From a9f8fd2444ee94755793b2c748d5efa7adcb8ef1 Mon Sep 17 00:00:00 2001 From: v-rusraut Date: Fri, 15 Nov 2024 16:39:06 +0530 Subject: [PATCH 1/6] Repackage - Claroty --- .../Analytic Rules/ClarotyAssetDown.yaml | 8 +- .../ClarotyCriticalBaselineDeviation.yaml | 8 +- .../ClarotyLoginToUncommonSite.yaml | 8 +- .../ClarotyMultipleFailedLogin.yaml | 8 +- .../ClarotyMultipleFailedLoginsSameDst.yaml | 8 +- .../Analytic Rules/ClarotyNewAsset.yaml | 6 - .../ClarotyPolicyViolation.yaml | 6 - .../ClarotySuspiciousActivity.yaml | 8 +- .../ClarotySuspiciousFileTransfer.yaml | 8 +- .../Claroty/Analytic Rules/ClarotyTreat.yaml | 2 +- Solutions/Claroty/Data/Solution_Claroty.json | 6 +- .../ClarotyBaselineDeviation.yaml | 6 - .../ClarotyConflictAssets.yaml | 6 - .../ClarotyCriticalEvents.yaml | 6 - .../Hunting Queries/ClarotyPLCLogins.yaml | 6 - .../ClarotySRAFailedLogins.yaml | 6 - .../Hunting Queries/ClarotyScanSources.yaml | 6 - .../Hunting Queries/ClarotyScantargets.yaml | 6 - .../ClarotyUnapprovedAccess.yaml | 6 - .../ClarotyUnresolvedAlerts.yaml | 6 - .../ClarotyWriteExecuteOperations.yaml | 6 - Solutions/Claroty/Package/3.0.3.zip | Bin 0 -> 14404 bytes .../Claroty/Package/createUiDefinition.json | 53 +- Solutions/Claroty/Package/mainTemplate.json | 982 ++---------------- Solutions/Claroty/ReleaseNotes.md | 1 + 25 files changed, 113 insertions(+), 1059 deletions(-) create mode 100644 Solutions/Claroty/Package/3.0.3.zip diff --git a/Solutions/Claroty/Analytic Rules/ClarotyAssetDown.yaml b/Solutions/Claroty/Analytic Rules/ClarotyAssetDown.yaml index d920baaefc4..87fdda85c60 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotyAssetDown.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotyAssetDown.yaml @@ -5,12 +5,6 @@ description: | severity: High status: Available requiredDataConnectors: - - connectorId: Claroty - dataTypes: - - ClarotyEvent - - connectorId: ClarotyAma - dataTypes: - - ClarotyEvent - connectorId: CefAma dataTypes: - CommonSecurityLog @@ -32,5 +26,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.2 +version: 1.0.3 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Analytic Rules/ClarotyCriticalBaselineDeviation.yaml b/Solutions/Claroty/Analytic Rules/ClarotyCriticalBaselineDeviation.yaml index a4bc4368c46..f53c057c588 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotyCriticalBaselineDeviation.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotyCriticalBaselineDeviation.yaml @@ -5,12 +5,6 @@ description: | severity: High status: Available requiredDataConnectors: - - connectorId: Claroty - dataTypes: - - ClarotyEvent - - connectorId: ClarotyAma - dataTypes: - - ClarotyEvent - connectorId: CefAma dataTypes: - CommonSecurityLog @@ -33,5 +27,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.2 +version: 1.0.3 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Analytic Rules/ClarotyLoginToUncommonSite.yaml b/Solutions/Claroty/Analytic Rules/ClarotyLoginToUncommonSite.yaml index 33ba1bb2606..8f5df920c3a 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotyLoginToUncommonSite.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotyLoginToUncommonSite.yaml @@ -5,12 +5,6 @@ description: | severity: Medium status: Available requiredDataConnectors: - - connectorId: Claroty - dataTypes: - - ClarotyEvent - - connectorId: ClarotyAma - dataTypes: - - ClarotyEvent - connectorId: CefAma dataTypes: - CommonSecurityLog @@ -46,5 +40,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: SrcIpAddr -version: 1.0.2 +version: 1.0.3 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLogin.yaml b/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLogin.yaml index 096e773f9b2..e2d89cb9f23 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLogin.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLogin.yaml @@ -5,12 +5,6 @@ description: | severity: High status: Available requiredDataConnectors: - - connectorId: Claroty - dataTypes: - - ClarotyEvent - - connectorId: ClarotyAma - dataTypes: - - ClarotyEvent - connectorId: CefAma dataTypes: - CommonSecurityLog @@ -37,5 +31,5 @@ entityMappings: fieldMappings: - identifier: Name columnName: AccountCustomEntity -version: 1.0.2 +version: 1.0.3 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLoginsSameDst.yaml b/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLoginsSameDst.yaml index 0ffb499ffd0..40c6e6e3127 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLoginsSameDst.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLoginsSameDst.yaml @@ -5,12 +5,6 @@ description: | severity: High status: Available requiredDataConnectors: - - connectorId: Claroty - dataTypes: - - ClarotyEvent - - connectorId: ClarotyAma - dataTypes: - - ClarotyEvent - connectorId: CefAma dataTypes: - CommonSecurityLog @@ -39,5 +33,5 @@ entityMappings: fieldMappings: - identifier: DistinguishedName columnName: SGCustomEntity -version: 1.0.2 +version: 1.0.3 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Analytic Rules/ClarotyNewAsset.yaml b/Solutions/Claroty/Analytic Rules/ClarotyNewAsset.yaml index db6d372edaf..22679c6bfd9 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotyNewAsset.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotyNewAsset.yaml @@ -5,12 +5,6 @@ description: | severity: High status: Available requiredDataConnectors: - - connectorId: Claroty - dataTypes: - - ClarotyEvent - - connectorId: ClarotyAma - dataTypes: - - ClarotyEvent - connectorId: CefAma dataTypes: - CommonSecurityLog diff --git a/Solutions/Claroty/Analytic Rules/ClarotyPolicyViolation.yaml b/Solutions/Claroty/Analytic Rules/ClarotyPolicyViolation.yaml index 0d572c165bd..a557347a63d 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotyPolicyViolation.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotyPolicyViolation.yaml @@ -5,12 +5,6 @@ description: | severity: High status: Available requiredDataConnectors: - - connectorId: Claroty - dataTypes: - - ClarotyEvent - - connectorId: ClarotyAma - dataTypes: - - ClarotyEvent - connectorId: CefAma dataTypes: - CommonSecurityLog diff --git a/Solutions/Claroty/Analytic Rules/ClarotySuspiciousActivity.yaml b/Solutions/Claroty/Analytic Rules/ClarotySuspiciousActivity.yaml index f4c64bb1412..98f834ea080 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotySuspiciousActivity.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotySuspiciousActivity.yaml @@ -5,12 +5,6 @@ description: | severity: High status: Available requiredDataConnectors: - - connectorId: Claroty - dataTypes: - - ClarotyEvent - - connectorId: ClarotyAma - dataTypes: - - ClarotyEvent - connectorId: CefAma dataTypes: - CommonSecurityLog @@ -32,5 +26,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.2 +version: 1.0.3 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Analytic Rules/ClarotySuspiciousFileTransfer.yaml b/Solutions/Claroty/Analytic Rules/ClarotySuspiciousFileTransfer.yaml index 6da2925c08b..76b660ccc4e 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotySuspiciousFileTransfer.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotySuspiciousFileTransfer.yaml @@ -5,12 +5,6 @@ description: | severity: High status: Available requiredDataConnectors: - - connectorId: Claroty - dataTypes: - - ClarotyEvent - - connectorId: ClarotyAma - dataTypes: - - ClarotyEvent - connectorId: CefAma dataTypes: - CommonSecurityLog @@ -32,5 +26,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.2 +version: 1.0.3 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Analytic Rules/ClarotyTreat.yaml b/Solutions/Claroty/Analytic Rules/ClarotyTreat.yaml index c4eecaf4002..c8b45d02f4e 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotyTreat.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotyTreat.yaml @@ -32,5 +32,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.2 +version: 1.0.3 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Data/Solution_Claroty.json b/Solutions/Claroty/Data/Solution_Claroty.json index 48057d71190..17292bc28df 100644 --- a/Solutions/Claroty/Data/Solution_Claroty.json +++ b/Solutions/Claroty/Data/Solution_Claroty.json @@ -21,10 +21,6 @@ "Hunting Queries/ClarotyUnresolvedAlerts.yaml", "Hunting Queries/ClarotyWriteExecuteOperations.yaml" ], - "Data Connectors": [ - "Data Connectors/Connector_Claroty_CEF.json", - "Data Connectors/template_ClarotyAMA.json" - ], "Analytic Rules": [ "Analytic Rules/ClarotyAssetDown.yaml", "Analytic Rules/ClarotyCriticalBaselineDeviation.yaml", @@ -42,7 +38,7 @@ ], "Metadata": "SolutionMetadata.json", "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Claroty", - "Version": "3.0.2", + "Version": "3.0.3", "TemplateSpec": true, "Is1PConnector": false } diff --git a/Solutions/Claroty/Hunting Queries/ClarotyBaselineDeviation.yaml b/Solutions/Claroty/Hunting Queries/ClarotyBaselineDeviation.yaml index 4e77850826a..3ac409e8bd6 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotyBaselineDeviation.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotyBaselineDeviation.yaml @@ -4,12 +4,6 @@ description: | 'Query searches for baseline deviation events.' severity: Medium requiredDataConnectors: - - connectorId: Claroty - dataTypes: - - ClarotyEvent - - connectorId: ClarotyAma - dataTypes: - - ClarotyEvent - connectorId: CefAma dataTypes: - CommonSecurityLog diff --git a/Solutions/Claroty/Hunting Queries/ClarotyConflictAssets.yaml b/Solutions/Claroty/Hunting Queries/ClarotyConflictAssets.yaml index e4aa657600c..4259414cb96 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotyConflictAssets.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotyConflictAssets.yaml @@ -4,12 +4,6 @@ description: | 'Query searches for conflicting assets.' severity: Medium requiredDataConnectors: - - connectorId: Claroty - dataTypes: - - ClarotyEvent - - connectorId: ClarotyAma - dataTypes: - - ClarotyEvent - connectorId: CefAma dataTypes: - CommonSecurityLog diff --git a/Solutions/Claroty/Hunting Queries/ClarotyCriticalEvents.yaml b/Solutions/Claroty/Hunting Queries/ClarotyCriticalEvents.yaml index cc40bd5c9e8..86ac250a3f5 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotyCriticalEvents.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotyCriticalEvents.yaml @@ -4,12 +4,6 @@ description: | 'Query searches for critical severity events.' severity: High requiredDataConnectors: - - connectorId: Claroty - dataTypes: - - ClarotyEvent - - connectorId: ClarotyAma - dataTypes: - - ClarotyEvent - connectorId: CefAma dataTypes: - CommonSecurityLog diff --git a/Solutions/Claroty/Hunting Queries/ClarotyPLCLogins.yaml b/Solutions/Claroty/Hunting Queries/ClarotyPLCLogins.yaml index a5d205d83ec..7585c5fcbfb 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotyPLCLogins.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotyPLCLogins.yaml @@ -4,12 +4,6 @@ description: | 'Query searches for PLC login security alerts.' severity: High requiredDataConnectors: - - connectorId: Claroty - dataTypes: - - ClarotyEvent - - connectorId: ClarotyAma - dataTypes: - - ClarotyEvent - connectorId: CefAma dataTypes: - CommonSecurityLog diff --git a/Solutions/Claroty/Hunting Queries/ClarotySRAFailedLogins.yaml b/Solutions/Claroty/Hunting Queries/ClarotySRAFailedLogins.yaml index 6d0f6815d75..2aa4490137b 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotySRAFailedLogins.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotySRAFailedLogins.yaml @@ -4,12 +4,6 @@ description: | 'Query searches for login failure events.' severity: High requiredDataConnectors: - - connectorId: Claroty - dataTypes: - - ClarotyEvent - - connectorId: ClarotyAma - dataTypes: - - ClarotyEvent - connectorId: CefAma dataTypes: - CommonSecurityLog diff --git a/Solutions/Claroty/Hunting Queries/ClarotyScanSources.yaml b/Solutions/Claroty/Hunting Queries/ClarotyScanSources.yaml index 6b38fca0703..10102c41777 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotyScanSources.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotyScanSources.yaml @@ -4,12 +4,6 @@ description: | 'Query searches for sources of network scans.' severity: Medium requiredDataConnectors: - - connectorId: Claroty - dataTypes: - - ClarotyEvent - - connectorId: ClarotyAma - dataTypes: - - ClarotyEvent - connectorId: CefAma dataTypes: - CommonSecurityLog diff --git a/Solutions/Claroty/Hunting Queries/ClarotyScantargets.yaml b/Solutions/Claroty/Hunting Queries/ClarotyScantargets.yaml index 2fd4377e5e9..d7a884f5639 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotyScantargets.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotyScantargets.yaml @@ -4,12 +4,6 @@ description: | 'Query searches for targets of network scans.' severity: Medium requiredDataConnectors: - - connectorId: Claroty - dataTypes: - - ClarotyEvent - - connectorId: ClarotyAma - dataTypes: - - ClarotyEvent - connectorId: CefAma dataTypes: - CommonSecurityLog diff --git a/Solutions/Claroty/Hunting Queries/ClarotyUnapprovedAccess.yaml b/Solutions/Claroty/Hunting Queries/ClarotyUnapprovedAccess.yaml index 86ec7e0652a..def9786ac7c 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotyUnapprovedAccess.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotyUnapprovedAccess.yaml @@ -4,12 +4,6 @@ description: | 'Query searches for unapproved access events.' severity: Medium requiredDataConnectors: - - connectorId: Claroty - dataTypes: - - ClarotyEvent - - connectorId: ClarotyAma - dataTypes: - - ClarotyEvent - connectorId: CefAma dataTypes: - CommonSecurityLog diff --git a/Solutions/Claroty/Hunting Queries/ClarotyUnresolvedAlerts.yaml b/Solutions/Claroty/Hunting Queries/ClarotyUnresolvedAlerts.yaml index 456ff9b7138..6b3dd4a04b1 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotyUnresolvedAlerts.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotyUnresolvedAlerts.yaml @@ -4,12 +4,6 @@ description: | 'Query searches for alerts with unresolved status.' severity: Medium requiredDataConnectors: - - connectorId: Claroty - dataTypes: - - ClarotyEvent - - connectorId: ClarotyAma - dataTypes: - - ClarotyEvent - connectorId: CefAma dataTypes: - CommonSecurityLog diff --git a/Solutions/Claroty/Hunting Queries/ClarotyWriteExecuteOperations.yaml b/Solutions/Claroty/Hunting Queries/ClarotyWriteExecuteOperations.yaml index a0636b80323..b6f37a50886 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotyWriteExecuteOperations.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotyWriteExecuteOperations.yaml @@ -4,12 +4,6 @@ description: | 'Query searches for operations with Write and Execute accesses.' severity: Medium requiredDataConnectors: - - connectorId: Claroty - dataTypes: - - ClarotyEvent - - connectorId: ClarotyAma - dataTypes: - - ClarotyEvent - connectorId: CefAma dataTypes: - CommonSecurityLog diff --git a/Solutions/Claroty/Package/3.0.3.zip b/Solutions/Claroty/Package/3.0.3.zip new file mode 100644 index 0000000000000000000000000000000000000000..8f4fa4b0ccfe6c3b077f4e20d1b12c88e2f6aa9f GIT binary patch literal 14404 zcmZ|018^@r+y&f!Z5y|?ZQH%IZQHult!>-3ZQFKlZMR>aci#Cp-|kK_* z69s7yP*flwAV{Eu06UEleA$y4XdoaOVIUxkpSMPiCI-$XDi$IprWUpq&K7pIbe2wb zwp&`~wi_JiUp>9uAbUCluDjCnUJ;kDJQl~mh0JSYSzi+20m*w?WlydJ%=@wtc>oh86>pc z2xDGEf{5yUzQprIca#j4&A`1rKfk(kD~F0u8~XmBZ-%e%cOe>KNm8pU`lW%YeqlfP zF;l&XSDYWG-;E*!6}Rb1$x{~$H}g9;N~6~Ir3m35=JzFy)nBDr{eq4V#Jv5JK6_eb zPD366&LVj)_SM%EGt7t(d5X?UY+I=Iw$A$2@2)w_mhq~`l*v%gb#fBy%98U)J};N> z+c0Q2GMPoB-66j4`&n+5f*1)lmxh6pLlMPfzT3@1Z%12hTFaWuhkFP#27mba)`{xS z*fL^gCsX`n?&@l0Jlw3Kyn z_8Ji)Qk^3U+8+CkGu6}#BQ9N320J0Kc)&=VL1y`0M4O4)83B`QVc4SHw#0pZAJKqp3H8WG@jOiVbl?90~{KrR_ zA`^}mk>L?#bW}caDIS8?jxPXbE(IB#Io&O_HAsR4!nv8sYzJ_bsH|fS>i15B9v8z1 z+XJNqK?QqzLWpFvLyaeNwGVd?S2huCp@7}f1 zP8!uJK}IK!Wf%Or-I7s-L)JhnXIn$LX^fKw1P*k%b7fz!CTJ+LW@>OF$=GZhPO%rZ zs=MBn2z>krDj3vWr4l-t;7p<+M~JHS`M*l@mQMu_P=uUubQw@=NXe2D!)f@be*c0QF14EL6GL-|K9*cr48ofP7+W_cghOCL87wvqJd5L< zLDw;`LSffPEawihp4w@b{E z+!DZ*>r)zg+hna3-s?-Y`&UM@ig<2m1D|^Lf{BL~?H3p3Y_e)lH2ks-@j6zxD_>>_ z7rz}Zx80>PlBLLL_rLnAd)4R8BaX7`&sLCmG-I>XWNc{7FeH;GS|LRb1@Oiej|YKi zY(FOV#gIFySk;a_Uh%ci^0wNK0cGSouKOF17L&ZfsM%W6E%TxA)qigE%F6KLXlLSp z=b^GjIe--h=(Ks9wuWkoS_~TNL#4Z&T5?m9t$X;~j=@ly`m0FWYJI?IBJNb&`;y~b zGM)6G49+V*azz=WA)6Xh22d}{cyJzz7ipCydF9eQPnyVE@E@13OMBSKnhgOLtn@e) zGP3J2EQdqwWb^#<(>?k(5ouLS z|7)>1^Y2#I`kKi8M_gTYXpBr7Vbtp7Y{%u)VKOK}b`d5~(H!|;(P-W!ThYpSV6bFsau$;t+e=CzR8EG z8q-9hsbn%rxUkWntot&9ddi_9&Xi5znBjfFc`(c3rMaOZdUT$qLrt~DlMyf=qC_9p~TB}wl!s?rS8mg zWRN?I-Q93LXl|1d4!*Yu2v32!n4Zs^bb};*&fsOTXOGP28~v>6m!PW^L?t}m?lPa3 zse5}lC8#)L1&)W<0F4(?WhqHExw^a45t3w1x?UksDZ1K#)cj?OqN!LIJL~*@G##8! z9Dba9WzKlu;I8qeP=Zv-vrblO95DaHPer*)*LUP_Z{G)}s6Ao}P8ZVxMVFTAhDA4( z3FwS=myxGE#mn&OTY*%~wnkBnH;KF6mRg*Y>^~39HU^b*pc}ISrIv4jqAts{Cc8v! zr5qFwo+opIVt~t1?)(#U=CU#H9E;&sv43mK4A$0VBQztliYi#~PXZ)%)sSKdFO-JY zMlmcZ;h$685JC)QMty?oEz8I0>0mikdx znipB}gn|c=sxQF?*MwgqwJ>_jtGUdS_3MU6iPFbkzi$YI|Hl~Do|S$hg$4*{lL;6I z>1T{!bNtn3CF`}nyD9C4kBnB~R{{sh$d#OD(YI?y zgVWsAk!)P-)E07CY$6`{Lc{U#W|nwrTN*~H+q%3XG=HH0GKrw%a!#3X6DcxZQu27A~>}?>_J|BL%zH2bQa?Lwz1zYpN#Ob z8?aCie(^B&W0@f>+4AAtt~5I^od%&Ss50azGYCES;wzBCk&rf~GU|{LRnm4WaCwZV zjv=$N_j9kK4_!9~G0HFf>)EN@P?sQ9Lg&OYOp=#tq^+2IG7N-xLEQ)2B2~ywc+Y6A zcKuqd6*F`j?&fmhdwNrIiOcV&2fZ0@=wEZs#R-7}2c=2!L{*Vg996w{Sx_ey*HIYx z7XFvSEU6)*L#xAV(7Y^+fk0_r>M#Q{1RjX_Jze`z<|!@P&c;>>D(?U*{&B5cH+0QDYEh2IOwx=v^bH`IJBh8N`tZ-_D z%lH|Lr(jC#pwW2c1v|~Sq@_nBSVU}|RlgX!Qd##<4H{@7=CC(10qj&PGF3tAkWmaq zm=y6itz706T;8B)Gyy$B z{DQUJ_Mo_fR(Fwh_TD{bMT+s>d%kmQLS8)#F_1cEM9S#D5@LoCNPbv=px=IGZ_%8X z1`e}bx?A3SSg{|NKF= zr6=*M=HzLq$~8Qy7>I}_8n}se;+{CvJTI!4NvG4){4CA`+S`Br19 zu3w69IM`bZ?2*wBo?>Eqt(s-I*5{){8fK0_wM4GlIo^gCaS%p62MRtDu<%n>)8FJ? z5bqoOlvTAl@Xg=Fl~!JD!qc|!AtUvqIWas^5+$A!BgGWm$EV)ao3LbOWL_^p1FZtH zS;gyO>lz3&XONVK8FN;4UbA_d42RqLh3=W<%!L|T3S0wAZNJUGeQV`=2#Wipiv{I~ zTezyQ*RY8dik+9kMJnQoO5VU85cR(=cdvKvAA?dlOk1chG3`f3M((+H#ZSAi+V%lN z=gqBAyCe(-T-}4k2z45QEw3r83Ipq5Pq@lkgBE{>1wAV= zZ(b(0E@kw{)O`~$1Ks-mzF#pEr0x?n({BusT?jf|`(;kMacb_bcfycTQKk zbd6?vlk+{JSj*HzK}8?gCKfl8)#zz0pPWx$(RtpR-g>nP?5w&3drIKic^6pL@irPm z!vEP+OLkEaQIxl+6mKWDduq(Nb}ZmGu4_(MHaDu4>@0#0`0AZEId5LVt~ak)P?xtf zkv*1&=9X@|rg?7shv(h1Wz7PvJ$;THGSEhgIjXwIMbopviVb4xNkFCR@_*5|jxTQf z{z0=|rzzX8)tmlj!^d8m?d)+|;2i7Hpkt1`J@8Mt(`luZr4pjx@2)MTN7tn#>4+!$ z7K4p}?q!zB;$x#x4?^+BE^@)Lk zG@nkj1fthY`t!u#TJnV)9Ix;{&iyb2`D7?o_Bq&@`A|3}WY(n_47BU)UV*A8?t{ZX z#lfmMB5Yz9JeaQwmS-RXldJ|t4k)S?dRswJtZB9BsAw{)>OD}@V=RB6*e7IK%WV4_ zDX!K*tbpbY1pa#DEm<@-0X%^I{p0Q0X-?1jQkY@gJKiU&obPUjVqY=tw^USS*gJlc zRhKO0lxbBl?Wc7?DHhcVeA1uA)l6SHV{crp-3kb;m%gLq3fXSt_UV;(lx=Nlg{o+* zvF)$=UkI&DzCS{40gqyvl4h^96{PWd!u%f`&*B3g=sE2KZofJX3rmB^qt}%00%rQ9 zHi|91Z9mmzMTWhXELkO)C>V-u%}!8~ar!_Iw+R_;L6TS*lvCsUDFRn}wMHw50zNDw zxU$hi5LhK)h}n!c$`#H3W;gra>{pflWk;4-Rbbh(O@neRl%nh2`Uta!zUn|SctwM?;A{hvd!>P0>- zC|5OOK}&_D`u(4e8MW~;PO0{mj}pzzbEUPdf)lP8T($#=c`ko387>4t;@jV7@#5Pf z^Zo#OLm(DDmZFCDO)L8af{&tx(=XIzBdN}Dq8@ST;}wcRaM_d59pC|hbDO|o+(Gqg z18Mb!%l2G0Ic9J$UNHMrBm^_!WKOPsgB(q-2cNHSan`x^{)LN2aDb9U*GBZ3`~S_u zX&|UW-{E}Gr5JyQz4t#gR0|QFfod-Qd1R_!9X2 zkE`9Se`D%sf3@)T>8$OcTG8bc# zTM3b6rwIz8)0h*s^pZ@fTug=B^g-?S@KLF~W+O#k^sTHu*3!_%A+6P{p0h6T`FFfZ z9>pGE1O8VT&{=i0T9MPDe^3Th@qOZXl{lbHWw`*DOTvw4R0Vl!u1saF{zCqF@?z8Y ztKItXm!BR@BY!8BwpY}QrAf$)<@ER4*16l)o%EH#?9Yi&Nzeg$F0GTYn7(~3h6jyL z4Q6)RzV2TaYb&P%v}-$%HUt!BLWyAQyI(MUqby+s0MprC*jm}@4<0xngs#+fXDb5F zCz(zCn+vQpYY7n%Q~#UmU3Fn={DK(z&biSJalugXTpxt3T|_QGx?KFbGa{V%J#*yo zF3I-o5WA;EWY$1M7d-*)96=H}=u9}vB5{h@-Sfg-1oX#i%UnmPmTth6q3ASMgw;Zw z1=z$@lctVD6fVmfp1S!tTT{2eGt0oD!_4Vqezk zOS5*+USq*{fG}YxyB_M06{%q3(iQvRKA0VNQR0_!FLXmy_8`sDk_>_qCqKy&j+78i6+^W3YVYT&Tr4dphVa z%eMbc+{#f(^^@twXy=;uh4INjBI`5_q_yHog4h}j<9JY#0{j`CL!yq(tD4$XPXQxn z6!tADhX8)(Ebd$ffGfBT*1{IzZ|JpfFf|;LYgpB1s1A`-W5(;u>Q^_s&;mkF>>Q;w zsQ67Vyw>f06vD!NiXBA+fP=ESXBMh0nv>Z0t0ZbZKAHW_+w*;R1QV3*vOjTcdb}HG z`M`k`OHBGggQ+}IUn-N4cK8FX(X?+7ZT>wsdd$XA;C34PfH(jJpZ#m8Za_=3Bf$}n zsAWh6zCgjaMABCG`d;aYvpJa}&P3TPyAGwDsym!;v**7}YRMfL4!UrQNfg3wZ*39? zfr=3!^||GwEn@0X%L_qKtzaLM-in?_)rr>vI8)L2cwQhwyhin%d$YPwO1qPLTkO_=Pj+#&9sfx3E5 z`k+g5J(8Zgw3*cO>>w^6P{!5?+jCP;egx#ACwEAL(>;=G=YekXQ3RM_H}lrn`)spy zdbUo6z0=+{Gj`fd{Pq%~TXG=zCHpoQ{>8r+tNDx{bzEeMmsqh!JAZ632l2qrX3O)L z-<^+#X`m~Q6S{WsgvH5QPI&Anb{#537%k`ADStOH`vb`<8|RLiP28HBWp@-#7r!fb z#5n^)@Ws*5bfbIFW__{;O4QK@B5P?5%pZHM*O~WD;07B4z;im!6lL>7m3-DfD3B^S zROm3s=KovbFCDu_8d5_jL$@$3;Ho#WU9&-_{r8--ozD$Ju6jQ>*C#@weBa@x_C|h- z->rC2u_%n~W9P#vdLcg)j3Fr$4QKnnlZHUV$Nt+#zb_YNKv@Kjzamj#kGuu(j82Bw zyCEzE%=>P^bf!Ajkp2VnZ>AwbWwL=I!my|OKk~17vVV{Nkr1HC#f>=_zlW^uCmrkMd%sDtwc3Ikkh!r|oJ_ZXEB{Y>Tj z+(U0nX0K*aT>^m)81V%ATD%)^CTnOE)s`@o4DOBA7dd6j*t5UwP5-b34j8u`%08fl zkw5LY(@n-3Kd~F+F`=dP4k!YJ7xOw`3%io=p3!=b`UeS2kA&hw~|?A0tpbn_2l6VpFc^R+Oxg_{mx`G0O|sPNy22ZX_+h*6M=4D^?d!Z zK9IG-I$p4*Z>$y~6K+YrQgN06lML(jc<9HP&3?3w)G_0qovzD7wWTH4g;g*!! zf^2^Tnit9x$%ix)Gd%g7EGen6Elxi| zB2T-otQei~Ny*D}j3d&ePeS)`82G{);+Mt!F%4@cuQX=iZ0rLf&jg~H);Lv3P4#-D zu3T-c?w>X5T-NDb-YHV95v|c&{h+MI8AXvn<%8{z9ax$;G+e>Nu@U*?1?R?fgOX>yU!i8=OT3tcI=e6 zC>zh|WZV6sEe_-Fs{FQo|2Tc?K*DGixffb=IJkI7%xVE26|-5aT?f|3?jEv7oX!^s z<8eKr_y^@8hDoqwfT_;6_AX@s6DQWln(>Ex{kp?;StV6lno`Z;Ubu^UiS|4Lt4pyT z(TBEiNW{M{ZHB(79GedEtvEs>h6Zj@*)fe=+u$(H6FfAW?j0hB#*eQ(hv~8N$L$D{ zt1f*Dvq2~#*MIMFmtCdFcpu+aP% z>>wY_=E)-y@lRB#J4eFPohfMuJw_1xF8@>>$6oVr;Bb=pB&b?wp{m4#M>7k=nOJ|K z8S3n2`;TP)>jt8jN6#mEC4K4qtxUoQkzl=MM67d|S=rG?tJB(-%2PtHj+2g8uyCj~ z$^uK{-8+v~lSTNo1tsLq@vO_?ZY*ty)arBym_CyeC+_Vc6@`yc_XPhmzQ%E4wN7NW zPGs54tk^U47?=_nm=QeS!%D^&x)f|n!3cU;+Fsh;n}ZdIJ_qsUITu830T_Er_25b@ zevRYq&c#)hfE^FUR941G50wfOrAZf+i3DG|BuNflE9Vj=gzl6Hh>{`oDE*P5PLZkr zPI9G7as{Kx(x$>Ar9!mP*Fcy%A4fIr60TuhAot3Y0Agmat1h8y@@9iSwc+Zq%(+Ia z{Ksic=l$!l9d5L^5rq159=zMs=p3>SY|o3{r-9u2y2S1&_}Y`$N6l{1Hr~wPeNS ztq5GTcPCp_V`0tAG)!qvA7PkZa1u8|?kq?kPgM74xnO?SEELT< ziTt;NA~Zd@8gF8Fs@YKZYw_~kJYQBYJg120BV&IIbDoSfwyE#sfp`b0Bw&3;)6tl0)(0_9UA%JU)iH0#Xce53uR?FY>*=eg`*>A zFw}z5JI7$)@H}OYHf4!KeEFml=^@cqL6x7NeImX_(S)c|>!Ifpa>gj>N<+%3HC^P z-v&FFx*)~hSQY=GPbYh}XoYh6eBQ0(IH4DzqW7a~*kycM_iU=DpRF%z3m5;>On$>w z?Q&JA(OI%mdt6uPauwzKAMgKsv#<1j#We|AsX<$*a$2d(vzDWlR@IXwHK3F3X6O83 zZsG5cZtlNYeeH{v)eRc=lNKHlB~L>AgwxR0L|4x2No@=gEzBG$h(F5RXD#{{Arh9Q zb%$4I!Y#h!7Dnq5DXH6FpG*X)!sf0;;7$?ivZ_Q@=aRh?jdDPdD!%RAdi+g@vTG^{`D9@x&472mFPd!pIyDRsAgervh zvY+SvdD(|={3DtqYcl0T{5VQ8C2qy-ePff-A)g~{uvJRaD@eJAHkR5$l_d3`nt)9V z%Ft-hY?2104&d$1;aGV?18I-RW70}y>ToViA6*i&;oX&`lL9#u&b9 zY!zD!ZebZ~dM|*jB3{oSp@djriy@?xTVEw+ew=J&hLmm!CA3h9lwL%{g4n>N`k>ib z5;}GF2sH-YUzSX_SDNe)_=Y>>2*F@!k=hEAoaw%OcFh@RKRiB=?e?&pvK+^XzRggfz)YaLLqMk^jrWc)2C<%%cWrFca;a^0fV(p3q(Ra#qsV*A1GuD8o(@F>w)-R*iEJn-C*rtl9*sX#yrGZek-TmbeOzO9kGq z5Hds+2A69VGqfZr7Bgf+2>b0q5<$#(*X!INkP2*L!wSjVqRkD{-zY7R>I&CSgA&x{ z?f2C0EVf#mm)dyb(18wjbtc4kX%k>LDvdZ7oBnt#$V6ES7W^wfkRsT)JAWvk%*4Rj zNK3}I?SYnv)CcT@vh6fO)&1s^ug%>B4HuXHy+!zCA`$35G~0WH)PyQEdPKk4Pv1CB zO#>e{zb{Zi-TZ1YUsRDpKL4VbkQerd5E^)~MXsf6!KRsMt2hfspji#*u5ktY4t1=H zVN^-LTZJITkfDEUnLr-yZjoT-_zzEcw6Q~M3CH0UU2Tbgl@{F7B<;#{0B;s@ZHZDK zuQZq!&4Niyf!{nQyG6wTny8UiyMVk|hJQ9Y2MJ9s5G;-;*UsjGNww@V0PjLvJ7G_v z^Xu=u+wHR+-OKa9WEpdkB}U;5kfl;~KQZb$oBrPoz+K2F+C{D@JR`;r74 z23J*}E9YhKtN(De{)cln+7Rdm=dK*w)#C2-@gMI0aN3v9Om5M+mk8Kt!Cn7{v!8nl z*}X(-fO{guO=zLVWB&xaq$*ksHR|&0C#ovgt<_}ZMh>d8;hej%6>srI?o+pv_ODxe z8^Fj7>_*Pb=0+}V6J~%LY)}pCngX04(;DvjCl%ba^{>u?e-g>C*Ao4kmjQ0j56w$A z)0>W$G@T37f80D-I~!!&PcT+8W21-Jyx=aChTZ3je{2u^*_knWo6UfSxk8N0tK*I= zoA(1hRttrh>SDgFqqX34f@MqRak|X&WKlJrzH8IHx&`>5sDBNdNG%k3M`4K&~}F&-$S_ zK%W88^TSJ%UV1RWQ`bIvFsTj8m;d3V?;H;4OT>05Ak_qzp+{&lJm(u8U>#}{;XcnG zGYsl66?DX_Lm*~nje;yZg_Gv5ZjU3bYkimj7)K>^} zO>4-X?P&z|5;^Hp1DQ*S?qd*I9Q#o&fPJ+42c_B|9lN;9 zAbl#(VliuMUm(gdvRx-tHV?c7yGcW!9h&1I%9wnnEW{Jpm#jy@}@D_R%#}8cpKxiq}M(P~@t7U$) zjDvIsM@h_r6{^6~!JLI;ASxA8x_DdXV-RxOcG5okCtD9oq9H$>W|(_qfZ4vsLm?f` z28nvyCM22bdDv(sif5ksnk+jcK1aShHy)R@adb0bWORFiu{FqEJ_)F9?{ zy2K~7Y*o-HL}J4z38i3&dL;p~<+&j^V#rFpY*y0m>l2e3UB zDNxF95bX)j)@i~@qTFQ!Q-AU32>RTWQdu6GUTT}*AIgeO;C$>N!M#%nW&+?Lsrn7(^fThZ#%j>OwLV zt+S>Na~Fv%Sh7_8=g4Bq4DgsDlW5SoVII%*mpLoVHaho$_Vq*0vKR@n$o4<>n`<`R zoH@+04BfD%SDTYiT|+Wz9;gT4iprZcoFs-L|B{Xkx85@Tm@G?MxJj<&|I`>&w0`51 zSu)p*Dz+g=Fa9T)>|adDmo^EgIf6n;U??B3Qn8@xv%7-sT&DT6lFr)MEaMKB{0;cJ z^L3z2MgxK>mB&$+-oUS+NZ*jiPyR5Kp+$`& z6fJB~l)ixl_R9(&av3PTbI}d=A1${J>>{jO1ZTImU&#MR7de6#(G_6bD2-xe8u9xI z)WF`pNt~mNOw6^(&AG{~iF{{SqCBF+Rqt(?KG#VRp|oEV-!TBbdxspOraB<-!0g)< z(l1Zi)<1^05T7wwPq-ZR1ybsNWNzU{=Ay+`at(7?LPQ+Yy}2Q~{7L;5LJ;P51+5kJ z51Ezcd)gdf7{+PU5-2EMKiv?F2?}l(|G+Zm6pa@Iu9m|iVP2eIdBr*Q5YYi}y##_~ zm|oSxLOjp&S>|q7o3qYZmGW zh7FCw#-#JNM+jtuSK<=YHU=y=Zn*=Tha*`}A4ve&k-I63 z1CYMF5qfSjn9&f`I{ZXs=(V_14&sIU_eKH{->z)izLPDJ9m|+c%CyU+#cdAqF~lt9&_}N7Y3s$s`jNgL z)3`JQ@Z+#lY;O|@E#tDba>{Bc?h6q$wWU#A2TIRT2fv+L!ld%7To zvLN;&@XgH)=7!`eWhFy9Q!VbZN^r7=`(9r{2m#q}3~lBho*}pxWLY=p#24F~-6x8~ zRUy><1V$xy)lW17tr}}cAq^R#cDL?>Q%#RrJpWqUW974aTk^E5&M|y0-sXbNY9We0 z(DaS7z!;gJR$z>bmjZG}`bJR$737+SM=c{Ohez2Eh?O2mqyZiYqL$aW58q*`UZQA&Gi{r&Iw=JRM_#HvMr~1D+T(v7T~KzL-E?O0n!r>nPu)Q?)2xn_q85|MgP7 zXuNilfPf>1UkRtG5Pju8jA+n*_t`j>Q*DjNAx6cs3RhPjRJSD8u;E4eonx~q2%JUBRQ~m`d2dGgn+}MMRpQm zXB2pa?otz(HVFQe;rpiwlMV$dGN2ohF&4fwi>2fZm$fvj@t?D{5HLNzhZF=(?LX}a zBV_jT0U^`nVA3%lS(M-vbCD`N3+Tu-%mPqgi&UNZDKa0~_~USznB}(uA}84htd1*U zqSG9=*CV$SAtO1NQiOW@6kbW!qYnJ!zZ%tXM#k7k=1b^{=tz8_Cp7g)fR<*!=w+hE z4|xiPB+z?uLK@sJDaMmkN!i)ax&CWQ|7odTJjVhvcd0Rw59I}B|MlZ~SJ0lz^nx>Q zte#ICr)w|}iI*9+41-?_VzcvPqtxNaEe(*G{3}U6cIX0X19<=l_7)gSnEK$*2-sfl zWnvot%`z#C*kHVd&1R&dFks4Rt@@wy)TrO!ECYJm3$5Sq6;PWNbRKNbV2Lz;&}$lw zWXWQ*RI34(u~fS@+-Lg3?zUQuE2mN1RgG*=#xP%(i^?B%b4=; zSq&htKXf5M*UErVPhDLS2-~D)uV5PQ?8m7>7b`g^hf2GDuP$z!b!* zfXt2bktX4TbL?TKRmP2Br)}~WD{f`b0DhKPnlnJ+CXaZE(x7 z;e?z(J?7XSd=G#5PabwqV}yPm@P9*em24$Z_;<6;(Z=$1g&Pdw_>-4_gkxtTeZ+oN zh~8xd@ePyvlM0Pwi-aS{wa&|J8;#S&5pw+6Q1jZkr4H47dm8+p>sx>bZ;YIRh!yFN ze8mEq+9lbI61RpxRd);k%67htFpu7eJ~IH;-32<)|1rNR`$9 z-JdoDTI>mo-ult_sNN=^SQ{b{7)q!FU;zh-5;pmMnfa!*AQ9u0m$-p%4mF@aA$HrO ztUNG39Evk7W$b|xfl|8FnPq+~$C%R@r|8=Y#|Z|ofeAZL#+mZM>LcEcev;hCn)`#_ zVZvI$W<^ZX>_)o)kgPfJ-v9u3f}{oA3_%SzQe4aKJv5wUOYDN<9-0k;| zBW%dU%BY0ITVejazxVz$;AHSJUHEJej|s934^%4gXBGpCKL*oGW_~3d8DR7Wh#xE~ z1H=v**dxeH0UMFr4vmx^mp5ZOx7atRSE;4`qKi2XAXPRA3(Mg%^;aHH!;VF$FGvc_WAksyJntLD4+%5RW4$AU&>fPx0aE$wsGtb*^ zM(30IdKhN4>)ag|!i`f@q^w-gab#)ond%Or~S|{*r9`+Gx_6`p+Lb zx`sL^CUz$iTRIXaB|0Z36l2??@l8#M<7DmQWwO!D>7=%<*h!nV$xGSTwghS?Gr}}( z$29H?0w;F0<0~O1w<9JucEMxa>dCHPyV^y84Wy93~LJ@Mfe+BYH`kqB=OX=xCEy*wPn^~|8vRqu$$wPZsX z4c9pq#(&W$$rclCVBXJsgMNSeDM$l=QGx#d&+7ebW&Xci|34@9{@;cCzc)kwUnLy= c90UCSY>ifs1_S>u3GmMy^y8Pa{}=i{02^*|r2qf` literal 0 HcmV?d00001 diff --git a/Solutions/Claroty/Package/createUiDefinition.json b/Solutions/Claroty/Package/createUiDefinition.json index e680d7d0720..357c5e30e0c 100644 --- a/Solutions/Claroty/Package/createUiDefinition.json +++ b/Solutions/Claroty/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Claroty/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Claroty](https://claroty.com/) solution for Microsoft Sentinel enables ingestion of  [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel. \n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.\n\n**Data Connectors:** 2, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Claroty/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Claroty](https://claroty.com/) solution for Microsoft Sentinel enables ingestion of  [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel. \n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.\n\n**Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -51,37 +51,6 @@ } ], "steps": [ - { - "name": "dataconnectors", - "label": "Data Connectors", - "bladeTitle": "Data Connectors", - "elements": [ - { - "name": "dataconnectors1-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "This Solution installs the data connector for Claroty. You can get Claroty CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." - } - }, - { - "name": "dataconnectors-parser-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "The Solution installs a parser that transforms the ingested data into Microsoft Sentinel normalized format. The normalized format enables better correlation of different types of data from different data sources to drive end-to-end outcomes seamlessly in security monitoring, hunting, incident investigation and response scenarios in Microsoft Sentinel." - } - }, - { - "name": "dataconnectors-link2", - "type": "Microsoft.Common.TextBlock", - "options": { - "link": { - "label": "Learn more about connecting data sources", - "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources" - } - } - } - ] - }, { "name": "workbooks", "label": "Workbooks", @@ -323,7 +292,7 @@ "name": "huntingquery1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for baseline deviation events. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" + "text": "Query searches for baseline deviation events. This hunting query depends on CefAma data connector (CommonSecurityLog Parser or Table)" } } ] @@ -337,7 +306,7 @@ "name": "huntingquery2-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for conflicting assets. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" + "text": "Query searches for conflicting assets. This hunting query depends on CefAma data connector (CommonSecurityLog Parser or Table)" } } ] @@ -351,7 +320,7 @@ "name": "huntingquery3-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for critical severity events. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" + "text": "Query searches for critical severity events. This hunting query depends on CefAma data connector (CommonSecurityLog Parser or Table)" } } ] @@ -365,7 +334,7 @@ "name": "huntingquery4-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for PLC login security alerts. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" + "text": "Query searches for PLC login security alerts. This hunting query depends on CefAma data connector (CommonSecurityLog Parser or Table)" } } ] @@ -379,7 +348,7 @@ "name": "huntingquery5-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for login failure events. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" + "text": "Query searches for login failure events. This hunting query depends on CefAma data connector (CommonSecurityLog Parser or Table)" } } ] @@ -393,7 +362,7 @@ "name": "huntingquery6-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for sources of network scans. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" + "text": "Query searches for sources of network scans. This hunting query depends on CefAma data connector (CommonSecurityLog Parser or Table)" } } ] @@ -407,7 +376,7 @@ "name": "huntingquery7-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for targets of network scans. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" + "text": "Query searches for targets of network scans. This hunting query depends on CefAma data connector (CommonSecurityLog Parser or Table)" } } ] @@ -421,7 +390,7 @@ "name": "huntingquery8-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for unapproved access events. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" + "text": "Query searches for unapproved access events. This hunting query depends on CefAma data connector (CommonSecurityLog Parser or Table)" } } ] @@ -435,7 +404,7 @@ "name": "huntingquery9-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for alerts with unresolved status. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" + "text": "Query searches for alerts with unresolved status. This hunting query depends on CefAma data connector (CommonSecurityLog Parser or Table)" } } ] @@ -449,7 +418,7 @@ "name": "huntingquery10-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for operations with Write and Execute accesses. