diff --git a/Parsers/ASimAuditEvent/ARM/ASimAuditEventNative/ASimAuditEventNative.json b/Parsers/ASimAuditEvent/ARM/ASimAuditEventNative/ASimAuditEventNative.json index af0b92d41c0..4468c5a6361 100644 --- a/Parsers/ASimAuditEvent/ARM/ASimAuditEventNative/ASimAuditEventNative.json +++ b/Parsers/ASimAuditEvent/ARM/ASimAuditEventNative/ASimAuditEventNative.json @@ -27,7 +27,7 @@ "displayName": "Audit Event ASIM parser for Microsoft Sentinel native Audit Event table", "category": "ASIM", "FunctionAlias": "ASimAuditEventNative", - "query": "let parser=(disabled:bool=false) \n{\n ASimAuditEventLogs | where not(disabled)\n | extend EventSchema = \"AuditEvent\"\n | extend\n Value\t= NewValue,\n User = ActorUsername,\n Application = TargetAppName,\n Dst = coalesce (TargetDvcId, TargetHostname, TargetIpAddr, TargetAppId, TargetAppName),\n Dvc = coalesce (DvcFQDN, DvcHostname, DvcIpAddr, DvcId, _ResourceId, strcat (EventVendor,'/', EventProduct)), \n Rule=RuleName,\n EventStartTime = TimeGenerated,\n EventEndTime = TimeGenerated\n | project-rename\n EventUid = _ItemId\n | project-away\n _ResourceId, _SubscriptionId\n};\nparser (disabled=disabled)\n", + "query": "let parser=(disabled:bool=false) \n{\n ASimAuditEventLogs | where not(disabled)\n | extend EventSchema = \"AuditEvent\"\n | extend\n Value\t= NewValue,\n User = ActorUsername,\n Application = TargetAppName,\n Dst = coalesce (TargetDvcId, TargetHostname, TargetIpAddr, TargetAppId, TargetAppName),\n Dvc = coalesce (DvcFQDN, DvcHostname, DvcIpAddr, DvcId, _ResourceId, strcat (EventVendor,'/', EventProduct)), \n Rule=RuleName,\n EventStartTime = TimeGenerated,\n EventEndTime = TimeGenerated\n | project-away\n _ResourceId, _SubscriptionId\n};\nparser (disabled=disabled)\n", "version": 1, "functionParameters": "disabled:bool=False" } diff --git a/Parsers/ASimAuditEvent/ARM/vimAuditEventNative/vimAuditEventNative.json b/Parsers/ASimAuditEvent/ARM/vimAuditEventNative/vimAuditEventNative.json index bf52e9fd7c8..eab0d785946 100644 --- a/Parsers/ASimAuditEvent/ARM/vimAuditEventNative/vimAuditEventNative.json +++ b/Parsers/ASimAuditEvent/ARM/vimAuditEventNative/vimAuditEventNative.json @@ -27,7 +27,7 @@ "displayName": "Audit Event ASIM filtering parser for Microsoft Sentinel native Audit Event table", "category": "ASIM", "FunctionAlias": "vimAuditEventNative", - "query": "let parser=\n(\n starttime: datetime=datetime(null), \n endtime: datetime=datetime(null),\n srcipaddr_has_any_prefix: dynamic=dynamic([]), \n eventtype_in: dynamic=dynamic([]),\n eventresult: string='*',\n actorusername_has_any: dynamic=dynamic([]),\n operation_has_any: dynamic=dynamic([]),\n object_has_any: dynamic=dynamic([]),\n newvalue_has_any: dynamic=dynamic([]),\n disabled: bool = false\n)\n{\n ASimAuditEventLogs | where not(disabled)\n | where (isnull(starttime) or TimeGenerated >= starttime) \n and (isnull(endtime) or TimeGenerated <= endtime)\n and ((array_length(srcipaddr_has_any_prefix) == 0) or SrcIpAddr has_any (srcipaddr_has_any_prefix))\n and (array_length(actorusername_has_any) == 0 or ActorUsername has_any (actorusername_has_any))\n and (array_length(newvalue_has_any) == 0 or NewValue has_any (newvalue_has_any))\n and (array_length(eventtype_in) == 0 or EventType has_any (eventtype_in))\n and (array_length(operation_has_any) == 0 or Operation has_any (operation_has_any))\n and (eventresult == '*' or EventResult == eventresult)\n and (array_length(object_has_any) == 0 or Object has_any (object_has_any))\n | extend EventSchema = \"AuditEvent\"\n | extend\n Value\t= NewValue,\n User = ActorUsername,\n Application = TargetAppName,\n Dst = coalesce (TargetDvcId, TargetHostname, TargetIpAddr, TargetAppId, TargetAppName),\n Dvc = coalesce (DvcFQDN, DvcHostname, DvcIpAddr, DvcId, _ResourceId, strcat (EventVendor,'/', EventProduct)),\n Rule=RuleName,\n EventStartTime = TimeGenerated,\n EventEndTime = TimeGenerated\n | project-rename\n EventUid = _ItemId\n | project-away \n _ResourceId, _SubscriptionId\n };\n parser(\n starttime=starttime, \n endtime=endtime, \n srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, \n eventtype_in=eventtype_in, \n eventresult=eventresult, \n actorusername_has_any=actorusername_has_any, \n operation_has_any=operation_has_any, \n object_has_any=object_has_any, \n newvalue_has_any=newvalue_has_any, \n disabled=disabled\n )\n ", + "query": "let parser=\n(\n starttime: datetime=datetime(null), \n endtime: datetime=datetime(null),\n srcipaddr_has_any_prefix: dynamic=dynamic([]), \n eventtype_in: dynamic=dynamic([]),\n eventresult: string='*',\n actorusername_has_any: dynamic=dynamic([]),\n operation_has_any: dynamic=dynamic([]),\n object_has_any: dynamic=dynamic([]),\n newvalue_has_any: dynamic=dynamic([]),\n disabled: bool = false\n)\n{\n ASimAuditEventLogs | where not(disabled)\n | where (isnull(starttime) or TimeGenerated >= starttime) \n and (isnull(endtime) or TimeGenerated <= endtime)\n and ((array_length(srcipaddr_has_any_prefix) == 0) or SrcIpAddr has_any (srcipaddr_has_any_prefix))\n and (array_length(actorusername_has_any) == 0 or ActorUsername has_any (actorusername_has_any))\n and (array_length(newvalue_has_any) == 0 or NewValue has_any (newvalue_has_any))\n and (array_length(eventtype_in) == 0 or EventType has_any (eventtype_in))\n and (array_length(operation_has_any) == 0 or Operation has_any (operation_has_any))\n and (eventresult == '*' or EventResult == eventresult)\n and (array_length(object_has_any) == 0 or Object has_any (object_has_any))\n | extend EventSchema = \"AuditEvent\"\n | extend\n Value\t= NewValue,\n User = ActorUsername,\n Application = TargetAppName,\n Dst = coalesce (TargetDvcId, TargetHostname, TargetIpAddr, TargetAppId, TargetAppName),\n Dvc = coalesce (DvcFQDN, DvcHostname, DvcIpAddr, DvcId, _ResourceId, strcat (EventVendor,'/', EventProduct)),\n Rule=RuleName,\n EventStartTime = TimeGenerated,\n EventEndTime = TimeGenerated\n | project-away \n _ResourceId, _SubscriptionId\n };\n parser(\n starttime=starttime, \n endtime=endtime, \n srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, \n eventtype_in=eventtype_in, \n eventresult=eventresult, \n actorusername_has_any=actorusername_has_any, \n operation_has_any=operation_has_any, \n object_has_any=object_has_any, \n newvalue_has_any=newvalue_has_any, \n disabled=disabled\n )\n ", "version": 1, "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),srcipaddr_has_any_prefix:dynamic=dynamic([]),actorusername_has_any:dynamic=dynamic([]),operation_has_any:dynamic=dynamic([]),eventtype_in:dynamic=dynamic([]),eventresult:string='*',object_has_any:dynamic=dynamic([]),newvalue_has_any:dynamic=dynamic([]),disabled:bool=False" } diff --git a/Solutions/Check Point CloudGuard CNAPP/Package/3.0.0.zip b/Solutions/Check Point CloudGuard CNAPP/Package/3.0.0.zip index 4f68527901a..98b7f78d809 100644 Binary files a/Solutions/Check Point CloudGuard CNAPP/Package/3.0.0.zip and b/Solutions/Check Point CloudGuard CNAPP/Package/3.0.0.zip differ diff --git a/Solutions/Check Point CloudGuard