Improved BloodHound Enterprise Solution

[daviditkin]

Required items, please complete

Change(s):

• DCR custom table schema changed to reflect additional information now available from BloodHound.
• Function App now schedules a golang executable that is connector to BloodHoundEnterprise
• New Workbooks based on additional information now available from BloodHound
• Alert rules modified to reflect modifications to schema

Reason for Change(s):

• New approach to integrating with BloodHoundEnterprise. New endpoints, golang connector.
• Additional Workbooks based on new data available from BloodHoundEnterprise

Version Updated:

• Solution updated from 3.0.0 to 3.1.0
• Alert Rules updated from 1.0.x to 1.1.0 to reflect modification to schema

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Need Help

Note: I have run the Test-AzTemplate and it runs without error.
I can not run the kql validation scripts I keep getting dll/version issues and I need help with that test.

[daviditkin]

Hello @daviditkin, Please create a custom schema table named as BloodHoundLogs_CL at location https://github.com/Azure/Azure-Sentinel/tree/master/.script/tests/KqlvalidationsTests/CustomTables

Please add workbook metadata to https://github.com/Azure/Azure-Sentinel/blob/master/Workbooks/WorkbooksMetadata.json

Make sure function app zip is updated with all the libraries and functions Also do share working images of function app

Hey @v-prasadboke , thanks for you help. I still getting validation errors, but a different set this time. Any help would be appreciated.

[v-prasadboke]

please add workbook images file name in the properties

[daviditkin]

@v-prasadboke Thanks for your help. The PR now passes the first set of automated tests.

If you see anything that looks like it can be improved please let me know.

I still have some questions to make sure what I've done is correct:

1. There are a bunch of resource id errors in mainTemplate.json that I have corrected by hand before adding it to the zip file.
   I am correcting them with this kind of modification:

"workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]",
"_workbookcontentProductId1": "[variables('workbookcontentProductId1')]",

2. Is sample data required for the PR. I've not added it.

[v-prasadboke]

Hello @daviditkin, Can you share invocation logs images for the Function app

[daviditkin]

Hello @daviditkin, Can you share invocation logs images for the Function app

Hey @v-prasadboke , I'm not sure where you want me to put the images. Here is a log from test runs I just did. Let me know if I should screenshots into my solution's directory or somewhere else? I'm not sure where this screenshot should be placed.