From 9521587ba6f763916ce663a2f9e480c7bee4a7e4 Mon Sep 17 00:00:00 2001 From: v-amolpatil Date: Thu, 26 Oct 2023 17:08:38 +0530 Subject: [PATCH] updated code --- .../connectorDefinition.json | 10 ++++----- .../PrismaCloudCompute_CLV2.json | 10 ++++----- .../Package/3.0.0.zip | Bin 8254 -> 8246 bytes .../Package/createUiDefinition.json | 4 ++-- .../Package/mainTemplate.json | 20 ++++++++++-------- 5 files changed, 23 insertions(+), 21 deletions(-) diff --git a/Solutions/Palo Alto Prisma Cloud CWPP/Data Connectors/PaloAltoPrismaCloudCWPP_ccp/connectorDefinition.json b/Solutions/Palo Alto Prisma Cloud CWPP/Data Connectors/PaloAltoPrismaCloudCWPP_ccp/connectorDefinition.json index 13fad019289..da741638faf 100644 --- a/Solutions/Palo Alto Prisma Cloud CWPP/Data Connectors/PaloAltoPrismaCloudCWPP_ccp/connectorDefinition.json +++ b/Solutions/Palo Alto Prisma Cloud CWPP/Data Connectors/PaloAltoPrismaCloudCWPP_ccp/connectorDefinition.json @@ -6,9 +6,9 @@ "properties": { "connectorUiConfig": { "id": "PaloAltoPrismaCloudCWPP", - "title": "Prisma Cloud Compute CWPP (using REST API)", + "title": "Palo Alto Prisma Cloud CWPP (using REST API)", "publisher": "Microsoft", - "descriptionMarkdown": "The [Prisma Cloud Compute CWPP](https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents) data connector allows you to connect to your Prisma Cloud CWPP instance and ingesting alerts into Microsoft Sentinel. The data connector is built on Microsoft Sentinel's Codeless Connector Platform and uses the Prisma Cloud API to fetch security events and supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security event data into a custom columns so that queries don't need to parse it again, thus resulting in better performance.", + "descriptionMarkdown": "The [Palo Alto Prisma Cloud CWPP](https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents) data connector allows you to connect to your Palo Alto Prisma Cloud CWPP instance and ingesting alerts into Microsoft Sentinel. The data connector is built on Microsoft Sentinel's Codeless Connector Platform and uses the Prisma Cloud API to fetch security events and supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security event data into a custom columns so that queries don't need to parse it again, thus resulting in better performance.", "graphQueriesTableName": "PrismaCloudCompute_CL", "graphQueries": [ { @@ -67,13 +67,13 @@ "customs": [ { "name": "PrismaCloudCompute API Key", - "description": "A Prisma Cloud Compute CWPP Monitor API username and password is required. [See the documentation to learn more about PrismaCloudCompute SIEM API](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PrismaCloudCompute/Data%20Connectors/readme.md)." + "description": "A Palo Alto Prisma Cloud CWPP Monitor API username and password is required. [See the documentation to learn more about PrismaCloudCompute SIEM API](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PrismaCloudCompute/Data%20Connectors/readme.md)." } ] }, "instructionSteps": [ { - "description": "To enable the Prisma Cloud Compute CWPP Security Events for Microsoft Sentinel, provide the required information below and click on Connect.\n>", + "description": "To enable the Palo Alto Prisma Cloud CWPP Security Events for Microsoft Sentinel, provide the required information below and click on Connect.