Skip to content

Commit

Permalink
Update zip for branding validation
Browse files Browse the repository at this point in the history
  • Loading branch information
v-atulyadav committed Sep 15, 2023
1 parent bc1ded5 commit a7e82b6
Show file tree
Hide file tree
Showing 2 changed files with 1 addition and 1 deletion.
Binary file modified Solutions/Illusive Platform/Package/3.0.0.zip
Binary file not shown.
2 changes: 1 addition & 1 deletion Solutions/Illusive Platform/Package/mainTemplate.json
Original file line number Diff line number Diff line change
Expand Up @@ -991,7 +991,7 @@
"kind": "Scheduled",
"location": "[parameters('workspace-location')]",
"properties": {
"description": "Create a Sentinel incident upon a new Illusive alert (incident) and associate all related Illusive events to the relevant Sentinel alert. This is done by filtering and processing Illusive Syslog messages.",
"description": "Create a Microsoft Sentinel incident upon a new Illusive alert (incident) and associate all related Illusive events to the relevant Microsoft Sentinel alert. This is done by filtering and processing Illusive Syslog messages.",
"displayName": "Illusive Incidents Analytic Rule",
"enabled": false,
"query": "CommonSecurityLog\n| where DeviceProduct == \"illusive\"\n| extend DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2)\n| summarize arg_max(TimeGenerated, *) by DeviceCustomNumber2, AdditionalExtensions, TimeGenerated\n| extend Category = extract(@'cat=([^;]+)(\\;|$)', 1, AdditionalExtensions), HasForensics = extract(@'cs7=([^;]+)(\\;|$)', 1, AdditionalExtensions)\n| extend Category = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"),Category)\t\n| where Category == \"illusive:alerts\"\n| extend IncidentId = DeviceCustomNumber2, IncidentURL = DeviceCustomString5\n| project TimeGenerated, SourceIP, SourceHostName,Computer , DeviceEventClassID ,HasForensics ,SourceUserName, Activity, DeviceAddress, DestinationHostName, DestinationUserName, IncidentId, IncidentURL\n",
Expand Down

0 comments on commit a7e82b6

Please sign in to comment.