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" + "text": "Query searches for operations with Write and Execute accesses. This hunting query depends on CefAma data connector (CommonSecurityLog Parser or Table)" } } ] diff --git a/Solutions/Claroty/Package/mainTemplate.json b/Solutions/Claroty/Package/mainTemplate.json index e5ff003865c..a61d4f7df98 100644 --- a/Solutions/Claroty/Package/mainTemplate.json +++ b/Solutions/Claroty/Package/mainTemplate.json @@ -41,7 +41,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Claroty", - "_solutionVersion": "3.0.2", + "_solutionVersion": "3.0.3", "solutionId": "azuresentinel.azure-sentinel-solution-claroty", "_solutionId": "[variables('solutionId')]", "workbookVersion1": "1.0.0", @@ -52,8 +52,8 @@ "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", "parserObject1": { - "_parserName1": "[concat(parameters('workspace'),'/','Claroty Data Parser')]", - "_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Claroty Data Parser')]", + "_parserName1": "[concat(parameters('workspace'),'/','ClarotyEvent')]", + "_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'ClarotyEvent')]", "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('ClarotyEvent-Parser')))]", "parserVersion1": "1.0.0", "parserContentId1": "ClarotyEvent-Parser" @@ -108,58 +108,40 @@ "_huntingQuerycontentId10": "3882ffbf-6228-4e1f-ab8f-8d79a26da0fb", "huntingQueryTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3882ffbf-6228-4e1f-ab8f-8d79a26da0fb')))]" }, - "uiConfigId1": "Claroty", - "_uiConfigId1": "[variables('uiConfigId1')]", - "dataConnectorContentId1": "Claroty", - "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", - "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", - "dataConnectorVersion1": "1.0.0", - "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", - "uiConfigId2": "ClarotyAma", - "_uiConfigId2": "[variables('uiConfigId2')]", - "dataConnectorContentId2": "ClarotyAma", - "_dataConnectorContentId2": "[variables('dataConnectorContentId2')]", - "dataConnectorId2": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", - "_dataConnectorId2": "[variables('dataConnectorId2')]", - "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", - "dataConnectorVersion2": "1.0.0", - "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", "analyticRuleObject1": { - "analyticRuleVersion1": "1.0.2", + "analyticRuleVersion1": "1.0.3", "_analyticRulecontentId1": "fd6e3416-0421-4166-adb9-186e555a7008", "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'fd6e3416-0421-4166-adb9-186e555a7008')]", "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('fd6e3416-0421-4166-adb9-186e555a7008')))]", - "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','fd6e3416-0421-4166-adb9-186e555a7008','-', '1.0.2')))]" + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','fd6e3416-0421-4166-adb9-186e555a7008','-', '1.0.3')))]" }, "analyticRuleObject2": { - "analyticRuleVersion2": "1.0.2", + "analyticRuleVersion2": "1.0.3", "_analyticRulecontentId2": "9a8b4321-e2be-449b-8227-a78227441b2a", "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '9a8b4321-e2be-449b-8227-a78227441b2a')]", "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('9a8b4321-e2be-449b-8227-a78227441b2a')))]", - "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','9a8b4321-e2be-449b-8227-a78227441b2a','-', '1.0.2')))]" + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','9a8b4321-e2be-449b-8227-a78227441b2a','-', '1.0.3')))]" }, "analyticRuleObject3": { - "analyticRuleVersion3": "1.0.2", + "analyticRuleVersion3": "1.0.3", "_analyticRulecontentId3": "e7dbcbc3-b18f-4635-b27c-718195c369f1", "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e7dbcbc3-b18f-4635-b27c-718195c369f1')]", "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e7dbcbc3-b18f-4635-b27c-718195c369f1')))]", - "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e7dbcbc3-b18f-4635-b27c-718195c369f1','-', '1.0.2')))]" + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e7dbcbc3-b18f-4635-b27c-718195c369f1','-', '1.0.3')))]" }, "analyticRuleObject4": { - "analyticRuleVersion4": "1.0.2", + "analyticRuleVersion4": "1.0.3", "_analyticRulecontentId4": "4b5bb3fc-c690-4f54-9a74-016213d699b4", "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4b5bb3fc-c690-4f54-9a74-016213d699b4')]", "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4b5bb3fc-c690-4f54-9a74-016213d699b4')))]", - "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4b5bb3fc-c690-4f54-9a74-016213d699b4','-', '1.0.2')))]" + "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4b5bb3fc-c690-4f54-9a74-016213d699b4','-', '1.0.3')))]" }, "analyticRuleObject5": { - "analyticRuleVersion5": "1.0.2", + "analyticRuleVersion5": "1.0.3", "_analyticRulecontentId5": "1c2310ef-19bf-4caf-b2b0-a4c983932fa5", "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1c2310ef-19bf-4caf-b2b0-a4c983932fa5')]", "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1c2310ef-19bf-4caf-b2b0-a4c983932fa5')))]", - "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1c2310ef-19bf-4caf-b2b0-a4c983932fa5','-', '1.0.2')))]" + "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1c2310ef-19bf-4caf-b2b0-a4c983932fa5','-', '1.0.3')))]" }, "analyticRuleObject6": { "analyticRuleVersion6": "1.0.2", @@ -176,25 +158,25 @@ "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','3b22ac47-e02c-4599-a37a-57f965de17be','-', '1.0.2')))]" }, "analyticRuleObject8": { - "analyticRuleVersion8": "1.0.2", + "analyticRuleVersion8": "1.0.3", "_analyticRulecontentId8": "99ad9f3c-304c-44c5-a61f-3a17f8b58218", "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '99ad9f3c-304c-44c5-a61f-3a17f8b58218')]", "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('99ad9f3c-304c-44c5-a61f-3a17f8b58218')))]", - "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','99ad9f3c-304c-44c5-a61f-3a17f8b58218','-', '1.0.2')))]" + "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','99ad9f3c-304c-44c5-a61f-3a17f8b58218','-', '1.0.3')))]" }, "analyticRuleObject9": { - "analyticRuleVersion9": "1.0.2", + "analyticRuleVersion9": "1.0.3", "_analyticRulecontentId9": "5cf35bad-677f-4c23-8927-1611e7ff6f28", "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5cf35bad-677f-4c23-8927-1611e7ff6f28')]", "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5cf35bad-677f-4c23-8927-1611e7ff6f28')))]", - "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5cf35bad-677f-4c23-8927-1611e7ff6f28','-', '1.0.2')))]" + "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5cf35bad-677f-4c23-8927-1611e7ff6f28','-', '1.0.3')))]" }, "analyticRuleObject10": { - "analyticRuleVersion10": "1.0.2", + "analyticRuleVersion10": "1.0.3", "_analyticRulecontentId10": "731e5ac4-7fe1-4b06-9941-532f2e008bb3", "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '731e5ac4-7fe1-4b06-9941-532f2e008bb3')]", "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('731e5ac4-7fe1-4b06-9941-532f2e008bb3')))]", - "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','731e5ac4-7fe1-4b06-9941-532f2e008bb3','-', '1.0.2')))]" + "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','731e5ac4-7fe1-4b06-9941-532f2e008bb3','-', '1.0.3')))]" }, "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, @@ -208,7 +190,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyOverview Workbook with template version 3.0.2", + "description": "ClarotyOverview Workbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -271,6 +253,10 @@ { "contentId": "ClarotyAma", "kind": "DataConnector" + }, + { + "contentId": "CefAma", + "kind": "DataConnector" } ] } @@ -300,7 +286,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyEvent Data Parser with template version 3.0.2", + "description": "ClarotyEvent Data Parser with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", @@ -314,7 +300,7 @@ "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Claroty Data Parser", + "displayName": "Parser for ClarotyEvent", "category": "Microsoft Sentinel Parser", "functionAlias": "ClarotyEvent", "query": "CommonSecurityLog\n| where DeviceVendor =~ 'Claroty'\n| extend EventVendor = 'Claroty'\n| extend EventProduct = 'Claroty'\n| extend EventSchemaVersion = 0.2\n| extend EventCount = 1\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3),\n ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID))\n| extend packed = pack(DeviceCustomNumber1Label, DeviceCustomNumber1\n , DeviceCustomNumber2Label, DeviceCustomNumber2\n , DeviceCustomNumber3Label, DeviceCustomNumber3\n , DeviceCustomString1Label, DeviceCustomString1\n , DeviceCustomString2Label, DeviceCustomString2\n , DeviceCustomString3Label, DeviceCustomString3\n , DeviceCustomString4Label, DeviceCustomString4\n , DeviceCustomString5Label, DeviceCustomString5\n , DeviceCustomString6Label, DeviceCustomString6\n , DeviceCustomDate1Label, DeviceCustomDate1\n , DeviceCustomDate2Label, DeviceCustomDate2)\n| evaluate bag_unpack(packed)\n| parse-kv AdditionalExtensions as (cs7Label:string, cs7:string, cs8Label:string, cs8:string, cs9Label:string, cs9:string, cs10Label:string, cs10:string, cat:string) with (pair_delimiter=';', kv_delimiter='=')\n| extend packed2 = pack(cs7Label, cs7\n , cs8Label, cs8\n , cs9Label, cs9\n , cs10Label, cs10)\n| evaluate bag_unpack(packed2)\n| extend EventEndTime = todatetime(ReceiptTime),\n cat = coalesce(column_ifexists(\"DeviceEventCategory\", \"\"),cat)\n| project-rename EventProductVersion=DeviceVersion\n , EventSubType=cat\n , EventOriginalType=DeviceEventClassID\n , EventSeverity=LogSeverity\n , EventMessage=Message\n , DstPortNumber=DestinationPort\n , DstIpAddr=DestinationIP\n , DstDvcHostname=DestinationHostName\n , DstUserName=DestinationUserName\n , DvcIpAddr=DeviceAddress\n , DvcHostname=DeviceName\n , DstMacAddr=DestinationMACAddress\n , NetworkApplicationProtocol=Protocol\n , SrcPortNumber=SourcePort\n , SrcIpAddr=SourceIP\n , SrcMacAddr=SourceMACAddress\n , EventId=ExternalID\n , SrcDvcHostname=SourceHostName\n| extend EventType=Activity\n| project-away AdditionalExtensions\n , Activity\n , ReceiptTime\n , DeviceVendor\n , DeviceProduct\n , DeviceCustomNumber1\n , DeviceCustomNumber1Label\n , DeviceCustomNumber2\n , DeviceCustomNumber2Label\n , DeviceCustomNumber3\n , DeviceCustomNumber3Label\n , DeviceCustomString1\n , DeviceCustomString1Label\n , DeviceCustomString2\n , DeviceCustomString2Label\n , DeviceCustomString3\n , DeviceCustomString3Label\n , DeviceCustomString4\n , DeviceCustomString4Label\n , DeviceCustomString5\n , DeviceCustomString5Label\n , DeviceCustomString6\n , DeviceCustomString6Label\n , cs7Label\n , cs7\n , cs8Label\n , cs8\n , cs9Label\n , cs9\n , cs10Label\n , cs10\n", @@ -336,7 +322,7 @@ "[variables('parserObject1')._parserId1]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Claroty Data Parser')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'ClarotyEvent')]", "contentId": "[variables('parserObject1').parserContentId1]", "kind": "Parser", "version": "[variables('parserObject1').parserVersion1]", @@ -366,7 +352,7 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('parserObject1').parserContentId1]", "contentKind": "Parser", - "displayName": "Claroty Data Parser", + "displayName": "Parser for ClarotyEvent", "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", "version": "[variables('parserObject1').parserVersion1]" @@ -379,7 +365,7 @@ "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Claroty Data Parser", + "displayName": "Parser for ClarotyEvent", "category": "Microsoft Sentinel Parser", "functionAlias": "ClarotyEvent", "query": "CommonSecurityLog\n| where DeviceVendor =~ 'Claroty'\n| extend EventVendor = 'Claroty'\n| extend EventProduct = 'Claroty'\n| extend EventSchemaVersion = 0.2\n| extend EventCount = 1\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3),\n ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID))\n| extend packed = pack(DeviceCustomNumber1Label, DeviceCustomNumber1\n , DeviceCustomNumber2Label, DeviceCustomNumber2\n , DeviceCustomNumber3Label, DeviceCustomNumber3\n , DeviceCustomString1Label, DeviceCustomString1\n , DeviceCustomString2Label, DeviceCustomString2\n , DeviceCustomString3Label, DeviceCustomString3\n , DeviceCustomString4Label, DeviceCustomString4\n , DeviceCustomString5Label, DeviceCustomString5\n , DeviceCustomString6Label, DeviceCustomString6\n , DeviceCustomDate1Label, DeviceCustomDate1\n , DeviceCustomDate2Label, DeviceCustomDate2)\n| evaluate bag_unpack(packed)\n| parse-kv AdditionalExtensions as (cs7Label:string, cs7:string, cs8Label:string, cs8:string, cs9Label:string, cs9:string, cs10Label:string, cs10:string, cat:string) with (pair_delimiter=';', kv_delimiter='=')\n| extend packed2 = pack(cs7Label, cs7\n , cs8Label, cs8\n , cs9Label, cs9\n , cs10Label, cs10)\n| evaluate bag_unpack(packed2)\n| extend EventEndTime = todatetime(ReceiptTime),\n cat = coalesce(column_ifexists(\"DeviceEventCategory\", \"\"),cat)\n| project-rename EventProductVersion=DeviceVersion\n , EventSubType=cat\n , EventOriginalType=DeviceEventClassID\n , EventSeverity=LogSeverity\n , EventMessage=Message\n , DstPortNumber=DestinationPort\n , DstIpAddr=DestinationIP\n , DstDvcHostname=DestinationHostName\n , DstUserName=DestinationUserName\n , DvcIpAddr=DeviceAddress\n , DvcHostname=DeviceName\n , DstMacAddr=DestinationMACAddress\n , NetworkApplicationProtocol=Protocol\n , SrcPortNumber=SourcePort\n , SrcIpAddr=SourceIP\n , SrcMacAddr=SourceMACAddress\n , EventId=ExternalID\n , SrcDvcHostname=SourceHostName\n| extend EventType=Activity\n| project-away AdditionalExtensions\n , Activity\n , ReceiptTime\n , DeviceVendor\n , DeviceProduct\n , DeviceCustomNumber1\n , DeviceCustomNumber1Label\n , DeviceCustomNumber2\n , DeviceCustomNumber2Label\n , DeviceCustomNumber3\n , DeviceCustomNumber3Label\n , DeviceCustomString1\n , DeviceCustomString1Label\n , DeviceCustomString2\n , DeviceCustomString2Label\n , DeviceCustomString3\n , DeviceCustomString3Label\n , DeviceCustomString4\n , DeviceCustomString4Label\n , DeviceCustomString5\n , DeviceCustomString5Label\n , DeviceCustomString6\n , DeviceCustomString6Label\n , cs7Label\n , cs7\n , cs8Label\n , cs8\n , cs9Label\n , cs9\n , cs10Label\n , cs10\n", @@ -402,7 +388,7 @@ "[variables('parserObject1')._parserId1]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Claroty Data Parser')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'ClarotyEvent')]", "contentId": "[variables('parserObject1').parserContentId1]", "kind": "Parser", "version": "[variables('parserObject1').parserVersion1]", @@ -432,7 +418,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyBaselineDeviation_HuntingQueries Hunting Query with template version 3.0.2", + "description": "ClarotyBaselineDeviation_HuntingQueries Hunting Query with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -517,7 +503,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyConflictAssets_HuntingQueries Hunting Query with template version 3.0.2", + "description": "ClarotyConflictAssets_HuntingQueries Hunting Query with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -602,7 +588,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyCriticalEvents_HuntingQueries Hunting Query with template version 3.0.2", + "description": "ClarotyCriticalEvents_HuntingQueries Hunting Query with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -687,7 +673,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyPLCLogins_HuntingQueries Hunting Query with template version 3.0.2", + "description": "ClarotyPLCLogins_HuntingQueries Hunting Query with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -772,7 +758,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotySRAFailedLogins_HuntingQueries Hunting Query with template version 3.0.2", + "description": "ClarotySRAFailedLogins_HuntingQueries Hunting Query with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -857,7 +843,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyScanSources_HuntingQueries Hunting Query with template version 3.0.2", + "description": "ClarotyScanSources_HuntingQueries Hunting Query with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]", @@ -942,7 +928,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyScantargets_HuntingQueries Hunting Query with template version 3.0.2", + "description": "ClarotyScantargets_HuntingQueries Hunting Query with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]", @@ -1027,7 +1013,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyUnapprovedAccess_HuntingQueries Hunting Query with template version 3.0.2", + "description": "ClarotyUnapprovedAccess_HuntingQueries Hunting Query with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]", @@ -1112,7 +1098,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyUnresolvedAlerts_HuntingQueries Hunting Query with template version 3.0.2", + "description": "ClarotyUnresolvedAlerts_HuntingQueries Hunting Query with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject9').huntingQueryVersion9]", @@ -1197,7 +1183,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyWriteExecuteOperations_HuntingQueries Hunting Query with template version 3.0.2", + "description": "ClarotyWriteExecuteOperations_HuntingQueries Hunting Query with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject10').huntingQueryVersion10]", @@ -1273,672 +1259,6 @@ "version": "1.0.0" } }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName1')]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Claroty data connector with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion1')]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "GenericUI", - "properties": { - "connectorUiConfig": { - "id": "[variables('_uiConfigId1')]", - "title": "[Deprecated] Claroty via Legacy Agent", - "publisher": "Claroty", - "descriptionMarkdown": "The [Claroty](https://claroty.com/) data connector provides the capability to ingest [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel.", - "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution.", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "Claroty", - "baseQuery": "ClarotyEvent" - } - ], - "sampleQueries": [ - { - "description": "Top 10 Destinations", - "query": "ClarotyEvent\n | where isnotempty(DstIpAddr)\n | summarize count() by DstIpAddr\n | top 10 by count_" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (Claroty)", - "lastDataReceivedQuery": "ClarotyEvent\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "ClarotyEvent\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ] - }, - "instructionSteps": [ - { - "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution." - }, - { - "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", - "innerSteps": [ - { - "title": "1.1 Select or create a Linux machine", - "description": "Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-prem environment, Azure or other clouds." - }, - { - "title": "1.2 Install the CEF collector on the Linux machine", - "description": "Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Microsoft Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.\n\n> 1. Make sure that you have Python on your machine using the following command: python -version.\n\n> 2. You must have elevated permissions (sudo) on your machine.", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId", - "PrimaryKey" - ], - "label": "Run the following command to install and apply the CEF collector:", - "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}" - }, - "type": "CopyableLabel" - } - ] - } - ], - "title": "1. Linux Syslog agent configuration" - }, - { - "description": "Configure log forwarding using CEF:\n\n1. Navigate to the **Syslog** section of the Configuration menu.\n\n2. Select **+Add**.\n\n3. In the **Add New Syslog Dialog** specify Remote Server **IP**, **Port**, **Protocol** and select **Message Format** - **CEF**.\n\n4. Choose **Save** to exit the **Add Syslog dialog**.", - "title": "2. Configure Claroty to send logs using CEF" - }, - { - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python -version\n\n>2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId" - ], - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}" - }, - "type": "CopyableLabel" - } - ], - "title": "3. Validate connection" - }, - { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", - "title": "4. Secure your machine " - } - ] - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", - "source": { - "kind": "Solution", - "name": "Claroty", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId1')]", - "contentKind": "DataConnector", - "displayName": "[Deprecated] Claroty via Legacy Agent", - "contentProductId": "[variables('_dataConnectorcontentProductId1')]", - "id": "[variables('_dataConnectorcontentProductId1')]", - "version": "[variables('dataConnectorVersion1')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", - "dependsOn": [ - "[variables('_dataConnectorId1')]" - ], - "location": "[parameters('workspace-location')]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", - "source": { - "kind": "Solution", - "name": "Claroty", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } - } - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "GenericUI", - "properties": { - "connectorUiConfig": { - "title": "[Deprecated] Claroty via Legacy Agent", - "publisher": "Claroty", - "descriptionMarkdown": "The [Claroty](https://claroty.com/) data connector provides the capability to ingest [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel.", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "Claroty", - "baseQuery": "ClarotyEvent" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (Claroty)", - "lastDataReceivedQuery": "ClarotyEvent\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "ClarotyEvent\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "sampleQueries": [ - { - "description": "Top 10 Destinations", - "query": "ClarotyEvent\n | where isnotempty(DstIpAddr)\n | summarize count() by DstIpAddr\n | top 10 by count_" - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ] - }, - "instructionSteps": [ - { - "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution." - }, - { - "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", - "innerSteps": [ - { - "title": "1.1 Select or create a Linux machine", - "description": "Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-prem environment, Azure or other clouds." - }, - { - "title": "1.2 Install the CEF collector on the Linux machine", - "description": "Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Microsoft Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.\n\n> 1. Make sure that you have Python on your machine using the following command: python -version.\n\n> 2. You must have elevated permissions (sudo) on your machine.", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId", - "PrimaryKey" - ], - "label": "Run the following command to install and apply the CEF collector:", - "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}" - }, - "type": "CopyableLabel" - } - ] - } - ], - "title": "1. Linux Syslog agent configuration" - }, - { - "description": "Configure log forwarding using CEF:\n\n1. Navigate to the **Syslog** section of the Configuration menu.\n\n2. Select **+Add**.\n\n3. In the **Add New Syslog Dialog** specify Remote Server **IP**, **Port**, **Protocol** and select **Message Format** - **CEF**.\n\n4. Choose **Save** to exit the **Add Syslog dialog**.", - "title": "2. Configure Claroty to send logs using CEF" - }, - { - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python -version\n\n>2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId" - ], - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}" - }, - "type": "CopyableLabel" - } - ], - "title": "3. Validate connection" - }, - { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", - "title": "4. Secure your machine " - } - ], - "id": "[variables('_uiConfigId1')]", - "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution." - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName2')]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Claroty data connector with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion2')]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "GenericUI", - "properties": { - "connectorUiConfig": { - "id": "[variables('_uiConfigId2')]", - "title": "[Deprecated] Claroty via AMA", - "publisher": "Claroty", - "descriptionMarkdown": "The [Claroty](https://claroty.com/) data connector provides the capability to ingest [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel.", - "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution.", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "Claroty", - "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Claroty'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" - } - ], - "sampleQueries": [ - { - "description": "Top 10 Destinations", - "query": "ClarotyEvent\n | where isnotempty(DstIpAddr)\n | summarize count() by DstIpAddr\n | top 10 by count_" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (Claroty)", - "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Claroty'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "CommonSecurityLog\n |where DeviceVendor =~ 'Claroty'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ], - "customs": [ - { - "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" - }, - { - "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" - } - ] - }, - "instructionSteps": [ - { - "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution.", - "instructions": [ - { - "parameters": { - "title": "1. Kindly follow the steps to configure the data connector", - "instructionSteps": [ - { - "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", - "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" - }, - { - "title": "Step B. Configure Claroty to send logs using CEF", - "description": "Configure log forwarding using CEF:\n\n1. Navigate to the **Syslog** section of the Configuration menu.\n\n2. Select **+Add**.\n\n3. In the **Add New Syslog Dialog** specify Remote Server **IP**, **Port**, **Protocol** and select **Message Format** - **CEF**.\n\n4. Choose **Save** to exit the **Add Syslog dialog**." - }, - { - "title": "Step C. Validate connection", - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" - }, - "type": "CopyableLabel" - } - ] - } - ] - }, - "type": "InstructionStepsGroup" - } - ] - }, - { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", - "title": "2. Secure your machine " - } - ] - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", - "contentId": "[variables('_dataConnectorContentId2')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion2')]", - "source": { - "kind": "Solution", - "name": "Claroty", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId2')]", - "contentKind": "DataConnector", - "displayName": "[Deprecated] Claroty via AMA", - "contentProductId": "[variables('_dataConnectorcontentProductId2')]", - "id": "[variables('_dataConnectorcontentProductId2')]", - "version": "[variables('dataConnectorVersion2')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", - "dependsOn": [ - "[variables('_dataConnectorId2')]" - ], - "location": "[parameters('workspace-location')]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", - "contentId": "[variables('_dataConnectorContentId2')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion2')]", - "source": { - "kind": "Solution", - "name": "Claroty", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } - } - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "GenericUI", - "properties": { - "connectorUiConfig": { - "title": "[Deprecated] Claroty via AMA", - "publisher": "Claroty", - "descriptionMarkdown": "The [Claroty](https://claroty.com/) data connector provides the capability to ingest [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel.", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "Claroty", - "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Claroty'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (Claroty)", - "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Claroty'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "CommonSecurityLog\n |where DeviceVendor =~ 'Claroty'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "sampleQueries": [ - { - "description": "Top 10 Destinations", - "query": "ClarotyEvent\n | where isnotempty(DstIpAddr)\n | summarize count() by DstIpAddr\n | top 10 by count_" - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ], - "customs": [ - { - "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" - }, - { - "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" - } - ] - }, - "instructionSteps": [ - { - "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution.", - "instructions": [ - { - "parameters": { - "title": "1. Kindly follow the steps to configure the data connector", - "instructionSteps": [ - { - "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", - "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" - }, - { - "title": "Step B. Configure Claroty to send logs using CEF", - "description": "Configure log forwarding using CEF:\n\n1. Navigate to the **Syslog** section of the Configuration menu.\n\n2. Select **+Add**.\n\n3. In the **Add New Syslog Dialog** specify Remote Server **IP**, **Port**, **Protocol** and select **Message Format** - **CEF**.\n\n4. Choose **Save** to exit the **Add Syslog dialog**." - }, - { - "title": "Step C. Validate connection", - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" - }, - "type": "CopyableLabel" - } - ] - } - ] - }, - "type": "InstructionStepsGroup" - } - ] - }, - { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", - "title": "2. Secure your machine " - } - ], - "id": "[variables('_uiConfigId2')]", - "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution." - } - } - }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", @@ -1948,7 +1268,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyAssetDown_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "ClarotyAssetDown_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -1975,18 +1295,6 @@ "triggerThreshold": 0, "status": "Available", "requiredDataConnectors": [ - { - "connectorId": "Claroty", - "dataTypes": [ - "ClarotyEvent" - ] - }, - { - "connectorId": "ClarotyAma", - "dataTypes": [ - "ClarotyEvent" - ] - }, { "connectorId": "CefAma", "dataTypes": [ @@ -2002,13 +1310,13 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "IPCustomEntity", - "identifier": "Address" + "identifier": "Address", + "columnName": "IPCustomEntity" } - ] + ], + "entityType": "IP" } ] } @@ -2064,7 +1372,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyCriticalBaselineDeviation_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "ClarotyCriticalBaselineDeviation_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -2091,18 +1399,6 @@ "triggerThreshold": 0, "status": "Available", "requiredDataConnectors": [ - { - "connectorId": "Claroty", - "dataTypes": [ - "ClarotyEvent" - ] - }, - { - "connectorId": "ClarotyAma", - "dataTypes": [ - "ClarotyEvent" - ] - }, { "connectorId": "CefAma", "dataTypes": [ @@ -2118,13 +1414,13 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "IPCustomEntity", - "identifier": "Address" + "identifier": "Address", + "columnName": "IPCustomEntity" } - ] + ], + "entityType": "IP" } ] } @@ -2180,7 +1476,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyLoginToUncommonSite_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "ClarotyLoginToUncommonSite_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -2207,18 +1503,6 @@ "triggerThreshold": 0, "status": "Available", "requiredDataConnectors": [ - { - "connectorId": "Claroty", - "dataTypes": [ - "ClarotyEvent" - ] - }, - { - "connectorId": "ClarotyAma", - "dataTypes": [ - "ClarotyEvent" - ] - }, { "connectorId": "CefAma", "dataTypes": [ @@ -2235,13 +1519,13 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } - ] + ], + "entityType": "IP" } ] } @@ -2297,7 +1581,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyMultipleFailedLogin_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "ClarotyMultipleFailedLogin_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -2324,18 +1608,6 @@ "triggerThreshold": 0, "status": "Available", "requiredDataConnectors": [ - { - "connectorId": "Claroty", - "dataTypes": [ - "ClarotyEvent" - ] - }, - { - "connectorId": "ClarotyAma", - "dataTypes": [ - "ClarotyEvent" - ] - }, { "connectorId": "CefAma", "dataTypes": [ @@ -2352,13 +1624,13 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "AccountCustomEntity", - "identifier": "Name" + "identifier": "Name", + "columnName": "AccountCustomEntity" } - ] + ], + "entityType": "Account" } ] } @@ -2414,7 +1686,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyMultipleFailedLoginsSameDst_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "ClarotyMultipleFailedLoginsSameDst_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -2441,18 +1713,6 @@ "triggerThreshold": 0, "status": "Available", "requiredDataConnectors": [ - { - "connectorId": "Claroty", - "dataTypes": [ - "ClarotyEvent" - ] - }, - { - "connectorId": "ClarotyAma", - "dataTypes": [ - "ClarotyEvent" - ] - }, { "connectorId": "CefAma", "dataTypes": [ @@ -2469,13 +1729,13 @@ ], "entityMappings": [ { - "entityType": "SecurityGroup", "fieldMappings": [ { - "columnName": "SGCustomEntity", - "identifier": "DistinguishedName" + "identifier": "DistinguishedName", + "columnName": "SGCustomEntity" } - ] + ], + "entityType": "SecurityGroup" } ] } @@ -2531,7 +1791,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyNewAsset_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "ClarotyNewAsset_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -2558,18 +1818,6 @@ "triggerThreshold": 0, "status": "Available", "requiredDataConnectors": [ - { - "connectorId": "Claroty", - "dataTypes": [ - "ClarotyEvent" - ] - }, - { - "connectorId": "ClarotyAma", - "dataTypes": [ - "ClarotyEvent" - ] - }, { "connectorId": "CefAma", "dataTypes": [ @@ -2586,13 +1834,13 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "IPCustomEntity", - "identifier": "Address" + "identifier": "Address", + "columnName": "IPCustomEntity" } - ] + ], + "entityType": "IP" } ] } @@ -2648,7 +1896,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyPolicyViolation_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "ClarotyPolicyViolation_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -2675,18 +1923,6 @@ "triggerThreshold": 0, "status": "Available", "requiredDataConnectors": [ - { - "connectorId": "Claroty", - "dataTypes": [ - "ClarotyEvent" - ] - }, - { - "connectorId": "ClarotyAma", - "dataTypes": [ - "ClarotyEvent" - ] - }, { "connectorId": "CefAma", "dataTypes": [ @@ -2702,13 +1938,13 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "IPCustomEntity", - "identifier": "Address" + "identifier": "Address", + "columnName": "IPCustomEntity" } - ] + ], + "entityType": "IP" } ] } @@ -2764,7 +2000,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotySuspiciousActivity_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "ClarotySuspiciousActivity_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -2791,18 +2027,6 @@ "triggerThreshold": 0, "status": "Available", "requiredDataConnectors": [ - { - "connectorId": "Claroty", - "dataTypes": [ - "ClarotyEvent" - ] - }, - { - "connectorId": "ClarotyAma", - "dataTypes": [ - "ClarotyEvent" - ] - }, { "connectorId": "CefAma", "dataTypes": [ @@ -2818,13 +2042,13 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "IPCustomEntity", - "identifier": "Address" + "identifier": "Address", + "columnName": "IPCustomEntity" } - ] + ], + "entityType": "IP" } ] } @@ -2880,7 +2104,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotySuspiciousFileTransfer_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "ClarotySuspiciousFileTransfer_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -2907,18 +2131,6 @@ "triggerThreshold": 0, "status": "Available", "requiredDataConnectors": [ - { - "connectorId": "Claroty", - "dataTypes": [ - "ClarotyEvent" - ] - }, - { - "connectorId": "ClarotyAma", - "dataTypes": [ - "ClarotyEvent" - ] - }, { "connectorId": "CefAma", "dataTypes": [ @@ -2934,13 +2146,13 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "IPCustomEntity", - "identifier": "Address" + "identifier": "Address", + "columnName": "IPCustomEntity" } - ] + ], + "entityType": "IP" } ] } @@ -2996,7 +2208,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyTreat_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "ClarotyTreat_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -3050,13 +2262,13 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "IPCustomEntity", - "identifier": "Address" + "identifier": "Address", + "columnName": "IPCustomEntity" } - ] + ], + "entityType": "IP" } ] } @@ -3108,12 +2320,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.2", + "version": "3.0.3", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Claroty", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Claroty solution for Microsoft Sentinel enables ingestion of  Continuous Threat Detection and Secure Remote Access events into Microsoft Sentinel.