\n>", "instructions": [ { "type": "Textbox", @@ -110,7 +110,7 @@ "type": "ConnectionToggleButton" } ], - "title": "Connect Prisma Cloud Compute CWPP Security Events to Microsoft Sentinel" + "title": "Connect Palo Alto Prisma Cloud CWPP Security Events to Microsoft Sentinel" } ] } diff --git a/Solutions/Palo Alto Prisma Cloud CWPP/Data Connectors/PrismaCloudCompute_CLV2.json b/Solutions/Palo Alto Prisma Cloud CWPP/Data Connectors/PrismaCloudCompute_CLV2.json index ccff445cd79..f174ebe5fde 100644 --- a/Solutions/Palo Alto Prisma Cloud CWPP/Data Connectors/PrismaCloudCompute_CLV2.json +++ b/Solutions/Palo Alto Prisma Cloud CWPP/Data Connectors/PrismaCloudCompute_CLV2.json @@ -1,8 +1,8 @@ { "id": "PrismaCloudComputeNativePoller", - "title": "Prisma Cloud Compute CWPP (using REST API)", + "title": "Palo Alto Prisma Cloud CWPP (using REST API)", "publisher": "Microsoft", - "descriptionMarkdown": "The [Prisma Cloud Compute CWPP](https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents) data connector allows you to connect to your Prisma Cloud CWPP instance and ingesting alerts into Microsoft Sentinel. The data connector is built on Microsoft Sentinel’s Codeless Connector Platform and uses the Prisma Cloud API to fetch security events and supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security event data into a custom columns so that queries don't need to parse it again, thus resulting in better performance.", + "descriptionMarkdown": "The [Palo Alto Prisma Cloud CWPP](https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents) data connector allows you to connect to your Prisma Cloud CWPP instance and ingesting alerts into Microsoft Sentinel. The data connector is built on Microsoft Sentinel’s Codeless Connector Platform and uses the Prisma Cloud API to fetch security events and supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security event data into a custom columns so that queries don't need to parse it again, thus resulting in better performance.", "graphQueriesTableName": "PrismaCloudCompute_CL", "graphQueries": [ { @@ -61,13 +61,13 @@ "customs": [ { "name": "PrismaCloudCompute API Key", - "description": "A Prisma Cloud Compute CWPP Monitor API username and password is required. [See the documentation to learn more about PrismaCloudCompute SIEM API](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PrismaCloudCompute/Data%20Connectors/readme.md)." + "description": "A Palo Alto Prisma Cloud CWPP Monitor API username and password is required. [See the documentation to learn more about PrismaCloudCompute SIEM API](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PrismaCloudCompute/Data%20Connectors/readme.md)." } ] }, "instructionSteps": [ { - "description": "To enable the Prisma Cloud Compute CWPP Security Events for Microsoft Sentinel, provide the required information below and click on Connect.\n>", + "description": "To enable the Palo Alto Prisma Cloud CWPP Security Events for Microsoft Sentinel, provide the required information below and click on Connect.