Skip to content

Commit a8e7cb6

Browse files
shashankshah-contrastshashankshah-contrast
authored
[ContrastADR] - CCF Data Connector Support (#13954)
* Adding support of ccf data connector and relavent component change in Contrast ADR * Resolving ARM TTK validation fails * Resolving Copilot review changes * Change BasePath to resolve detectiontemplate validation * Revert existing data connector files * Add comma in validconnectorIds.json
1 parent 1181bfc commit a8e7cb6

33 files changed

Lines changed: 4321 additions & 890 deletions

‎.script/tests/KqlvalidationsTests/CustomTables/ContrastADRAttackEvents_CL.json‎

Lines changed: 321 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,321 @@
1+
{
2+
"Name": "ContrastADRAttackEvents_CL",
3+
"Properties": [
4+
{
5+
"Name": "TimeGenerated",
6+
"Type": "datetime"
7+
},
8+
{
9+
"Name": "agentVersion",
10+
"Type": "string"
11+
},
12+
{
13+
"Name": "applicationId",
14+
"Type": "string"
15+
},
16+
{
17+
"Name": "associatedAt",
18+
"Type": "datetime"
19+
},
20+
{
21+
"Name": "attackPayload",
22+
"Type": "dynamic"
23+
},
24+
{
25+
"Name": "detectedTime",
26+
"Type": "long"
27+
},
28+
{
29+
"Name": "environment",
30+
"Type": "string"
31+
},
32+
{
33+
"Name": "eventUuid",
34+
"Type": "string"
35+
},
36+
{
37+
"Name": "incidentId",
38+
"Type": "string"
39+
},
40+
{
41+
"Name": "issueId",
42+
"Type": "string"
43+
},
44+
{
45+
"Name": "mitreTactics",
46+
"Type": "dynamic"
47+
},
48+
{
49+
"Name": "nativeId",
50+
"Type": "string"
51+
},
52+
{
53+
"Name": "observationId",
54+
"Type": "string"
55+
},
56+
{
57+
"Name": "observationType",
58+
"Type": "string"
59+
},
60+
{
61+
"Name": "organizationUuid",
62+
"Type": "string"
63+
},
64+
{
65+
"Name": "result",
66+
"Type": "string"
67+
},
68+
{
69+
"Name": "rule",
70+
"Type": "string"
71+
},
72+
{
73+
"Name": "ruleUuid",
74+
"Type": "string"
75+
},
76+
{
77+
"Name": "severity",
78+
"Type": "string"
79+
},
80+
{
81+
"Name": "sourceIp",
82+
"Type": "string"
83+
},
84+
{
85+
"Name": "timestamp",
86+
"Type": "datetime"
87+
},
88+
{
89+
"Name": "url",
90+
"Type": "string"
91+
},
92+
{
93+
"Name": "server",
94+
"Type": "dynamic"
95+
},
96+
{
97+
"Name": "application",
98+
"Type": "dynamic"
99+
},
100+
{
101+
"Name": "host",
102+
"Type": "dynamic"
103+
},
104+
{
105+
"Name": "request",
106+
"Type": "dynamic"
107+
},
108+
{
109+
"Name": "attackPayload_attackerInput",
110+
"Type": "dynamic"
111+
},
112+
{
113+
"Name": "parameters",
114+
"Type": "dynamic"
115+
},
116+
{
117+
"Name": "vectorAnalysis_vectorFields",
118+
"Type": "dynamic"
119+
},
120+
{
121+
"Name": "applicationMetadata",
122+
"Type": "dynamic"
123+
},
124+
{
125+
"Name": "server_id",
126+
"Type": "real"
127+
},
128+
{
129+
"Name": "server_name",
130+
"Type": "string"
131+
},
132+
{
133+
"Name": "application_id",
134+
"Type": "string"
135+
},
136+
{
137+
"Name": "application_name",
138+
"Type": "string"
139+
},
140+
{
141+
"Name": "application_agentLanguage",
142+
"Type": "string"
143+
},
144+
{
145+
"Name": "host_operatingSystem",
146+
"Type": "string"
147+
},
148+
{
149+
"Name": "host_runtimePath",
150+
"Type": "string"
151+
},
152+
{
153+
"Name": "host_runtimeVersion",
154+
"Type": "string"
155+
},
156+
{
157+
"Name": "host_hostname",
158+
"Type": "string"
159+
},
160+
{
161+