\n\n\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 2, Parsers: 1, Workbooks: 1, Analytic Rules: 10, Hunting Queries: 10

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Claroty solution for Microsoft Sentinel enables ingestion of  Continuous Threat Detection and Secure Remote Access events into Microsoft Sentinel.

\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Parsers: 1, Workbooks: 1, Analytic Rules: 10, Hunting Queries: 10

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -3197,16 +2409,6 @@ "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]", "version": "[variables('huntingQueryObject10').huntingQueryVersion10]" }, - { - "kind": "DataConnector", - "contentId": "[variables('_dataConnectorContentId1')]", - "version": "[variables('dataConnectorVersion1')]" - }, - { - "kind": "DataConnector", - "contentId": "[variables('_dataConnectorContentId2')]", - "version": "[variables('dataConnectorVersion2')]" - }, { "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", diff --git a/Solutions/Claroty/ReleaseNotes.md b/Solutions/Claroty/ReleaseNotes.md index 13166bae4d9..df94769f6d3 100644 --- a/Solutions/Claroty/ReleaseNotes.md +++ b/Solutions/Claroty/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|------------------------------------------------| +| 3.0.3 | 18-11-2024 | Removed Deprecated **Data Connectors** | | 3.0.2 | 10-07-2024 | Deprecated **Data Connector** | | 3.0.1 | 11-09-2023 | Addition of new Claroty AMA **Data Connector** | | 3.0.0 | 27-07-2023 | Corrected the links in the solution. | From 73c6cf7a604cbd9d29685261e65f41f2a4d80c2d Mon Sep 17 00:00:00 2001 From: v-rusraut Date: Fri, 15 Nov 2024 16:55:58 +0530 Subject: [PATCH 2/6] Updated Analytical Rule Version --- .../Analytic Rules/ClarotyNewAsset.yaml | 2 +- .../ClarotyPolicyViolation.yaml | 2 +- Solutions/Claroty/Package/3.0.3.zip | Bin 14404 -> 14778 bytes Solutions/Claroty/Package/mainTemplate.json | 96 +++++++++--------- 4 files changed, 50 insertions(+), 50 deletions(-) diff --git a/Solutions/Claroty/Analytic Rules/ClarotyNewAsset.yaml b/Solutions/Claroty/Analytic Rules/ClarotyNewAsset.yaml index 22679c6bfd9..e9a203e9a81 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotyNewAsset.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotyNewAsset.yaml @@ -26,5 +26,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.2 +version: 1.0.3 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Analytic Rules/ClarotyPolicyViolation.yaml b/Solutions/Claroty/Analytic Rules/ClarotyPolicyViolation.yaml index a557347a63d..58b7773a369 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotyPolicyViolation.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotyPolicyViolation.yaml @@ -26,5 +26,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.2 +version: 1.0.3 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Package/3.0.3.zip b/Solutions/Claroty/Package/3.0.3.zip index 8f4fa4b0ccfe6c3b077f4e20d1b12c88e2f6aa9f..9c264a2ca4603b8d7246eb618588b136bd9f370a 100644 GIT binary patch literal 14778 zcmZ{L18^rz_ipryZ5tcgwv7!ow(VqNY;4^gDDM>j-&o`%gmCa zzFa&k5tbrm^jdX}t}t&<7za^I~GHlfhzL`%3~s5u5AO*)kO*Ns53W3Hi1W zVPA=}ZZ#NzgnxDH_$Xj?ZzlwYJ*wPD#nC}9 zR~?;@s><|+VUq>cF=i}(y%jSI8=}JtstfF2tB(iPIojT}_-T$$^49J9W%YqfWszU) z*iSxNRc+k;J-TskZ+i=$K7YBScoktYq$P?g6D%5=^BVG_Wddu?;+UJp+q&jH09QKM*EY6Z`7ppi zpbH5yBf?7{CkmcJ)?qp&u0eVkL|uqaz{Hskq8}PoH!aT|{3L=E&2Lv1_Qz?pSq={%@pmM0$6%{?*2+cEs_**_2o9WyXOowF-!k=H5IvoLW(81j)atbgrNCU@ualbDLaN@V;Km|s{mlQxwa zn$4|~{2nr2%VFB}YJAk_cipB_jcTdNMG3K{gc&@t4lGxoe%&4XQqKfNNfE0{1dWMT znoMU2w=sI4%HAQ-mu(mn`x7pi&@oZLsgqRKTY|{moaC0eMpXf`Q5zVR((eu20eVNv z-MBk^cgIk}DEHbtznKtCDFXEjCB@ktNbb+dIR$=B(7uF+(a3Owc`s|K6w(15cy51M z3b7n2+9{t}$}RdYdq_|B;0*zfs%e5kiFoV}ROMyGLqUdeV@{c^6pxGtWa8!**W zr>-&B&hfG105ze_Xz{%=VpxScCRW>Z*i2(DXJC>#KXr| zPu-`dM_1o%@(ZrGw1(z)8Ng}810Is=~%d8xHW}E26z$i#kYuWG5RVf{yJX*Q*!9*$?{X z{ay*6%Q<0C>X0c@{eVdlpoE(|L`yCDDw4|EQvz>cfYPDYW>Bqu&w-bT>tU9SsvIzL z5`kxy@<3bIhqGRnRe00ztIZu30}$@#3*E;2*)3UQ5@b6|z?KwoIF`lS3T;3Vyld_p z=XW;y=0j|>*ykzdN1Ks=>p0)f1E`F*RG80>`PCq72q!I|kKt^05S$$>s zf_-F>t7evuEy3?!E!eBIb3MY@?%I@>Z8Vp5kVqtwS8mgK73@{#q-B{K{laez%_k#u zGvBo(S8;>HBj>8gE;>Ad<;t2P}6lC=0j+BWO*wL!Y zb(bF{(c&!_8_;LHu5%aI!s?o0Pv1&siC-@#+z?-E-LH2=B&OxI>|YmMsK&HcaRY&V6xy#KwKq2NBzdv*WsPm;hcH-}N3V}FudKvTMaQdeWRZ zUjB7jtDSUulIgxz$<4Y>kh`gEZ$b;b%3l}lA`q2}bsd2F#;0{+-P=qg9ME9=nUf$b?plrN4K{$9lvBdRi?RaMh~$@b4`h-D;utMPf4WP_#f^DsMX| z!9(6Ia&gfrw?805I|)H@Ddi z`-YCD#)f%#^cz%YFKc$2zf0yN3cs^u2Bt9COwEIjAdE;Z?h`g*{aWQZLqZ zkh=yns!IzN-8_y3z))DTPOxsy5RVpb8$SwXs>v98^4^0hk6;d5`20fd7G_FzX}v*n zoKcxvr84`wlxWM495EAOMR$<_+#Y4_pRKv=YIO+Hsb*#DSquc%6jxRMe$AxFO#xMH z_)bc~;?FFqL)}!@VHgOmRqGW;w&YlYGt@b&Qj9R7r^!|728z3S)+B!Ar~6F1J``Vx zIfXt&hh0&ux2UP0jmrj9>uDu55P&l^xLzzvydbIh@vGw5w@UXlVxBwQq15RJrVAUi z$JyrkKs~xc+PvhJ-L58?zKcdp=dFL-i#+L0;YDP;+%AdViHdMw$P03=M)T7;FP8Eh z;_DMZ;r~c^F{L3}K52n~)|o(nkiJu1YkhMY6=Q2VtMA13KgsU7_J+e+b6n?EnKwk0 zOSzG$X!;j%{B7yY{!xVGt?TaiKCz3t0CECHt_YkY=gq#`)#QeI;70Nq#R|B95+NWg zCSy5X!?KJVdD_g0osUJpDd6+H`YZ28z}Ij9WmayFurUK|nCR#Abxb1e_%yEUHSAP4 z==~d0AA}$m_1Uek@Eosdy^1V9>Or$@>-r$*N$?BuvR0mZ^Kj zq$K~VpV%k$nQ5~C5mhKywj?lWt}&x5v(PIsd>xB?zK~*~SBrXq#?3|r6$uCM&v4Tw|s8h&VFqC%!)S)^U*cB^qtI$47)Rok@2c%c39d z2ZHGIQmNqdb3z)29JrL9bqa@=Asi}UDjGRFKNZ-N!*@Z=vM@&Jr^e*w=geDWgwWE; zwhSL25`qMwCw_A(B)F>oIdbk1a6|@_A|FYG);}Y+ zM$|cpjbsy0I|m4oJ+ZzyXh%+QNprq6!L>BDY=Q#i_I2#w@Z_dQparXwRqH85%2t&C zG0P|jG6>(72L|neLF}*DH3&^?)|3%kUS&U>Z7R42m~5EEE4^qhWHUhsQa)!Fqa3(J z#g!AoJ77v@=o_=P$mt*UJ7&b}OxV}{vQin4pF?PsQomvgTo5_W6meMXtZ*V#uh`d8 z_Dz3C{t+IVt@nF2Ksg+R>O+j)QE{%Ly5$_se8=v~OH@tpjEq@H>i`Y-2wm1L%tTfZ zDI>5Tifg+am+UZV;j~yYwoLFReFPN!ZCP+~Tb&MNB40`S1NMO7;exzSrt+1x@jIKd zq#Acmyq&Fj{?)co)=<28EP>koi(P?TUDcDMsa9LO#RI4Iw(qj`ktsjF>DdX#IsqKQ zPlt?Mz0`pLRoW@L`6bPdP0N_jTx1Ep}TUr%fu}8 zk1oyah*s)^d8x%ofAtPw#n}FX)=w_!K4S$K9qbAL0=qtBo=vePF&TDTIR01RS5bX* z9%FPGcPF-DS?UT#aBnfw4#)~kq7GI%y%1c}>UZ6qqcb>q*PgN_AWRAM$>`!_LIidX zYL|41P_yMzzS}5MR3o0xBw0%w&9-s=6K46;Z@}lqT<)IFt+`nV)W)Y#RXI$ z@d0N12DRpsxaNhCtt5^%WMJRwt@#gtJSIzlomXF&OrYKq?rRwucGPK5RMBb?PB4BQ z-rO9g98W$sR_=+dB?)Oh2u_{O9k%x&>;8nar1pdp=n(6|Ff{0bgL8$4+IC57F=y_X zMQ1Rm4fED>QVwbJ(*|~Jc(^jefEK$RT@TF)m2LwzY7wR6@`c(skzQw z)Hrp%e}Q`?-<{^|p>aXegi{ZjGEO8EA*)S$Vnc>MHX6oniqw$30*1xiIraI#P$U@PetYE9b zS$S?Z3o)HmRksG?t)!Voc=X%rRg*tBB%E9Gz%{!3gaXbkT+ghM+HH@zQjau9yQJRa~lOq*arT8}9`@G(9nW z!?Sf7SmW#nId)Hvu%pFkhAf~i7fwrPwZR)$=(Gyl>p~D{?GDL2+s)t%Cth~hW3mCQ z0OmNcq+$ffvh*lIB5FhFef;0}8RY-P@BJ@+Zf``FeWG7kYS>v<$F10UL&~%%2Io20 z5W|cekbU*0?17o-!sUG=+2Ui1<%}ZZ!XZe+~8nv8*td zfK(X+$BN|?E8~sg8G^6nd$gwr9AXctk@>ns>`W9k2M#=FSO)3c`>*mB0X5X$^-tY@ z+!He^$WDL=R(7k!=8Kp8xwqecZL&Px2(h^Q-{7}(orsAF2hb5+uJC)6xGsS7s}Xv$ zcmgR)@kEL)@)ev14eRz8WfmSHYRmeN{f89yMa0+xJN}Db%1-oO~$L3|7FrlUdr@3Ybv-wST{< zf;82B-2VZ_1b}_Ztm>cn1VPAPgG| z=jHi30DM4(G`Ft>+`njKk0Fx+BM;-KjC5OdDR+wM9ngz^y>((n3S2Y&e@1d&13TY5TY)xW?=UrIh z5pT?>E%gvPE(4#fwRGc}g-d6OIW0v0pzXefOOt1yr6c>hO&y{owG8@ek+sEc*a4~KTv$@CRpJL=qR{UNnk^8wy~+{%F4?7)hH}mB-ITn$Is0ofRvea6>iTj zoyqVH@51&FXfo{7HZV({0mnQk=kyoH$gU7~zq;MDak(l)+#c4(D2#8LPDdD;!LGcLfP2}HF>6pBiJjPkQ%@m+66OWN7he&^Lv1J(s&t%F0yIF zX^Vsil->!I8E=XqqqSU#Lk+N(i2d%K$<=O6%Iu=t7(l@sN(I(L5oCe94ePbR!X_ZS z#zLrE+vb)u+t@$ENY`fi1UG(8l%xo z4<9L*KCGhqzy6!S^Mwut$*i(^jTFTQRIj1U=&vP|2>cl14=p({xuady!xW7m)^1A1 z1b2{uEu9$?x;extRT14H!0}K$tpa z>LjEgIx=23JjF(^@OZ@HZC^1hl(T?kn%$Z*G6&<`aR-3YFywb7f9)R}CoN1diTtH? z&a{`M@REyS7D~{zp8wP9ElXCdn?Jy$g=kmXS#&aVHAhnrNs_Rye(X37pPet+f;-!~ z<5050?Jd{HS!nxN!aEiCUbYk3mtw=g#a^x35mJ4^mc2hPvdaO>?6(G+>a!=o0IeaG!I$=5b*mvJ;H6m23c z;mzppPuYYbJfYJd(;a!VJBAH8!xfO&9_nA;X@Wn_EeC;zt+s*M`IwiYhf3x zY)x@?C<%FM8Y<&gAEMP=3}tDL@G`a+-DTie^YAiDqnX%U8`O1VosASdb2P{6vv%_S ztQw-K1u&vZ5@>(_T&c&Qk5Y0!eI_9_g_hR??})8i_2vjAtiT1pW{@D{0-%LUs>5yI zK+;_raltI==pcWjGhU;!3~n_gYv}8Vn0Vke@yMp3ZK3qd-5J+hMn9LSbny)uvVrve zJg{O<(QT2`(qL$6n$Sg2j@IW)FIZWy2U;9|N_U!&I@lWiZSc&LX^8CL6QIaZfs-)C z$3t_VXU2sr&Wb2rsLNT_F;_CsW()92_A5nWK}amlwgWnAPzo{YGS5lUQY7M_VdUuC z^lLg#y1s(e2L2;Vw5W;K+gLMQf?ElHB~}=24pbm8z{Ecq9nUSf|B#p_4R?k zAd}cjqRCuxvH!ib?_KvPQy< zSTpEv`Rm6K)<8L$xO0b^^HVsI+&XYno)p?c?iNo)9{!4mt*!P zAuEX}K~LS!B5}pfgVc#niwm%?c5wZmz>frc!nxmX42g)eW;GA@6E_6-nz|r-CJXWEm~R+I<*e9&^g`H` z!K1|CBF>u%5pDJfnfmyGlE&$O1U&5Sh9f*^OJ=Z zh{8=L)KrbP9gjJT*67SS$krL{uB5KC?B>D|QOmeCaU#_eF(4WxSBe?!W}AF@6{Z$P zMLVi2HrK85&{bqavmZg_Y7s+P=a0(NF??>|RZnM$ZXhkC%uAiMyLrNpIXLY!c>ZX| zNZSJBFG=!zwu)r}aIYe=v%Q>^kb*}d_9JfDZWoyIY9ib&uUVp>0{FvvxZsvpaSP(Z znO@<&60WzgiDq;AIs5Injp83=y|`0g(pDS0 zYzI9v7zv^(UUWc?Z6zH8J3bB_SlOihs3<(I%_>4jeYN(;~p{ZTvT=Llq zsYPyz7)^&5l8m^0yhm!vDV9p8>#+ZY_oFVNGP?)G?|%Qfd7o<^9@QKHO_E)-#m0)* zyrPFx>#^G`o`>9?y=1lpntb2TBlIy&tj#&iD;%f=c+>DC48uN?QC`LYIW~qbva+VvQ@is{7k9NLo#F zu(_tKia2sKjkYK7o-i22AfEeZbFcS zt06-$d)=NG2a`aSF3B;>iw(hyRargpVe_(el!EIF-WSbIU0+%(n~HlJPcBKv;v6!J20PD6HqtwDLhunVKb& zpCi*f=zkp^bUEeBI_M>S?qke5wD1^sjq0AYCM)jE70OR~M)}%Pz!B8(?G8vQWCdtl z?MLdXJ*rK=RX~Np)&gsh8cH_uGp>k;`~Zx&A7|gq&%ddNK8nD0`x6<% z=xa>$5=cN4+Lx!SGc+yJ1ehI?=B;4t(^*MMl7fv_LA95;Zo)yiAtO+{yiyoKdDAQ6 z#^OghN(#suX46n4ECA9V;nkLlNw5_N>h491C@+jZT!Tfy z{Oi9OXo~0(z^JR62#kGM7nyr?C6{n!>vjGL_7UxN?e{<`ia~5 z>%E2K2N@D%n`FE7k@`AKwicgbevQM-FRip-Lc(qje5oOMp z)F|<%p`!LjX%D4`$=q5is9LMUMGbHIBLtj~3*O2CVS6r=ui^Y+b|=z!Xs!_PF1+gd z8leH=ygNA)jD;5gB9X)X96#nUVB-)#Sh>z1U#(EiSEz>PFxFSNN|d=9t9M2^H)#t` z;xcOFKEP`bGOYM1SkwJh$I5OeXn!xA?s-<$Ha#8M+|aR( zORw?9hlnIVBV>6Ob?w_;2F%i@zwP>>C9=fA<_Ny*J2A;+=sN7M%rXEam zP99Zy^F3Bd)Sd%*30H}Tb5@ZmakPFP@R)f^3gb%{0)_+TwqOTdp*)m^<%9yqmbO74 z=&(XO5#8X7A)NbLqu%>(*GbY>)x#cJz6DX>O{_kO;bYt1p^c#(GQYs@D?{}KPR zW5K|&xiofps>V}_vJLa|sl*h->x7W^YQ3mSPAXV1e~Kb(&+st=9?V6h#lvF!G7jcm zijrQZGMVo)E~jJ~5ai`wx`6PeNV~BsTfIg7Dpb8yUiZ7&gK!7q?$55oLPg^rXKw_b z%63vZYdIVJU!{tc`lY%E=Te!hX5r|I4;}EeSW=-A3Me>jf(DL*Xbdl8V${*U#=`#Zn%Yikm8Oj+~ zBw`HF@eJV19nynYsNu|md;4vdfeV0pIZwf7QCGBaW>J4!LC^j$L6WHqX2G5{ljs|h z^k$)*gDy~nBYhx}6|7pN7gA<0>L6!HywKDVVva*hizR1qi4O$7T4#fM)NGa|XKCMK z?3sZpb|rzDfQ%{OdO-%vTI5sZ>hs~*N2wCC+~6r3?}J&(H!UUR^zRY$AD#}-rRCqp z=0^mctdxL8fq-ex!--SYwXum)Dr};OEAlKcH>TyAMdfiq(^EXmG{{inin7MAbSw5_ z8Fz6=^~5}+<*PJVT62!7_bLvivVH(g=Y(HY`8Tp4U#c{B2y57F&lFBCz zdy&(H6xi^1h=GOBQaC2!ff6LWL$OAuv3s$Vtu*(z87s6!rXCR#rr4L>V(81{w~42( zt`5j_?Rx9OdADVO6{G(<6H}ZVV@fPTNP#DSzg^+m>c=DMvJ}h%7;W?C2^)b_E+>i( z=E1(bc2FXa9cut_R{@pu9#+n{eS~>LjnJ&tm;Xo8M_dWLDZgM|m-w0?mh~}6K`W-? zosK9d{B=7IcI10pAY@fjojd_eYZWlwb7P(#-BFRdj3F%T@TWW3bdHwI^k$~qm#nE# zq^G)>+N3@{{H8u#BfQQ<2~Iu8S^Ez{qS9_kk)%Q6h_5fKJ@9v+`x7zgw+L{qx7IA{ z8s^Q8gff^2T)y1hsX)%4u3_g@aIVk^t^ik56vQI6K0G*Ami3*30=~2)bHHT@c-*U< zc+%k`%oS>cR`reCKlrb3rLHG)2f1DP+$dPy-{5>~7_OXUuCIgV+G5>~5WmfI_iZMR ze5m$59vrzZ*3Fd^?uHZsv-bQOxv87UTn2rfbD%3AQ;>PM&3}6G=081oQ&C1BMKjWs zWplFdyrcoZH>NNnZc%GkozCMYIh{<;TFffT87)rysEm9fNx-p z9F3GU;b}i(?8*P9H#23C2;`mKOQTAJM}4%W-9V%wRH-2~! zEpmc&Oo#Z{FnR1~M?>Ln{bS`0Tu@}yV%={m+pCDt*Z!P2%Rgzc~>%WwSHI1X{UbA zOTlMo#O^YC&%1&7HyAws6Ab)xq2s21?%3n?1`lLM-(Sg-+^wJlsQYB)s{3A>l~C=^+^94rI!jR<9tW#jvUgR{XUr-{1TY9 zaO!Rlonrbq!f`Q5!^Z^EBKj~5f+DKLEd*n0mXSGEylwu;xYQh$hl`(MXU}g4FL3Cs z5*z_#D-UZC<&sWniTn&6h5_t3GnsrwxPRfMi1DV(L$H={T6Cqz?m#}Kt2-Ux$ojo^rkczJH%3jJ!tP#Sju)JsnS<;$@Fw)NS{Sfhd$`UWp7`D+y4fayOZf zvrh=Y7FK}5l^dJ}+t_^N86qMAa{;#00%45pE$=aMt0Mc)>oPoC9+w=K~Uy#6_2HDohjMEh%B;L!WXHo$CmIaAfAX()K8LDm8SfoGDljvyeYHFsS_RNcmuI+4b+l{ec20dK+Tt~A$b*iXUS&=j-K)ekUi&dnenJSe%LxKElTvjJ z^g^OJSxi4BYK7J{zSz3!Sp_I0KBD@1+(!AqE&j~K;p_h97VYU}p|wo&UPggJaPv`= z^s=0)*g7YKb*cI*A#d|1UfZ^#W3zSB-`0|J_oUcG_w~?~=THRRazOVr80+%gKHbaR z8}GdRZG&KQ+vkR;W$42#9Nada&S!v?I|@lfwI*e%R{m>3D0pvumuN8Ua1epIrZ;mM zCU0QNX~=eZL)s&`H0r%uDB!Er1qRc2DumMd$IE*cev{w$Aj;YR9WrgAIQO5Q9fHgH zJ~V9@2$%Atq}$#23MBQJRxpw9gGYL8EZ83wvKIh#TQiQd4K{=*sms~QNr{onzd4!v ze`h3|b<_Lh;~8>i%x$MBvyu0lYCxU1KnydvxBwp7IGIV(F^bg3DzyUo7OY$g$13^C zI&!D^=BaAar52>-K$&G|d1%9>!@(i|(=cdG+VXn88Z65*ZcaSu;S=?EDjqzp-2&|l5!eBIKxkWx#Ct) z)xi-S0Cwp*?Q2Z~|H6QB{O35W=eU5f-MQs7Z^yM_J#U?PQ}P-|(-1kuI_*64cD|oR z4gV^S^po#(E~l<72SIlC&VC{2Bs=(C7S|D|hj#j1qV$mhb%s1+rilgX(OibSBj3La zaAbco;Cok^EQ6+=JskDTKos;D^*004|1fZtE}_09QqR|>y@>H^*Crcc$Ap=G6Crhb z|9hm58n-2ey=Z??Ir;v3HyxfrkOXa=eEIiWd)OZZs{l*o7X%pmBR7#>b)7&Bht@F}}s5&ow#NXO3BMe20gB9#oH15TNx3o?q#q7$g@oTbr4#+v$J zWw8akML(zqsDQ*`6~A4M4Xs=KAD3hKcDZghLf{ApY=%`hkU`x_)7SRtiK0L4bBsL! z-)RHaY(J>J!qG&r)KU;Rx$RAkJS$6#C2u{32cn0IX)JxQve#j)w%05a0gX|MeA89S zykt*ZJdFnx{SUQZ>?DsQ{W`5R#ttp$zg=q3~ zN|L=fe6P_f-&j0fVEN2g;Et+^;ZZWd5;U=*lt8A&v{-YoA}p+bhrF)xlLAVkbBCV_>_3b?Bn_hZ?->&|*YX z=9=FLZ>)JinL<#+1wxd{gZXRX8p}tRs9MnPn-+M!DOZ6m_#WRPxh`Lwr6Sz}CW3kB z52bOQR883~mXF!{@PD(n*FtPb>>ORu2QdI7`Kf!JKeGV9{~z!*-{A55@gxbCV}rlJ zBc3}T@vIhI(E2O?(&X96vSNeS+xS*s<2#hc2H-&%a{R}?aA_opKw9hZVZDCeC_d{2 z4#Q9L0z{(j{A&PgD{t{Z?O16zlgyLb(#Z7(1;XIz&N=>zIT~f4Hw_`pSo1RZ^}jqL zC!f`@GiS)LGs%##Gie(iF*9#YkmTUF1Wd*C1eC>11*$Fc>m5drEdZI64!JHN=_z!NU2I$tUX87Fq8nVFO;G#rpcY}Smoa0$(;pkwVX&xwI&HS>`2@P73V zKx6P}(!yD5%yHw4Cmg9H3LGg46dY-?rY9_^qdUb&GnYUd=rvY2Sqka$&8kYB6>*s6 zPTc4KkaERH0eO6y%_h1spmE3<&Yi@n}i@E2RZ+F|%sFStct3PXt?+$m!bI_fswcZ5Zy*4+z z{MQiCR?ODkweJGY?`D_UTc58x-D4cyU#Z~79e#EnJlrjE23H+;d^DFoSb50a8D76^ zthRKHwH7yVO^uVfFc7?IhQO__(nZ^(tspliikGwqmf1spKm4A0jyah_BcpZP189Lb z4L<9)r$cxGueq;Z`1+G^L)t|KxFYEn9h0np5_cLc)8WB08MyfFR&|O-zW`?*4c%zZ z%C3v%n3@fzpXZE(*!U2(zP4HyTlpkxAZ zm?0v?Wgd57wh%gcm`yNx{X97}w0Nbfe4+&r7zv7t0MFy!xB=r8%`B*9B?Bi12ZVO3 z>`iI~_BV0gLKESJ$@XH7z=+FZJeje$h1(V2AGNvaZwDMhl;ZCe-9-EJ=)X?h{f7J< zC4bm(JJPVC%l2x#GyD1JuK&WeWU+!XBU7AAvwIT7dme85Oqb^QXTaSy5B|y3{(87X zhIn|Mndm`ML`$qJ@4o1GoMc=n?mW_V_{iZ!MMQf(V$$X6;)NI5i3`0tt#K7{I);Hpa>Q^OZU%7u+-l)_{DcG4m$83yPx8W?J`#crC{X@c790S zI%!J1i0Z0VYR>t~?t4@BX}_T6@Rc0KbT*2**vglo&SZVsq}ULG*bppNcml2QtNbTO zawqaN*`oE*#mn{X)XnailO_z84{xZJd5~6NJDh%Q970*$8KGJ6A+Ex9j>@eZf-WBh zsMfqFm@z-kI~b=U=%*w6>^b~yW*em}!J5zCnokpu9v#Fc470dk%@=IVrvpeQF@VK} zqlZ;)O0xhTmjm51Q~s;v097+z2zrwkfNav|K_t_OEQSyymOL`3*Wo+ET2~7mi4PS? z7a!H*0i17HU+x`T3S2x0y!vvk-LW%dL#-1Y>N1nv3o*+ZyK$2}25e?=lmA{s+InZE($p^c+zgqI zWB7T;f9>=2y;vL=1QqE2zeDnS#W)Z!5aB-3ZQFKlZMR>aci#Cp-|kK_* z69s7yP*flwAV{Eu06UEleA$y4XdoaOVIUxkpSMPiCI-$XDi$IprWUpq&K7pIbe2wb zwp&`~wi_JiUp>9uAbUCluDjCnUJ;kDJQl~mh0JSYSzi+20m*w?WlydJ%=@wtc>oh86>pc z2xDGEf{5yUzQprIca#j4&A`1rKfk(kD~F0u8~XmBZ-%e%cOe>KNm8pU`lW%YeqlfP zF;l&XSDYWG-;E*!6}Rb1$x{~$H}g9;N~6~Ir3m35=JzFy)nBDr{eq4V#Jv5JK6_eb zPD366&LVj)_SM%EGt7t(d5X?UY+I=Iw$A$2@2)w_mhq~`l*v%gb#fBy%98U)J};N> z+c0Q2GMPoB-66j4`&n+5f*1)lmxh6pLlMPfzT3@1Z%12hTFaWuhkFP#27mba)`{xS z*fL^gCsX`n?&@l0Jlw3Kyn z_8Ji)Qk^3U+8+CkGu6}#BQ9N320J0Kc)&=VL1y`0M4O4)83B`QVc4SHw#0pZAJKqp3H8WG@jOiVbl?90~{KrR_ zA`^}mk>L?#bW}caDIS8?jxPXbE(IB#Io&O_HAsR4!nv8sYzJ_bsH|fS>i15B9v8z1 z+XJNqK?QqzLWpFvLyaeNwGVd?S2huCp@7}f1 zP8!uJK}IK!Wf%Or-I7s-L)JhnXIn$LX^fKw1P*k%b7fz!CTJ+LW@>OF$=GZhPO%rZ zs=MBn2z>krDj3vWr4l-t;7p<+M~JHS`M*l@mQMu_P=uUubQw@=NXe2D!)f@be*c0QF14EL6GL-|K9*cr48ofP7+W_cghOCL87wvqJd5L< zLDw;`LSffPEawihp4w@b{E z+!DZ*>r)zg+hna3-s?-Y`&UM@ig<2m1D|^Lf{BL~?H3p3Y_e)lH2ks-@j6zxD_>>_ z7rz}Zx80>PlBLLL_rLnAd)4R8BaX7`&sLCmG-I>XWNc{7FeH;GS|LRb1@Oiej|YKi zY(FOV#gIFySk;a_Uh%ci^0wNK0cGSouKOF17L&ZfsM%W6E%TxA)qigE%F6KLXlLSp z=b^GjIe--h=(Ks9wuWkoS_~TNL#4Z&T5?m9t$X;~j=@ly`m0FWYJI?IBJNb&`;y~b zGM)6G49+V*azz=WA)6Xh22d}{cyJzz7ipCydF9eQPnyVE@E@13OMBSKnhgOLtn@e) zGP3J2EQdqwWb^#<(>?k(5ouLS z|7)>1^Y2#I`kKi8M_gTYXpBr7Vbtp7Y{%u)VKOK}b`d5~(H!|;(P-W!ThYpSV6bFsau$;t+e=CzR8EG z8q-9hsbn%rxUkWntot&9ddi_9&Xi5znBjfFc`(c3rMaOZdUT$qLrt~DlMyf=qC_9p~TB}wl!s?rS8mg zWRN?I-Q93LXl|1d4!*Yu2v32!n4Zs^bb};*&fsOTXOGP28~v>6m!PW^L?t}m?lPa3 zse5}lC8#)L1&)W<0F4(?WhqHExw^a45t3w1x?UksDZ1K#)cj?OqN!LIJL~*@G##8! z9Dba9WzKlu;I8qeP=Zv-vrblO95DaHPer*)*LUP_Z{G)}s6Ao}P8ZVxMVFTAhDA4( z3FwS=myxGE#mn&OTY*%~wnkBnH;KF6mRg*Y>^~39HU^b*pc}ISrIv4jqAts{Cc8v! zr5qFwo+opIVt~t1?)(#U=CU#H9E;&sv43mK4A$0VBQztliYi#~PXZ)%)sSKdFO-JY zMlmcZ;h$685JC)QMty?oEz8I0>0mikdx znipB}gn|c=sxQF?*MwgqwJ>_jtGUdS_3MU6iPFbkzi$YI|Hl~Do|S$hg$4*{lL;6I z>1T{!bNtn3CF`}nyD9C4kBnB~R{{sh$d#OD(YI?y zgVWsAk!)P-)E07CY$6`{Lc{U#W|nwrTN*~H+q%3XG=HH0GKrw%a!#3X6DcxZQu27A~>}?>_J|BL%zH2bQa?Lwz1zYpN#Ob z8?aCie(^B&W0@f>+4AAtt~5I^od%&Ss50azGYCES;wzBCk&rf~GU|{LRnm4WaCwZV zjv=$N_j9kK4_!9~G0HFf>)EN@P?sQ9Lg&OYOp=#tq^+2IG7N-xLEQ)2B2~ywc+Y6A zcKuqd6*F`j?&fmhdwNrIiOcV&2fZ0@=wEZs#R-7}2c=2!L{*Vg996w{Sx_ey*HIYx z7XFvSEU6)*L#xAV(7Y^+fk0_r>M#Q{1RjX_Jze`z<|!@P&c;>>D(?U*{&B5cH+0QDYEh2IOwx=v^bH`IJBh8N`tZ-_D z%lH|Lr(jC#pwW2c1v|~Sq@_nBSVU}|RlgX!Qd##<4H{@7=CC(10qj&PGF3tAkWmaq zm=y6itz706T;8B)Gyy$B z{DQUJ_Mo_fR(Fwh_TD{bMT+s>d%kmQLS8)#F_1cEM9S#D5@LoCNPbv=px=IGZ_%8X z1`e}bx?A3SSg{|NKF= zr6=*M=HzLq$~8Qy7>I}_8n}se;+{CvJTI!4NvG4){4CA`+S`Br19 zu3w69IM`bZ?2*wBo?>Eqt(s-I*5{){8fK0_wM4GlIo^gCaS%p62MRtDu<%n>)8FJ? z5bqoOlvTAl@Xg=Fl~!JD!qc|!AtUvqIWas^5+$A!BgGWm$EV)ao3LbOWL_^p1FZtH zS;gyO>lz3&XONVK8FN;4UbA_d42RqLh3=W<%!L|T3S0wAZNJUGeQV`=2#Wipiv{I~ zTezyQ*RY8dik+9kMJnQoO5VU85cR(=cdvKvAA?dlOk1chG3`f3M((+H#ZSAi+V%lN z=gqBAyCe(-T-}4k2z45QEw3r83Ipq5Pq@lkgBE{>1wAV= zZ(b(0E@kw{)O`~$1Ks-mzF#pEr0x?n({BusT?jf|`(;kMacb_bcfycTQKk zbd6?vlk+{JSj*HzK}8?gCKfl8)#zz0pPWx$(RtpR-g>nP?5w&3drIKic^6pL@irPm z!vEP+OLkEaQIxl+6mKWDduq(Nb}ZmGu4_(MHaDu4>@0#0`0AZEId5LVt~ak)P?xtf zkv*1&=9X@|rg?7shv(h1Wz7PvJ$;THGSEhgIjXwIMbopviVb4xNkFCR@_*5|jxTQf z{z0=|rzzX8)tmlj!^d8m?d)+|;2i7Hpkt1`J@8Mt(`luZr4pjx@2)MTN7tn#>4+!$ z7K4p}?q!zB;$x#x4?^+BE^@)Lk zG@nkj1fthY`t!u#TJnV)9Ix;{&iyb2`D7?o_Bq&@`A|3}WY(n_47BU)UV*A8?t{ZX z#lfmMB5Yz9JeaQwmS-RXldJ|t4k)S?dRswJtZB9BsAw{)>OD}@V=RB6*e7IK%WV4_ zDX!K*tbpbY1pa#DEm<@-0X%^I{p0Q0X-?1jQkY@gJKiU&obPUjVqY=tw^USS*gJlc zRhKO0lxbBl?Wc7?DHhcVeA1uA)l6SHV{crp-3kb;m%gLq3fXSt_UV;(lx=Nlg{o+* zvF)$=UkI&DzCS{40gqyvl4h^96{PWd!u%f`&*B3g=sE2KZofJX3rmB^qt}%00%rQ9 zHi|91Z9mmzMTWhXELkO)C>V-u%}!8~ar!_Iw+R_;L6TS*lvCsUDFRn}wMHw50zNDw zxU$hi5LhK)h}n!c$`#H3W;gra>{pflWk;4-Rbbh(O@neRl%nh2`Uta!zUn|SctwM?;A{hvd!>P0>- zC|5OOK}&_D`u(4e8MW~;PO0{mj}pzzbEUPdf)lP8T($#=c`ko387>4t;@jV7@#5Pf z^Zo#OLm(DDmZFCDO)L8af{&tx(=XIzBdN}Dq8@ST;}wcRaM_d59pC|hbDO|o+(Gqg z18Mb!%l2G0Ic9J$UNHMrBm^_!WKOPsgB(q-2cNHSan`x^{)LN2aDb9U*GBZ3`~S_u zX&|UW-{E}Gr5JyQz4t#gR0|QFfod-Qd1R_!9X2 zkE`9Se`D%sf3@)T>8$OcTG8bc# zTM3b6rwIz8)0h*s^pZ@fTug=B^g-?S@KLF~W+O#k^sTHu*3!_%A+6P{p0h6T`FFfZ z9>pGE1O8VT&{=i0T9MPDe^3Th@qOZXl{lbHWw`*DOTvw4R0Vl!u1saF{zCqF@?z8Y ztKItXm!BR@BY!8BwpY}QrAf$)<@ER4*16l)o%EH#?9Yi&Nzeg$F0GTYn7(~3h6jyL z4Q6)RzV2TaYb&P%v}-$%HUt!BLWyAQyI(MUqby+s0MprC*jm}@4<0xngs#+fXDb5F zCz(zCn+vQpYY7n%Q~#UmU3Fn={DK(z&biSJalugXTpxt3T|_QGx?KFbGa{V%J#*yo zF3I-o5WA;EWY$1M7d-*)96=H}=u9}vB5{h@-Sfg-1oX#i%UnmPmTth6q3ASMgw;Zw z1=z$@lctVD6fVmfp1S!tTT{2eGt0oD!_4Vqezk zOS5*+USq*{fG}YxyB_M06{%q3(iQvRKA0VNQR0_!FLXmy_8`sDk_>_qCqKy&j+78i6+^W3YVYT&Tr4dphVa z%eMbc+{#f(^^@twXy=;uh4INjBI`5_q_yHog4h}j<9JY#0{j`CL!yq(tD4$XPXQxn z6!tADhX8)(Ebd$ffGfBT*1{IzZ|JpfFf|;LYgpB1s1A`-W5(;u>Q^_s&;mkF>>Q;w zsQ67Vyw>f06vD!NiXBA+fP=ESXBMh0nv>Z0t0ZbZKAHW_+w*;R1QV3*vOjTcdb}HG z`M`k`OHBGggQ+}IUn-N4cK8FX(X?+7ZT>wsdd$XA;C34PfH(jJpZ#m8Za_=3Bf$}n zsAWh6zCgjaMABCG`d;aYvpJa}&P3TPyAGwDsym!;v**7}YRMfL4!UrQNfg3wZ*39? zfr=3!^||GwEn@0X%L_qKtzaLM-in?_)rr>vI8)L2cwQhwyhin%d$YPwO1qPLTkO_=Pj+#&9sfx3E5 z`k+g5J(8Zgw3*cO>>w^6P{!5?+jCP;egx#ACwEAL(>;=G=YekXQ3RM_H}lrn`)spy zdbUo6z0=+{Gj`fd{Pq%~TXG=zCHpoQ{>8r+tNDx{bzEeMmsqh!JAZ632l2qrX3O)L z-<^+#X`m~Q6S{WsgvH5QPI&Anb{#537%k`ADStOH`vb`<8|RLiP28HBWp@-#7r!fb z#5n^)@Ws*5bfbIFW__{;O4QK@B5P?5%pZHM*O~WD;07B4z;im!6lL>7m3-DfD3B^S zROm3s=KovbFCDu_8d5_jL$@$3;Ho#WU9&-_{r8--ozD$Ju6jQ>*C#@weBa@x_C|h- z->rC2u_%n~W9P#vdLcg)j3Fr$4QKnnlZHUV$Nt+#zb_YNKv@Kjzamj#kGuu(j82Bw zyCEzE%=>P^bf!Ajkp2VnZ>AwbWwL=I!my|OKk~17vVV{Nkr1HC#f>=_zlW^uCmrkMd%sDtwc3Ikkh!r|oJ_ZXEB{Y>Tj z+(U0nX0K*aT>^m)81V%ATD%)^CTnOE)s`@o4DOBA7dd6j*t5UwP5-b34j8u`%08fl zkw5LY(@n-3Kd~F+F`=dP4k!YJ7xOw`3%io=p3!=b`UeS2kA&hw~|?A0tpbn_2l6VpFc^R+Oxg_{mx`G0O|sPNy22ZX_+h*6M=4D^?d!Z zK9IG-I$p4*Z>$y~6K+YrQgN06lML(jc<9HP&3?3w)G_0qovzD7wWTH4g;g*!! zf^2^Tnit9x$%ix)Gd%g7EGen6Elxi| zB2T-otQei~Ny*D}j3d&ePeS)`82G{);+Mt!F%4@cuQX=iZ0rLf&jg~H);Lv3P4#-D zu3T-c?w>X5T-NDb-YHV95v|c&{h+MI8AXvn<%8{z9ax$;G+e>Nu@U*?1?R?fgOX>yU!i8=OT3tcI=e6 zC>zh|WZV6sEe_-Fs{FQo|2Tc?K*DGixffb=IJkI7%xVE26|-5aT?f|3?jEv7oX!^s z<8eKr_y^@8hDoqwfT_;6_AX@s6DQWln(>Ex{kp?;StV6lno`Z;Ubu^UiS|4Lt4pyT z(TBEiNW{M{ZHB(79GedEtvEs>h6Zj@*)fe=+u$(H6FfAW?j0hB#*eQ(hv~8N$L$D{ zt1f*Dvq2~#*MIMFmtCdFcpu+aP% z>>wY_=E)-y@lRB#J4eFPohfMuJw_1xF8@>>$6oVr;Bb=pB&b?wp{m4#M>7k=nOJ|K z8S3n2`;TP)>jt8jN6#mEC4K4qtxUoQkzl=MM67d|S=rG?tJB(-%2PtHj+2g8uyCj~ z$^uK{-8+v~lSTNo1tsLq@vO_?ZY*ty)arBym_CyeC+_Vc6@`yc_XPhmzQ%E4wN7NW zPGs54tk^U47?=_nm=QeS!