Merge remote-tracking branch 'origin/master' into users/v-rodrigolop/airlock

Author: RodrigoLopezCam

.script/tests/KqlvalidationsTests/CustomTables/VaronisAlerts_CL.json

@@ -6,84 +6,132 @@
       "Type": "DateTime"
     },
     {
-      "Name": "DeviceName_s",
+      "Name": "AlertId_g",
       "Type": "String"
     },
     {
-      "Name": "ID_g",
+      "Name": "ThreatDetectionPolicyName_s",
       "Type": "String"
     },
     {
-      "Name": "Name_s",
+      "Name": "AlertTime_t",
+      "Type": "DateTime"
+    },
+    {
+      "Name": "AlertSeverity_s",
       "Type": "String"
     },
     {
-      "Name": "Time_t",
-      "Type": "DateTime"
+      "Name": "AlertCategory_s",
+      "Type": "String"
     },
     {
-      "Name": "Severity_s",
+      "Name": "Countries_s",
       "Type": "String"
     },
     {
-      "Name": "SeverityId_d",
-      "Type": "Real"
+      "Name": "States_s",
+      "Type": "String"
     },
     {
       "Name": "Status_s",
       "Type": "String"
     },
     {
-      "Name": "StatusId_d",
-      "Type": "Real"
+      "Name": "CloseReason_s",
+      "Type": "String"
+    },
+    {
+      "Name": "BlacklistedLocation_b",
+      "Type": "Boolean"
+    },
+    {
+      "Name": "AbnormalLocations_s",
+      "Type": "String"
+    },
+    {
+      "Name": "EventsCount_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "PrivilegedAccountType_s",
+      "Type": "String"
     },
     {
-      "Name": "NumOfAlertedEvents_d",
-      "Type": "Real"
+      "Name": "UserNames_s",
+      "Type": "String"
     },
     {
-      "Name": "UserName_s",
+      "Name": "UserSamAccountNames_s",
       "Type": "String"
     },
     {
-      "Name": "SamAccountName_s",
+      "Name": "ContainsMaliciousExternalIPs_b",
+      "Type": "Boolean"
+    },
+    {
+      "Name": "AggregatedExternalIPThreatTypes_s",
       "Type": "String"
     },
     {
-      "Name": "Asset_s",
+      "Name": "Assets_s",
       "Type": "String"
     },
     {
-      "Name": "AssetContainsFlaggedData_s",
+      "Name": "FlaggedDataExposed_s",
       "Type": "String"
     },
     {
-      "Name": "AssetContainsSensitiveData_s",
+      "Name": "SensitiveDataExposed_s",
       "Type": "String"
     },
     {
-      "Name": "Platform_s",
+      "Name": "DataSourceTypes_s",
       "Type": "String"
     },
     {
-      "Name": "FileServerOrDomain_s",
+      "Name": "DataSources_s",
       "Type": "String"
     },
     {
-      "Name": "EventUTC_t",
+      "Name": "DeviceNames_s",
+      "Type": "String"
+    },
+    {
+      "Name": "InitialEventTimeUTC_t",
       "Type": "DateTime"
     },
     {
-      "Name": "IngestTime_t",
+      "Name": "AccountsHaveFollowUpIndicators_s",
+      "Type": "String"
+    },
+    {
+      "Name": "AlertTimeUTC_t",
+      "Type": "DateTime"
+    },
+    {
+      "Name": "InitialEventTime_t",
       "Type": "DateTime"
     },
     {
-      "Name": "Query_s",
+      "Name": "AssignedtoVaronis_b",
+      "Type": "Boolean"
+    },
+    {
+      "Name": "EscalationType_s",
+      "Type": "String"
+    },
+    {
+      "Name": "MitreTacticName_s",
       "Type": "String"
     },
     {
-      "Name": "Category",
+      "Name": "ClosedBy_s",
       "Type": "String"
+    },
+    {
+      "Name": "IngestTime_t",
+      "Type": "DateTime"
     }
   ]
 }

.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json

@@ -327,5 +327,6 @@
   "GambitSecurityPush",
   "TailscaleCCF",
   "TailscalePremiumCCF",
-  "WhisperSecurityConnector"
+  "WhisperSecurityConnector",
+  "VaronisSaaSAlertsPush"
 ]

Solutions/Azure Firewall/Analytic Rules/Azure Firewall - Abnormal Port to Protocol.yaml

