Skip to content

Commit 70d13ec

Browse files
jlheardjasonheard
jlheard
and
jasonheard
authored
[PaloAltoCortexXDR] - add analytic rules, parser, and drop CCP from name (#14751)
* [PaloAltoCortexXDR] - add parser and analytic rules + rename solution dropping CCP * Add validation check files * Rename files to fix validation check --------- Co-authored-by: jasonheard <jasonheard@microsoft.com>
1 parent c45ccf5 commit 70d13ec

28 files changed

Lines changed: 1128 additions & 99 deletions

‎.script/tests/KqlvalidationsTests/CustomTables/PaloAltoCortexXDR_Incidents.json‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
{
2+
"Name": "PaloAltoCortexXDR_Incidents",
3+
"Properties": [
4+
{
5+
"Name": "TimeGenerated",
6+
"Type": "Datetime"
7+
},
8+
{
9+
"Name": "IncidentId",
10+
"Type": "String"
11+
},
12+
{
13+
"Name": "IncidentName",
14+
"Type": "String"
15+
},
16+
{
17+
"Name": "CreationTime",
18+
"Type": "Datetime"
19+
},
20+
{
21+
"Name": "ModificationTime",
22+
"Type": "Datetime"
23+
},
24+
{
25+
"Name": "DetectionTime",
26+
"Type": "Datetime"
27+
},
28+
{
29+
"Name": "Status",
30+
"Type": "String"
31+
},
32+
{
33+
"Name": "Severity",
34+
"Type": "String"
35+
},
36+
{
37+
"Name": "Description",
38+
"Type": "String"
39+
},
40+
{
41+
"Name": "AlertCount",
42+
"Type": "Int"
43+
},
44+
{
45+
"Name": "LowSeverityAlertCount",
46+
"Type": "Int"
47+
},
48+
{
49+
"Name": "MedSeverityAlertCount",
50+
"Type": "Int"
51+
},
52+
{
53+
"Name": "HighSeverityAlertCount",
54+
"Type": "Int"
55+
},
56+
{
57+
"Name": "CriticalSeverityAlertCount",
58+
"Type": "Int"
59+
},
60+
{
61+
"Name": "UserCount",
62+
"Type": "Int"
63+
},
64+
{
65+
"Name": "HostCount",
66+
"Type": "Int"
67+
},
68+
{
69+
"Name": "ResolveComment",
70+
"Type": "String"
71+
},
72+
{
73+
"Name": "ResolvedTimestamp",
74+
"Type": "Datetime"
75+
},
76+
{
77+
"Name": "XdrUrl",
78+
"Type": "String"
79+
},
80+
{
81+
"Name": "Starred",
82+
"Type": "Bool"
83+
},
84+
{
85+
"Name": "Hosts",
86+
"Type": "Dynamic"
87+
},
88+
{
89+
"Name": "Users",
90+
"Type": "Dynamic"
91+
},
92+
{
93+
"Name": "IncidentSources",
94+
"Type": "Dynamic"
95+
},
96+
{
97+
"Name": "WildfireHits",
98+
"Type": "Int"
99+
},
100+
{
101+
"Name": "AlertsGroupingStatus",
102+
"Type": "String"
103+
},
104+
{
105+
"Name": "AlertCategories",
106+
"Type": "Dynamic"
107+
},
108+
{
109+
"Name": "OriginalTags",
110+
"Type": "Dynamic"
111+
},
112+
{
113+
"Name": "Tags",
114+
"Type": "Dynamic"
115+
}
116+
]
117+
}

‎.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -241,6 +241,7 @@
241241
"MicrosoftDefenderThreatIntelligence",
242242
"ZeroFox_Alert_Polling",
243243
"CortexXDR",
244+
"CortexXDRDataConnector",
244245
"CorelightConnectorExporter",
245246
"MimecastSIEMAPI",
246247
"MimecastTTPAPI",

‎Solutions/Palo Alto Cortex XDR CCP/Package/3.0.4.zip‎

-15.6 KB
Binary file not shown.

