-
Notifications
You must be signed in to change notification settings - Fork 3.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'native_Authentication_parser' of https://github.com/Azu…
…re/Azure-Sentinel into native_Authentication_parser
- Loading branch information
Showing
46 changed files
with
9,945 additions
and
936 deletions.
There are no files selected for viewing
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
219 changes: 219 additions & 0 deletions
219
Solutions/DruvaDataSecurityCloud/Data Connectors/Druva_ccp/Druva_DCR.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,219 @@ | ||
| [ | ||
| { | ||
| "name": "DruvaDCR", | ||
| "apiVersion": "2021-09-01-preview", | ||
| "type": "Microsoft.Insights/dataCollectionRules", | ||
| "location": "{{location}}", | ||
| "properties": { | ||
| "dataCollectionEndpointId": "{{dataCollectionEndpointId}}", | ||
| "streamDeclarations": { | ||
| "Custom-DruvaSecurityEvents_CL": { | ||
| "columns": [ | ||
| { | ||
| "name": "TimeGenerated", | ||
| "type": "datetime" | ||
| }, | ||
| { | ||
| "name": "id", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "globalCustomerId", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "occurenceTime", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "area", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "category", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "type", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "syslogSeverity", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "syslogFacility", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "details", | ||
| "type": "string" | ||
| } | ||
| ] | ||
| }, | ||
| "Custom-DruvaPlatformEvents_CL": { | ||
| "columns": [ | ||
| { | ||
| "name": "TimeGenerated", | ||
| "type": "datetime" | ||
| }, | ||
| { | ||
| "name": "category", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "details", | ||
| "type": "dynamic" | ||
| }, | ||
| { | ||
| "name": "feature", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "globalID", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "timeStamp", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "productID", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "syslogFacility", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "syslogSeverity", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "type", | ||
| "type": "string" | ||
| } | ||
| ] | ||
| }, | ||
| "Custom-DruvaInsyncEvents_CL": { | ||
| "columns": [ | ||
| { | ||
| "name": "eventType", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "eventState", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "eventID", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "eventDetails", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "timestamp", | ||
| "type": "datetime" | ||
| }, | ||
| { | ||
| "name": "initiator", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "ip", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "profileID", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "profileName", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "inSyncUserID", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "inSyncUserName", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "inSyncUserEmail", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "inSyncDataSourceID", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "inSyncDataSourceName", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "clientOS", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "clientVersion", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "severity", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "facility", | ||
| "type": "int" | ||
| } | ||
| ] | ||
| } | ||
| }, | ||
| "destinations": { | ||
| "logAnalytics": [ | ||
| { | ||
| "workspaceResourceId": "{{workspaceResourceId}}", | ||
| "name": "clv2ws1" | ||
| } | ||
| ] | ||
| }, | ||
| "dataFlows": [ | ||
| { | ||
| "streams": [ | ||
| "Custom-DruvaSecurityEvents_CL" | ||
| ], | ||
| "destinations": [ | ||
| "clv2ws1" | ||
| ], | ||
| "transformKql": "source\n| extend TimeGenerated = datetime_add('second',occurenceTime,make_datetime(1970,1,1)) \n| extend event_type = type\n| project-away occurenceTime, type\n| extend id = tostring(id) // Convert 'id' to string and rename to EventUid\n| project-rename EventUid = id\n\n", | ||
| "outputStream": "Custom-DruvaSecurityEvents_CL" | ||
| }, | ||
|
|
||
| { | ||
| "streams": [ | ||
| "Custom-DruvaPlatformEvents_CL" | ||
| ], | ||
| "destinations": [ | ||
| "clv2ws1" | ||
| ], | ||
| "transformKql": "source\n| extend TimeGenerated = datetime_add('second',timeStamp,make_datetime(1970,1,1))\n| extend event_type = type\n| project-away timeStamp, type\n", | ||
