diff --git a/Solutions/VaronisSaaS/Data Connectors/VaronisSaaS_API_FunctionApp.json b/Solutions/VaronisSaaS/Data Connectors/VaronisSaaS_API_FunctionApp.json index 64b112a68e2..e189252d2a8 100644 --- a/Solutions/VaronisSaaS/Data Connectors/VaronisSaaS_API_FunctionApp.json +++ b/Solutions/VaronisSaaS/Data Connectors/VaronisSaaS_API_FunctionApp.json @@ -1,6 +1,6 @@ { "id": "VaronisSaaS", - "title": "Varonis SaaS", + "title": "[Deprecated] Varonis SaaS", "publisher": "Varonis", "descriptionMarkdown": "Varonis SaaS provides the capability to ingest [Varonis Alerts](https://www.varonis.com/products/datalert) into Microsoft Sentinel.\n\nVaronis prioritizes deep data visibility, classification capabilities, and automated remediation for data access. Varonis builds a single prioritized view of risk for your data, so you can proactively and systematically eliminate risk from insider threats and cyberattacks.", "graphQueries": [ @@ -10,22 +10,22 @@ "metricName": "Total data recieved" }, { - "baseQuery": "VaronisAlerts_CL\n| where Severity_s == \"High\"", + "baseQuery": "VaronisAlerts_CL\n| where AlertSeverity_s == \"High\"", "legend": "High severity alerts", "metricName": "High severity alerts" }, { - "baseQuery": "VaronisAlerts_CL\n| where Severity_s == \"Medium\"", + "baseQuery": "VaronisAlerts_CL\n| where AlertSeverity_s == \"Medium\"", "legend": "Medium severity alerts", "metricName": "Medium severity alerts" }, { - "baseQuery": "VaronisAlerts_CL\n| where Severity_s == \"Low\"", + "baseQuery": "VaronisAlerts_CL\n| where AlertSeverity_s == \"Low\"", "legend": "Low severity alerts", "metricName": "Low severity alerts" }, { - "baseQuery": "VaronisAlerts_CL\n| where Severity_s == \"Informational\"", + "baseQuery": "VaronisAlerts_CL\n| where AlertSeverity_s == \"Informational\"", "legend": "Informational severity alerts", "metricName": "Informational severity alerts" } @@ -37,7 +37,7 @@ }, { "description": "List high severity Varonis Alerts", - "query": "VaronisAlerts_CL\n| where Severity_s == \"High\"\n| sort by TimeGenerated desc" + "query": "VaronisAlerts_CL\n| where AlertSeverity_s == \"High\"\n| sort by TimeGenerated desc" } ], "dataTypes": [ diff --git a/Solutions/VaronisSaaS/Data/Solution_VaronisSaaS.json b/Solutions/VaronisSaaS/Data/Solution_VaronisSaaS.json index 8c6176ba4cf..39e64c0d9ab 100644 --- a/Solutions/VaronisSaaS/Data/Solution_VaronisSaaS.json +++ b/Solutions/VaronisSaaS/Data/Solution_VaronisSaaS.json @@ -17,7 +17,7 @@ "Analytic Rules/VaronisInformationalAlertsDetected.yaml" ], "BasePath": "C:\\Sources\\Azure-Sentinel\\Solutions\\VaronisSaaS", - "Version": "3.1.0", + "Version": "3.1.1", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false diff --git a/Solutions/VaronisSaaS/Package/3.1.1.zip b/Solutions/VaronisSaaS/Package/3.1.1.zip new file mode 100644 index 00000000000..7d285ba4cd9 Binary files /dev/null and b/Solutions/VaronisSaaS/Package/3.1.1.zip differ diff --git a/Solutions/VaronisSaaS/Package/mainTemplate.json b/Solutions/VaronisSaaS/Package/mainTemplate.json index b79c45729c1..49253733396 100644 --- a/Solutions/VaronisSaaS/Package/mainTemplate.json +++ b/Solutions/VaronisSaaS/Package/mainTemplate.json @@ -53,7 +53,7 @@ }, "variables": { "_solutionName": "VaronisSaaS", - "_solutionVersion": "3.1.0", + "_solutionVersion": "3.1.1", "solutionId": "varonis.microsoft-sentinel-solution-varonissaas", "_solutionId": "[variables('solutionId')]", "workbookVersion1": "1.0.0", @@ -72,7 +72,7 @@ "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", - "dataConnectorCCPVersion": "3.1.0", + "dataConnectorCCPVersion": "3.1.1", "_dataConnectorContentIdConnectorDefinition2": "VaronisSaaSAlertsPush", "dataConnectorTemplateNameConnectorDefinition2": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition2')))]", "_dataConnectorContentIdConnections2": "VaronisSaaSAlertsPushConnections", @@ -118,7 +118,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "VaronisSaaS Workbook with template version 3.1.0", + "description": "VaronisSaaS Workbook with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -205,7 +205,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "VaronisSaaS data connector with template version 3.1.0", + "description": "VaronisSaaS data connector with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -221,7 +221,7 @@ "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId1')]", - "title": "Varonis SaaS", + "title": "[Deprecated] Varonis SaaS", "publisher": "Varonis", "descriptionMarkdown": "Varonis SaaS provides the capability to ingest [Varonis Alerts](https://www.varonis.com/products/datalert) into Microsoft Sentinel.\n\nVaronis prioritizes deep data visibility, classification capabilities, and automated remediation for data access. Varonis builds a single prioritized view of risk for your data, so you can proactively and systematically eliminate risk from insider threats and cyberattacks.", "graphQueries": [ @@ -231,22 +231,22 @@ "metricName": "Total data recieved" }, { - "baseQuery": "VaronisAlerts_CL\n| where Severity_s == \"High\"", + "baseQuery": "VaronisAlerts_CL\n| where AlertSeverity_s == \"High\"", "legend": "High severity alerts", "metricName": "High severity alerts" }, { - "baseQuery": "VaronisAlerts_CL\n| where Severity_s == \"Medium\"", + "baseQuery": "VaronisAlerts_CL\n| where AlertSeverity_s == \"Medium\"", "legend": "Medium severity alerts", "metricName": "Medium severity alerts" }, { - "baseQuery": "VaronisAlerts_CL\n| where Severity_s == \"Low\"", + "baseQuery": "VaronisAlerts_CL\n| where AlertSeverity_s == \"Low\"", "legend": "Low severity alerts", "metricName": "Low severity alerts" }, { - "baseQuery": "VaronisAlerts_CL\n| where Severity_s == \"Informational\"", + "baseQuery": "VaronisAlerts_CL\n| where AlertSeverity_s == \"Informational\"", "legend": "Informational severity alerts", "metricName": "Informational severity alerts" } @@ -258,7 +258,7 @@ }, { "description": "List high severity Varonis Alerts", - "query": "VaronisAlerts_CL\n| where Severity_s == \"High\"\n| sort by TimeGenerated desc" + "query": "VaronisAlerts_CL\n| where AlertSeverity_s == \"High\"\n| sort by TimeGenerated desc" } ], "dataTypes": [ @@ -374,7 +374,7 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('_dataConnectorContentId1')]", "contentKind": "DataConnector", - "displayName": "Varonis SaaS", + "displayName": "[Deprecated] Varonis SaaS", "contentProductId": "[variables('_dataConnectorcontentProductId1')]", "id": "[variables('_dataConnectorcontentProductId1')]", "version": "[variables('dataConnectorVersion1')]" @@ -417,7 +417,7 @@ "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "Varonis SaaS", + "title": "[Deprecated] Varonis SaaS", "publisher": "Varonis", "descriptionMarkdown": "Varonis SaaS provides the capability to ingest [Varonis Alerts](https://www.varonis.com/products/datalert) into Microsoft Sentinel.