRules * Add ContrastADRCCF to valid connector IDs Include "ContrastADRCCF" in the .script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json list so detection template schema validation recognizes the new connector ID. This ensures templates referencing the Contrast ADR CCF connector will pass validation. * Update Check Point Cyberint template variables Rename workbook default to "Check Point Cyberint Alerts - Alert Overview & Sync Health" and add template variables for X-Sender-Id and X-Integration-Instance-Id. Replace hardcoded header values with references to the new variables so playbook/template IDs are generated dynamically. Also update the packaged 3.1.0 zip to include these template changes. --------- Co-authored-by: maheshji001 <v-maheshbh@microsoft.com>
1 parent e813583 commit 700c28c

52 files changed

Lines changed: 8710 additions & 174 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.script/tests/KqlvalidationsTests/CustomTables/argsentdc_CL.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{
2+
"Name": "argsentdc_CL",
3+
"Properties": [
4+
{ "Name": "TimeGenerated", "Type": "DateTime" },
5+
{ "Name": "acknowledged_by", "Type": "Dynamic" },
6+
{ "Name": "acknowledged_date", "Type": "Dynamic" },
7+
{ "Name": "alert_data", "Type": "Dynamic" },
8+
{ "Name": "analysis_report", "Type": "Dynamic" },
9+
{ "Name": "attachments", "Type": "Dynamic" },
10+
{ "Name": "category", "Type": "String" },
11+
{ "Name": "closed_by", "Type": "Dynamic" },
12+
{ "Name": "closure_date", "Type": "Dynamic" },
13+
{ "Name": "closure_reason", "Type": "Dynamic" },
14+
{ "Name": "closure_reason_description", "Type": "Dynamic" },
15+
{ "Name": "confidence", "Type": "Int" },
16+
{ "Name": "created_by", "Type": "Dynamic" },
17+
{ "Name": "created_date", "Type": "DateTime" },
18+
{ "Name": "description", "Type": "String" },
19+
{ "Name": "environment", "Type": "String" },
20+
{ "Name": "event_title", "Type": "String" },
21+
{ "Name": "event_type", "Type": "String" },
22+
{ "Name": "id", "Type": "Int" },
23+
{ "Name": "impacts", "Type": "Dynamic" },
24+
{ "Name": "indicators", "Type": "Dynamic" },
25+
{ "Name": "iocs", "Type": "Dynamic" },
26+
{ "Name": "mitre", "Type": "Dynamic" },
27+
{ "Name": "modification_date", "Type": "DateTime" },
28+
{ "Name": "publish_date", "Type": "String" },
29+
{ "Name": "recommendation", "Type": "String" },
30+
{ "Name": "ref_id", "Type": "String" },
31+
{ "Name": "related_assets", "Type": "Dynamic" },
32+
{ "Name": "related_entities", "Type": "Dynamic" },
33+
{ "Name": "severity", "Type": "String" },
34+
{ "Name": "source", "Type": "String" },
35+
{ "Name": "source_category", "Type": "String" },
36+
{ "Name": "status", "Type": "String" },
37+
{ "Name": "tags", "Type": "Dynamic" },
38+
{ "Name": "targeted_brands", "Type": "Dynamic" },
39+
{ "Name": "targeted_vectors", "Type": "Dynamic" },
40+
{ "Name": "threat_actor", "Type": "String" },
41+
{ "Name": "ticket_id", "Type": "Dynamic" }
42+
]
43+
}

‎.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -295,5 +295,7 @@
295295
"XbowSecurityConnector",
296296
"NetskopeWebTxConnector",
297297
"SOCPrimeAuditLogsDataConnector",
298-
"ContrastADRCCF"
298+
"ContrastADRCCF",
299+
"CheckPointCyberintAlerts",
300+
"CheckPointCyberintIOC"
299301
]

‎Logos/checkpoint-cyberint.svg‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎Logos/checkpoint.svg‎

