Skip to content

Commit aeccea3

Browse files
v-dvedakv-dvedak
authored
Merge pull request #13523 from darktrace/darktrace-ccf
New Darktrace CCF integration
2 parents 80f3d94 + 7bbb6ae commit aeccea3

67 files changed

Lines changed: 8254 additions & 380 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.script/tests/KqlvalidationsTests/CustomTables/DarktraceASM_CL.json‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
{
2+
"Name": "DarktraceASM_CL",
3+
"Properties": [
4+
{
5+
"name": "TimeGenerated",
6+
"type": "datetime"
7+
},
8+
{
9+
"name": "action",
10+
"type": "string"
11+
},
12+
{
13+
"name": "alertTime",
14+
"type": "datetime"
15+
},
16+
{
17+
"name": "alertTimestamp",
18+
"type": "int"
19+
},
20+
{
21+
"name": "alertTitle",
22+
"type": "string"
23+
},
24+
{
25+
"name": "alertType",
26+
"type": "string"
27+
},
28+
{
29+
"name": "assetId",
30+
"type": "int"
31+
},
32+
{
33+
"name": "assetName",
34+
"type": "string"
35+
},
36+
{
37+
"name": "assetUri",
38+
"type": "string"
39+
},
40+
{
41+
"name": "customLabel",
42+
"type": "string"
43+
},
44+
{
45+
"name": "darktraceProduct",
46+
"type": "string"
47+
},
48+
{
49+
"name": "description",
50+
"type": "string"
51+
},
52+
{
53+
"name": "endTime",
54+
"type": "datetime"
55+
},
56+
{
57+
"name": "endTimestamp",
58+
"type": "int"
59+
},
60+
{
61+
"name": "previousRating",
62+
"type": "string"
63+
},
64+
{
65+
"name": "rating",
66+
"type": "string"
67+
},
68+
{
69+
"name": "riskId",
70+
"type": "int"
71+
},
72+
{
73+
"name": "riskUri",
74+
"type": "string"
75+
},
76+
{
77+
"name": "startTime",
78+
"type": "datetime"
79+
},
80+
{
81+
"name": "startTimestamp",
82+
"type": "int"
83+
},
84+
{
85+
"name": "state",
86+
"type": "string"
87+
},
88+
{
89+
"name": "workbenchUri",
90+
"type": "string"
91+
}
92+
]
93+
}

‎.script/tests/KqlvalidationsTests/CustomTables/DarktraceEMAIL_CL.json‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
{
2+
"Name": "DarktraceEMAIL_CL",
3+
"Properties": [
4+
{
5+
"name": "TimeGenerated",
6+
"type": "datetime"
7+
},
8+
{
9+
"name": "actions",
10+
"type": "dynamic"
11+
},
12+
{
13+
"name": "alertTime",
14+
"type": "datetime"
15+
},
16+
{
17+
"name": "anomalyScore",
18+
"type": "int"
19+
},
20+
{
21+
"name": "attachmentNames",
22+
"type": "dynamic"
23+
},
24+
{
25+
"name": "attachmentSha1s",
26+
"type": "dynamic"
27+
},
28+
{
29+
"name": "attachmentSha256s",
30+
"type": "dynamic"
31+
},
32+
{
33+
"name": "customLabel",
34+
"type": "string"
35+
},
36+
{
37+
"name": "darktraceProduct",
38+
"type": "string"
39+
},
40+
{
41+
"name": "direction",
42+
"type": "string"
43+
},
44+
{
45+
"name": "from",
46+
"type": "string"
47+
},
48+
{
49+
"name": "linkHosts",
50+
"type": "dynamic"
51+
},
52+
{
53+
"name": "messageId",
54+
"type": "string"
55+
},
56+
{
57+
"name": "recipientActions",
58+
"type": "dynamic"
59+
},
60+
{
61+
"name": "recipients",
62+
"type": "dynamic"
63+
},
64+
{
65+
"name": "subject",
66+
"type": "string"
67+
},
68+
{
69+
"name": "tags",
70+
"type": "dynamic"
71+
},
72+
{
73+
"name": "timestamp",
74+
"type": "datetime"
75+
},
76+
{
77+
"name": "url",
78+
"type": "string"
79+
},
80+
{
81+
"name": "uuid",
82+
"type": "string"
83+
}
84+
]
85+
}

‎.script/tests/KqlvalidationsTests/CustomTables/DarktraceIncidents_CL.json‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
{
2+
"Name": "DarktraceIncidents_CL",
3+
"Properties": [
4+
{
5+
"name": "TimeGenerated",
6+
"type": "datetime"
7+
},
8+
{
9+
"name": "activityId",
10+
"type": "string"
11+
},
12+
{
13+
"name": "aiaScore",
14+
"type": "int"
15+
},
16+
{
17+
"name": "bestAssetName",
18+
"type": "string"
19+
},
20+
{
21+
"name": "currentGroup",
22+
"type": "string"
23+
},
24+
{
25+
"name": "customLabel",
26+
"type": "string"
27+
},
28+
{
29+
"name": "darktraceProduct",
30+
"type": "string"
31+
},
32+
{
33+
"name": "deviceHostname",
34+
"type": "string"
35+
},
36+
{
37+
"name": "deviceIp",
38+
"type": "string"
39+
},
40+
{
41+
"name": "deviceIdentifier",
42+
"type": "string"
43+
},
44+
{
45+
"name": "deviceMac",
46+
"type": "string"
47+
},
48+
{
49+
"name": "deviceSubnet",
50+
"type": "string"
51+
},
52+
{
53+
"name": "devices",
54+
"type": "dynamic"
55+
},
56+
{
57+
"name": "endTime",
58+
"type": "datetime"
59+
},
60+
{
61+
"name": "externalId",
62+
"type": "string"
63+
},
64+
{
65+
"name": "groupByActivity",
66+
"type": "boolean"
67+
},
68+
{
69+
"name": "groupCategory",
70+
"type": "string"
71+
},
72+
{
73+
"name": "groupPreviousGroups",
74+
"type": "dynamic"
75+
},
76+
{
77+
"name": "groupScore",
78+
"type": "int"
79+
},
80+
{
81+
"name": "groupingId",
82+
"type": "string"
83+
},
84+
{
85+
"name": "incidentEventTime",
86+
"type": "datetime"
87+
},
88+
{
89+
"name": "incidentEventTitle",
90+
"type": "string"
91+
},
92+
{
93+
"name": "latitude",
94+
"type": "real"
95+
},
96+
{
97+
"name": "longitude",
98+
"type": "real"
99+
},
100+
{
101+
"name": "newEvent",
102+
"type": "boolean"
103+
},
104+
{
105+
"name": "severity",
106+
"type": "int"
107+
},
108+
{
109+
"name": "startTime",
110+
"type": "datetime"
111+
},
112+
{
113+
"name": "summary",
114+
"type": "string"
115+
},
116+
{
117+
"name": "summaryFirstSentence",
118+
"type": "string"
119+
},
120+
{
121+
"name": "url",
122+
"type": "string"
123+
}
124+
]
125+
}

0 commit comments

Comments
 (0)