From f2b0691e15e20d15e6dad7a3a99a87aa525c3444 Mon Sep 17 00:00:00 2001 From: v-shukore Date: Fri, 9 Aug 2024 15:35:08 +0530 Subject: [PATCH] Solution packaged for updating the post deployment steps of playbook --- .../AWSAthena/Data/Solution_AWSAthena.json | 2 +- Solutions/AWSAthena/Package/3.0.1.zip | Bin 0 -> 8633 bytes .../AWSAthena/Package/createUiDefinition.json | 2 +- Solutions/AWSAthena/Package/mainTemplate.json | 16 ++++++++-------- .../AWSAthena-GetQueryResults/azuredeploy.json | 3 +-- .../azuredeploy.json | 4 ++-- Solutions/AWSAthena/ReleaseNotes.md | 1 + 7 files changed, 14 insertions(+), 14 deletions(-) create mode 100644 Solutions/AWSAthena/Package/3.0.1.zip diff --git a/Solutions/AWSAthena/Data/Solution_AWSAthena.json b/Solutions/AWSAthena/Data/Solution_AWSAthena.json index 39a9edfdedd..f55277ddfd9 100644 --- a/Solutions/AWSAthena/Data/Solution_AWSAthena.json +++ b/Solutions/AWSAthena/Data/Solution_AWSAthena.json @@ -8,7 +8,7 @@ "Playbooks/AWSAthenaPlaybooks/AWSAthena-GetQueryResults/azuredeploy.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\AWSAthena", - "Version": "3.0.0", + "Version": "3.0.1", "Metadata": "SolutionMetadata.json", "TemplateSpec": true } \ No newline at end of file diff --git a/Solutions/AWSAthena/Package/3.0.1.zip b/Solutions/AWSAthena/Package/3.0.1.zip new file mode 100644 index 0000000000000000000000000000000000000000..b42b5e2191b39924a0f4a6b67c0a0ccb98ac8384 GIT binary patch literal 8633 zcmZ{KQ*=*+GHLPO#>nUS`Qv=U`eBeu4~HZ%@|dNkc>=3chHx|_+00KD}TL+tvNY3&r! zpC4y?-w9KM7?Z2LK26f)?)LYInlMX7M$RSSZJ^l<8Ic^*1-UXTi|#d#5IHd&t)UXy zoV96q^E|aY9mmC2dVIbDblx@|8P_hFN}UpDJh{wRxbiFvESe) z9`CT?)LQl_nTd$zE8OO)70k;FVAgg`M)U(NwcDmDKPO@s!6-W^Fw2nD;4#ZAPC z!e60w!gYB;OGg3vG_C|p4ZPVIHR|Rxe4(6j2CKhAbP+0IA^;NG(xFk6F5?o7?wNjZt7DUxpbNsp~w02a|wZ9IkNi# z3N$DB80(4|ya%#ZGQ=slK%QbVnDYvlf-;A>ztYU#sd##Gy;A7m zCE_^YM7nKi%JUXzx`@;?_`2Wa=_4Q>!jshPuvZ){L`ueI^O8h?8y$O^)-eqb@_=c(Q&vBRuzrm}mz>NB%9^c}o)jNl zws)KLi!#*!@i~&M)^z(q2iuB0JajvISSzas#e#+Hh6{zdD_xiQyp3LqC9@5KYt@fO zQZ<2tQv;Bk-1I`~cJFhWluExDkYe$4(9F!w!*W3V3Nc7NADAt5&7 ziL%dqP6jOw>3AK0#$n^|;JkkIMJzued&jcS_1ZO)j5-f*gzzv* z7>cL%Y4AIV-c?mnd(w+j7|}8iqIr*wTfQ-j+S*- zf~wNud@7HQ}zbdADt6_2BQJd%x^t<@2h}|)V#0URSrLpWlQ=L zM)_OvTZCNLk^9YezVrNkvx8c4<>RKXk|LY`z@3{~bs={SvdG=!Sb$7yc|N$NP7m?` zimSoa%zaO366w*_$EQw`&Y&U8e6uB%oAM0~7(U^U5Bu~4@Lr)D>fW;rDP1ccV_t`b z{{oOJ!svW#iog__?s+~2tB%8#(%xw58L6yr?qwtzR1d8(3A!Nj5d z1#?V*tQ{4@q{5uGBptn40X`-nNwyi>#qvy0EL+~Z-Ri`9=i`|lCQH8)qaTpLwSTso zJgy;s!K1lbH&b7GRNQ@Gnq5HKg-$~kMrZpit1)`HYummzC35kLFe6Z+CumQp*G;{Utff%JN=)X2X-hVr-koZpf$q2T z&syZiEYsJk_Aj!vhm$;?