Skip to content

Commit 7900bd0

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request #14748 from RodrigoLopezCam/users/v-rodrigolop/airlock
[PuPr] Airlock Digital CCF Data Connector
2 parents c092be8 + ebdf22e commit 7900bd0

10 files changed

Lines changed: 459 additions & 149 deletions

‎Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/AirlockDigital_ConnectorDefinition.json‎

Lines changed: 110 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@
1010
"title": "Airlock Digital connector (via Codeless Connector Framework)",
1111
"publisher": "Microsoft",
1212
"descriptionMarkdown": "The Airlock Digital connector collects application control and execution logs from your Airlock Digital server, providing visibility into file executions, server activities, and security event summaries in Microsoft Sentinel.",
13-
"graphQueriesTableName": "AirlockDigitalExecutionHistories",
1413
"graphQueries": [
1514
{
1615
"metricName": "Total Server Activities received",
@@ -30,13 +29,13 @@
3029
{
3130
"metricName": "Blocked Executions",
3231
"legend": "Blocked Only",
33-
"baseQuery": "{{graphQueriesTableName}} | where ExecutionType == 1"
32+
"baseQuery": "AirlockDigitalExecutionHistories | where ExecutionType == 1"
3433
}
3534
],
3635
"sampleQueries": [
3736
{
3837
"description": "Get sample of 20 recent events",
39-
"query": "{{graphQueriesTableName}}\n| take 20"
38+
"query": "AirlockDigitalExecutionHistories\n| top 20 by TimeGenerated desc"
4039
}
4140
],
4241
"dataTypes": [
@@ -98,51 +97,126 @@
9897
{
9998
"type": "Markdown",
10099
"parameters": {
101-
"content": "**Before you begin:**\r\n- Access to your Airlock Digital server\r\n- API Key from Airlock Digital (User Menu > Settings > API Keys)\r\n- Server must be accessible from Azure (ensure firewall allows connections)\r\n\r\n**Base URL:** Enter your Airlock Digital server URL. Default port is 3129 for REST API.\r\nExample: `https://airlock.company.com:3129`"
102-
}
103-
},
104-
{
105-
"type": "Textbox",
106-
"parameters": {
107-
"label": "Base URL",
108-
"placeholder": "https://server.name:3129",
109-
"type": "text",
110-
"name": "BaseUrl",
111-
"validations": {
112-
"required": true
113-
}
114-
}
115-
},
116-
{
117-
"type": "Textbox",
118-
"parameters": {
119-
"label": "API Key",
120-
"placeholder": "Enter your Airlock Digital API Key",
121-
"type": "password",
122-
"name": "apiKey",
123-
"validations": {
124-
"required": true
125-
}
100+
"content": "**Before you begin:**\r\n- Access to your Airlock Digital server\r\n- API Key from Airlock Digital (User Menu > Settings > API Keys)\r\n- Server must be accessible from Azure (ensure firewall allows connections)\r\n\r\n**Base URL:** Enter your Airlock Digital server URL. Default port is 3129 for REST API.\r\nExample: `https://airlock.company.com:3129`\r\n\r\n**The connector collects:**\r\n- **Server Activities**: Administrative actions, policy changes, agent check-ins, and repository updates\r\n- **Execution Histories**: File execution events including blocked, audited, and trusted executions with file hashes, publishers, and user details\r\n- **File Activity Summary**: Aggregated statistics on file activity, security events, and execution trends\r\n\r\n**Data refresh:** Logs are retrieved every 5 minutes. Data should appear within 5-10 minutes after connection."
126101
}
127102
}
128103
]
129104
},
130105
{
131-
"title": "2. Connect and Start Data Collection",
132-
"description": "Click Connect to start ingesting Airlock Digital logs",
106+
"title": "2. Connect Airlock Digital servers to Microsoft Sentinel",
107+