\n>", "instructions": [ { "type": "Textbox", @@ -104,7 +104,7 @@ "type": "ConnectionToggleButton" } ], - "title": "Connect Prisma Cloud Compute CWPP Security Events to Microsoft Sentinel" + "title": "Connect Palo Alto Prisma Cloud CWPP Security Events to Microsoft Sentinel" } ] } \ No newline at end of file diff --git a/Solutions/Palo Alto Prisma Cloud CWPP/Package/3.0.0.zip b/Solutions/Palo Alto Prisma Cloud CWPP/Package/3.0.0.zip index 0f853b5d63cea7809eae03b8b3ce973a06674b52..cc28f4c9510055c7c8851d65f93e1fa94a82fc11 100644 GIT binary patch delta 7437 zcmV+o9rEJ7K(;^|P)h>@6aWAK2msiHT30An=TJ@t004>+000-0&mS6*H5f6OQ)~s& z&1lmWLmU*ebhf!rq{gG-x?TSJj?}yDq}_&nF)Z?Qug^Vq`tTxZwBl_Z|AAUP2`1jwnyXBLakgHH)M(U88=rgKJq@++9T+4< zPIzFfzAm`oIam@RiBIl`4pXg`V$~hck-&H2BR3fxF1bXQv^NWmBE`Ni9cF;35rwTS z{~+=eLz6z8x7jg#6R(6_mx~gA!H`AkGURgOBdLC)*K{Zp$b^zbP9~RnrLnqu-`vG` zx0(lRBQm=t1K)jHe4xiQh}GJ*&(G#+u8xj=)fUcszHaiV4IL z@Fr|rkjmSC!D$jRVR zlWn2Uaw+M>_`P$EJYv@~E;T!sBswz!bIztxml>PBo6S1E3V#(BT*VpOCA<(x>coPGoq}KhV z6T=>Hw2DlnzzC=GumZGyq>b`~^wcOgU~!|(Ef$Yb$p{TFmmgp zIz?BIu9cR0B>+hUWK`)Yvs9EeT+46inzIZFAT280GIvV0mfD5vE%!7{d>E*6V0!7~ zsG#k;&Jqxcsk}9ogd(4PhcU{6rI+Z+L6J~^)XYwRXPNJAF6;DvIKN1)Eg4;;8ZDkV z_j$~&r#b@(h-_NbfrMw0TPj`7!s&E2?$AMyGb+woVsI@5Dk?GY^wYvQNj+CYX^B?n zQQ9beQvZuK6jwx{(N$%)_?KV>6wOgGrB{uw3*Bsz+UPNeT#|Da?$%qi*rkc-@y^ed7JC zDH^_PnLcSP_pLtkB9|`|I*4G>wg6I>*VYr?JFiMA!6VuRDi&JbJ|;{wDpD`GbWI-g z1#h~C`+mx#PWi!f(fHsQ0buvSO)8O5m$(V=i^yDKHA*IbYy*sVi3!V=M(4i&sNbm9 zxZGMAC>>9P#Y>Y^sFiSikiRmpGI*v z_gZN52cV*<>f)vtFVEk#q4d47+X99&yoGgqZu0X&P)Av#u`|7a2&e` z$CKmnO)yOLpEMTjA&{)K+a7|SpI;4;Njr#Ldy8bB;1TwllMIP$GU|21mp0IkG#8_K z`+0hLe0m%me;*y6jL6|b)ooomRK?8~7I3QboR+qK3!{q*+7SlQk}p6y@xy2!MonR@ zWmYYAuYG-JOg&(F2L%~f%-jyM5mGYg>aLaSL86BU{D+W0YiPl-xK~r(IFP;Nl1lCi znDZj602x;85sropFdD~qPJF^@xiNeC%qMdEh-ce0x74)i*mhb=VdLvVD%|XRM>7 zzEBOcn}$7Tn=L*|9*$MpnTv$j)>cX6GOLl=Fh@2!EglP)bjWfei}Ek0g< zOKC*V`#7hK5O}O$-A%4F-`l58*(h8+=aYfVF0h`<&9x z{ohba0|XQR000O8ZiZS{$zLpd>KFh50E&~M24e!5;j;$^^#OnF1@WZFZ8l-V{^hIQ zz@p>_XuV6{y-u+mOvIOy;)2L{{3e;mbGIN$=kCEI>*(7Jj>MX_z4L&Q)tb>o${RYF zqWt<#QI}Vt^-igmM6j(3+Y8Z&$Mw%eM5u40Q!k8Nbo%4PMSa7Z5qz9CfyK8@Vzv$= zcqyHk;)|TRTW)`x&mD=1IIxHd{}kR=cqNa7HK)l$OWQtEf6mmavyB*#1LNV-w22w6 zr#0bwZoaZ7)xYN>@f1>q`V!~g!AuBamFjsP_ z#7tEuD&HVKDD{1LNbd?{ok~~d+-(?@4haQ>%B2EemxIyZ)vPoOx@Ksig$XZI7hB~4bW$^RFI=U1^a>E2yT@XXIPuus#mR=EFCFbY@+avaIcRp961Wbv;toRZhJ#=+UU{IqsP*r=PMuI z5qw{15F~#}uant}jND7?#1UZ+DXm=B<`~~KzeVwDZrZF%YCWl(BWqpP4r7)%fz{^R z*TjKKzYU6$mp;G7zjD?CL78zn$Qvfz>1;7f+)HfXax(cB(oE1I)8FM4bj8K}sXSUP zQk+Oe%7#6C!BOj_tTRniONGk!|LE$i zFlE^UmGzv-%yv$!V8ixQU8SpAU7b~FdAAJ}QRziax1RU_ScPp`lR47r8z55=hBl!N zQf6N!?XB*1O)4-CmaR5&x=d;vmE0CiDki%Qw8%?#@S{t9gHW+|te?!EM24OB&_{8Wv-*SNe%KaJ2O-faP#qhxzQco6s_7Vpq^ZO9&0C zzo-=SRhoUfQ)^inCtB2?`q)0`z4}x4YaN(c9=FNaj+`j%2{W~*wXV|VJ93qpT!_v- zhwU9J=#;dc#*~FV`3*ST*~r*^bJR$`&%#?8?Err)QeC$V!LT;qDw}y-F;jF9QxdGu zn=db~(8Xc-fap)jav@_+yH zzm)p`F6MFpA5^OgzM;JdBVY6%Q%uF-V}VXSy)cv;%$zl%iP}N<4mcs2CAOKOv(q=T zrA@Jmu9Km_kst9fVv!wC=tnS>X4Bz@4lREfb+H?l|IYl7ul6unc;SjJ9I^6d@Oc(; zs|cFskke~3*qtcaBkW*tlv*TJvP&?Ob4_64%=2PDpooSN%lnvHbB@O48bKZc%OhZp z8xe-=l}&;ve>J9XY8iWCsz`vAm~qX5xXg$l^68vw3-l_oH|y_Y$09hHo>F;^0zcNE^BaoGL7lhtnn^ao=0Ek?&jCTusLWFTLpAWH_I z<%9f$uE38mAOb*_9W?fRZn}TNTrYpc0XsNMyZtsIE5aQm(Yt= z=5?w`umTH`IACw_CecUTs(?=jDon{0Sg~iww|_l=k6+^e90cqhiZ@gEBRQuhGzb~? zH|#;Ye)th*E%6Y@9XExiJK3-*Xa9v=+|kjG$OZe(CZ4?{9_NC-OATNVdXazZa-N_Y z+oM>ot*)-JxZB_pN{KunHK9y}axaq2lG(HZ81$yV+GM?H@8?XHEI^(yXYzRI3jfMv z#K3li>-i%HG|Ih*>l$qU zOK#N-T~2@=Y)f6wwulXcL%5*yn&8qND_P{(p~0e$?(qa)~r|4;VA zKZu^-|GcjSc!