Lines changed: 10 additions & 0 deletions
Loading

‎Solutions/Check Point Cyberint Alerts/Analytic Rules/CPEMAlertIngestionAnomaly.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
id: 8d3b9c7e-5a2f-4e1d-b6c8-3f9a7e2d1b4c
2+
name: Check Point Exposure Management - Alert Ingestion Anomaly
3+
description: |
4+
Detects when no Check Point Exposure Management alerts have been ingested into the argsentdc_CL table
5+
for an extended period. This may indicate a failure in the CCP data connector or the
6+
Importer playbook, a misconfigured API token, or network connectivity issues.
7+
severity: Medium
8+
queryFrequency: 1h
9+
queryPeriod: 24h
10+
triggerOperator: gt
11+
triggerThreshold: 0
12+
status: Available
13+
tactics:
14+
- DefenseEvasion
15+
relevantTechniques:
16+
- T1562
17+
requiredDataConnectors:
18+
- connectorId: CheckPointCyberintAlerts
19+
dataTypes:
20+
- argsentdc_CL
21+
query: |
22+
let lookback = 24h;
23+
let expected_interval = 1h;
24+
let last_record = toscalar(
25+
argsentdc_CL
26+
| where TimeGenerated > ago(lookback)
27+
| summarize max(TimeGenerated)
28+
);
29+
let gap_minutes = datetime_diff('minute', now(), last_record);
30+
// Alert if no records in the last expected_interval, but there WERE records in the lookback period
31+
// (avoids alerting on brand-new deployments with no data yet)
32+
argsentdc_CL
33+
| where TimeGenerated > ago(lookback)
34+
| summarize
35+
LastIngestionTime = max(TimeGenerated),
36+
TotalRecords = count(),
37+
DistinctAlerts = dcount(ref_id)
38+
| where LastIngestionTime < ago(expected_interval)
39+
| extend GapMinutes = datetime_diff('minute', now(), LastIngestionTime)
40+
| project
41+
LastIngestionTime,
42+
GapMinutes,
43+
TotalRecords,
44+
DistinctAlerts,
45+
Message = strcat("No Check Point Exposure Management alerts ingested for ", GapMinutes, " minutes. Last record at ", LastIngestionTime)
46+
suppressionEnabled: false
47+
suppressionDuration: 5h
48+
incidentConfiguration:
49+
createIncident: true
50+
groupingConfiguration:
51+
enabled: true
52+
reopenClosedIncident: false
53+
lookbackDuration: 24h
54+
matchingMethod: AllEntities
55+
eventGroupingSettings:
56+
aggregationKind: SingleAlert
57+
alertDetailsOverride:
58+
alertDescriptionFormat: '{{Message}}'
59+
alertDisplayNameFormat: 'Check Point Exposure Management - Ingestion gap detected ({{GapMinutes}} minutes)'
60+
version: 1.0.0
61+
kind: Scheduled

‎Solutions/Check Point Cyberint Alerts/Data Connectors/CyberintArgosAlertsLogs_ccp/CyberintArgosAlertsLogs_DCR.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
},
2020
{
2121
"name": "ref_id",
22-
"type": "datetime"
22+
"type": "string"
2323
},
2424
{
2525
"name": "confidence",

‎Solutions/Check Point Cyberint Alerts/Data Connectors/CyberintArgosAlertsLogs_ccp/CyberintArgosAlertsLogs_PollingConfig.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@
2020
"ApiKeyIdentifier": "access_token="
2121
},
2222
"request": {
23-
"apiEndpoint": "[[concat('https://', parameters('argosurl'), '/alert/api/v1/alerts')]",
23+
"apiEndpoint": "[[concat(parameters('argosurl'), '/alert/api/v1/alerts')]",
2424
"rateLimitQPS": 10,
25-
"queryWindowInMin": 5,
25+
"queryWindowInMin": "[[parameters('pollinginterval')]",
2626
"httpMethod": "POST",
2727
"queryTimeFormat": "UnixTimestamp",
2828
"retryCount": 3,
@@ -38,7 +38,7 @@
3838
"X-Integration-Version": "1.0"
3939
},
4040
"isPostPayloadJson": true,
41-
"queryParametersTemplate": "{ 'filters': { 'created_date': { 'from': '{_QueryWindowStartTime}', 'to': '{_QueryWindowEndTime}' } } }"
41+
"queryParametersTemplate": "[[concat('{ ''filters'': { ''created_date'': { ''from'': ''{_QueryWindowStartTime}'', ''to'': ''{_QueryWindowEndTime}'' }', if(not(empty(parameters('severity'))), concat(', ''severity'': [''', replace(parameters('severity'), ',', ''','''), ''']'), ''), if(not(empty(parameters('environments'))), concat(', ''environments'': [''', replace(parameters('environments'), ',', ''','''), ''']'), ''), ' }, ''include_csv_attachments_as_json_content'': ', parameters('includecsvattachments'), ' }')]"
4242
},
4343
"response": {
4444
"eventsJsonPaths": ["$.alerts"]

