Skip to content

Commit b13cc36

Browse files
v-dhbeduv-dhbedu
committed
BitSight: de-duplicate statistics parsers and simplify connector auth (v3.2.1)
- Add arg_max(TimeGenerated, *) de-duplication to the BitSight statistics parsers so the CCF snapshot tables return only the latest record per entity, resolving the duplicate-records issue. - Replace the separate username and password inputs with a single BitSight API Token field in both the Security Statistics and Security Events connectors. Authentication uses HTTP Basic with the token as the username and an empty password, matching BitSight's documented API token scheme. - Bump solution to 3.2.1, update release notes, and regenerate the package.
1 parent 9d818c2 commit b13cc36

11 files changed

Lines changed: 1015 additions & 461 deletions

‎Solutions/BitSight/Data Connectors/BitSight_CCF/ConnectorDefinition.json‎

Lines changed: 4 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@
148148
{
149149
"type": "Markdown",
150150
"parameters": {
151-
"content": "## BitSight Statistics Connections\n\nManage multiple BitSight statistics connections. Each connection selects one or more **data streams** to ingest and assigns a **Connection Name** stored in the `connectionName` column of every ingested record.\n\n> **Authentication**: BitSight uses HTTP Basic Authentication where the API token is used as **both** the username and password."
151+
"content": "## BitSight Statistics Connections\n\nManage multiple BitSight statistics connections. Each connection selects one or more **data streams** to ingest and assigns a **Connection Name** stored in the `connectionName` column of every ingested record.\n\n> **Authentication**: BitSight uses HTTP Basic Authentication with your API Token."
152152
}
153153
},
154154
{
@@ -255,28 +255,16 @@
255255
{
256256
"type": "Markdown",
257257
"parameters": {
258-
"content": "## 3. Authentication\n\nBitSight uses your API token as **both** the username and password for HTTP Basic Authentication."
258+
"content": "## 3. Authentication\n\nProvide your BitSight API Token. It authenticates requests to the BitSight REST API using HTTP Basic Authentication."
259259
}
260260
},
261261
{
262262
"type": "Textbox",
263263
"parameters": {
264-
"label": "BitSight API Token (Username)",
264+
"label": "BitSight API Token",
265265
"placeholder": "Paste your BitSight API Token",
266-
"type": "text",
267-
"name": "username",
268-
"validations": {
269-
"required": true
270-
}
271-
}
272-
},
273-
{
274-
"type": "Textbox",
275-
"parameters": {
276-
"label": "BitSight API Token (Password)",
277-
"placeholder": "Paste your BitSight API Token again",
278266
"type": "password",
279-
"name": "password",
267+
"name": "apiToken",
280268
"validations": {
281269
"required": true
282270
}

‎Solutions/BitSight/Data Connectors/BitSight_CCF/PollingConfig.json‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
[
1+
[
22
{
33
"type": "Microsoft.SecurityInsights/dataConnectors",
44
"apiVersion": "2025-03-01",
@@ -8,8 +8,8 @@
88
"properties": {
99
"auth": {
1010
"type": "Basic",
11-
"UserName": "[[parameters('username')]",
12-
"Password": "[[parameters('password')]"
11+
"UserName": "[[parameters('apiToken')]",
12+
"Password": "[[parameters('apiToken')]"
1313
},
1414
"request": {
1515
"apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]",
@@ -98,8 +98,8 @@
9898
"properties": {
9999
"auth": {
100100
"type": "Basic",
101-
"UserName": "[[parameters('username')]",
102-
"Password": "[[parameters('password')]"
101+
"UserName": "[[parameters('apiToken')]",
102+
"Password": "[[parameters('apiToken')]"
103103
},
104104
"request": {
105105
"apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]",
@@ -186,8 +186,8 @@
186186
"properties": {
187187
"auth": {
188188
"type": "Basic",
189-
"UserName": "[[parameters('username')]",
190-
"Password": "[[parameters('password')]"
189+
"UserName": "[[parameters('apiToken')]",
190+
"Password": "[[parameters('apiToken')]"
191191
},
192192
"request": {
193193
"apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]",
@@ -276,8 +276,8 @@
276276
"properties": {
277277
"auth": {
278278
"type": "Basic",
279-
"UserName": "[[parameters('username')]",
280-
"Password": "[[parameters('password')]"
279+
"UserName": "[[parameters('apiToken')]",
280+
"Password": "[[parameters('apiToken')]"
281281
},
282282
"request": {
283283
"apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]",
@@ -366,8 +366,8 @@
366366
"properties": {
367367
"auth": {
368368
"type": "Basic",
369-
"UserName": "[[parameters('username')]",
370-
"Password": "[[parameters('password')]"
369+
"UserName": "[[parameters('apiToken')]",
370+
"Password": "[[parameters('apiToken')]"
371371
},
372372
"request": {
373373
"apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]",
@@ -456,8 +456,8 @@
456456
"properties": {
457457
"auth": {
458458
"type": "Basic",
459-
"UserName": "[[parameters('username')]",
460-
"Password": "[[parameters('password')]"
459+
"UserName": "[[parameters('apiToken')]",
460+
"Password": "[[parameters('apiToken')]"
461461
},
462462
"request": {
463463
"apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]",
@@ -546,8 +546,8 @@
546546
"properties": {
547547
"auth": {
548548
"type": "Basic",
549-
"UserName": "[[parameters('username')]",
550-
"Password": "[[parameters('password')]"
549+
"UserName": "[[parameters('apiToken')]",
550+
"Password": "[[parameters('apiToken')]"
551551
},
552552
"request": {
553553
"apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]",
@@ -636,8 +636,8 @@
636636
"properties": {
637637
"auth": {
638638
"type": "Basic",
639-
"UserName": "[[parameters('username')]",
640-
"Password": "[[parameters('password')]"
639+
"UserName": "[[parameters('apiToken')]",
640+
"Password": "[[parameters('apiToken')]"
641641
},
642642
"request": {
643643
"apiEndpoint": "https://service.bitsighttech.com/customer-api/v1/defaults/vulnerabilities",