‎Solutions/Palo Alto Cortex XDR CCP/Package/createUiDefinition.json‎

Lines changed: 0 additions & 85 deletions
This file was deleted.

‎Solutions/Palo Alto Cortex XDR/Analytic Rules/PaloAltoCortexXDR_High.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
id: 06263265-ff65-43ff-8b15-6ac82325a672
2+
name: Cortex XDR Incident - High
3+
description: |
4+
'A new incident was created in the Cortex XDR portal with a severity "High". Click on the events for incident details. '
5+
severity: High
6+
requiredDataConnectors:
7+
- connectorId: CortexXDRDataConnector
8+
dataTypes:
9+
- PaloAltoCortexXDR_Incidents_CL
10+
queryFrequency: 5m
11+
queryPeriod: 5m
12+
triggerOperator: gt
13+
triggerThreshold: 0
14+
suppressionDuration: 5h
15+
suppressionEnabled: false
16+
tactics: []
17+
relevantTechniques: []
18+
incidentConfiguration:
19+
createIncident: true
20+
groupingConfiguration:
21+
enabled: true
22+
reopenClosedIncident: false
23+
lookbackDuration: PT5H
24+
matchingMethod: AllEntities
25+
eventGroupingSettings:
26+
aggregationKind: SingleAlert
27+
alertDetailsOverride: null
28+
customDetails: null
29+
entityMappings:
30+
- entityType: Account
31+
fieldMappings:
32+
- identifier: Name
33+
columnName: Users_s
34+
- entityType: URL
35+
fieldMappings:
36+
- identifier: Url
37+
columnName: XdrUrl
38+
- entityType: Host
39+
fieldMappings:
40+
- identifier: HostName
41+
columnName: Hosts_s
42+
sentinelEntitiesMappings: null
43+
query: |
44+
PaloAltoCortexXDR_Incidents
45+
| where Severity contains "high"
46+
| where Status !contains "resolved_auto"
47+
// the below line filters for incidents that has at least one user or one host in it. Comment the below line if you want to generated incidents that have 0 user or 0 host as well
48+
| where HostCount > 0 or UserCount > 0
49+
| extend Hosts_s = tostring(Hosts), Users_s = tostring(Users)
50+
| project TimeGenerated, IncidentId, Status, Severity, IncidentSources, Description, XdrUrl, Hosts_s, Users_s, AlertCategories, HostCount, UserCount, AlertCount, CreationTime, ModificationTime
51+
version: 1.0.0
52+
kind: Scheduled

‎Solutions/Palo Alto Cortex XDR/Analytic Rules/PaloAltoCortexXDR_Low.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
id: 0d3fbeba-f9c9-40c7-9b71-8afb1816d7b2
2+
name: Cortex XDR Incident - Low
3+
description: |
4+
'A new incident was created in the Cortex XDR portal with a severity "Low". Click on the events for incident details. '
5+
severity: Low
6+
requiredDataConnectors:
7+
- connectorId: CortexXDRDataConnector
8+
dataTypes:
9+
- PaloAltoCortexXDR_Incidents_CL
10+
queryFrequency: 5m
11+
queryPeriod: 5m
12+
triggerOperator: gt
13+
triggerThreshold: 0
14+
suppressionDuration: 5h
15+
suppressionEnabled: false
16+
tactics: []
17+
relevantTechniques: []
18+
incidentConfiguration:
19+
createIncident: true
20+
groupingConfiguration:
21+
enabled: true
22+
reopenClosedIncident: false
23+
lookbackDuration: PT5H
24+
matchingMethod: AllEntities
25+
eventGroupingSettings:
26+
aggregationKind: SingleAlert
27+
alertDetailsOverride: null
28+
customDetails: null
29+
entityMappings:
30+
- entityType: Account
31+
fieldMappings:
32+
- identifier: Name
33+
columnName: Users_s
34+
- entityType: URL
35+
fieldMappings:
36+
- identifier: Url
37+
columnName: XdrUrl
38+
- entityType: Host
39+
fieldMappings:
40+
- identifier: HostName
41+
columnName: Hosts_s
42+
sentinelEntitiesMappings: null
43+
query: |
44+
PaloAltoCortexXDR_Incidents
45+
| where Severity contains "low"
46+
| where Status !contains "resolved_auto"
47+
// the below line filters for incidents that has at least one user or one host in it. Comment the below line if you want to generated incidents that have 0 user or 0 host as well
48+
| where HostCount > 0 or UserCount > 0
49+
| extend Hosts_s = tostring(Hosts), Users_s = tostring(Users)
50+
| project TimeGenerated, IncidentId, Status, Severity, IncidentSources, Description, XdrUrl, Hosts_s, Users_s, AlertCategories, HostCount, UserCount, AlertCount, CreationTime, ModificationTime
51+
version: 1.0.0
52+
kind: Scheduled