‎Solutions/Check Point Cyberint Alerts/Data Connectors/CyberintArgosAlertsLogs_ccp/CyberintArgosAlertsLogs_Table.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@
102102
},
103103
{
104104
"name": "ref_id",
105-
"type": "datetime"
105+
"type": "string"
106106
},
107107
{
108108
"name": "related_assets",

‎Solutions/Check Point Cyberint Alerts/Data Connectors/CyberintArgosAlertsLogs_ccp/CyberintArgosAlertsLogs_connectorDefinition.json‎

Lines changed: 44 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -51,21 +51,21 @@
5151
],
5252
"customs": [
5353
{
54-
"name": "Check Point Cyberint API Key, Argos URL, and Customer Name",
55-
"description": "The connector API key, Argos URL, and Customer Name are required"
54+
"name": "Check Point Cyberint API Key, Argos URL, Customer Name",
55+
"description": "The connector API key, Argos URL, and Customer Name are required. Include CSV Attachments as JSON is optional."
5656
}
5757
]
5858
},
5959
"instructionSteps": [
6060
{
6161
"title": "Connect Checkpoint Cyberint Alerts to Microsoft Sentinel",
62-
"description": "To enable the connector provide the required information below and click on Connect.\n>",
62+
"description": "To enable the connector provide the required information below and click on Connect.\n\n**Argos URL** — Cyberint API URL for your tenant (e.g. `https://your_tenant.cyberint.io`)\n\n**API Token** — Cyberint API access token\n\n**Customer Name** — Company (client) name associated with your Cyberint instance\n\n**Severity** — Comma-separated list of severities to fetch (low, medium, high, very_high). If empty, all severities are fetched.\n\n**Environments** — Comma-separated list of environments to fetch (e.g. Production,Staging). If empty, all environments are fetched.\n\n**Polling Interval** — How often to poll for new alerts, in minutes (default: 5)\n\n**Include CSV Attachments as JSON** — Whether to include CSV attachments as JSON content in alerts (default: false)\n>",
6363
"instructions": [
6464
{
6565
"type": "Textbox",
6666
"parameters": {
6767
"label": "Argos URL",
68-
"placeholder": "Argos URL",
68+
"placeholder": "https://your_tenant.cyberint.io",
6969
"type": "text",
7070
"name": "argosurl"
7171
}
@@ -74,7 +74,7 @@
7474
"type": "Textbox",
7575
"parameters": {
7676
"label": "API Token",
77-
"placeholder": "API Token",
77+
"placeholder": "Cyberint API access token",
7878
"type": "password",
7979
"name": "apikey"
8080
}
@@ -83,11 +83,49 @@
8383
"type": "Textbox",
8484
"parameters": {
8585
"label": "Customer Name",
86-
"placeholder": "Customer Name",
86+
"placeholder": "Company (client) name associated with your Cyberint instance",
8787
"type": "text",
8888
"name": "customername"
8989
}
9090
},
91+
{
92+
"type": "Textbox",
93+
"parameters": {
94+
"label": "Severity",
95+
"placeholder": "Comma-separated list (e.g. low,medium,high,very_high)",
96+
"type": "text",
97+
"name": "severity"
98+
}
99+
},
100+
{
101+
"type": "Textbox",
102+
"parameters": {
103+
"label": "Environments",
104+
"placeholder": "Comma-separated list",
105+
"type": "text",
106+
"name": "environments"
107+
}
108+
},
109+
{
110+
"type": "Textbox",
111+
"parameters": {
112+
"label": "Polling Interval (Minutes)",
113+
"placeholder": "Polling frequency in minutes",
114+
"type": "text",
115+
"name": "pollinginterval",
116+
"defaultValue": "5"
117+
}
118+
},
119+
{
120+
"type": "Textbox",
121+
"parameters": {
122+
"label": "Include CSV Attachments as JSON",
123+
"placeholder": "true or false",
124+
"type": "text",
125+
"name": "includecsvattachments",
126+
"defaultValue": "false"
127+
}
128+
},
91129
{
92130
"type": "ConnectionToggleButton",
93131
"parameters": {