%D^&x)f|n!3cU;+Fsh;n}ZdIJ_qsUITu830T_Er_25b@ zevRYq&c#)hfE^FUR941G50wfOrAZf+i3DG|BuNflE9Vj=gzl6Hh>{`oDE*P5PLZkr zPI9G7as{Kx(x$>Ar9!mP*Fcy%A4fIr60TuhAot3Y0Agmat1h8y@@9iSwc+Zq%(+Ia z{Ksic=l$!l9d5L^5rq159=zMs=p3>SY|o3{r-9u2y2S1&_}Y`$N6l{1Hr~wPeNS ztq5GTcPCp_V`0tAG)!qvA7PkZa1u8|?kq?kPgM74xnO?SEELT< ziTt;NA~Zd@8gF8Fs@YKZYw_~kJYQBYJg120BV&IIbDoSfwyE#sfp`b0Bw&3;)6tl0)(0_9UA%JU)iH0#Xce53uR?FY>*=eg`*>A zFw}z5JI7$)@H}OYHf4!KeEFml=^@cqL6x7NeImX_(S)c|>!Ifpa>gj>N<+%3HC^P z-v&FFx*)~hSQY=GPbYh}XoYh6eBQ0(IH4DzqW7a~*kycM_iU=DpRF%z3m5;>On$>w z?Q&JA(OI%mdt6uPauwzKAMgKsv#<1j#We|AsX<$*a$2d(vzDWlR@IXwHK3F3X6O83 zZsG5cZtlNYeeH{v)eRc=lNKHlB~L>AgwxR0L|4x2No@=gEzBG$h(F5RXD#{{Arh9Q zb%$4I!Y#h!7Dnq5DXH6FpG*X)!sf0;;7$?ivZ_Q@=aRh?jdDPdD!%RAdi+g@vTG^{`D9@x&472mFPd!pIyDRsAgervh zvY+SvdD(|={3DtqYcl0T{5VQ8C2qy-ePff-A)g~{uvJRaD@eJAHkR5$l_d3`nt)9V z%Ft-hY?2104&d$1;aGV?18I-RW70}y>ToViA6*i&;oX&`lL9#u&b9 zY!zD!ZebZ~dM|*jB3{oSp@djriy@?xTVEw+ew=J&hLmm!CA3h9lwL%{g4n>N`k>ib z5;}GF2sH-YUzSX_SDNe)_=Y>>2*F@!k=hEAoaw%OcFh@RKRiB=?e?&pvK+^XzRggfz)YaLLqMk^jrWc)2C<%%cWrFca;a^0fV(p3q(Ra#qsV*A1GuD8o(@F>w)-R*iEJn-C*rtl9*sX#yrGZek-TmbeOzO9kGq z5Hds+2A69VGqfZr7Bgf+2>b0q5<$#(*X!INkP2*L!wSjVqRkD{-zY7R>I&CSgA&x{ z?f2C0EVf#mm)dyb(18wjbtc4kX%k>LDvdZ7oBnt#$V6ES7W^wfkRsT)JAWvk%*4Rj zNK3}I?SYnv)CcT@vh6fO)&1s^ug%>B4HuXHy+!zCA`$35G~0WH)PyQEdPKk4Pv1CB zO#>e{zb{Zi-TZ1YUsRDpKL4VbkQerd5E^)~MXsf6!KRsMt2hfspji#*u5ktY4t1=H zVN^-LTZJITkfDEUnLr-yZjoT-_zzEcw6Q~M3CH0UU2Tbgl@{F7B<;#{0B;s@ZHZDK zuQZq!&4Niyf!{nQyG6wTny8UiyMVk|hJQ9Y2MJ9s5G;-;*UsjGNww@V0PjLvJ7G_v z^Xu=u+wHR+-OKa9WEpdkB}U;5kfl;~KQZb$oBrPoz+K2F+C{D@JR`;r74 z23J*}E9YhKtN(De{)cln+7Rdm=dK*w)#C2-@gMI0aN3v9Om5M+mk8Kt!Cn7{v!8nl z*}X(-fO{guO=zLVWB&xaq$*ksHR|&0C#ovgt<_}ZMh>d8;hej%6>srI?o+pv_ODxe z8^Fj7>_*Pb=0+}V6J~%LY)}pCngX04(;DvjCl%ba^{>u?e-g>C*Ao4kmjQ0j56w$A z)0>W$G@T37f80D-I~!!&PcT+8W21-Jyx=aChTZ3je{2u^*_knWo6UfSxk8N0tK*I= zoA(1hRttrh>SDgFqqX34f@MqRak|X&WKlJrzH8IHx&`>5sDBNdNG%k3M`4K&~}F&-$S_ zK%W88^TSJ%UV1RWQ`bIvFsTj8m;d3V?;H;4OT>05Ak_qzp+{&lJm(u8U>#}{;XcnG zGYsl66?DX_Lm*~nje;yZg_Gv5ZjU3bYkimj7)K>^} zO>4-X?P&z|5;^Hp1DQ*S?qd*I9Q#o&fPJ+42c_B|9lN;9 zAbl#(VliuMUm(gdvRx-tHV?c7yGcW!9h&1I%9wnnEW{Jpm#jy@}@D_R%#}8cpKxiq}M(P~@t7U$) zjDvIsM@h_r6{^6~!JLI;ASxA8x_DdXV-RxOcG5okCtD9oq9H$>W|(_qfZ4vsLm?f` z28nvyCM22bdDv(sif5ksnk+jcK1aShHy)R@adb0bWORFiu{FqEJ_)F9?{ zy2K~7Y*o-HL}J4z38i3&dL;p~<+&j^V#rFpY*y0m>l2e3UB zDNxF95bX)j)@i~@qTFQ!Q-AU32>RTWQdu6GUTT}*AIgeO;C$>N!M#%nW&+?Lsrn7(^fThZ#%j>OwLV zt+S>Na~Fv%Sh7_8=g4Bq4DgsDlW5SoVII%*mpLoVHaho$_Vq*0vKR@n$o4<>n`<`R zoH@+04BfD%SDTYiT|+Wz9;gT4iprZcoFs-L|B{Xkx85@Tm@G?MxJj<&|I`>&w0`51 zSu)p*Dz+g=Fa9T)>|adDmo^EgIf6n;U??B3Qn8@xv%7-sT&DT6lFr)MEaMKB{0;cJ z^L3z2MgxK>mB&$+-oUS+NZ*jiPyR5Kp+$`& z6fJB~l)ixl_R9(&av3PTbI}d=A1${J>>{jO1ZTImU&#MR7de6#(G_6bD2-xe8u9xI z)WF`pNt~mNOw6^(&AG{~iF{{SqCBF+Rqt(?KG#VRp|oEV-!TBbdxspOraB<-!0g)< z(l1Zi)<1^05T7wwPq-ZR1ybsNWNzU{=Ay+`at(7?LPQ+Yy}2Q~{7L;5LJ;P51+5kJ z51Ezcd)gdf7{+PU5-2EMKiv?F2?}l(|G+Zm6pa@Iu9m|iVP2eIdBr*Q5YYi}y##_~ zm|oSxLOjp&S>|q7o3qYZmGW zh7FCw#-#JNM+jtuSK<=YHU=y=Zn*=Tha*`}A4ve&k-I63 z1CYMF5qfSjn9&f`I{ZXs=(V_14&sIU_eKH{->z)izLPDJ9m|+c%CyU+#cdAqF~lt9&_}N7Y3s$s`jNgL z)3`JQ@Z+#lY;O|@E#tDba>{Bc?h6q$wWU#A2TIRT2fv+L!ld%7To zvLN;&@XgH)=7!`eWhFy9Q!VbZN^r7=`(9r{2m#q}3~lBho*}pxWLY=p#24F~-6x8~ zRUy><1V$xy)lW17tr}}cAq^R#cDL?>Q%#RrJpWqUW974aTk^E5&M|y0-sXbNY9We0 z(DaS7z!;gJR$z>bmjZG}`bJR$737+SM=c{Ohez2Eh?O2mqyZiYqL$aW58q*`UZQA&Gi{r&Iw=JRM_#HvMr~1D+T(v7T~KzL-E?O0n!r>nPu)Q?)2xn_q85|MgP7 zXuNilfPf>1UkRtG5Pju8jA+n*_t`j>Q*DjNAx6cs3RhPjRJSD8u;E4eonx~q2%JUBRQ~m`d2dGgn+}MMRpQm zXB2pa?otz(HVFQe;rpiwlMV$dGN2ohF&4fwi>2fZm$fvj@t?D{5HLNzhZF=(?LX}a zBV_jT0U^`nVA3%lS(M-vbCD`N3+Tu-%mPqgi&UNZDKa0~_~USznB}(uA}84htd1*U zqSG9=*CV$SAtO1NQiOW@6kbW!qYnJ!zZ%tXM#k7k=1b^{=tz8_Cp7g)fR<*!=w+hE z4|xiPB+z?uLK@sJDaMmkN!i)ax&CWQ|7odTJjVhvcd0Rw59I}B|MlZ~SJ0lz^nx>Q zte#ICr)w|}iI*9+41-?_VzcvPqtxNaEe(*G{3}U6cIX0X19<=l_7)gSnEK$*2-sfl zWnvot%`z#C*kHVd&1R&dFks4Rt@@wy)TrO!ECYJm3$5Sq6;PWNbRKNbV2Lz;&}$lw zWXWQ*RI34(u~fS@+-Lg3?zUQuE2mN1RgG*=#xP%(i^?B%b4=; zSq&htKXf5M*UErVPhDLS2-~D)uV5PQ?8m7>7b`g^hf2GDuP$z!b!* zfXt2bktX4TbL?TKRmP2Br)}~WD{f`b0DhKPnlnJ+CXaZE(x7 z;e?z(J?7XSd=G#5PabwqV}yPm@P9*em24$Z_;<6;(Z=$1g&Pdw_>-4_gkxtTeZ+oN zh~8xd@ePyvlM0Pwi-aS{wa&|J8;#S&5pw+6Q1jZkr4H47dm8+p>sx>bZ;YIRh!yFN ze8mEq+9lbI61RpxRd);k%67htFpu7eJ~IH;-32<)|1rNR`$9 z-JdoDTI>mo-ult_sNN=^SQ{b{7)q!FU;zh-5;pmMnfa!*AQ9u0m$-p%4mF@aA$HrO ztUNG39Evk7W$b|xfl|8FnPq+~$C%R@r|8=Y#|Z|ofeAZL#+mZM>LcEcev;hCn)`#_ zVZvI$W<^ZX>_)o)kgPfJ-v9u3f}{oA3_%SzQe4aKJv5wUOYDN<9-0k;| zBW%dU%BY0ITVejazxVz$;AHSJUHEJej|s934^%4gXBGpCKL*oGW_~3d8DR7Wh#xE~ z1H=v**dxeH0UMFr4vmx^mp5ZOx7atRSE;4`qKi2XAXPRA3(Mg%^;aHH!;VF$FGvc_WAksyJntLD4+%5RW4$AU&>fPx0aE$wsGtb*^ zM(30IdKhN4>)ag|!i`f@q^w-gab#)ond%Or~S|{*r9`+Gx_6`p+Lb zx`sL^CUz$iTRIXaB|0Z36l2??@l8#M<7DmQWwO!D>7=%<*h!nV$xGSTwghS?Gr}}( z$29H?0w;F0<0~O1w<9JucEMxa>dCHPyV^y84Wy93~LJ@Mfe+BYH`kqB=OX=xCEy*wPn^~|8vRqu$$wPZsX z4c9pq#(&W$$rclCVBXJsgMNSeDM$l=QGx#d&+7ebW&Xci|34@9{@;cCzc)kwUnLy= c90UCSY>ifs1_S>u3GmMy^y8Pa{}=i{02^*|r2qf` diff --git a/Solutions/Claroty/Package/mainTemplate.json b/Solutions/Claroty/Package/mainTemplate.json index a61d4f7df98..20e77100a01 100644 --- a/Solutions/Claroty/Package/mainTemplate.json +++ b/Solutions/Claroty/Package/mainTemplate.json @@ -144,18 +144,18 @@ "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1c2310ef-19bf-4caf-b2b0-a4c983932fa5','-', '1.0.3')))]" }, "analyticRuleObject6": { - "analyticRuleVersion6": "1.0.2", + "analyticRuleVersion6": "1.0.3", "_analyticRulecontentId6": "6c29b611-ce69-4016-bf99-eca639fee1f5", "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '6c29b611-ce69-4016-bf99-eca639fee1f5')]", "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('6c29b611-ce69-4016-bf99-eca639fee1f5')))]", - "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','6c29b611-ce69-4016-bf99-eca639fee1f5','-', '1.0.2')))]" + "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','6c29b611-ce69-4016-bf99-eca639fee1f5','-', '1.0.3')))]" }, "analyticRuleObject7": { - "analyticRuleVersion7": "1.0.2", + "analyticRuleVersion7": "1.0.3", "_analyticRulecontentId7": "3b22ac47-e02c-4599-a37a-57f965de17be", "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '3b22ac47-e02c-4599-a37a-57f965de17be')]", "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('3b22ac47-e02c-4599-a37a-57f965de17be')))]", - "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','3b22ac47-e02c-4599-a37a-57f965de17be','-', '1.0.2')))]" + "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','3b22ac47-e02c-4599-a37a-57f965de17be','-', '1.0.3')))]" }, "analyticRuleObject8": { "analyticRuleVersion8": "1.0.3", @@ -1296,10 +1296,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CefAma", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CefAma" } ], "tactics": [ @@ -1310,13 +1310,13 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "IPCustomEntity" } - ], - "entityType": "IP" + ] } ] } @@ -1400,10 +1400,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CefAma", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CefAma" } ], "tactics": [ @@ -1414,13 +1414,13 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "IPCustomEntity" } - ], - "entityType": "IP" + ] } ] } @@ -1504,10 +1504,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CefAma", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CefAma" } ], "tactics": [ @@ -1519,13 +1519,13 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "SrcIpAddr" } - ], - "entityType": "IP" + ] } ] } @@ -1609,10 +1609,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CefAma", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CefAma" } ], "tactics": [ @@ -1624,13 +1624,13 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "identifier": "Name", "columnName": "AccountCustomEntity" } - ], - "entityType": "Account" + ] } ] } @@ -1714,10 +1714,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CefAma", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CefAma" } ], "tactics": [ @@ -1729,13 +1729,13 @@ ], "entityMappings": [ { + "entityType": "SecurityGroup", "fieldMappings": [ { "identifier": "DistinguishedName", "columnName": "SGCustomEntity" } - ], - "entityType": "SecurityGroup" + ] } ] } @@ -1819,10 +1819,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CefAma", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CefAma" } ], "tactics": [ @@ -1834,13 +1834,13 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "IPCustomEntity" } - ], - "entityType": "IP" + ] } ] } @@ -1924,10 +1924,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CefAma", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CefAma" } ], "tactics": [ @@ -1938,13 +1938,13 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "IPCustomEntity" } - ], - "entityType": "IP" + ] } ] } @@ -2028,10 +2028,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CefAma", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CefAma" } ], "tactics": [ @@ -2042,13 +2042,13 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "IPCustomEntity" } - ], - "entityType": "IP" + ] } ] } @@ -2132,10 +2132,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CefAma", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CefAma" } ], "tactics": [ @@ -2146,13 +2146,13 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "IPCustomEntity" } - ], - "entityType": "IP" + ] } ] } @@ -2236,22 +2236,22 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Claroty", "dataTypes": [ "ClarotyEvent" - ] + ], + "connectorId": "Claroty" }, { - "connectorId": "ClarotyAma", "dataTypes": [ "ClarotyEvent" - ] + ], + "connectorId": "ClarotyAma" }, { - "connectorId": "CefAma", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CefAma" } ], "tactics": [ @@ -2262,13 +2262,13 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "IPCustomEntity" } - ], - "entityType": "IP" + ] } ] } From e43ec0cc1bba540afe0f2d20128ab2ef6f4a7335 Mon Sep 17 00:00:00 2001 From: v-rusraut Date: Tue, 19 Nov 2024 12:29:26 +0530 Subject: [PATCH 3/6] Repackage - Forcepoint CSG --- .../Data/Solution_ForcepointCSG.json | 6 +- Solutions/Forcepoint CSG/Package/3.0.3.zip | Bin 0 -> 5519 bytes .../Package/createUiDefinition.json | 26 +- .../Forcepoint CSG/Package/mainTemplate.json | 758 +----------------- Solutions/Forcepoint CSG/ReleaseNotes.md | 7 +- 5 files changed, 14 insertions(+), 783 deletions(-) create mode 100644 Solutions/Forcepoint CSG/Package/3.0.3.zip diff --git a/Solutions/Forcepoint CSG/Data/Solution_ForcepointCSG.json b/Solutions/Forcepoint CSG/Data/Solution_ForcepointCSG.json index b0c17a53e20..32913d85777 100644 --- a/Solutions/Forcepoint CSG/Data/Solution_ForcepointCSG.json +++ b/Solutions/Forcepoint CSG/Data/Solution_ForcepointCSG.json @@ -3,10 +3,6 @@ "Author": "Forcepoint", "Logo": "", "Description": "[Forcepoint Cloud Security Gateway](https://www.forcepoint.com/product/cloud-security-gateway) (CSG) Solution for Microsoft Sentinel exports web and/or email logs so that custom dashboards can be created using Workbooks to visualize events and insights on activities of Forcepoint Cloud Security Gateway.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/csg_and_sentinel/).\n\n This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.", - "Data Connectors": [ - "Solutions/Forcepoint CSG/Data Connectors/ForcepointCloudSecurityGateway.json", - "Solutions/Forcepoint CSG/Data Connectors/template_ForcepointCloudSecurityGatewayAMA.json" - ], "Workbooks": [ "Solutions/Forcepoint CSG/Workbooks/ForcepointCloudSecuirtyGateway.json" ], @@ -14,7 +10,7 @@ "azuresentinel.azure-sentinel-solution-commoneventformat" ], "BasePath": "C:\\Github\\Azure-Sentinel", - "Version": "3.0.2", + "Version": "3.0.3", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false diff --git a/Solutions/Forcepoint CSG/Package/3.0.3.zip b/Solutions/Forcepoint CSG/Package/3.0.3.zip new file mode 100644 index 0000000000000000000000000000000000000000..90eed2397a63b6d1144e69940272988e10d05133 GIT binary patch literal 5519 zcmZ`-XEYp+vt0zMN3W{{(R=TGiMog`SS>{FL?mkTx}x{qqg&nTM33mb_vnHj`|^A5 z)BC^kWlC@|3$6bZJ?eudiIJo zw)W2Up7t)z+#ft#oU09;T$Y7jK1*95gQkQHg&o;OgdKr%_(n;#=t)f~Gq(yfB#nwc zOj)%V*(99FExK)FoVu-jW~pr!?b~Zuv7;qvf9Lq0g#{pY$wPh3kL?gTM<5~>sCo@S zU#%&YPR4X-F{c1ZfB`F+B7gO*C!G8Q6BA}y$NawX+>r0XLghY-? z@AEwW<0$oVJDFfKx~}g$dVKP%yK^vOaLK?T9EJg#{hjMt@}cyqAKcJ&(m-X?BS>I2Y}c6eJ`L$i^|p^mSLdkHT3L;gGv zcfP3kz51oJvpro6pt{Z8iDgKhjIY&FJ0ETY6WBP2sxj%)uhipp>E}{uO>!el=j|;d zeh12C+MQ;&K#7G~QNGYhd`+nm%MQJ3eG7(>W)co(yey*s4X2lXO%;rR4^b$Pr%q2w zI~q_&9TAGO`zi_+&bHLC3*C-=>m$JSTkvDoPFr4Zw^bLA*yxuYYW0yTyuFM zfj=2Af?y~g8e7t<6uuA&AVeG%#uhTgTZMweXslDzZm0TD*7M4$+t?cPmIK3`GPnw# zF}njjbA8Sc7(VxcKFOc*pE#q5dWxbcj-7`(b=^OHQJ)K~*kl)IdemzUL+VQ>0qm-A z+;OfPR*8voe}MIP(p4`p7-ca`F2KK{aDueUBGBFPGGr0_Ks$1nYQH$$+w$kF2NK;* zn=ngR&K}^_@o1s&{Mh!=*bI~RWRsi^)fEHh%K~;mBCZz^vaQ9VjvC;?!dDFIXYnJ5 zHH1&0whcsquJOZq$*@=LR*pJJ=8d_Ut_-cr%8txA^dL6-vN}55 zq&s^QKQm93tfwMXmD|tMJC52Q7#?tlK1+<#&}ByjU069;YdfYVovducHUQ*L*!K(0 zgjuP92BQt2m1yeze|=4u(VOw~z41`dzJJh!dUIP`9}SHX*&x&}T(eyTZJ6 z%GKy{4H~lU5>$C-w6vKO9<0OE!%c!VEM5u>H4-|QsH^T^x*HuA zrbRkTKm3&Pc_q-o>eG>nMb+To%n6X-e31i%oizO#KbsDLS}t@RHZ^72`{K=X%MP_3 zgA)A~v;09gzcxW$W=<34Z9ya9sV~OBIIrF7Q_$Z8_MH0S-s^O=#(2$@c}WrQ(-gGC z$f1a3pzZr~jtss?f%0-OLv>Yzl0w zAbpuO32hpjuVm4NF>~LI7uJ+o8BlHII>{Zh)(L^C4@w34X#GP$#Y^l$=Jxv1@g#lo zJbTc@O;?NaSZp+4Q6@XT@8HG_)s=2jwW|Q%`DEYT%wTWz z&&}5Ux9tSN6)DrK>AHZ7xfT1Gf)U~o(0kkc@Sx{^15dNi9C#b#iTN@`=$G^n--(-49?clL2 zeChxGfzI`4bvTER`G@_I1JV15CfF?TK40SUr&>uYMR_8JBnyE~fNmZdR};xUXjXGVTP z;Ntz zz1e3R{JJ%AiMNpc>K4OgR}!TN;zQCIucA*WM!wmJhM$jbQ_LEEHf^u2u11g7&nucS zE`D%XR^6HRmVOH;WXI4v#08Owwv*Y9AyPsKuQ_8WcRkssfT*loDzC?XM3#*<6{xdz z(twk$Pt^~GtiY8oO5!u~1%I z^->@6Og8OggUt?wHakdsFo{+`m{1f=BC!+`0aq*Z^yv!J>-;N6>vd%^o{YBi!nDaH z0f*jw&8X}%_oDV=ow$aQP0xdRH=He%_opyx!&Fnssin!Z@Agv4{TA(}zDXyZ*~GV6 z*f|q>!33P5zi$&*z@09``40EneY-rIE1lUPQi+~O}?qC1j|vUEr&Tz zj~bxSzJQgfvnH>SvudnjGS?X9h$xsUOPm1i7mKx=2TAT5?|DmqX`XY*@;{dwIncxY zg+fQ+wFucUqaCt2+8uc6e3EE$j8O&G=+vLfj$;$!hUh2zPX~SwGToOv7@v0Ey(P>S zq*v-SCsB(nyW8IZsW2^?ffqDI;-hdsRjQjvlQ$t}McnlEbvhM^qNdvC&oJa#fs+8T z99!YjYwHM4lqpxC{jbzH4-HE-vLmBC=IIIF0`!LeVRTKTAFey0s;dapNSuAGJZ}-P zt698mKjHe*)=qCqG>~a`!*jlw$xnm3u?p0Sz;Ssy#bM)qwMIc~NZ#e-20<1r6$ThPZyYTRy=0+;e-syv2d;y% z`sbioJf&v@3RV12?4@a!Jww{fie+FFl||3UFgr$ImxH!w1w60SZ0v5@To9xjYT$>@ za4#XJ+{oT9$B8^UDH!nrzRL&NZ~`C{N2H81mD=e^6qf3&zuf3Q%vLx0mi+3*oD|+p zGuYn6DAY<-(_J#lAla-;HkbjCrpbRF=a`9!i3ofej&VS{5_|WL3Z*M>Qa8)3phpoL z_emxK8Z;XH-mu?8>E@gFK(2WBMmqu^KFBT1M4~&w|LC+ABbxc?Vuq3D8f0S*ntTlp1EuSnhQ!hg`R& zDug#sGBy;4$5oid+E`=cU&hFa4&Vt&HDYVq&N60blQmAk1y~FLSJ=WSu9ZMiL58TQ z?PTjWA(#rg#rsjRVX{hC3C0TC?MJ^VznLLpB#~%K_gFfJB~IiMQa1&;sg{CF+I9K1 z(Pe$Vmdg1hlal}$XXh7CX-%+9Z%g#)4nn8R3G=^Go_c0}(}wI8>X;q*rhfX`g*sL+ z56qsa`YwmYM8$9B>vz|T5vd#D!!;K7Xi1rqr+dH8!RhHD2a!I~3+T$mIm(dt)(56sAFG>;w`gK5vCVUNfw%z4%xzS>yPkkK-<=ku0&Te<@rzk6#CD8jdYqYRfx`7m zyl>9Uo`Q>h!1ks6+bRk{vBHF8Hw?{N`(q&2?~xxodi{g!1)EgJrf-V8Qmg1DrYboU z<4)aoir;(Al05^^mW6kd?Mj}i&Yk}LIcWyOzns0D77$P)+wxX5s7ZaIQ`i-PsSqX? z2OSzvk6*fRcoer@0$f3Pl@<^5M)7ws257kHf85GHMdB2<{Ph`x~aNr+dhSR>! zlo-A#xs_Qnnb8`#L3m@H-tA80NPo5FP*_v=sGBfAEjG7r(C|2%d9=Zpxi5~a~0&;(m0$%iT|-v5kx z*~}uQv9h74NZ_@3Ky zC#2)}D->lZ%SkQGpg5)}HaY$TJ&$xtUKqOEBX{AwcoC=HS$qn~DL?8??0gbZ5&KTB z<;143HE^k#=*e8p<3cMfV}@W2jY$}?$eyDte|k~=LraR&nDmRUe3%{RVu7hXaOILX z>D}k%o#7wsl`94e_bc#E_mqa>V`yr%eUCAwpu|I#9p>wYR~rlC2IEA-U#`ysj2KEQ zIViQ}nS^l~ww~o4OD2?n%h~+lkldEZG_JM5{)26b!kD*|%kW+}d2q*gu(exmjZwVw zmuBbk`R@*46ppCPf7E4A@6hJ7qkqAjAK7@U7NZr^$Ygf7=bXMrR&{xM>iJYZ6z6*> z^A6Orgc> z$v)7-gYarDg9$A~D)qZR)y|Hu-`>eepq0fkuj^2(O+w?JraI(~eubcXHnciZ7ixAd zYhYpOA?@ma$|5*f`*}IZgVV<9xrw4%#!^JLi>va0uZdGkULnGnvQNvtoH4$PeJUZm zY|2Fz{XF}o##8^um$u)X_@$e!s-i$A9)MQFS&(E~BCqe=P-WXETDXhW+DLFhA$mIf zf)5@bstnBTxFkwJso0A;P@x4hVUx~~2!*5qtMQHw; zwQRCzPU@22<vOw1SsWJ&l<@vLvo46uum;An!Fdv0FPE) zN#%*2=@=a>ifhF^HeeHj@+y-={dww?$k!WWyMuFOb!O;vMfbRFWd0wZzEJtaL-w!yVUJq+=%oH98EeWLQMVqY4s8$IT1O=es;f^qPKNK<*Aoyji(AfuFYSr z)l1#%YsYC?m4j#2c11%NYYQA|%S~#_)y^+ggQ!xE+fW>C?@n_r_sD(?IZEP&nI!K$ zG_oT77r#6xcT@ae%vrSlrDb8w;Qc+cC*CX=A z;2ik{08v9hB?0{Zw&!1&20#JO|6BgX|6_vw=aT;vdjF38&l26gj_UuBeGoNtjDK5D O|7Pgldh_o&fd2wq`f(Hh literal 0 HcmV?d00001 diff --git a/Solutions/Forcepoint CSG/Package/createUiDefinition.json b/Solutions/Forcepoint CSG/Package/createUiDefinition.json index 6b2d3203f75..576d6c7e87d 100644 --- a/Solutions/Forcepoint CSG/Package/createUiDefinition.json +++ b/Solutions/Forcepoint CSG/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Forcepoint%20CSG/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\n[Forcepoint Cloud Security Gateway](https://www.forcepoint.com/product/cloud-security-gateway) (CSG) Solution for Microsoft Sentinel exports web and/or email logs so that custom dashboards can be created using Workbooks to visualize events and insights on activities of Forcepoint Cloud Security Gateway.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/csg_and_sentinel/).\n\n This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.\n\n**Data Connectors:** 2, **Workbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Forcepoint%20CSG/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\n[Forcepoint Cloud Security Gateway](https://www.forcepoint.com/product/cloud-security-gateway) (CSG) Solution for Microsoft Sentinel exports web and/or email logs so that custom dashboards can be created using Workbooks to visualize events and insights on activities of Forcepoint Cloud Security Gateway.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/csg_and_sentinel/).\n\n This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.