Init Checkpoint HEC SOAR content hub

.script/tests/KqlvalidationsTests/CustomTables/CheckpointHEC_CL.json

@@ -0,0 +1,137 @@
+{
+  "Name": "CheckpointHEC_CL",
+  "Properties": [
+    {
+        "Name": "TimeGenerated",
+        "Type": "datetime"
+    },
+    {
+        "Name": "email_raw",
+        "Type": "dynamic"
+    },
+    {
+        "Name": "event_raw",
+        "Type": "dynamic"
+    },
+    {
+        "Name": "EmailEmailId",
+        "Type": "string"
+    },
+    {
+        "Name": "EmailType",
+        "Type": "string"
+    },
+    {
+        "Name": "EmailSubject",
+        "Type": "string"
+    },
+    {
+        "Name": "EmailTo",
+        "Type": "dynamic"
+    },
+    {
+        "Name": "EmailFromEmail",
+        "Type": "string"
+    },
+    {
+        "Name": "EmailFromName",
+        "Type": "string"
+    },
+    {
+        "Name": "EmailBbc",
+        "Type": "dynamic"
+    },
+    {
+        "Name": "EmailCc",
+        "Type": "dynamic"
+    },
+    {
+        "Name": "EmailReplyTo",
+        "Type": "dynamic"
+    },
+    {
+        "Name": "EmailBodyContentType",
+        "Type": "string"
+    },
+    {
+        "Name": "EmailMessageId",
+        "Type": "string"
+    },
+    {
+        "Name": "EmailDirection",
+        "Type": "string"
+    },
+    {
+        "Name": "EmailAttachmentCount",
+        "Type": "int"
+    },
+    {
+        "Name": "EmailAttachmentsPayloads",
+        "Type": "dynamic"
+    },
+    {
+        "Name": "EmailLinks",
+        "Type": "dynamic"
+    },
+    {
+        "Name": "EmailSenderClientIp",
+        "Type": "string"
+    },
+    {
+        "Name": "EmailSenderServerIp",
+        "Type": "string"
+    },
+    {
+        "Name": "EmailDkimResults",
+        "Type": "string"
+    },
+    {
+        "Name": "EmailDmarcResults",
+        "Type": "string"
+    },
+    {
+        "Name": "EmailSpfResults",
+        "Type": "string"
+    },
+    {
+        "Name": "EmailSaasSpamVerdict",
+        "Type": "string"
+    },
+    {
+        "Name": "EventEventId",
+        "Type": "string"
+    },
+    {
+        "Name": "EventCategory",
+        "Type": "string"
+    },
+    {
+        "Name": "EventConfidenceIndicator",
+        "Type": "string"
+    },
+    {
+        "Name": "EventConfidenceLevel",
+        "Type": "int"
+    },
+    {
+        "Name": "EventCurrentState",
+        "Type": "string"
+    },
+    {
+        "Name": "EventDescription",
+        "Type": "string"
+    },
+    {
+        "Name": "EventPolicyRuleId",
+        "Type": "int"
+    },
+    {
+        "Name": "EventAction",
+        "Type": "string"
+    },
+    {
+        "Name": "EventProvider",
+        "Type": "string"
+    }
+]
+}

Solutions/Checkpoint Harmony Email and Collaboration/Analytic Rules/CheckpointHECPhishingNotQuarantined.yaml

@@ -0,0 +1,51 @@
+id: a97e2333-b7de-4c14-9700-e652a1dbef26
+name: Checkpoint - Pending Phishing emails
+apiVersion: 2021-09-01-preview
+description: This query searches for phishing emails that are pending action
+displayName: Checkpoint - Pending Phishing emails
+severity: High
+enabled: true
+query: CheckpointHEC_CL | where EventCurrentState == "new" and EventCategory == "phishing"
+queryFrequency: 5m
+queryPeriod: 15m
+requiredDataConnectors:
+  - connectorId: CheckpointHECConnection
+    dataTypes:
+      - CheckpointHEC_CL
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+  - InitialAccess
+relevantTechniques:
+  - T1566
+suppressionDuration: 5h
+suppressionEnabled: false
+alertRuleTemplateName:
+incidentConfiguration:
+  createIncident: true
+  groupingConfiguration:
+    enabled: true
+    reopenClosedIncident: false
+    lookbackDuration: 1d
+    matchingMethod: AllEntities
+eventGroupingSettings:
+  aggregationKind: SingleAlert
+alertDetailsOverride:
+customDetails:
+  EmailID: EmailEmailId
+entityMappings:
+  - entityType: MailMessage
+    fieldMappings:
+      - identifier: Sender
+        columnName: EmailFromEmail
+      - identifier: NetworkMessageId
+        columnName: EmailMessageId
+      - identifier: Subject
+        columnName: EmailSubject
+  - entityType: Mailbox
+    fieldMappings:
+      - identifier: MailboxPrimaryAddress
+        columnName: EmailTo
+version: 1.0.0
+kind: Scheduled
+

Solutions/Checkpoint Harmony Email and Collaboration/AzureFunctions/Quarantine/__init__.py

