diff --git a/Solutions/BitSight/Data Connectors/BitSight_CCF/ConnectorDefinition.json b/Solutions/BitSight/Data Connectors/BitSight_CCF/ConnectorDefinition.json index 3ddb6086d71..0fce40b8aa3 100644 --- a/Solutions/BitSight/Data Connectors/BitSight_CCF/ConnectorDefinition.json +++ b/Solutions/BitSight/Data Connectors/BitSight_CCF/ConnectorDefinition.json @@ -148,7 +148,7 @@ { "type": "Markdown", "parameters": { - "content": "## BitSight Statistics Connections\n\nManage multiple BitSight statistics connections. Each connection selects one or more **data streams** to ingest and assigns a **Connection Name** stored in the `connectionName` column of every ingested record.\n\n> **Authentication**: BitSight uses HTTP Basic Authentication where the API token is used as **both** the username and password." + "content": "## BitSight Statistics Connections\n\nManage multiple BitSight statistics connections. Each connection selects one or more **data streams** to ingest and assigns a **Connection Name** stored in the `connectionName` column of every ingested record.\n\n> **Authentication**: BitSight uses HTTP Basic Authentication with your API Token." } }, { @@ -160,8 +160,8 @@ "columnValue": "properties.addOnAttributes.connectionName" }, { - "columnName": "Active Streams", - "columnValue": "properties.addOnAttributes.streams" + "columnName": "Data Type", + "columnValue": "properties.dataType" }, { "columnName": "API URL", @@ -255,28 +255,16 @@ { "type": "Markdown", "parameters": { - "content": "## 3. Authentication\n\nBitSight uses your API token as **both** the username and password for HTTP Basic Authentication." + "content": "## 3. Authentication\n\nProvide your BitSight API Token. It authenticates requests to the BitSight REST API using HTTP Basic Authentication." } }, { "type": "Textbox", "parameters": { - "label": "BitSight API Token (Username)", + "label": "BitSight API Token", "placeholder": "Paste your BitSight API Token", - "type": "text", - "name": "username", - "validations": { - "required": true - } - } - }, - { - "type": "Textbox", - "parameters": { - "label": "BitSight API Token (Password)", - "placeholder": "Paste your BitSight API Token again", "type": "password", - "name": "password", + "name": "apiToken", "validations": { "required": true } diff --git a/Solutions/BitSight/Data Connectors/BitSight_CCF/PollingConfig.json b/Solutions/BitSight/Data Connectors/BitSight_CCF/PollingConfig.json index 2e92a5a36ef..6fe346bd2ff 100644 --- a/Solutions/BitSight/Data Connectors/BitSight_CCF/PollingConfig.json +++ b/Solutions/BitSight/Data Connectors/BitSight_CCF/PollingConfig.json @@ -1,4 +1,4 @@ -[ +[ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-03-01", @@ -7,9 +7,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -97,9 +98,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -185,9 +187,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -275,9 +278,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -365,9 +369,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -455,9 +460,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -545,9 +551,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -635,9 +642,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "https://service.bitsighttech.com/customer-api/v1/defaults/vulnerabilities", diff --git a/Solutions/BitSight/Data Connectors/BitSight_Events_CCF/ConnectorDefinition.json b/Solutions/BitSight/Data Connectors/BitSight_Events_CCF/ConnectorDefinition.json index c83017708ea..ed290bd17e1 100644 --- a/Solutions/BitSight/Data Connectors/BitSight_Events_CCF/ConnectorDefinition.json +++ b/Solutions/BitSight/Data Connectors/BitSight_Events_CCF/ConnectorDefinition.json @@ -103,7 +103,7 @@ { "type": "Markdown", "parameters": { - "content": "## BitSight Connections\n\nManage multiple BitSight data stream connections. Each connection selects a specific data type - **Alerts**, **Breaches**, or **Findings** - and assigns a **Connection Name** that is stored in the `ConnectorName` column of every ingested record.\n\n> **Authentication**: BitSight uses HTTP Basic Authentication where the API token is used as **both** the username and password." + "content": "## BitSight Connections\n\nManage multiple BitSight data stream connections. Each connection selects a specific data type - **Alerts**, **Breaches**, or **Findings** - and assigns a **Connection Name** that is stored in the `ConnectorName` column of every ingested record.\n\n> **Authentication**: BitSight uses HTTP Basic Authentication with your API Token." } }, { @@ -196,28 +196,16 @@ { "type": "Markdown", "parameters": { - "content": "## 3. Authentication\n\nBitSight uses your API token as **both** the username and password for HTTP Basic Authentication." + "content": "## 3. Authentication\n\nProvide your BitSight API Token. It authenticates requests to the BitSight REST API using HTTP Basic Authentication." } }, { "type": "Textbox", "parameters": { - "label": "BitSight API Token (Username)", + "label": "BitSight API Token", "placeholder": "Paste your BitSight API Token", - "type": "text", - "name": "username", - "validations": { - "required": true - } - } - }, - { - "type": "Textbox", - "parameters": { - "label": "BitSight API Token (Password)", - "placeholder": "Paste your BitSight API Token again", "type": "password", - "name": "password", + "name": "apiToken", "validations": { "required": true } diff --git a/Solutions/BitSight/Data Connectors/BitSight_Events_CCF/PollingConfig.json b/Solutions/BitSight/Data Connectors/BitSight_Events_CCF/PollingConfig.json index be4f943b26a..33fe7b77a3f 100644 --- a/Solutions/BitSight/Data Connectors/BitSight_Events_CCF/PollingConfig.json +++ b/Solutions/BitSight/Data Connectors/BitSight_Events_CCF/PollingConfig.json @@ -1,4 +1,4 @@ -[ +[ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-03-01", @@ -7,9 +7,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/v2/alerts/')]", @@ -66,9 +67,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -167,9 +169,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -271,9 +274,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -375,9 +379,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", diff --git a/Solutions/BitSight/Data/Solution_BitSight.json b/Solutions/BitSight/Data/Solution_BitSight.json index d14f90c3811..6a2088bb84a 100644 --- a/Solutions/BitSight/Data/Solution_BitSight.json +++ b/Solutions/BitSight/Data/Solution_BitSight.json @@ -37,7 +37,7 @@ "Data Connectors/BitSight_CCF/ConnectorDefinition.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\BitSight", - "Version": "3.2.0", + "Version": "3.2.1", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false diff --git a/Solutions/BitSight/Package/3.2.1.zip b/Solutions/BitSight/Package/3.2.1.zip new file mode 100644 index 00000000000..6c65eb90ad9 Binary files /dev/null and b/Solutions/BitSight/Package/3.2.1.zip differ diff --git a/Solutions/BitSight/Package/mainTemplate.json b/Solutions/BitSight/Package/mainTemplate.json index 703d67032af..2eb87c3ed5b 100644 --- a/Solutions/BitSight/Package/mainTemplate.json +++ b/Solutions/BitSight/Package/mainTemplate.json @@ -55,7 +55,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "BitSight", - "_solutionVersion": "3.2.0", + "_solutionVersion": "3.2.1", "solutionId": "bitsight_technologies_inc.bitsight_sentinel", "_solutionId": "[variables('solutionId')]", "workbookVersion1": "1.0.0", @@ -153,7 +153,7 @@ "_parserName7": "[concat(parameters('workspace'),'/','BitSightDiligenceStatistics')]", "_parserId7": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'BitSightDiligenceStatistics')]", "parserTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('BitSightDiligenceStatistics-Parser')))]", - "parserVersion7": "1.1.0", + "parserVersion7": "1.2.0", "parserContentId7": "BitSightDiligenceStatistics-Parser" }, "parserObject8": { @@ -181,14 +181,14 @@ "_parserName11": "[concat(parameters('workspace'),'/','BitSightIndustrialStatistics')]", "_parserId11": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'BitSightIndustrialStatistics')]", "parserTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('BitSightIndustrialStatistics-Parser')))]", - "parserVersion11": "1.1.0", + "parserVersion11": "1.2.0", "parserContentId11": "BitSightIndustrialStatistics-Parser" }, "parserObject12": { "_parserName12": "[concat(parameters('workspace'),'/','BitSightObservationStatistics')]", "_parserId12": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'BitSightObservationStatistics')]", "parserTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('BitSightObservationStatistics-Parser')))]", - "parserVersion12": "1.1.0", + "parserVersion12": "1.2.0", "parserContentId12": "BitSightObservationStatistics-Parser" }, "parserObject13": { @@ -207,7 +207,7 @@ "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", - "dataConnectorCCPVersion": "3.2.0", + "dataConnectorCCPVersion": "3.2.1", "_dataConnectorContentIdConnectorDefinition2": "BitSightEventsConnector", "dataConnectorTemplateNameConnectorDefinition2": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition2')))]", "_dataConnectorContentIdConnections2": "BitSightEventsConnectorConnections", @@ -231,7 +231,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightWorkbook Workbook with template version 3.2.0", + "description": "BitSightWorkbook Workbook with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -249,7 +249,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# My Company\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"df9ebd46-967c-445f-9328-d3538237ba3b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"company\",\"label\":\"Company Name\",\"type\":2,\"isRequired\":true,\"query\":\"BitSightCompanyDetails\\r\\n| distinct Name\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":\"Kati Communications, Inc.\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"parameters - 1\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"ae71f2b2-2245-4937-827e-20960f9ae3b8\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Timer\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":604800000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"parameters - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let latest_Rating = toscalar(BitSightGraphData\\r\\n| where todatetime(RatingDate) {Timer} and CompanyName == '{company}'\\r\\n| distinct CompanyName, RatingDate, Rating\\r\\n| summarize High = max(Rating), Low = min(Rating), any(RatingDate, Rating)\\r\\n| order by any_RatingDate desc\\r\\n| project strcat_delim(\\\"-\\\",any_Rating, High, Low)\\r\\n| limit 1);\\r\\nBitSightCompanyDetails\\r\\n| where Name == '{company}'\\r\\n| sort by TimeGenerated\\r\\n| extend LatestRating = toint(todecimal(split(latest_Rating, \\\"-\\\")[0])), High = toint(todecimal(split(latest_Rating, \\\"-\\\")[1])), Low = toint(todecimal(split(latest_Rating, \\\"-\\\")[2]))\\r\\n| project-rename Name = Name, Subscription = SubscriptionType , Industry = Industry, [\\\"Customer Monitoring Count\\\"] = CustomerMonitoringCount, [\\\"Latest Rating\\\"] = LatestRating\\r\\n| project Name, [\\\"Latest Rating\\\"], High, Low, Industry, [\\\"Customer Monitoring Count\\\"]\\r\\n| limit 1\",\"size\":4,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"0px\",\"padding\":\"0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"BitSightGraphData\\r\\n| where todatetime(RatingDate) {Timer} and CompanyName == '{company}'\\r\\n| distinct CompanyName, RatingDate, Rating\\r\\n| project CompanyName, RatingDate, Rating\\r\\n| order by RatingDate asc\",\"size\":0,\"aggregation\":4,\"title\":\"Security Ratings Over Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"xAxis\":\"RatingDate\",\"createOtherGroup\":0,\"showDataPoints\":true,\"ySettings\":{\"min\":300,\"max\":850}}},\"name\":\"query - 4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"BitSightFindingsData\\r\\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}'\\r\\n| summarize