\n\nVaronis prioritizes deep data visibility, classification capabilities, and automated remediation for data access. Varonis builds a single prioritized view of risk for your data, so you can proactively and systematically eliminate risk from insider threats and cyberattacks.", "graphQueries": [ @@ -427,22 +427,22 @@ "metricName": "Total data recieved" }, { - "baseQuery": "VaronisAlerts_CL\n| where Severity_s == \"High\"", + "baseQuery": "VaronisAlerts_CL\n| where AlertSeverity_s == \"High\"", "legend": "High severity alerts", "metricName": "High severity alerts" }, { - "baseQuery": "VaronisAlerts_CL\n| where Severity_s == \"Medium\"", + "baseQuery": "VaronisAlerts_CL\n| where AlertSeverity_s == \"Medium\"", "legend": "Medium severity alerts", "metricName": "Medium severity alerts" }, { - "baseQuery": "VaronisAlerts_CL\n| where Severity_s == \"Low\"", + "baseQuery": "VaronisAlerts_CL\n| where AlertSeverity_s == \"Low\"", "legend": "Low severity alerts", "metricName": "Low severity alerts" }, { - "baseQuery": "VaronisAlerts_CL\n| where Severity_s == \"Informational\"", + "baseQuery": "VaronisAlerts_CL\n| where AlertSeverity_s == \"Informational\"", "legend": "Informational severity alerts", "metricName": "Informational severity alerts" } @@ -468,7 +468,7 @@ }, { "description": "List high severity Varonis Alerts", - "query": "VaronisAlerts_CL\n| where Severity_s == \"High\"\n| sort by TimeGenerated desc" + "query": "VaronisAlerts_CL\n| where AlertSeverity_s == \"High\"\n| sort by TimeGenerated desc" } ], "availability": { @@ -1433,7 +1433,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "VaronisHighSeverityAlertsDetected_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "VaronisHighSeverityAlertsDetected_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -1461,10 +1461,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VaronisSaaSAlertsPush", "dataTypes": [ "VaronisAlerts_CL" - ] + ], + "connectorId": "VaronisSaaSAlertsPush" } ], "tactics": [ @@ -1478,26 +1478,26 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "UserNames_s" + "columnName": "UserNames_s", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "UserSamAccountNames_s" + "columnName": "UserSamAccountNames_s", + "identifier": "Name" } - ] + ], + "entityType": "Account" }, { - "entityType": "Host", "fieldMappings": [ { - "identifier": "HostName", - "columnName": "DeviceNames_s" + "columnName": "DeviceNames_s", + "identifier": "HostName" } - ] + ], + "entityType": "Host" } ], "eventGroupingSettings": { @@ -1505,23 +1505,23 @@ }, "customDetails": { "Status": "Status_s", - "MitreTactic": "MitreTacticName_s", "EventsCount": "EventsCount_d", - "AlertCategory": "AlertCategory_s", - "VaronisAlertGuid": "AlertId_g" + "MitreTactic": "MitreTacticName_s", + "VaronisAlertGuid": "AlertId_g", + "AlertCategory": "AlertCategory_s" }, "alertDetailsOverride": { - "alertDescriptionFormat": "Varonis detected activity for policy {{ThreatDetectionPolicyName_s}} in category {{AlertCategory_s}}. Users: {{UserNames_s}}.", - "alertDisplayNameFormat": "Varonis alert: {{ThreatDetectionPolicyName_s}} ({{AlertSeverity_s}})" + "alertDisplayNameFormat": "Varonis alert: {{ThreatDetectionPolicyName_s}} ({{AlertSeverity_s}})", + "alertDescriptionFormat": "Varonis detected activity for policy {{ThreatDetectionPolicyName_s}} in category {{AlertCategory_s}}. Users: {{UserNames_s}}." }, "incidentConfiguration": { + "createIncident": true, "groupingConfiguration": { "reopenClosedIncident": false, "lookbackDuration": "PT5H", "enabled": false, "matchingMethod": "AllEntities" - }, - "createIncident": true + } } } }, @@ -1575,7 +1575,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "VaronisMediumSeverityAlertsDetected_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "VaronisMediumSeverityAlertsDetected_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -1603,10 +1603,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VaronisSaaSAlertsPush", "dataTypes": [ "VaronisAlerts_CL" - ] + ], + "connectorId": "VaronisSaaSAlertsPush" } ], "tactics": [ @@ -1620,26 +1620,26 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "UserNames_s" + "columnName": "UserNames_s", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "UserSamAccountNames_s" + "columnName": "UserSamAccountNames_s", + "identifier": "Name" } - ] + ], + "entityType": "Account" }, { - "entityType": "Host", "fieldMappings": [ { - "identifier": "HostName", - "columnName": "DeviceNames_s" + "columnName": "DeviceNames_s", + "identifier": "HostName" } - ] + ], + "entityType": "Host" } ], "eventGroupingSettings": { @@ -1647,23 +1647,23 @@ }, "customDetails": { "Status": "Status_s", - "MitreTactic": "MitreTacticName_s", "EventsCount": "EventsCount_d", - "AlertCategory": "AlertCategory_s", - "VaronisAlertGuid": "AlertId_g" + "MitreTactic": "MitreTacticName_s", + "VaronisAlertGuid": "AlertId_g", + "AlertCategory": "AlertCategory_s" }, "alertDetailsOverride": { - "alertDescriptionFormat": "Varonis detected activity for policy {{ThreatDetectionPolicyName_s}} in category {{AlertCategory_s}}. Users: {{UserNames_s}}.", - "alertDisplayNameFormat": "Varonis alert: {{ThreatDetectionPolicyName_s}} ({{AlertSeverity_s}})" + "alertDisplayNameFormat": "Varonis alert: {{ThreatDetectionPolicyName_s}} ({{AlertSeverity_s}})", + "alertDescriptionFormat": "Varonis detected activity for policy {{ThreatDetectionPolicyName_s}} in category {{AlertCategory_s}}. Users: {{UserNames_s}}." }, "incidentConfiguration": { + "createIncident": true, "groupingConfiguration": { "reopenClosedIncident": false, "lookbackDuration": "PT5H", "enabled": false, "matchingMethod": "AllEntities" - }, - "createIncident": true + } } } }, @@ -1717,7 +1717,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "VaronisLowSeverityAlertsDetected_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "VaronisLowSeverityAlertsDetected_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -1745,10 +1745,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VaronisSaaSAlertsPush", "dataTypes": [ "VaronisAlerts_CL" - ] + ], + "connectorId": "VaronisSaaSAlertsPush" } ], "tactics": [ @@ -1762,26 +1762,26 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "UserNames_s" + "columnName": "UserNames_s", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "UserSamAccountNames_s" + "columnName": "UserSamAccountNames_s", + "identifier": "Name" } - ] + ], + "entityType": "Account" }, { - "entityType": "Host", "fieldMappings": [ { - "identifier": "HostName", - "columnName": "DeviceNames_s" + "columnName": "DeviceNames_s", + "identifier": "HostName" } - ] + ], + "entityType": "Host" } ], "eventGroupingSettings": { @@ -1789,23 +1789,23 @@ }, "customDetails": { "Status": "Status_s", - "MitreTactic": "MitreTacticName_s", "EventsCount": "EventsCount_d", - "AlertCategory": "AlertCategory_s", - "VaronisAlertGuid": "AlertId_g" + "MitreTactic": "MitreTacticName_s", + "VaronisAlertGuid": "AlertId_g", + "AlertCategory": "AlertCategory_s" }, "alertDetailsOverride": { - "alertDescriptionFormat": "Varonis