‎Solutions/Check Point Cyberint Alerts/Data/Solution_Cyberint.json‎

Lines changed: 23 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,32 @@
11
{
22
"Name": "Check Point Cyberint Alerts",
3-
"Author": "Cyberint - support@checkpoint.com",
4-
"Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/checkpoint-cyberint.svg\" width=\"75px\" height=\"75px\">",
5-
"Description": "Cyberint, a Check Point company, provides Microsoft Sentinel integration to streamline critical Alerts and bring enriched threat intelligence from the Infinity External Risk Management solution into Microsoft Sentinel. This simplifies the process of tracking the status of tickets with automatic sync updates across systems. Using this new integration for Microsoft Sentinel, existing Cyberint and Microsoft Sentinel customers can easily pull logs based on Cyberint's findings into Microsoft Sentinel platform.<p><span style='color:red; font-weight:bold;'>NOTE</span>: Microsoft recommends installation of Check Point Cyberint Alerts Connector (via Codeless Connector Platform). This connector is build on the Codeless Connector Platform (CCP), which uses the Log Ingestion API, which replaces ingestion via the <a href='https://learn.microsoft.com/en-us/azure/azure-monitor/logs/custom-logs-migrate' style='color:#1890F1;'>deprecated HTTP Data Collector API</a>. CCP-based data connectors also support <a href='https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-rule-overview' style='color:#1890F1;'>Data Collection Rules</a> (DCRs) offering transformations and enrichment.</p>",
3+
"Author": "Check Point - support@checkpoint.com",
4+
"Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/checkpoint.svg\" width=\"75px\" height=\"75px\">",
5+
"Description": "Check Point provides Microsoft Sentinel integration to streamline critical Alerts and bring enriched threat intelligence from the Infinity External Risk Management solution into Microsoft Sentinel. This simplifies the process of tracking the status of tickets with automatic sync updates across systems. Using this new integration for Microsoft Sentinel, existing Check Point Exposure Management and Microsoft Sentinel customers can easily pull logs based on Check Point Exposure Management findings into Microsoft Sentinel platform.<p><span style='color:red; font-weight:bold;'>NOTE</span>: Microsoft recommends installation of Check Point Exposure Management Alerts Connector (via Codeless Connector Platform). This connector is build on the Codeless Connector Platform (CCP), which uses the Log Ingestion API, which replaces ingestion via the <a href='https://learn.microsoft.com/en-us/azure/azure-monitor/logs/custom-logs-migrate' style='color:#1890F1;'>deprecated HTTP Data Collector API</a>. CCP-based data connectors also support <a href='https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-rule-overview' style='color:#1890F1;'>Data Collection Rules</a> (DCRs) offering transformations and enrichment.</p>",
6+
"Analytic Rules": [
7+
"Analytic Rules/CPEMAlertIngestionAnomaly.yaml"
8+
],
9+
"Workbooks": [
10+
"Workbooks/CPEMAlertOverview.json"
11+
],
12+
"Parsers": [
13+
"Parsers/CPEMAlerts.yaml"
14+
],
15+
"Playbooks": [
16+
"Playbooks/Sync/CPEM_InboundSync/azuredeploy.json",
17+
"Playbooks/Sync/CPEM_OutboundSync/azuredeploy.json",
18+
"Playbooks/Sync/CPEM_ManualStatusUpdate/azuredeploy.json",
19+
"Playbooks/Enrichment/CPEM_IOCEnrichment/azuredeploy.json",
20+
"Playbooks/Enrichment/CPEM_FetchAttachments/azuredeploy.json",
21+
"Playbooks/Response/CPEM_CredentialLeakResponse/azuredeploy.json",
22+
"Playbooks/Response/CPEM_PhishingTakedown/azuredeploy.json",
23+
"Playbooks/Response/CPEM_VulnerabilityMonitoring/azuredeploy.json"
24+
],
625
"Data Connectors": [
726
"Data Connectors/CyberintArgosAlertsLogs_ccp/CyberintArgosAlertsLogs_connectorDefinition.json"
827
],
928
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Check Point Cyberint Alerts",
10-
"Version": "3.0.0",
29+
"Version": "3.1.0",
1130
"Metadata": "SolutionMetadata.json",
1231
"TemplateSpec": true
1332
}

0 commit comments

Comments
 (0)