Skip to content

Commit c76c2a4

Browse files
p-osmanp-osman
authored
Merge branch 'master' into prodaft-usta-atp
2 parents 04a98f4 + 12063ce commit c76c2a4

393 files changed

Lines changed: 70113 additions & 8442 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/skills/asim-parser-filter-validator/SKILL.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ AgentEvent, AlertEvent, AssetEntity, AuditEvent, Authentication, DhcpEvent, Dns,
4040
## How to run
4141

4242
```powershell
43-
.\.github\skills\asim-parser-filter-validator\scripts\asimFilterTest.ps1 -ParserFile "{PathToFilterParserKQL}" -SchemaName "{SchemaName}" -WorkspaceId "{your-workspace-guid}"
43+
.\scripts\asimFilterTest.ps1 -ParserFile "{PathToFilterParserKQL}" -SchemaName "{SchemaName}" -WorkspaceId "{your-workspace-guid}"
4444
```
4545

4646
## Prerequisites

‎.github/skills/asim-parser-github-pr-packager/SKILL.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ For example: `asim/networksession-cisco-asa`.
3939

4040
Create a YAML file for **each** parser (parameter-less and parameterized) in the directory `Parsers/ASim<SchemaName>/Parsers/`.
4141

42+
For the schema reference in both parser files, use the exact `SchemaTitle` and schema-specific `aka.ms` `SchemaLink` defined for the schema in `.script/tests/asimParsersTest/VerifyASimParserTemplate.py`. Do not substitute a Learn documentation URL.
43+
4244
### Parameter-less parser: `ASim<Schema><Vendor><Product>.yaml`
4345