@@ -0,0 +1,52 @@
+import azure.functions as func
+import json
+
+from utils.client import get_brand_client
+
+SUPPORTED_ACTIONS = ['entityQuarantine', 'eventQuarantine']
+SUPPORTED_BRANDS = ['checkpoint', 'avanan']
+_ACTION = 'quarantine'
+
+def main(req: func.HttpRequest) -> func.HttpResponse:
+    try:
+        body = req.get_json()
+    except ValueError:
+        return func.HttpResponse("Invalid JSON", status_code=400)
+
+    brand = body.get('brand')
+    host = body.get('host')
+    client_id = body.get('clientId')
+    client_secret = body.get('clientSecret')
+    action = body.get('action')
+    entity_type = body.get('entityType')
+    entity_ids = body.get('entityIds', [])
+
+    if brand not in SUPPORTED_BRANDS:
+        return func.HttpResponse(f'Brand {brand} is not one of supported {SUPPORTED_BRANDS}',
+                                 status_code=400)
+    elif action not in SUPPORTED_ACTIONS:
+        return func.HttpResponse(f'Action {action} is not one of support actions {SUPPORTED_ACTIONS}',
+                             status_code=400)
+
+    client = get_brand_client(brand, host, client_id, client_secret)
+    if not client:
+        return func.HttpResponse('Unable to create client for the provided brand/credentials',
+                                 status_code=400)
+    if not client:
+        return func.HttpResponse(f'No client found for brand {brand}', status_code=400)
+
+    if action == 'entityQuarantine':
+        if not entity_type:
+            return  func.HttpResponse(f'For entityAction action type, entityType must be specified'
+                                            , status_code=400)
+        args = [entity_ids, entity_type, _ACTION]
+        _func = client.entity_action
+    elif action == 'eventQuarantine':
+        args = [entity_ids, _ACTION]
+        _func = client.event_action
+
+    try:
+        res = _func(*args)
+        return func.HttpResponse(json.dumps(res), status_code=200)
+    except Exception as e:
+        return func.HttpResponse(f'Failed to execute action {e}', status_code=500)

Solutions/Checkpoint Harmony Email and Collaboration/AzureFunctions/Quarantine/function.json

@@ -0,0 +1,16 @@
+{
+  "bindings": [
+    {
+      "authLevel": "function",
+      "type": "httpTrigger",
+      "direction": "in",
+      "name": "req",
+      "methods": [ "post" ]
+    },
+    {
+      "type": "http",
+      "direction": "out",
+      "name": "$return"
+    }
+  ]
+}

Solutions/Checkpoint Harmony Email and Collaboration/AzureFunctions/Restore/__init__.py

@@ -0,0 +1,51 @@
+import azure.functions as func
+import json
+
+from utils.client import get_brand_client
+
+SUPPORTED_ACTIONS = ['entityRestore', 'eventRestore']
+SUPPORTED_BRANDS = ['checkpoint', 'avanan']
+_ACTION = 'restore'
+
+def main(req: func.HttpRequest) -> func.HttpResponse:
+    try:
+        body = req.get_json()
+    except ValueError:
+        return func.HttpResponse("Invalid JSON", status_code=400)
+
+    brand = body.get('brand')
+    host = body.get('host')
+    client_id = body.get('clientId')
+    client_secret = body.get('clientSecret')
+    action = body.get('action')
+    entity_type = body.get('entityType')
+    entity_ids = body.get('entityIds', [])
+
+    if brand not in SUPPORTED_BRANDS:
+        return func.HttpResponse(f'Brand {brand} is not one of supported {SUPPORTED_BRANDS}',
+                                 status_code=400)
+    elif action not in SUPPORTED_ACTIONS:
+        return func.HttpResponse(f'Action {action} is not one of support actions {SUPPORTED_ACTIONS}',
+                             status_code=400)
+
+    client = get_brand_client(brand, host, client_id, client_secret)
+    if not client:
+        return func.HttpResponse('Unable to create client for the provided brand/credentials',
+                                 status_code=400)
+
+    if action == 'entityRestore':
+        if not entity_type:
+            return func.HttpResponse(f'For entityAction action type, entityType must be specified'
+                                     , status_code=400)
+        args = [entity_ids, entity_type, _ACTION]
+        _func = client.entity_action
+    elif action == 'eventRestore':
+        args = [entity_ids, _ACTION]
+        _func = client.event_action
+
+    try:
+        res = _func(*args)
+        return func.HttpResponse(json.dumps(res), status_code=200)
+    except Exception as e:
+        return func.HttpResponse(f'Failed to execute action {e}', status_code=500)
+

Solutions/Checkpoint Harmony Email and Collaboration/AzureFunctions/Restore/function.json

@@ -0,0 +1,16 @@
+{
+  "bindings": [
+    {
+      "authLevel": "function",
+      "type": "httpTrigger",
+      "direction": "in",
+      "name": "req",
+      "methods": [ "post" ]
+    },
+    {
+      "type": "http",
+      "direction": "out",
+      "name": "$return"
+    }
+  ]
+}

Solutions/Checkpoint Harmony Email and Collaboration/AzureFunctions/host.json

@@ -0,0 +1,18 @@
+{
+  "version": "2.0",
+  "extensions": {
+    "http": { "routePrefix": "api" }
+  },
+  "logging": {
+    "applicationInsights": {
+      "samplingSettings": {
+        "isEnabled": true,
+        "excludedTypes": "Request"
+      }
+    }
+  },
+  "extensionBundle": {
+    "id": "Microsoft.Azure.Functions.ExtensionBundle",
+    "version": "[4.*, 5.0.0)"
+  }
+}

Solutions/Checkpoint Harmony Email and Collaboration/AzureFunctions/requirements.txt

@@ -0,0 +1,8 @@
+# Uncomment to enable Azure Monitor OpenTelemetry
+# Ref: aka.ms/functions-azure-monitor-python 
+# azure-monitor-opentelemetry 
+
+azure-functions
+requests
+cached-property
+python-jose