Skip to content

Commit a858ba1

Browse files
RodrigoLopezCamRodrigoLopezCam
committed
Airlock Digital: multi-instance support + ingestion fixes
1 parent c2d0c06 commit a858ba1

11 files changed

Lines changed: 446 additions & 128 deletions

‎Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/AirlockDigital_ConnectorDefinition.json‎

Lines changed: 109 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535
"sampleQueries": [
3636
{
3737
"description": "Get sample of 20 recent events",
38-
"query": "AirlockDigitalExecutionHistories\n| take 20"
38+
"query": "AirlockDigitalExecutionHistories\n| top 20 by TimeGenerated desc"
3939
}
4040
],
4141
"dataTypes": [
@@ -97,51 +97,126 @@
9797
{
9898
"type": "Markdown",
9999
"parameters": {
100-
"content": "**Before you begin:**\r\n- Access to your Airlock Digital server\r\n- API Key from Airlock Digital (User Menu > Settings > API Keys)\r\n- Server must be accessible from Azure (ensure firewall allows connections)\r\n\r\n**Base URL:** Enter your Airlock Digital server URL. Default port is 3129 for REST API.\r\nExample: `https://airlock.company.com:3129`"
101-
}
102-
},
103-
{
104-
"type": "Textbox",
105-
"parameters": {
106-
"label": "Base URL",
107-
"placeholder": "https://server.name:3129",
108-
"type": "text",
109-
"name": "BaseUrl",
110-
"validations": {
111-
"required": true
112-
}
113-
}
114-
},
115-
{
116-
"type": "Textbox",
117-
"parameters": {
118-
"label": "API Key",
119-
"placeholder": "Enter your Airlock Digital API Key",
120-
"type": "password",
121-
"name": "apiKey",
122-
"validations": {
123-
"required": true
124-
}
100+
"content": "**Before you begin:**\r\n- Access to your Airlock Digital server\r\n- API Key from Airlock Digital (User Menu > Settings > API Keys)\r\n- Server must be accessible from Azure (ensure firewall allows connections)\r\n\r\n**Base URL:** Enter your Airlock Digital server URL. Default port is 3129 for REST API.\r\nExample: `https://airlock.company.com:3129`\r\n\r\n**The connector collects:**\r\n- **Server Activities**: Administrative actions, policy changes, agent check-ins, and repository updates\r\n- **Execution Histories**: File execution events including blocked, audited, and trusted executions with file hashes, publishers, and user details\r\n- **File Activity Summary**: Aggregated statistics on file activity, security events, and execution trends\r\n\r\n**Data refresh:** Logs are retrieved every 5 minutes. Data should appear within 5-10 minutes after connection."
125101
}
126102
}
127103
]
128104
},
129105
{
130-
"title": "2. Connect and Start Data Collection",
131-
"description": "Click Connect to start ingesting Airlock Digital logs",
106+
"title": "2. Connect Airlock Digital servers to Microsoft Sentinel",
107+
"description": "This connector supports multiple simultaneous connections. Add one connection per Airlock Digital server; each connection ingests the selected data types in parallel. Use the grid below to review existing connections or add a new one.",
132108
"instructions": [
133109
{
134-
"type": "Markdown",
110+
"type": "DataConnectorsGrid",
135111
"parameters": {
136-
"content": "**The connector collects:**\r\n- **Execution Histories**: File execution events including blocked, audited, and trusted executions with file hashes, publishers, and user details\r\n- **Server Activities**: Administrative actions, policy changes, agent check-ins, and repository updates\r\n- **File Activity Summary**: Aggregated statistics on file activity, security events, and execution trends\r\n\r\n**Data refresh:** Logs are retrieved every 5 minutes. Data should appear within 5-10 minutes after connection."
112+
"mapping": [
113+
{
114+
"columnName": "Connector Name",
115+
"columnValue": "properties.addOnAttributes.friendlyName"
116+
},
117+
{
118+
"columnName": "Data Type",
119+
"columnValue": "properties.addOnAttributes.dataType"
120+
},
121+
{
122+
"columnName": "Endpoint",
123+
"columnValue": "properties.request.apiEndpoint"
124+
}
125+
],
126+
"menuItems": [
127+
"DeleteConnector"
128+
]
137129
}
138130
},
139131
{
140-
"type": "ConnectionToggleButton",
132+
"type": "ContextPane",
141133
"parameters": {
142-
"connectLabel": "Connect",
143-
"disconnectLabel": "Disconnect",
144-
"name": "toggle"
134+
"isPrimary": true,
135+
"label": "Add Connection",
136+
"title": "Connect an Airlock Digital server",
137+
"subtitle": "Airlock Digital",
138+
"contextPaneType": "DataConnectorsContextPane",
139+
"instructionSteps": [
140+
{
141+
"instructions": [
142+
{
143+
"type": "Markdown",
144+
"parameters": {
145+
"content": "## Connection details\n\nProvide the Airlock Digital server URL and API key, then choose which data types to collect. Create a separate connection for each Airlock Digital server."
146+
}
147+
},
148+
{
149+
"type": "Textbox",
150+
"parameters": {
151+
"label": "Base URL",
152+
"placeholder": "https://server.name:3129",
153+
"type": "text",
154+
"name": "BaseUrl",
155+
"validations": {
156+
"required": true
157+
}
158+
}
159+
},
160+
{
161+
"type": "Textbox",
162+
"parameters": {
163+
"label": "API Key",
164+
"placeholder": "Enter your Airlock Digital API Key",
165+
"type": "password",
166+
"name": "apiKey",
167+
"validations": {
168+
"required": true
169+
}
170+
}
171+
},
172+
{
173+
"type": "Dropdown",
174+
"parameters": {
175+
"label": "Data Types",
176+
"name": "selectedDataTypes",
177+
"options": [
178+
{
179+
"key": "AirlockDigitalServerActivities",
180+
"text": "Server Activities"
181+
},
182+
{
183+
"key": "AirlockDigitalExecutionHistories",
184+
"text": "Execution Histories"
185+
},
186+
{
187+
"key": "AirlockDigitalFileActivitySummary",
188+
"text": "File Activity Summary"
189+
}
190+
],
191+
"placeholder": "Select data types to collect...",
192+
"isMultiSelect": true,
193+
"defaultAllSelected": true,
194+
"required": true
195+
}
196+
},
197+
{
198+
"type": "Textbox",
199+
"parameters": {
200+
"label": "Connector Friendly Name",
201+
"placeholder": "Enter a unique friendly name for this connection",
202+
"type": "text",
203+
"name": "friendlyName",
204+
"validations": {
205+
"required": true
206+
}
207+
}
208+
},
209+
{
210+
"type": "InfoMessage",
211+
"parameters": {
212+
"text": "The friendly name helps you identify this connection in the grid and in the collected data.",
213+
"visible": true,
214+
"inline": true
215+
}
216+
}
217+
]
218+
}
219+
]
145220
}
146221
}
147222
]