"description": "This connector supports multiple simultaneous connections. Add one connection per Airlock Digital server; each connection ingests the selected data types in parallel. Use the grid below to review existing connections or add a new one.",
133108
"instructions": [
134109
{
135-
"type": "Markdown",
110+
"type": "DataConnectorsGrid",
136111
"parameters": {
137-
"content": "**The connector collects:**\r\n- **Execution Histories**: File execution events including blocked, audited, and trusted executions with file hashes, publishers, and user details\r\n- **Server Activities**: Administrative actions, policy changes, agent check-ins, and repository updates\r\n- **File Activity Summary**: Aggregated statistics on file activity, security events, and execution trends\r\n\r\n**Data refresh:** Logs are retrieved every 5 minutes. Data should appear within 5-10 minutes after connection."
112+
"mapping": [
113+
{
114+
"columnName": "Connector Name",
115+
"columnValue": "properties.addOnAttributes.friendlyName"
116+
},
117+
{
118+
"columnName": "Data Type",
119+
"columnValue": "properties.addOnAttributes.dataType"
120+
},
121+
{
122+
"columnName": "Endpoint",
123+
"columnValue": "properties.request.apiEndpoint"
124+
}
125+
],
126+
"menuItems": [
127+
"DeleteConnector"
128+
]
138129
}
139130
},
140131
{
141-
"type": "ConnectionToggleButton",
132+
"type": "ContextPane",
142133
"parameters": {
143-
"connectLabel": "Connect",
144-
"disconnectLabel": "Disconnect",
145-
"name": "toggle"
134+
"isPrimary": true,
135+
"label": "Add Connection",
136+
"title": "Connect an Airlock Digital server",
137+
"subtitle": "Airlock Digital",
138+
"contextPaneType": "DataConnectorsContextPane",
139+
"instructionSteps": [
140+
{
141+
"instructions": [
142+
{
143+
"type": "Markdown",
144+
"parameters": {
145+
"content": "## Connection details\n\nProvide the Airlock Digital server URL and API key, then choose which data types to collect. Create a separate connection for each Airlock Digital server."
146+
}
147+
},
148+
{
149+
"type": "Textbox",
150+
"parameters": {
151+
"label": "Base URL",
152+
"placeholder": "https://server.name:3129",
153+
"type": "text",
154+
"name": "BaseUrl",
155+
"validations": {
156+
"required": true
157+
}
158+
}
159+
},
160+
{
161+
"type": "Textbox",
162+
"parameters": {
163+
"label": "API Key",
164+
"placeholder": "Enter your Airlock Digital API Key",
165+
"type": "password",
166+
"name": "apiKey",
167+
"validations": {
168+
"required": true
169+
}
170+
}
171+
},
172+
{
173+
"type": "Dropdown",
174+
"parameters": {
175+
"label": "Data Types",
176+
"name": "selectedDataTypes",
177+
"options": [
178+
{
179+
"key": "AirlockDigitalServerActivities",
180+
"text": "Server Activities"
181+
},
182+
{
183+
"key": "AirlockDigitalExecutionHistories",
184+
"text": "Execution Histories"
185+
},
186+
{
187+
"key": "AirlockDigitalFileActivitySummary",
188+
"text": "File Activity Summary"
189+
}
190+
],
191+
"placeholder": "Select data types to collect...",
192+
"isMultiSelect": true,
193+
"defaultAllSelected": true,
194+
"required": true
195+
}
196+
},
197+
{
198+
"type": "Textbox",
199+
"parameters": {
200+
"label": "Connector Friendly Name",
201+
"placeholder": "Enter a unique friendly name for this connection",
202+
"type": "text",
203+
"name": "friendlyName",
204+
"validations": {
205+
"required": true
206+
}
207+
}
208+
},
209+
{
210+
"type": "InfoMessage",
211+
"parameters": {
212+
"text": "The friendly name helps you identify this connection in the grid and in the collected data.",
213+
"visible": true,
214+
"inline": true
215+
}
216+
}
217+
]
218+
}
219+
]
146220
}
147221
}
148222
]