\n\n**Workbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -51,30 +51,6 @@ } ], "steps": [ - { - "name": "dataconnectors", - "label": "Data Connectors", - "bladeTitle": "Data Connectors", - "elements": [ - { - "name": "dataconnectors1-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "This Solution installs the data connector for Forcepoint CSG. You can get Forcepoint CSG CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." - } - }, - { - "name": "dataconnectors-link2", - "type": "Microsoft.Common.TextBlock", - "options": { - "link": { - "label": "Learn more about connecting data sources", - "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources" - } - } - } - ] - }, { "name": "workbooks", "label": "Workbooks", diff --git a/Solutions/Forcepoint CSG/Package/mainTemplate.json b/Solutions/Forcepoint CSG/Package/mainTemplate.json index a8d9c59bb3e..3c6caab542a 100644 --- a/Solutions/Forcepoint CSG/Package/mainTemplate.json +++ b/Solutions/Forcepoint CSG/Package/mainTemplate.json @@ -39,27 +39,9 @@ }, "variables": { "_solutionName": "Forcepoint CSG", - "_solutionVersion": "3.0.2", + "_solutionVersion": "3.0.3", "solutionId": "microsoftsentinelcommunity.azure-sentinel-solution-forcepoint-csg", "_solutionId": "[variables('solutionId')]", - "uiConfigId1": "ForcepointCSG", - "_uiConfigId1": "[variables('uiConfigId1')]", - "dataConnectorContentId1": "ForcepointCSG", - "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", - "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", - "dataConnectorVersion1": "1.0.0", - "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", - "uiConfigId2": "ForcepointCSGAma", - "_uiConfigId2": "[variables('uiConfigId2')]", - "dataConnectorContentId2": "ForcepointCSGAma", - "_dataConnectorContentId2": "[variables('dataConnectorContentId2')]", - "dataConnectorId2": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", - "_dataConnectorId2": "[variables('dataConnectorId2')]", - "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", - "dataConnectorVersion2": "1.0.0", - "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", "workbookVersion1": "1.0.0", "workbookContentId1": "ForcepointCloudSecurityGatewayWorkbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", @@ -70,724 +52,6 @@ "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName1')]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Forcepoint CSG data connector with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion1')]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "GenericUI", - "properties": { - "connectorUiConfig": { - "id": "[variables('_uiConfigId1')]", - "title": "[Deprecated] Forcepoint CSG via Legacy Agent", - "publisher": "Forcepoint", - "descriptionMarkdown": "Forcepoint Cloud Security Gateway is a converged cloud security service that provides visibility, control, and threat protection for users and data, wherever they are. For more information visit: https://www.forcepoint.com/product/cloud-security-gateway", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "Forcepoint CSG", - "baseQuery": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint CSG\"\n" - } - ], - "sampleQueries": [ - { - "description": "Top 5 Web requested Domains with log severity equal to 6 (Medium)", - "query": "CommonSecurityLog\n| where TimeGenerated <= ago(0m)\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Web\"\n| where LogSeverity == 6\n| where DeviceCustomString2 != \"\"\n| summarize Count=count() by DeviceCustomString2\n| top 5 by Count\n| render piechart" - }, - { - "description": "Top 5 Web Users with 'Action' equal to 'Blocked'", - "query": "CommonSecurityLog\n| where TimeGenerated <= ago(0m)\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Web\"\n| where Activity == \"Blocked\"\n| where SourceUserID != \"Not available\"\n| summarize Count=count() by SourceUserID\n| top 5 by Count\n| render piechart" - }, - { - "description": "Top 5 Sender Email Addresses Where Spam Score Greater Than 10.0", - "query": "CommonSecurityLog\n| where TimeGenerated <= ago(0m)\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Email\"\n| where DeviceCustomFloatingPoint1 > 10.0\n| summarize Count=count() by SourceUserName\n| top 5 by Count\n| render barchart" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (Forcepoint CSG)", - "lastDataReceivedQuery": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Web\"\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "CommonSecurityLog (Forcepoint CSG)", - "lastDataReceivedQuery": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Email\"\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Web\"\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Email\"\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "read": true, - "write": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ] - }, - "instructionSteps": [ - { - "description": "This integration requires the Linux Syslog agent to collect your Forcepoint Cloud Security Gateway Web/Email logs on port 514 TCP as Common Event Format (CEF) and forward them to Microsoft Sentinel.", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId", - "PrimaryKey" - ], - "label": "Your Data Connector Syslog Agent Installation Command is:", - "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}" - }, - "type": "CopyableLabel" - } - ], - "title": "1. Linux Syslog agent configuration" - }, - { - "description": "The integration is made available with two implementations options.", - "innerSteps": [ - { - "title": "2.1 Docker Implementation", - "description": "Leverages docker images where the integration component is already installed with all necessary dependencies.\n\nFollow the instructions provided in the Integration Guide linked below.\n\n[Integration Guide >](https://frcpnt.com/csg-sentinel)" - }, - { - "title": "2.2 Traditional Implementation", - "description": "Requires the manual deployment of the integration component inside a clean Linux machine.\n\nFollow the instructions provided in the Integration Guide linked below.\n\n[Integration Guide >](https://frcpnt.com/csg-sentinel)" - } - ], - "title": "2. Implementation options" - }, - { - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python -version \n \n>2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId" - ], - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}" - }, - "type": "CopyableLabel" - } - ], - "title": "3. Validate connection" - }, - { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF).", - "title": "4. Secure your machine " - } - ] - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", - "source": { - "kind": "Solution", - "name": "Forcepoint CSG", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Forcepoint" - }, - "support": { - "name": "Community", - "tier": "Community", - "link": "https://github.com/Azure/Azure-Sentinel/issues" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId1')]", - "contentKind": "DataConnector", - "displayName": "[Deprecated] Forcepoint CSG via Legacy Agent", - "contentProductId": "[variables('_dataConnectorcontentProductId1')]", - "id": "[variables('_dataConnectorcontentProductId1')]", - "version": "[variables('dataConnectorVersion1')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", - "dependsOn": [ - "[variables('_dataConnectorId1')]" - ], - "location": "[parameters('workspace-location')]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", - "source": { - "kind": "Solution", - "name": "Forcepoint CSG", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Forcepoint" - }, - "support": { - "name": "Community", - "tier": "Community", - "link": "https://github.com/Azure/Azure-Sentinel/issues" - } - } - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "GenericUI", - "properties": { - "connectorUiConfig": { - "title": "[Deprecated] Forcepoint CSG via Legacy Agent", - "publisher": "Forcepoint", - "descriptionMarkdown": "Forcepoint Cloud Security Gateway is a converged cloud security service that provides visibility, control, and threat protection for users and data, wherever they are. For more information visit: https://www.forcepoint.com/product/cloud-security-gateway", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "Forcepoint CSG", - "baseQuery": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint CSG\"\n" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (Forcepoint CSG)", - "lastDataReceivedQuery": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Web\"\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "CommonSecurityLog (Forcepoint CSG)", - "lastDataReceivedQuery": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Email\"\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Web\"\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Email\"\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "sampleQueries": [ - { - "description": "Top 5 Web requested Domains with log severity equal to 6 (Medium)", - "query": "CommonSecurityLog\n| where TimeGenerated <= ago(0m)\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Web\"\n| where LogSeverity == 6\n| where DeviceCustomString2 != \"\"\n| summarize Count=count() by DeviceCustomString2\n| top 5 by Count\n| render piechart" - }, - { - "description": "Top 5 Web Users with 'Action' equal to 'Blocked'", - "query": "CommonSecurityLog\n| where TimeGenerated <= ago(0m)\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Web\"\n| where Activity == \"Blocked\"\n| where SourceUserID != \"Not available\"\n| summarize Count=count() by SourceUserID\n| top 5 by Count\n| render piechart" - }, - { - "description": "Top 5 Sender Email Addresses Where Spam Score Greater Than 10.0", - "query": "CommonSecurityLog\n| where TimeGenerated <= ago(0m)\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Email\"\n| where DeviceCustomFloatingPoint1 > 10.0\n| summarize Count=count() by SourceUserName\n| top 5 by Count\n| render barchart" - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "read": true, - "write": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ] - }, - "instructionSteps": [ - { - "description": "This integration requires the Linux Syslog agent to collect your Forcepoint Cloud Security Gateway Web/Email logs on port 514 TCP as Common Event Format (CEF) and forward them to Microsoft Sentinel.", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId", - "PrimaryKey" - ], - "label": "Your Data Connector Syslog Agent Installation Command is:", - "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}" - }, - "type": "CopyableLabel" - } - ], - "title": "1. Linux Syslog agent configuration" - }, - { - "description": "The integration is made available with two implementations options.", - "innerSteps": [ - { - "title": "2.1 Docker Implementation", - "description": "Leverages docker images where the integration component is already installed with all necessary dependencies.\n\nFollow the instructions provided in the Integration Guide linked below.\n\n[Integration Guide >](https://frcpnt.com/csg-sentinel)" - }, - { - "title": "2.2 Traditional Implementation", - "description": "Requires the manual deployment of the integration component inside a clean Linux machine.\n\nFollow the instructions provided in the Integration Guide linked below.\n\n[Integration Guide >](https://frcpnt.com/csg-sentinel)" - } - ], - "title": "2. Implementation options" - }, - { - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python -version \n \n>2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId" - ], - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}" - }, - "type": "CopyableLabel" - } - ], - "title": "3. Validate connection" - }, - { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF).", - "title": "4. Secure your machine " - } - ], - "id": "[variables('_uiConfigId1')]" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName2')]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Forcepoint CSG data connector with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion2')]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "GenericUI", - "properties": { - "connectorUiConfig": { - "id": "[variables('_uiConfigId2')]", - "title": "[Deprecated] Forcepoint CSG via AMA", - "publisher": "Forcepoint", - "descriptionMarkdown": "Forcepoint Cloud Security Gateway is a converged cloud security service that provides visibility, control, and threat protection for users and data, wherever they are. For more information visit: https://www.forcepoint.com/product/cloud-security-gateway", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "Forcepoint CSG", - "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint CSG'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" - } - ], - "sampleQueries": [ - { - "description": "Top 5 Web requested Domains with log severity equal to 6 (Medium)", - "query": "CommonSecurityLog\n| where TimeGenerated <= ago(0m)\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Web\"\n| where LogSeverity == 6\n| where DeviceCustomString2 != \"\"\n| summarize Count=count() by DeviceCustomString2\n| top 5 by Count\n| render piechart" - }, - { - "description": "Top 5 Web Users with 'Action' equal to 'Blocked'", - "query": "CommonSecurityLog\n| where TimeGenerated <= ago(0m)\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Web\"\n| where Activity == \"Blocked\"\n| where SourceUserID != \"Not available\"\n| summarize Count=count() by SourceUserID\n| top 5 by Count\n| render piechart" - }, - { - "description": "Top 5 Sender Email Addresses Where Spam Score Greater Than 10.0", - "query": "CommonSecurityLog\n| where TimeGenerated <= ago(0m)\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Email\"\n| where DeviceCustomFloatingPoint1 > 10.0\n| summarize Count=count() by SourceUserName\n| top 5 by Count\n| render barchart" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (Forcepoint CSG)", - "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint CSG'\n |where DeviceProduct =~ 'Web'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "CommonSecurityLog (Forcepoint CSG)", - "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint CSG'\n |where DeviceProduct =~ 'Email'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint CSG'\n |where DeviceProduct =~ 'Web'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint CSG'\n |where DeviceProduct =~ 'Email'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "read": true, - "write": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ], - "customs": [ - { - "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" - }, - { - "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" - } - ] - }, - "instructionSteps": [ - { - "instructions": [ - { - "parameters": { - "title": "1. Kindly follow the steps to configure the data connector", - "instructionSteps": [ - { - "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", - "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine." - }, - { - "title": "Step B. Implementation options", - "description": "The integration is made available with two implementations options.", - "innerSteps": [ - { - "title": "1. Docker Implementation", - "description": "Leverages docker images where the integration component is already installed with all necessary dependencies.\n\nFollow the instructions provided in the Integration Guide linked below.\n\n[Integration Guide >](https://frcpnt.com/csg-sentinel)" - }, - { - "title": "2. Traditional Implementation", - "description": "Requires the manual deployment of the integration component inside a clean Linux machine.\n\nFollow the instructions provided in the Integration Guide linked below.\n\n[Integration Guide >](https://frcpnt.com/csg-sentinel)" - } - ] - }, - { - "title": "Step C. Validate connection", - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" - }, - "type": "CopyableLabel" - } - ] - } - ] - }, - "type": "InstructionStepsGroup" - } - ] - }, - { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF).", - "title": "2. Secure your machine " - } - ] - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", - "contentId": "[variables('_dataConnectorContentId2')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion2')]", - "source": { - "kind": "Solution", - "name": "Forcepoint CSG", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Forcepoint" - }, - "support": { - "name": "Community", - "tier": "Community", - "link": "https://github.com/Azure/Azure-Sentinel/issues" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId2')]", - "contentKind": "DataConnector", - "displayName": "[Deprecated] Forcepoint CSG via AMA", - "contentProductId": "[variables('_dataConnectorcontentProductId2')]", - "id": "[variables('_dataConnectorcontentProductId2')]", - "version": "[variables('dataConnectorVersion2')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", - "dependsOn": [ - "[variables('_dataConnectorId2')]" - ], - "location": "[parameters('workspace-location')]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", - "contentId": "[variables('_dataConnectorContentId2')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion2')]", - "source": { - "kind": "Solution", - "name": "Forcepoint CSG", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Forcepoint" - }, - "support": { - "name": "Community", - "tier": "Community", - "link": "https://github.com/Azure/Azure-Sentinel/issues" - } - } - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "GenericUI", - "properties": { - "connectorUiConfig": { - "title": "[Deprecated] Forcepoint CSG via AMA", - "publisher": "Forcepoint", - "descriptionMarkdown": "Forcepoint Cloud Security Gateway is a converged cloud security service that provides visibility, control, and threat protection for users and data, wherever they are. For more information visit: https://www.forcepoint.com/product/cloud-security-gateway", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "Forcepoint CSG", - "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint CSG'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (Forcepoint CSG)", - "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint CSG'\n |where DeviceProduct =~ 'Web'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "CommonSecurityLog (Forcepoint CSG)", - "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint CSG'\n |where DeviceProduct =~ 'Email'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint CSG'\n |where DeviceProduct =~ 'Web'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint CSG'\n |where DeviceProduct =~ 'Email'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "sampleQueries": [ - { - "description": "Top 5 Web requested Domains with log severity equal to 6 (Medium)", - "query": "CommonSecurityLog\n| where TimeGenerated <= ago(0m)\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Web\"\n| where LogSeverity == 6\n| where DeviceCustomString2 != \"\"\n| summarize Count=count() by DeviceCustomString2\n| top 5 by Count\n| render piechart" - }, - { - "description": "Top 5 Web Users with 'Action' equal to 'Blocked'", - "query": "CommonSecurityLog\n| where TimeGenerated <= ago(0m)\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Web\"\n| where Activity == \"Blocked\"\n| where SourceUserID != \"Not available\"\n| summarize Count=count() by SourceUserID\n| top 5 by Count\n| render piechart" - }, - { - "description": "Top 5 Sender Email Addresses Where Spam Score Greater Than 10.0", - "query": "CommonSecurityLog\n| where TimeGenerated <= ago(0m)\n| where DeviceVendor == \"Forcepoint CSG\"\n| where DeviceProduct == \"Email\"\n| where DeviceCustomFloatingPoint1 > 10.0\n| summarize Count=count() by SourceUserName\n| top 5 by Count\n| render barchart" - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "read": true, - "write": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ], - "customs": [ - { - "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" - }, - { - "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" - } - ] - }, - "instructionSteps": [ - { - "instructions": [ - { - "parameters": { - "title": "1. Kindly follow the steps to configure the data connector", - "instructionSteps": [ - { - "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", - "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine." - }, - { - "title": "Step B. Implementation options", - "description": "The integration is made available with two implementations options.", - "innerSteps": [ - { - "title": "1. Docker Implementation", - "description": "Leverages docker images where the integration component is already installed with all necessary dependencies.\n\nFollow the instructions provided in the Integration Guide linked below.\n\n[Integration Guide >](https://frcpnt.com/csg-sentinel)" - }, - { - "title": "2. Traditional Implementation", - "description": "Requires the manual deployment of the integration component inside a clean Linux machine.\n\nFollow the instructions provided in the Integration Guide linked below.\n\n[Integration Guide >](https://frcpnt.com/csg-sentinel)" - } - ] - }, - { - "title": "Step C. Validate connection", - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" - }, - "type": "CopyableLabel" - } - ] - } - ] - }, - "type": "InstructionStepsGroup" - } - ] - }, - { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF).", - "title": "2. Secure your machine " - } - ], - "id": "[variables('_uiConfigId2')]" - } - } - }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", @@ -797,7 +61,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ForcepointCloudSecuirtyGateway Workbook with template version 3.0.2", + "description": "ForcepointCloudSecuirtyGateway Workbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -858,6 +122,10 @@ { "contentId": "ForcepointCSGAma", "kind": "DataConnector" + }, + { + "contentId": "CefAma", + "kind": "DataConnector" } ] } @@ -883,12 +151,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.2", + "version": "3.0.3", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Forcepoint CSG", "publisherDisplayName": "Community", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Forcepoint Cloud Security Gateway (CSG) Solution for Microsoft Sentinel exports web and/or email logs so that custom dashboards can be created using Workbooks to visualize events and insights on activities of Forcepoint Cloud Security Gateway.