‎Solutions/BitSight/Data Connectors/BitSight_Events_CCF/ConnectorDefinition.json‎

Lines changed: 4 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@
103103
{
104104
"type": "Markdown",
105105
"parameters": {
106-
"content": "## BitSight Connections\n\nManage multiple BitSight data stream connections. Each connection selects a specific data type - **Alerts**, **Breaches**, or **Findings** - and assigns a **Connection Name** that is stored in the `ConnectorName` column of every ingested record.\n\n> **Authentication**: BitSight uses HTTP Basic Authentication where the API token is used as **both** the username and password."
106+
"content": "## BitSight Connections\n\nManage multiple BitSight data stream connections. Each connection selects a specific data type - **Alerts**, **Breaches**, or **Findings** - and assigns a **Connection Name** that is stored in the `ConnectorName` column of every ingested record.\n\n> **Authentication**: BitSight uses HTTP Basic Authentication with your API Token."
107107
}
108108
},
109109
{
@@ -196,28 +196,16 @@
196196
{
197197
"type": "Markdown",
198198
"parameters": {
199-
"content": "## 3. Authentication\n\nBitSight uses your API token as **both** the username and password for HTTP Basic Authentication."
199+
"content": "## 3. Authentication\n\nProvide your BitSight API Token. It authenticates requests to the BitSight REST API using HTTP Basic Authentication."
200200
}
201201
},
202202
{
203203
"type": "Textbox",
204204
"parameters": {
205-
"label": "BitSight API Token (Username)",
205+
"label": "BitSight API Token",
206206
"placeholder": "Paste your BitSight API Token",
207-
"type": "text",
208-
"name": "username",
209-
"validations": {
210-
"required": true
211-
}
212-
}
213-
},
214-
{
215-
"type": "Textbox",
216-
"parameters": {
217-
"label": "BitSight API Token (Password)",
218-
"placeholder": "Paste your BitSight API Token again",
219207
"type": "password",
220-
"name": "password",
208+
"name": "apiToken",
221209
"validations": {
222210
"required": true
223211
}