count() by RiskVectorLabel\\r\\n| order by count_ desc\",\"size\":0,\"title\":\"Count of Observations by Risk Vector\",\"exportFieldName\":\"x\",\"exportParameterName\":\"SelectedRiskVectorLabel\",\"exportDefaultValue\":\"none\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\",\"chartSettings\":{\"xAxis\":\"RiskVectorLabel\",\"createOtherGroup\":0,\"showLegend\":true}},\"name\":\"query - 5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"BitSightFindingsData\\r\\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}'\\r\\n| where RiskVectorLabel == '{SelectedRiskVectorLabel}'\\r\\n| project-away EventVendor, EventProduct\",\"size\":0,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"sortBy\":[{\"itemKey\":\"RemediationHistoryLastRefreshStatusDate\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"RemediationHistoryLastRefreshStatusDate\",\"sortOrder\":2}]},\"conditionalVisibility\":{\"parameterName\":\"SelectedRiskVectorLabel\",\"comparison\":\"isNotEqualTo\",\"value\":\"none\"},\"name\":\"query - 16\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"BitSightFindingsData\\r\\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}' and RiskCategory == \\\"Compromised Systems\\\"\\r\\n| extend Date = format_datetime(todatetime(LastSeen), 'yyyy-MM')\\r\\n| summarize count() by RiskVectorLabel,Date\\r\\n| project Date, count_, RiskVectorLabel\\r\\n| order by Date asc\\r\\n\",\"size\":0,\"aggregation\":4,\"title\":\"Compromised Systems by Risk Vector Over Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"Date\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"xAxis\":\"Date\",\"yAxis\":[\"count_\"],\"group\":\"RiskVectorLabel\",\"showDataPoints\":true}},\"name\":\"query - 6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"BitSightFindingsData\\r\\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}' and RiskCategory == \\\"User Behavior\\\"\\r\\n| extend Date = format_datetime(todatetime(LastSeen), 'yyyy-MM')\\r\\n| summarize count() by RiskVectorLabel,Date\\r\\n| project Date, count_, RiskVectorLabel\\r\\n| order by Date asc\\r\\n\",\"size\":0,\"aggregation\":4,\"title\":\"User Behavior by Risk Vector Over Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"xAxis\":\"Date\",\"yAxis\":[\"count_\"],\"group\":\"RiskVectorLabel\"}},\"name\":\"query - 15\"},{\"type\":1,\"content\":{\"json\":\"##### Diligence by Risk Vector Over Time\"},\"name\":\"text - 13\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"4d26ba1c-db98-437a-9a0c-63126f341afb\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Risk_Vector\",\"label\":\"Risk Vector\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"BitSightFindingsData\\r\\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}' and RiskCategory == \\\"Diligence\\\"\\r\\n| distinct RiskVectorLabel\\r\\n\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"BitSightFindingsData\\r\\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}' and RiskCategory == \\\"Diligence\\\" and ('*' in ({Risk_Vector}) or RiskVectorLabel in ({Risk_Vector}))\\r\\n| extend Date = format_datetime(todatetime(LastSeen), 'yyyy-MM')\\r\\n| summarize count() by RiskVectorLabel,Date\\r\\n| project Date, count_, RiskVectorLabel\\r\\n| order by Date asc\\r\\n\",\"size\":0,\"aggregation\":4,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Date\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"xAxis\":\"Date\",\"yAxis\":[\"count_\"],\"group\":\"RiskVectorLabel\",\"createOtherGroup\":0,\"showDataPoints\":true}},\"name\":\"query - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"BitSightDiligenceHistoricalStatistics\\r\\n| where todatetime(Date) {Timer} and CompanyName == '{company}'\\r\\n| extend yyyy_mm = format_datetime(todatetime(Date), 'yyyy-MM')\\r\\n| summarize round(avg(Count),2) by yyyy_mm, Category\\r\\n| project Category, avg_Count, yyyy_mm = strcat(yyyy_mm,\\\" (Avg)\\\")\\r\\n| order by yyyy_mm asc, Category asc\\r\\n| limit 15\",\"size\":0,\"aggregation\":4,\"title\":\"Diligence Observations by Severity\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\",\"chartSettings\":{\"xAxis\":\"yyyy_mm\",\"yAxis\":[\"avg_Count\"],\"group\":\"Category\"}},\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"BitSightFindingsData\\r\\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}' and RiskCategory == \\\"Compromised Systems\\\" and RiskVectorLabel == \\\"Botnet Infections\\\"\\r\\n| extend d=parse_json(Details) \\r\\n| mv-expand asset = todynamic(Assets)\\r\\n| project Infection = dynamic_to_json(d[0].infection.family), [\\\"Detection Method\\\"] = dynamic_to_json(d[0].detection_method), [\\\"Last Seen\\\"] = column_ifexists(\\\"LastSeen\\\",\\\"\\\"), Asset = dynamic_to_json(asset.asset)\\r\\n| distinct Infection, [\\\"Detection Method\\\"], Asset, [\\\"Last Seen\\\"]\\r\\n| order by [\\\"Last Seen\\\"] desc\",\"size\":0,\"title\":\"Infections\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 7\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"##### Vulnerabilities\"},\"name\":\"text - 11\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"c7ff4374-c346-4c43-9354-8936687c2704\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Severity\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"BitSightFindingsSummary\\r\\n| where todatetime(StartDate) {Timer} and Company == '{company}'\\r\\n| extend Filter = case(toreal(Severity) <= 3.9 and toreal(Severity) >= 0.0, \\\"Minor\\\", \\r\\n toreal(Severity) <= 6.9 and toreal(Severity) >= 4.0, \\\"Moderate\\\",\\r\\n toreal(Severity) <= 8.9 and toreal(Severity) >= 7.0, \\\"Material\\\",\\r\\n toreal(Severity) <= 10.0 and toreal(Severity) >= 9.0, \\\"Severe\\\",\\r\\n \\\"\\\")\\r\\n| distinct Filter\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 10\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"BitSightFindingsSummary\\r\\n| where todatetime(StartDate) {Timer} and Company == '{company}'\\r\\n| distinct Name, Severity, StartDate, EndDate, Description\\r\\n| extend [\\\"Severity Details\\\"] = case(toreal(Severity) <= 3.9 and toreal(Severity) >= 0.0, \\\"Minor\\\", \\r\\n toreal(Severity) <= 6.9 and toreal(Severity) >= 4.0, \\\"Moderate\\\",\\r\\n toreal(Severity) <= 8.9 and toreal(Severity) >= 7.0, \\\"Material\\\",\\r\\n toreal(Severity) <= 10.0 and toreal(Severity) >= 9.0, \\\"Severe\\\",\\r\\n \\\"\\\")\\r\\n| where ('*' in ({Severity}) or [\\\"Severity Details\\\"] in ({Severity}))\\r\\n| project-rename Name = Name, [\\\"Start Date\\\"] = StartDate, [\\\"End Date\\\"] = EndDate\\r\\n| project Name, [\\\"Severity Details\\\"], [\\\"Start Date\\\"], [\\\"End Date\\\"], Description\\r\\n\",\"size\":0,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 9\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"My Company\"}]},\"name\":\"Main\",\"styleSettings\":{\"showBorder\":true}}],\"fromTemplateId\":\"sentinel-BitSightWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# My Company\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"df9ebd46-967c-445f-9328-d3538237ba3b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"company\",\"label\":\"Company Name\",\"type\":2,\"isRequired\":true,\"query\":\"BitSightCompanyDetails\\r\\n| distinct Name\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":\"Kati Communications, Inc.\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"parameters - 1\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"ae71f2b2-2245-4937-827e-20960f9ae3b8\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Timer\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":604800000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"parameters - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let latest_Rating = toscalar(BitSightGraphData\\r\\n| where todatetime(RatingDate) {Timer} and CompanyName == '{company}'\\r\\n| distinct CompanyName, RatingDate, Rating\\r\\n| summarize High = max(Rating), Low = min(Rating), any(RatingDate, Rating)\\r\\n| order by any_RatingDate desc\\r\\n| project strcat_delim(\\\"-\\\",any_Rating, High, Low)\\r\\n| limit 1);\\r\\nBitSightCompanyDetails\\r\\n| where Name == '{company}'\\r\\n| sort by TimeGenerated\\r\\n| extend LatestRating = toint(todecimal(split(latest_Rating, \\\"-\\\")[0])), High = toint(todecimal(split(latest_Rating, \\\"-\\\")[1])), Low = toint(todecimal(split(latest_Rating, \\\"-\\\")[2]))\\r\\n| project-rename Name = Name, Subscription = SubscriptionType , Industry = Industry, [\\\"Customer Monitoring Count\\\"] = CustomerMonitoringCount, [\\\"Latest Rating\\\"] = LatestRating\\r\\n| project Name, [\\\"Latest Rating\\\"], High, Low, Industry, [\\\"Customer Monitoring Count\\\"]\\r\\n| limit 1\",\"size\":4,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"0px\",\"padding\":\"0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"BitSightGraphData\\r\\n| where todatetime(RatingDate) {Timer} and CompanyName == '{company}'\\r\\n| distinct CompanyName, RatingDate, Rating\\r\\n| project CompanyName, RatingDate, Rating\\r\\n| order by RatingDate asc\",\"size\":0,\"aggregation\":4,\"title\":\"Security Ratings Over Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"xAxis\":\"RatingDate\",\"createOtherGroup\":0,\"showDataPoints\":true,\"ySettings\":{\"min\":300,\"max\":850}}},\"name\":\"query - 4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"BitSightFindingsData\\r\\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}'\\r\\n| summarize count() by RiskVectorLabel\\r\\n| order by count_ desc\",\"size\":0,\"title\":\"Count of Observations by Risk Vector\",\"exportFieldName\":\"x\",\"exportParameterName\":\"SelectedRiskVectorLabel\",\"exportDefaultValue\":\"none\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\",\"chartSettings\":{\"xAxis\":\"RiskVectorLabel\",\"createOtherGroup\":0,\"showLegend\":true}},\"name\":\"query - 5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"BitSightFindingsData\\r\\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}'\\r\\n| where RiskVectorLabel == '{SelectedRiskVectorLabel}'\\r\\n| project-away EventVendor, EventProduct\",\"size\":0,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"sortBy\":[{\"itemKey\":\"RemediationHistoryLastRefreshStatusDate\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"RemediationHistoryLastRefreshStatusDate\",\"sortOrder\":2}]},\"conditionalVisibility\":{\"parameterName\":\"SelectedRiskVectorLabel\",\"comparison\":\"isNotEqualTo\",\"value\":\"none\"},\"name\":\"query - 16\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"BitSightFindingsData\\r\\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}' and RiskCategory == \\\"Compromised Systems\\\"\\r\\n| extend Date = format_datetime(todatetime(LastSeen), 'yyyy-MM')\\r\\n| summarize count() by RiskVectorLabel,Date\\r\\n| project Date, count_, RiskVectorLabel\\r\\n| order by Date asc\\r\\n\",\"size\":0,\"aggregation\":4,\"title\":\"Compromised Systems by Risk Vector Over Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"Date\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"xAxis\":\"Date\",\"yAxis\":[\"count_\"],\"group\":\"RiskVectorLabel\",\"showDataPoints\":true}},\"name\":\"query - 6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"BitSightFindingsData\\r\\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}' and RiskCategory == \\\"User Behavior\\\"\\r\\n| extend Date = format_datetime(todatetime(LastSeen), 'yyyy-MM')\\r\\n| summarize count() by RiskVectorLabel,Date\\r\\n| project Date, count_, RiskVectorLabel\\r\\n| order by Date asc\\r\\n\",\"size\":0,\"aggregation\":4,\"title\":\"User Behavior by Risk Vector Over Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"xAxis\":\"Date\",\"yAxis\":[\"count_\"],\"group\":\"RiskVectorLabel\"}},\"name\":\"query - 15\"},{\"type\":1,\"content\":{\"json\":\"##### Diligence by Risk Vector Over Time\"},\"name\":\"text - 