%&gbr63SU`>2H_ua#}fwKr;B7b_X>KY0QVt7$3R@)`R8$($&l+)@y z72yCjE;4Y}HnS=omTYQ4?NF zH(eNc_8GEHfguYOq#G45l*{l}Q_2-I-ik2=zES18l?sThlTd#$4ZF`7+Q8x#&cW-@ zOZ*YFtZ@uy6SI3v+2gqgfzR1Jq09@NTd~-Gr#2<7@oqa0DTf)jB0~@<&FqGd_$B`8 zhs{7wD9}{|dFUwx`z(@Dp`17loFH%uhz?8+e(Insn%n4NbO}_Z_;2}Zfi1`%H(wDR zHiac|8v&zYmvVo}1|d@tmLltiYtJQYe92(pYBkVCD%K~c`eEwBMSxU_vV58=LB|&{ zV_GS0WiS*0lMNX_mLiZ)Y~**=9%&m4Qgd(`UjE0;_G!3n^X}~QO_wZJ6LO9RC*+iJ zcD>}r?VH%^4&QDm*CvQPuj^Ig3>&`Lz_x#e9nY50IL&{C07>%CtZC}bRffpPhUjAj zu##K^^9_(eCkj##d`Eg&td6U%I#Axma!Sx0T(vdc_ZxOTgk6xz(rd7aUwmod-bl(D zf4)5zxivOR$_Ox(6m)M>v{EOOd(6+9_pW9#auK#5e_wG@_F42GHJ5LEaU^2Zh8+WJ zfoG?RCIpj55)*%3-xsc(12ucjG47Du5O05Yb|LB6bFSHrNP5~EuANAF_MB@Jl6kz> zvF2@@BBWd+L9ZZ4nPr!P7{sYraAWnQ@zh@WIggq0k*(G*jHR7 zj8h3_`^-9dIiuIe({0%UM@F1pIBK{jD9WFh?lb$GG}5zIJj}?-%OTxoPOd}Bg8kW@ z!JZ6w2Z}HVT_{LM7=eg@_)6R`+Gln;UJNNEy;!kbZYGpvoP~slU}cit46sXPif!B; zg%0xU6tsVF>AVX)Q2{f_Mic_N$1H{a_fPd3pQTr8LLnmzcqd9F!sWEw`iI+uaP>_J zukp&)e_i9?1waF%&U6AB7zvCc`T3$?mQm1Mvj+u@1rT%hbZcJGI3_7WPIcZrx~Inm zQ>-x=02))PH)l4pzk(~X`kXi5dUC{LfLwvm`Hp`+YLoNTvOJrPzLj6 z+2nr@QWKhdE#6MTqcE5x>c_uKBY;y87?=6*&roVGc$dkp8Tv~;PLW#sV)OM(Y+m`$ z#qI_MEj|FXslP6$P5%NmB{4L?qvSJhk+>_*P!E^N3S+j3*`-)fFyU&2wA4=Q0u5!O zBa>F~p!&U83zp@BM8@MDmu*861$M!%lU~UILl3n_ zPYT!tt4{kT0&Ig{BP0Oqf@?2&9{P{G7DbGD#KZnwu8RZ^}RS(DH7> z5ALKt%8)#7{$(A3<#k>BT;ta&RPlVi$8}?;bP5IMOx52q%m19l6dg^`KaSuB&?eJ~ z>rBK4B!36(QnpQyHKGtr3l$e7mY#LtB?WrFI8greopv7g`G08<#otSDAky~hjA@I8 zA5N$fh+^xU?B<2Dq;RsM7H2=o_8XV!H$PxAFUvphuuZG%e&?~8Nm>1#W%S1_n{QYq zKW|$8E{p$nS^Pg;S^Sa8;2V^^?@EXmp{)JTGWNsE);Bp}P3$u$L*K=}lCwKPnR(qh z>fL4Kha}3Boqzb=W#V;*Gq^0gsSs$EdGBJB@{W3!ao_Ku3IL(Y3=EkLGMxaTq9J_t7dbT2us8}DPulL+47!+jE5C2?o)=mN7-@9u*`T@ z=%b@sjluU4Im0sHUDEegE(<=i4EV=cErw;iyTrKpaerG5wtiV|jbUYZD&v&huAGGb zMaygts;}K97>1VJtUh*^+f#AC|77*Ad(^wuSVI7*M`&2QwRcI*QR-FivOaanA=7HW zsfseLKdo^V)8$G4XwJ&V6oKKzo3~I8diabR)_eZT%(r><gX!E`GJ!W5=X*@xZur;%jss zsd*rIyrlz4&H@|At>ElD9OMkd>Ag{|M{xiYXIJqLqU_^Dmom=CrYoLPG-;Wcri0Z1 zGt+vYUUL|4fV&>GI3?e0pH@>LhVDEB(L7y(hDjo#@ohP$ zrA9H-4a$z$I*eKd)k@WgXkE>90I2OQIlk2BFVl{vVZ__Wfr|sD_0F#4j1tl}UkyStbl>FdyV!NnE16bG zvwwIZ@ez&X0E3dS>o$_*Zp_J2q=E)2OrUNWmwda%kPl4a zk&B3a8`Lk4J+QjTWM9YxwX(6zTZM`SEqkBc4#)V5(Q=C+Y$ajM_Nj*ywfhm@w5x!+ zmJmu&y|w7pPtzg@nNAnq%zZoHvjtJuxqmn@5Sm>+ql-sJ$Dhjux#05Wg%5siHP3&c zVem<#4N1n-kW$*Yf|`xL?(QzjSj)VfWOBQVh%2w>{{XcMfbu3xT{_(?+u8C-@Dc|r zw&rb)TNHi^o~%?>k73rUB^~2c8fZ`2T?ZCyYieQkZjpA4U4BEc8z4JLcuTL#q<_yk z#$AIJe(dGk_hV5tptzp$aYCQf*4M&H@?>7GZ+yz5&)2nvYpsmbEzOFMk zN|pF78g{@mT2(7rxHtAk=|+kJt( zD+pGGfkCk{3<{E!K__TdhA!6wpfjjehWGQkPFzT zbShtSBig(hx2_ALXn0X$D54)==2bEmMmJxISoF7|3X+=1YEUM1kToa*XxYIQS(s8k zIh@zG(c&dQ_x4t|>r&Iv6g=1;gIQAR^b4C3?J^r;A6PH0YKN#Pp8)xtTM3(bGNJ*D zq!Kh>5!Z!9*{V^+*^Xc6Vt=^pcz3LBIi~j+C)3G)=4(wq6W1C{SOs@YUJ{?M?=CJm zF~>)`4aMD{A4Q(?dGLyWw)}@~TQHrkFn2`641KMiVIzBmi!Wb^Tt{gBz+v|4)y#FT zUc7kX`%ftSZ*6>(*%1SLCyejFmoZCk_1#3eo&-1~fm@4&h1w`0%zvVXQ@B6H8$Q-; z1$Q*Vn4JgQM2CS3#^RsaQ@F;q+ZpC90~CP68^L*dv+;;DgbN5(>y8z``kt@r*$HIJ z1FB0WUfLQf5fdbndNV9Zm7YU z3dQTdCndI_83NurzJDaY;XDctbczPswD`gI{~NxoG}$T2i?IL2r4kZOe&Nl;iJDsWs(8gIVC2^L3o+`(RR2k z$Lr-Thiw_n(=@tvhxzGip5scyY8=sNj%;=dYF9*1i)QiSkbl^oZk$n56L&@MbR%|6 z)TZIELVNM80hJwrygq@uUV%E@z+C@8+>k6fSzkuXrgieVu^976*>>7ls)bg~3$WE< zX{4nT}3t4aIOlIOFhhP7kJ^HNPS}JqVJON$Ht=g(Ci(mb| zaJ$&Z?RLR-uj-~%-mSIlsYBD~fRz*2 z3=KbgX32UK}AD6|}*Fxw~ad7z9wNyZR*qB1&{9h*-$ z|H32BtMVl7z?Xak9L!>x)OAqnVBtiVQ#MO#mw% LBnF%x00000i^*K> delta 7428 zcmV+f9sA<8K)yg1P)h>@6aWAK2mmo_T2}*0==4?w004xM7dA0oQnUrq&1lmWLmU*e zbhf!rq{gG{rd|H~j?}yDwB3e%F)Z?Qug^Vq`tTxZwBl_Z|AAUP3MSsxnyXBLakgHH)M(U88&AFNo`za@0|rTv6CN0=uM2K? z4wi&S;*&d~!&IxKSak<oKZ$(B(4>#& zZFUUb#w%gh<)TD?Fl5oX47uF+NUGoHH602CGNELVlgXuCX{_$vH+L~^R`Y;uMP}Dz z;D_&v5A?VOv0B^q`N>?()zQ(f+QQk<5qp2N1_LbTcWeRd`c~ul!W(63_sak5qtY&sCkiD)2C#;ab5txC0C79|Oax%EoWLqe-TuOQ| ze(#(kkJ$Ch2+TPNFB66&XcCZa2X&@`bf1VogpNd8W6>?sVz=rt&CAt@}$ShRwLtY%1w- z=rB22#idezV1!b7SOHqnMp;67Y7`u>xYgzs3r;VV=(9=r7-*l)Uc^-u->3|XymL~W zqAN((N=v;GfTRL4s&kcBDoGoz<+pUrSq24=7M0#HcS^RF+J)>b_cTp>7^rh#dgbP9`d9o)IZ zut{l)gRH2t;Ts)Lu?e$8|`4kkTz!gA54ryg<9B`F|;rZ6*lL*3$u@wzX;`n3C7 zQ#5?p@_f=-?puB6MJ`_`bP&O$Z2_b%udOG(cV3lLg3o9hs90!y`#E7EQIUGdrEBt_ zFL={E-1k!^b;=K>i-rf!2mremZcd4ey2SB+|8tSK#%h#I*cKS^5)+m!jm~}lQNK~I zad~HHoOEn3@a}#PRIm{!78077^nmM4L7y327JL4CqI>#5P#Y>Y@~kQQikiRmpGI*v z^;&53$Dg8^>f)vtFQ@O?Q2Jiky8?z2yoGfB#oxNqsosbtT{V~zcC4agu+7Z z_0TGd5Y{LfeVSJ}p9g32U^HP)%)d2Zqj@ly2i}vzxA!AbeY1m8hizdX+vkXW#yU#s z3)MioY1o5y+2V`j;aIhuxp){&JEM0Xw2(Z5D`CAipOvK2yScSD>2?YIuxBTcg%5Ub z-aObJS0w!lje^^~S9DQL&Am~7;?y}C4d5H9Y?f&Bh<0wV)-S)=KDbZE>~~siQ?C3R zdQgm2`;i|`UOhF>7Z=!=O_v1V-iGhp!}hbF`o1bnwIhS#gqZ5nVJ8Hl^=>U)l_K+t zHTh628{Jy#HqJO0ChfleIGmhcSJ;SLzdilG3+s#=y6D4vZw0KKbZPN_DXYj~Z|U(` zN+W{aXE|+yxU(SduEzBW>@-J>=3T}2!-HY6yN7n4+NA)Bf>1U{NjGSs-ntcBFNHxH z{!4ZxgoXcsVJF0Tv|BZAc#3SyZ#&C7RP5=riD5vc!635cAsmQwL(j<^u-43QpHup| z{~J(C0|XQR000O8TzOgwS8o=bAnF(Z09})s24e!@%(MRn^#OnP3*t$U+ib#!{mWOq z!H$w2p!F_&_d3OPFcDu)iVGs+@tb5K&)tG3ox2BX#A|v+_ zJ8?wVLrQ-uSA{vocg=56{F<9KFZEhOCue6`*R{i#Wj0#1IX4Ay;L>k{;^d{zuko*( z^*~UzcO2yR4c+N%**CZm*TUsw@-L(or$wf}%j?gI1^QEYv|OY(k&Kl0-Sh=Vt(UT% zHc>4VE(_Ey;Wn)OpmxLSx>3NxruGSG-;h8Mca|lmr?vsN1Og?8^}`jfZQrS_bm>%_ z-0ME8p`K4g|M)}QD+TMTlOqc&f2r->)koKwt~RivY>9t#^;Vd&Y=X*q&SYjgCswdw zd#bL|)vd11sKY4r_|sR+Y8p$<}JUncFX?siQoFb|fk z{48B2wT?=9ZIjBDT?bm^B@VMLeJORBJAWER9D_8bG zo3^B3UZ7zy7JH?ghyzDk&jMHu*L9fBe)|?$22Jb=dT0ruVf7c4g1$<#Z+B`ftIdfP zHK;ze4|=cu)cslqrk2NTa<(HQN_)agchp)_>GK_#N=+t2XP?7-#|kJqhh1pDgJ0pDa;5!JThX|OC(uqX2=Y{tae?5dToK7X*!$$QS*`6jO0CDgBD4Z>=F#+Toaf$^Ssy(D59an@;>HUJxAm6#Uc-Iz=uvEoL5|g$3r9f4!hrXvifa+{y@yW#pw9RgzW~D4CIRxWXS-ue2|~e z6&N`NL;&cre}l%p&-eA;FxN|Qzzz=6ZoiGlif}7R^se9e*g^^#6iC>zfGShDd7Ww! ztiXZ<3~)T&B>JdZ74Qi`g({HPNY2;^4MK+f4SNu; zAAZDHODqI($G5`Mop`g#6L?`4-97pdxnSSf#Iu*gf8$)xx3>W-LN5{*=n1;9J&N_( z>gp#6UtPa_agD6%%&B`{40~;1ltv+ z=Z_%JDEA_=BQOEq$0Wk8wiT9#bbM#U^R6_5q!&`^gqso2sF7Xtm6<$P_rN{go<%Y4 zK@9+>f5>(Rq5!8PrNbPDrm9e&yDk;q{)tPr0)e!zrmusN`5YY)1j|L;kwG3}co<0ho>5yiMYbE^Kc9v)Mff zxO-1O373p}Ub8HyL);l({WIQ&cGw{gO-sBtfA9Blb=yv2%kE}b>A$YKX#-f&RW~#_ z0eY}4H9gxRHV_Wsg3@b(OFqU)YiQ_|Toj_inBqtzb;70x`Q&^pxDfK`wMyH1y*&T& z6?B=c-4$W$cq!KGiCDAZ-*$@99dV>G+ zf4&xA9m40-KwQ9X;^VpR9?lJnMF11|(|c8Sqp%=`7sX<=T{65elvP7Ht@^152jIBK zz+KzSs(4u9)PmZt1`4MrQI1J4O^O#HK^nb7OYDXBLJ}R1IJXdROr~)DHh6BjF!Jm( zWSs&-7Ai;`71$`3;jgBYD`>pYVhY?*f91TD3W%+fP%;g>4m1mL0L4n(Z%QzsJ7z2<*x;{Ab))Oitw;0e=LdH z2pAQ+lu0%SnUb&+SwCERE@9(K1`AiKfqSH4eS)eVraoK*NTn!Cwz(2?d=WFImH$=- zLlH1>$N;kRfP~_bwV6*7C|jMi2igWh)Et_IjsI~Iff_F2ygNI6(w48VfBA;H8rb&Fu;bY>7N^+|Aju1wHBH^Q$`3i&5Phrw zR+5Qe?*15bq97H)ccj;T)p2Q62g*(?rv%->C0S#y->~x`?1Ds=UV~Nq;!6wnMpAbB zxpOWuYiyPj0AMO5=-#GirOqe!n4dTAUClh@B5XnazT%|pv*DhCx*^Wqg z+8eH&NP701YZOv>yw|bjMV%s~Tq8lR5J;J2mx36?sabNh7T(Al(0yi~?c4_8y@%bE zd4?)L%E4tAdf4t~%Txp}f1?S75emY+W+C_K@G6Y@9fpp-Y|q4>%OnvT@Pi=QjPa@7 zXEw4PS)~A5U?KPwR|(@(df7g+PF~IEHS*Lgd*H~3(+fup_XI`x^U{50pOZ#<_KJrY zS$R36`^?F8NLjEy-Wm90z&lWcLFhs$LBa?