\n

For more details about this solution refer to integration documentation.

\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 2, Workbooks: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Forcepoint Cloud Security Gateway (CSG) Solution for Microsoft Sentinel exports web and/or email logs so that custom dashboards can be created using Workbooks to visualize events and insights on activities of Forcepoint Cloud Security Gateway.

\n

For more details about this solution refer to integration documentation.

\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Workbooks: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -910,16 +178,6 @@ }, "dependencies": { "criteria": [ - { - "kind": "DataConnector", - "contentId": "[variables('_dataConnectorContentId1')]", - "version": "[variables('dataConnectorVersion1')]" - }, - { - "kind": "DataConnector", - "contentId": "[variables('_dataConnectorContentId2')]", - "version": "[variables('dataConnectorVersion2')]" - }, { "kind": "Workbook", "contentId": "[variables('_workbookContentId1')]", diff --git a/Solutions/Forcepoint CSG/ReleaseNotes.md b/Solutions/Forcepoint CSG/ReleaseNotes.md index 82e91952fa0..74ded5530f2 100644 --- a/Solutions/Forcepoint CSG/ReleaseNotes.md +++ b/Solutions/Forcepoint CSG/ReleaseNotes.md @@ -1,6 +1,7 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|--------------------------------------------------------------------| -| 3.0.2 | 15-07-2024 | Deprecating data connectors | -| 3.0.1 | 19-12-2023 | Workbook moved from standalone to solution and repackage | -| 3.0.0 | 11-09-2023 | Addition of new Forcepoint CSG AMA **Data Connector** | | +| 3.0.3 | 19-11-2024 | Removed Deprecated **Data Connectors** | +| 3.0.2 | 15-07-2024 | Deprecating data connectors | +| 3.0.1 | 19-12-2023 | Workbook moved from standalone to solution and repackage | +| 3.0.0 | 11-09-2023 | Addition of new Forcepoint CSG AMA **Data Connector** | From ddffcc59c24d55fcdce1bb24a4a9e3864e7ca7bb Mon Sep 17 00:00:00 2001 From: v-rusraut Date: Tue, 19 Nov 2024 13:05:05 +0530 Subject: [PATCH 4/6] Repackage - NGFW --- .../Data/Solution_ForcepointNGFW.json | 6 +- Solutions/Forcepoint NGFW/Package/3.0.2.zip | Bin 0 -> 14657 bytes .../Package/createUiDefinition.json | 26 +- .../Forcepoint NGFW/Package/mainTemplate.json | 790 +----------------- Solutions/Forcepoint NGFW/ReleaseNotes.md | 7 +- 5 files changed, 18 insertions(+), 811 deletions(-) create mode 100644 Solutions/Forcepoint NGFW/Package/3.0.2.zip diff --git a/Solutions/Forcepoint NGFW/Data/Solution_ForcepointNGFW.json b/Solutions/Forcepoint NGFW/Data/Solution_ForcepointNGFW.json index 4573578595d..1605df4a580 100644 --- a/Solutions/Forcepoint NGFW/Data/Solution_ForcepointNGFW.json +++ b/Solutions/Forcepoint NGFW/Data/Solution_ForcepointNGFW.json @@ -3,10 +3,6 @@ "Author": "Forcepoint", "Logo": "", "Description": "The [Forcepoint NGFW (Next Generation Firewall)](https://www.forcepoint.com/product/ngfw-next-generation-firewall) Solution for Microsoft Sentinel allows you to automatically export user defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/ngfw_and_azure_sentinel/) \n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.", - "Data Connectors": [ - "Solutions/Forcepoint NGFW/Data Connectors/FORCEPOINT_NGFW.json", - "Solutions/Forcepoint NGFW/Data Connectors/template_FORCEPOINT_NGFWAMA.json" - ], "Workbooks": [ "Solutions/Forcepoint NGFW/Workbooks/ForcepointNGFW.json", "Solutions/Forcepoint NGFW/Workbooks/ForcepointNGFWAdvanced.json" @@ -15,7 +11,7 @@ "azuresentinel.azure-sentinel-solution-commoneventformat" ], "BasePath": "C:\\Github\\Azure-Sentinel", - "Version": "3.0.1", + "Version": "3.0.2", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false diff --git a/Solutions/Forcepoint NGFW/Package/3.0.2.zip b/Solutions/Forcepoint NGFW/Package/3.0.2.zip new file mode 100644 index 0000000000000000000000000000000000000000..300d93b79234aff897485489a8327003f3f84f9c GIT binary patch literal 14657 zcmZ{LQ?Mv7kma>)+qUidu5H`4ZQHi}u5H`4ZS9+xs@>Vy+N3M#R66-RUESx%O96wR z0000$0BD;!X`rQ{kPm0*5ff7jTMK6kJ6k$SCp+6=^-J5$ zG1MQu{96WjEp;Y}iThS_0~W3Fh(n#e89F4lM`5NwM9$(;JjcJx!jwBK0(m8It#XaK zn7Sf=l2>Kg)CnM_GMG<4a)_#@@~XV^(HRUkur*WCx;8c~CRPbjJKB zVjzffmfc)k(fFWe%R&&bDO;P+#q7y{?w_R+#|w<+!#S9s!5 z7)UO~#Kg36{@UMoxN$5EVH?n3AUepY`{>vYGVcq3M8-J>4@#UyNV|b^B);T)1!Q4_ zL8_^OTu(=8VY=vk4yvz>jSVa({!%q1YasLLweB!_W0x+}OsZIf1c->^5$(E5RsNRQ zIZ!winA)QyXX{)lZ(iK^IH7OIbl^19L~mmO{d|=j0Q0R1m0GR(`n6A`y`P_3T@MYP zQ+}#K+JZ6@A%=2JZ)w(xP?xkZ$*un(*?=H(y8Nr?EcB{cl?cBAkN*?GACwnSwVdONgeEf^G4h>&b-hlR^X2s7CQ;| zjhd(`A5QBE#-NxNqZb7qs}rG(ar6EB2diPYYFu{m+7+AZn)|kK;OuYo7L8oeH4Au@ z#YST~8EllQ+|WWj8@u|UF&I&I%aveSF*kkAOdrv}Juosplno9sOJh2c{E)StSBVld z^S!Ho`_w*KZKoqJ$3^A~3tj>GaNEQR~N{ zGx;1qJzfGPWdU6Cx;;Y099g?l=Tzv3IHF`C6tHi1BEf)AcA`6t8-GeD9xq4)DB4ZR zYvoDSAEjjubP!ft&a*b9Dy6u?kcpVwq3*91klSiA>9JU;Q-;7Ta^P*8V)qE-UHn-r zAkYIiH-g1C&(FK0*U@KzTzy@CMi&<~3(%m7mpOB2YeCsPP+udr3Ax~?V&FBAn;<{Y zxsMjmI!E!_TA<3)m8Yw2SX;GSvSi9&_mN=By!KKP^`>TWso; zp3Th>*e^H(ixYMD90E{{A@;U#zDHVAh||1Jkr&~M4i(xru0gdXDQx58i*{SsV?-H> z$5?zi(TXhmdx-=5=d&XS;!{s(fGf!N^veDq{EfR7!4bbN8vPI|{*a1yg!~(XBO@4_ z2wq)=-C(xYTC)uiHQEX#$6H&KPcN1(wI~Uo zM9la{rB61sNT2f|6K2w{aR+>1 zpSAI{qx38c8W*P^kz&~;wD*o0dpaOEl-S2e+5Gb3R`;SyE7@zM4kd25#(4)&oCRd2 zToSK&`TNFUFSKG1#cysUwsfDi{5Lk%$?s0&bHma9EE0Fz{K3-ir*Z>{l6hn$Xx*Gv zdEYGv1>l94A*H}lpS+ICu9_KsnkO6*Di~OpDT}=Cs{xcrpW~%U%xRJ0VEujEsEoEI z-Js6S_0P8NRPKTMnbYsDYgZbh{d~xmEz*|R_4yy-&fd~FCIr(O*JhND_j(;uGq}s_ z1ogfPShGm^%!)kImvz67;jQCst{k=cTxv`jS?4z>!hEH5JqGwzp3%H#1xKN)i+OMVxy0Y7{D*LQc0UzNMQll#z9 z#0v$b5|ala0?VrvmVQNAG>Y=Kd+;LJ$0UfURwAM9zFUkZC2)GE5PX+R&0V3( z^E1eG85Q9UyZVJ<<@)@{|olzm5jgx7ytky%>e-r|G~bEfrYKIiH*JWKk)xgz`ypfa@%ZeJbP_g zd515Tdu`pO)s*W^>?n)HCD&~+!k?5`-H1(N7ZpNsBT*owlJ2S~@9g6=#0{el-#?SapsyWXUxAN#`|8M+_kn8Ck(wh7!R{OOEf zv*s5K)Up5Ob5BRJO0}$0wNOvB+$a^s>lb}YXW_TjMBH(IJBRQ?=1*or@Kt> z>>b#;tV5ySZ|IXR#(FgtA!zmu0B^mh{1ROKX$&5R>#19CNQ&9r$C`R*Ri>9c5`Zc~ zWU}}goTNfzrdJeLypwHqs2R}hU zVjIaKhKMPDse~@Vo2hv)eob&UvM`PT$Ux-Bg$S!5Q^#+~iMHIbyKqH|+a4Fc^4lsX zewX4N%s|8jy&$n%YP|R6YtM+I8P`&hT2y9iA-aKqRRE{GeQ9dy$J1brt4U$q3bOG)~jtDx= zYpLI^swCKQMfLb|`T61x0Kr7s{=jYQr|%|)cox!t&O%_k z;uOU9tc`d91nvQ>IcyPo!JH*~EhY8VuUZr0!&j-CiR2q4f!$dEm~TQ{SK#(aH?Eqn zs#fl_DUgOZ3~*e<)xZ+pN^U{C@pfke7#!n*Jz_2CMH4Zs&2?|R22Z7AKjsK2IQ0fI za#67(pJ?NfV9m+_Qe$sz*v&`Mr+|Pj`KTxWJ?8zxaQrm2+N|ZUv_`PZC(R~PxF_B{dVUuR2>Sl+PMips# z@veAsQ(tD_TMVKTs+(}cQ*eg6Px*xH{WG`Kj|#aKoI| z4Dc>4C*y%(AJHfAvX~HQ=YlC{m~Bh5=c=ZO9t3_r8NMJOaT`|^l|>A2I@?(n>R|bw zK)GqD3zr%I{-wq*0?>>Ae9On9Fik?=a#{lZrP2rBQO`fO(D7zA2IEa^IXujRB-qlg z4|q8+UavRBEcA^zQ^_jaX}TDqr^zntEBpogYF)D$DTmI5>QUoNH1NQ`E5M|@G*SDB z*@#q;A-qq?E*+{B%kA%`u)v;|^V}un@`2IH85+ST2TL*)Db&R1!z=!}h%C-r_Jd7= zOhi}jsAq~OA6M{+p!(A^s$_8sAp3emRmj1CB!Zjo5GVG3lr4huF+f%&XZ2kH8pf1T zXp$aEqgK?}N!)aoWUe-~_`*b#n*Tm!qAZNZ^$3jtGmi9AZATqh&_u|cdta7(0Wmk5LoR;ikRm(Iv9 zS<4VXUzJj~Jzpqt$|I`y<+zd`c!JmZ}K$OB%E`+5lgrUN} zF$Jrs$s<@m^{DPQ=mWih&L&8yU;i4ian4bu#}J<9Ye87|t)yQ)8sH$q9Y6~RuxOM( zh|dyjzHwL-=h})4Kcww?jryxalhAnfr+0G#1Wn>gK!&Y(zcIWiae%`aVA`K~#SiEU z++6op!AD9D=ndihElgLBH{r}a|2tH&T4vZ&;KzTH5a8F=I-?0C{>@iEgP)A^RwURg zj`Ov<(ZK~(tq)*6=ihwQ2k025&M#C>4#p8khB4@a^z9~|-68A1W|`I50`=*gu-$uf zs2Z@VC?774kJRZrD5r`*-x9Lvj!te3+Josk|lxCbv9fsREaTSgN zW&-n0vTrL8sHFaKH)js+2@_AGKiqfT-2WLMJiipVpX84h`$e1n*B9GcQ#1>@A^~P- zWyDr%kB=j;bEYFqsl2wyJcX^;0#`}?BbR!c&8v`R_8walvUaSwRby<@p_5@JT^IcH zQ|sgPA~t@+;Ug&7KNvOBRbqa%*e8_-3W^ONRi(E8*ilX|S(bck?Gx7XBNMI*SLAzG zp7;v&wsNwn>JP<<1geEddWJ^Xg4(ECu9>v_7B#vQEqRdRi;v@_hjsUbrDxD3i77Bj zE}o-3A6Tj3Trn{SYH(bDxb)xPv1H7mZWW#Q95k3kcHpr{Q(wS?nXJj(r3!KZtE^#I zGAs(oF!tXL+Z*gFKY&U^yy0s?tM1TH3YDEe&MK1tzG*%LH!`gaM;yO+`v_{D&>J$R zzCw?<&H++Yf{mCsLLbizaJpw5sbzU0de+xm?Tfu z;xV2f=CTJk({+N$p5NuL`oBM5%!lC9*cp7@+0iwys{LK{I_shqTp%2zRoyA?8$H+LoiJZF1#6k?PC=4Zuws7&}=rl@yK9qxh__hu4kon+#eeZS7I+*09s zCC{odoW}WF8Y$Kio1RRjWTx~^l9~At&nmg{Z8DJP?8p8P$*5`}#E_&BA9}=_e*+_B zAG7LKl>v$2gQ&pB0WU>X=#?y>SfE`cQ;-&CdYlIQwHPB+$<_-WX0|dErXv?(epmjY`Yt_<*J8IdCU2CFbf4Y3$ zYGXHFGwq2@l)J_tO)J%4vP^fa3Uj{z$A!Z95pQq)^)O^RkLTqEwsufBkbvEiY-x6@ zgkdDJ?}+N&vANmV+|zEC1&HdP~vB4t}Nd-JGeOLjZ zhP%3L)1Ia362?{?de~gEUGvha;&j2SrS&WpbYndOzW<$YDGEmNN?)clFcYh@+1ysG z+9^~cR&%5NlG`+`lveYIvzb$O>C8IWS>Pc(PO8~v4F z*eYr|yF5<_`qL|-gfV8T$edyIqC=2aj<{tH1cE0>irq~gXwr1bRT@|U-9=g6?Fmoa z%~4mm-SM(Hi{lQ-TG{SZxOq6>hAS<65QlAwPm7Ah(Q@SqRi{V!D%P@gyk#=Yw{26$ z;+R)kclUHwRs9`Qb;r+kKSlIcPqd<34BBu}(SvQ#a_x$Fi%olH76Br5=aS{JRVP~X zeXEuY_wtDCF`jXyDFQ{X<|N?~-_S@mSyAWF{w=Y3AZD`)*kB27U0f{XOEn8^@+%+^ zuLt4HFKLyy89I2~>}>3=PVGcu1p@2%Y{cI2w?Am*Xd%ai0V(aCSy(I$G!^W}D5Mdk ze>F-F7scKlp|On7lCW1BR3KC!el;W>Ub40iX-|(k;L@GJ@y6Ixyyl)mmU3w6OnNCs zCZPS!uG%om*PamS0}<;?KKUX!7Kc5A0|A zFy#ybh{payOe^`FGwjHBE70QRvrUG9_~jA=!bGm=wNF{6h1&pj>`Di^Cv`lEuBT08 z9npW$@m>@sv8ydSq)RN_e3%#^wSJbLRS4G= z_SKJu`xF>2;AOAJ_C?BK@PM~pf_iZ8`BW2Ry_#`lg8Ru1$+X(h_$5>s%lVqU{5kQF zA&NhRiknc*h*h)G2LG})CGFMJ0iA8;b^Vm@K5+rp!P*W8I-d#dWv<(nyge)US5W^D z_^N#d=3!#kb-MG_U;9evCn`7(QOZ>nCa{U`L7IpJX}P_%<|?!PP}LD- zW`q0A!bdBCSezrsgC2!6hdO%rgY`fM!-K~1Y&a=#Kv0}Q(E_1x{S}B?NCUTH{qxca zN%?!Se#P$jVz^shK&iH7Wy+~`-fqCR_!B4YNP{}(5dAUwoMgo>3G%6RCu*|Y<-j(4 z(RM5lkGEA=8UIAUP%z>u+2;td+<#}Jm1}yCjLAa%0jZ-W9XrYrl|dXR^>&FNpdIWM z7X~6}_YFtmEP4li{NFh zN11JF{0Q3}BTQCzlGuD;fwCMWK3jdk^<&qH_LHkME`ixKFPAa5d+!tgHrS}ph!co$ zJ|`%f1ywnafZ-#(#q9%%IH>3ci_e`kRN68+l*N^;tqo$1F&W_GF29#9bto`eW3NpY zHhV^#ejQg`e>iJY(F`MS{8G2|D`7RM zLR+o_#1&|E8Mb}xD5XPtgG=^=#)yc03J=uT8z+cE0xpt)^ZWTckKA0=1~Z;}@f&|o zfdS>hrj)eRM@w4E5kO3V|A#mu&QBp=TqT01HL@iV^50WDz4StqDP~XdNgnHKxO-ap(#r3>O;_Qin9G*mBG$;e^`g0YOyZu}Gut#*2!@U5Gdx((8IDMG0N$8{oCJweuutoVWWiBimA*;rWNxt9ns zOnxyHc!rsBH%jkBE9 z2H@9>37{f=y?7(j5@kb8k{p{%4Wvt<)={^{@b?*G_((ty*JeUh6uRs~JucVdavJ|r zzdvM$Pb{!4^ig@W=4`HxNl1T^9x?w479Y1kbijOdB5%zFNYpop7{tO4HE>F9>7DbU zaR_5P*w~O6QKtacCp*Md+(IOtMv6z4m2@Qd@Jufn^4uvWL}w*2mnA*L_~iBo3cKbd z#7D$Yz@RfL{U#*Zrd9nIIR!6ODB%sLv!CcObSW;h94X(KWNO$gRFu3_8)IX)Slei6 z^^7W(6Q}PKgK+h5!g^Wo^KX&9Sjcq@1@m^bwZ81q*IHl3`CR6$`su3t%S}GJT^=7t zc7FkPdp-dt8sJs+^PU%;^W;zM)K^+JK3C>j9$b9B@#koynZ_UMO%fts-aIP9^&*~c zNWm2tIiHF2v@e5M>!?;KF#+YsM{P<@Z<5<@Nf7(z$id+&VYyO5;IxGwS+Ri=N zun)NdTlE0Ej+~$ff^EE~MG*i9Kxe!=MlQ!b#L-Hoti#nDb>&M=d;PD@q z_f7PNneAswfpMC5xSNo*iMMp1C_6!HlT;T!GW%tjp1)OORHY%^-IMBX2(s{xr~OT6 z{GiW}0TgpN3v3lEch-w3q==oQ^WV!T^gq^yXsNGYqZxWW+qAj^5S7tl!S8ybY28Sk z3|88LCW@OICRV=h@|mUQ_7#}Kz3>{$JchNy&JOBpCAdSF6a)fCWkU9=?Jh!GID)RF zOR2|*U5Ggyi9?W-$M4&{eWPRL8G)KGvIhe{#7<9k_V^K^?3S(d6)RB8Cq5SVZrKlR zQ@{T(S?E8Z!10VdjT366M4VPRqX{%#6j*@)CBajJxH3cu&7DsEQ~K%)V|}Lg^$GhN z6#MYQD*xvHt2)oYH)>jjf$%}~szVl@*}e5AIijwO=^fXl?4WszfYmsUg~Su6J6uil zh?wUQ6a1$XT$vxM7SeJe_!E?~WX00uVm;F~9ZHxb_4b{|ioL%rqR?D!)3&4~%Q+Mn z=eEKoHJlCOUvj=3ukPcBOIJUl4d#k{W$jDjx_~?1MVRz$HA;k};T(rj_5`p^z7DD1 zVdoPag3*|T*A=B*6y|kHJPUonmqBm(GW@td6MG!lsI8DnJ@K6yjybTE)qpLgT^79a zA$a;;P4F6Js&?v>cBUvn8?tl=Oxbou z;}Ty;uv)}7F%7fq`4+irkUVnJCzI+WyM1F?zzJqAB{Z`k4MLE_JiK;D9Z*FM12{SO0{l+(+bH?EGx zMAWL!7&4j@KZ=LgIa6Vym>j1G32MzK@49$1Cz~-u37}CYIPXOeVH7S_JXJcMq4QdU zFU>e)vt(Hmu|EprB!q7acfhMzC?e180^mKOw?r2kKAw4~K{KL}{kYYkdxIxK&A%2P z;S{QnrYl5o0Ja^eFUJlJsNwDa!1};-A-4#9oL$$xRW{Jp?|#ds)d*r-4gWC0(r6=q zHk`7@;JE7m%#aOfc8zMDRF>EUCE}uy(j^0D5yI(6(9knLs;~O0#8FaQG8`n$u+2iN zK~KGcZw?ovAlcJbClV5mQ8b{5lK8N-poyTga)!*^BqXWORXLuMX8(jhE}uogyHAwU zfa}Rv!+RUNcPRSjRRu)tw~01j-x2TwZ|E~S%f}k=E_gYP&DqNF&@;KMu2mU{J*A1~ zz=({llk&j<9xGcuUAv`;$%SzX%dW#cT0F2JSIoJ{dS-|hW%}lBenKYd0;R#==*;cF z(4m@<2PdTc1-*0jZB6)Maz@Ft_6$7Oow`DI309-BaH{2)BCJLwVFXrS+UBu{%H6UE zvjk(;N|VY-UQUTno>{qg2sQGmpg3x(;#lSW$5mV*hO;iGdW=Of7;Un#0ys>(ac?I> z6ya_q$!;BXB_0d;8dT&=Zj(VXg#?_ON78=EU-&uoFI;D#lE?zu81G=mv0rvkVdXv9 z#z{XGj6Dq-wK}D(qm_;{Ri($)vkP!^OHC_ptC$M`1!d)$bL&xgVEks@u8tfw#{8;l zhFn*F|2Y-C_j!P5!lJ?n-dH|vWf9vGqxpBqmd2D!qV|Fw`O`!`3jH*!x59fa1dc*> z0b7jC%DvYC1)d^V?ToBHUua@C1JL{jcp1vp`1sv-cm7Nnvxuj-`mou^*8zr3l$-$C zILd&c@lnKX7^5GTfFzOrmtN8@MG&e948Bh0aS6tWO;ZHqU`KNRFz;-p3WC5Uo$wh| z7!bw>+baa&WNl{V4}LRr@P{vdnAw`Sg@wWQuEEm|eKsorulE9vNNm2L-ic%x@R;^9 zeZ*qv4#zs+por=pfm9~_xngc}WARzD?4*iOqx)6?t${2|3WN4~1yDu8)aill6JG>~ zQXo3_7)Xi&c!k<@hrBuHYIRNK=)^K~@7dVQ3dh~1G0QBerO-<0`qFpWfK|E_-93@f zPr*r1!4$9z#*7X*^UI|Bz6EZv{$)2zIV51+USWfY@ET$2Stev5@G+Di4aQk1$Cp{6 zp{J}T0}Y=wa@T~_YNP|Tzu1A!u;%#9RCja}e@I|#ah<4@PG0+Ktj#_i&^%#g7{)@Q z!!lvDCm)3aF@uUD%q)a;+aVJpZ+!@_r$Uh}@#3!*@*rv$bd~Z=&fSPu_V1a1H!Dw= zggNstn$!0IWr9YT{fnSt1zF9iKB zxs%9!2jX*ZZt~LL@9Gc@@eF3*8s^hQQA$f8fozpX^@eL(+Q;0CLWi-!mO zkvKxb8o;RPfG|?D4+shMErb(8k?rb-fH5UplXvnLMKVk`$qR1@lrgA`5o=(>m@-Ab zV{7w|pVuSQT)aC@O*#LkxZe@-MC(_-jBG1p6@&olydfG;i?G13W_{dGtiMB+o(K<=q z%D8~lGXetAf{fWwm9E!M5t_3p$U&9yf^k->=j5Q~7M6#n|%37pSDHcoho*?gu}#0DW2s2Gs{CP#}M z2kcT7kNSj7BAD;u1y`z%aBz_c*2D_Vp!IycecQ>qbnuL~Fc6`!L zX&ewR3)hI@P$!JNHHkH5*TK!$5M0%1HqNZ9Cdf=BGVHD>BP0cjksiV?Zds^^`lOqHgfE(~_YaA(UH z0uvZzUgwXU;8G4de(kA0fslhd?%>7qI|XeAQs1IHVTz`v;UqUK3E55x|4w6-RyveC z$UhD7CPy+jaCWKC?rdQ1K3;eZkjqs379gMd<1feYk+T3XCZXHWg|#y2Gb)R*xSLrk zj0l>%#Np}}!$=<6E%`R;&ZJLuk(iuo-$>PCszq(7^x~U0N*OPNPt@D!EoF@Y13$7u z4bMMLv>irdrg^mbZW*SvXCSffUDw6>?07$`?6X!NIU!lm63O|pzGobDZ{m|4z)#RO zGvT;^w^2LUHs3`4rI~Fq=8Vat6DplXxM(ug{1@2x|D68Y#Xnaix$r+@WwI|PU6T>IBQakN&BjOLK^vReSm2`&Yk>cByx`Jr~lm& zD}E;bOeR3Lv^Rl=CviCy5)DP(*L6HKTqB`Y>&fx+3(pU(Ku~{l@NysA zM;p!Ct{_bf&_Y*>*vnjRXW+`8D^I!c+Z`yaFy$`fkHaAj8-*nt?GVgMm_Pm$cdYBp zp62-MK}qG4&K#$OiA}|)gox^a7S(6*dIRgV+^LjgdZmj)5L1}DZ(!nuO}ja*ZbN|2bxb>N9-)dOkQ>%bAqxq1Ibn z{RR9EI4565T6fclTO`ix6G*I&EV-2h!71!Um|8K1y{BgU(sM*W72fY2J9VShzdx&V z?9S~;3g*NMrHN4PjbqhYlkP4EPOiUJ>SzY1fF#EJFdHZpE>qoUT~Z9PiDMN~2qB zNJ%vPBYB9cYq51~$cdWjnP6S*-3|FQkFcCrU(8;l$Evk=Q`_~NaY()Ebj&IDC}*1s z8kpebIILD}3Tq%x2pk^MhhXaZ>;@uz*aJ6|^K4j0zI78Y*~AP*-20n#D)yD!Dbq7& zs(SrFT(dEJp#O#hU+ZTTww*3JV8>IepQvC6lkU+*2L`U%(B|(Y_ohTBVd{2AHVomz zuhUhL1vb>*)YuS4+_fJ1jiiKzgl}h4Rt)X0XCH4B+8;YiIA8BiC(dU@9FlVdLi0%g zPA)VBWUO8aP|KeLJy~|ni>XjyU6nQe`vq|^Vnl_FOuPIc75!Op_%-R`laWdWA+fm{hq88_Kcdx z?jaa3KM=0524&pR^Ma7Ypnfp^w|EQe0&KAY*vH$qZ)Js}I00r%OI})uemPfg2a1a) zW;v-xfL@7Io-wO>E1yC5fzol`+=#HPV5YE18GrSZBK+XH9NcN=p^pbJtwv&bk9pDf zMEv_-2S(So<{s20tMWWi(oW2D5u?i~iCH{%;*&#Myn+!f9;+9L@$J1$UuFCl9Io#K zp>K7xNMj+x>7m)`@d_C2S}Y1-k#QdYDfaFisZW8R{w(xOcTFjL--8$7Nrtx30|x zJ^eG2Hk0qn1*iRAx%VD0QGB`Vc(r8PkV24&wChPIpbEX`2Y0Ub$wSXjaD_)U0*w+( zAmivzAU(7K8q3wux3<^=98C!N3Rjgel^ypB6`q#_n0)XwKs%8=)-QzO5W;?Z1Uf_( zlr9(oQLrf+bu?>|i2F;u3+xUvUboF1G}3=q zqlP21EW{BunI|VWFPjOu(<&j6>qk*JqZZT%vW1uT_4tQ|flwIH zTMSq5<0zSxicVSZUQghRo~CL`O=U34C3Wk`#vv)_W|7>q6xjN)Zc1WVR42937{s#a zP=M!rUeb8?TG*;fhSlV=P7LdAH-I09A00{(vUHRL#@td8bI?JEAnt~3y;u5td8#vE zxe9$n;UP6}cq4F`3|Ry>R$trMvgbMoZKnWmj$xND+j!UDC4iX9pc!`hVcv=g>1Y^0i{7KMCViCYQt~wmO_Nr}A2-sGeFUw;{{Z*+dSbs?@__`!a*_M~SR8n31@#+wk-4d!Z z>aNyjINtc@!()(!Le-d45W%da8~bFXc4l5nmhdg{&@1Y#YuCyV4JMHmEqPTGsSE3p zAyH)o`;%LZ?Wl#1@@@W`ctqx&;}grAr@ONJI{31zEdE%`s?H?MUR zq+;<85aSL@A*j@|Lh&#(&v`6Om%`}=AGpl3Ra>x@fFU9zYPw0;wgu}nP%a%L3Y#4x z{op2t%j(Xs%UyaDW=*$*tS_a|k(#@BJ7+#!`>xokyvUCEBPzS^g2L*Qfx0G<1QIAK5kv*~JDR(m#oJqQBeU6$mF<@=-x)PrYNnGR zs>wl$p(i&eaFIIvSk%L=_1Pe)&36VSZ7rQG>y|cJwZgbn4N4a3+S-j}h(EE}8?xv~3LG^LwFO*9A?XAcpcD+pg-c=4G;yn{ zYE<GD$#(l4l1{n1+X7P1Xq8`_RlmVE zQBFEp-2m;=qy?R(^ut7 zDbiMDqtjrTUip9x#S9WOXkUKRI_68aVWDt}w}!hr9_iIM?dii}Rj2$u^&3;-KNe?t znSgEt`m&}OApcz(W>RZo(8bV&T2(#tNYz|#=y}Q?6(o|*E0nv@XxwJ9K!qhM{@xya-Nm$q*sV~aInKE{vxGH?c9o@&3 z&?HFG0suo8xCTdln>x@qH=Q9&hORrHxqJXiypzqI45i1We8F(fioj*xq`@-ultGO2 z*E6BUiedYs{IC{A3qDw9tZlLoK#~(^DtA=|eam&8Dx-iXf=3cRX)A97Mhx%D$ zl)o#M)IOo43LX(tzx2qe!5gCsb+Jl1-SadPjBS?49jgu|vptp4kpGiU(?o{ieOX?U z{%6MwH_gQ_qdvOMzYRM%(_!nf*)|5%5{-_Pb52zC1O#Lel-b=AzMMPggU|}nGwBGm zX+{_ZFM_-*gh7ze>UN11VmJLNCna~*#pzI_o{UyQ1UpolSp*lCq$ZQiImx*SlY&K5 z5LvlCWxss+QOKSf=fWjAGs2R)JLZFz=I!vV41bW~4m>B1LE~{a&g4ES`;{Vh2xX4V z*7Yf)tmFFC^9NUxj1~${l*b6-0ZYF?Ada;w?F&*rl-~yf;O_U;?}y$P>!8^jbS#c7 zAf&YWwV>V+MNlZf8EXs>ZgPC@t46hdpE8IsAl%4qAcl{F&KF4z!t2Rs{YP@}Ch>jt zlZ`}85m@s@+^YybwFFtfmEeox?iNhjAc$;@e!$NV+IgMK#ZNuSpy$_aCEe*V0L=%`{j7Gg5bWp>_ARe$|cv@)%GlFx9AB2IF zzUkB6UK#@B=~f6vUEgjl4Q9qD8v1zzVMI73E4nWkRH+m8cstr9+Dxmk`#Q@%NE8lB za#qM~4{Qo8ngkaFk6ZeR?IrvEq8inK2rX9xseT*8ec>y;MLDoiIyd2kLcmVPdd=u| zZT-=l>v7Tp;~OysIdV1}K|^-4_98S@O# z2iIMjU?8-yh_B12m&LYy$=?5V0m#5CnaIoOIj?I30dVWfA#}}F@}RBG&vw?CTcYQhUbpD+0ZlqvQ-%9f%o8a*uwmQsG5D8VwCCj>Y;_` zF)>1L;(U;yud50Hp(oP4dftKLoE+`K)PQT>o6udkGhNt~1{($o;Pe$gIzq(QZ;9~P zGNR9MCH#K;06Qr$(3zGpg}i$$dJ;11ov(n+eHSysVW|;i9OG9`5yqGXHNahZ&&VTZ zZjq$ha^WMR4p)+70Th}-Jfunpu+`Gj$9@JhmWd|7ha3YgBpx8SH!~sxW;>qH&kcDJ z$X-e)`VEfRI6vTen$UPH02(2s{T7XHr$@58Lv_&(q?g}JWFW_T5(}&fwB~M zh2!=bipCFt(<~==^zQZ-TwV$g2nFE(FI4;|TKI3{|07%cpP&3s*~9<&;q{*e^8XP* W$V-8O{YMDUzZv{*FXQ-+)BgfrYgbMH literal 0 HcmV?d00001 diff --git a/Solutions/Forcepoint NGFW/Package/createUiDefinition.json b/Solutions/Forcepoint NGFW/Package/createUiDefinition.json index a1c72244435..e5805fbd1a9 100644 --- a/Solutions/Forcepoint NGFW/Package/createUiDefinition.json +++ b/Solutions/Forcepoint NGFW/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Forcepoint%20NGFW/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Forcepoint NGFW (Next Generation Firewall)](https://www.forcepoint.com/product/ngfw-next-generation-firewall) Solution for Microsoft Sentinel allows you to automatically export user defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/ngfw_and_azure_sentinel/) \n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.\n\n**Data Connectors:** 2, **Workbooks:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Forcepoint%20NGFW/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Forcepoint NGFW (Next Generation Firewall)](https://www.forcepoint.com/product/ngfw-next-generation-firewall) Solution for Microsoft Sentinel allows you to automatically export user defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/ngfw_and_azure_sentinel/) \n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.