Merge branch 'native_Audit_Parser' of https://github.com/Azure/Azure-…

…Sentinel into native_Audit_Parser
Azure · Jan 8, 2025 · 3ea0a0a · 3ea0a0a
2 parents f66bb7d + c94b514
commit 3ea0a0a
Show file tree

Hide file tree

Showing 6 changed files with 6 additions and 18 deletions.
diff --git a/Parsers/ASimAuditEvent/ARM/ASimAuditEventNative/ASimAuditEventNative.json b/Parsers/ASimAuditEvent/ARM/ASimAuditEventNative/ASimAuditEventNative.json
@@ -27,7 +27,7 @@
         "displayName": "Audit Event ASIM parser for Microsoft Sentinel native Audit Event table",
         "category": "ASIM",
         "FunctionAlias": "ASimAuditEventNative",
-        "query": "let parser=(disabled:bool=false) \n{\n  ASimAuditEventLogs  | where not(disabled)\n    | extend EventSchema = \"AuditEvent\"\n    | extend\n        Value\t= NewValue,\n        User =  ActorUsername,\n        Application =  TargetAppName,\n        Dst = coalesce (TargetDvcId, TargetHostname, TargetIpAddr, TargetAppId, TargetAppName),\n        Dvc = coalesce (DvcFQDN, DvcHostname, DvcIpAddr, DvcId, _ResourceId, strcat (EventVendor,'/', EventProduct)), \n        Rule=RuleName,\n        EventStartTime = TimeGenerated,\n        EventEndTime = TimeGenerated\n    | project-rename\n        EventUid = _ItemId\n    | project-away\n        _ResourceId, _SubscriptionId\n};\nparser  (disabled=disabled)\n",
+        "query": "let parser=(disabled:bool=false) \n{\n  ASimAuditEventLogs  | where not(disabled)\n    | extend EventSchema = \"AuditEvent\"\n    | extend\n        Value\t= NewValue,\n        User =  ActorUsername,\n        Application =  TargetAppName,\n        Dst = coalesce (TargetDvcId, TargetHostname, TargetIpAddr, TargetAppId, TargetAppName),\n        Dvc = coalesce (DvcFQDN, DvcHostname, DvcIpAddr, DvcId, _ResourceId, strcat (EventVendor,'/', EventProduct)), \n        Rule=RuleName,\n        EventStartTime = TimeGenerated,\n        EventEndTime = TimeGenerated\n    | project-away\n        _ResourceId, _SubscriptionId\n};\nparser  (disabled=disabled)\n",
         "version": 1,
         "functionParameters": "disabled:bool=False"
       }