13\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"4d26ba1c-db98-437a-9a0c-63126f341afb\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Risk_Vector\",\"label\":\"Risk Vector\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"BitSightFindingsData\\r\\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}' and RiskCategory == \\\"Diligence\\\"\\r\\n| distinct RiskVectorLabel\\r\\n\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"BitSightFindingsData\\r\\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}' and RiskCategory == \\\"Diligence\\\" and ('*' in ({Risk_Vector}) or RiskVectorLabel in ({Risk_Vector}))\\r\\n| extend Date = format_datetime(todatetime(LastSeen), 'yyyy-MM')\\r\\n| summarize count() by RiskVectorLabel,Date\\r\\n| project Date, count_, RiskVectorLabel\\r\\n| order by Date asc\\r\\n\",\"size\":0,\"aggregation\":4,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Date\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"xAxis\":\"Date\",\"yAxis\":[\"count_\"],\"group\":\"RiskVectorLabel\",\"createOtherGroup\":0,\"showDataPoints\":true}},\"name\":\"query - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"BitSightDiligenceHistoricalStatistics\\r\\n| where todatetime(Date) {Timer} and CompanyName == '{company}'\\r\\n| extend yyyy_mm = format_datetime(todatetime(Date), 'yyyy-MM')\\r\\n| summarize round(avg(Count),2) by yyyy_mm, Category\\r\\n| project Category, avg_Count, yyyy_mm = strcat(yyyy_mm,\\\" (Avg)\\\")\\r\\n| order by yyyy_mm asc, Category asc\\r\\n| limit 15\",\"size\":0,\"aggregation\":4,\"title\":\"Diligence Observations by Severity\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\",\"chartSettings\":{\"xAxis\":\"yyyy_mm\",\"yAxis\":[\"avg_Count\"],\"group\":\"Category\"}},\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"BitSightFindingsData\\r\\n| where todatetime(LastSeen) {Timer} and CompanyName == '{company}' and RiskCategory == \\\"Compromised Systems\\\" and RiskVectorLabel == \\\"Botnet Infections\\\"\\r\\n| extend d=parse_json(Details) \\r\\n| mv-expand asset = todynamic(Assets)\\r\\n| project Infection = dynamic_to_json(d[0].infection.family), [\\\"Detection Method\\\"] = dynamic_to_json(d[0].detection_method), [\\\"Last Seen\\\"] = column_ifexists(\\\"LastSeen\\\",\\\"\\\"), Asset = dynamic_to_json(asset.asset)\\r\\n| distinct Infection, [\\\"Detection Method\\\"], Asset, [\\\"Last Seen\\\"]\\r\\n| order by [\\\"Last Seen\\\"] desc\",\"size\":0,\"title\":\"Infections\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 7\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"##### Vulnerabilities\"},\"name\":\"text - 11\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"c7ff4374-c346-4c43-9354-8936687c2704\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Severity\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"BitSightFindingsSummary\\r\\n| where todatetime(StartDate) {Timer} and Company == '{company}'\\r\\n| extend Filter = case(toreal(Severity) <= 3.9 and toreal(Severity) >= 0.0, \\\"Minor\\\", \\r\\n toreal(Severity) <= 6.9 and toreal(Severity) >= 4.0, \\\"Moderate\\\",\\r\\n toreal(Severity) <= 8.9 and toreal(Severity) >= 7.0, \\\"Material\\\",\\r\\n toreal(Severity) <= 10.0 and toreal(Severity) >= 9.0, \\\"Severe\\\",\\r\\n \\\"\\\")\\r\\n| distinct Filter\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 10\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"BitSightFindingsSummary\\r\\n| where todatetime(StartDate) {Timer} and Company == '{company}'\\r\\n| distinct Name, Severity, StartDate, EndDate, Description\\r\\n| extend [\\\"Severity Details\\\"] = case(toreal(Severity) <= 3.9 and toreal(Severity) >= 0.0, \\\"Minor\\\", \\r\\n toreal(Severity) <= 6.9 and toreal(Severity) >= 4.0, \\\"Moderate\\\",\\r\\n toreal(Severity) <= 8.9 and toreal(Severity) >= 7.0, \\\"Material\\\",\\r\\n toreal(Severity) <= 10.0 and toreal(Severity) >= 9.0, \\\"Severe\\\",\\r\\n \\\"\\\")\\r\\n| where ('*' in ({Severity}) or [\\\"Severity Details\\\"] in ({Severity}))\\r\\n| project-rename Name = Name, [\\\"Start Date\\\"] = StartDate, [\\\"End Date\\\"] = EndDate\\r\\n| project Name, [\\\"Severity Details\\\"], [\\\"Start Date\\\"], [\\\"End Date\\\"], Description\\r\\n\",\"size\":0,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 9\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"My Company\"}]},\"name\":\"Main\",\"styleSettings\":{\"showBorder\":true}}],\"fromTemplateId\":\"sentinel-BitSightWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -359,7 +359,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightDropInCompanyRatings_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "BitSightDropInCompanyRatings_AnalyticalRules Analytics Rule with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -387,10 +387,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "BitSight", "dataTypes": [ "BitSightGraphData" - ], - "connectorId": "BitSight" + ] } ], "tactics": [ @@ -409,8 +409,8 @@ "CompanyName": "CompanyName" }, "alertDetailsOverride": { - "alertDescriptionFormat": "Alert is generated for {{CompanyName}}.\\n\\nRating Date: {{RatingDate}}\\nPercentage Drop: {{percentage}}%", - "alertDisplayNameFormat": "BitSight : Alert for >10% drop in ratings of {{CompanyName}}." + "alertDisplayNameFormat": "BitSight : Alert for >10% drop in ratings of {{CompanyName}}.", + "alertDescriptionFormat": "Alert is generated for {{CompanyName}}.\\n\\nRating Date: {{RatingDate}}\\nPercentage Drop: {{percentage}}%" }, "incidentConfiguration": { "createIncident": false @@ -468,7 +468,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightNewAlertFound_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "BitSightNewAlertFound_AnalyticalRules Analytics Rule with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -496,10 +496,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "BitSight", "dataTypes": [ "BitSightAlerts" - ], - "connectorId": "BitSight" + ] } ], "tactics": [ @@ -512,22 +512,22 @@ ], "entityMappings": [ { - "entityType": "URL", "fieldMappings": [ { - "columnName": "CompanyURL", - "identifier": "Url" + "identifier": "Url", + "columnName": "CompanyURL" } - ] + ], + "entityType": "URL" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "alertDetailsOverride": { - "alertSeverityColumnName": "Severity", "alertDescriptionFormat": "Alert generated on {{AlertDate}} in BitSight.\\n\\nCompany URL: {{CompanyURL}}\\nAlert GUID: {{GUID}}", - "alertDisplayNameFormat": "BitSight: Alert for {{Trigger}} in {{CompanyName}} from bitsight." + "alertDisplayNameFormat": "BitSight: Alert for {{Trigger}} in {{CompanyName}} from bitsight.", + "alertSeverityColumnName": "Severity" }, "incidentConfiguration": { "createIncident": false @@ -585,7 +585,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightCompromisedSystemsDetected_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "BitSightCompromisedSystemsDetected_AnalyticalRules Analytics Rule with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -613,10 +613,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "BitSight", "dataTypes": [ "BitSightFindingsData" - ], - "connectorId": "BitSight" + ] } ], "tactics": [ @@ -627,26 +627,26 @@ ], "entityMappings": [ { - "entityType": "Malware", "fieldMappings": [ { - "columnName": "RiskVector", - "identifier": "Name" + "identifier": "Name", + "columnName": "RiskVector" }, { - "columnName": "RiskCategory", - "identifier": "Category" + "identifier": "Category", + "columnName": "RiskCategory" } - ] + ], + "entityType": "Malware" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "alertDetailsOverride": { - "alertSeverityColumnName": "Severity", "alertDescriptionFormat": "Alert is generated for {{CompanyName}}.\\n\\nRisk Vector: {{RiskVector}}\\nTemporaryId: {{TemporaryId}}\\nRisk Category: Compromised Systems", - "alertDisplayNameFormat": "BitSight: Alert for {{RiskVector}} in {{CompanyName}} from BitSight" + "alertDisplayNameFormat": "BitSight: Alert for {{RiskVector}} in {{CompanyName}} from BitSight", + "alertSeverityColumnName": "Severity" }, "incidentConfiguration": { "createIncident": true @@ -704,7 +704,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightDiligenceRiskCategoryDetected_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "BitSightDiligenceRiskCategoryDetected_AnalyticalRules Analytics Rule with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -732,10 +732,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "BitSight", "dataTypes": [ "BitSightFindingsData" - ], - "connectorId": "BitSight" + ] } ], "tactics": [ @@ -751,26 +751,26 @@ ], "entityMappings": [ { - "entityType": "Malware", "fieldMappings": [ { - "columnName": "RiskVector", - "identifier": "Name" + "identifier": "Name", + "columnName": "RiskVector" }, { - "columnName": "RiskCategory", - "identifier": "Category" + "identifier": "Category", + "columnName": "RiskCategory" } - ] + ], + "entityType": "Malware" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "alertDetailsOverride": { - "alertSeverityColumnName": "Severity", "alertDescriptionFormat": "Alert is generated for {{CompanyName}}.\\n\\nRisk Vector: {{RiskVector}}\\nTemporaryId: {{TemporaryId}}\\nRisk Category: Diligence", - "alertDisplayNameFormat": "BitSight: Alert for {{RiskVector}} in {{CompanyName}} from BitSight" + "alertDisplayNameFormat": "BitSight: Alert for {{RiskVector}} in {{CompanyName}} from BitSight", + "alertSeverityColumnName": "Severity" }, "incidentConfiguration": { "createIncident": false @@ -828,7 +828,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightDropInHeadlineRating_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "BitSightDropInHeadlineRating_AnalyticalRules Analytics Rule with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -856,10 +856,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "BitSight", "dataTypes": [ "BitSightGraphData" - ], - "connectorId": "BitSight" + ] } ], "tactics": [ @@ -878,8 +878,8 @@ "CompanyName": "CompanyName" }, "alertDetailsOverride": { - "alertDescriptionFormat": "Alert is generated for {{CompanyName}}.\\n\\nRating Date: {{RatingDate}}\\nRating Drop: {{RatingDifferance}}", - "alertDisplayNameFormat": "BitSight : Alert for drop in the headline rating of {{CompanyName}}." + "alertDisplayNameFormat": "BitSight : Alert for drop in the headline rating of {{CompanyName}}.", + "alertDescriptionFormat": "Alert is generated for {{CompanyName}}.\\n\\nRating Date: {{RatingDate}}\\nRating Drop: {{RatingDifferance}}" }, "incidentConfiguration": { "createIncident": false @@ -937,7 +937,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightNewBreachFound_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "BitSightNewBreachFound_AnalyticalRules Analytics Rule with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -965,10 +965,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "BitSight", "dataTypes": [ "BitSightBreaches" - ], - "connectorId": "BitSight" + ] } ], "tactics": [ @@ -981,22 +981,22 @@ ], "entityMappings": [ { - "entityType": "URL", "fieldMappings": [ { - "columnName": "PreviwURL", - "identifier": "Url" + "identifier": "Url", + "columnName": "PreviwURL" } - ] + ], + "entityType": "URL" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "alertDetailsOverride": { - "alertSeverityColumnName": "Severity", "alertDescriptionFormat": "Alert is generated on {{DateCreated}} at BitSight.