*_z(RyduAj1jP3a>bF1o9YkW^l7So3MRhjU0*uf$;K?v}bNg(cmStl?o+eT^6luE*mz)I^-Ns!NC2=#f1dUn;UkUbs~Pd z{fi!O|D4Z{Z8VFIG+s8=kt(WEj);9|ulchuzD*vK>%>V3G}oIN36XYLZn>Pftv>Is zKhvN4)80MD@j*n4xEmB{Ouq>dE(Oeh?`2IRe0KfB!KPQ@B3;b-ANL(^=RT)*JYjVa zzd(IdE|506;!kY4*d3gQD2k-VXl5u(7Mnd4hRGI8SF%}HGN#3sC8Zwz5mYFT)p z1ZJUtrvX8JGH{zZ${f)vL;{0cu+W9qCt=tT|J8e(jmQ+l{@4ZXTmQ226y#n+-2{ES znH_V1j*EDB+4tvfkCm17}*MZ-r9^#;1=cq zG&|+0u{!!S+{bSKh|9_E+kBkSXXK?xHk&Y^C}UWs)`1e!^hCbq@D=&7&?Q z2cPvzXIF>kCja9`tR+a5!CF<=o9Rs$9Bq8)%b8m=0PJmI)scFVA`EVP(GsqGA9~Pq zK}sT%UQ&22@d!tZknl}p1-BLq6z_{Tsb9y96aZEz zrrrbtx8%r1nU(HgmL+6f5_25k#uG}~dC;1=v}LZRbCwI%LJ+bmGk)N0(IYj38k8hp z|5kxCyP-*>jN31gMKEh8NI=QrrE}qItm3h{wQ2d3`0N@oC_&1kn+>&?F>SbRdBxFm zDQ#EMl>)WJ1dp!SUNC13!~=%vM7ac=lQw-X`z`wSSe9=guK_x&HLb5ZUx9|l`YI2B z*EuVmyom6HA7OJ)L0WDEe;+>{Ka}ynQ}3c7uH|VRbK}T|xX(9F|7UnXJ&!G~emT{l zkiNNL=E*oQjv_r`r^@ZhOWdH3oOmM?Wk698&o2FUdb;egE`{T8Uk+ZU*-~NHWTSNa zQ$*b={*WP*8L6%meX!cVJ<8*N%>+*0LQ)YZcP=_ zF%2$Gxx;KF?T|vW7s1A?(<}Hg3Eu^aKH3+{>jA02vOcU%&NtRpriKEj2x&Q`AB9%4 z`FPln{chERsS|Uj8JZE52QiO03T|hDxze6A9fb(gAJCO5(N#%(*rI8g$E$E0?R61PT799r;%*E70x5t zW|vqH!p#-ikaUH+=|fx1>mW(fCQ;71?V)34E1A9|Jj@Dvl-x}^kx;-2MoYoIx@;JpJd4uDetECuiH{e4^)=8+1V^GaL@z_$2Y=zUO^;C@FHy|CAvy zW;#`~inq2!^}r=IXM;_3>?o*ypW{BpQuO(Et&n`KicTp~E%vwF@(XjWI`!SgW+7eRPQgf}*iWQkkj=y(ChlYqQ*vdm_a^n^2 ztrjdXv8B4Y^=9^+rM%(nzA%)1^b^&7HKk}`y0|ZjXj*K99tp~=a1vY0!+sHDuJ^Bo z>Y(1$!#HtR`iw@07B1bLaL(VYS13q@DnmgC#KbK47ri%h#9$_!MnP`X2K4Iq@h8iU zp$13X_f>$Q9RXSBy$F%jWo;4F>J?nvi8=R(D1}0WkzNIbTGVuH!@96B@g<*ADV%;? zkQ?hwW<#&3pcVne;9?+@Y-6IIUs{PWYaN7d8_^6GNC9Cdn4U?AL&|t_5)1{&1fBc1 zSUICldfya4zO?)7C&9AGxiG>@4oyLyS1klhY=h>TH{vtweAR-)MQ-)khH5O97lrBm!%MT2PL)I>&JWTpKs z!asnMF;&q?hj;Ch8=xjyb#=^(PW4qZ!>}+na7+WqkY;{!X;I>V3^%2_+*D#V1J4_U zh14O|?4UjYBIlkeI4QpcVGK41B;2IVa$&|Yr+~Y=goWL)7$&9=vgiHVy^D2{cyjuxQkg|8}NFZWW`98xKTDlPx^>w3Ybx{X1}r{4qVgsytXUTdi}1*iwz*m z2gH^`p<;=Hz<&)++oasS1-d9fRmy}zaYJ2qi>>K38X7Kh;Tw9-PvRZH`kQ$)`D`9) zvz)ZIF6U$bY~@hXq*261zTDlBAUs`oJzRhHeQujXf4<#(SG@l`-&?vFI@!B8JsivU zh3^pPV4GF=G$Mc`#~6c4Q2+p#+JcS)2GjzGs>I`^=$~O+j~h#@q5IMQz$~ICJw_jq zw#fPzR1Nz76$(wXv_%LTY(ftj8cK04rQd0#l5A?qbPk*n!*5E1h*wMdXZ2`%5a|7go2~qZb3vQ%)$u>^2J@L z-L_$~&O@g|KZ$0r{xj8dQKhuC;A7D&Yl=?|+z!7f2X&K64|NCJqGVYrohg||OUodq zHCU}s7kXqUABOyn5H$$6>4taswom-0+oB$sVWj}+kGTRJKH$;_@Y1D8NgLryVc3Pd zUah}iRMC&(Q52BzJQT7W<{Y~}n3APVbC_{HNNW@Fk+K@-EI&)VSPL(8OWp)LJgIMO zD79~?TXt#60*Rr86886an^nRrbwU;VZ0@`}0Ro9gq8JC)l&x0L>hAoaSeo{)grmdJ zo3>)7-f&Zik)tq=g9rZ>RVImzifWy+z3L#xECfLrSgqi{zy)*adchF6 zsO5b+21OZ;XN|T@&#w+mY(0%zL{jX?