Skip to content

Commit

Permalink
Repackaging-BoxSolution
Browse files Browse the repository at this point in the history
  • Loading branch information
@v-sudkharat
v-sudkharat committed Jun 14, 2023
1 parent 1c58ab2 commit c204dd7
Show file tree
Hide file tree
Showing 4 changed files with 154 additions and 109 deletions.
2 changes: 1 addition & 1 deletion Solutions/Box/Data/Solution_Box.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@
"Analytic Rules/BoxUserRoleChangedToOwner.yaml"
],
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Box",
"Version": "2.0.0",
"Version": "2.0.2",
"Metadata": "SolutionMetadata.json",
"TemplateSpec": true,
"Is1PConnector": false
Expand Down
Binary file added Solutions/Box/Package/2.0.2.zip
View file
Binary file not shown.
36 changes: 25 additions & 11 deletions Solutions/Box/Package/createUiDefinition.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
"config": {
"isWizard": false,
"basics": {
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Box/Workbooks/Images/Logo/box.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Box](https://developer.box.com/guides/events/enterprise-events/for-enterprise/) solution connector provides the capability to ingest [Box enterprise's events](https://developer.box.com/guides/events/#admin-events) into Microsoft Sentinel using the Box REST API \r\n \r\n \r\n **Underlying Microsoft Technologies used:** \r\n \r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n \r\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api) \r\n \r\n b. [Azure Functions ](https://azure.microsoft.com/services/functions/#overview)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Box/Workbooks/Images/Logo/box.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Box](https://developer.box.com/guides/events/enterprise-events/for-enterprise/) solution connector provides the capability to ingest [Box enterprise's events](https://developer.box.com/guides/events/#admin-events) into Microsoft Sentinel using the Box REST API \r\n \r\n **Underlying Microsoft Technologies used:** \r\n \r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n \r\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api) \r\n \r\n b. [Azure Functions ](https://azure.microsoft.com/services/functions/#overview)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
"subscription": {
"resourceProviders": [
"Microsoft.OperationsManagement/solutions",
Expand Down Expand Up @@ -107,6 +107,20 @@
"uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data"
}
}
},
{
"name": "workbook1",
"type": "Microsoft.Common.Section",
"label": "Box",
"elements": [
{
"name": "workbook1-text",
"type": "Microsoft.Common.TextBlock",
"options": {
"text": "Sets the time name for analysis"
}
}
]
}
]
},
Expand Down Expand Up @@ -309,7 +323,7 @@
"name": "huntingquery1-text",
"type": "Microsoft.Common.TextBlock",
"options": {
"text": "Query shows iplist for admin users. You can check for suspicious IPs or new IPs. It depends on the BoxDataConnector data connector and BoxEvents_CL data type and BoxDataConnector parser."
"text": "Query shows iplist for admin users. You can check for suspicious IPs or new IPs. This hunting query depends on BoxDataConnector data connector (BoxEvents_CL Parser or Table)"
}
}
]
Expand All @@ -323,7 +337,7 @@
"name": "huntingquery2-text",
"type": "Microsoft.Common.TextBlock",
"options": {
"text": "Query shows deleted user accounts. It depends on the BoxDataConnector data connector and BoxEvents_CL data type and BoxDataConnector parser."
"text": "Query shows deleted user accounts. This hunting query depends on BoxDataConnector data connector (BoxEvents_CL Parser or Table)"
}
}
]
Expand All @@ -337,7 +351,7 @@
"name": "huntingquery3-text",
"type": "Microsoft.Common.TextBlock",
"options": {
"text": "Query shows inactive admin accounts (admin users which last login time is more than 30 days). It depends on the BoxDataConnector data connector and BoxEvents_CL data type and BoxDataConnector parser."
"text": "Query shows inactive admin accounts (admin users which last login time is more than 30 days). This hunting query depends on BoxDataConnector data connector (BoxEvents_CL Parser or Table)"
}
}
]
Expand All @@ -351,7 +365,7 @@
"name": "huntingquery4-text",
"type": "Microsoft.Common.TextBlock",
"options": {
"text": "Query shows inactive user accounts (users which last login time is more than 30 days). It depends on the BoxDataConnector data connector and BoxEvents_CL data type and BoxDataConnector parser."
"text": "Query shows inactive user accounts (users which last login time is more than 30 days). This hunting query depends on BoxDataConnector data connector (BoxEvents_CL Parser or Table)"
}
}
]
Expand All @@ -365,7 +379,7 @@
"name": "huntingquery5-text",
"type": "Microsoft.Common.TextBlock",
"options": {
"text": "Query shows new user accounts. It depends on the BoxDataConnector data connector and BoxEvents_CL data type and BoxDataConnector parser."
"text": "Query shows new user accounts. This hunting query depends on BoxDataConnector data connector (BoxEvents_CL Parser or Table)"
}
}
]
Expand All @@ -379,7 +393,7 @@
"name": "huntingquery6-text",
"type": "Microsoft.Common.TextBlock",
"options": {
"text": "Query searches for potentially suspicious files or files which can contain sensitive information such as passwords, secrets. It depends on the BoxDataConnector data connector and BoxEvents_CL data type and BoxDataConnector parser."
"text": "Query searches for potentially suspicious files or files which can contain sensitive information such as passwords, secrets. This hunting query depends on BoxDataConnector data connector (BoxEvents_CL Parser or Table)"
}
}
]
Expand All @@ -393,7 +407,7 @@
"name": "huntingquery7-text",
"type": "Microsoft.Common.TextBlock",
"options": {
"text": "Query shows downloaded data volume per user. It depends on the BoxDataConnector data connector and BoxEvents_CL data type and BoxDataConnector parser."
"text": "Query shows downloaded data volume per user. This hunting query depends on BoxDataConnector data connector (BoxEvents_CL Parser or Table)"
}
}
]
Expand All @@ -407,7 +421,7 @@
"name": "huntingquery8-text",
"type": "Microsoft.Common.TextBlock",
"options": {
"text": "Query shows user permissions(groups) changes. It depends on the BoxDataConnector data connector and BoxEvents_CL data type and BoxDataConnector parser."
"text": "Query shows user permissions(groups) changes. This hunting query depends on BoxDataConnector data connector (BoxEvents_CL Parser or Table)"
}
}
]
Expand All @@ -421,7 +435,7 @@
"name": "huntingquery9-text",
"type": "Microsoft.Common.TextBlock",
"options": {
"text": "Query shows uploaded data volume per user. It depends on the BoxDataConnector data connector and BoxEvents_CL data type and BoxDataConnector parser."
"text": "Query shows uploaded data volume per user. This hunting query depends on BoxDataConnector data connector (BoxEvents_CL Parser or Table)"
}
}
]
Expand All @@ -435,7 +449,7 @@
"name": "huntingquery10-text",
"type": "Microsoft.Common.TextBlock",
"options": {
"text": "Query shows users with newly added owner permissions. It depends on the BoxDataConnector data connector and BoxEvents_CL data type and BoxDataConnector parser."
"text": "Query shows users with newly added owner permissions. This hunting query depends on BoxDataConnector data connector (BoxEvents_CL Parser or Table)"
}
}
]
Expand Down
Loading

0 comments on commit c204dd7

Please sign in to comment.