\\n\\nGUID: {{GUID}}\\nPreview URL: {{PreviwURL}}", - "alertDisplayNameFormat": "BitSight: Alert for new breach in {{Companyname}}." + "alertDisplayNameFormat": "BitSight: Alert for new breach in {{Companyname}}.", + "alertSeverityColumnName": "Severity" }, "incidentConfiguration": { "createIncident": false @@ -1054,7 +1054,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightAlerts Data Parser with template version 3.2.0", + "description": "BitSightAlerts Data Parser with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", @@ -1186,7 +1186,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightBreaches Data Parser with template version 3.2.0", + "description": "BitSightBreaches Data Parser with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject2').parserVersion2]", @@ -1318,7 +1318,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightCompanyDetails Data Parser with template version 3.2.0", + "description": "BitSightCompanyDetails Data Parser with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject3').parserVersion3]", @@ -1450,7 +1450,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightCompanyRatingDetails Data Parser with template version 3.2.0", + "description": "BitSightCompanyRatingDetails Data Parser with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject4').parserVersion4]", @@ -1582,7 +1582,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightCompanyRatings Data Parser with template version 3.2.0", + "description": "BitSightCompanyRatings Data Parser with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject5').parserVersion5]", @@ -1714,7 +1714,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightDiligenceHistoricalStatistics Data Parser with template version 3.2.0", + "description": "BitSightDiligenceHistoricalStatistics Data Parser with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject6').parserVersion6]", @@ -1846,7 +1846,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightDiligenceStatistics Data Parser with template version 3.2.0", + "description": "BitSightDiligenceStatistics Data Parser with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject7').parserVersion7]", @@ -1863,7 +1863,7 @@ "displayName": "Parser for BitSightDiligenceStatistics", "category": "Microsoft Sentinel Parser", "functionAlias": "BitSightDiligenceStatistics", - "query": "union isfuzzy=true\n (\n BitsightDiligence_statistics_CL\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"DiligenceStatistics\",\n Unknown = column_ifexists('unknown', ''),\n Bad = column_ifexists('bad', ''),\n Warn = column_ifexists('warn', ''),\n Neutral = column_ifexists('neutral', ''),\n Fair = column_ifexists('fair', ''),\n Good = column_ifexists('good', ''),\n RiskVector = column_ifexists('risk_vector', ''),\n CompanyName = column_ifexists('Company_name', ''),\n SpearPhishing = column_ifexists('spear_phishing', ''),\n BitFlip = column_ifexists('bit_flip', ''),\n TypographicalErrors = column_ifexists('typographical_errors', ''),\n TLDVariant = column_ifexists('tld_variant', ''),\n TotalCount = column_ifexists('total_count', '')\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n Unknown,\n Bad,\n Warn,\n Neutral,\n Fair,\n Good,\n RiskVector,\n CompanyName,\n SpearPhishing,\n BitFlip,\n TypographicalErrors,\n TLDVariant,\n TotalCount\n ),\n (\n BitSightDiligenceStatistics_CL\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"DiligenceStatistics\"\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n CompanyName,\n CompanyGuid,\n RiskVector,\n Unknown,\n Bad,\n Warn,\n Neutral,\n Fair,\n Good,\n SpearPhishing,\n BitFlip,\n TypographicalErrors,\n TldVariant,\n TotalCount,\n ConnectorName\n )\n", + "query": "union isfuzzy=true\n (\n BitsightDiligence_statistics_CL\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"DiligenceStatistics\",\n Unknown = column_ifexists('unknown', ''),\n Bad = column_ifexists('bad', ''),\n Warn = column_ifexists('warn', ''),\n Neutral = column_ifexists('neutral', ''),\n Fair = column_ifexists('fair', ''),\n Good = column_ifexists('good', ''),\n RiskVector = column_ifexists('risk_vector', ''),\n CompanyName = column_ifexists('Company_name', ''),\n SpearPhishing = column_ifexists('spear_phishing', ''),\n BitFlip = column_ifexists('bit_flip', ''),\n TypographicalErrors = column_ifexists('typographical_errors', ''),\n TLDVariant = column_ifexists('tld_variant', ''),\n TotalCount = column_ifexists('total_count', '')\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n Unknown,\n Bad,\n Warn,\n Neutral,\n Fair,\n Good,\n RiskVector,\n CompanyName,\n SpearPhishing,\n BitFlip,\n TypographicalErrors,\n TLDVariant,\n TotalCount\n ),\n (\n BitSightDiligenceStatistics_CL\n | summarize arg_max(TimeGenerated, *) by CompanyGuid, RiskVector\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"DiligenceStatistics\"\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n CompanyName,\n CompanyGuid,\n RiskVector,\n Unknown,\n Bad,\n Warn,\n Neutral,\n Fair,\n Good,\n SpearPhishing,\n BitFlip,\n TypographicalErrors,\n TldVariant,\n TotalCount,\n ConnectorName\n )\n", "functionParameters": "", "version": 2, "tags": [ @@ -1913,8 +1913,8 @@ "contentId": "[variables('parserObject7').parserContentId7]", "contentKind": "Parser", "displayName": "Parser for BitSightDiligenceStatistics", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject7').parserContentId7,'-', '1.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject7').parserContentId7,'-', '1.1.0')))]", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject7').parserContentId7,'-', '1.2.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject7').parserContentId7,'-', '1.2.0')))]", "version": "[variables('parserObject7').parserVersion7]" } }, @@ -1928,7 +1928,7 @@ "displayName": "Parser for BitSightDiligenceStatistics", "category": "Microsoft Sentinel Parser", "functionAlias": "BitSightDiligenceStatistics", - "query": "union isfuzzy=true\n (\n BitsightDiligence_statistics_CL\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"DiligenceStatistics\",\n Unknown = column_ifexists('unknown', ''),\n Bad = column_ifexists('bad', ''),\n Warn = column_ifexists('warn', ''),\n Neutral = column_ifexists('neutral', ''),\n Fair = column_ifexists('fair', ''),\n Good = column_ifexists('good', ''),\n RiskVector = column_ifexists('risk_vector', ''),\n CompanyName = column_ifexists('Company_name', ''),\n SpearPhishing = column_ifexists('spear_phishing', ''),\n BitFlip = column_ifexists('bit_flip', ''),\n TypographicalErrors = column_ifexists('typographical_errors', ''),\n TLDVariant = column_ifexists('tld_variant', ''),\n TotalCount = column_ifexists('total_count', '')\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n Unknown,\n Bad,\n Warn,\n Neutral,\n Fair,\n Good,\n RiskVector,\n CompanyName,\n SpearPhishing,\n BitFlip,\n TypographicalErrors,\n TLDVariant,\n TotalCount\n ),\n (\n BitSightDiligenceStatistics_CL\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"DiligenceStatistics\"\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n CompanyName,\n CompanyGuid,\n RiskVector,\n Unknown,\n Bad,\n Warn,\n Neutral,\n Fair,\n Good,\n SpearPhishing,\n BitFlip,\n TypographicalErrors,\n TldVariant,\n TotalCount,\n ConnectorName\n )\n", + "query": "union isfuzzy=true\n (\n BitsightDiligence_statistics_CL\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"DiligenceStatistics\",\n Unknown = column_ifexists('unknown', ''),\n Bad = column_ifexists('bad', ''),\n Warn = column_ifexists('warn', ''),\n Neutral = column_ifexists('neutral', ''),\n Fair = column_ifexists('fair', ''),\n Good = column_ifexists('good', ''),\n RiskVector = column_ifexists('risk_vector', ''),\n CompanyName = column_ifexists('Company_name', ''),\n SpearPhishing = column_ifexists('spear_phishing', ''),\n BitFlip = column_ifexists('bit_flip', ''),\n TypographicalErrors = column_ifexists('typographical_errors', ''),\n TLDVariant = column_ifexists('tld_variant', ''),\n TotalCount = column_ifexists('total_count', '')\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n Unknown,\n Bad,\n Warn,\n Neutral,\n Fair,\n Good,\n RiskVector,\n CompanyName,\n SpearPhishing,\n BitFlip,\n TypographicalErrors,\n TLDVariant,\n TotalCount\n ),\n (\n BitSightDiligenceStatistics_CL\n | summarize arg_max(TimeGenerated, *) by CompanyGuid, RiskVector\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"DiligenceStatistics\"\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n CompanyName,\n CompanyGuid,\n RiskVector,\n Unknown,\n Bad,\n Warn,\n Neutral,\n Fair,\n Good,\n SpearPhishing,\n BitFlip,\n TypographicalErrors,\n TldVariant,\n TotalCount,\n ConnectorName\n )\n", "functionParameters": "", "version": 2, "tags": [ @@ -1978,7 +1978,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightFindingsData Data Parser with template version 3.2.0", + "description": "BitSightFindingsData Data Parser with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject8').parserVersion8]", @@ -2110,7 +2110,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightFindingsSummary Data Parser with template version 3.2.0", + "description": "BitSightFindingsSummary Data Parser with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject9').parserVersion9]", @@ -2242,7 +2242,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightGraphData Data Parser with template version 3.2.0", + "description": "BitSightGraphData Data Parser with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject10').parserVersion10]", @@ -2374,7 +2374,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightIndustrialStatistics Data Parser with template version 3.2.0", + "description": "BitSightIndustrialStatistics Data Parser with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject11').parserVersion11]", @@ -2391,7 +2391,7 @@ "displayName": "Parser for BitSightIndustrialStatistics", "category": "Microsoft Sentinel Parser", "functionAlias": "BitSightIndustrialStatistics", - "query": "union isfuzzy=true\n (\n BitsightIndustrial_statistics_CL\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"IndustrialStatistics\",\n Count = column_ifexists('count', ''),\n CountPeriod = column_ifexists('count_period', ''),\n AverageDurationDays = column_ifexists('average_duration_days', ''),\n RiskVector = column_ifexists('risk_vector', ''),\n CompanyName = column_ifexists('Company_name', '')\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n Count,\n CountPeriod,\n AverageDurationDays,\n RiskVector,\n CompanyName\n ),\n (\n BitsightIndustrialStatistics_CL\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"IndustrialStatistics\"\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n CompanyName,\n CompanyGuid,\n RiskVector,\n IncidentCount,\n CountPeriod,\n AverageDurationDays,\n ConnectorName\n )\n", + "query": "union isfuzzy=true\n (\n BitsightIndustrial_statistics_CL\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"IndustrialStatistics\",\n Count = column_ifexists('count', ''),\n CountPeriod = column_ifexists('count_period', ''),\n AverageDurationDays = column_ifexists('average_duration_days', ''),\n RiskVector = column_ifexists('risk_vector', ''),\n CompanyName = column_ifexists('Company_name', '')\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n Count,\n CountPeriod,\n AverageDurationDays,\n RiskVector,\n CompanyName\n ),\n (\n BitsightIndustrialStatistics_CL\n | summarize arg_max(TimeGenerated, *) by CompanyGuid, RiskVector\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"IndustrialStatistics\"\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n CompanyName,\n CompanyGuid,\n RiskVector,\n IncidentCount,\n CountPeriod,\n AverageDurationDays,\n ConnectorName\n )\n", "functionParameters": "", "version": 2, "tags": [ @@ -2441,8 +2441,8 @@ "contentId": "[variables('parserObject11').parserContentId11]", "contentKind": "Parser", "displayName": "Parser for BitSightIndustrialStatistics", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject11').parserContentId11,'-', '1.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject11').parserContentId11,'-', '1.1.0')))]", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject11').parserContentId11,'-', '1.2.