_NkpVPq${A7(5lxNFkgkTCrXv3e#Fa2Hu=- zxuq#>1K?0vTiN8b;1d^XYXb$-IpNBkD|D4`+xZE_reu!w_YIWMsUF(I^{47_gsHUa z`PAJSxn{So*sPK8lf?2L3I!@RRhtj1+`l}uHq$LRq{Y=2AtkvYMPrxoD5D4ToEY(G z1}BveTrw|{Sit=@?;vW%8|-7T3j`9lBR*m@wV$0$zbtV8;|y`QxW%pVaf;EXj#pDD zJ7;@>(D%pEla{^g9X_0&u)a0wmDb@eSlXxGUNX-u)oHmZ?Ae=SC3TwyRfp^mO4AgB z_kN67MNeUweXnyDd6IAtt}WX6d%9F>6`;Ow5gz5>Ysy=tMqTtohMOJP*$bY5rmTwM z&L=_FT2229F2^14v)Ck57fea5q7954MQ5Lmm4_Ji?GqUPsDN=Jxql~Tb$ZX-^~QPY z>LQ?48>^$@IL+A2(US(oaZV|pxTKwZ=AVb(@OY`h_Y~~&_9}UIN@dewAu6T~suL$# zLU#6hX(Ou2&U}c*M0d0xtqHGIMVH<%>eGT;`Bo&BAGs$#c3^hAS+J?u7a6b59429m z{R5gW6Fv4Dnof#meH<6A{r7KSgF&0=`f}%*UFE|8P9wU=ChGc_Y7ZN!9Or_{QmmfD zTz~lGkjGGGJxrf!)GlH@mmWFZPg%w)W?U z9P%noG@2B-))7%u;!BIo8`*IP8h^(MRcY*4TS-H9&`v>i{H4@l!%X?z`%ueC=?@wH z^a0cyp7f|h;z#)R7MML*eu=J5bxiYlg9zV#S{r2j^)TQG8W` zq*I3(GsHU1X*p|KCMTq>Ak;uVKBW7e&cT@+B!Vsc_|r33ScJ3iM}x_+>A*x2Md^H| z%9|43pIMKXF1LFe^}QHx8X#v(bZI?Uj|x!m{dID7xt$e5fM?nl6lWoFNZhp)#< zyN*f%gg2{3(=72tF`kb#yODVs(pI6l?&TE1nx_t3Qp;`gpZmrplF+J<&1Bal@#?#p zWDTJzJspk>0fQiebI%@(O{LT(PkdIJOQx#UU2gM6ktfC*+@LAh8QI5&q_HTgru$Uv zg@uERL%1$tN+m^J+dL?yZ`M^qx)bEKqT*EpX;VfGih%CWvKLLJ+6KDfh_jZ2w$8lr zw?CG-$_HylT#(Pf^usnN=d1c;dj zMg}J#4WEIQkdToPu@SNJ5pL3FlSI4AH-lCnhek~$EFv9c&3ZUeN4iCSg$MJ}`0y;v z&Qv^Ev=DEbH>Q;}OKlnnzKk6i6Jh*X@@{}dNk1INBnaGU&v|n{xQN@c$*N1I)v9cs zz*_S(t7+Q0zST^N=cxC6Y6R47J=oVBI@$LiR6jgSxl+B}1I+Afj?Jt}t=`_fMuja2 z8L4R*@_WM^9=_%6un0&d+xunruygSCMkYxd>wwRY_%}I-@{cCH2}J{3q#7Hw;U7he zZrqxlZSI^ZC`Al|inX0fOXTwCks=YBz>-zVMxqMfOt`t#VlpgC+G7|1wgm?_11b{I z#(pV4M}~5W*JrmE|A?8c+PAhM&U->SSm*4oNI}bXx`ndk_LUT0;&*VmzXrhdr9A`t#5?l|QmWhp4a!mtqOj#YF?vgfpUx3~;Hg3Ew@J3!%9XRPI2?GTSA z(^?nXr1KT&hZmXEA&-Dm*8W z&z%&nIb<1owjtZ>l+3 zxQZu?>${Iyc>w=>o)ebTT^sz;=TBCA}HJ)rEYbUk^!X1**u|yqPgAg>46kfs$ z*v29|v)fO|y}eV~4_n^1?bMm!&4b3Zs7RB#8vi%O=<-4005E_VYh?3a>bgmee~kdA9=b-+=VWqB=~;kD8uFF`x6E} zdMIyN548dd*Fg&ueoC18&BW5MT~D=ZEDaUBGW9<`S%Yd+f1cH7JNs$=5s0m|&!Yi?vs$M6Ku_>Jw%!;vP|YYt7QqFH z{cxRk3OWf2_9YI~-}Xg&@qIF9yUaS%4N+4+VR@Hsf}C752ROS?PjR5~m6|`CiwQNN zQoH|CNcZu^^^NJW#IPD(BdD{A!Mm!-4Fsoo9J&90~ zZe!G*O9&|(Vr97aP-x>EkO&DHwt1>Kz)RnHM2EaS@;p)i@|5^A0X{wWjV`VVWaIVX-wjK$Ty%7Z?^_e(O+afz%KoP7)^vlc`5Y|Cl)v| z4ORwed4n%_TQ&TFrReRfUoA|dCZ(;}xGV-ltSu{Al?gSr)|bhnLsz97-ww8#TLV46j~Z8vt$-6+J7+^|${|nJ|6Hg5=s* z1$r25kN&w^;^ytEdm_C@)a>)C0f8@-`M>O4OcjgvXztUImfAeMP}sKlR1m|yJiN%i z8nzd|N3%4{NVi|c4sx|kNvNTzs#6wnDvuX1;VWr=lspQfqIYMWY4vZVLSW52a2SIn ziM=i_#Vrd=wTSE?l)NObuLmi#ZEz`x1>)Hpmw{}eQpB3drUEHLFT(HN2`PoL_FKC({7}@!