diff --git a/Parsers/ASimAuditEvent/ARM/vimAuditEventNative/vimAuditEventNative.json b/Parsers/ASimAuditEvent/ARM/vimAuditEventNative/vimAuditEventNative.json
@@ -27,7 +27,7 @@
         "displayName": "Audit Event ASIM filtering parser for Microsoft Sentinel native Audit Event table",
         "category": "ASIM",
         "FunctionAlias": "vimAuditEventNative",
-        "query": "let parser=\n(\n  starttime: datetime=datetime(null), \n  endtime: datetime=datetime(null),\n  srcipaddr_has_any_prefix: dynamic=dynamic([]), \n  eventtype_in: dynamic=dynamic([]),\n  eventresult: string='*',\n  actorusername_has_any: dynamic=dynamic([]),\n  operation_has_any: dynamic=dynamic([]),\n  object_has_any: dynamic=dynamic([]),\n  newvalue_has_any: dynamic=dynamic([]),\n  disabled: bool = false\n)\n{\n  ASimAuditEventLogs  | where not(disabled)\n  | where (isnull(starttime) or TimeGenerated >= starttime) \n                  and (isnull(endtime) or TimeGenerated <= endtime)\n                  and ((array_length(srcipaddr_has_any_prefix) == 0) or SrcIpAddr has_any (srcipaddr_has_any_prefix))\n                  and (array_length(actorusername_has_any) == 0  or ActorUsername has_any (actorusername_has_any))\n                  and (array_length(newvalue_has_any) == 0 or NewValue has_any (newvalue_has_any))\n                  and (array_length(eventtype_in) == 0 or EventType has_any (eventtype_in))\n                  and (array_length(operation_has_any) == 0 or Operation has_any (operation_has_any))\n                  and (eventresult == '*' or EventResult == eventresult)\n                  and (array_length(object_has_any) == 0 or Object has_any (object_has_any))\n  | extend EventSchema = \"AuditEvent\"\n  | extend\n        Value\t= NewValue,\n        User =  ActorUsername,\n        Application =  TargetAppName,\n        Dst = coalesce (TargetDvcId, TargetHostname, TargetIpAddr, TargetAppId, TargetAppName),\n        Dvc = coalesce (DvcFQDN, DvcHostname, DvcIpAddr, DvcId, _ResourceId, strcat (EventVendor,'/', EventProduct)),\n        Rule=RuleName,\n        EventStartTime = TimeGenerated,\n        EventEndTime = TimeGenerated\n  | project-rename\n        EventUid = _ItemId\n    | project-away \n        _ResourceId, _SubscriptionId\n  };\n  parser(\n    starttime=starttime, \n    endtime=endtime, \n    srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, \n    eventtype_in=eventtype_in, \n    eventresult=eventresult, \n    actorusername_has_any=actorusername_has_any, \n    operation_has_any=operation_has_any, \n    object_has_any=object_has_any, \n    newvalue_has_any=newvalue_has_any, \n    disabled=disabled\n  )\n  ",
+        "query": "let parser=\n(\n  starttime: datetime=datetime(null), \n  endtime: datetime=datetime(null),\n  srcipaddr_has_any_prefix: dynamic=dynamic([]), \n  eventtype_in: dynamic=dynamic([]),\n  eventresult: string='*',\n  actorusername_has_any: dynamic=dynamic([]),\n  operation_has_any: dynamic=dynamic([]),\n  object_has_any: dynamic=dynamic([]),\n  newvalue_has_any: dynamic=dynamic([]),\n  disabled: bool = false\n)\n{\n  ASimAuditEventLogs  | where not(disabled)\n  | where (isnull(starttime) or TimeGenerated >= starttime) \n                  and (isnull(endtime) or TimeGenerated <= endtime)\n                  and ((array_length(srcipaddr_has_any_prefix) == 0) or SrcIpAddr has_any (srcipaddr_has_any_prefix))\n                  and (array_length(actorusername_has_any) == 0  or ActorUsername has_any (actorusername_has_any))\n                  and (array_length(newvalue_has_any) == 0 or NewValue has_any (newvalue_has_any))\n                  and (array_length(eventtype_in) == 0 or EventType has_any (eventtype_in))\n                  and (array_length(operation_has_any) == 0 or Operation has_any (operation_has_any))\n                  and (eventresult == '*' or EventResult == eventresult)\n                  and (array_length(object_has_any) == 0 or Object has_any (object_has_any))\n  | extend EventSchema = \"AuditEvent\"\n  | extend\n        Value\t= NewValue,\n        User =  ActorUsername,\n        Application =  TargetAppName,\n        Dst = coalesce (TargetDvcId, TargetHostname, TargetIpAddr, TargetAppId, TargetAppName),\n        Dvc = coalesce (DvcFQDN, DvcHostname, DvcIpAddr, DvcId, _ResourceId, strcat (EventVendor,'/', EventProduct)),\n        Rule=RuleName,\n        EventStartTime = TimeGenerated,\n        EventEndTime = TimeGenerated\n    | project-away \n        _ResourceId, _SubscriptionId\n  };\n  parser(\n    starttime=starttime, \n    endtime=endtime, \n    srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, \n    eventtype_in=eventtype_in, \n    eventresult=eventresult, \n    actorusername_has_any=actorusername_has_any, \n    operation_has_any=operation_has_any, \n    object_has_any=object_has_any, \n    newvalue_has_any=newvalue_has_any, \n    disabled=disabled\n  )\n  ",
         "version": 1,
         "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),srcipaddr_has_any_prefix:dynamic=dynamic([]),actorusername_has_any:dynamic=dynamic([]),operation_has_any:dynamic=dynamic([]),eventtype_in:dynamic=dynamic([]),eventresult:string='*',object_has_any:dynamic=dynamic([]),newvalue_has_any:dynamic=dynamic([]),disabled:bool=False"
       }

