Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Repackage - Claroty #11435

Merged
merged 6 commits into from
Nov 21, 2024
Merged

Repackage - Claroty #11435

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a9f8fd2
Repackage - Claroty
v-rusraut Nov 15, 2024
73c6cf7
Updated Analytical Rule Version
v-rusraut Nov 15, 2024
e43ec0c
Repackage - Forcepoint CSG
v-rusraut Nov 19, 2024
ddffcc5
Repackage - NGFW
v-rusraut Nov 19, 2024
240f766
update workbookmetadata.json
v-shukore Nov 21, 2024
bb165f4
Updated deprecated comment in creaetui
v-shukore Nov 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 1 addition & 7 deletions Solutions/Claroty/Analytic Rules/ClarotyAssetDown.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,6 @@ description: |
severity: High
status: Available
requiredDataConnectors:
- connectorId: Claroty
dataTypes:
- ClarotyEvent
- connectorId: ClarotyAma
dataTypes:
- ClarotyEvent
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
Expand All @@ -32,5 +26,5 @@ entityMappings:
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
version: 1.0.2
version: 1.0.3
kind: Scheduled
8 changes: 1 addition & 7 deletions Solutions/Claroty/Analytic Rules/ClarotyCriticalBaselineDeviation.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,6 @@ description: |
severity: High
status: Available
requiredDataConnectors:
- connectorId: Claroty
dataTypes:
- ClarotyEvent
- connectorId: ClarotyAma
dataTypes:
- ClarotyEvent
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
Expand All @@ -33,5 +27,5 @@ entityMappings:
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
version: 1.0.2
version: 1.0.3
kind: Scheduled
8 changes: 1 addition & 7 deletions Solutions/Claroty/Analytic Rules/ClarotyLoginToUncommonSite.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,6 @@ description: |
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: Claroty
dataTypes:
- ClarotyEvent
- connectorId: ClarotyAma
dataTypes:
- ClarotyEvent
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
Expand Down Expand Up @@ -46,5 +40,5 @@ entityMappings:
fieldMappings:
- identifier: Address
columnName: SrcIpAddr
version: 1.0.2
version: 1.0.3
kind: Scheduled
8 changes: 1 addition & 7 deletions Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLogin.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,6 @@ description: |
severity: High
status: Available
requiredDataConnectors:
- connectorId: Claroty
dataTypes:
- ClarotyEvent
- connectorId: ClarotyAma
dataTypes:
- ClarotyEvent
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
Expand All @@ -37,5 +31,5 @@ entityMappings:
fieldMappings:
- identifier: Name
columnName: AccountCustomEntity
version: 1.0.2
version: 1.0.3
kind: Scheduled
8 changes: 1 addition & 7 deletions Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLoginsSameDst.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,6 @@ description: |
severity: High
status: Available
requiredDataConnectors:
- connectorId: Claroty
dataTypes:
- ClarotyEvent
- connectorId: ClarotyAma
dataTypes:
- ClarotyEvent
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
Expand Down Expand Up @@ -39,5 +33,5 @@ entityMappings:
fieldMappings:
- identifier: DistinguishedName
columnName: SGCustomEntity
version: 1.0.2
version: 1.0.3
kind: Scheduled
8 changes: 1 addition & 7 deletions Solutions/Claroty/Analytic Rules/ClarotyNewAsset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,6 @@ description: |
severity: High
status: Available
requiredDataConnectors:
- connectorId: Claroty
dataTypes:
- ClarotyEvent
- connectorId: ClarotyAma
dataTypes:
- ClarotyEvent
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
Expand All @@ -32,5 +26,5 @@ entityMappings:
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
version: 1.0.2
version: 1.0.3
kind: Scheduled
8 changes: 1 addition & 7 deletions Solutions/Claroty/Analytic Rules/ClarotyPolicyViolation.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,6 @@ description: |
severity: High
status: Available
requiredDataConnectors:
- connectorId: Claroty
dataTypes:
- ClarotyEvent
- connectorId: ClarotyAma
dataTypes:
- ClarotyEvent
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
Expand All @@ -32,5 +26,5 @@ entityMappings:
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
version: 1.0.2
version: 1.0.3
kind: Scheduled
8 changes: 1 addition & 7 deletions Solutions/Claroty/Analytic Rules/ClarotySuspiciousActivity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,6 @@ description: |
severity: High
status: Available
requiredDataConnectors:
- connectorId: Claroty
dataTypes:
- ClarotyEvent
- connectorId: ClarotyAma
dataTypes:
- ClarotyEvent
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
Expand All @@ -32,5 +26,5 @@ entityMappings:
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
version: 1.0.2
version: 1.0.3
kind: Scheduled
8 changes: 1 addition & 7 deletions Solutions/Claroty/Analytic Rules/ClarotySuspiciousFileTransfer.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,6 @@ description: |
severity: High
status: Available
requiredDataConnectors:
- connectorId: Claroty
dataTypes:
- ClarotyEvent
- connectorId: ClarotyAma
dataTypes:
- ClarotyEvent
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
Expand All @@ -32,5 +26,5 @@ entityMappings:
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
version: 1.0.2
version: 1.0.3
kind: Scheduled
2 changes: 1 addition & 1 deletion Solutions/Claroty/Analytic Rules/ClarotyTreat.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,5 +32,5 @@ entityMappings:
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
version: 1.0.2
version: 1.0.3
kind: Scheduled