"Name": "host_isKubernetes",
162+
"Type": "bool"
163+
},
164+
{
165+
"Name": "host_isDocker",
166+
"Type": "bool"
167+
},
168+
{
169+
"Name": "attackPayload_attackerInput_confirmedAttack",
170+
"Type": "bool"
171+
},
172+
{
173+
"Name": "attackPayload_attackerInput_effectiveAttack",
174+
"Type": "bool"
175+
},
176+
{
177+
"Name": "attackPayload_attackerInput_applicableAttack",
178+
"Type": "bool"
179+
},
180+
{
181+
"Name": "attackPayload_attackerInput_patternsMatched",
182+
"Type": "dynamic"
183+
},
184+
{
185+
"Name": "attackPayload_attackerInput_filters",
186+
"Type": "dynamic"
187+
},
188+
{
189+
"Name": "attackPayload_attackerInput_name",
190+
"Type": "string"
191+
},
192+
{
193+
"Name": "attackPayload_attackerInput_inputType",
194+
"Type": "string"
195+
},
196+
{
197+
"Name": "attackPayload_attackerInput_type",
198+
"Type": "string"
199+
},
200+
{
201+
"Name": "attackPayload_attackerInput_documentType",
202+
"Type": "string"
203+
},
204+
{
205+
"Name": "attackPayload_attackerInput_documentPath",
206+
"Type": "string"
207+
},
208+
{
209+
"Name": "attackPayload_url",
210+
"Type": "string"
211+
},
212+
{
213+
"Name": "attackPayload_value",
214+
"Type": "string"
215+
},
216+
{
217+
"Name": "request_method",
218+
"Type": "string"
219+
},
220+
{
221+
"Name": "request_protocol",
222+
"Type": "string"
223+
},
224+
{
225+
"Name": "request_protocolVersion",
226+
"Type": "string"
227+
},
228+
{
229+
"Name": "request_headers_accept",
230+
"Type": "dynamic"
231+
},
232+
{
233+
"Name": "request_headers_connection",
234+
"Type": "dynamic"
235+
},
236+
{
237+
"Name": "request_headers_user_agent",
238+
"Type": "dynamic"
239+
},
240+
{
241+
"Name": "request_headers_referer",
242+
"Type": "dynamic"
243+
},
244+
{
245+
"Name": "request_headers_host",
246+
"Type": "dynamic"
247+
},
248+
{
249+
"Name": "request_headers_contrasttraceparent",
250+
"Type": "dynamic"
251+
},
252+
{
253+
"Name": "request_headers_x_request_id",
254+
"Type": "dynamic"
255+
},
256+
{
257+
"Name": "request_headers_content_length",
258+
"Type": "dynamic"
259+
},
260+
{
261+
"Name": "request_headers_x_forwarded_proto",
262+
"Type": "dynamic"
263+
},
264+
{
265+
"Name": "request_headers_x_forwarded_port",
266+
"Type": "dynamic"
267+
},
268+
{
269+
"Name": "request_headers_x_real_ip",
270+
"Type": "dynamic"
271+
},
272+
{
273+
"Name": "request_headers_x_forwarded_scheme",
274+
"Type": "dynamic"
275+
},
276+
{
277+
"Name": "request_headers_x_forwarded_host",
278+
"Type": "dynamic"
279+
},
280+
{
281+
"Name": "request_headers_content_type",
282+
"Type": "dynamic"
283+
},
284+
{
285+
"Name": "request_headers_x_scheme",
286+
"Type": "dynamic"
287+
},
288+
{
289+
"Name": "request_headers_accept_encoding",
290+
"Type": "dynamic"
291+
},
292+
{
293+
"Name": "request_headers_cookie",
294+
"Type": "dynamic"
295+
},
296+
{
297+
"Name": "request_body",
298+
"Type": "string"
299+
},
300+
{
301+
"Name": "request_queryString",
302+
"Type": "string"
303+
},
304+
{
305+
"Name": "vectorAnalysis_callLocation",
306+
"Type": "string"
307+
},
308+
{
309+
"Name": "codeLocation_file",
310+
"Type": "string"
311+
},
312+
{
313+
"Name": "codeLocation_method",
314+
"Type": "string"
315+
},
316+
{
317+
"Name": "codeLocation_stack",
318+
"Type": "dynamic"
319+
}
320+
]
321+
}

0 commit comments

Comments
 (0)