detected activity for policy {{ThreatDetectionPolicyName_s}} in category {{AlertCategory_s}}. Users: {{UserNames_s}}.", - "alertDisplayNameFormat": "Varonis alert: {{ThreatDetectionPolicyName_s}} ({{AlertSeverity_s}})" + "alertDisplayNameFormat": "Varonis alert: {{ThreatDetectionPolicyName_s}} ({{AlertSeverity_s}})", + "alertDescriptionFormat": "Varonis detected activity for policy {{ThreatDetectionPolicyName_s}} in category {{AlertCategory_s}}. Users: {{UserNames_s}}." }, "incidentConfiguration": { + "createIncident": true, "groupingConfiguration": { "reopenClosedIncident": false, "lookbackDuration": "PT5H", "enabled": false, "matchingMethod": "AllEntities" - }, - "createIncident": true + } } } }, @@ -1859,7 +1859,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "VaronisInformationalAlertsDetected_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "VaronisInformationalAlertsDetected_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -1887,10 +1887,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VaronisSaaSAlertsPush", "dataTypes": [ "VaronisAlerts_CL" - ] + ], + "connectorId": "VaronisSaaSAlertsPush" } ], "tactics": [ @@ -1904,26 +1904,26 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "UserNames_s" + "columnName": "UserNames_s", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "UserSamAccountNames_s" + "columnName": "UserSamAccountNames_s", + "identifier": "Name" } - ] + ], + "entityType": "Account" }, { - "entityType": "Host", "fieldMappings": [ { - "identifier": "HostName", - "columnName": "DeviceNames_s" + "columnName": "DeviceNames_s", + "identifier": "HostName" } - ] + ], + "entityType": "Host" } ], "eventGroupingSettings": { @@ -1931,23 +1931,23 @@ }, "customDetails": { "Status": "Status_s", - "MitreTactic": "MitreTacticName_s", "EventsCount": "EventsCount_d", - "AlertCategory": "AlertCategory_s", - "VaronisAlertGuid": "AlertId_g" + "MitreTactic": "MitreTacticName_s", + "VaronisAlertGuid": "AlertId_g", + "AlertCategory": "AlertCategory_s" }, "alertDetailsOverride": { - "alertDescriptionFormat": "Varonis detected activity for policy {{ThreatDetectionPolicyName_s}} in category {{AlertCategory_s}}. Users: {{UserNames_s}}.", - "alertDisplayNameFormat": "Varonis alert: {{ThreatDetectionPolicyName_s}} ({{AlertSeverity_s}})" + "alertDisplayNameFormat": "Varonis alert: {{ThreatDetectionPolicyName_s}} ({{AlertSeverity_s}})", + "alertDescriptionFormat": "Varonis detected activity for policy {{ThreatDetectionPolicyName_s}} in category {{AlertCategory_s}}. Users: {{UserNames_s}}." }, "incidentConfiguration": { + "createIncident": true, "groupingConfiguration": { "reopenClosedIncident": false, "lookbackDuration": "PT5H", "enabled": false, "matchingMethod": "AllEntities" - }, - "createIncident": true + } } } }, @@ -1997,7 +1997,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.1.0", + "version": "3.1.1", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "VaronisSaaS", diff --git a/Solutions/VaronisSaaS/ReleaseNotes.md b/Solutions/VaronisSaaS/ReleaseNotes.md index 0e40859ebc3..3b07f35a746 100644 --- a/Solutions/VaronisSaaS/ReleaseNotes.md +++ b/Solutions/VaronisSaaS/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------| +| 3.1.1 | 29-07-2026 | Mark Azure Function data connector as Deprecated | | 3.1.0 | 21-04-2026 | Add CCF Push data connector | | 3.0.3 | 25-11-2025 | Add Informational severity level support | | 3.0.2 | 12-09-2025 | Save last alert ingest time |