SWG file fixes and NetworkAccessAlerts table

Azure · Dec 29, 2024 · ec16e02 · ec16e02
1 parent 01c7d14
commit ec16e02
Show file tree

Hide file tree

Showing 6 changed files with 97 additions and 66 deletions.
diff --git a/.script/tests/KqlvalidationsTests/CustomTables/NetworkAccessAlerts.json b/.script/tests/KqlvalidationsTests/CustomTables/NetworkAccessAlerts.json
@@ -0,0 +1,93 @@
+{
+  "Name": "NetworkAccessAlerts",
+
+    {
+      "Name": "TenantId",
+      "Type": "string"
+    },
+    {
+      "Name": "TimeGenerated",
+      "Type": "datetime"
+    },
+    {
+      "Name": "Id",
+      "Type": "string"
+    },
+    {
+      "Name": "DisplayName",
+      "Type": "string"
+    },
+    {
+      "Name": "Severity",
+      "Type": "string"
+    },
+    {
+      "Name": "ComponentName",
+      "Type": "string"
+    },
+    {
+      "Name": "DetectionTechnology",
+      "Type": "string"
+    },
+    {
+      "Name": "AlertType",
+      "Type": "string"
+    },
+    {
+      "Name": "Description",
+      "Type": "string"
+    },
+    {
+      "Name": "ProductName",
+      "Type": "string"
+    },
+    {
+      "Name": "PolicyId",
+      "Type": "string"
+    },
+    {
+      "Name": "LastActivityDateTime",
+      "Type": "datetime"
+    },
+    {
+      "Name": "FirstActivityDateTime",
+      "Type": "datetime"
+    },
+    {
+      "Name": "SourceSystem",
+      "Type": "string"
+    },
+    {
+      "Name": "Techniques",
+      "Type": "string"
+    },
+    {
+      "Name": "SubTechniques",
+      "Type": "string"
+    },
+    {
+      "Name": "ExtendedProperties",
+      "Type": "dynamic"
+    },
+    {
+      "Name": "RelatedResources",
+      "Type": "dynamic"
+    },
+    {
+      "Name": "IsPreview",
+      "Type": "bool"
+    },
+    {
+      "Name": "CreationDateTime",
+      "Type": "datetime"
+    },
+    {
+      "Name": "Type",
+      "Type": "string"
+    },
+    {
+      "Name": "VendorName",
+      "Type": "string"
+    }
+  ]
+}
diff --git a/Solutions/Global Secure Access/Analytic Rules/Identity - AfterHoursActivity.yaml b/Solutions/Global Secure Access/Analytic Rules/Identity - AfterHoursActivity.yaml
@@ -36,5 +36,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.1
+version: 1.0.2
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/Identity - SharedSessions.yaml b/Solutions/Global Secure Access/Analytic Rules/Identity - SharedSessions.yaml
diff --git a/Solutions/Global Secure Access/Analytic Rules/SWG - Abnormal Deny Rate.yaml b/Solutions/Global Secure Access/Analytic Rules/SWG - Abnormal Deny Rate.yaml
@@ -54,5 +54,5 @@ entityMappings:
     fieldMappings:
       - identifier: Url
         columnName: DestinationIp
-version: 1.0.1
+version: 1.0.2
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/SWG - Abnormal Port to Protocol.yaml b/Solutions/Global Secure Access/Analytic Rules/SWG - Abnormal Port to Protocol.yaml
@@ -50,5 +50,5 @@ entityMappings:
     fieldMappings:
       - identifier: Url
         columnName: FqdnCustomEntity
-version: 1.0.1
+version: 1.0.2
 kind: Scheduled
diff --git a/Solutions/Global Secure Access/Analytic Rules/SWG - Source IP Port Scan.yaml b/Solutions/Global Secure Access/Analytic Rules/SWG - Source IP Port Scan.yaml
@@ -37,5 +37,5 @@ entityMappings:
     fieldMappings:
       - identifier: Url
         columnName: DestinationFqdn
-version: 1.0.1
+version: 1.0.2
 kind: Scheduled