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject11').parserContentId11,'-', '1.2.0')))]", "version": "[variables('parserObject11').parserVersion11]" } }, @@ -2456,7 +2456,7 @@ "displayName": "Parser for BitSightIndustrialStatistics", "category": "Microsoft Sentinel Parser", "functionAlias": "BitSightIndustrialStatistics", - "query": "union isfuzzy=true\n (\n BitsightIndustrial_statistics_CL\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"IndustrialStatistics\",\n Count = column_ifexists('count', ''),\n CountPeriod = column_ifexists('count_period', ''),\n AverageDurationDays = column_ifexists('average_duration_days', ''),\n RiskVector = column_ifexists('risk_vector', ''),\n CompanyName = column_ifexists('Company_name', '')\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n Count,\n CountPeriod,\n AverageDurationDays,\n RiskVector,\n CompanyName\n ),\n (\n BitsightIndustrialStatistics_CL\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"IndustrialStatistics\"\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n CompanyName,\n CompanyGuid,\n RiskVector,\n IncidentCount,\n CountPeriod,\n AverageDurationDays,\n ConnectorName\n )\n", + "query": "union isfuzzy=true\n (\n BitsightIndustrial_statistics_CL\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"IndustrialStatistics\",\n Count = column_ifexists('count', ''),\n CountPeriod = column_ifexists('count_period', ''),\n AverageDurationDays = column_ifexists('average_duration_days', ''),\n RiskVector = column_ifexists('risk_vector', ''),\n CompanyName = column_ifexists('Company_name', '')\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n Count,\n CountPeriod,\n AverageDurationDays,\n RiskVector,\n CompanyName\n ),\n (\n BitsightIndustrialStatistics_CL\n | summarize arg_max(TimeGenerated, *) by CompanyGuid, RiskVector\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"IndustrialStatistics\"\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n CompanyName,\n CompanyGuid,\n RiskVector,\n IncidentCount,\n CountPeriod,\n AverageDurationDays,\n ConnectorName\n )\n", "functionParameters": "", "version": 2, "tags": [ @@ -2506,7 +2506,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightObservationStatistics Data Parser with template version 3.2.0", + "description": "BitSightObservationStatistics Data Parser with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject12').parserVersion12]", @@ -2523,7 +2523,7 @@ "displayName": "Parser for BitSightObservationStatistics", "category": "Microsoft Sentinel Parser", "functionAlias": "BitSightObservationStatistics", - "query": "union isfuzzy=true\n (\n BitsightObservation_statistics_CL\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"ObservationStatistics\",\n Count = column_ifexists('count', ''),\n CountPeriod = column_ifexists('count_period', ''),\n AverageDurationDays = column_ifexists('average_duration_days', ''),\n RiskVector = column_ifexists('risk_vector', ''),\n CompanyName = column_ifexists('Company_name', '')\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n Count,\n CountPeriod,\n AverageDurationDays,\n RiskVector,\n CompanyName\n ),\n (\n BitSightObservationStatistics_CL\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"ObservationStatistics\"\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n CompanyName,\n CompanyGuid,\n RiskVector,\n ObservationCount,\n CountPeriod,\n AverageDurationDays,\n ConnectorName\n )\n", + "query": "union isfuzzy=true\n (\n BitsightObservation_statistics_CL\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"ObservationStatistics\",\n Count = column_ifexists('count', ''),\n CountPeriod = column_ifexists('count_period', ''),\n AverageDurationDays = column_ifexists('average_duration_days', ''),\n RiskVector = column_ifexists('risk_vector', ''),\n CompanyName = column_ifexists('Company_name', '')\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n Count,\n CountPeriod,\n AverageDurationDays,\n RiskVector,\n CompanyName\n ),\n (\n BitSightObservationStatistics_CL\n | summarize arg_max(TimeGenerated, *) by CompanyGuid, RiskVector\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"ObservationStatistics\"\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n CompanyName,\n CompanyGuid,\n RiskVector,\n ObservationCount,\n CountPeriod,\n AverageDurationDays,\n ConnectorName\n )\n", "functionParameters": "", "version": 2, "tags": [ @@ -2573,8 +2573,8 @@ "contentId": "[variables('parserObject12').parserContentId12]", "contentKind": "Parser", "displayName": "Parser for BitSightObservationStatistics", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject12').parserContentId12,'-', '1.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject12').parserContentId12,'-', '1.1.0')))]", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject12').parserContentId12,'-', '1.2.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject12').parserContentId12,'-', '1.2.0')))]", "version": "[variables('parserObject12').parserVersion12]" } }, @@ -2588,7 +2588,7 @@ "displayName": "Parser for BitSightObservationStatistics", "category": "Microsoft Sentinel Parser", "functionAlias": "BitSightObservationStatistics", - "query": "union isfuzzy=true\n (\n BitsightObservation_statistics_CL\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"ObservationStatistics\",\n Count = column_ifexists('count', ''),\n CountPeriod = column_ifexists('count_period', ''),\n AverageDurationDays = column_ifexists('average_duration_days', ''),\n RiskVector = column_ifexists('risk_vector', ''),\n CompanyName = column_ifexists('Company_name', '')\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n Count,\n CountPeriod,\n AverageDurationDays,\n RiskVector,\n CompanyName\n ),\n (\n BitSightObservationStatistics_CL\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"ObservationStatistics\"\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n CompanyName,\n CompanyGuid,\n RiskVector,\n ObservationCount,\n CountPeriod,\n AverageDurationDays,\n ConnectorName\n )\n", + "query": "union isfuzzy=true\n (\n BitsightObservation_statistics_CL\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"ObservationStatistics\",\n Count = column_ifexists('count', ''),\n CountPeriod = column_ifexists('count_period', ''),\n AverageDurationDays = column_ifexists('average_duration_days', ''),\n RiskVector = column_ifexists('risk_vector', ''),\n CompanyName = column_ifexists('Company_name', '')\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n Count,\n CountPeriod,\n AverageDurationDays,\n RiskVector,\n CompanyName\n ),\n (\n BitSightObservationStatistics_CL\n | summarize arg_max(TimeGenerated, *) by CompanyGuid, RiskVector\n | extend\n EventVendor = \"BitSight\",\n EventProduct = \"ObservationStatistics\"\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n CompanyName,\n CompanyGuid,\n RiskVector,\n ObservationCount,\n CountPeriod,\n AverageDurationDays,\n ConnectorName\n )\n", "functionParameters": "", "version": 2, "tags": [ @@ -2638,7 +2638,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSightVulnerabilitiesFindingsSummary Data Parser with template version 3.2.0", + "description": "BitSightVulnerabilitiesFindingsSummary Data Parser with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject13').parserVersion13]", @@ -2770,7 +2770,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitSight data connector with template version 3.2.0", + "description": "BitSight data connector with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -3591,7 +3591,7 @@ { "type": "Markdown", "parameters": { - "content": "## BitSight Connections\n\nManage multiple BitSight data stream connections. Each connection selects a specific data type - **Alerts**, **Breaches**, or **Findings** - and assigns a **Connection Name** that is stored in the `ConnectorName` column of every ingested record.\n\n> **Authentication**: BitSight uses HTTP Basic Authentication where the API token is used as **both** the username and password." + "content": "## BitSight Connections\n\nManage multiple BitSight data stream connections. Each connection selects a specific data type - **Alerts**, **Breaches**, or **Findings** - and assigns a **Connection Name** that is stored in the `ConnectorName` column of every ingested record.\n\n> **Authentication**: BitSight uses HTTP Basic Authentication with your API Token." } }, { @@ -3684,28 +3684,16 @@ { "type": "Markdown", "parameters": { - "content": "## 3. Authentication\n\nBitSight uses your API token as **both** the username and password for HTTP Basic Authentication." + "content": "## 3. Authentication\n\nProvide your BitSight API Token. It authenticates requests to the BitSight REST API using HTTP Basic Authentication." } }, { "type": "Textbox", "parameters": { - "label": "BitSight API Token (Username)", + "label": "BitSight API Token", "placeholder": "Paste your BitSight API Token", - "type": "text", - "name": "username", - "validations": { - "required": true - } - } - }, - { - "type": "Textbox", - "parameters": { - "label": "BitSight API Token (Password)", - "placeholder": "Paste your BitSight API Token again", "type": "password", - "name": "password", + "name": "apiToken", "validations": { "required": true } @@ -5233,7 +5221,7 @@ { "type": "Markdown", "parameters": { - "content": "## BitSight Connections\n\nManage multiple BitSight data stream connections. Each connection selects a specific data type - **Alerts**, **Breaches**, or **Findings** - and assigns a **Connection Name** that is stored in the `ConnectorName` column of every ingested record.\n\n> **Authentication**: BitSight uses HTTP Basic Authentication where the API token is used as **both** the username and password." + "content": "## BitSight Connections\n\nManage multiple BitSight data stream connections. Each connection selects a specific data type - **Alerts**, **Breaches**, or **Findings** - and assigns a **Connection Name** that is stored in the `ConnectorName` column of every ingested record.\n\n> **Authentication**: BitSight uses HTTP Basic Authentication with your API Token." } }, { @@ -5326,28 +5314,16 @@ { "type": "Markdown", "parameters": { - "content": "## 3. Authentication\n\nBitSight uses your API token as **both** the username and password for HTTP Basic Authentication." + "content": "## 3. Authentication\n\nProvide your BitSight API Token. It authenticates requests to the BitSight REST API using HTTP Basic Authentication." } }, { "type": "Textbox", "parameters": { - "label": "BitSight API Token (Username)", + "label": "BitSight API Token", "placeholder": "Paste your BitSight API Token", - "type": "text", - "name": "username", - "validations": { - "required": true - } - } - }, - { - "type": "Textbox", - "parameters": { - "label": "BitSight API Token (Password)", - "placeholder": "Paste your BitSight API Token again", "type": "password", - "name": "password", + "name": "apiToken", "validations": { "required": true } @@ -5490,13 +5466,8 @@ "type": "securestring", "minLength": 1 }, - "username": { - "defaultValue": "username", - "type": "securestring", - "minLength": 1 - }, - "password": { - "defaultValue": "password", + "apiToken": { + "defaultValue": "apiToken", "type": "securestring", "minLength": 1 }, @@ -5544,9 +5515,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/v2/alerts/')]", @@ -5603,9 +5575,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -5704,9 +5677,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -5808,9 +5782,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -5912,9 +5887,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -6187,7 +6163,7 @@ { "type": "Markdown", "parameters": { - "content": "## BitSight Statistics Connections\n\nManage multiple BitSight statistics connections. Each connection selects one or more **data streams** to ingest and assigns a **Connection Name** stored in the `connectionName` column of every ingested record.\n\n> **Authentication**: BitSight uses HTTP Basic Authentication where the API token is used as **both** the username and password." + "content": "## BitSight Statistics Connections\n\nManage multiple BitSight statistics connections. Each connection selects one or more **data streams** to ingest and assigns a **Connection Name** stored in the `connectionName` column of every ingested record.