Merge pull request #9654 from cmaneiro/cmaneiro

resourceid entity

Solutions/Azure Key Vault/Analytic Rules/KeyvaultMassSecretRetrieval.yaml

@@ -31,6 +31,7 @@ query: |
   | where OperationName in (OperationList) and ResourceType =~ "VAULTS"
   | where not(identity_claim_appid_g in (AllowedAppId) and OperationName == 'VaultGet')
   | extend
+      ResourceId,
       ResultType = column_ifexists("ResultType", ""),
       identity_claim_http_schemas_microsoft_com_identity_claims_objectidentifier_g = column_ifexists("identity_claim_http_schemas_microsoft_com_identity_claims_objectidentifier_g", ""),
       identity_claim_http_schemas_xmlsoap_org_ws_2005_05_identity_claims_upn_s = column_ifexists("identity_claim_http_schemas_xmlsoap_org_ws_2005_05_identity_claims_upn_s", ""),
@@ -59,12 +60,13 @@ query: |
       ResourceList = make_set(Resource, 50),
       OperationNameList = make_set(OperationName, 50),
       RequestURLList = make_set(requestUri_s, 50),
+      ResourceId = max(ResourceId),
       CallerIPList = make_set(CallerIPAddress, 50),
       clientInfo_sList = make_set(clientInfo_s, 50),
       CallerIPMax = max(CallerIPAddress)
       by ResourceType, ResultType, identity_claim_appid_g, CallerObjectId, CallerObjectUPN
       | where EventCount > EventCountThreshold
-  | project-reorder StartTime, EndTime, EventCount, ResourceType,identity_claim_appid_g, CallerObjectId, CallerObjectUPN, ResultType, ResourceList, OperationNameList, RequestURLList, CallerIPList, clientInfo_sList
+  | project-reorder StartTime, EndTime, EventCount, ResourceId,ResourceType,identity_claim_appid_g, CallerObjectId, CallerObjectUPN, ResultType, ResourceList, OperationNameList, RequestURLList, CallerIPList, clientInfo_sList
   | extend timestamp = EndTime
 entityMappings:
   - entityType: Account
@@ -75,5 +77,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: CallerIPMax
-version: 1.0.5
+version: 1.0.6
 kind: Scheduled

Solutions/Azure Key Vault/Package/createUiDefinition.json

@@ -6,7 +6,7 @@
     "config": {
       "isWizard": false,
       "basics": {
-        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\n[Azure Key Vault](https://azure.microsoft.com/services/key-vault/) Solution for Microsoft Sentinel enables you to stream Azure Key Vault diagnostics logs into Microsoft Sentinel, allowing you to continuously monitor activity in all your instances.\n\n**Data Connectors:** 1, **Workbooks:** 1, **Analytic Rules:** 4\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \r \n  • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Azure%20Key%20Vault/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\n[Azure Key Vault](https://azure.microsoft.com/services/key-vault/) Solution for Microsoft Sentinel enables you to stream Azure Key Vault diagnostics logs into Microsoft Sentinel, allowing you to continuously monitor activity in all your instances.\n\n**Data Connectors:** 1, **Workbooks:** 1, **Analytic Rules:** 4\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
         "subscription": {
           "resourceProviders": [
             "Microsoft.OperationsManagement/solutions",
@@ -60,7 +60,7 @@
             "name": "dataconnectors1-text",
             "type": "Microsoft.Common.TextBlock",
             "options": {
-              "text": "This solution installs the data connector for ingesting Azure Key Vault diagnostics logs into Microsoft Sentinel. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
+              "text": "This Solution installs the data connector for Azure Key Vault. You can get Azure Key Vault custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
             }
           },
           {