diff --git a/Solutions/Check Point CloudGuard CNAPP/Package/3.0.0.zip b/Solutions/Check Point CloudGuard CNAPP/Package/3.0.0.zip
diff --git a/Solutions/Check Point CloudGuard CNAPP/Package/mainTemplate.json b/Solutions/Check Point CloudGuard CNAPP/Package/mainTemplate.json
@@ -48,7 +48,7 @@
     "_email": "[variables('email')]",
     "_solutionName": "Check Point CloudGuard CNAPP",
     "_solutionVersion": "3.0.0",
-    "solutionId": "checkpoint-cloudguard.checkpoint-sentinel-solutions-cloud-guard",
+    "solutionId": "checkpoint.checkpoint-sentinel-solutions-cloud-guard",
     "_solutionId": "[variables('solutionId')]",
     "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
     "dataConnectorCCPVersion": "1.0.0",

diff --git a/Solutions/Check Point CloudGuard CNAPP/SolutionMetadata.json b/Solutions/Check Point CloudGuard CNAPP/SolutionMetadata.json
@@ -1,5 +1,5 @@
 {
-  "publisherId": "checkpoint-cloudguard",
+  "publisherId": "checkpoint",
   "offerId": "checkpoint-sentinel-solutions-cloud-guard",
   "firstPublishDate": "2024-11-12",
   "providers": [

diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json
@@ -1066,7 +1066,6 @@
 			"CommonSecurityLog"
 		],
 		"dataConnectorsDependencies": [
-			"TrendMicro",
 			"CefAma"
 		],
 		"previewImagesFileNames": [
@@ -1087,7 +1086,6 @@
 			"CommonSecurityLog"
 		],
 		"dataConnectorsDependencies": [
-			"TrendMicro",
 			"CefAma"
 		],
 		"previewImagesFileNames": [
@@ -1133,7 +1131,6 @@
 			"Syslog"
 		],
 		"dataConnectorsDependencies": [
-			"BarracudaCloudFirewall",
 			"SyslogAma"
 		],
 		"previewImagesFileNames": [
@@ -1601,7 +1598,6 @@
 			"Syslog"
 		],
 		"dataConnectorsDependencies": [
-			"SymantecProxySG",
 			"SyslogAma"
 		],
 		"previewImagesFileNames": [
@@ -3681,7 +3677,6 @@
 			"CommonSecurityLog"
 		],
 		"dataConnectorsDependencies": [
-			"AristaAwakeSecurity",
 			"CefAma"
 		],
 		"previewImagesFileNames": [
@@ -3973,8 +3968,6 @@
 			"CommonSecurityLog"
 		],
 		"dataConnectorsDependencies": [
-			"InfobloxCloudDataConnector",
-			"InfobloxCloudDataConnectorAma",
 			"CefAma"
 		],
 		"previewImagesFileNames": [
@@ -4104,7 +4097,7 @@
 			"SecurityBridgeLogs"
 		],
 		"dataConnectorsDependencies": [
-			"SecurityBridgeSAP"
+			"CustomLogsAma"
 		],
 		"previewImagesFileNames": [
 			""
@@ -4166,7 +4159,6 @@
 			"McAfeeEPOEvent"
 		],
 		"dataConnectorsDependencies": [
-			"McAfeeePO",
 			"SyslogAma"
 		],
 		"previewImagesFileNames": [
@@ -4642,7 +4634,6 @@
 			"DigitalGuardianDLPEvent"
 		],
 		"dataConnectorsDependencies": [
-			"DigitalGuardianDLP",
 			"SyslogAma"
 		],
 		"previewImagesFileNames": [
@@ -4703,7 +4694,6 @@
 			"Syslog"
 		],
 		"dataConnectorsDependencies": [
-			"CiscoWSA",
 			"SyslogAma"
 		],
 		"previewImagesFileNames": [
@@ -5790,7 +5780,6 @@
 		"description": "A workbook providing insights into malware and C2 activity detected by iboss.",
 		"dataTypesDependencies": [],
 		"dataConnectorsDependencies": [
-			"ibossAma",
 			"CefAma"
 		],
 		"previewImagesFileNames": [
@@ -5808,7 +5797,6 @@
 		"description": "A workbook providing insights into web usage activity detected by iboss.",
 		"dataTypesDependencies": [],
 		"dataConnectorsDependencies": [
-			"ibossAma",
 			"CefAma"
 		],
 		"previewImagesFileNames": [
@@ -7944,7 +7932,7 @@
 		"Infoblox_Config_Insight_Details_CL"
 		],
 		"dataConnectorsDependencies": [
-		"InfobloxCloudDataConnectorAma",
+		"CefAma",
 		"InfobloxSOCInsightsDataConnector_AMA",
 		"InfobloxSOCInsightsDataConnector_API",
 		"InfobloxSOCInsightsDataConnector_Legacy"