\n\n> **Authentication**: BitSight uses HTTP Basic Authentication with your API Token." } }, { @@ -6199,8 +6175,8 @@ "columnValue": "properties.addOnAttributes.connectionName" }, { - "columnName": "Active Streams", - "columnValue": "properties.addOnAttributes.streams" + "columnName": "Data Type", + "columnValue": "properties.dataType" }, { "columnName": "API URL", @@ -6294,28 +6270,16 @@ { "type": "Markdown", "parameters": { - "content": "## 3. Authentication\n\nBitSight uses your API token as **both** the username and password for HTTP Basic Authentication." + "content": "## 3. Authentication\n\nProvide your BitSight API Token. It authenticates requests to the BitSight REST API using HTTP Basic Authentication." } }, { "type": "Textbox", "parameters": { - "label": "BitSight API Token (Username)", + "label": "BitSight API Token", "placeholder": "Paste your BitSight API Token", - "type": "text", - "name": "username", - "validations": { - "required": true - } - } - }, - { - "type": "Textbox", - "parameters": { - "label": "BitSight API Token (Password)", - "placeholder": "Paste your BitSight API Token again", "type": "password", - "name": "password", + "name": "apiToken", "validations": { "required": true } @@ -6988,217 +6952,849 @@ ] } } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition3'),'-', variables('dataConnectorCCPVersion'))))]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "version": "[variables('dataConnectorCCPVersion')]" - } - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition3'))]", - "apiVersion": "2022-09-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", - "location": "[parameters('workspace-location')]", - "kind": "Customizable", - "properties": { - "connectorUiConfig": { - "id": "BitSightStatisticsConnector", - "title": "BitSight Security Statistics (via Codeless Connector Framework)", - "publisher": "Microsoft", - "descriptionMarkdown": "The [BitSight](https://www.bitsight.com/) data connector provides the capability to ingest security statistics, company profiles, rating details, diligence history, risk vector statistics, and vulnerability data from your BitSight portfolio into Microsoft Sentinel through the BitSight REST API. Refer to the [BitSight API documentation](https://help.bitsighttech.com/hc/en-us/articles/115014888388-API-Token-Management) for more information.", - "graphQueriesTableName": "BitSightCompanyDetails", - "graphQueries": [ - { - "metricName": "Total Company Detail records received", - "legend": "BitSight Company Details", - "baseQuery": "{{graphQueriesTableName}}" - }, - { - "metricName": "Total Company Rating Details received", - "legend": "BitSight Company Rating Details", - "baseQuery": "BitSightCompanyRatingDetails" - }, - { - "metricName": "Total Diligence Historical Statistics received", - "legend": "BitSight Diligence Historical Statistics", - "baseQuery": "BitSightDiligenceHistoricalStatistics" - }, - { - "metricName": "Total Diligence Statistics received", - "legend": "BitSight Diligence Statistics", - "baseQuery": "BitSightDiligenceStatistics" - }, - { - "metricName": "Total Observations Statistics received", - "legend": "BitSight Observations Statistics", - "baseQuery": "BitSightObservationStatistics" - }, - { - "metricName": "Total Industries Statistics received", - "legend": "BitSight Industries Statistics", - "baseQuery": "BitsightIndustrialStatistics" - }, - { - "metricName": "Total Findings Summary records received", - "legend": "BitSight Findings Summary", - "baseQuery": "BitSightFindingsSummary" - }, - { - "metricName": "Total Vulnerabilities received", - "legend": "BitSight Vulnerabilities", - "baseQuery": "BitsightVulnerabilitiesFindingsSummary" - } - ], - "sampleQueries": [ - { - "description": "Get sample of BitSight Company Details", - "query": "{{graphQueriesTableName}}\n | take 10" - }, - { - "description": "Get company security ratings over time", - "query": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(90d)\n | summarize LatestRating = arg_max(TimeGenerated, CurrentRating) by Name\n | order by LatestRating asc" - }, - { - "description": "Get sample of BitSight Company Rating Details", - "query": "BitSightCompanyRatingDetails\n | take 10" - }, - { - "description": "Get findings summary with latest data per company/stat", - "query": "BitSightFindingsSummary\n | where TimeGenerated > ago(1d)\n | take 10" - }, - { - "description": "Get sample of BitSight Vulnerabilities", - "query": "BitsightVulnerabilitiesFindingsSummary\n | take 10" - } - ], - "dataTypes": [ - { - "name": "{{graphQueriesTableName}}", - "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "BitSightCompanyRatingDetails", - "lastDataReceivedQuery": "BitSightCompanyRatingDetails\n | where TimeGenerated > ago(12h)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "BitSightFindingsSummary", - "lastDataReceivedQuery": "BitSightFindingsSummary\n | where TimeGenerated > ago(12h)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "BitSightDiligenceHistoricalStatistics", - "lastDataReceivedQuery": "BitSightDiligenceHistoricalStatistics\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" - }, - { - "name": "BitSightDiligenceStatistics", - "lastDataReceivedQuery": "BitSightDiligenceStatistics\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" - }, - { - "name": "BitSightObservationStatistics", - "lastDataReceivedQuery": "BitSightObservationStatistics\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" - }, - { - "name": "BitsightIndustrialStatistics", - "lastDataReceivedQuery": "BitsightIndustrialStatistics\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "BitsightVulnerabilitiesFindingsSummary", - "lastDataReceivedQuery": "BitsightVulnerabilitiesFindingsSummary\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" - } - ], - "connectivityCriteria": [ - { - "type": "HasDataConnectors" - } - ], - "availability": { - "isPreview": true, - "status": 1 - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "Read and Write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true, - "action": false - } - } - ], - "customs": [ - { - "name": "BitSight API Token", - "description": "A BitSight API Token is required to authenticate requests to the BitSight REST API. [See the documentation](https://help.bitsighttech.com/hc/en-us/articles/115014888388-API-Token-Management) to learn more about API Token management." - } - ] - }, - "instructionSteps": [ - { - "title": "1. Connection Management", - "description": "Manage your BitSight statistics data stream connections", - "instructions": [ - { - "type": "Markdown", - "parameters": { - "content": "## BitSight Statistics Connections\n\nManage multiple BitSight statistics connections. Each connection selects one or more **data streams** to ingest and assigns a **Connection Name** stored in the `connectionName` column of every ingested record.\n\n> **Authentication**: BitSight uses HTTP Basic Authentication where the API token is used as **both** the username and password." - } - }, - { - "type": "DataConnectorsGrid", - "parameters": { - "mapping": [ - { - "columnName": "Connection Name", - "columnValue": "properties.addOnAttributes.connectionName" - }, - { - "columnName": "Active Streams", - "columnValue": "properties.addOnAttributes.streams" - }, - { - "columnName": "API URL", - "columnValue": "properties.request.apiEndpoint" - } - ], - "menuItems": [ - "DeleteConnector" - ] - } - }, - { - "type": "ContextPane", - "parameters": { - "isPrimary": true, - "label": "Add Connection", - "title": "Add BitSight Statistics Connection", - "subtitle": "Configure a new BitSight statistics connection", - "contextPaneType": "DataConnectorsContextPane", - "instructionSteps": [ - { - "instructions": [ - { - "type": "Markdown", - "parameters": { - "content": "## 1. Select Data Streams\n\nChoose which BitSight statistics data types to collect for this connection. You can select multiple streams." - } - }, - { - "type": "Dropdown", - "parameters": { - "label": "Data Streams", - "name": "streams", - "options": [ - { + "name": "BitSightCompanyDetails_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "retentionInDays": 180, + "schema": { + "name": "BitSightCompanyDetails_CL", + "description": "The BitSightCompanyDetails table contains full company snapshots from the BitSight API per company GUID ingested into Microsoft Sentinel.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true + }, + { + "name": "Guid", + "type": "string", + "description": "Unique identifier (GUID) for the company in BitSight." + }, + { + "name": "Name", + "type": "string", + "description": "Name of the company." + }, + { + "name": "Shortname", + "type": "string", + "description": "Short name of the company." + }, + { + "name": "CompanyType", + "type": "string", + "description": "The type of entity (e.g., CURATED,PRIVATE)." + }, + { + "name": "Description", + "type": "string", + "description": "Description of the company." + }, + { + "name": "PrimaryDomain", + "type": "string", + "description": "Primary internet domain of the company." + }, + { + "name": "Homepage", + "type": "string", + "description": "URL of the company homepage." + }, + { + "name": "DisplayUrl", + "type": "string", + "description": "URL to the company overview page in BitSight portal." + }, + { + "name": "Sparkline", + "type": "string", + "description": "URL to the company rating sparkline image." + }, + { + "name": "Industry", + "type": "string", + "description": "Industry sector name." + }, + { + "name": "IndustrySlug", + "type": "string", + "description": "URL-friendly identifier for the industry." + }, + { + "name": "SubIndustry", + "type": "string", + "description": "Sub-industry name." + }, + { + "name": "SubIndustrySlug", + "type": "string", + "description": "URL-friendly identifier for the sub-industry." + }, + { + "name": "Ipv4Count", + "type": "int", + "description": "Number of IPv4 addresses attributed to the company." + }, + { + "name": "PeopleCount", + "type": "int", + "description": "Number of people associated with the company." + }, + { + "name": "SearchCount", + "type": "int", + "description": "Number of searches for the company." + }, + { + "name": "CustomerMonitoringCount", + "type": "int", + "description": "Number of customers monitoring this company." + }, + { + "name": "CurrentRating", + "type": "int", + "description": "Current overall BitSight security rating." + }, + { + "name": "RatingIndustryMedian", + "type": "string", + "description": "Comparison of company rating to industry median (e.g., above, below)." + }, + { + "name": "Ratings", + "type": "dynamic", + "description": "Array of historical rating snapshots, each with rating_date, rating, range, and rating_color." + }, + { + "name": "SubscriptionType", + "type": "string", + "description": "Type of BitSight subscription (e.g., Continuous Monitoring)." + }, + { + "name": "SubscriptionTypeKey", + "type": "string", + "description": "Machine-readable subscription type key." + }, + { + "name": "SubscriptionEndDate", + "type": "string", + "description": "Date the subscription ends (YYYY-MM-DD), or null." + }, + { + "name": "BulkEmailSenderStatus", + "type": "string", + "description": "Bulk email sender classification (e.g., NONE)." + }, + { + "name": "SecurityGrade", + "type": "string", + "description": "Security grade, if available." + }, + { + "name": "ServiceProvider", + "type": "boolean", + "description": "Indicates whether this company is a service provider." + }, + { + "name": "HasCompanyTree", + "type": "boolean", + "description": "Indicates whether the company has a company tree." + }, + { + "name": "HasPreferredContact", + "type": "boolean", + "description": "Indicates whether the company has a preferred contact." + }, + { + "name": "IsBundle", + "type": "boolean", + "description": "Indicates whether this is a bundle entry." + }, + { + "name": "IsPrimary", + "type": "boolean", + "description": "Indicates whether this is the primary company record." + }, + { + "name": "InSpmPortfolio", + "type": "boolean", + "description": "Indicates whether the company is in the SPM portfolio." + }, + { + "name": "IsMycompMysubsBundle", + "type": "boolean", + "description": "Indicates whether this is a my-company/my-subsidiaries bundle." + }, + { + "name": "IsCsp", + "type": "boolean", + "description": "Indicates whether the company is a cloud service provider." + }, + { + "name": "HasDelegatedSecurityControls", + "type": "boolean", + "description": "Indicates whether security controls have been delegated." + }, + { + "name": "CustomId", + "type": "dynamic", + "description": "Customer-assigned identifier for the company." + }, + { + "name": "AvailableUpgradeTypes", + "type": "dynamic", + "description": "Array of available upgrade types for this company." + }, + { + "name": "CompanyFeatures", + "type": "dynamic", + "description": "Array of feature flags enabled for the company." + }, + { + "name": "RelatedCompanies", + "type": "dynamic", + "description": "Array of related company references." + }, + { + "name": "PrimaryCompany", + "type": "dynamic", + "description": "Primary company object (guid, name), or null." + }, + { + "name": "ComplianceClaim", + "type": "dynamic", + "description": "Compliance claim object, or null." + }, + { + "name": "Permissions", + "type": "dynamic", + "description": "Object of permission flags for this company (can_annotate, can_view_forensics, etc.)." + }, + { + "name": "ConnectorName", + "type": "string", + "description": "Connection name identifier for multi-instance tracking." + } + ] + } + } + }, + { + "name": "BitSightCompanyRatingDetails_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "retentionInDays": 180, + "schema": { + "name": "BitSightCompanyRatingDetails_CL", + "description": "The BitSightCompanyRatingDetails table contains per-risk-vector rating breakdowns for each portfolio company from the BitSight API ingested into Microsoft Sentinel.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true + }, + { + "name": "CompanyName", + "type": "string", + "description": "Name of the company." + }, + { + "name": "CompanyGuid", + "type": "string", + "description": "GUID of the company." + }, + { + "name": "RiskVectorSlug", + "type": "string", + "description": "URL-friendly identifier for the risk vector (dict key — always null due to CCF JSONPath limitation; use RiskVectorLabel)." + }, + { + "name": "RiskVectorLabel", + "type": "string", + "description": "Human-readable name of the risk vector (API field: name)." + }, + { + "name": "RiskCategory", + "type": "string", + "description": "Parent risk category for the risk vector (API field: category)." + }, + { + "name": "CategoryOrder", + "type": "int", + "description": "Display order of the category." + }, + { + "name": "Rating", + "type": "int", + "description": "Numeric score for this risk vector." + }, + { + "name": "Grade", + "type": "string", + "description": "Letter grade for this risk vector." + }, + { + "name": "Percentile", + "type": "int", + "description": "Percentile rank compared to peers for this risk vector (0-100)." + }, + { + "name": "GradeColor", + "type": "string", + "description": "Hex color code associated with the grade for UI display (e.g., '#239563')." + }, + { + "name": "RiskVectorOrder", + "type": "int", + "description": "Display order of the risk vector within its category." + }, + { + "name": "DisplayUrl", + "type": "string", + "description": "URL to the risk vector detail page in BitSight portal." + }, + { + "name": "Beta", + "type": "boolean", + "description": "Indicates if this risk vector is in beta status." + }, + { + "name": "ConnectorName", + "type": "string", + "description": "Connection name identifier for multi-instance tracking." + } + ] + } + } + }, + { + "name": "BitSightDiligenceHistoricalStatistics_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "retentionInDays": 180, + "schema": { + "name": "BitSightDiligenceHistoricalStatistics_CL", + "description": "The BitSightDiligenceHistoricalStatistics table contains historical diligence statistics per company over time from the BitSight API ingested into Microsoft Sentinel.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true + }, + { + "name": "CompanyName", + "type": "string", + "description": "Name of the company." + }, + { + "name": "CompanyGuid", + "type": "string", + "description": "GUID of the company." + }, + { + "name": "RecordDate", + "type": "string", + "description": "The date of the historical record (YYYY-MM-DD)." + }, + { + "name": "Grade", + "type": "string", + "description": "Letter grade for this record period." + }, + { + "name": "Counts", + "type": "dynamic", + "description": "Array of per-category count objects ({ count, category }). Expanded row-per-category at query time by the KQL parser via mv-expand." + }, + { + "name": "ConnectorName", + "type": "string", + "description": "Connection name identifier for multi-instance tracking." + } + ] + } + } + }, + { + "name": "BitSightDiligenceStatistics_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "retentionInDays": 180, + "schema": { + "name": "BitSightDiligenceStatistics_CL", + "description": "The BitSightDiligenceStatistics table contains diligence statistics per risk vector for each portfolio company from the BitSight API ingested into Microsoft Sentinel.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true + }, + { + "name": "CompanyName", + "type": "string", + "description": "Name of the company." + }, + { + "name": "CompanyGuid", + "type": "string", + "description": "GUID of the company." + }, + { + "name": "RiskVector", + "type": "string", + "description": "Risk vector slug (dict key — always null due to CCF JSONPath limitation)." + }, + { + "name": "Unknown", + "type": "int", + "description": "Count of findings with unknown severity." + }, + { + "name": "Bad", + "type": "int", + "description": "Count of bad findings." + }, + { + "name": "Warn", + "type": "int", + "description": "Count of warn findings." + }, + { + "name": "Neutral", + "type": "int", + "description": "Count of neutral findings." + }, + { + "name": "Fair", + "type": "int", + "description": "Count of fair findings." + }, + { + "name": "Good", + "type": "int", + "description": "Count of good findings." + }, + { + "name": "SpearPhishing", + "type": "int", + "description": "[domain_squatting] Count of spear-phishing lookalike domains." + }, + { + "name": "BitFlip", + "type": "int", + "description": "[domain_squatting] Count of bit-flip lookalike domains." + }, + { + "name": "TypographicalErrors", + "type": "int", + "description": "[domain_squatting] Count of typographical-error lookalike domains." + }, + { + "name": "TldVariant", + "type": "int", + "description": "[domain_squatting] Count of TLD-variant lookalike domains." + }, + { + "name": "TotalCount", + "type": "int", + "description": "[domain_squatting] Total count of all lookalike domain types." + }, + { + "name": "ConnectorName", + "type": "string", + "description": "Connection name identifier for multi-instance tracking." + } + ] + } + } + }, + { + "name": "BitSightFindingsSummary_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "retentionInDays": 180, + "schema": { + "name": "BitSightFindingsSummary_CL", + "description": "The BitSightFindingsSummary table contains findings summary statistics per risk vector for each monitored company. Severity and description enrichment is resolved at query time by joining with BitsightVulnerabilitiesFindingsSummary on Name == DisplayName.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true + }, + { + "name": "CompanyName", + "type": "string", + "description": "Name of the company associated with the findings summary." + }, + { + "name": "CompanyGuid", + "type": "string", + "description": "GUID of the company associated with the findings summary." + }, + { + "name": "StartDate", + "type": "string", + "description": "Start date of the reporting period (YYYY-MM-DD)." + }, + { + "name": "EndDate", + "type": "string", + "description": "End date of the reporting period (YYYY-MM-DD)." + }, + { + "name": "Stats", + "type": "dynamic", + "description": "Array of per-stat objects. Expanded row-per-stat at query time by the KQL parser via mv-expand into Name, StatId, Confidence, EventCount, HostCount, FirstSeen columns." + }, + { + "name": "ConnectorName", + "type": "string", + "description": "Connection name identifier for multi-instance tracking." + } + ] + } + } + }, + { + "name": "BitsightIndustrialStatistics_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "retentionInDays": 180, + "schema": { + "name": "BitsightIndustrialStatistics_CL", + "description": "The BitsightIndustrialStatistics table contains industry peer comparison statistics per risk vector for each portfolio company from the BitSight API ingested into Microsoft Sentinel.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true + }, + { + "name": "CompanyName", + "type": "string", + "description": "Name of the company." + }, + { + "name": "CompanyGuid", + "type": "string", + "description": "GUID of the company." + }, + { + "name": "RiskVector", + "type": "string", + "description": "Risk vector slug (dict key — always null due to CCF JSONPath limitation)." + }, + { + "name": "IncidentCount", + "type": "int", + "description": "Number of incidents for this risk vector in the industry over the measured period." + }, + { + "name": "CountPeriod", + "type": "string", + "description": "Measurement period (e.g., 'year')." + }, + { + "name": "AverageDurationDays", + "type": "real", + "description": "Average duration in days for incidents of this risk vector in the industry." + }, + { + "name": "ConnectorName", + "type": "string", + "description": "Connection name identifier for multi-instance tracking." + } + ] + } + } + }, + { + "name": "BitSightObservationStatistics_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "retentionInDays": 180, + "schema": { + "name": "BitSightObservationStatistics_CL", + "description": "The BitSightObservationStatistics table contains observations statistics per risk vector for each portfolio company from the BitSight API ingested into Microsoft Sentinel.