‎Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/AirlockDigital_DCR.json‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@
2727
{
2828
"name": "description",
2929
"type": "string"
30+
},
31+
{
32+
"name": "friendlyName",
33+
"type": "string"
3034
}
3135
]
3236
},
@@ -131,6 +135,10 @@
131135
{
132136
"name": "extbrowser",
133137
"type": "string"
138+
},
139+
{
140+
"name": "friendlyName",
141+
"type": "string"
134142
}
135143
]
136144
},
@@ -160,6 +168,10 @@
160168
"name": "malicious_files_count",
161169
"type": "int"
162170
},
171+
{
172+
"name": "friendlyName",
173+
"type": "string"
174+
},
163175
{
164176
"name": "execution_summary",
165177
"type": "dynamic"
@@ -184,7 +196,7 @@
184196
"clv2ws1"
185197
],
186198
"outputStream": "Custom-AirlockDigitalServerActivities_CL",
187-
"transformKql": "source | extend TimeGenerated = todatetime(['datetime']) , Checkpoint = ['checkpoint'] , EventDateTime = ['datetime'] , Task = ['task'] , User = ['user'] , Description = ['description'] | project TimeGenerated , Checkpoint , EventDateTime , Task , User , Description"
199+
"transformKql": "source | extend TimeGenerated = todatetime(['datetime']) , Checkpoint = ['checkpoint'] , EventDateTime = ['datetime'] , Task = ['task'] , User = ['user'] , Description = ['description'] , ConnectorName = ['friendlyName'] | project TimeGenerated , Checkpoint , EventDateTime , Task , User , Description , ConnectorName"
188200
},
189201
{
190202
"streams": [
@@ -194,7 +206,7 @@
194206
"clv2ws1"
195207
],
196208
"outputStream": "Custom-AirlockDigitalExecutionHistories_CL",
197-
"transformKql": "source | extend TimeGenerated = todatetime(['datetime']) , Checkpoint = ['checkpoint'] , EventDateTime = ['datetime'] , ExecutionType = ['type'] , Username = ['username'] , Hostname = ['hostname'] , NetDomain = ['netdomain'] , FileName = ['filename'] , ParentPolicy = ['ppolicy'] , PolicyName = ['policyname'] , PolicyVersion = ['policyver'] , CommandLine = ['commandline'] , Publisher = ['publisher'] , ParentProcess = ['pprocess'] , GrandparentProcess = ['gprocess'] , SHA256 = ['sha256'] , MD5 = ['md5'] , SHA128 = ['sha128'] , SHA384 = ['sha384'] , SHA512 = ['sha512'] , IPAddress = ['ip'] , LocalIPAddress = ['localip'] , ExtensionId = ['extid'] , ExtensionName = ['extname'] , ExtensionType = ['exttype'] , ExtensionBrowser = ['extbrowser'] | project TimeGenerated , Checkpoint , EventDateTime , ExecutionType , Username , Hostname , NetDomain , FileName , ParentPolicy , PolicyName , PolicyVersion , CommandLine , Publisher , ParentProcess , GrandparentProcess , SHA256 , MD5 , SHA128 , SHA384 , SHA512 , IPAddress , LocalIPAddress , ExtensionId , ExtensionName , ExtensionType , ExtensionBrowser"
209+
"transformKql": "source | extend TimeGenerated = todatetime(['datetime']) , Checkpoint = ['checkpoint'] , EventDateTime = ['datetime'] , ExecutionType = ['type'] , Username = ['username'] , Hostname = ['hostname'] , NetDomain = ['netdomain'] , FileName = ['filename'] , ParentPolicy = ['ppolicy'] , PolicyName = ['policyname'] , PolicyVersion = ['policyver'] , CommandLine = ['commandline'] , Publisher = ['publisher'] , ParentProcess = ['pprocess'] , GrandparentProcess = ['gprocess'] , SHA256 = ['sha256'] , MD5 = ['md5'] , SHA128 = ['sha128'] , SHA384 = ['sha384'] , SHA512 = ['sha512'] , IPAddress = ['ip'] , LocalIPAddress = ['localip'] , ExtensionId = ['extid'] , ExtensionName = ['extname'] , ExtensionType = ['exttype'] , ExtensionBrowser = ['extbrowser'] , ConnectorName = ['friendlyName'] | project TimeGenerated , Checkpoint , EventDateTime , ExecutionType , Username , Hostname , NetDomain , FileName , ParentPolicy , PolicyName , PolicyVersion , CommandLine , Publisher , ParentProcess , GrandparentProcess , SHA256 , MD5 , SHA128 , SHA384 , SHA512 , IPAddress , LocalIPAddress , ExtensionId , ExtensionName , ExtensionType , ExtensionBrowser , ConnectorName"
198210
},
199211
{
200212
"streams": [
@@ -204,7 +216,7 @@
204216
"clv2ws1"
205217
],
206218
"outputStream": "Custom-AirlockDigitalFileActivitySummary_CL",
207-
"transformKql": "source | extend TimeGenerated = now() , TimePeriod = ['time_period'] , StartDate = ['start_date'] , EndDate = ['end_date'] , PolicyFilter = ['policy_filter'] , NewFilesCount = ['new_files_count'] , MaliciousFilesCount = ['malicious_files_count'] , TotalUntrustedTotal = toint(execution_summary.total_untrusted_total) , TotalUntrustedUnique = toint(execution_summary.total_untrusted_unique) , BlockedTotal = toint(execution_summary.blocked_total) , BlockedUnique = toint(execution_summary.blocked_unique) , AuditTotal = toint(execution_summary.audit_total) , AuditUnique = toint(execution_summary.audit_unique) , TrustedTotal = toint(execution_summary.trusted_total) , OtpTotal = toint(execution_summary.otp_total) , BlocklistTotal = toint(execution_summary.blocklist_total) , BlocklistAuditTotal = toint(execution_summary.blocklist_audit_total) | project TimeGenerated , TimePeriod , StartDate , EndDate , PolicyFilter , NewFilesCount , MaliciousFilesCount , TotalUntrustedTotal , TotalUntrustedUnique , BlockedTotal , BlockedUnique , AuditTotal , AuditUnique , TrustedTotal , OtpTotal , BlocklistTotal , BlocklistAuditTotal"
219+
"transformKql": "source | extend TimeGenerated = todatetime(['end_date']) , TimePeriod = ['time_period'] , StartDate = ['start_date'] , EndDate = ['end_date'] , PolicyFilter = ['policy_filter'] , NewFilesCount = ['new_files_count'] , MaliciousFilesCount = ['malicious_files_count'] , TotalUntrustedTotal = toint(execution_summary.total_untrusted_total) , TotalUntrustedUnique = toint(execution_summary.total_untrusted_unique) , BlockedTotal = toint(execution_summary.blocked_total) , BlockedUnique = toint(execution_summary.blocked_unique) , AuditTotal = toint(execution_summary.audit_total) , AuditUnique = toint(execution_summary.audit_unique) , TrustedTotal = toint(execution_summary.trusted_total) , OtpTotal = toint(execution_summary.otp_total) , BlocklistTotal = toint(execution_summary.blocklist_total) , BlocklistAuditTotal = toint(execution_summary.blocklist_audit_total) , ConnectorName = ['friendlyName'] | project TimeGenerated , TimePeriod , StartDate , EndDate , PolicyFilter , NewFilesCount , MaliciousFilesCount , TotalUntrustedTotal , TotalUntrustedUnique , BlockedTotal , BlockedUnique , AuditTotal , AuditUnique , TrustedTotal , OtpTotal , BlocklistTotal , BlocklistAuditTotal , ConnectorName"
208220
}
209221
]
210222
}

