search

Azure / Azure-Sentinel

Cloud-native SIEM for intelligent security analytics for your entire enterprise.
https://azure.microsoft.com/en-us/services/azure-sentinel/
MIT License
4.52k stars 2.97k forks source link

DomainTools New Playbooks #10723

Closed RamboV closed 2 months ago

RamboV commented 3 months ago

Required items, please complete

Change(s):

Guidance <- remove section before submitting

Before submitting this PR please ensure that you have read the following sections and filled out the changes, reason for change and testing complete sections:

Thank you for your contribution to the Microsoft Sentinel Github repo.

Details of the code changes in your submitted PR. Providing descriptions for pull requests ensures there is context to changes being made and greatly enhances the code review process. Providing associated Issues that this resolves also easily connects the reason.

Change(s):

The code should have been tested in a Microsoft Sentinel environment that does not have any custom parsers, functions or tables, so that you validate no incorrect syntax and execution functions properly. If your submission requires a custom parser or function, it must be submitted with the PR.

Testing Completed:

Note: If updating a detection, you must update the version field.

Before the submission has been made, please look at running the KQL and Yaml Validation Checks locally. https://github.com/Azure/Azure-Sentinel#run-kql-validation-locally

Checked that the validations are passing and have addressed any issues that are present:

References:

RamboV commented 3 months ago

During packaging we encountered some issues and are currently investigating the exact problem. Please refer to the below screenshot for details. Any suggestions or insights would be greatly appreciated.

image

v-prasadboke commented 3 months ago

During packaging we encountered some issues and are currently investigating the exact problem. Please refer to the below screenshot for details. Any suggestions or insights would be greatly appreciated.

image

This error is an exception, This can be ignored

And thanks for raising this PR. This PR will be investigated and we will update you about the same before 05 July, 2024.

v-prasadboke commented 2 months ago

Hello @RamboV, Please create a custom table named as DomainToolsDomainEnrichment_CL at location https://github.com/Azure/Azure-Sentinel/tree/master/.script/tests/KqlvalidationsTests/CustomTables

Custom connector located in Playbook folder, looks like Function app. If it is a Function app please move it to Data Connector folder and add Data connector file as well.

RamboV commented 2 months ago

Hello @v-prasadboke, Added custom table DomainToolsDomainEnrichment_CL.json at specified location.

v-prasadboke commented 2 months ago

Hello @RamboV, Please create a custom table named as DomainToolsDomainEnrichment_CL at location https://github.com/Azure/Azure-Sentinel/tree/master/.script/tests/KqlvalidationsTests/CustomTables

Custom connector located in Playbook folder, looks like Function app. If it is a Function app please move it to Data Connector folder and add Data connector file as well.

Please have a look at the below mentioned point

RamboV commented 2 months ago

Hello @RamboV, Please create a custom table named as DomainToolsDomainEnrichment_CL at location https://github.com/Azure/Azure-Sentinel/tree/master/.script/tests/KqlvalidationsTests/CustomTables Custom connector located in Playbook folder, looks like Function app. If it is a Function app please move it to Data Connector folder and add Data connector file as well.

Please have a look at the below mentioned point

Hello @v-prasadboke , it is a FuntionApp custom connector, very similar to the below https://github.com/Azure/Azure-Sentinel/tree/3a43f4e66e6d156bc7dbc4ebc420108050fcca6b/Solutions/AWS_IAM/Playbooks/AWS_IAM_FunctionAppConnector https://github.com/Azure/Azure-Sentinel/tree/3a43f4e66e6d156bc7dbc4ebc420108050fcca6b/Solutions/AWSAthena/Playbooks/CustomConnector/AWSAthena_FunctionAppConnector

Please let us know if you still need it to be moved

v-prasadboke commented 2 months ago

Will check on it @RamboV.

v-prasadboke commented 2 months ago

Hello @RamboV, The PR is still failing for a KQL validation. Can you check it once.

RamboV commented 2 months ago

Hello @v-prasadboke , we digged the issue, will submit the changes tomorrow, your change now doesn't solve the pipeline issues.

v-prasadboke commented 2 months ago

Hello @v-prasadboke , we digged the issue, will submit the changes tomorrow, your change now doesn't solve the pipeline issues.

Got it @RamboV.

RamboV commented 2 months ago

Hello @v-prasadboke , we digged the issue, will submit the changes tomorrow, your change now doesn't solve the pipeline issues.

Got it @RamboV.

Hello @v-prasadboke , we have updated the parser, all checks have passed, kindly check

v-prasadboke commented 2 months ago

Hello @RamboV, All looks fine to me. I have one final requirement. The logo which is being used in createui and input file is in png format.

Can you please provide us a logo in svg format and it should be less than or = 5kb

RamboV commented 2 months ago

Hello @RamboV, All looks fine to me. I have one final requirement. The logo which is being used in createui and input file is in png format.

Can you please provide us a logo in svg format and it should be less than or = 5kb

@v-prasadboke is it ok it is like 6kb, do you want us to send here?

RamboV commented 2 months ago

Hello @RamboV, All looks fine to me. I have one final requirement. The logo which is being used in createui and input file is in png format. Can you please provide us a logo in svg format and it should be less than or = 5kb

@v-prasadboke is it ok it is like 6kb, do you want us to send here?

DomainTools Logo Color

v-prasadboke commented 2 months ago

You can add it in the Logos folder

RamboV commented 2 months ago

You can add it in the Logos folder

Hello @v-prasadboke done ,