Merge pull request #11189 from riskive/zerofox/change_alert_connector…

…_param [ZeroFox] Change query param in Alerts codeless connector
Azure · Sep 27, 2024 · 2551576 · 2551576
2 parents b274cec + b4e94f1
commit 2551576
Show file tree

Hide file tree

Showing 5 changed files with 38 additions and 28 deletions.
diff --git a/Solutions/ZeroFox/Data Connectors/Alerts/alerts_connector.json b/Solutions/ZeroFox/Data Connectors/Alerts/alerts_connector.json
@@ -104,10 +104,13 @@
             "apiEndpoint": "https://api.zerofox.com/1.0/alerts/",
             "httpMethod": "Get",
             "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
-            "startTimeAttributeName": "min_timestamp",
-            "endTimeAttributeName": "max_timestamp",
+            "startTimeAttributeName": "last_modified_min_date",
+            "endTimeAttributeName": "last_modified_max_date",
             "queryParameters": {
               "sort_direction": "asc"
+            },
+            "headers": {
+              "zf-source": "Microsoft-Sentinel"
             }
           },
           "response": {

diff --git a/Solutions/ZeroFox/Data/Solution_ZeroFox.json b/Solutions/ZeroFox/Data/Solution_ZeroFox.json
@@ -14,7 +14,7 @@
       "Analytic Rules/ZF_Alerts_MediumSeverityRule.yaml"
     ],
     "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\ZeroFox",
-    "Version": "3.0.1",
+    "Version": "3.2.0",
     "Metadata": "SolutionMetadata.json",
     "TemplateSpec": true,
     "Is1Pconnector": false

diff --git a/Solutions/ZeroFox/Package/3.2.0.zip b/Solutions/ZeroFox/Package/3.2.0.zip
diff --git a/Solutions/ZeroFox/Package/mainTemplate.json b/Solutions/ZeroFox/Package/mainTemplate.json
@@ -33,7 +33,7 @@
     "email": "integration-support@zerofox.com",
     "_email": "[variables('email')]",
     "_solutionName": "ZeroFox",
-    "_solutionVersion": "3.0.0",
+    "_solutionVersion": "3.2.0",
     "solutionId": "zerofoxinc1695922129370.zerofox-sentinel-connector",
     "_solutionId": "[variables('solutionId')]",
     "uiConfigId1": "ZeroFoxCTIDataConnector",
@@ -94,7 +94,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "ZeroFox data connector with template version 3.0.0",
+        "description": "ZeroFox data connector with template version 3.2.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('dataConnectorVersion1')]",
@@ -811,7 +811,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "ZeroFox data connector with template version 3.0.0",
+        "description": "ZeroFox data connector with template version 3.2.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('dataConnectorVersion2')]",
@@ -914,10 +914,13 @@
                     "apiEndpoint": "https://api.zerofox.com/1.0/alerts/",
                     "httpMethod": "Get",
                     "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
-                    "startTimeAttributeName": "min_timestamp",
-                    "endTimeAttributeName": "max_timestamp",
+                    "startTimeAttributeName": "last_modified_min_date",
+                    "endTimeAttributeName": "last_modified_max_date",
                     "queryParameters": {
                       "sort_direction": "asc"
+                    },
+                    "headers": {
+                      "zf-source": "Microsoft-Sentinel"
                     }
                   },
                   "response": {
@@ -1101,10 +1104,13 @@
             "apiEndpoint": "https://api.zerofox.com/1.0/alerts/",
             "httpMethod": "Get",
             "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
-            "startTimeAttributeName": "min_timestamp",
-            "endTimeAttributeName": "max_timestamp",
+            "startTimeAttributeName": "last_modified_min_date",
+            "endTimeAttributeName": "last_modified_max_date",
             "queryParameters": {
               "sort_direction": "asc"
+            },
+            "headers": {
+              "zf-source": "Microsoft-Sentinel"
             }
           },
           "response": {
@@ -1130,7 +1136,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "ZF_Alerts_HighSeverityRule_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "ZF_Alerts_HighSeverityRule_AnalyticalRules Analytics Rule with template version 3.2.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]",
@@ -1178,8 +1184,8 @@
                     "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "columnName": "entity_name_s",
-                        "identifier": "FullName"
+                        "identifier": "FullName",
+                        "columnName": "entity_name_s"
                       }
                     ]
                   }
@@ -1240,7 +1246,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "ZF_Alerts_InformationalSeverityRule_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "ZF_Alerts_InformationalSeverityRule_AnalyticalRules Analytics Rule with template version 3.2.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]",
@@ -1288,8 +1294,8 @@
                     "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "columnName": "entity_name_s",
-                        "identifier": "FullName"
+                        "identifier": "FullName",
+                        "columnName": "entity_name_s"
                       }
                     ]
                   }
@@ -1350,7 +1356,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "ZF_Alerts_LowSeverityRule_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "ZF_Alerts_LowSeverityRule_AnalyticalRules Analytics Rule with template version 3.2.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]",
@@ -1398,8 +1404,8 @@
                     "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "columnName": "entity_name_s",
-                        "identifier": "FullName"
+                        "identifier": "FullName",
+                        "columnName": "entity_name_s"
                       }
                     ]
                   }
@@ -1460,7 +1466,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "ZF_Alerts_MediumSeverityRule_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "ZF_Alerts_MediumSeverityRule_AnalyticalRules Analytics Rule with template version 3.2.0",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]",
@@ -1508,8 +1514,8 @@
                     "entityType": "Account",
                     "fieldMappings": [
                       {
-                        "columnName": "entity_name_s",
-                        "identifier": "FullName"
+                        "identifier": "FullName",
+                        "columnName": "entity_name_s"
                       }
                     ]
                   }
@@ -1566,7 +1572,7 @@
       "apiVersion": "2023-04-01-preview",
       "location": "[parameters('workspace-location')]",
       "properties": {
-        "version": "3.0.0",
+        "version": "3.2.0",
         "kind": "Solution",
         "contentSchemaVersion": "3.0.0",
         "displayName": "ZeroFox",

diff --git a/Solutions/ZeroFox/ReleaseNotes.md b/Solutions/ZeroFox/ReleaseNotes.md
@@ -1,5 +1,6 @@
-| **Version**   | **Date Modified (DD-MM-YYYY)**   | **Change History**                                                                                            |
-|---------------|----------------------------------|---------------------------------------------------------------------------------------------------------------|
-| 3.1.0         | 26-07-2024                       | Updated ZeroFox connector to generate result batches and implemented async Sentinel connector logic           |
-| 3.0.1         | 30-04-2024                       | Fixed Solution Metadata for deployment                                                                        |
-| 3.0.0         | 04-08-2023                       | Added **Data Connectors** for ZeroFox's Alerts and CTI feeds                                                  |
+| **Version**   | **Date Modified (DD-MM-YYYY)**   | **Change History**                                                                                  |
+|---------------|----------------------------------|-----------------------------------------------------------------------------------------------------|
+| 3.2.0         | 26-09-2024                       | Changed query parameter in alerts connector for fetching updates                                    |
+| 3.1.0         | 26-07-2024                       | Updated ZeroFox connector to generate result batches and implemented async Sentinel connector logic |
+| 3.0.1         | 30-04-2024                       | Fixed Solution Metadata for deployment                                                              |
+| 3.0.0         | 04-08-2023                       | Added **Data Connectors** for ZeroFox's Alerts and CTI feeds                                        |