4446
```yaml
@@ -53,7 +55,7 @@ Normalization:
5355
Version: <schema version>
5456
References:
5557
- Title: ASIM <schema name> Schema
56-
Link: <link to the Learn Microsoft documentation for this specific ASIM schema>
58+
Link: <schema-specific aka.ms SchemaLink from VerifyASimParserTemplate.py>
5759
- Title: ASIM
5860
Link: https://aka.ms/AboutASIM
5961
- Title: <vendor> <product> Documentation
@@ -88,7 +90,7 @@ Normalization:
8890
Version: <schema version>
8991
References:
9092
- Title: ASIM <schema name> Schema
91-
Link: <link to the Learn Microsoft documentation for this specific ASIM schema>
93+
Link: <schema-specific aka.ms SchemaLink from VerifyASimParserTemplate.py>
9294
- Title: ASIM
9395
Link: https://aka.ms/AboutASIM
9496
- Title: <vendor> <product> Documentation
@@ -174,7 +176,7 @@ If there is no file, then we will need to create a file.
174176

175177
## Step 9. Generate a sample data file
176178

177-
Extract the EventVendor and EventProduct from the parameter-less parser. Create a sample data file in the directory `SampleData/ASIM` with the following name:
179+
Extract the EventVendor and EventProduct from the parameter-less parser. Create a sample data file in the directory `Sample Data/ASIM` with the following name:
178180
`{EventVendor}_{EventProduct}_{ASIMSchema}_IngestedLogs.csv`
179181

180182
The headers of the CSV file should match the name of the columns from the source table. The source table columns can be derived from Step 8.

‎.github/workflows/ScanSecrets.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,6 @@ jobs:
1515
with:
1616
fetch-depth: 10
1717
- name: Secret Scanning
18-
uses: trufflesecurity/trufflehog@main
18+
uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3.95.9
1919
with:
2020
extra_args: --exclude-paths=.script/SecretScanning/Excludepathlist --only-verified

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -355,3 +355,6 @@ Hunting Queries/DeployedQueries.json
355355

356356
.arm-ttk
357357

358+
359+
# Local-only helper scripts (not for upstream submission)
360+
.local-helpers/

‎.script/tests/KqlvalidationsTests/CustomTables/CheckpointHEC_CL.json‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
{
2+
"Name": "CheckpointHEC_CL",
3+
"Properties": [
4+
{
5+
"Name": "TimeGenerated",
6+
"Type": "datetime"
7+
},
8+
{
9+
"Name": "email_raw",
10+
"Type": "dynamic"
11+
},
12+
{
13+
"Name": "event_raw",
14+
"Type": "dynamic"
15+
},
16+
{
17+
"Name": "EmailEmailId",
18+
"Type": "string"
19+
},
20+
{
21+
"Name": "EmailType",
22+
"Type": "string"
23+
},
24+
{
25+
"Name": "EmailSubject",
26+
"Type": "string"
27+
},
28+
{
29+
"Name": "EmailTo",
30+
"Type": "dynamic"
31+
},
32+
{
33+
"Name": "EmailFromEmail",
34+
"Type": "string"
35+
},
36+
{
37+
"Name": "EmailFromName",
38+
"Type": "string"
39+
},
40+
{
41+
"Name": "EmailBbc",
42+
"Type": "dynamic"
43+
},
44+
{
45+
"Name": "EmailCc",
46+
"Type": "dynamic"
47+
},
48+
{
49+
"Name": "EmailReplyTo",
50+
"Type": "dynamic"
51+
},
52+
{
53+
"Name": "EmailBodyContentType",
54+
"Type": "string"
55+
},
56+
{
57+
"Name": "EmailMessageId",
58+
"Type": "string"
59+
},
60+
{
61+
"Name": "EmailDirection",
62+
"Type": "string"
63+
},
64+
{
65+
"Name": "EmailAttachmentCount",
66+
"Type": "int"
67+
},
68+
{
69+
"Name": "EmailAttachmentsPayloads",
70+
"Type": "dynamic"
71+
},
72+
{
73+
"Name": "EmailLinks",
74+
"Type": "dynamic"
75+
},
76+
{
77+
"Name": "EmailSenderClientIp",
78+
"Type": "string"
79+
},
80+
{
81+
"Name": "EmailSenderServerIp",
82+
"Type": "string"
83+
},
84+
{
85+
"Name": "EmailDkimResults",
86+
"Type": "string"
87+
},
88+
{
89+
"Name": "EmailDmarcResults",
90+
"Type": "string"
91+
},
92+
{
93+
"Name": "EmailSpfResults",
94+
"Type": "string"
95+
},
96+
{
97+
"Name": "EmailSaasSpamVerdict",
98+
"Type": "string"
99+
},
100+
{
101+
"Name": "EventEventId",
102+
"Type": "string"
103+
},
104+
{
105+
"Name": "EventCategory",
106+
"Type": "string"
107+
},
108+
{
109+
"Name": "EventConfidenceIndicator",
110+
"Type": "string"
111+
},
112+
{
113+
"Name": "EventConfidenceLevel",
114+
"Type": "int"
115+
},
116+
{
117+
"Name": "EventCurrentState",
118+
"Type": "string"
119+
},
120+
{
121+
"Name": "EventDescription",
122+
"Type": "string"
123+
},
124+
{
125+
"Name": "EventPolicyRuleId",
126+
"Type": "int"
127+
},
128+
{
129+
"Name": "EventAction",
130+
"Type": "string"
131+
},
132+
{
133+
"Name": "EventProvider",
134+
"Type": "string"
135+
}
136+
]
137+
}

‎.script/tests/KqlvalidationsTests/CustomTables/DigitalShadows_V2_CL.json‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
{
2+
"Name": "DigitalShadows_V2_CL",
3+
"Properties": [
4+
{
5+
"Name": "TimeGenerated",
6+
"Type": "DateTime"
7+
},
8+
{
9+
"Name": "App",
10+
"Type": "String"
11+
},
12+
{
13+
"Name": "Title",
14+
"Type": "String"
15+
},
16+
{
17+
"Name": "TimeRaised",
18+
"Type": "DateTime"
19+
},
20+
{
21+
"Name": "TimeUpdated",
22+
"Type": "DateTime"
23+
},
24+
{
25+
"Name": "Classification",
26+
"Type": "String"
27+
},
28+
{
29+
"Name": "RiskLevel",
30+
"Type": "String"
31+
},
32+
{
33+
"Name": "RiskAssessmentRiskLevel",
34+
"Type": "String"
35+
},
36+
{
37+
"Name": "GreyMatterLink",
38+
"Type": "String"
39+
},
40+
{
41+
"Name": "Assets",
42+
"Type": "String"
43+
},
44+
{
45+
"Name": "Description",
46+
"Type": "String"
47+
},
48+
{
49+
"Name": "ImpactDescription",
50+
"Type": "String"
51+
},
52+
{
53+
"Name": "Mitigation",
54+
"Type": "String"
55+
},
56+
{
57+
"Name": "RiskFactors",
58+
"Type": "String"
59+
},
60+
{
61+
"Name": "Comments",
62+
"Type": "String"
63+
},
64+
{
65+
"Name": "PortalId",
66+
"Type": "String"
67+
},
68+
{
69+
"Name": "Status",
70+
"Type": "String"
71+
},
72+
{
73+
"Name": "TriageId",
74+
"Type": "String"
75+
},
76+
{
77+
"Name": "TriageRaisedTime",
78+
"Type": "DateTime"
79+
},
80+
{
81+
"Name": "TriageUpdatedTime",
82+
"Type": "DateTime"
83+
},
84+
{
85+
"Name": "IncidentId",
86+
"Type": "Real"
87+
},
88+
{
89+
"Name": "AlertId",
90+
"Type": "String"
91+
}
92+
]
93+
}

0 commit comments

Comments
 (0)