\n\n**Workbooks:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -51,30 +51,6 @@ } ], "steps": [ - { - "name": "dataconnectors", - "label": "Data Connectors", - "bladeTitle": "Data Connectors", - "elements": [ - { - "name": "dataconnectors1-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "This Solution installs the data connector for Forcepoint NGFW. You can get Forcepoint NGFW CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." - } - }, - { - "name": "dataconnectors-link2", - "type": "Microsoft.Common.TextBlock", - "options": { - "link": { - "label": "Learn more about connecting data sources", - "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources" - } - } - } - ] - }, { "name": "workbooks", "label": "Workbooks", diff --git a/Solutions/Forcepoint NGFW/Package/mainTemplate.json b/Solutions/Forcepoint NGFW/Package/mainTemplate.json index b48b92cc842..15e3b301adc 100644 --- a/Solutions/Forcepoint NGFW/Package/mainTemplate.json +++ b/Solutions/Forcepoint NGFW/Package/mainTemplate.json @@ -47,27 +47,9 @@ }, "variables": { "_solutionName": "Forcepoint NGFW", - "_solutionVersion": "3.0.1", + "_solutionVersion": "3.0.2", "solutionId": "microsoftsentinelcommunity.azure-sentinel-solution-forcepoint-ngfw", "_solutionId": "[variables('solutionId')]", - "uiConfigId1": "ForcepointNgfw", - "_uiConfigId1": "[variables('uiConfigId1')]", - "dataConnectorContentId1": "ForcepointNgfw", - "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", - "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", - "dataConnectorVersion1": "1.0.0", - "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", - "uiConfigId2": "ForcepointNgfwAma", - "_uiConfigId2": "[variables('uiConfigId2')]", - "dataConnectorContentId2": "ForcepointNgfwAma", - "_dataConnectorContentId2": "[variables('dataConnectorContentId2')]", - "dataConnectorId2": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", - "_dataConnectorId2": "[variables('dataConnectorId2')]", - "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", - "dataConnectorVersion2": "1.0.0", - "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", "workbookVersion1": "1.0.0", "workbookContentId1": "ForcepointNGFWWorkbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", @@ -84,750 +66,6 @@ "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName1')]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Forcepoint NGFW data connector with template version 3.0.1", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion1')]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "GenericUI", - "properties": { - "connectorUiConfig": { - "id": "[variables('_uiConfigId1')]", - "title": "[Deprecated] Forcepoint NGFW via Legacy Agent", - "publisher": "Forcepoint", - "descriptionMarkdown": "The Forcepoint NGFW (Next Generation Firewall) connector allows you to automatically export user-defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.", - "graphQueries": [ - { - "metricName": "Forcepoint NGFW log results", - "legend": "CommonSecurityLog", - "baseQuery": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n" - } - ], - "sampleQueries": [ - { - "description": "Show all terminated actions from the Forcepoint NGFW", - "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| where DeviceAction == \"Terminate\"\n" - }, - { - "description": "Show all Forcepoint NGFW with suspected compromise behaviour", - "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| where Activity contains \"compromise\"\n" - }, - { - "description": "Show chart grouping all Forcepoint NGFW events by Activity type", - "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| summarize count=count() by Activity\n | render barchart\n" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (ForcePointNGFW)", - "lastDataReceivedQuery": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "read": true, - "write": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ] - }, - "instructionSteps": [ - { - "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", - "innerSteps": [ - { - "title": "1.1 Select or create a Linux machine", - "description": "Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-prem environment, Azure or other clouds." - }, - { - "title": "1.2 Install the CEF collector on the Linux machine", - "description": "Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Microsoft Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.\n\n> 1. Make sure that you have Python on your machine using the following command: python -version.\n\n> 2. You must have elevated permissions (sudo) on your machine.", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId", - "PrimaryKey" - ], - "label": "Run the following command to install and apply the CEF collector:", - "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}" - }, - "type": "CopyableLabel" - } - ] - } - ], - "title": "1. Linux Syslog agent configuration" - }, - { - "description": "Set your security solution to send Syslog messages in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machine's IP address.", - "title": "2. Forward Common Event Format (CEF) logs to Syslog agent" - }, - { - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python - version \n\n>2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId" - ], - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}" - }, - "type": "CopyableLabel" - } - ], - "title": "3. Validate connection" - }, - { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", - "title": "4. Secure your machine " - }, - { - "description": "To complete the installation of this Forcepoint product integration, follow the guide linked below.\n\n[Installation Guide >](https://frcpnt.com/ngfw-sentinel)", - "title": "5. Forcepoint integration installation guide " - } - ], - "metadata": { - "id": "e002d400-e0b0-4673-959a-eec31378d17c", - "version": "1.0.0", - "kind": "dataConnector", - "source": { - "kind": "community" - }, - "author": { - "name": "Forcepoint" - }, - "support": { - "name": "Forcepoint", - "link": "https://support.forcepoint.com/", - "tier": "developer" - } - } - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", - "source": { - "kind": "Solution", - "name": "Forcepoint NGFW", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Forcepoint" - }, - "support": { - "name": "Community", - "tier": "Community", - "link": "https://github.com/Azure/Azure-Sentinel/issues" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId1')]", - "contentKind": "DataConnector", - "displayName": "[Deprecated] Forcepoint NGFW via Legacy Agent", - "contentProductId": "[variables('_dataConnectorcontentProductId1')]", - "id": "[variables('_dataConnectorcontentProductId1')]", - "version": "[variables('dataConnectorVersion1')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", - "dependsOn": [ - "[variables('_dataConnectorId1')]" - ], - "location": "[parameters('workspace-location')]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", - "source": { - "kind": "Solution", - "name": "Forcepoint NGFW", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Forcepoint" - }, - "support": { - "name": "Community", - "tier": "Community", - "link": "https://github.com/Azure/Azure-Sentinel/issues" - } - } - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "GenericUI", - "properties": { - "connectorUiConfig": { - "title": "[Deprecated] Forcepoint NGFW via Legacy Agent", - "publisher": "Forcepoint", - "descriptionMarkdown": "The Forcepoint NGFW (Next Generation Firewall) connector allows you to automatically export user-defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.", - "graphQueries": [ - { - "metricName": "Forcepoint NGFW log results", - "legend": "CommonSecurityLog", - "baseQuery": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (ForcePointNGFW)", - "lastDataReceivedQuery": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "sampleQueries": [ - { - "description": "Show all terminated actions from the Forcepoint NGFW", - "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| where DeviceAction == \"Terminate\"\n" - }, - { - "description": "Show all Forcepoint NGFW with suspected compromise behaviour", - "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| where Activity contains \"compromise\"\n" - }, - { - "description": "Show chart grouping all Forcepoint NGFW events by Activity type", - "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| summarize count=count() by Activity\n | render barchart\n" - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "read": true, - "write": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ] - }, - "instructionSteps": [ - { - "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", - "innerSteps": [ - { - "title": "1.1 Select or create a Linux machine", - "description": "Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-prem environment, Azure or other clouds." - }, - { - "title": "1.2 Install the CEF collector on the Linux machine", - "description": "Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Microsoft Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.\n\n> 1. Make sure that you have Python on your machine using the following command: python -version.\n\n> 2. You must have elevated permissions (sudo) on your machine.", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId", - "PrimaryKey" - ], - "label": "Run the following command to install and apply the CEF collector:", - "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}" - }, - "type": "CopyableLabel" - } - ] - } - ], - "title": "1. Linux Syslog agent configuration" - }, - { - "description": "Set your security solution to send Syslog messages in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machine's IP address.", - "title": "2. Forward Common Event Format (CEF) logs to Syslog agent" - }, - { - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python - version \n\n>2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId" - ], - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}" - }, - "type": "CopyableLabel" - } - ], - "title": "3. Validate connection" - }, - { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", - "title": "4. Secure your machine " - }, - { - "description": "To complete the installation of this Forcepoint product integration, follow the guide linked below.\n\n[Installation Guide >](https://frcpnt.com/ngfw-sentinel)", - "title": "5. Forcepoint integration installation guide " - } - ], - "id": "[variables('_uiConfigId1')]" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName2')]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Forcepoint NGFW data connector with template version 3.0.1", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion2')]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "GenericUI", - "properties": { - "connectorUiConfig": { - "id": "[variables('_uiConfigId2')]", - "title": "[Deprecated] Forcepoint NGFW via AMA", - "publisher": "Forcepoint", - "descriptionMarkdown": "The Forcepoint NGFW (Next Generation Firewall) connector allows you to automatically export user-defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.", - "graphQueries": [ - { - "metricName": "Forcepoint NGFW log results", - "legend": "CommonSecurityLog", - "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint'\n |where DeviceProduct =~ 'NGFW'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" - } - ], - "sampleQueries": [ - { - "description": "Show all terminated actions from the Forcepoint NGFW", - "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| where DeviceAction == \"Terminate\"\n" - }, - { - "description": "Show all Forcepoint NGFW with suspected compromise behaviour", - "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| where Activity contains \"compromise\"\n" - }, - { - "description": "Show chart grouping all Forcepoint NGFW events by Activity type", - "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| summarize count=count() by Activity\n | render barchart\n" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (ForcePointNGFW)", - "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint'\n |where DeviceProduct =~ 'NGFW'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint'\n |where DeviceProduct =~ 'NGFW'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "read": true, - "write": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ], - "customs": [ - { - "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" - }, - { - "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" - } - ] - }, - "instructionSteps": [ - { - "customs": [ - { - "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" - }, - { - "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" - } - ], - "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", - "instructions": [ - { - "parameters": { - "title": "1. Kindly follow the steps to configure the data connector", - "instructionSteps": [ - { - "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", - "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine." - }, - { - "title": "Step B. Forward Common Event Format (CEF) logs to Syslog agent", - "description": "Set your security solution to send Syslog messages in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machine's IP address." - }, - { - "title": "Step C. Validate connection", - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" - }, - "type": "CopyableLabel" - } - ] - } - ] - }, - "type": "InstructionStepsGroup" - } - ] - }, - { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", - "title": "2. Secure your machine " - }, - { - "description": "To complete the installation of this Forcepoint product integration, follow the guide linked below.\n\n[Installation Guide >](https://frcpnt.com/ngfw-sentinel)", - "title": "3. Forcepoint integration installation guide " - } - ], - "metadata": { - "id": "e002d400-e0b0-4673-959a-eec31378d17c", - "version": "1.0.0", - "kind": "dataConnector", - "source": { - "kind": "community" - }, - "author": { - "name": "Forcepoint" - }, - "support": { - "name": "Forcepoint", - "link": "https://support.forcepoint.com/", - "tier": "developer" - } - } - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", - "contentId": "[variables('_dataConnectorContentId2')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion2')]", - "source": { - "kind": "Solution", - "name": "Forcepoint NGFW", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Forcepoint" - }, - "support": { - "name": "Community", - "tier": "Community", - "link": "https://github.com/Azure/Azure-Sentinel/issues" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId2')]", - "contentKind": "DataConnector", - "displayName": "[Deprecated] Forcepoint NGFW via AMA", - "contentProductId": "[variables('_dataConnectorcontentProductId2')]", - "id": "[variables('_dataConnectorcontentProductId2')]", - "version": "[variables('dataConnectorVersion2')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", - "dependsOn": [ - "[variables('_dataConnectorId2')]" - ], - "location": "[parameters('workspace-location')]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", - "contentId": "[variables('_dataConnectorContentId2')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion2')]", - "source": { - "kind": "Solution", - "name": "Forcepoint NGFW", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Forcepoint" - }, - "support": { - "name": "Community", - "tier": "Community", - "link": "https://github.com/Azure/Azure-Sentinel/issues" - } - } - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "GenericUI", - "properties": { - "connectorUiConfig": { - "title": "[Deprecated] Forcepoint NGFW via AMA", - "publisher": "Forcepoint", - "descriptionMarkdown": "The Forcepoint NGFW (Next Generation Firewall) connector allows you to automatically export user-defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.", - "graphQueries": [ - { - "metricName": "Forcepoint NGFW log results", - "legend": "CommonSecurityLog", - "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint'\n |where DeviceProduct =~ 'NGFW'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (ForcePointNGFW)", - "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint'\n |where DeviceProduct =~ 'NGFW'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint'\n |where DeviceProduct =~ 'NGFW'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "sampleQueries": [ - { - "description": "Show all terminated actions from the Forcepoint NGFW", - "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| where DeviceAction == \"Terminate\"\n" - }, - { - "description": "Show all Forcepoint NGFW with suspected compromise behaviour", - "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| where Activity contains \"compromise\"\n" - }, - { - "description": "Show chart grouping all Forcepoint NGFW events by Activity type", - "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| summarize count=count() by Activity\n | render barchart\n" - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "read": true, - "write": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ], - "customs": [ - { - "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" - }, - { - "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" - } - ] - }, - "instructionSteps": [ - { - "customs": [ - { - "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" - }, - { - "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" - } - ], - "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", - "instructions": [ - { - "parameters": { - "title": "1. Kindly follow the steps to configure the data connector", - "instructionSteps": [ - { - "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", - "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine." - }, - { - "title": "Step B. Forward Common Event Format (CEF) logs to Syslog agent", - "description": "Set your security solution to send Syslog messages in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machine's IP address." - }, - { - "title": "Step C. Validate connection", - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" - }, - "type": "CopyableLabel" - } - ] - } - ] - }, - "type": "InstructionStepsGroup" - } - ] - }, - { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", - "title": "2. Secure your machine " - }, - { - "description": "To complete the installation of this Forcepoint product integration, follow the guide linked below.\n\n[Installation Guide >](https://frcpnt.com/ngfw-sentinel)", - "title": "3. Forcepoint integration installation guide " - } - ], - "id": "[variables('_uiConfigId2')]" - } - } - }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", @@ -837,7 +75,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ForcepointNGFW Workbook with template version 3.0.1", + "description": "ForcepointNGFW Workbook with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -898,6 +136,10 @@ { "contentId": "ForcepointNgfwAma", "kind": "DataConnector" + }, + { + "contentId": "CefAma", + "kind": "DataConnector" } ] } @@ -927,7 +169,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ForcepointNGFWAdvanced Workbook with template version 3.0.1", + "description": "ForcepointNGFWAdvanced Workbook with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion2')]", @@ -996,6 +238,10 @@ { "contentId": "ForcepointNgfwAma", "kind": "DataConnector" + }, + { + "contentId": "CefAma", + "kind": "DataConnector" } ] } @@ -1021,12 +267,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.1", + "version": "3.0.2", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Forcepoint NGFW", "publisherDisplayName": "Community", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Forcepoint NGFW (Next Generation Firewall) Solution for Microsoft Sentinel allows you to automatically export user defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.

\n

For more details about this solution refer to integration documentation

\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 2, Workbooks: 2

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Forcepoint NGFW (Next Generation Firewall) Solution for Microsoft Sentinel allows you to automatically export user defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.