@vO0(~XXg1rw>{PeW*n4t z9BOz*q<|5Anf+9v?Bz2J3X<_V;=hG>=6tLm_OZn8NxOLVp|92-P00u zM2r2(`PPRV-|0kbA{F*VXSVdNOt_1`iG%T?L~E}X#e!UhC$2~!vR(VQJcR&yZi68u z{IW71S3Wy0dwjp{m?4lqvcr%f9edxT@34Q!Kb~6Q5cWIO-tVX$f*U?S4#Vv3X2K$) zIrq1wSPiCn_2K7hB}3K5Sd_Sh#K;Tb&X~P2sI$MnomET6n&@n4Gp&Es; z6GPD_z%^Xa^RPs0=3>@qH;xED8K>q#Puc^Yr3g#L=?C`L5NAh;^T}shvn_hHaFAZ4 zK&r)>DT8Uyd8i81jdIlXY*7ku&m}`ig%Q2*WJx(}h6w9emg>-(?3tKYvOod~@tF(s z8@JLd$!gPi3j210?&w%mfX9zC!=4n)Ih2mGJ2LdTZNE0CxRBEy0J#^DyI;6#h@Xxo zBgQr`nJ-u#sbM?~1Y@e~Hv#FAnXs@Ad2)UTTM0NvD(xf)IUL^0prRKhOnoi?* z&}FLAZK=*OhN24W!K^6L{apiXo;r#khvUk&FowwM>&8BB5mqs2OC*wV7bQ2sY$gpC zVTgnkTsu#|mxi^M19cL-gYZb8F7D9e;*u!4^JN7ucbo_oID;YPS#h*onp_tTFmQBk z6=S!f`WiFWLm|9$-FVRrkz-`CP{@rLx#QmDH81FrpDSB1W&3y2Gn{~FphVZ}$0Tca zWwdSu?K+3dB=%nLxSf)y+k>PXV-d5OcLr_uW73wkDR$DP3T+deidlx_P=%U}<3L%( zVsqfbL8UdaEaEn1McH=po$7?gh09rEa#&E_k3XHc%bj??*pdw$n#Y)tEJI%E?Si1B zJ41($Nt*>E<-V(`#P%Fq1WhJ|D^\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/AWSAthena/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\n[Amazon Athena](https://aws.amazon.com/athena/?whats-new-cards.sort-by=item.additionalFields.postDateTime&whats-new-cards.sort-order=desc) is an interactive query service that makes it easy to analyze data in Amazon S3 using standard SQL. Athena is serverless, so there is no infrastructure to manage, and you pay only for the queries that you run. \n\n **Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n a. [Azure Functions](https://azure.microsoft.com/products/functions/#overview)\n\n**Function Apps:** 1, **Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/AWSAthena/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\n[Amazon Athena](https://aws.amazon.com/athena/?whats-new-cards.sort-by=item.additionalFields.postDateTime&whats-new-cards.sort-order=desc) is an interactive query service that makes it easy to analyze data in Amazon S3 using standard SQL. Athena is serverless, so there is no infrastructure to manage, and you pay only for the queries that you run. \n\n **Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n a. [Azure Functions](https://azure.microsoft.com/products/functions/#overview)\n\n**Function Apps:** 1, **Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", diff --git a/Solutions/AWSAthena/Package/mainTemplate.json b/Solutions/AWSAthena/Package/mainTemplate.json index 2eefe702c3f..fad63963642 