‎Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/AirlockDigital_DCR.json‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@
2727
{
2828
"name": "description",
2929
"type": "string"
30+
},
31+
{
32+
"name": "friendlyName",
33+
"type": "string"
3034
}
3135
]
3236
},
@@ -131,6 +135,10 @@
131135
{
132136
"name": "extbrowser",
133137
"type": "string"
138+
},
139+
{
140+
"name": "friendlyName",
141+
"type": "string"
134142
}
135143
]
136144
},
@@ -160,6 +168,10 @@
160168
"name": "malicious_files_count",
161169
"type": "int"
162170
},
171+
{
172+
"name": "friendlyName",
173+
"type": "string"
174+
},
163175
{
164176
"name": "execution_summary",
165177
"type": "dynamic"
@@ -184,7 +196,7 @@
184196
"clv2ws1"
185197
],
186198
"outputStream": "Custom-AirlockDigitalServerActivities_CL",
187-
"transformKql": "source | extend TimeGenerated = todatetime(['datetime']) , Checkpoint = ['checkpoint'] , EventDateTime = ['datetime'] , Task = ['task'] , User = ['user'] , Description = ['description'] | project TimeGenerated , Checkpoint , EventDateTime , Task , User , Description"
199+
"transformKql": "source | extend TimeGenerated = todatetime(['datetime']) , Checkpoint = ['checkpoint'] , EventDateTime = ['datetime'] , Task = ['task'] , User = ['user'] , Description = ['description'] , ConnectorName = ['friendlyName'] | project TimeGenerated , Checkpoint , EventDateTime , Task , User , Description , ConnectorName"
188200
},
189201
{
190202
"streams": [
@@ -194,7 +206,7 @@
194206
"clv2ws1"
195207
],
196208
"outputStream": "Custom-AirlockDigitalExecutionHistories_CL",
197-
"transformKql": "source | extend TimeGenerated = todatetime(['datetime']) , Checkpoint = ['checkpoint'] , EventDateTime = ['datetime'] , ExecutionType = ['type'] , Username = ['username'] , Hostname = ['hostname'] , NetDomain = ['netdomain'] , FileName = ['filename'] , ParentPolicy = ['ppolicy'] , PolicyName = ['policyname'] , PolicyVersion = ['policyver'] , CommandLine = ['commandline'] , Publisher = ['publisher'] , ParentProcess = ['pprocess'] , GrandparentProcess = ['gprocess'] , SHA256 = ['sha256'] , MD5 = ['md5'] , SHA128 = ['sha128'] , SHA384 = ['sha384'] , SHA512 = ['sha512'] , IPAddress = ['ip'] , LocalIPAddress = ['localip'] , ExtensionId = ['extid'] , ExtensionName = ['extname'] , ExtensionType = ['exttype'] , ExtensionBrowser = ['extbrowser'] | project TimeGenerated , Checkpoint , EventDateTime , ExecutionType , Username , Hostname , NetDomain , FileName , ParentPolicy , PolicyName , PolicyVersion , CommandLine , Publisher , ParentProcess , GrandparentProcess , SHA256 , MD5 , SHA128 , SHA384 , SHA512 , IPAddress , LocalIPAddress , ExtensionId , ExtensionName , ExtensionType , ExtensionBrowser"
209+
"transformKql": "source | extend TimeGenerated = todatetime(['datetime']) , Checkpoint = ['checkpoint'] , EventDateTime = ['datetime'] , ExecutionType = ['type'] , Username = ['username'] , Hostname = ['hostname'] , NetDomain = ['netdomain'] , FileName = ['filename'] , ParentPolicy = ['ppolicy'] , PolicyName = ['policyname'] , PolicyVersion = ['policyver'] , CommandLine = ['commandline'] , Publisher = ['publisher'] , ParentProcess = ['pprocess'] , GrandparentProcess = ['gprocess'] , SHA256 = ['sha256'] , MD5 = ['md5'] , SHA128 = ['sha128'] , SHA384 = ['sha384'] , SHA512 = ['sha512'] , IPAddress = ['ip'] , LocalIPAddress = ['localip'] , ExtensionId = ['extid'] , ExtensionName = ['extname'] , ExtensionType = ['exttype'] , ExtensionBrowser = ['extbrowser'] , ConnectorName = ['friendlyName'] | project TimeGenerated , Checkpoint , EventDateTime , ExecutionType , Username , Hostname , NetDomain , FileName , ParentPolicy , PolicyName , PolicyVersion , CommandLine , Publisher , ParentProcess , GrandparentProcess , SHA256 , MD5 , SHA128 , SHA384 , SHA512 , IPAddress , LocalIPAddress , ExtensionId , ExtensionName , ExtensionType , ExtensionBrowser , ConnectorName"
198210
},
199211
{
200212
"streams": [
@@ -204,7 +216,7 @@
204216
"clv2ws1"
205217
],
206218
"outputStream": "Custom-AirlockDigitalFileActivitySummary_CL",
207-
"transformKql": "source | extend TimeGenerated = now() , TimePeriod = ['time_period'] , StartDate = ['start_date'] , EndDate = ['end_date'] , PolicyFilter = ['policy_filter'] , NewFilesCount = ['new_files_count'] , MaliciousFilesCount = ['malicious_files_count'] , TotalUntrustedTotal = toint(execution_summary.total_untrusted_total) , TotalUntrustedUnique = toint(execution_summary.total_untrusted_unique) , BlockedTotal = toint(execution_summary.blocked_total) , BlockedUnique = toint(execution_summary.blocked_unique) , AuditTotal = toint(execution_summary.audit_total) , AuditUnique = toint(execution_summary.audit_unique) , TrustedTotal = toint(execution_summary.trusted_total) , OtpTotal = toint(execution_summary.otp_total) , BlocklistTotal = toint(execution_summary.blocklist_total) , BlocklistAuditTotal = toint(execution_summary.blocklist_audit_total) | project TimeGenerated , TimePeriod , StartDate , EndDate , PolicyFilter , NewFilesCount , MaliciousFilesCount , TotalUntrustedTotal , TotalUntrustedUnique , BlockedTotal , BlockedUnique , AuditTotal , AuditUnique , TrustedTotal , OtpTotal , BlocklistTotal , BlocklistAuditTotal"
219+
"transformKql": "source | extend TimeGenerated = todatetime(['end_date']) , TimePeriod = ['time_period'] , StartDate = ['start_date'] , EndDate = ['end_date'] , PolicyFilter = ['policy_filter'] , NewFilesCount = ['new_files_count'] , MaliciousFilesCount = ['malicious_files_count'] , TotalUntrustedTotal = toint(execution_summary.total_untrusted_total) , TotalUntrustedUnique = toint(execution_summary.total_untrusted_unique) , BlockedTotal = toint(execution_summary.blocked_total) , BlockedUnique = toint(execution_summary.blocked_unique) , AuditTotal = toint(execution_summary.audit_total) , AuditUnique = toint(execution_summary.audit_unique) , TrustedTotal = toint(execution_summary.trusted_total) , OtpTotal = toint(execution_summary.otp_total) , BlocklistTotal = toint(execution_summary.blocklist_total) , BlocklistAuditTotal = toint(execution_summary.blocklist_audit_total) , ConnectorName = ['friendlyName'] | project TimeGenerated , TimePeriod , StartDate , EndDate , PolicyFilter , NewFilesCount , MaliciousFilesCount , TotalUntrustedTotal , TotalUntrustedUnique , BlockedTotal , BlockedUnique , AuditTotal , AuditUnique , TrustedTotal , OtpTotal , BlocklistTotal , BlocklistAuditTotal , ConnectorName"
208220
}
209221
]
210222
}