`1jJY3e$hU&)A3?Re<#-;Nv^hE8-Bo|Q#=pM5a{@*{*Z+wHcg-FYG?p&RUE!^H zMdO&H3^~<#_voG;e;Z7(#$*6!Os(FW+06b5F3jq4-hk`L5sv|K1xDvP`lwA#SIhEj zIs)^#H=-`R#{12CSvEvgRec-14gP?a z7B)$$Y)lsU%EwSZe59ZM;$j8b_K|NnDWOnU zqOPW<#=caWo$y#@Cy+ZX@BNb$Ixf&KSrV@c@1H4KK~*-?co|^SiB!-pIYEJxWG`j`gFUFMkR zL=nCbij(^>OeH&TA0|t7kYzmz*$(?QSzwcM6-$5Kx$!6mWE!+)8SERAP6i|t3{55& zIgwx&>{4M6o#e69Klt zuMrXecEPn5JrDgyUW+0|J>p^iE?9SJ9*qXrBIiap*xv=?&ifwbZ;^E)9pdkTeL!}v zgZqDx*|)s|dyNAY0G-p^_E*{tBkCX3^jSCO)<*tT(l_N_f@pcS;kS6w-)l&oH~;94 z!1B5-ey;ID7OJj3_i^3WDV;*WIaBp#&ho#sF-1pH^p7L>ZM4aB;yM%Y0m+|8yOeDc zWQ{09(?Y#PiKS<)a7lsQj}erAn5Uh`eSUv+MDh1h9Ei02u43Av;WriP1ftkFC%bv! zEGeAqsKwcjivGqG{LK&8%q#W}JZ#gd$lrOaW>Rr~TNU=ltf+5TK|jCq{9Q5s?~3_< zvWod5RmeA}h~JehF+#=rp%w0jSF~@k(3;q1P@%qyeKIpO?_#jB>`W@Kn^LV`QC+u!dehp| zuaMrOBDzK#p;tNQE)kZ9cT(Yel#1p(Ya9=&Y22qmd5?m zAh&|E^W2a#5T{p4xfaC%P@LV;KZvrA6J5$UBb#o2PSK=gW}41i2h2?CS$oYny#ele z)apF9AX~L>HXPq;XCc)0FQsRv}+#|uQ zm2)GKeo9d$T{gIQg98@_PV04E%NZr0Z@wCYX6U};+jp_+qE|AllxBbNJmMp6mIF4F zgk@LQhv;K9)L-4*9?y3=J&`&M86H{m&YFL zy2)f;$lSH^W}Dv?DjKwGdv+Tf<1a?bEe5cagf;I^J*24Jj`*fs1=O{KK#JWOIU<>kN)kCAN#kK42QH zsvsEPY&1o$Dt&)+8JE=t`y1UdifOgkpp`+7Z(&!u=x}*;P;AZJ7udUkU}YE>6f47^ zAXyo7f@WptGCcq~gKA~yA7m?o7I~dPxYGN*LUJV>{Q`6)B--J+QoG*4yE638dK!`& zKGLp-CVVe?gWt!PGL2PIw{smo+R@Hc)aac(4T~gI(B*%$Fgw|h3vg6Am9P0G+U$*6 z*M(6uyr?l0(GM{5DwzwTdoM*S`mU&gq@1!Elu3zX4T=C-JlG-&Q|c#&^ZGVgyaecW zZ*{vaH62aC!~SD1OKP2dVN;@AfkXI#_2Q~LL{0ew$a`)jZ0gB~8(<`rpaF}xE-cDc zjVjJOexZMh;jZJ|vAW}!-e#OkC;yo*L;Xx#YA|6H+%$Pfe8RrFxa7nfAL%v}H-ml@ zSwJZ|AtGkzYyJEh*(+Ro`ATFuLh}a>vsbTXu6y<3#S`CuLg{~N zx4%^L0Htfn0e&b?L-QTVq86 z=&VWrDJ&P7;p{SSUqe{6^4E6t+KrTj#r4+;qCwj9CJofK{O!#RHCR)jcpdnp#5OcT zz>5^zb?UMRbUXp~5{u)I~2Do!dOp=4}GWnxuKM*%0i%wRT5wmHXyl$-1JW{ruc9v?PRr3OD-LW*%Rtw$abj-0( z2F>peG-Yl`MA?O`HFPF3agxKYf6g9#R=-=S?V@=Cx|UnDRb39h`sv|zv61e4hZ%or z$yEQeWWX?{ImM(W9s93S;ceS$qh4>LO^vT=rd8gp-Pu!vrqKW^C$JfAELpLvGYv$| z{LbAieZhR8U7v2AKjnN5gVpobA;V9eE|R~{Q|v##5@kbt`vEO6dTOI}gm0d`P1UA- zYtMbUpjciTQ3OzkDg}hn7}K}bbMb!{l7Bv3*w5ioKHO}FGD-|;FcFH>6im^^!#0JR zsW(u@6dq%r_kIKSjz!rlk1Oxh{ON*|_jIv&{x;x4fWlZ+^2R9o#p!RnOd|%P2HkMq zcHAOig$iK;K~0ZYH3C_St**4!JY}7l{qOk>7I_cQAj5fuoplg;;R@27(!2!Oy`ng^XcYac;tCin#BG0 zl7)bSSxl3f4r&!FoCtHuW=VhDvh>X4ljPIvo{wn82gM)B!fe?)GgS(L)6rJ8?cntE z;t<5|>4MYBDPDwLaXMk!&sx&lx<1aPzG*>=0jcqDQeKv?{#T_=tc5?CbwmMWswmvh zsY9={0hL1pa%=S&acbO5wIMlOE~fm*_eB2b{{c`-0Rj{N6aWAK2mlQ+Yg$(WOX&1g z1^@trleHf>A6$7_S8o=bAnF(Z0A0)g01*HH000000096X0001slMEmv2BaSV0000S C18JE6 diff --git a/Solutions/Palo Alto Prisma Cloud CWPP/Package/createUiDefinition.json b/Solutions/Palo Alto Prisma Cloud CWPP/Package/createUiDefinition.json index 21c2cb89a85..ce3065d48b8 100644 --- a/Solutions/Palo Alto Prisma Cloud CWPP/Package/createUiDefinition.json +++ b/Solutions/Palo Alto Prisma Cloud CWPP/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Prisma Cloud Compute CWPP](https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents) solution for Microsoft Sentinel allows you to connect to your Palo Alto Prisma Cloud CWPP instance and ingest alerts into your Microsoft Sentinel workspace using the Prisma Cloud API.