@@ -68,8 +68,7 @@ query: |
   | join kind=leftouter (LearningPortToProtocol1) on $left.AlertTimeDstPort == $right.LearningTimeDstPort
   | where LearningTimeProtocol != AlertTimeProtocol),
   (AlertTimePortToProtocol2 
-  | join kind=leftouter (LearningPortToProtocol2) on $left.AlertTimeDstPort == $right.LearningTimeDstPort
-  | where LearningTimeProtocol != AlertTimeProtocol),
+  | join kind=leftanti (LearningPortToProtocol2) on $left.AlertTimeDstPort == $right.LearningTimeDstPort, $left.AlertTimeProtocol == $right.LearningTimeProtocol),
   (AlertTimePortToProtocol3 
   | join kind=leftouter (LearningPortToProtocol3) on $left.AlertTimeDstPort == $right.LearningTimeDstPort
   | where LearningTimeProtocol != AlertTimeProtocol))
@@ -88,5 +87,5 @@ customDetails:
 alertDetailsOverride:
   alertDisplayNameFormat: 'Abnormal Port to Protocol Communication Detected from {{SourceIp}} to {{Fqdn}}'
   alertDescriptionFormat: 'Communication was observed over port {{AlertTimeDstPort}} using protocol {{AlertTimeProtocol}}, which is different from the protocol observed during the learning period. This could indicate potential malicious activity such as C2 communication or data exfiltration.'
-version: 1.1.4
+version: 1.1.5
 kind: Scheduled

Solutions/Azure Firewall/Analytic Rules/SeveralDenyActionsRegistered.yaml

@@ -25,27 +25,28 @@ relevantTechniques:
   - T1071
   - T1210
 query: |
-  let threshold = 1;
+  let threshold = 2;
   union isfuzzy=true(
   AZFWApplicationRule
   | where Action == "Deny"
   | summarize StartTime = min(TimeGenerated), count() by SourceIp, Fqdn, Action, Protocol
-  | where count_ >= ["threshold"]),
+  | where count_ >= threshold),
   (AZFWNetworkRule
   | where Action == "Deny"
   | extend Fqdn = DestinationIp
-  | summarize StartTime = min(TimeGenerated), count() by SourceIp, Fqdn, Action, Protocol
-  | where count_ >= ["threshold"]),
+  | summarize StartTime = min(TimeGenerated), count_ = dcount(DestinationPort), Protocols = make_set(Protocol) by SourceIp, Fqdn, Action
+  | where count_ >= threshold
+  | extend Protocol = strcat_array(Protocols, "/")),
   (AZFWFlowTrace
   | where Action == "Deny"
   | extend Fqdn = DestinationIp
   | summarize StartTime = min(TimeGenerated), count() by SourceIp, Fqdn, Action, Protocol
-  | where count_ >= ["threshold"]),
+  | where count_ >= threshold),
   (AZFWIdpsSignature
   | where Action == "Deny"
   | extend Fqdn = DestinationIp
   | summarize StartTime = min(TimeGenerated), count() by SourceIp, Fqdn, Action, Protocol
-  | where count_ >= ["threshold"]),
+  | where count_ >= threshold),
   (AzureDiagnostics
   | where OperationName in ("AzureFirewallApplicationRuleLog","AzureFirewallNetworkRuleLog")
   | extend msg_s_replaced0 = replace(@"\s\s",@" ",msg_s)
@@ -56,7 +57,7 @@ query: |
   | where Action == "Deny"
   | extend Fqdn = iff(DestinationIp matches regex "\\d+\\.\\d+\\.\\d+\\.\\d+","",DestinationIp)
   | summarize StartTime = min(TimeGenerated), count() by SourceIp, Fqdn, Action, Protocol
-  | where count_ >= ["threshold"])
+  | where count_ >= threshold)
 entityMappings:
   - entityType: IP
     fieldMappings:
@@ -71,5 +72,5 @@ customDetails:
 alertDetailsOverride:
   alertDisplayNameFormat: 'Multiple Deny Actions Detected from {{SourceIp}} to {{Fqdn}}'
   alertDescriptionFormat: 'Source IP {{SourceIp}} has triggered multiple deny actions to destination {{Fqdn}} using protocol {{Protocol}}, which may indicate malicious activity such as lateral movement or reconnaissance.'
-version: 1.1.2
+version: 1.1.3
 kind: Scheduled

Solutions/Azure Firewall/Data/Solution_AzureFirewall.json

@@ -37,7 +37,7 @@
   "Analytic Rules/Azure Firewall - Web Application attack detected.yaml"
   ],
   "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Azure Firewall",
-  "Version": "3.0.5",
+  "Version": "3.0.7",
   "Metadata": "SolutionMetadata.json",
   "TemplateSpec": true,
   "StaticDataConnectorIds": [