8 changes: 2 additions & 6 deletions Solutions/Claroty/Data/Solution_Claroty.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"Name": "Claroty",
"Author": "Microsoft - support@microsoft.com",
"Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">",
"Description": "The [Claroty](https://claroty.com/) solution for Microsoft Sentinel enables ingestion of  [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel. \n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.",
"Description": "The [Claroty](https://claroty.com/) solution for Microsoft Sentinel enables ingestion of  [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel. \n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors were deprecated on **Aug 31, 2024**.",
"Workbooks": [
"Workbooks/ClarotyOverview.json"
],
Expand All @@ -21,10 +21,6 @@
"Hunting Queries/ClarotyUnresolvedAlerts.yaml",
"Hunting Queries/ClarotyWriteExecuteOperations.yaml"
],
"Data Connectors": [
"Data Connectors/Connector_Claroty_CEF.json",
"Data Connectors/template_ClarotyAMA.json"
],
"Analytic Rules": [
"Analytic Rules/ClarotyAssetDown.yaml",
"Analytic Rules/ClarotyCriticalBaselineDeviation.yaml",
Expand All @@ -42,7 +38,7 @@
],
"Metadata": "SolutionMetadata.json",
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Claroty",
"Version": "3.0.2",
"Version": "3.0.3",
"TemplateSpec": true,
"Is1PConnector": false
}
6 changes: 0 additions & 6 deletions Solutions/Claroty/Hunting Queries/ClarotyBaselineDeviation.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,6 @@ description: |
'Query searches for baseline deviation events.'
severity: Medium
requiredDataConnectors:
- connectorId: Claroty
dataTypes:
- ClarotyEvent
- connectorId: ClarotyAma
dataTypes:
- ClarotyEvent
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
Expand Down
6 changes: 0 additions & 6 deletions Solutions/Claroty/Hunting Queries/ClarotyConflictAssets.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,6 @@ description: |
'Query searches for conflicting assets.'
severity: Medium
requiredDataConnectors:
- connectorId: Claroty
dataTypes:
- ClarotyEvent
- connectorId: ClarotyAma
dataTypes:
- ClarotyEvent
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
Expand Down
6 changes: 0 additions & 6 deletions Solutions/Claroty/Hunting Queries/ClarotyCriticalEvents.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,6 @@ description: |
'Query searches for critical severity events.'
severity: High
requiredDataConnectors:
- connectorId: Claroty
dataTypes:
- ClarotyEvent
- connectorId: ClarotyAma
dataTypes:
- ClarotyEvent
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
Expand Down
6 changes: 0 additions & 6 deletions Solutions/Claroty/Hunting Queries/ClarotyPLCLogins.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,6 @@ description: |
'Query searches for PLC login security alerts.'
severity: High
requiredDataConnectors:
- connectorId: Claroty
dataTypes:
- ClarotyEvent
- connectorId: ClarotyAma
dataTypes:
- ClarotyEvent
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
Expand Down
6 changes: 0 additions & 6 deletions Solutions/Claroty/Hunting Queries/ClarotySRAFailedLogins.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,6 @@ description: |
'Query searches for login failure events.'
severity: High
requiredDataConnectors:
- connectorId: Claroty
dataTypes:
- ClarotyEvent
- connectorId: ClarotyAma
dataTypes:
- ClarotyEvent
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
Expand Down
6 changes: 0 additions & 6 deletions Solutions/Claroty/Hunting Queries/ClarotyScanSources.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,6 @@ description: |
'Query searches for sources of network scans.'
severity: Medium
requiredDataConnectors:
- connectorId: Claroty
dataTypes:
- ClarotyEvent
- connectorId: ClarotyAma
dataTypes:
- ClarotyEvent
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
Expand Down
6 changes: 0 additions & 6 deletions Solutions/Claroty/Hunting Queries/ClarotyScantargets.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,6 @@ description: |
'Query searches for targets of network scans.'
severity: Medium
requiredDataConnectors:
- connectorId: Claroty
dataTypes:
- ClarotyEvent
- connectorId: ClarotyAma
dataTypes:
- ClarotyEvent
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
Expand Down
6 changes: 0 additions & 6 deletions Solutions/Claroty/Hunting Queries/ClarotyUnapprovedAccess.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,6 @@ description: |
'Query searches for unapproved access events.'
severity: Medium
requiredDataConnectors:
- connectorId: Claroty
dataTypes:
- ClarotyEvent
- connectorId: ClarotyAma
dataTypes:
- ClarotyEvent
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
Expand Down
6 changes: 0 additions & 6 deletions Solutions/Claroty/Hunting Queries/ClarotyUnresolvedAlerts.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,6 @@ description: |
'Query searches for alerts with unresolved status.'
severity: Medium
requiredDataConnectors:
- connectorId: Claroty
dataTypes:
- ClarotyEvent
- connectorId: ClarotyAma
dataTypes:
- ClarotyEvent
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
Expand Down
6 changes: 0 additions & 6 deletions Solutions/Claroty/Hunting Queries/ClarotyWriteExecuteOperations.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,6 @@ description: |
'Query searches for operations with Write and Execute accesses.'
severity: Medium
requiredDataConnectors:
- connectorId: Claroty
dataTypes:
- ClarotyEvent
- connectorId: ClarotyAma
dataTypes:
- ClarotyEvent
- connectorId: CefAma
dataTypes:
- CommonSecurityLog
Expand Down
Binary file added Solutions/Claroty/Package/3.0.3.zip
View file
Open in desktop
Binary file not shown.
Loading
Loading