Merge remote-tracking branch 'origin/master' into users/v-rodrigolop/airlock

Author: RodrigoLopezCam

.script/tests/KqlvalidationsTests/CustomTables/PaloAltoCortexXDR_Incidents.json

@@ -0,0 +1,117 @@
+{
+  "Name": "PaloAltoCortexXDR_Incidents",
+  "Properties": [
+    {
+        "Name": "TimeGenerated",
+        "Type": "Datetime"
+    },
+    {
+        "Name": "IncidentId",
+        "Type": "String"
+    },
+    {
+        "Name": "IncidentName",
+        "Type": "String"
+    },
+    {
+        "Name": "CreationTime",
+        "Type": "Datetime"
+    },
+    {
+        "Name": "ModificationTime",
+        "Type": "Datetime"
+    },
+    {
+        "Name": "DetectionTime",
+        "Type": "Datetime"
+    },
+    {
+        "Name": "Status",
+        "Type": "String"
+    },
+    {
+        "Name": "Severity",
+        "Type": "String"
+    },
+    {
+        "Name": "Description",
+        "Type": "String"
+    },
+    {
+        "Name": "AlertCount",
+        "Type": "Int"
+    },
+    {
+        "Name": "LowSeverityAlertCount",
+        "Type": "Int"
+    },
+    {
+        "Name": "MedSeverityAlertCount",
+        "Type": "Int"
+    },
+    {
+        "Name": "HighSeverityAlertCount",
+        "Type": "Int"
+    },
+    {
+        "Name": "CriticalSeverityAlertCount",
+        "Type": "Int"
+    },
+    {
+        "Name": "UserCount",
+        "Type": "Int"
+    },
+    {
+        "Name": "HostCount",
+        "Type": "Int"
+    },
+    {
+        "Name": "ResolveComment",
+        "Type": "String"
+    },
+    {
+        "Name": "ResolvedTimestamp",
+        "Type": "Datetime"
+    },
+    {
+        "Name": "XdrUrl",
+        "Type": "String"
+    },
+    {
+        "Name": "Starred",
+        "Type": "Bool"
+    },
+    {
+        "Name": "Hosts",
+        "Type": "Dynamic"
+    },
+    {
+        "Name": "Users",
+        "Type": "Dynamic"
+    },
+    {
+        "Name": "IncidentSources",
+        "Type": "Dynamic"
+    },
+    {
+        "Name": "WildfireHits",
+        "Type": "Int"
+    },
+    {
+        "Name": "AlertsGroupingStatus",
+        "Type": "String"
+    },
+    {
+        "Name": "AlertCategories",
+        "Type": "Dynamic"
+    },
+    {
+        "Name": "OriginalTags",
+        "Type": "Dynamic"
+    },
+    {
+        "Name": "Tags",
+        "Type": "Dynamic"
+    }
+  ]
+}

.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json

@@ -241,6 +241,7 @@
   "MicrosoftDefenderThreatIntelligence",
   "ZeroFox_Alert_Polling",
   "CortexXDR",
+  "CortexXDRDataConnector",
   "CorelightConnectorExporter",
   "MimecastSIEMAPI",
   "MimecastTTPAPI",

Solutions/NetApp Ransomware Resilience/Data/Solution_NetAppRansomwareResilience.json

@@ -7,12 +7,15 @@
     "Playbooks": [
         "Playbooks/NetApp-RansomwareResilience-Auth-Playbook/azuredeploy.json",
         "Playbooks/NetApp-RansomwareResilience_Volume_Offline_Playbook/azuredeploy.json",
+        "Playbooks/NetApp-RansomwareResilience_Volume_Online_Playbook/azuredeploy.json",
         "Playbooks/NetApp-RansomwareResilience_Async_Poll_Playbook/azuredeploy.json",
         "Playbooks/NetApp-RansomwareResilience_Volume_Snapshot_Playbook/azuredeploy.json",
         "Playbooks/NetApp-RansomwareResilience_Enrich_StorageVM_Playbook/azuredeploy.json",
-        "Playbooks/NetApp-RansomwareResilience_Enrich_IP_Playbook/azuredeploy.json"
+        "Playbooks/NetApp-RansomwareResilience_Enrich_IP_Playbook/azuredeploy.json",
+        "Playbooks/NetApp-RansomwareResilience_Block_User_Playbook/azuredeploy.json",
+        "Playbooks/NetApp-RansomwareResilience_Unblock_User_Playbook/azuredeploy.json"
     ],
-    "Version": "3.0.0",
+    "Version": "3.1.0",
     "BasePath": "C:\\GitHub\\Azure-Sentinel\\solutions\\NetApp Ransomware Resilience",
     "Metadata": "SolutionMetadata.json",
     "TemplateSpec": true,

Solutions/NetApp Ransomware Resilience/Package/3.1.0.zip

@@ -6,7 +6,7 @@
     "config": {
       "isWizard": false,
       "basics": {
-        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/NetApp.svg\" alt=\"NetApp Logo\" width=\"75\" height=\"75\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/NetApp%20Ransomware%20Resilience/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nNetApp Ransomware Resilience - Comprehensive security solution for detecting and responding to ransomware threats across NetApp storage environments.\n\n**Playbooks:** 6\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/NetApp.svg\" alt=\"NetApp Logo\" width=\"75\" height=\"75\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/NetApp%20Ransomware%20Resilience/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nNetApp Ransomware Resilience - Comprehensive security solution for detecting and responding to ransomware threats across NetApp storage environments.\n\n**Playbooks:** 9\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
         "subscription": {
           "resourceProviders": [
             "Microsoft.OperationsManagement/solutions",