Merge pull request #14256 from gloo-shock/master

Migrate WithSecure connector to codeless solution

Author: v-atulyadav

Solutions/WithSecureElementsCCF/Data Connectors/WithSecureElementsCCP/WithSecureElements_ConnectorDefinition.json

@@ -0,0 +1,116 @@
+{
+  "name": "WithSecureElementsCCF",
+  "apiVersion": "2022-09-01-preview",
+  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
+  "location": "{{location}}",
+  "kind": "Customizable",
+  "properties": {
+    "connectorUiConfig": {
+      "id": "WithSecureElementsCCF",
+      "title": "WithSecure Elements (CCF)",
+      "publisher": "WithSecure",
+      "descriptionMarkdown": "WithSecure Elements security events ingested via Microsoft Sentinel's Codeless Connector Framework (CCF) \u2014 a fully SaaS deployment with no Azure Function, Storage Account or Key Vault to manage.\n\nThe connector polls the [WithSecure Elements security-events API](https://connect.withsecure.com/api-reference/elements#post-/security-events/v1/security-events) and stores normalized events in the `WsSecurityEvents_CL` Log Analytics table.",
+      "graphQueriesTableName": "WsSecurityEvents_CL",
+      "graphQueries": [
+        {
+          "metricName": "Total events received",
+          "legend": "WithSecure Elements events",
+          "baseQuery": "WsSecurityEvents_CL"
+        }
+      ],
+      "sampleQueries": [
+        {
+          "description": "All WithSecure events (most recent first)",
+          "query": "WsSecurityEvents_CL\n| sort by TimeGenerated desc"
+        },
+        {
+          "description": "Events grouped by engine",
+          "query": "WsSecurityEvents_CL\n| summarize Count = count() by DeviceEventClassID\n| sort by Count desc"
+        }
+      ],
+      "dataTypes": [
+        {
+          "name": "WsSecurityEvents_CL",
+          "lastDataReceivedQuery": "WsSecurityEvents_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
+        }
+      ],
+      "connectivityCriteria": [
+        {
+          "type": "HasDataConnectors"
+        }
+      ],
+      "availability": {
+        "isPreview": false
+      },
+      "permissions": {
+        "resourceProvider": [
+          {
+            "provider": "Microsoft.OperationalInsights/workspaces",
+            "permissionsDisplayText": "read and write permissions on the workspace are required.",
+            "providerDisplayName": "Workspace",
+            "scope": "Workspace",
+            "requiredPermissions": {
+              "write": true,
+              "read": true,
+              "delete": true
+            }
+          }
+        ],
+        "customs": [
+          {
+            "name": "WithSecure Elements API client credentials",
+            "description": "Client credentials are required. See the [user guide](https://connect.withsecure.com/getting-started/elements#getting-client-credentials) for details."
+          }
+        ]
+      },
+      "instructionSteps": [
+        {
+          "title": "Create WithSecure Elements API credentials",
+          "description": "Follow the [user guide](https://connect.withsecure.com/getting-started/elements#getting-client-credentials) to create Elements API credentials. Save the client id and client secret in a safe place."
+        },
+        {
+          "title": "Connect WithSecure Elements to Microsoft Sentinel",
+          "description": "Provide the Elements API URL together with the client id and client secret you created in the previous step, then click **Connect** to start ingesting events.",
+          "instructions": [
+            {
+              "type": "Textbox",
+              "parameters": {
+                "label": "Elements API URL",
+                "placeholder": "https://api.connect.withsecure.com",
+                "type": "text",
+                "name": "elementsApiUrl"
+              }
+            },
+            {
+              "type": "Textbox",
+              "parameters": {
+                "label": "Engine (optional)",
+                "placeholder": "default",
+                "type": "text",
+                "name": "engine"
+              }
+            },
+            {
+              "type": "Textbox",
+              "parameters": {
+                "label": "Engine Group (optional)",
+                "placeholder": "default",
+                "type": "text",
+                "name": "engineGroup"
+              }
+            },
+            {
+              "type": "OAuthForm",
+              "parameters": {
+                "clientIdLabel": "Elements API Client Id",
+                "clientSecretLabel": "Elements API Client Secret",
+                "connectButtonLabel": "Connect",
+                "disconnectButtonLabel": "Disconnect"
+              }
+            }
+          ]
+        }
+      ]
+    }
+  }
+}

Solutions/WithSecureElementsCCF/Data Connectors/WithSecureElementsCCP/WithSecureElements_DCR.json

@@ -0,0 +1,96 @@
+[
+  {
+    "name": "WsCollectionRule",
+    "apiVersion": "2022-06-01",
+    "type": "Microsoft.Insights/dataCollectionRules",
+    "properties": {
+      "dataCollectionEndpointId": "{{dataCollectionEndpointId}}",
+      "streamDeclarations": {
+        "Custom-WsSecurityEventsRaw_CL": {
+          "columns": [
+            {
+              "name": "engine",
+              "type": "string"
+            },
+            {
+              "name": "action",
+              "type": "string"
+            },
+            {
+              "name": "severity",
+              "type": "string"
+            },
+            {
+              "name": "message",
+              "type": "string"
+            },
+            {
+              "name": "persistenceTimestamp",
+              "type": "datetime"
+            },
+            {
+              "name": "serverTimestamp",
+              "type": "datetime"
+            },
+            {
+              "name": "clientTimestamp",
+              "type": "datetime"
+            },
+            {
+              "name": "userName",
+              "type": "string"
+            },
+            {
+              "name": "details",
+              "type": "dynamic"
+            },
+            {
+              "name": "device",
+              "type": "dynamic"
+            },
+            {
+              "name": "organization",
+              "type": "dynamic"
+            },
+            {
+              "name": "target",
+              "type": "dynamic"
+            },
+            {
+              "name": "id",
+              "type": "string"
+            },
+            {
+              "name": "eventTransactionId",
+              "type": "string"
+            },
+            {
+              "name": "acknowledged",
+              "type": "boolean"
+            }
+          ]
+        }
+      },
+      "destinations": {
+        "logAnalytics": [
+          {
+            "workspaceResourceId": "{{workspaceResourceId}}",
+            "name": "WsRuleDest"
+          }
+        ]
+      },
+      "dataFlows": [
+        {
+          "streams": [
+            "Custom-WsSecurityEventsRaw_CL"
+          ],
+          "destinations": [
+            "WsRuleDest"
+          ],
+          "transformKql": "source\n        | extend details = todynamic(details)\n        | extend device = todynamic(device)\n        | extend organization = todynamic(organization)\n        | extend engine = tostring(engine)\n        | extend action = tostring(action)\n        | extend severity = tostring(severity)\n        | extend _infectedObject =     case(\n        engine in (\"fileScanning\", \"manualScanning\"), case(\n    isnotempty(tostring(details.filePath)), tostring(details.filePath),\n    isnotempty(tostring(details.object)), tostring(details.object),\n    tostring(details.path)\n),\n        engine == \"deepGuard\" and not(tostring(details.name) matches regex @\"Rarity: (\\d+), Reputation: (\\d+)\" or tostring(details.name) == \"DeepGuard blocks a rare application\"), tostring(details.filePath),\n        engine == \"webTrafficScanning\" and isnotempty(tostring(details.alertType)), tostring(details.url),\n        engine == \"webTrafficScanning\", tostring(details.websiteUrl),\n        engine == \"amsi\", tostring(details.path),\n        \"\"\n    )\n        | extend _malwareName =     case(\n        engine in (\"fileScanning\", \"manualScanning\"), case(\n    isnotempty(tostring(details.name)), tostring(details.name),\n    tostring(details.infectionName)\n),\n        engine == \"deepGuard\" and not(tostring(details.name) matches regex @\"Rarity: (\\d+), Reputation: (\\d+)\" or tostring(details.name) == \"DeepGuard blocks a rare application\"), tostring(details.name),\n        engine == \"webTrafficScanning\" and isnotempty(tostring(details.alertType)), tostring(extract(@\"[^/\\\\]+$\", 0, tostring(details.process))),\n        engine == \"webTrafficScanning\", tostring(extract(@\"[^/\\\\]+$\", 0, tostring(details.filePath))),\n        engine == \"amsi\", tostring(details.infectionName),\n        \"\"\n    )\n        | extend\n            TimeGenerated = now(),\n            PersistenceTimestamp = todatetime(persistenceTimestamp),\n            Activity = case(\n        engine == \"webTrafficScanning\", \"Web Traffic Scanning event\",\n        engine == \"webContentControl\", \"Web Content Control event\",\n        engine == \"applicationControl\", \"Application Control event\",\n        engine == \"fileScanning\", \"File Scanning event\",\n        engine == \"manualScanning\", \"Manual Scanning event\",\n        engine == \"realtimeScanning\", \"Real - time Scanning event\",\n        engine == \"deviceControl\", \"Device Control event\",\n        engine == \"deepGuard\", \"DeepGuard event\",\n        engine == \"dataGuard\", \"DataGuard event\",\n        engine == \"browsingProtection\", \"Browsing Protection event\",\n        engine == \"connectionControl\", \"Network connection event\",\n        engine == \"reputationBasedBrowsing\", \"Browsing Protection event\",\n        engine == \"integrityChecker\", \"Integrity Checker event\",\n        engine == \"tamperProtection\", \"Tamper Protection event\",\n        engine == \"firewall\", \"Firewall event\",\n        engine == \"amsi\", \"Antimalware Scan Interface (AMSI) event\",\n        engine == \"connector\", \"Elements Connector event\",\n        engine == \"setting\", \"Setting event\",\n        engine == \"edr\", \"Endpoint Detection and Response (EDR) event\",\n        engine == \"xFence\", \"XFENCE event\",\n        engine == \"systemEventsLog\", \"System event\",\n        engine == \"activityMonitor\", \"Server Share Protection event\",\n        engine == \"emailScan\", \"Email scanning event\",\n        engine == \"emailBreach\", \"Email breach event\",\n        engine == \"teamsScan\", \"Microsoft Teams scanning event\",\n        engine == \"oneDriveScan\", \"Microsoft OneDrive scanning event\",\n        engine == \"sharePointScan\", \"Microsoft SharePoint scanning event\",\n        engine == \"inboxRuleScan\", \"Suspicious inbox rule event\",\n        engine == \"activityMonitorClientProtection\", \"Activity Monitor Client Protection\",\n        engine\n    ),\n            DeviceVendor = \"WithSecure\",\n            DeviceEventClassID = strcat(engine, \".\", action),\n            DeviceAction = action,\n            SimplifiedDeviceAction = action,\n            LogSeverity = case(\n        severity == \"critical\", int(10),\n        severity == \"fatal_error\", int(8),\n        severity == \"error\", int(6),\n        severity == \"warning\", int(4),\n        severity == \"info\", int(1),\n        int(null)\n    ),\n            Message = tostring(message),\n            SourceHostName = case(\n    isnotempty(tostring(device.name)), tostring(device.name),\n    isnotempty(tostring(device.id)), tostring(device.id),\n    isnotempty(tostring(device.winsAddress)), tostring(device.winsAddress),\n    \"\"\n),\n            SourceUserName = tostring(details.userName),\n            DeviceCustomString1 = _infectedObject,\n            DeviceCustomString1Label = iif(isnotempty(_infectedObject), \"Infected object\", \"\"),\n            DeviceCustomString2 = _malwareName,\n            DeviceCustomString2Label = iif(isnotempty(_malwareName), \"Malware\", \"\"),\n            AdditionalExtensions = strcat('{\"accountName\":\"', tostring(organization.name), '\",','\"details\":', iif(isempty(tostring(details)), \"null\", tostring(details)),'}')\n        | project TimeGenerated, PersistenceTimestamp, Activity, DeviceVendor, DeviceEventClassID, DeviceAction, SimplifiedDeviceAction, LogSeverity, Message, SourceHostName, SourceUserName, DeviceCustomString1, DeviceCustomString1Label, DeviceCustomString2, DeviceCustomString2Label, AdditionalExtensions",
+          "outputStream": "Custom-WsSecurityEvents_CL"
+        }
+      ]
+    }
+  }
+]