‎Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/AirlockDigital_PollerConfig.json‎

Lines changed: 26 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
{
33
"type": "Microsoft.SecurityInsights/dataConnectors",
44
"apiVersion": "2023-02-01-preview",
5-
"name": "AirlockDigitalServerActivitiesConnector",
5+
"name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/','AirlockDigitalServerActivities' , uniqueString(parameters('friendlyName')) )]",
66
"location": "{{location}}",
77
"kind": "RestApiPoller",
88
"properties": {
@@ -16,7 +16,7 @@
1616
"httpMethod": "POST",
1717
"queryWindowInMin": 5,
1818
"retryCount": 3,
19-
"timeoutInSeconds": 30,
19+
"timeoutInSeconds": 120,
2020
"isPostPayloadJson": true,
2121
"headers": {
2222
"Accept": "application/json",
@@ -32,7 +32,7 @@
3232
},
3333
"paging": {
3434
"pagingType": "PersistentToken",
35-
"nextPageTokenJsonPath": "$.response.svractivities[-1].checkpoint",
35+
"nextPageTokenJsonPath": "$.response.svractivities[-1:].checkpoint",
3636
"nextPageParaName": "checkpoint",
3737
"pagingInfoPlacement": "RequestBody"
3838
},
@@ -42,13 +42,18 @@
4242
"streamName": "Custom-AirlockDigitalServerActivities_CL",
4343
"dataCollectionEndpoint": "{{dataCollectionEndpoint}}",
4444
"dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}"
45+
},
46+
"addOnAttributes": {
47+
"friendlyName": "[[parameters('friendlyName')]",
48+
"dataType": "Server Activities"
4549
}
46-
}
50+
},
51+
"condition": "[[contains(parameters('selectedDataTypes'), 'AirlockDigitalServerActivities')]"
4752
},
4853
{
4954
"type": "Microsoft.SecurityInsights/dataConnectors",
5055
"apiVersion": "2023-02-01-preview",
51-
"name": "AirlockDigitalExecutionHistoriesConnector",
56+
"name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/','AirlockDigitalExecutionHistories' , uniqueString(parameters('friendlyName')) )]",
5257
"location": "{{location}}",
5358
"kind": "RestApiPoller",
5459
"properties": {
@@ -62,7 +67,7 @@
6267
"httpMethod": "POST",
6368
"queryWindowInMin": 5,
6469
"retryCount": 3,
65-
"timeoutInSeconds": 30,
70+
"timeoutInSeconds": 120,
6671
"isPostPayloadJson": true,
6772
"headers": {
6873
"Accept": "application/json",
@@ -78,7 +83,7 @@
7883
},
7984
"paging": {
8085
"pagingType": "PersistentToken",
81-
"nextPageTokenJsonPath": "$.response.exechistories[-1].checkpoint",
86+
"nextPageTokenJsonPath": "$.response.exechistories[-1:].checkpoint",
8287
"nextPageParaName": "checkpoint",
8388
"pagingInfoPlacement": "RequestBody"
8489
},
@@ -88,13 +93,18 @@
8893
"streamName": "Custom-AirlockDigitalExecutionHistories_CL",
8994
"dataCollectionEndpoint": "{{dataCollectionEndpoint}}",
9095
"dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}"
96+
},
97+
"addOnAttributes": {
98+
"friendlyName": "[[parameters('friendlyName')]",
99+
"dataType": "Execution Histories"
91100
}
92-
}
101+
},
102+
"condition": "[[contains(parameters('selectedDataTypes'), 'AirlockDigitalExecutionHistories')]"
93103
},
94104
{
95105
"type": "Microsoft.SecurityInsights/dataConnectors",
96106
"apiVersion": "2023-02-01-preview",
97-
"name": "AirlockDigitalFileActivitySummaryConnector",
107+
"name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/','AirlockDigitalFileActivitySummary' , uniqueString(parameters('friendlyName')) )]",
98108
"location": "{{location}}",
99109
"kind": "RestApiPoller",
100110
"properties": {
@@ -108,7 +118,7 @@
108118
"httpMethod": "POST",
109119
"queryWindowInMin": 5,
110120
"retryCount": 3,
111-
"timeoutInSeconds": 30,
121+
"timeoutInSeconds": 120,
112122
"isPostPayloadJson": true,
113123
"headers": {
114124
"Accept": "application/json",
@@ -128,7 +138,12 @@
128138
"streamName": "Custom-AirlockDigitalFileActivitySummary_CL",
129139
"dataCollectionEndpoint": "{{dataCollectionEndpoint}}",
130140
"dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}"
141+
},
142+
"addOnAttributes": {
143+
"friendlyName": "[[parameters('friendlyName')]",
144+
"dataType": "File Activity Summary"
131145
}
132-
}
146+
},
147+
"condition": "[[contains(parameters('selectedDataTypes'), 'AirlockDigitalFileActivitySummary')]"
133148
}
134149
]

0 commit comments

Comments
 (0)