100644 --- a/Solutions/AWSAthena/Package/mainTemplate.json +++ b/Solutions/AWSAthena/Package/mainTemplate.json @@ -33,7 +33,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "AWSAthena", - "_solutionVersion": "3.0.0", + "_solutionVersion": "3.0.1", "solutionId": "azuresentinel.azure-sentinel-solution-awsathena", "_solutionId": "[variables('solutionId')]", "AWSAthena_FunctionAppConnector": "AWSAthena_FunctionAppConnector", @@ -66,7 +66,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AWSAthena_FunctionAppConnector Playbook with template version 3.0.0", + "description": "AWSAthena_FunctionAppConnector Playbook with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -106,7 +106,7 @@ "resources": [ { "type": "Microsoft.Storage/storageAccounts", - "apiVersion": "2021-02-01", + "apiVersion": "2023-04-01", "name": "[[variables('storageAccountName')]", "location": "[[variables('workspace-location-inline')]", "sku": { @@ -191,7 +191,7 @@ }, { "name": "AzureWebJobsStorage", - "value": "[[concat('DefaultEndpointsProtocol=https;AccountName=', variables('storageAccountName'), ';EndpointSuffix=', environment().suffixes.storage, ';AccountKey=',listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), '2022-05-01').keys[0].value)]" + "value": "[[concat('DefaultEndpointsProtocol=https;AccountName=', variables('storageAccountName'), ';EndpointSuffix=', environment().suffixes.storage, ';AccountKey=',listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), '2023-04-01').keys[0].value)]" }, { "name": "FUNCTIONS_EXTENSION_VERSION", @@ -271,7 +271,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AWSAthena-GetQueryResults Playbook with template version 3.0.0", + "description": "AWSAthena-GetQueryResults Playbook with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion2')]", @@ -728,7 +728,7 @@ "Obtain AWS Access Key ID, Secret Access Key and Region." ], "postDeployment": [ - "Follow Post deployment steps from playbook readme file." + "a. Once deployment is complete, authorize each connection.\n 1. Click the Microsoft Sentinel connection resource.\n 2. Click edit API connection.