‎Solutions/BitSight/Data Connectors/BitSight_Events_CCF/PollingConfig.json‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
[
1+
[
22
{
33
"type": "Microsoft.SecurityInsights/dataConnectors",
44
"apiVersion": "2025-03-01",
@@ -8,8 +8,8 @@
88
"properties": {
99
"auth": {
1010
"type": "Basic",
11-
"UserName": "[[parameters('username')]",
12-
"Password": "[[parameters('password')]"
11+
"UserName": "[[parameters('apiToken')]",
12+
"Password": "[[parameters('apiToken')]"
1313
},
1414
"request": {
1515
"apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/v2/alerts/')]",
@@ -67,8 +67,8 @@
6767
"properties": {
6868
"auth": {
6969
"type": "Basic",
70-
"UserName": "[[parameters('username')]",
71-
"Password": "[[parameters('password')]"
70+
"UserName": "[[parameters('apiToken')]",
71+
"Password": "[[parameters('apiToken')]"
7272
},
7373
"request": {
7474
"apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]",
@@ -168,8 +168,8 @@
168168
"properties": {
169169
"auth": {
170170
"type": "Basic",
171-
"UserName": "[[parameters('username')]",
172-
"Password": "[[parameters('password')]"
171+
"UserName": "[[parameters('apiToken')]",
172+
"Password": "[[parameters('apiToken')]"
173173
},
174174
"request": {
175175
"apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]",
@@ -272,8 +272,8 @@
272272
"properties": {
273273
"auth": {
274274
"type": "Basic",
275-
"UserName": "[[parameters('username')]",
276-
"Password": "[[parameters('password')]"
275+
"UserName": "[[parameters('apiToken')]",
276+
"Password": "[[parameters('apiToken')]"
277277
},
278278
"request": {
279279
"apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]",
@@ -376,8 +376,8 @@
376376
"properties": {
377377
"auth": {
378378
"type": "Basic",
379-
"UserName": "[[parameters('username')]",
380-
"Password": "[[parameters('password')]"
379+
"UserName": "[[parameters('apiToken')]",
380+
"Password": "[[parameters('apiToken')]"
381381
},
382382
"request": {
383383
"apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]",

‎Solutions/BitSight/Data/Solution_BitSight.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@
3737
"Data Connectors/BitSight_CCF/ConnectorDefinition.json"
3838
],
3939
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\BitSight",
40-
"Version": "3.2.0",
40+
"Version": "3.2.1",
4141
"Metadata": "SolutionMetadata.json",
4242
"TemplateSpec": true,
4343
"Is1PConnector": false

‎Solutions/BitSight/Package/3.2.1.zip‎

51.7 KB
Binary file not shown.

‎Solutions/BitSight/Package/mainTemplate.json‎

Lines changed: 968 additions & 394 deletions
Large diffs are not rendered by default.

‎Solutions/BitSight/Parsers/BitSightDiligenceStatistics.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
id: 3900f610-56b5-4f8f-84f4-291d9b41dfe2
22
Function:
33
Title: Parser for BitSightDiligenceStatistics
4-
Version: '1.1.0'
5-
LastUpdated: '2026-05-25'
4+
Version: '1.2.0'
5+
LastUpdated: '2026-07-30'
66
Category: Microsoft Sentinel Parser
77
FunctionName: BitSightDiligenceStatistics
88
FunctionAlias: BitSightDiligenceStatistics
@@ -46,6 +46,7 @@ FunctionQuery: |
4646
),
4747
(
4848
BitSightDiligenceStatistics_CL
49+
| summarize arg_max(TimeGenerated, *) by CompanyGuid, RiskVector
4950
| extend
5051
EventVendor = "BitSight",
5152
EventProduct = "DiligenceStatistics"

‎Solutions/BitSight/Parsers/BitSightIndustrialStatistics.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
id: 44c51bc8-1c06-46ca-ba25-0422d0af4015
22
Function:
33
Title: Parser for BitSightIndustrialStatistics
4-
Version: '1.1.0'
5-
LastUpdated: '2026-05-25'
4+
Version: '1.2.0'
5+
LastUpdated: '2026-07-30'
66
Category: Microsoft Sentinel Parser
77
FunctionName: BitSightIndustrialStatistics
88
FunctionAlias: BitSightIndustrialStatistics
@@ -30,6 +30,7 @@ FunctionQuery: |
3030
),
3131
(
3232
BitsightIndustrialStatistics_CL
33+
| summarize arg_max(TimeGenerated, *) by CompanyGuid, RiskVector
3334
| extend
3435
EventVendor = "BitSight",
3536
EventProduct = "IndustrialStatistics"

‎Solutions/BitSight/Parsers/BitSightObservationStatistics.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
id: 144a9fa0-98a3-40f7-b39e-9c7ff0229290
22
Function:
33
Title: Parser for BitSightObservationStatistics
4-
Version: '1.1.0'
5-
LastUpdated: '2026-05-25'
4+
Version: '1.2.0'
5+
LastUpdated: '2026-07-30'
66
Category: Microsoft Sentinel Parser
77
FunctionName: BitSightObservationStatistics
88
FunctionAlias: BitSightObservationStatistics
@@ -30,6 +30,7 @@ FunctionQuery: |
3030
),
3131
(
3232
BitSightObservationStatistics_CL
33+
| summarize arg_max(TimeGenerated, *) by CompanyGuid, RiskVector
3334
| extend
3435
EventVendor = "BitSight",
3536
EventProduct = "ObservationStatistics"

0 commit comments

Comments
 (0)