‎Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/AirlockDigital_PollerConfig.json‎

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
{
33
"type": "Microsoft.SecurityInsights/dataConnectors",
44
"apiVersion": "2023-02-01-preview",
5-
"name": "AirlockDigitalServerActivitiesConnector",
5+
"name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/','AirlockDigitalServerActivities' , uniqueString(parameters('friendlyName')) )]",
66
"location": "{{location}}",
77
"kind": "RestApiPoller",
88
"properties": {
@@ -42,13 +42,18 @@
4242
"streamName": "Custom-AirlockDigitalServerActivities_CL",
4343
"dataCollectionEndpoint": "{{dataCollectionEndpoint}}",
4444
"dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}"
45+
},
46+
"addOnAttributes": {
47+
"friendlyName": "[[parameters('friendlyName')]",
48+
"dataType": "Server Activities"
4549
}
46-
}
50+
},
51+
"condition": "[[contains(parameters('selectedDataTypes'), 'AirlockDigitalServerActivities')]"
4752
},
4853
{
4954
"type": "Microsoft.SecurityInsights/dataConnectors",
5055
"apiVersion": "2023-02-01-preview",
51-
"name": "AirlockDigitalExecutionHistoriesConnector",
56+
"name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/','AirlockDigitalExecutionHistories' , uniqueString(parameters('friendlyName')) )]",
5257
"location": "{{location}}",
5358
"kind": "RestApiPoller",
5459
"properties": {
@@ -88,13 +93,18 @@
8893
"streamName": "Custom-AirlockDigitalExecutionHistories_CL",
8994
"dataCollectionEndpoint": "{{dataCollectionEndpoint}}",
9095
"dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}"
96+
},
97+
"addOnAttributes": {
98+
"friendlyName": "[[parameters('friendlyName')]",
99+
"dataType": "Execution Histories"
91100
}
92-
}
101+
},
102+
"condition": "[[contains(parameters('selectedDataTypes'), 'AirlockDigitalExecutionHistories')]"
93103
},
94104
{
95105
"type": "Microsoft.SecurityInsights/dataConnectors",
96106
"apiVersion": "2023-02-01-preview",
97-
"name": "AirlockDigitalFileActivitySummaryConnector",
107+
"name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/','AirlockDigitalFileActivitySummary' , uniqueString(parameters('friendlyName')) )]",
98108
"location": "{{location}}",
99109
"kind": "RestApiPoller",
100110
"properties": {
@@ -128,7 +138,12 @@
128138
"streamName": "Custom-AirlockDigitalFileActivitySummary_CL",
129139
"dataCollectionEndpoint": "{{dataCollectionEndpoint}}",
130140
"dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}"
141+
},
142+
"addOnAttributes": {
143+
"friendlyName": "[[parameters('friendlyName')]",
144+
"dataType": "File Activity Summary"
131145
}
132-
}
146+
},
147+
"condition": "[[contains(parameters('selectedDataTypes'), 'AirlockDigitalFileActivitySummary')]"
133148
}
134149
]