\n

For more details about this solution refer to integration documentation

\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Workbooks: 2

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -1048,16 +294,6 @@ }, "dependencies": { "criteria": [ - { - "kind": "DataConnector", - "contentId": "[variables('_dataConnectorContentId1')]", - "version": "[variables('dataConnectorVersion1')]" - }, - { - "kind": "DataConnector", - "contentId": "[variables('_dataConnectorContentId2')]", - "version": "[variables('dataConnectorVersion2')]" - }, { "kind": "Workbook", "contentId": "[variables('_workbookContentId1')]", diff --git a/Solutions/Forcepoint NGFW/ReleaseNotes.md b/Solutions/Forcepoint NGFW/ReleaseNotes.md index 1ca0fc4cd7d..a344cc1811f 100644 --- a/Solutions/Forcepoint NGFW/ReleaseNotes.md +++ b/Solutions/Forcepoint NGFW/ReleaseNotes.md @@ -1,6 +1,5 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|--------------------------------------------------------------------| -| 3.0.1 | 15-07-2024 | Deprecating data connectors | -| 3.0.0 | 29-08-2023 | Addition of new Forcepoint NGFW AMA **Data Connector** | | - - +| 3.0.2 | 19-11-2024 | Removed Deprecated **Data Connectors** | +| 3.0.1 | 15-07-2024 | Deprecating data connectors | +| 3.0.0 | 29-08-2023 | Addition of new Forcepoint NGFW AMA **Data Connector** | From 240f766a7f41176836fe328d187345e0409eee57 Mon Sep 17 00:00:00 2001 From: v-shukore Date: Thu, 21 Nov 2024 13:15:33 +0530 Subject: [PATCH 5/6] update workbookmetadata.json --- .../V2/WorkbookMetadata/WorkbooksMetadata.json | 6 ++---- Workbooks/WorkbooksMetadata.json | 8 -------- 2 files changed, 2 insertions(+), 12 deletions(-) diff --git a/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json b/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json index a4e765cff53..6210e7d3937 100644 --- a/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json +++ b/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json @@ -1960,8 +1960,7 @@ "CommonSecurityLog" ], "dataConnectorsDependencies": [ - "ForcepointCSG", - "ForcepointCSGAma" + "CefAma" ], "previewImagesFileNames": [ "ForcepointCloudSecurityGatewayWhite.png", @@ -2988,8 +2987,7 @@ "CommonSecurityLog" ], "dataConnectorsDependencies": [ - "Claroty", - "ClarotyAma" + "CefAma" ], "previewImagesFileNames": [ "ClarotyBlack.png", diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json index 6bb23bf2bc5..7462d3749ab 100644 --- a/Workbooks/WorkbooksMetadata.json +++ b/Workbooks/WorkbooksMetadata.json @@ -78,9 +78,7 @@ "ThreatIntelligenceIndicator" ], "dataConnectorsDependencies": [ - "ForcepointNgfw", "ThreatIntelligence", - "ForcepointNgfwAma", "CefAma" ], "previewImagesFileNames": [ @@ -1381,8 +1379,6 @@ "CommonSecurityLog" ], "dataConnectorsDependencies": [ - "ForcepointNgfw", - "ForcepointNgfwAma", "CefAma" ], "previewImagesFileNames": [ @@ -2451,8 +2447,6 @@ "CommonSecurityLog" ], "dataConnectorsDependencies": [ - "ForcepointCSG", - "ForcepointCSGAma", "CefAma" ], "previewImagesFileNames": [ @@ -3747,8 +3741,6 @@ "CommonSecurityLog" ], "dataConnectorsDependencies": [ - "Claroty", - "ClarotyAma", "CefAma" ], "previewImagesFileNames": [ From bb165f48c6fe3951506c6330f6ec2a026bd3470d Mon Sep 17 00:00:00 2001 From: v-shukore Date: Thu, 21 Nov 2024 13:24:10 +0530 Subject: [PATCH 6/6] Updated deprecated comment in creaetui --- Solutions/Claroty/Data/Solution_Claroty.json | 2 +- Solutions/Claroty/Package/3.0.3.zip | Bin 14778 -> 14782 bytes .../Claroty/Package/createUiDefinition.json | 2 +- .../Data/Solution_ForcepointCSG.json | 2 +- Solutions/Forcepoint CSG/Package/3.0.3.zip | Bin 5519 -> 5516 bytes .../Package/createUiDefinition.json | 2 +- .../Data/Solution_ForcepointNGFW.json | 2 +- Solutions/Forcepoint NGFW/Package/3.0.2.zip | Bin 14657 -> 14654 bytes .../Package/createUiDefinition.json | 2 +- 9 files changed, 6 insertions(+), 6 deletions(-) diff --git a/Solutions/Claroty/Data/Solution_Claroty.json b/Solutions/Claroty/Data/Solution_Claroty.json index 17292bc28df..6ea0ba6439d 100644 --- a/Solutions/Claroty/Data/Solution_Claroty.json +++ b/Solutions/Claroty/Data/Solution_Claroty.json @@ -2,7 +2,7 @@ "Name": "Claroty", "Author": "Microsoft - support@microsoft.com", "Logo": "", - "Description": "The [Claroty](https://claroty.com/) solution for Microsoft Sentinel enables ingestion of  [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel. \n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.", + "Description": "The [Claroty](https://claroty.com/) solution for Microsoft Sentinel enables ingestion of  [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel. \n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors were deprecated on **Aug 31, 2024**.", "Workbooks": [ "Workbooks/ClarotyOverview.json" ], diff --git a/Solutions/Claroty/Package/3.0.3.zip b/Solutions/Claroty/Package/3.0.3.zip index 9c264a2ca4603b8d7246eb618588b136bd9f370a..542a1874a2b5d57701767c534589c2164e4985b9 100644 GIT binary patch delta 2854 zcmV+>3)%F#bG~yIP)h>@6aWAK2moPfby?**dsxB>001VD7axCH{chVh694~zdj~>y zKy1SwN!o6Ai|a1DN%jLscXN%q`6CGmTB2=kBvB#6F$ptj)DY^%NMir* zokAlInLhw!0h5DcF%`=8y-)l4YCgSi$bx%%1{1t|5q*Tm8ROHL&Yr)$2rt4;=NF;b zt4@cU_>3w>B%3fvv>0o0=*(Q)?a`Am%KHa zEOnCex6FTzjZ>-1Rw}QRb-jREGL}ktnhd4}2R@ZTF9*q>X3T!zwUGmYER1FhI1T6$ zm?q~}p;&~3D-{=~rdNPMHBiY^DXYp*TjDl}nA8+dhr*&hxFRVVT@qE*6;!pK;Gq{Q zEjjgj?s5!ngl}@Nn3A+j*c?PcIY4JsIs3#a3{;(I1b%xgVxb2#1fCIF2O^?s%msAAgCX+8RP_-$hCCZ;!F?ZLlvtE` zgen370vMTCMC5E*5^7>p;#$9sj?lGoIVA%PLE!ULi5^EQvU!lQX<1?)IoKS;$=Fw9 zfglIHz=#muJXB1lGmNL?*HjoNAfxb@XOvtOT5LbE2Fr@xc zbCl@KK6SY^`46d%lDYZK zFK7Ph3AgQZ3sF|Z<6@XC1Yqb)p?@O9oO?FFpBE`earyWa{NGqdy~)X z(pq)FB1kbttajjf%RO*MT*rRm9wHF>mWFke7Iu`^H3o$@$s)`bK*CnBx zIaeG4Ub?ofVLdhIk5a@@g@1~R*HM4sJJ73TTpTFVZ!(LPT&@vOgXVcSDV;@4vnyFV%;K7U@ zW-w+Y^3m=h^b3$EAVS>{60mmW@9vg9O6tIRv zz!@%*m1T8x^{A+!r`bncS=QFN;RvX|hZX0l@`{M;;#^s=a5$VJ^{dsiO=W6oLFNz1 z;f(naS&EoU0l-LQ!jON>TT!dp2&?5XO(P)(1H!tLb~pjduiH9x2{c1K8LPA>WyB0; zGLM{F++6jYvS`=E$MQ0IyW)YLsumwu@n(*ijw0mqOmKB*LkAlOr%*?Lv=8=t8F#qr zF!^D&p&RHJvSi$X0NWgX_P~^~XR?{q;jhaL_fY5F=WFuRZmxeSFJuZy_KOvQbv}lF zbsDblSnF$s^zLRiuiapJJ8a^2r?AnquEPUHkT0{@HHo3(s$!RlWhxDq#m7Ql)_(Ki zpQWVrQFvI}{iRX3cCvd$;d&158ig~?oN z{suxZ>5-vQu(e&?0T}8pjmsIs8;i>$$){7?X;LE{ZaP4~Rad~jyT#)>*=xTMdmTvF z^}5t2uxVl7D_Aj`b6WfQeGRz3F$3CyFJ!PY7DDJtM9zOCwRM*5lB%1>vlg_0ZORwsGs?nGjae)=2!w27TU$LCw)#1k3e=axAtRaZL#frGIdv zKHs=egS7%H%#Ts(M>gz>$22Se*~sbPnO10v?GJ9{7f;p7b<#hwwZCe_+P|=cO_d(p zmS1hmmRWz6WL8;9LXgoWOfw1&%dpY&Oc5xl5V3I1r3lS6hsU+*%SNnvB7E*HVV@-Y zX4cr38#8X|sL_gukL`|MH)6QcSVi3BctwE1OLP8!Wu=VsjoVJ;QjXb-f(@lT8-WeY zl!Z)E-(P}vdK?p`Im0vefcgt6*&|!|o2IQi;aGnyku+432C}Aao|36cqGs@ZWP|SQ zHe%6{xz1y&EalTX^TvJcxVO7;Lmt?p6K-$7*sEHJPZHeUP`oIERXo=om=nl{@#OdZ z_RSx%_M3~vGkX>0gS`n;ls-4z%5|9%QMqz^6Xjj&w`IA;-DbEna|ZA(q!E54S8$CqPW_93ReO5ec7ZaV!UpLyjIGxM2PDnscLF{dP1`p_zo@6aWAK2mqRfZ&}A5P3OJ}001mQ000-0PdOTY-5c$0+c@(7 z0rw7s?ts{VKazfIcZ=&Tyh-*0NOyCMyZw;_1ufAwHq`G8Qdid8SsKh1&9#1vRF2qP)Q@E0SF*I;1CS@BA)VDF#tncz2SdQ z8NlF_hKlvv%!DfLt1>VQ22A;qCpugCUp$%-CH)uYPCAk<2Q#jJ=jkL>Ou~v9C4{mu zoY?>Sr!dH477jsJK;-aP%!IOYZ}YiQfYZ%Y65PAZ*tI>lC(?M0$4&mKxTD52gC{tMC~L3zXO)AH~<&|&uCi*B8uSW z5h5c$2pIu?-|huuCf6In9{oTToRZPY5l+RxmM|*w!MfqW0EJ?v25344+@V_XFhn!T zG|B=(6@dT&giNhP6l7WuYGPF8TEC8u(6tIaB?AdT;0sg*9rz zy-34%U!f%^t>3gKIMWx$K#;bU23 zq3~&=xF8i$j1=n=n00voPKnvONMO z@)lfi2zz;k-9UP-&>y8plN$XLQ`k}FK`^U-Wm-m*|IB{mh>INVOrxC4W2g|2Z{YEG z^v1DLrb@38R;@>zSr0}s8YLV3OFj#7=jB9Cmwq-3zZO>UWSDb(4{Q z%mr3L-j7G)s%1hwrRQcvSRc%zQ+7^RhzGr$k~e&=1ARvm-p?wz7ZB$5`g>pZ_x5*y z;3n-llA5%*{7ePftTQ;2A~}RQp#mM!2@4Ut*&31%M&=?6Y>|3u^g}4wu=JW01h8U& zb&SbJA?jVkVaX&)7NM?b5|FAPS!z{()2VSB7W_s-P`OcHM3as+$c}Z7&Q8?WvOs_KID531rp9>u)_vt_}e4Xt5A-tZEkboISM5toB&-uUJ;2+&b5q%=x~kPuhxq<<;2v1`X36b zISUiA5-FL10V9+NL$-QFscOT2td^_1n1u2R0GkTi(G+Zc(*~+XU>K^(ROK@{AqJhP zJPK-Yi#717tbHs$R@3OG1rPMprFhGNH)}LZluf><1lLg;IM_ybrEUV0eX#R$)ZyO4 z)Q4_cH`FQA%D52$vN`o5HuJkv*lt?a;SnQ9m)Y`~!ccKl(@RY=wSkNBV`&))8|tm)i)KcX4b zE5>3yjeXk|cD=0I*6!o2YZp(3u#>id<2zR9lU5XJ4)_vC*Hg-|q?C_GOVyZMy~Hzu}|+(v0%uC&j3%hV%u!LbuB-=uUc;6{*JZ%RV&*5g)MEVbnCkO zYHPZ5Rg%fFl*GV)qb-=`6dab}U=WxlP}U)0@q$Yco68P&tJP<%X!S&d++V>yNrdg> z*k@Z)Ztkeb8jE-Bj$gN;xYJZ6+~;^vfWk`)ev54-NBP!urwT47Y)(Ok(w>dLhGxcM zCTSS1z&itu1=E7z$$Lb@C6(-swfs%nTAp(3mPi__X$w_<(>M1?)fHBqdEc=@_xD=S z=-6E9v0awx>79Awrh44p+qxnT?9mCg_h9UWt;{D0?r$hwm%%QcZx74~)Wdl4dvpC3 z4{rSGX7Su!g?VRh!j!o$RJV3rrUF#$++GEF-TrNrvisM>&FCW;fuC&N%G8`>nGxod)bsQuiG%@&%mB>}G5X~=%xUSF?5{MI5R28b1eJt}>0 z31j*7US@W+60Zz`KbE~_m0h4zczyDKO-B(WcnDg$4%xBvo@RG7kHw7G3xfnE$9QYa?wzag>4i@ng3VdxhZnxKIs8D{NOvTR_HfL#nhUW)lBklB*-I0O0Vcd?5Y_FNz zWFtAl3Ze*V_u)m8cAC{E#|K#_uN5QNUURy^NF1*uztd05<>iNDCGB*+Un5tQzHckm zvb`pEgSA*oL8kHc%YzFiZ8gm`-q9k;r{HDwL!DMkWqUpJ22;rx#qEDw62L<;mv*}G z6?4&lRL`^3zACYJM1`9#dCaF#!GDj>zjd\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Claroty/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Claroty](https://claroty.com/) solution for Microsoft Sentinel enables ingestion of  [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel. \n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.\n\n**Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Claroty/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Claroty](https://claroty.com/) solution for Microsoft Sentinel enables ingestion of  [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel. \n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors were deprecated on **Aug 31, 2024**. \n\n**Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", diff --git a/Solutions/Forcepoint CSG/Data/Solution_ForcepointCSG.json b/Solutions/Forcepoint CSG/Data/Solution_ForcepointCSG.json index 32913d85777..32110310edf 100644 --- a/Solutions/Forcepoint CSG/Data/Solution_ForcepointCSG.json +++ b/Solutions/Forcepoint CSG/Data/Solution_ForcepointCSG.json @@ -2,7 +2,7 @@ "Name": "Forcepoint CSG", "Author": "Forcepoint", "Logo": "", - "Description": "[Forcepoint Cloud Security Gateway](https://www.forcepoint.com/product/cloud-security-gateway) (CSG) Solution for Microsoft Sentinel exports web and/or email logs so that custom dashboards can be created using Workbooks to visualize events and insights on activities of Forcepoint Cloud Security Gateway.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/csg_and_sentinel/).\n\n This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.", + "Description": "[Forcepoint Cloud Security Gateway](https://www.forcepoint.com/product/cloud-security-gateway) (CSG) Solution for Microsoft Sentinel exports web and/or email logs so that custom dashboards can be created using Workbooks to visualize events and insights on activities of Forcepoint Cloud Security Gateway.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/csg_and_sentinel/).\n\n This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors were deprecated on **Aug 31, 2024**.", "Workbooks": [ "Solutions/Forcepoint CSG/Workbooks/ForcepointCloudSecuirtyGateway.json" ], diff --git a/Solutions/Forcepoint CSG/Package/3.0.3.zip b/Solutions/Forcepoint CSG/Package/3.0.3.zip index 90eed2397a63b6d1144e69940272988e10d05133..21550a1307be11e391acf6efd2443c2baa68f28e 100644 GIT binary patch delta 1888 zcmV-m2cP(lD~u}}P)h>@6aWAK2mq66by#Jb004Rv000-0AQc)Atypbu+cpsX zK4Aahpl$FAkwqwfizUlW+jT`zSmg0|_uO+Y?E5dj0Pwyx;hZPTI|OfTZDtOGpjhz} zma>>9JheW1muv2aDk=9&u;=gl2jfihh2YEJSaW9itLGW=q z${V@6<}8gQ*L2r~2(>b5X8j|lyP=^JUT|$t5ec_0E4MR$rdh%*3ZcY%TEfLpr85z) z7jQ|KH{u=B5iZV{G<;O=Oqmg(X$s?F#7(G0X3Lv@5=jh3hfgLoI+`v0SlD?!%?;Oh zqa}n08|O*!@AwKAMapG>V4;!0xr&u3_TE-|zFEW*50)abbG+b(@3VXSoO2P+ZTClN0Sq_LhIq?E>+7EgfV&326l&ZG=V99@2qS#PPz~tK*qIYNI&wLfDr~N zdq$9TaZ9>z`DE42+IBdWDv#ibhq)GZ1!u_7C0nfxTP~OWtQL15Wm-jfXoHZBj!k)V z92Z9i&_^@|wPhGQ4Rta=g(~p-OlfOi$)|u>6QC64osb|^Y%pl(0J9M0#;OD&X693c zBsUO$vXpQPT{=aO8-nAF(sxs(?hJXp5GH3*yyL(Zc$*>h1Oc(m09wRCD;Ai<9KUAp zK`6af`KyuiPXFde@8syX@pYb6>>Kk4^Spo^dZ^PX9yL8ql+Wj zN_l9NGd{#@!w)A!!SIQ}PP|sN6jD+YN@8Igm;o$UmH=&IQi?d|{W8^GT%S^^uUVlv z5(_cH_%`K9Thq+r%FMzfelLtAcWU#APA*1RN<+sFR5BbM!O1NalVTI#Ct_~AP1kp%;9)F|2}pEj#@qn_g? zDo{Cc>7`Z+5f%O7rYQlmZZQ%VY|c2%*VX$PHD6;`V@H z2eg;DPOE2%Y2%`+)I(nu53MkB25?QiW_QT-Z}t#4Ov~p!O{y%qD7! zzlw;6RVf)EuOQ|YgoT;Lf>h=PmKG*g7P~CeP_(RjXgTF!X%bV(t5&_k^eUidTIE^C zen!3Uw4^@nTAeo)RX@ugmE!dY!L8SZ`VVZab{k3Nibg8$?DV?LOdQPY+}()xBR%@f z zaqc=tR8}>74lxpVJrrZU6fZ67oV9vYO@W+7 z=PhH94@WcP{H~YS2yhw4!D2jb#>=U5lgHXxdaLq&4^wUfhVhS&IS2^#+Wq_&RUT5dk9pM`V{1A((NAZFJN5`W3bkcwzB0Uc z6lqRxUdqEfrQyJT(#sSF5KK3nr}(C%>kZ|nUbn){#GpS9n@bxDx6RMSUcJ6q-|>}_ z@6aWAK2mnQ4b6G-@OBD~ZaR-nM4U=khS&S`? a$r}d%0D6-S6;=UIlVueo2J#dD0001yO@vqg delta 1884 zcmV-i2c!6mD~~H1P)h>@6aWAK2mnQ4b6Iqfpuipn004v(000-09Tgf7typbu+cpsX zK4AZW&^A~$kwqwf8)eyPyRIk-i##6ho_p?vegEYbgm_=;Xu(qI9TIP0Os)^Zuv`gJ zn$d)%EHeRpS11-lGOhM>xEJgP2a{Z}C1f42yFrG#fWNGpc!{U13;^nT{0CO?C56JWYsJ(UWO|j-sm|;bu|H3e6PU zXb>U9#(GlzJGp{Io-q*uSYTv$E)%KCy|?vVpqI(iBP$-81zhmM_xU}1E*MW1rulw4 z&8FFC^qVw)>~J(9F9oBT5yj?A5hICNFfx}y$Q92LGGlY87~z>VR0v$beJw?S4jmHI z_0L~_lS_+aXOrAqvQjr*rEmS(-_qCJ4jRQ+?d4UaOoz{;idZgrX1+PtJH9##EA3W! zkj6tag`h3h3kD{qbPd*%o4ZV|GQzbkTpQ>e&{2nfy1KKrSzGB+ct~=l3ojl6x8aj#r`V>>W zWrbouEWilj>&l}x*UaPE%+e%w&$U5!8uKA65TYtH5-kLXK)I#LY)wX^qaq>S?vKfT z!QR1lqfup0Lm#wi-=@epqbe&SUaIR;xR<@QiPS+Gl0QjbOH)4{KiuR$@L}kUo${@V znOnb|$_|^LKo-ENmr5>qTy~BdSAw{G=>^mi3$wmx8e!Pn?B2TTAQjK6vbdL*@!fQS&la*d7dYHtTDIgVtG-Qas00?=%L)TxK_Hr8abj^t zHxz)F*CWkMVta$~1=pvjtTBw0utuDr9;>n<~4L^BI} zBis-4@ZIEui+DU9IN9*A3G_36&H1Dn4xd1s+MDeCIN94DfWh0M+nBU1imQ(dVA(i= z6D9K#m^eDpg3g#g@$GEL1*|Njh|9V6%EpIKvg7Iv7Q}F4j1!SVej&nP0JJ@P1liKJ^Z#-e62n%$^#P!PFa1J!{GK-G>3F zzTMy{a+@m__iKcUSX+`@p^9j?b@hNTIR9Yr*jmcFMCxxt_MBG|-Ect%hfwjjuHxRY zeFZ_kv~1YXH@sYG(>-^8A~Uxrcf6ko8nbI|EC4$!1fF4&?6uX+?$Lu`V%WXuwY8mT zcn#9OK*zc39g%t2oO>M$)!`j=UTw}_x`D}umjuj43np^1mIX<0M1Lt?W$;JehVK6KQbvIsCot->dYw^_# z{~36D$CeG3^6ezJsoKiHgTr(Fg94ucLE2b{uP!?uHV?$m6fo{`Dkfkyho2J&rJC4j zW>ft`ci}VO-2Zqa;SpuCZu39`$OoTY&7-cTV^~vS!ybEt9i`eT zHD75~K93Z`*DvOOVUgi*VDOC!0|=y>Dl&M+;Po2wQ?;#dGcoYb!{*Y)!ma!1>^19~ z^&MU*dC~2e?G!O_W@+zc&cSg1KekSA*#C_7Ifj-7gL8et_P_f2ReSSBpS8WR_My`! zy^d$~hu;xtCmNL5a$7y1Sxn&{`1>zVO9KQH0000807YT5TnC~J4MkydS#*-1z#azx W0ECkZ6;=ULlVTMl2K5vG0001b0C{Hs diff --git a/Solutions/Forcepoint CSG/Package/createUiDefinition.json b/Solutions/Forcepoint CSG/Package/createUiDefinition.json index 576d6c7e87d..7f2a581656d 100644 --- a/Solutions/Forcepoint CSG/Package/createUiDefinition.json +++ b/Solutions/Forcepoint CSG/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Forcepoint%20CSG/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\n[Forcepoint Cloud Security Gateway](https://www.forcepoint.com/product/cloud-security-gateway) (CSG) Solution for Microsoft Sentinel exports web and/or email logs so that custom dashboards can be created using Workbooks to visualize events and insights on activities of Forcepoint Cloud Security Gateway.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/csg_and_sentinel/).\n\n This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.\n\n**Workbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Forcepoint%20CSG/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\n[Forcepoint Cloud Security Gateway](https://www.forcepoint.com/product/cloud-security-gateway) (CSG) Solution for Microsoft Sentinel exports web and/or email logs so that custom dashboards can be created using Workbooks to visualize events and insights on activities of Forcepoint Cloud Security Gateway.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/csg_and_sentinel/).\n\n This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors were deprecated on **Aug 31, 2024**. \n\n**Workbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", diff --git a/Solutions/Forcepoint NGFW/Data/Solution_ForcepointNGFW.json b/Solutions/Forcepoint NGFW/Data/Solution_ForcepointNGFW.json index 1605df4a580..1ae82336612 100644 --- a/Solutions/Forcepoint NGFW/Data/Solution_ForcepointNGFW.json +++ b/Solutions/Forcepoint NGFW/Data/Solution_ForcepointNGFW.json @@ -2,7 +2,7 @@ "Name": "Forcepoint NGFW", "Author": "Forcepoint", "Logo": "", - "Description": "The [Forcepoint NGFW (Next Generation Firewall)](https://www.forcepoint.com/product/ngfw-next-generation-firewall) Solution for Microsoft Sentinel allows you to automatically export user defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/ngfw_and_azure_sentinel/) \n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.", + "Description": "The [Forcepoint NGFW (Next Generation Firewall)](https://www.forcepoint.com/product/ngfw-next-generation-firewall) Solution for Microsoft Sentinel allows you to automatically export user defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/ngfw_and_azure_sentinel/) \n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors were deprecated on **Aug 31, 2024**.", "Workbooks": [ "Solutions/Forcepoint NGFW/Workbooks/ForcepointNGFW.json", "Solutions/Forcepoint NGFW/Workbooks/ForcepointNGFWAdvanced.json" diff --git a/Solutions/Forcepoint NGFW/Package/3.0.2.zip b/Solutions/Forcepoint NGFW/Package/3.0.2.zip index 300d93b79234aff897485489a8327003f3f84f9c..6590dd6c61af2ce3cc7741358324a8f7e3f65db0 100644 GIT binary patch delta 2068 zcmV+v2@6aWAK2msh>by=t1z*)Zs005|w7b<^XTUatE%5ht?Fq$pY z#Bmp}vx~&t{IHB*M2@JbhaB$AP>MEdV4tOr)+gzAh8K~dly#Z~)(8S~=FGW%=jM;U z{S9Nm?`^yi84oU4uyU@j7t?8V5@kH+smMg`BK|{ZL=@|+zO&P_=vj0=DU4W4v6;Rw zf;;iAuV0F#%%y*mI*)Ej<>Yr+^lz*4-vyzUwc>fAgdtfsGB(=krHf{scZWkwycWiS z5fS%<)z<|#JQEH?p!i5fIE;0^lrnVjKf6O*vP`w zlK&>Nlvxu$pSRvId=sV8t;$7dg@Hsz9wOg(ORE1TZ*hMpbD^ei7L=S`>r~t7?tOC? z*>yS(*hVI91p$BgbMXP6D4;`Ee#s|2@#8LACfviGCL-pbbF209}| zW98eLnVo;W(k2##mbv@G`Pu8MSMR1Zd(S<}k}>JRNSWJ}fX*4;LVb4kkn2s(q_t&N z3H|^)+NrIDHcDGhT@jC2A&ld|ADK;_k(Mzjh(-gu6}@si&Z| zKH~3TzLG?HJw3m1bp{^%1#4yqP={D zNO3m1nbB1)VmOLSh*28w;fV+X6yA!wWwnt?QRdZ2fKYPFP+g(Oa?dk0iFZL%*QIZ6 zFR3o=98QSH;Hkv+=!sib%@>WDl}h4+w9bdNIk#*he56qKWAuiE9CLa)D^vEzXCZ$( zKRf@^>1nM+8-G&eoX+m91vhyW>?+7ZNDRu0k5m(=G5e7XxwIAT(~sK%1t^Szu+v~{ zx#)J7PVd1b80Zp!`WA=>jD2sr>r$|8=lrIq3yHmHTlKV++?9IlAy;1`U(jysl(Ntk zJQkK}RwaGP(XHK^66yR2Zao%03ZH)1r(9A+3%Z2&yN}1N%ao4!L3g45bE+o$ z7c^?f1j$4#{GT!*Ts2HWz>1~9G3lxzRHp`N4Od&#RLfdd^t5~I85Q`#s6;bX98tXq z=#|lBG0@*v^~)OhxOJxNGHQOUe`y%+2A38Z-3cbgSVVTi#_QR;)|9SRZd-qd{t(u} zI+~emR!C&0Gg|duX{~N0SrPc^wUmm+FRJ`I@W7p@Q$CxiuaI-!)IMO|3Cs$rNFwR+ zM%E{?8M^LLKMb0Y5_#%Yqn;B-F1=sGFP+B$M!@lMPQzpud0fLQd-O^*QR)+2ri6le1?hQ20=ETa^w)ar49gR^1|c zX>{=tBTkvK>~>hjcmS;D2ltzRRf!E~l?c)hp z-|yj+u#H(U8P2xzNsD<)Qg`j9tTT#A4tP%WY2X?(GM3oI6@_priuqI z{GLX`AEDt$-v|nAUH^aGOPzO%a?kpO;)%GG&O6|UhQJv$$w6D)?;Zm;OdLk{L0dbT zhPR;p2RhEf;E67(<~-HHHkwe!pmL8bv%iKY8r5rM)r=`lf$9c0c=V^yeK9eTH8A zg&pr@9JuI0em4p3v-WhQkwNEAD6|1YS*smwf_^@1H`u8wX_vv)Rj)M@gwjm>G_%kC zv48Ld?tJ!iPre0WDC_ngv<~U6m`7G)EX`O6#{(Y6(vW@*1z}*u!F2SbpN|ax>=Wpy z*w(3eMT29LYP5f@H|e2yII3rw;u*?jP+P+;=}e4-eeSZ}6f}vf530(0V$0B6d^N zknS6-G$|EqD-4aIXct_$)tBRI_tBp3PZ-#fi?Tnp?dC$*NoSi2?vOv$jsDN!4c;4l z!2lOxsKV;jyzmoPBYv}!yf^9jX|1uLH>m|Z%bJf-k7PGf6U_l>&5GcCivRHMf3x=o yyf7QsYIRws-@sYF2LJ%57XSbk000000000103egjI7k8XlNUK82BbIu0002MOZ~0@ delta 2096 zcmV-02+#Mva=~&NP)h>@6aWAK2moAWb6FOb6eq$5006TW000-0&o~-?#aQcZ+sGCE zU!dPD2)gs zoz-`Cb{0Mh&!>eE8!5Jbvlm8iC;svEOOeQ2I;r#Urc_RTmxcedI{)1$@UqrCkCiYa z>qbUKTb;OY?s<1O)WjQMEEo}SPgs3jaKkg}9bcDl5=ZQ>r2RM@Uo&15D7>5a0 zRs`+Midz|VUi-sX*vQDj)sp`zvy@pAJzuuoF?<`Q(yhx?X@!A*L`NPX-*`)^|EF(p zD087^a2AxDUF%fa>h67W7urp_9I>s8-5LV^{HNjrKG#B~YuA2%xy+aO>FI0j#Kq|; z`&J2V1v4TMhB?jLTChYbrMEIq*-9kZ2qtsuxKeaN_g1Tt47y;%>&JiphrRKh>|L_O z8&UBlQTA@!*jw3udfY%~glMdMTQjq>SK36P&@y*_I6r%R_3GWMX79O&Sv(i?sL7(nY6a-D#7o8M?15%&_-$NsVm|MD}-?z_#?B)Gt#m~p@0>Kj>``H z6_Qp^h%I&oFjAk5UyBcpU5Q*6?)~*j8nMNz$xh4db{i&t?K|(X!sxh++$>L%?KB6A zY1*=wCJl>LPsGx&HaA$~WCkL=wd_Hcq&qL2&cGtV@dFbd3T+%CG_sfyP{eFsd!Bhzjfk{~A#wHKB?WlO zR|+>tY2agj!*Fkes(iKumRQUkXNl1n^GIS_ZSIxkv1KR^O#4TP5U~yXfz05;4H#w` zr9~SGZ^R2;YvozK1B;c`_hh4$u^6z@M;2}Y8_0|WkfI=QrAt>qrA>quA`4h7(mLF+ zj!LS9{%aTVPPpqtk$MJN>m&Xi2E6yh^L+!|*~Djm;cZVO{*FZ<@)$%6-;|gybOwvr z<%Z6nI0C+VKxLAXzY7taEAes=!H)6-g^77C=*Ih`%81vhyW_ln&iIu0t04_Xtm z3Huj2bgv6#DBLmi-HwI%JHzqHg|`j0s{5lYngnONC?7RrRRO5|kaT z9#CE_YhBUPuB#GFDpVttXeNv!sy6|>GP*1d^!Ek+vQ7frI#YHTHGkHBG>msMObd;F z?l6;MLL$3i{=t(@~FF@s&_SK8%J!;bg59Y$T$$K0b_h z(%>-^#E=-%^yXWNqPXiE14{e4g9!UyLc%(Oe&_6P;)wV=t`Kq`z>F8;3XtP}Dm}(0 z{RB9fgc~9cSWP!!&%bP1svSFh4UVS1L*yp`Yt9DoHvz#|I+1xkXq{G!YZRS)Tvk3` zjxLs?lK`bgWd2paPL`u!Ir5qe-+np)>mIUeY-4PU4{Jo%W4n^nC8~jT*HjP8?8VO( zkHJ#j2h!m+vgf*{=!Xj(9HEkbDAjd_zwj#?&4Gl5BYk63XzTj#Uh2GClzY~%6pzKN zblw3+Gz8A5NglM-{qAw#hN;68f6&&Brr|B9|BjAxfAB>6+H!#CiXF*l@@jwns@f7M zGsf0~*=Q|P;dg@+0QMs=m7!{2C$BnhtTPYIJctPjgabn|n~@JU^w=xMsw3B z;@SDhW2Y^xm|?GPc1qoT%%0+S=yU)7cD$D{aM6YQZW7#Q?deJ*yT7K;G7x61cC-}w z`LJDPXAbL}kyya$4QGl_nyH^=_St{>#oYPq>7ING#8B4lKWH7&-8PSG$=IK<9Zn8- z981Fi6Nb$gOvlee#?PUDqnDajG&nY?Mw@$MX=gk3%PHl_(|=89Q))kT2Eu=EaQFFm zIR91fz~=FW=Mm~rQ>A}#gq;6+2%&21)-=IVEfy%K`0)p$PV*?qT*-ceLx^J-3q*So+(+!QHXct_$_5Y5q-N)Tku?Yiva#8lDw%r^% z?QC7^<+kH81=G)`)M_rD?1;>G^4`v7tAqb@$ZKqWKv2 zNOm(d(F{myRs`=;{D*%(0Z>Z=1e5PL8nY4zo-i9+W^-8\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Forcepoint%20NGFW/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Forcepoint NGFW (Next Generation Firewall)](https://www.forcepoint.com/product/ngfw-next-generation-firewall) Solution for Microsoft Sentinel allows you to automatically export user defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/ngfw_and_azure_sentinel/) \n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.\n\n**Workbooks:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Forcepoint%20NGFW/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Forcepoint NGFW (Next Generation Firewall)](https://www.forcepoint.com/product/ngfw-next-generation-firewall) Solution for Microsoft Sentinel allows you to automatically export user defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/ngfw_and_azure_sentinel/) \n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors were deprecated on **Aug 31, 2024**.\n\n**Workbooks:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions",