Skip to content

Commit efb12f9

Browse files
jame2Ojame2O
authored
Merge pull request #55 from squaredup/work/jd/defender
New Defender Plugin
2 parents 164e199 + 4400a1d commit efb12f9

28 files changed

Lines changed: 4110 additions & 0 deletions

‎plugins/MicrosoftDefender/v1/configValidation.json‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{
2+
"steps": [
3+
{
4+
"displayName": "Alerts access",
5+
"dataStream": { "name": "validationAlerts" },
6+
"success": "Successfully read alerts.",
7+
"error": "Cannot read alerts. Grant the 'SecurityAlert.Read.All' application permission in Microsoft Entra ID, or check your client ID and secret.",
8+
"required": true
9+
},
10+
{
11+
"displayName": "Incidents access",
12+
"dataStream": { "name": "validationIncidents" },
13+
"success": "Successfully read incidents.",
14+
"error": "Cannot read incidents. Grant the 'SecurityIncident.Read.All' application permission in Microsoft Entra ID, or check your client ID and secret."
15+
},
16+
{
17+
"displayName": "Advanced hunting access",
18+
"dataStream": { "name": "validationHunting" },
19+
"success": "Successfully ran an advanced hunting query.",
20+
"error": "Cannot run advanced hunting queries. Grant the 'ThreatHunting.Read.All' application permission in Microsoft Entra ID, or check your client ID and secret.",
21+
"required": true
22+
},
23+
{
24+
"displayName": "Secure score access",
25+
"dataStream": { "name": "validationSecureScore" },
26+
"success": "Successfully read secure scores.",
27+
"error": "Cannot read secure scores. Grant the 'SecurityEvents.Read.All' application permission in Microsoft Entra ID, or check your client ID and secret."
28+
}
29+
]
30+
}

‎plugins/MicrosoftDefender/v1/custom_types.json‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
[
2+
{
3+
"name": "Device",
4+
"sourceType": "Device",
5+
"icon": "desktop",
6+
"singular": "Device",
7+
"plural": "Devices"
8+
}
9+
]

‎plugins/MicrosoftDefender/v1/dataStreams/Vulnerabilities.json‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{
2+
"name": "Vulnerabilities",
3+
"displayName": "Vulnerabilities",
4+
"description": "Returns vulnerabilities data for the specified device",
5+
"baseDataSourceName": "httpRequestScoped",
6+
"config": {
7+
"httpMethod": "post",
8+
"errorHandling": {
9+
"type": "default"
10+
},
11+
"paging": {
12+
"mode": "none"
13+
},
14+
"expandInnerObjects": true,
15+
"endpointPath": "runHuntingQuery",
16+
"postBody": {
17+
"Query": "DeviceTvmSoftwareVulnerabilities | where DeviceId in ({{objects.map(o => {return `\"${o.rawId}\"`}).join(\",\")}})",
18+
"Timespan": "{{timeframe.enum != \"none\" ? `${timeframe.start}/${timeframe.end}` : \"\" }}"
19+
},
20+
"pathToData": "results",
21+
"getArgs": [],
22+
"headers": []
23+
},
24+
"metadata": [
25+
{
26+
"name": "CveGuide",
27+
"displayName": "Cve Id",
28+
"valueExpression": "{{ $['CveId'] ? `https://msrc.microsoft.com/update-guide/vulnerability/${$['CveId']}` : '' }}",
29+
"formatExpression": "{{ $['CveId'] }}",
30+
"shape": "url",
31+
"computed": true
32+
},
33+
{
34+
"name": "CveId",
35+
"displayName": "CVE Id",
36+
"shape": "string",
37+
"visible": false,
38+
"role": "label"
39+
},
40+
{
41+
"name": "VulnerabilitySeverityLevel",
42+
"displayName": "Severity",
43+
"shape": "string",
44+
"role": "label"
45+
},
46+
{
47+
"name": "SoftwareName",
48+
"displayName": "Affected Software",
49+
"shape": "string",
50+
"role": "label"
51+
},
52+
{
53+
"name": "CveTags",
54+
"displayName": "Tags",
55+
"shape": "string",
56+
"role": "label"
57+
},
58+
{
59+
"sourceId": "DeviceId",
60+
"name": "DeviceName",
61+
"shape": "string",
62+
"visible": false,
63+
"role": "label",
64+
"sourceType": "Device"
65+
}
66+
],
67+
"matches": {
68+
"sourceType": {
69+
"type": "equals",
70+
"value": "Device"
71+
}
72+
},
73+
"timeframes": false,
74+
"providesPluginDiagnostics": true,
75+
"objectLimit": 1,
76+
"tags": []
77+
}

‎plugins/MicrosoftDefender/v1/dataStreams/advancedHuntingQuery.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"name": "advancedHuntingQuery",
3+
"displayName": "Advanced Hunting Query",
4+
"description": "Queries a specified set of data supported by Defender to proactively look for specific threats in your environment",
5+
"baseDataSourceName": "httpRequestUnscoped",
6+
"config": {
7+
"httpMethod": "post",
8+
"errorHandling": {
9+
"type": "default"
10+
},
11+
"paging": {
12+
"mode": "none"
13+
},
14+
"expandInnerObjects": true,
15+
"endpointPath": "runHuntingQuery",
16+
"postBody": {
17+
"Query": "{{query}}",
18+
"Timespan": "{{timeframe.enum != \"none\" ? `${timeframe.start}/${timeframe.end}` : \"\" }}"
19+
},
20+
"pathToData": "results",
21+
"getArgs": [],
22+
"headers": []
23+
},
24+
"timeframes": [
25+
"last1hour",
26+
"last12hours",
27+
"last24hours",
28+
"last7days",
29+
"last30days",
30+
"thisMonth",
31+
"thisQuarter",
32+
"thisYear",
33+
"lastMonth",
34+
"lastQuarter",
35+
"lastYear"
36+
],
37+
"supportsNoneTimeframe": true,
38+
"providesPluginDiagnostics": true,
39+
"manualConfigApply": true,
40+
"tags": [],
41+
"ui": [
42+
{
43+
"name": "query",
44+
"language": "kusto",
45+
"label": "Query",
46+
"type": "code",
47+
"validation": {
48+
"required": true
49+
}
50+
}
51+
]
52+
}

‎plugins/MicrosoftDefender/v1/dataStreams/alerts.json‎

Lines changed: 218 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,218 @@
1+
{
2+
"name": "alerts",
3+
"displayName": "Alerts",
4+
"description": "Returns a list of alert resources created to track suspicious activities in an organization",
5+
"baseDataSourceName": "httpRequestUnscoped",
6+
"config": {
7+
"httpMethod": "get",
8+
"errorHandling": {
9+
"type": "default"
10+
},
11+
"paging": {
12+
"mode": "nextUrl",
13+
"pageSize": {
14+
"realm": {
15+
"value": "none",
16+
"label": "none"
17+
}
18+
},
19+
"in": {
20+
"realm": {
21+
"value": "payload",
22+
"label": "payload"
23+
},
24+
"path": "@odata.nextLink"
25+
}
26+
},
27+
"expandInnerObjects": true,
28+
"endpointPath": "alerts_v2",
29+
"pathToData": "value",
30+
"getArgs": [
31+
{
32+
"key": "$filter",
33+
"value": "{{ status && status.length > 0 ? \"(status eq \" + status.map((m) => { return `'${m}'` }).join(\" or status eq \") + \") and \" : \"\" }}{{ severity && severity.length > 0 ? \"(severity eq \" + severity.map((m) => { return `'${m}'` }).join(\" or severity eq \") + \") and \" : \"\" }}{{timeframe.enum !== \"none\" ? timeframeCol + \" ge \" + timeframe.start + \" and \" + timeframeCol + \" le \" + timeframe.end : \"1 eq 1\"}}"
34+
}
35+
],
36+
"headers": []
37+
},
38+
"metadata": [
39+
{
40+
"name": "title",
41+
"displayName": "Alert Name",
42+
"shape": "string",
43+
"role": "label"
44+
},
45+
{
46+
"name": "systemTags",
47+
"displayName": "System Tags",
48+
"shape": "string",
49+
"role": "label"
50+
},
51+
{
52+
"name": "severity",
53+
"displayName": "Severity",
54+
"shape": "string",
55+
"role": "label"
56+
},
57+
{
58+
"name": "status",
59+
"displayName": "Status",
60+
"shape": "string",
61+
"role": "label"
62+
},
63+
{
64+
"name": "category",
65+
"displayName": "Category",
66+
"shape": "string",
67+
"role": "label"
68+
},
69+
{
70+
"name": "detectionSource",
71+
"displayName": "Detection Source",
72+
"shape": "string",
73+
"role": "label"
74+
},
75+
{
76+
"name": "firstActivityDateTime",
77+
"displayName": "First Activity",
78+
"shape": "date",
79+
"role": "label"
80+
},
81+
{
82+
"name": "lastActivityDateTime",
83+
"displayName": "Last Activity",
84+
"shape": "date",
85+
"role": "label"
86+
},
87+
{
88+
"name": "classification",
89+
"displayName": "Classification",
90+
"shape": "string",
91+
"role": "label"
92+
},
93+
{
94+
"name": "determination",
95+
"displayName": "Determination",
96+
"shape": "string",
97+
"role": "label"
98+
},
99+
{
100+
"name": "assignedTo",
101+
"displayName": "Assigned To",
102+
"shape": "string",
103+
"role": "label"
104+
}
105+
],
106+
"timeframes": [
107+
"last1hour",
108+
"last12hours",
109+
"last24hours",
110+
"last7days",
111+
"last30days",
112+
"thisMonth",
113+
"thisQuarter",
114+
"thisYear",
115+
"lastMonth",
116+
"lastQuarter",
117+
"lastYear"
118+
],
119+
"supportsNoneTimeframe": true,
120+
"manualConfigApply": true,
121+
"providesPluginDiagnostics": true,
122+
"tags": [],
123+
"ui": [
124+
{
125+
"name": "severity",
126+
"label": "Severity",
127+
"type": "autocomplete",
128+
"data": {
129+
"source": "fixed",
130+
"values": [
131+
{
132+
"value": "low",
133+
"label": "Low"
134+
},
135+
{
136+
"value": "medium",
137+
"label": "Medium"
138+
},
139+
{
140+
"value": "high",
141+
"label": "High"
142+
},
143+
{
144+
"value": "informational",
145+
"label": "Informational"
146+
},
147+
{
148+
"value": "unknown",
149+
"label": "Unknown"
150+
},
151+
{
152+
"value": "unknownFutureValue",
153+
"label": "Unknown Future Value"
154+
}
155+
]
156+
},
157+
"isClearable": true
158+
},
159+
{
160+
"name": "status",
161+
"label": "Status",
162+
"type": "autocomplete",
163+
"data": {
164+
"source": "fixed",
165+
"values": [
166+
{
167+
"value": "newAlert",
168+
"label": "New"
169+
},
170+
{
171+
"value": "inProgress",
172+
"label": "In Progress"
173+
},
174+
{
175+
"value": "resolved",
176+
"label": "Resolved"
177+
},
178+
{
179+
"value": "unknown",
180+
"label": "Unknown"
181+
},
182+
{
183+
"value": "unknownFutureValue",
184+
"label": "Unknown Future Value"
185+
}
186+
]
187+
},
188+
"isClearable": true
189+
},
190+
{
191+
"tileEditorStep": ["Timeframe"],
192+
"isMulti": false,
193+
"help": "Select the column to apply the timeframe",
194+
"data": {
195+
"source": "fixed",
196+
"values": [
197+
{
198+
"value": "createdDateTime",
199+
"label": "Creation Time"
200+
},
201+
{
202+
"value": "lastActivityDateTime",
203+
"label": "Last Activity Time"
204+
},
205+
{
206+
"value": "lastUpdateDateTime",
207+
"label": "Last Update Time"
208+
}
209+
]
210+
},
211+
"defaultValue": "createdDateTime",
212+
"name": "timeframeCol",
213+
"label": "Timeframe Column",
214+
"type": "autocomplete",
215+
"isClearable": false
216+
}
217+
]
218+
}

0 commit comments

Comments
 (0)