Skip to content

Commit

Permalink
Merge pull request #9330 from Azure/feature/sagamzu/UpdateMdcSolution
Browse files Browse the repository at this point in the history
[Solution] Update Microsoft defender for cloud solution
  • Loading branch information
v-dvedak authored Nov 21, 2023
2 parents 9165da7 + 0f7990c commit f101af8
Show file tree
Hide file tree
Showing 12 changed files with 830 additions and 93 deletions.
4 changes: 4 additions & 0 deletions .script/dataConnectorValidator.ts
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,10 @@ function getConnectorCategory(dataTypes : any, instructionSteps:[])
{
return ConnectorCategory.SysLog;
}
else if (dataTypes[0].name.includes("SecurityAlert"))
{
return ConnectorCategory.SecurityAlert;
}
else if (dataTypes[0].name.includes("ThreatIntelligenceIndicator"))
{
return ConnectorCategory.ThreatIntelligenceIndicator;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -218,5 +218,6 @@
"AtlassianBeaconAlerts",
"GCPAuditLogsDefinition",
"PrancerLogData",
"MicrosoftDefenderForCloudTenantBased",
"RidgeBotDataConnector"
]
1 change: 1 addition & 0 deletions .script/utils/dataConnector.ts
Original file line number Diff line number Diff line change
Expand Up @@ -206,4 +206,5 @@ export enum ConnectorCategory {
AwsS3="AwsS3",
AWS="AWS",
AzureActiveDirectory="AzureActiveDirectory",
SecurityAlert="SecurityAlert"
}
331 changes: 331 additions & 0 deletions .script/utils/schemas/SecurityAlert_ConnectorSchema.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,331 @@
{
"$schema": "http://json-schema.org/draft-04/schema#",
"type": "object",
"properties": {
"id": {
"type": "string"
},
"title": {
"type": "string"
},
"publisher": {
"type": "string"
},
"descriptionMarkdown": {
"type": "string"
},
"logo": {
"type": "string"
},
"graphQueriesTableName": {
"type": "string"
},
"graphQueries": {
"type": "array",
"items": [
{
"type": "object",
"properties": {
"metricName": {
"type": "string"
},
"legend": {
"type": "string"
},
"baseQuery": {
"type": "string"
}
},
"required": [
"metricName",
"legend",
"baseQuery"
]
}
]
},
"sampleQueries": {
"type": "array",
"items": [
{
"type": "object",
"properties": {
"description": {
"type": "string"
},
"query": {
"type": "string"
}
},
"required": [
"description",
"query"
]
},
{
"type": "object",
"properties": {
"description": {
"type": "string"
},
"query": {
"type": "string"
}
},
"required": [
"description",
"query"
]
}
]
},
"dataTypes": {
"type": "array",
"items": [
{
"type": "object",
"properties": {
"name": {
"type": "string"
},
"lastDataReceivedQuery": {
"type": "string"
}
},
"required": [
"name",
"lastDataReceivedQuery"
]
}
]
},
"connectivityCriterias": {
"type": "array",
"items": [
{
"type": "object",
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "array",
"items": [
{
"type": "string"
}
]
}
},
"required": [
"type",
"value"
]
}
]
},
"availability": {
"type": "object",
"properties": {
"status": {
"type": "integer"
},
"isPreview": {
"type": "boolean"
}
},
"required": [
"status",
"isPreview"
]
},
"permissions": {
"type": "object",
"properties": {
"tenant": {
"type": "array",
"items": [
{
"type": "string"
},
{
"type": "string"
}
]
},
"resourceProvider": {
"type": "array",
"items": [
{
"type": "object",
"properties": {
"provider": {
"type": "string"
},
"permissionsDisplayText": {
"type": "string"
},
"providerDisplayName": {
"type": "string"
},
"scope": {
"type": "string"
},
"requiredPermissions": {
"type": "object",
"properties": {
"read": {
"type": "boolean"
},
"write": {
"type": "boolean"
},
"delete": {
"type": "boolean"
}
},
"required": [
"read",
"write",
"delete"
]
}
},
"required": [
"provider",
"permissionsDisplayText",
"providerDisplayName",
"scope",
"requiredPermissions"
]
}
]
},
"tenantMember": {
"type": "boolean"
}
},
"required": [
"tenant",
"resourceProvider",
"tenantMember"
]
},
"instructionSteps": {
"type": "array",
"items": [
{
"type": "object",
"properties": {
"title": {
"type": "string"
},
"description": {
"type": "string"
},
"instructions": {
"type": "array",
"items": [
{
"type": "object",
"properties": {
"parameters": {
"type": "object",
"properties": {
"title": {
"type": "string"
},
"connectorKind": {
"type": "string"
},
"enable": {
"type": "boolean"
},
"newPipelineEnabledFeatureFlagConfig": {
"type": "object",
"properties": {
"feature": {
"type": "string"
},
"featureStates": {
"type": "object",
"properties": {
"1": {
"type": "integer"
},
"2": {
"type": "integer"
},
"3": {
"type": "integer"
},
"4": {
"type": "integer"
}
},
"required": [
"1",
"2",
"3",
"4"
]
}
},
"required": [
"feature",
"featureStates"
]
},
"infoBoxMessage": {
"type": "string"
},
"shouldAlwaysDisplayInfoMessage": {
"type": "boolean"
}
},
"required": [
"title",
"connectorKind",
"enable",
"newPipelineEnabledFeatureFlagConfig",
"infoBoxMessage",
"shouldAlwaysDisplayInfoMessage"
]
},
"type": {
"type": "string"
}
},
"required": [
"parameters",
"type"
]
}
]
}
},
"required": [
"title",
"description",
"instructions"
]
}
]
}
},
"required": [
"id",
"title",
"publisher",
"descriptionMarkdown",
"logo",
"graphQueriesTableName",
"graphQueries",
"sampleQueries",
"dataTypes",
"connectivityCriterias",
"availability",
"permissions",
"instructionSteps"
]
}
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,9 @@ requiredDataConnectors:
- connectorId: AzureSecurityCenter
dataTypes:
- SecurityAlert
- connectorId: MicrosoftDefenderForCloudTenantBased
dataTypes:
- SecurityAlert
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
Expand Down Expand Up @@ -62,5 +65,5 @@ entityMappings:
fieldMappings:
- identifier: Address
columnName: IpAddress
version: 1.0.1
version: 1.0.2
kind: Scheduled
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"id": "AzureSecurityCenter",
"title": "Microsoft Defender for Cloud",
"title": "Subscription-based Microsoft Defender for Cloud (Legacy)",
"publisher": "Microsoft",
"descriptionMarkdown": "Microsoft Defender for Cloud is a security management tool that allows you to detect and quickly respond to threats across Azure, hybrid, and multi-cloud workloads. This connector allows you to stream your security alerts from Microsoft Defender for Cloud into Microsoft Sentinel, so you can view Defender data in workbooks, query it to produce alerts, and investigate and respond to incidents.\n\n[For more information>](https://aka.ms/ASC-Connector)",
"logo": "AzureSecurityCenter.svg",
Expand Down
Loading

0 comments on commit f101af8

Please sign in to comment.