\n 3. Click Authorize\n 4. Sign in\n 5. Click Save\n 6. Repeat steps for other connections. \n\n b. Assign Playbook Microsoft Sentinel Responder Role\n 1. Select the Playbook (Logic App) resource\n 2. Click on Identity Blade\n 3. Choose System assigned tab\n 4. Click on Azure role assignments\n 5. Click on Add role assignments\n 6. Select Scope - Resource group\n 7. Select Subscription - where Playbook has been created\n 8. Select Resource group - where Playbook has been created\n 9. Select Role - Microsoft Sentinel Responder\n 10. Click Save (It takes 3-5 minutes to show the added role." ], "lastUpdateTime": "2022-11-14T12:00:00Z", "tags": [ @@ -762,12 +762,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.0", + "version": "3.0.1", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "AWSAthena", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Amazon Athena is an interactive query service that makes it easy to analyze data in Amazon S3 using standard SQL. Athena is serverless, so there is no infrastructure to manage, and you pay only for the queries that you run.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Azure Functions
    2. \n
\n

Function Apps: 1, Playbooks: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Amazon Athena is an interactive query service that makes it easy to analyze data in Amazon S3 using standard SQL. Athena is serverless, so there is no infrastructure to manage, and you pay only for the queries that you run.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Azure Functions
    2. \n
\n

Function Apps: 1, Playbooks: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", diff --git a/Solutions/AWSAthena/Playbooks/AWSAthenaPlaybooks/AWSAthena-GetQueryResults/azuredeploy.json b/Solutions/AWSAthena/Playbooks/AWSAthenaPlaybooks/AWSAthena-GetQueryResults/azuredeploy.json index f5c46ce0cf8..e92a1c87ea7 100644 --- a/Solutions/AWSAthena/Playbooks/AWSAthenaPlaybooks/AWSAthena-GetQueryResults/azuredeploy.json +++ b/Solutions/AWSAthena/Playbooks/AWSAthenaPlaybooks/AWSAthena-GetQueryResults/azuredeploy.json @@ -5,8 +5,7 @@ "title": "AWS Athena - Execute Query and Get Results", "description": "When a new sentinel incident is created, this playbook gets triggered and performs the following actions:\n 1. It executes the query specified during playbook setup on given database.\n 2. Downloads the query result and adds as a comment to the incident.", "prerequisites": ["Obtain AWS Access Key ID, Secret Access Key and Region."], - "postDeployment": [ - "Follow Post deployment steps from playbook readme file." + "postDeployment": ["a. Once deployment is complete, authorize each connection.\n 1. Click the Microsoft Sentinel connection resource.\n 2. Click edit API connection.