Solutions/WithSecureElementsCCF/Data Connectors/WithSecureElementsCCP/WithSecureElements_PollerConfig.json

@@ -0,0 +1,57 @@
+[
+  {
+    "name": "WithSecureElementsConnection",
+    "apiVersion": "2022-12-01-preview",
+    "type": "Microsoft.SecurityInsights/dataConnectors",
+    "location": "{{location}}",
+    "kind": "RestApiPoller",
+    "properties": {
+      "connectorDefinitionName": "WithSecureElementsCCF",
+      "dataType": "WithSecure Elements security-events",
+      "auth": {
+        "type": "OAuth2",
+        "ClientId": "{{ClientId}}",
+        "ClientSecret": "{{ClientSecret}}",
+        "GrantType": "client_credentials",
+        "TokenEndpoint": "{{elementsApiUrl}}/as/token.oauth2",
+        "TokenEndpointHeaders": {
+          "Content-Type": "application/x-www-form-urlencoded",
+          "Accept": "application/json",
+          "Authorization": "Basic {{base64(ClientId:ClientSecret)}}"
+        },
+        "Scope": "connect.api.read",
+        "IsClientSecretInHeader": true
+      },
+      "request": {
+        "apiEndpoint": "{{elementsApiUrl}}/security-events/v1/security-events",
+        "httpMethod": "POST",
+        "isPostPayloadJson": true,
+        "queryWindowInMin": 5,
+        "queryTimeFormat": "yyyy-MM-ddTHH:mm:ss.fffZ",
+        "rateLimitQPS": 10,
+        "retryCount": 3,
+        "timeoutInSeconds": 60,
+        "headers": {
+          "Accept": "application/json",
+          "User-Agent": "ccf-sentinel-connector"
+        },
+        "queryParametersTemplate": "{\"limit\":100,\"order\":\"asc\",\"exclusiveStart\":true,\"persistenceTimestampStart\":\"{_QueryWindowStartTime}\",\"persistenceTimestampEnd\":\"{_QueryWindowEndTime}\",\"engineGroup\":[\"epp\",\"edr\",\"ecp\",\"xm\"]}"
+      },
+      "response": {
+        "eventsJsonPaths": ["$.items"],
+        "format": "json"
+      },
+      "paging": {
+        "pagingType": "NextPageToken",
+        "nextPageTokenJsonPath": "$.nextAnchor",
+        "nextPageParaName": "anchor"
+      },
+      "dcrConfig": {
+        "dataCollectionEndpoint": "{{dataCollectionEndpoint}}",
+        "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}",
+        "streamName": "Custom-WsSecurityEventsRaw_CL"
+      },
+      "isActive": true
+    }
+  }
+]

