Skip to content

Commit f25fcc9

Browse files
Merge remote-tracking branch 'upstream/master' into add-tailscale-ccf-solution
# Conflicts: # .script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json
2 parents f86d41e + 794547f commit f25fcc9

67 files changed

Lines changed: 2162 additions & 3102 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.github/skills/asim-parser-filter-validator/SKILL.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ AgentEvent, AlertEvent, AssetEntity, AuditEvent, Authentication, DhcpEvent, Dns,
4040
## How to run
4141

4242
```powershell
43-
.\.github\skills\asim-parser-filter-validator\scripts\asimFilterTest.ps1 -ParserFile "{PathToFilterParserKQL}" -SchemaName "{SchemaName}" -WorkspaceId "{your-workspace-guid}"
43+
.\scripts\asimFilterTest.ps1 -ParserFile "{PathToFilterParserKQL}" -SchemaName "{SchemaName}" -WorkspaceId "{your-workspace-guid}"
4444
```
4545

4646
## Prerequisites

.github/skills/asim-parser-github-pr-packager/SKILL.md

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ For example: `asim/networksession-cisco-asa`.
3939

4040
Create a YAML file for **each** parser (parameter-less and parameterized) in the directory `Parsers/ASim<SchemaName>/Parsers/`.
4141

42+
For the schema reference in both parser files, use the exact `SchemaTitle` and schema-specific `aka.ms` `SchemaLink` defined for the schema in `.script/tests/asimParsersTest/VerifyASimParserTemplate.py`. Do not substitute a Learn documentation URL.
43+
4244
### Parameter-less parser: `ASim<Schema><Vendor><Product>.yaml`
4345

4446
```yaml
@@ -53,7 +55,7 @@ Normalization:
5355
Version: <schema version>
5456
References:
5557
- Title: ASIM <schema name> Schema
56-
Link: <link to the Learn Microsoft documentation for this specific ASIM schema>
58+
Link: <schema-specific aka.ms SchemaLink from VerifyASimParserTemplate.py>
5759
- Title: ASIM
5860
Link: https://aka.ms/AboutASIM
5961
- Title: <vendor> <product> Documentation
@@ -88,7 +90,7 @@ Normalization:
8890
Version: <schema version>
8991
References:
9092
- Title: ASIM <schema name> Schema
91-
Link: <link to the Learn Microsoft documentation for this specific ASIM schema>
93+
Link: <schema-specific aka.ms SchemaLink from VerifyASimParserTemplate.py>
9294
- Title: ASIM
9395
Link: https://aka.ms/AboutASIM
9496
- Title: <vendor> <product> Documentation
@@ -174,7 +176,7 @@ If there is no file, then we will need to create a file.
174176

175177
## Step 9. Generate a sample data file
176178

177-
Extract the EventVendor and EventProduct from the parameter-less parser. Create a sample data file in the directory `SampleData/ASIM` with the following name:
179+
Extract the EventVendor and EventProduct from the parameter-less parser. Create a sample data file in the directory `Sample Data/ASIM` with the following name:
178180
`{EventVendor}_{EventProduct}_{ASIMSchema}_IngestedLogs.csv`
179181

180182
The headers of the CSV file should match the name of the columns from the source table. The source table columns can be derived from Step 8.

.github/workflows/ScanSecrets.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,6 @@ jobs:
1515
with:
1616
fetch-depth: 10
1717
- name: Secret Scanning
18-
uses: trufflesecurity/trufflehog@main
18+
uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3.95.9
1919
with:
2020
extra_args: --exclude-paths=.script/SecretScanning/Excludepathlist --only-verified

0 commit comments

Comments
 (0)