\n 3. Click Authorize\n 4. Sign in\n 5. Click Save\n 6. Repeat steps for other connections. \n\n b. Assign Playbook Microsoft Sentinel Responder Role\n 1. Select the Playbook (Logic App) resource\n 2. Click on Identity Blade\n 3. Choose System assigned tab\n 4. Click on Azure role assignments\n 5. Click on Add role assignments\n 6. Select Scope - Resource group\n 7. Select Subscription - where Playbook has been created\n 8. Select Resource group - where Playbook has been created\n 9. Select Role - Microsoft Sentinel Responder\n 10. Click Save (It takes 3-5 minutes to show the added role." ], "prerequisitesDeployTemplateFile": "../../CustomConnector/AWSAthena_FunctionAppConnector/azuredeploy.json", "lastUpdateTime": "2022-11-14T12:00:00.000Z", diff --git a/Solutions/AWSAthena/Playbooks/CustomConnector/AWSAthena_FunctionAppConnector/azuredeploy.json b/Solutions/AWSAthena/Playbooks/CustomConnector/AWSAthena_FunctionAppConnector/azuredeploy.json index 14d868bf24a..2222115966d 100644 --- a/Solutions/AWSAthena/Playbooks/CustomConnector/AWSAthena_FunctionAppConnector/azuredeploy.json +++ b/Solutions/AWSAthena/Playbooks/CustomConnector/AWSAthena_FunctionAppConnector/azuredeploy.json @@ -32,7 +32,7 @@ "resources": [ { "type": "Microsoft.Storage/storageAccounts", - "apiVersion": "2021-02-01", + "apiVersion": "2023-04-01", "name": "[variables('storageAccountName')]", "location": "[resourceGroup().location]", "sku": { @@ -117,7 +117,7 @@ }, { "name": "AzureWebJobsStorage", - "value": "[concat('DefaultEndpointsProtocol=https;AccountName=', variables('storageAccountName'), ';EndpointSuffix=', environment().suffixes.storage, ';AccountKey=',listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), '2022-05-01').keys[0].value)]" + "value": "[concat('DefaultEndpointsProtocol=https;AccountName=', variables('storageAccountName'), ';EndpointSuffix=', environment().suffixes.storage, ';AccountKey=',listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), '2023-04-01').keys[0].value)]" }, { "name": "FUNCTIONS_EXTENSION_VERSION", diff --git a/Solutions/AWSAthena/ReleaseNotes.md b/Solutions/AWSAthena/ReleaseNotes.md index 159feed4a72..95c1eb66d57 100644 --- a/Solutions/AWSAthena/ReleaseNotes.md +++ b/Solutions/AWSAthena/ReleaseNotes.md @@ -1,4 +1,5 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------------------------------------| +| 3.0.1 | 09-08-2024 | Updated **Playbook** post deployement steps | | 3.0.0 | 29-01-2024 | App insights to LA change in data connector and repackage |