Solutions/WithSecureElementsCCF/Data Connectors/WithSecureElementsCCP/WithSecureElements_Table.json

@@ -0,0 +1,80 @@
+[
+  {
+    "name": "WsSecurityEvents_CL",
+    "apiVersion": "2022-10-01",
+    "type": "Microsoft.OperationalInsights/workspaces/tables",
+    "properties": {
+      "schema": {
+        "name": "WsSecurityEvents_CL",
+        "columns": [
+          {
+            "name": "TimeGenerated",
+            "type": "datetime"
+          },
+          {
+            "name": "PersistenceTimestamp",
+            "type": "datetime"
+          },
+          {
+            "name": "Activity",
+            "type": "string"
+          },
+          {
+            "name": "DeviceVendor",
+            "type": "string"
+          },
+          {
+            "name": "DeviceEventClassID",
+            "type": "string"
+          },
+          {
+            "name": "DeviceAction",
+            "type": "string"
+          },
+          {
+            "name": "SimplifiedDeviceAction",
+            "type": "string"
+          },
+          {
+            "name": "LogSeverity",
+            "type": "int"
+          },
+          {
+            "name": "Message",
+            "type": "string"
+          },
+          {
+            "name": "SourceHostName",
+            "type": "string"
+          },
+          {
+            "name": "SourceUserName",
+            "type": "string"
+          },
+          {
+            "name": "DeviceCustomString1",
+            "type": "string"
+          },
+          {
+            "name": "DeviceCustomString1Label",
+            "type": "string"
+          },
+          {
+            "name": "DeviceCustomString2",
+            "type": "string"
+          },
+          {
+            "name": "DeviceCustomString2Label",
+            "type": "string"
+          },
+          {
+            "name": "AdditionalExtensions",
+            "type": "string"
+          }
+        ]
+      },
+      "retentionInDays": 30,
+      "totalRetentionInDays": 30
+    }
+  }
+]

Solutions/WithSecureElementsCCF/Data/Solution_WithSecureElementsCCF.json

@@ -0,0 +1,17 @@
+{
+  "Name": "WithSecureElementsCCF",
+  "Author": "WithSecure - project-msp-integrations@withsecure.com",
+  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/WithSecure.svg\" width=\"75px\" height=\"75px\">",
+  "Description": "WithSecure Elements is the unified cloud-based cyber security platform designed to reduce risk, complexity, and inefficiency.\nElevate your security from your endpoints to your cloud applications. Arm yourself against every type of cyber threat, from targeted attacks to zero-day ransomware.\nWithSecure Elements combines powerful predictive, preventive, and responsive security capabilities - all managed and monitored through a single security center. Our modular structure and flexible pricing models give you the freedom to evolve. With our expertise and insight, you'll always be empowered - and you'll never be alone.\nWith Microsoft Sentinel integration, you can correlate [security events](https://connect.withsecure.com/api-reference/security-events#overview) data from the WithSecure Elements solution with data from other sources, enabling a rich overview of your entire environment and faster reaction to threats.\nThis solution uses the Codeless Connector Framework (CCF) to natively poll the WithSecure Elements security-events API — no Azure Function, Storage Account or Key Vault required.\nFor more information visit our website at: [https://www.withsecure.com](https://www.withsecure.com).",
+  "Workbooks": [
+    "Solutions/WithSecureElementsCCF/Workbooks/WithSecureTopComputersByInfections.json"
+  ],
+  "Data Connectors": [
+    "Solutions/WithSecureElementsCCF/Data Connectors/WithSecureElementsCCP/WithSecureElements_ConnectorDefinition.json"
+  ],
+  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\WithSecureElementsCCF",
+  "Version": "3.0.0",
+  "Metadata": "SolutionMetadata.json",
+  "TemplateSpec": true,
+  "Is1PConnector": false
+}