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true + }, + { + "name": "CompanyName", + "type": "string", + "description": "Name of the company." + }, + { + "name": "CompanyGuid", + "type": "string", + "description": "GUID of the company." + }, + { + "name": "RiskVector", + "type": "string", + "description": "Risk vector slug (dict key — always null due to CCF JSONPath limitation)." + }, + { + "name": "ObservationCount", + "type": "int", + "description": "Total number of observations for this risk vector in the measurement period." + }, + { + "name": "CountPeriod", + "type": "string", + "description": "Measurement period (e.g., 'year')." + }, + { + "name": "AverageDurationDays", + "type": "real", + "description": "Average duration in days for observations." + }, + { + "name": "ConnectorName", + "type": "string", + "description": "Connection name identifier for multi-instance tracking." + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition3'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition3'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "BitSightStatisticsConnector", + "title": "BitSight Security Statistics (via Codeless Connector Framework)", + "publisher": "Microsoft", + "descriptionMarkdown": "The [BitSight](https://www.bitsight.com/) data connector provides the capability to ingest security statistics, company profiles, rating details, diligence history, risk vector statistics, and vulnerability data from your BitSight portfolio into Microsoft Sentinel through the BitSight REST API. Refer to the [BitSight API documentation](https://help.bitsighttech.com/hc/en-us/articles/115014888388-API-Token-Management) for more information.", + "graphQueriesTableName": "BitSightCompanyDetails", + "graphQueries": [ + { + "metricName": "Total Company Detail records received", + "legend": "BitSight Company Details", + "baseQuery": "{{graphQueriesTableName}}" + }, + { + "metricName": "Total Company Rating Details received", + "legend": "BitSight Company Rating Details", + "baseQuery": "BitSightCompanyRatingDetails" + }, + { + "metricName": "Total Diligence Historical Statistics received", + "legend": "BitSight Diligence Historical Statistics", + "baseQuery": "BitSightDiligenceHistoricalStatistics" + }, + { + "metricName": "Total Diligence Statistics received", + "legend": "BitSight Diligence Statistics", + "baseQuery": "BitSightDiligenceStatistics" + }, + { + "metricName": "Total Observations Statistics received", + "legend": "BitSight Observations Statistics", + "baseQuery": "BitSightObservationStatistics" + }, + { + "metricName": "Total Industries Statistics received", + "legend": "BitSight Industries Statistics", + "baseQuery": "BitsightIndustrialStatistics" + }, + { + "metricName": "Total Findings Summary records received", + "legend": "BitSight Findings Summary", + "baseQuery": "BitSightFindingsSummary" + }, + { + "metricName": "Total Vulnerabilities received", + "legend": "BitSight Vulnerabilities", + "baseQuery": "BitsightVulnerabilitiesFindingsSummary" + } + ], + "sampleQueries": [ + { + "description": "Get sample of BitSight Company Details", + "query": "{{graphQueriesTableName}}\n | take 10" + }, + { + "description": "Get company security ratings over time", + "query": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(90d)\n | summarize LatestRating = arg_max(TimeGenerated, CurrentRating) by Name\n | order by LatestRating asc" + }, + { + "description": "Get sample of BitSight Company Rating Details", + "query": "BitSightCompanyRatingDetails\n | take 10" + }, + { + "description": "Get findings summary with latest data per company/stat", + "query": "BitSightFindingsSummary\n | where TimeGenerated > ago(1d)\n | take 10" + }, + { + "description": "Get sample of BitSight Vulnerabilities", + "query": "BitsightVulnerabilitiesFindingsSummary\n | take 10" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "BitSightCompanyRatingDetails", + "lastDataReceivedQuery": "BitSightCompanyRatingDetails\n | where TimeGenerated > ago(12h)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "BitSightFindingsSummary", + "lastDataReceivedQuery": "BitSightFindingsSummary\n | where TimeGenerated > ago(12h)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "BitSightDiligenceHistoricalStatistics", + "lastDataReceivedQuery": "BitSightDiligenceHistoricalStatistics\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "BitSightDiligenceStatistics", + "lastDataReceivedQuery": "BitSightDiligenceStatistics\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "BitSightObservationStatistics", + "lastDataReceivedQuery": "BitSightObservationStatistics\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "BitsightIndustrialStatistics", + "lastDataReceivedQuery": "BitsightIndustrialStatistics\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "BitsightVulnerabilitiesFindingsSummary", + "lastDataReceivedQuery": "BitsightVulnerabilitiesFindingsSummary\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": true, + "status": 1 + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true, + "action": false + } + } + ], + "customs": [ + { + "name": "BitSight API Token", + "description": "A BitSight API Token is required to authenticate requests to the BitSight REST API. [See the documentation](https://help.bitsighttech.com/hc/en-us/articles/115014888388-API-Token-Management) to learn more about API Token management." + } + ] + }, + "instructionSteps": [ + { + "title": "1. Connection Management", + "description": "Manage your BitSight statistics data stream connections", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "## BitSight Statistics Connections\n\nManage multiple BitSight statistics connections. Each connection selects one or more **data streams** to ingest and assigns a **Connection Name** stored in the `connectionName` column of every ingested record.\n\n> **Authentication**: BitSight uses HTTP Basic Authentication with your API Token." + } + }, + { + "type": "DataConnectorsGrid", + "parameters": { + "mapping": [ + { + "columnName": "Connection Name", + "columnValue": "properties.addOnAttributes.connectionName" + }, + { + "columnName": "Data Type", + "columnValue": "properties.dataType" + }, + { + "columnName": "API URL", + "columnValue": "properties.request.apiEndpoint" + } + ], + "menuItems": [ + "DeleteConnector" + ] + } + }, + { + "type": "ContextPane", + "parameters": { + "isPrimary": true, + "label": "Add Connection", + "title": "Add BitSight Statistics Connection", + "subtitle": "Configure a new BitSight statistics connection", + "contextPaneType": "DataConnectorsContextPane", + "instructionSteps": [ + { + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "## 1. Select Data Streams\n\nChoose which BitSight statistics data types to collect for this connection. You can select multiple streams." + } + }, + { + "type": "Dropdown", + "parameters": { + "label": "Data Streams", + "name": "streams", + "options": [ + { "key": "FindingsSummary", "text": "FindingsSummary" }, @@ -7257,28 +7853,16 @@ { "type": "Markdown", "parameters": { - "content": "## 3. Authentication\n\nBitSight uses your API token as **both** the username and password for HTTP Basic Authentication." + "content": "## 3. Authentication\n\nProvide your BitSight API Token. It authenticates requests to the BitSight REST API using HTTP Basic Authentication." } }, { "type": "Textbox", "parameters": { - "label": "BitSight API Token (Username)", + "label": "BitSight API Token", "placeholder": "Paste your BitSight API Token", - "type": "text", - "name": "username", - "validations": { - "required": true - } - } - }, - { - "type": "Textbox", - "parameters": { - "label": "BitSight API Token (Password)", - "placeholder": "Paste your BitSight API Token again", "type": "password", - "name": "password", + "name": "apiToken", "validations": { "required": true } @@ -7413,13 +7997,8 @@ "type": "securestring", "minLength": 1 }, - "username": { - "defaultValue": "username", - "type": "securestring", - "minLength": 1 - }, - "password": { - "defaultValue": "password", + "apiToken": { + "defaultValue": "apiToken", "type": "securestring", "minLength": 1 }, @@ -7467,9 +8046,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -7557,9 +8137,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -7645,9 +8226,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -7735,9 +8317,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -7825,9 +8408,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -7915,9 +8499,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -8005,9 +8590,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "[[concat(parameters('bitSightApiUrl'), '/ratings/v2/portfolio')]", @@ -8095,9 +8681,10 @@ "kind": "RestApiPoller", "properties": { "auth": { - "type": "Basic", - "UserName": "[[parameters('username')]", - "Password": "[[parameters('password')]" + "type": "APIKey", + "ApiKey": "[[base64(concat(parameters('apiToken'), ':'))]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Basic" }, "request": { "apiEndpoint": "https://service.bitsighttech.com/customer-api/v1/defaults/vulnerabilities", @@ -8157,7 +8744,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.2.0", + "version": "3.2.1", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "BitSight", diff --git a/Solutions/BitSight/Parsers/BitSightDiligenceStatistics.yaml b/Solutions/BitSight/Parsers/BitSightDiligenceStatistics.yaml index 25d8396bbf6..d96683efdd3 100644 --- a/Solutions/BitSight/Parsers/BitSightDiligenceStatistics.yaml +++ b/Solutions/BitSight/Parsers/BitSightDiligenceStatistics.yaml @@ -1,8 +1,8 @@ id: 3900f610-56b5-4f8f-84f4-291d9b41dfe2 Function: Title: Parser for BitSightDiligenceStatistics - Version: '1.1.0' - LastUpdated: '2026-05-25' + Version: '1.2.0' + LastUpdated: '2026-07-30' Category: Microsoft Sentinel Parser FunctionName: BitSightDiligenceStatistics FunctionAlias: BitSightDiligenceStatistics @@ -46,6 +46,7 @@ FunctionQuery: | ), ( BitSightDiligenceStatistics_CL + | summarize arg_max(TimeGenerated, *) by CompanyGuid, RiskVector | extend EventVendor = "BitSight", EventProduct = "DiligenceStatistics" diff --git a/Solutions/BitSight/Parsers/BitSightIndustrialStatistics.yaml b/Solutions/BitSight/Parsers/BitSightIndustrialStatistics.yaml index 170b0f5e058..4d3b120858f 100644 --- a/Solutions/BitSight/Parsers/BitSightIndustrialStatistics.yaml +++ b/Solutions/BitSight/Parsers/BitSightIndustrialStatistics.yaml @@ -1,8 +1,8 @@ id: 44c51bc8-1c06-46ca-ba25-0422d0af4015 Function: Title: Parser for BitSightIndustrialStatistics - Version: '1.1.0' - LastUpdated: '2026-05-25' + Version: '1.2.0' + LastUpdated: '2026-07-30' Category: Microsoft Sentinel Parser FunctionName: BitSightIndustrialStatistics FunctionAlias: BitSightIndustrialStatistics @@ -30,6 +30,7 @@ FunctionQuery: | ), ( BitsightIndustrialStatistics_CL + | summarize arg_max(TimeGenerated, *) by CompanyGuid, RiskVector | extend EventVendor = "BitSight", EventProduct = "IndustrialStatistics" diff --git a/Solutions/BitSight/Parsers/BitSightObservationStatistics.yaml b/Solutions/BitSight/Parsers/BitSightObservationStatistics.yaml index 91b7edb8ded..584d25b73fa 100644 --- a/Solutions/BitSight/Parsers/BitSightObservationStatistics.yaml +++ b/Solutions/BitSight/Parsers/BitSightObservationStatistics.yaml @@ -1,8 +1,8 @@ id: 144a9fa0-98a3-40f7-b39e-9c7ff0229290 Function: Title: Parser for BitSightObservationStatistics - Version: '1.1.0' - LastUpdated: '2026-05-25' + Version: '1.2.0' + LastUpdated: '2026-07-30' Category: Microsoft Sentinel Parser FunctionName: BitSightObservationStatistics FunctionAlias: BitSightObservationStatistics @@ -30,6 +30,7 @@ FunctionQuery: | ), ( BitSightObservationStatistics_CL + | summarize arg_max(TimeGenerated, *) by CompanyGuid, RiskVector | extend EventVendor = "BitSight", EventProduct = "ObservationStatistics" diff --git a/Solutions/BitSight/ReleaseNotes.md b/Solutions/BitSight/ReleaseNotes.md index f85801603ea..abe8a957c9a 100644 --- a/Solutions/BitSight/ReleaseNotes.md +++ b/Solutions/BitSight/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|--------------------------------------------------------------------| +| 3.2.1 | 30-07-2026 | Added arg_max(TimeGenerated, *) de-duplication across the BitSight statistics parsers so snapshot tables return only the latest record per entity, and simplified connector authentication to a single API Token field (HTTP Basic authentication with the token as the username) for both the BitSight Security Statistics and BitSight Security Events connectors. | | 3.2.0 | 15-06-2026 | Replaced legacy Function App connector with two **Codeless Connector Framework (CCF)** connectors: **BitSight Security Events** (Alerts, Breaches, Findings) and **BitSight Security Statistics** (CompanyDetails, CompanyRatingDetails, DiligenceHistoricalStatistics, DiligenceStatistics, ObservationStatistics, IndustrialStatistics, VulnerabilitiesFindingsSummary, FindingsSummary). Added parsers for **BitSightCompanyRatingDetails** and **BitSightVulnerabilitiesFindingsSummary**. Updated Function App UI page for Log Ingestion API. | | 3.1.1 | 22-04-2026 | Updated **Solution Package** with the fix of solutionId | | 3.1.0 | 31-03-2026 | Updated the python runtime version to 3.12. Added support for Log Ingestion API and updated parsers accordingly.
Reverted the solution id to fix the BitSight Solution publishing issue. |