‎Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/table_AirlockDigitalExecutionHistories.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,11 @@
142142
"name": "ExtensionBrowser",
143143
"type": "string",
144144
"description": "Browser type (1=Chrome, 2=Firefox, 3=Edge)"
145+
},
146+
{
147+
"name": "ConnectorName",
148+
"type": "string",
149+
"description": "Connector Friendly Name assigned during connector setup"
145150
}
146151
]
147152
}

‎Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/table_AirlockDigitalFileActivitySummary.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,11 @@
9797
"name": "BlocklistAuditTotal",
9898
"type": "int",
9999
"description": "Total count of blocklist audit executions"
100+
},
101+
{
102+
"name": "ConnectorName",
103+
"type": "string",
104+
"description": "Connector Friendly Name assigned during connector setup"
100105
}
101106
]
102107
}

‎Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/table_AirlockDigitalServerActivities.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,11 @@
4242
"name": "Description",
4343
"type": "string",
4444
"description": "Detailed description of the server activity"
45+
},
46+
{
47+
"name": "ConnectorName",
48+
"type": "string",
49+
"description": "Connector Friendly Name assigned during connector setup"
4550
}
4651
]
4752
}

‎Solutions/AirlockDigital/Data/Solution_AirlockDigital.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
"Watchlists": [],
1818
"Playbooks": [],
1919
"BasePath": "C:\\Sentinel\\Azure-Sentinel\\Solutions\\AirlockDigital",
20-
"Version": "3.0.2",
20+
"Version": "3.1.0",
2121
"Metadata": "SolutionMetadata.json",
2222
"TemplateSpec": true,
2323
"Is1PConnector": false

‎Solutions/AirlockDigital/Package/3.0.2.zip‎

-10.4 KB
Binary file not shown.

‎Solutions/AirlockDigital/Package/3.1.0.zip‎

12.7 KB
Binary file not shown.

0 commit comments

Comments
 (0)