| "outputStream": "Custom-DruvaPlatformEvents_CL" | ||
| }, | ||
|
|
||
| { | ||
| "streams": [ | ||
| "Custom-DruvaInsyncEvents_CL" | ||
| ], | ||
| "destinations": [ | ||
| "clv2ws1" | ||
| ], | ||
| "transformKql": "source\n| extend TimeGenerated = timestamp\n| extend eventID = tostring(eventID)\n| project-rename EventUid = eventID\n| project-away timestamp\n", | ||
| "outputStream": "Custom-DruvaInsyncEvents_CL" | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| ] |
131 changes: 131 additions & 0 deletions
131
...tions/DruvaDataSecurityCloud/Data Connectors/Druva_ccp/Druva_DataConnectorDefinition.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,131 @@ | ||
| { | ||
| "name": "DruvaEventCCPDefinition", | ||
| "apiVersion": "2022-09-01-preview", | ||
| "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", | ||
| "location": "{{location}}", | ||
| "kind": "Customizable", | ||
| "properties": | ||
| { | ||
|
|
||
| "connectorUiConfig": { | ||
| "id": "DruvaEventCCPDefinition", | ||
| "title": "Druva Events Connector", | ||
| "publisher" : "Microsoft", | ||
| "descriptionMarkdown" : "Provides capability to ingest the druva events from druva apis", | ||
| "graphQueriesTableName" : "DruvaSecurityEvents_CL", | ||
| "graphQueries": [ | ||
| { | ||
| "metricName":"Total Security Events", | ||
| "legend":"Druva Security events received", | ||
| "baseQuery": "{{graphQueriesTableName}}" | ||
| }, | ||
|
|
||
| { | ||
| "metricName":"Total platform events", | ||
| "legend":"Druva platform events received", | ||
| "baseQuery": "DruvaPlatformEvents_CL" | ||
| }, | ||
| { | ||
| "metricName":"Total insync events", | ||
| "legend":"Druva insync events received", | ||
| "baseQuery": "DruvaInsyncEvents_CL" | ||
| } | ||
| ], | ||
| "sampleQueries":[ | ||
| { | ||
| "description": "Sample of Druva security events", | ||
| "query": "{{graphQueriesTableName}}\n| take 10" | ||
| }, | ||
| { | ||
| "description": "Sample of Druva platform events", | ||
| "query": "DruvaPlatformEvents_CL\n| take 10" | ||
| }, | ||
| { | ||
| "description": "Sample of Druva insync events", | ||
| "query": "DruvaInsyncEvents_CL\n| take 10" | ||
| } | ||
| ], | ||
| "dataTypes":[ | ||
| { | ||
| "name": "{{graphQueriesTableName}}", | ||
| "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | summarize Time=max(TimeGenerated) \n | where isnotempty(Time)" | ||
| }, | ||
| { | ||
| "name": "DruvaPlatformEvents_CL", | ||
| "lastDataReceivedQuery": "DruvaPlatformEvents_CL\n | summarize Time=max(TimeGenerated) \n | where isnotempty(Time)" | ||
| }, | ||
| { | ||
| "name": "DruvaInsyncEvents_CL", | ||
| "lastDataReceivedQuery": "DruvaInsyncEvents_CL\n | summarize Time=max(TimeGenerated) \n | where isnotempty(Time)" | ||
| } | ||
| ], | ||
| "connectivityCriteria":[ | ||
| { | ||
| "type": "HasDataConnectors" | ||
| } | ||
| ], | ||
| "permissions":{ | ||
| "resourceProvider":[ | ||
| { | ||
| "provider": "Microsoft.OperationalInsights/workspaces", | ||
| "permissionsDisplayText":"Read and Write permission are required", | ||
| "providerDisplayName":"Workspace", | ||
| "scope":"Workspace", | ||
| "requiredPermissions":{ | ||
| "write": true, | ||
| "read":true, | ||
| "delete": true | ||
| } | ||
| } | ||
| ], | ||
| "customs":[ | ||
| { | ||
| "name": "Druva API Access", | ||
| "description":"Druva api requires a client id and client secret to authenticate" | ||
| } | ||
| ] | ||
| }, | ||
| "instructionSteps":[ | ||
| { | ||
| "description": ">Note: Configurations to connect to Druva Rest API\n" | ||
| }, | ||
| { | ||
| "description": "Step 1: Create Crdentials from Druva Console: https://help.druva.com/en/articles/8580838-create-and-manage-api-credentials\n" | ||
| }, | ||
| { | ||
| "description": "Step 2: Enter the hostname public cloud its apis.druva.com\n" | ||
| }, | ||
| { | ||
| "description": "Step 3: Get client id and client secret key\n" | ||
| }, | ||
| { | ||
| "description": "Provide required values:\n", | ||
| "instructions":[ | ||
|
|
||
| { | ||
| "type": "Textbox", | ||
| "parameters": { | ||
| "label": "hostname", | ||
| "placeholder": "Example: apis.druva.com", | ||
| "type": "text", | ||
| "name": "hostname" | ||
| } | ||
| }, | ||
|
|
||
| { | ||
| "type": "OAuthForm", | ||
| "parameters":{ | ||
| "clientIdLabel":"Client ID", | ||
| "clientSecretLabel" : "Client Secret", | ||
| "connectButtonLabel":"Connect", | ||
| "disconnectButtonLabel": "Diconnect" | ||
|
|
||
| } | ||
| } | ||
| ], | ||
| "tittle": "Connect to Druva API to start collecting logs in microft sentinel" | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.