‎Solutions/Palo Alto Cortex XDR/Analytic Rules/PaloAltoCortexXDR_Medium.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
id: 2e638f3d-611f-4281-81b1-1fd4aa240ffb
2+
name: Cortex XDR Incident - Medium
3+
description: |
4+
'A new incident was created in the Cortex XDR portal with a severity "Medium". Click on the events for incident details. '
5+
severity: Medium
6+
requiredDataConnectors:
7+
- connectorId: CortexXDRDataConnector
8+
dataTypes:
9+
- PaloAltoCortexXDR_Incidents_CL
10+
queryFrequency: 5m
11+
queryPeriod: 5m
12+
triggerOperator: gt
13+
triggerThreshold: 0
14+
suppressionDuration: 5h
15+
suppressionEnabled: false
16+
tactics: []
17+
relevantTechniques: []
18+
incidentConfiguration:
19+
createIncident: true
20+
groupingConfiguration:
21+
enabled: true
22+
reopenClosedIncident: false
23+
lookbackDuration: PT5H
24+
matchingMethod: AllEntities
25+
eventGroupingSettings:
26+
aggregationKind: SingleAlert
27+
alertDetailsOverride: null
28+
customDetails: null
29+
entityMappings:
30+
- entityType: Account
31+
fieldMappings:
32+
- identifier: Name
33+
columnName: Users_s
34+
- entityType: URL
35+
fieldMappings:
36+
- identifier: Url
37+
columnName: XdrUrl
38+
- entityType: Host
39+
fieldMappings:
40+
- identifier: HostName
41+
columnName: Hosts_s
42+
sentinelEntitiesMappings: null
43+
query: |
44+
PaloAltoCortexXDR_Incidents
45+
| where Severity contains "medium"
46+
| where Status !contains "resolved_auto"
47+
// the below line filters for incidents that has at least one user or one host in it. Comment the below line if you want to generated incidents that have 0 user or 0 host as well
48+
| where HostCount > 0 or UserCount > 0
49+
| extend Hosts_s = tostring(Hosts), Users_s = tostring(Users)
50+
| project TimeGenerated, IncidentId, Status, Severity, IncidentSources, Description, XdrUrl, Hosts_s, Users_s, AlertCategories, HostCount, UserCount, AlertCount, CreationTime, ModificationTime
51+
version: 1.0.0
52+
kind: Scheduled

Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/DCR.json renamed to Solutions/Palo Alto Cortex XDR/Data Connectors/CortexXDR_ccp/DCR.json

File renamed without changes.

Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/DataConnectorDefinition.json renamed to Solutions/Palo Alto Cortex XDR/Data Connectors/CortexXDR_ccp/DataConnectorDefinition.json

File renamed without changes.

Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/PollingConfig.json renamed to Solutions/Palo Alto Cortex XDR/Data Connectors/CortexXDR_ccp/PollingConfig.json

File renamed without changes.

0 commit comments

Comments
 (0)