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:\n\na. [Codeless Connector Platform (CCP)](https://learn.microsoft.com/en-us/azure/sentinel/create-custom-connector#connect-with-the-codeless-connector-platform)\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Palo Alto Prisma Cloud CWPP](https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents) solution for Microsoft Sentinel allows you to connect to your Palo Alto Prisma Cloud CWPP instance and ingest alerts into your Microsoft Sentinel workspace using the Prisma Cloud API.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:\n\na. [Codeless Connector Platform (CCP)](https://learn.microsoft.com/en-us/azure/sentinel/create-custom-connector#connect-with-the-codeless-connector-platform)\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -60,7 +60,7 @@ "name": "dataconnectors1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This Solution installs the data connector for Prisma Cloud Compute CWPP. You can get Prisma Cloud Compute CWPP custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + "text": "This Solution installs the data connector for Palo Alto Prisma Cloud CWPP. You can get Palo Alto Prisma Cloud CWPP custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { diff --git a/Solutions/Palo Alto Prisma Cloud CWPP/Package/mainTemplate.json b/Solutions/Palo Alto Prisma Cloud CWPP/Package/mainTemplate.json index 3f06490ebab..45c873f324d 100644 --- a/Solutions/Palo Alto Prisma Cloud CWPP/Package/mainTemplate.json +++ b/Solutions/Palo Alto Prisma Cloud CWPP/Package/mainTemplate.json @@ -51,6 +51,8 @@ "_solutionId": "[variables('solutionId')]", "dataConnectorVersionConnectorDefinition": "1.0.0", "dataConnectorVersionConnections": "1.0.0", + "uiConfig": "PaloAltoPrismaCloudCWPP", + "_uiConfig": "[variables('uiConfig')]", "_dataConnectorContentIdConnectorDefinition": "PaloAltoPrismaCloudCWPP", "dataConnectorTemplateNameConnectorDefinition": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition')))]", "_dataConnectorContentIdConnections": "PaloAltoPrismaCloudCWPPTemplateNameConnections", @@ -118,10 +120,10 @@ "kind": "Customizable", "properties": { "connectorUiConfig": { - "id": "[variables('_dataConnectorContentIdConnectorDefinition')]", - "title": "Prisma Cloud Compute CWPP (using REST API)", + "id": "[variables('_uiConfig')]", + "title": "Palo Alto Prisma Cloud CWPP (using REST API)", "publisher": "Microsoft", - "descriptionMarkdown": "The [Prisma Cloud Compute CWPP](https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents) data connector allows you to connect to your Palo Alto Prisma Cloud CWPP instance and ingesting alerts into Microsoft Sentinel. The data connector is built on Microsoft Sentinel’s Codeless Connector Platform and uses the Prisma Cloud API to fetch security events and supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security event data into a custom columns so that queries don't need to parse it again, thus resulting in better performance.", + "descriptionMarkdown": "The [Palo Alto Prisma Cloud CWPP](https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents) data connector allows you to connect to your Palo Alto Prisma Cloud CWPP instance and ingesting alerts into Microsoft Sentinel. The data connector is built on Microsoft Sentinel’s Codeless Connector Platform and uses the Prisma Cloud API to fetch security events and supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security event data into a custom columns so that queries don't need to parse it again, thus resulting in better performance.", "graphQueriesTableName": "PrismaCloudCompute_CL", "graphQueries": [ { @@ -223,7 +225,7 @@ "type": "ConnectionToggleButton" } ], - "title": "Connect Prisma Cloud Compute CWPP Security Events to Microsoft Sentinel" + "title": "Connect Palo Alto Prisma Cloud CWPP Security Events to Microsoft Sentinel" } ] } @@ -479,10 +481,10 @@ "kind": "Customizable", "properties": { "connectorUiConfig": { - "id": "[variables('_dataConnectorContentIdConnectorDefinition')]", - "title": "Prisma Cloud Compute CWPP (using REST API)", + "id": "[variables('_uiConfig')]", + "title": "Palo Alto Prisma Cloud CWPP (using REST API)", "publisher": "Microsoft", - "descriptionMarkdown": "The [Prisma Cloud Compute CWPP](https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents) data connector allows you to connect to your Palo Alto Prisma Cloud CWPP instance and ingesting alerts into Microsoft Sentinel. The data connector is built on Microsoft Sentinel’s Codeless Connector Platform and uses the Prisma Cloud API to fetch security events and supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security event data into a custom columns so that queries don't need to parse it again, thus resulting in better performance.", + "descriptionMarkdown": "The [Palo Alto Prisma Cloud CWPP](https://prisma.pan.dev/api/cloud/cwpp/audits/#operation/get-audits-incidents) data connector allows you to connect to your Palo Alto Prisma Cloud CWPP instance and ingesting alerts into Microsoft Sentinel. The data connector is built on Microsoft Sentinel’s Codeless Connector Platform and uses the Prisma Cloud API to fetch security events and supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security event data into a custom columns so that queries don't need to parse it again, thus resulting in better performance.", "graphQueriesTableName": "PrismaCloudCompute_CL", "graphQueries": [ { @@ -584,7 +586,7 @@ "type": "ConnectionToggleButton" } ], - "title": "Connect Prisma Cloud Compute CWPP Security Events to Microsoft Sentinel" + "title": "Connect Palo Alto Prisma Cloud CWPP Security Events to Microsoft Sentinel" } ] } @@ -810,7 +812,7 @@ "contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]", "displayName": "[variables('_solutionName')]", "publisherDisplayName": "[variables('_solutionId')]", - "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Prisma Cloud Compute CWPP solution for Microsoft Sentinel allows you to connect to your Palo Alto Prisma Cloud CWPP instance and ingest alerts into your Microsoft Sentinel workspace using the Prisma Cloud API.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Codeless Connector Platform (CCP)
    2. \n
\n

Data Connectors: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Palo Alto Prisma Cloud CWPP solution for Microsoft Sentinel allows you to connect to your Palo Alto Prisma Cloud CWPP instance and ingest alerts into your Microsoft Sentinel workspace using the Prisma Cloud API.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Codeless Connector Platform (CCP)
    2. \n
\n

Data Connectors: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "icon": "[variables('_packageIcon')]" } }