Doppel solution

[anantm-metron]

Required items, please complete

Change(s):

• Created a Doppel folder inside Solutions, with subfolders for Data Connectors and Workbooks.
• Added the following files:
  • Data Connectors:
    • Connector_Doppel.json
    • DeployToAzure.json
  • Workbooks:
    • Doppel.json
    • Preview images for the workbooks.
  • Logos:
    • doppel.svg
  • Sample Data:
    • Doppel_Logs.json for sample data ingestion.

Reason for Change(s):

• Initial commit: To submit Doppel Data Connectors and Workbooks for review by the Microsoft Sentinel team as part of the integration process.

Version Updated:

• No
• It does not involve analytic rule or detection templates that would require a version number.

Testing Completed:

• Yes
• Tested locally using a Microsoft Sentinel environment.
• Validated that the Data Connectors and Workbooks function as expected when imported into Sentinel, and that the Sample Logs are correctly processed.

Checked that the validations are passing and have addressed any issues that are present:

• Yes, all validations have passed.
• There were no issues with the workbooks or data connectors after testing.

[anantm-metron]

@anantm-metron please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

• (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.

@microsoft-github-policy-service agree

• (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.

@microsoft-github-policy-service agree company="Microsoft"

Contributor License Agreement

@microsoft-github-policy-service agree company="Doppel"

[v-prasadboke]

Hello @anantm-metron,

1. Update the branch from master

2. Please create a input file which will located in Data folder.
   This will file will consist basic details of the Solution and listed content in the Solution.

3. Add Solutionmetadata file which will consist metadata details of the Solution.
   For input file and solution metadata please refer - https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Agari

4. Add workbook metadata to this Location - https://github.com/Azure/Azure-Sentinel/blob/master/Workbooks/WorkbooksMetadata.json

5. Workbook images added are B&W, Add colorful image. For each image added, add it with white and black background.

6. Can you specify what kind of Connector is this. Is this a custom connector or of kind CCP.
   I'm confused about the azuredeploy file you added - if possible please specify

7. Also please provide write access to the branch.

[anantm-metron]

Hi @v-prasadboke ,

Thanks for the review! I've addressed the comments as follows:

1. Solution Input File: Created in the Data folder with solution details and listed content.
2. Solution Metadata: Added the metadata file, following the Agari solution example.
3. Workbook Metadata: Updated the workbook metadata as per the reference.
4. Workbook Images: Added colorful images with white and black backgrounds.
5. Connector Type: This is a Custom Data Connector for Doppel.
6. azuredeploy File: The DeployToAzure.json is an ARM template that configures a DCR-based custom connector, enabling one-click deployment to create the necessary DCE, DCR, and custom Log Analytics table for the Doppel connector, eliminating manual setup steps.
7. Write Access: Provided write access to the branch.

Let me know if you need further changes!

[v-prasadboke]

Hello @anantm-metron, I have added some permission in data connector
Please check once and act as needed

[v-prasadboke]

Hello @anantm-metron, Please create a custom table schema for mentioned table in workbook
for ref - https://github.com/Azure/Azure-Sentinel/tree/master/.script/tests/KqlvalidationsTests/CustomTables