CNAPP/Package/mainTemplate.json b/Solutions/Check Point CloudGuard CNAPP/Package/mainTemplate.json index ab16ea67e62..b9a385dcb70 100644 --- a/Solutions/Check Point CloudGuard CNAPP/Package/mainTemplate.json +++ b/Solutions/Check Point CloudGuard CNAPP/Package/mainTemplate.json @@ -48,7 +48,7 @@ "_email": "[variables('email')]", "_solutionName": "Check Point CloudGuard CNAPP", "_solutionVersion": "3.0.0", - "solutionId": "checkpoint-cloudguard.checkpoint-sentinel-solutions-cloud-guard", + "solutionId": "checkpoint.checkpoint-sentinel-solutions-cloud-guard", "_solutionId": "[variables('solutionId')]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "dataConnectorCCPVersion": "1.0.0", diff --git a/Solutions/Check Point CloudGuard CNAPP/SolutionMetadata.json b/Solutions/Check Point CloudGuard CNAPP/SolutionMetadata.json index d58b502f0ed..5b12dff7c29 100644 --- a/Solutions/Check Point CloudGuard CNAPP/SolutionMetadata.json +++ b/Solutions/Check Point CloudGuard CNAPP/SolutionMetadata.json @@ -1,5 +1,5 @@ { - "publisherId": "checkpoint-cloudguard", + "publisherId": "checkpoint", "offerId": "checkpoint-sentinel-solutions-cloud-guard", "firstPublishDate": "2024-11-12", "providers": [ diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json index 4741a281eb2..252fd0c3a0e 100644 --- a/Workbooks/WorkbooksMetadata.json +++ b/Workbooks/WorkbooksMetadata.json @@ -1066,7 +1066,6 @@ "CommonSecurityLog" ], "dataConnectorsDependencies": [ - "TrendMicro", "CefAma" ], "previewImagesFileNames": [ @@ -1087,7 +1086,6 @@ "CommonSecurityLog" ], "dataConnectorsDependencies": [ - "TrendMicro", "CefAma" ], "previewImagesFileNames": [ @@ -1133,7 +1131,6 @@ "Syslog" ], "dataConnectorsDependencies": [ - "BarracudaCloudFirewall", "SyslogAma" ], "previewImagesFileNames": [ @@ -1601,7 +1598,6 @@ "Syslog" ], "dataConnectorsDependencies": [ - "SymantecProxySG", "SyslogAma" ], "previewImagesFileNames": [ @@ -3681,7 +3677,6 @@ "CommonSecurityLog" ], "dataConnectorsDependencies": [ - "AristaAwakeSecurity", "CefAma" ], "previewImagesFileNames": [ @@ -3973,8 +3968,6 @@ "CommonSecurityLog" ], "dataConnectorsDependencies": [ - "InfobloxCloudDataConnector", - "InfobloxCloudDataConnectorAma", "CefAma" ], "previewImagesFileNames": [ @@ -4104,7 +4097,7 @@ "SecurityBridgeLogs" ], "dataConnectorsDependencies": [ - "SecurityBridgeSAP" + "CustomLogsAma" ], "previewImagesFileNames": [ "" @@ -4166,7 +4159,6 @@ "McAfeeEPOEvent" ], "dataConnectorsDependencies": [ - "McAfeeePO", "SyslogAma" ], "previewImagesFileNames": [ @@ -4642,7 +4634,6 @@ "DigitalGuardianDLPEvent" ], "dataConnectorsDependencies": [ - "DigitalGuardianDLP", "SyslogAma" ], "previewImagesFileNames": [ @@ -4703,7 +4694,6 @@ "Syslog" ], "dataConnectorsDependencies": [ - "CiscoWSA", "SyslogAma" ], "previewImagesFileNames": [ @@ -5790,7 +5780,6 @@ "description": "A workbook providing insights into malware and C2 activity detected by iboss.", "dataTypesDependencies": [], "dataConnectorsDependencies": [ - "ibossAma", "CefAma" ], "previewImagesFileNames": [ @@ -5808,7 +5797,6 @@ "description": "A workbook providing insights into web usage activity detected by iboss.", "dataTypesDependencies": [], "dataConnectorsDependencies": [ - "ibossAma", "CefAma" ], "previewImagesFileNames": [ @@ -7944,7 +7932,7 @@ "Infoblox_Config_Insight_Details_CL" ], "dataConnectorsDependencies": [ - "InfobloxCloudDataConnectorAma", + "CefAma", "InfobloxSOCInsightsDataConnector_AMA", "InfobloxSOCInsightsDataConnector_API", "InfobloxSOCInsightsDataConnector_Legacy"