MailGuard 365 Sentinel Solution #7992

prathikc · 2023-05-09T03:44:28Z

Required items, please complete

Change(s):

MailGuard 365 Solution for Sentinel - data connector, hunting queries, workbook and logo.

Reason for Change(s):

New sentinel connector for MailGuard 365.

Version Updated:

N/A

Testing Completed:

Yes

Checked that the validations are passing and have addressed any issues that are present:

Yes

- Added MailGuard 365 Logo - Added Data Connector - Added Hunting Queries - Added Workbooks

prathikc · 2023-05-09T03:47:40Z

@microsoft-github-policy-service agree company="MailGuard Pty Ltd"

v-rbajaj · 2023-05-11T07:13:45Z

Hi @devikamehra, please provide your feedback.

devikamehra

Please provide sample data to test Hunting queries.

Solutions/MailGuard 365/Hunting Queries/MailGuard365HighConfidenceThreats.yaml

.script/tests/KqlvalidationsTests/CustomTables/MailGuard365_Threats_CL.json

v-rbajaj · 2023-05-17T07:54:58Z

Hi @prathikc, please provide the Sample data. Also, repackage the solution using this tool https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Create-Azure-Sentinel-Solution/V2 with version 2.0.0

v-rbajaj · 2023-05-18T12:30:42Z

Hi @prathikc, please address the comments from me and Devika, thanks!

- Updated entity mappings in the query - Added sample data

v-rbajaj · 2023-06-06T10:46:23Z

Hi @prathikc, please provide the Sample data. Also, repackage the solution using this tool https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Create-Azure-Sentinel-Solution/V2 with version 2.0.0

Hi @prathikc, can you please work on this as well?

prathikc · 2023-06-09T06:13:55Z

Hi @prathikc, please provide the Sample data. Also, repackage the solution using this tool https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Create-Azure-Sentinel-Solution/V2 with version 2.0.0

Hi @prathikc, can you please work on this as well?

Hi @v-rbajaj , I have uploaded the sample data as well now. Running into a few issues with generating the solution package, i suspect it might be with my environment, will continue to work on it.

prathikc · 2023-06-09T08:32:55Z

Hi @v-rbajaj , I've updated the solution V2.

v-rbajaj · 2023-06-09T08:52:43Z

Solutions/MailGuard 365/Data Connectors/MailGuard365.json

+    "sampleQueries": [
+        {
+            "description" : "All phishing threats stopped by MailGuard 365",
+            "query": "MailGuard365_Threats_CL \n | where where Category == \"Phishing\""


Please remove the extra "where" from the query, this should fix the failing KQL validation.

Please do fix the ARM TTK validation as well.

Thank you, I've fixed the KQL validation and the ARM TTK validation as well.

v-rbajaj · 2023-08-03T08:26:48Z

Hi @prathikc, thanks for making these changes.
As per latest guidelines you would repackage the solution using this tool https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Create-Azure-Sentinel-Solution/V3
Please go through the readme.md file and follow the instructions mentioned there.

Please remove the 2.0.0 zip from this PR, this PR will only have 3.0.0 zip

Please do add release note as well, follow below mentioned link for the same.
https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ReleaseNotesGuidance.md

Also please fix the merge conflicts.

v-rbajaj · 2023-08-08T07:50:37Z

Hi @prathikc, thanks for making these changes. As per latest guidelines you would repackage the solution using this tool https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Create-Azure-Sentinel-Solution/V3 Please go through the readme.md file and follow the instructions mentioned there.

Please remove the 2.0.0 zip from this PR, this PR will only have 3.0.0 zip

Please do add release note as well, follow below mentioned link for the same. https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ReleaseNotesGuidance.md

Hi @prathikc, please look into this comment.
Also please fix the merge conflicts.

v-rbajaj · 2023-08-10T08:24:08Z

Hi @prathikc , please look into the above comment.

prathikc · 2023-08-11T07:22:02Z

Hi @prathikc , please look into the above comment.

@v-rbajaj Noted, will package in V3.

v-atulyadav · 2023-08-14T10:01:16Z

Noted @prathikc, thanks.

v-rbajaj · 2023-08-16T10:57:58Z

Hi @prathikc, can you please provide some update on this PR?

v-rbajaj · 2023-08-18T11:25:33Z

Hi @prathikc, can you please provide some update on this PR?

v-rbajaj · 2023-08-22T07:12:09Z

Hi @prathikc, please provide some update on this PR

prathikc · 2023-08-23T11:29:57Z

Hi @prathikc, please provide some update on this PR

Hi @v-rbajaj , i am working on packaging the solution. There are some urgent issues that I am currently working on, will provi

Hi @prathikc, please provide some update on this PR

Hi @v-rbajaj , I'm still working on the packaging, will get it ready by early next week.

v-rbajaj · 2023-08-24T06:56:47Z

Hi @prathikc, thanks noted.

v-rbajaj · 2023-08-28T07:34:45Z

Hi @prathikc, can you please provide some update on this PR?

v-rbajaj · 2023-08-30T08:25:53Z

Hi @prathikc, thanks for making these changes, I hope you are working on adding of release notes and fixing the merge conflicts?

prathikc · 2023-08-31T06:06:22Z

Hi @prathikc, thanks for making these changes, I hope you are working on adding of release notes and fixing the merge conflicts?

Hi @v-rbajaj , i have resolved the conflicts and have added in release notes.

v-rbajaj · 2023-09-01T09:08:59Z

Solutions/MailGuard 365/Data Connectors/MailGuard365.json

+    "instructionSteps": [
+        {
+            "title": "Configure and connect MailGuard 365",
+            "description": "1. In the MailGuard 365 Console, click **Settings** on the navigation bar.\n2. Click the **Integrations** tab.\n3. Click the **Enable Microsoft Sentinel**.\n  - Enter your workspace id and primary key from the fields below, click **Finish**.\n5. For additional instructions, please contact MailGuard 365 support.",


Hi @prathikc, the description needs to be fixed, there is a small problem with the numbering, please take a look at image below.

Please repackage the solution post fixing.

Hi @v-rbajaj , that was a good catch! I have made the changes and re-packaged the solution.

v-rbajaj · 2023-09-05T06:24:11Z

Hi @prathikc, I just wanted to confirm if "Enter your workspace id and primary key from the fields below, click Finish." should be point 4 and "For additional instructions, please contact MailGuard 365 support." should be 5? Asking because it does look a bit odd..

Solutions/MailGuard 365/SolutionMetadata.json

Initial Commit for MailGuard 365 Sentinel Solution

79cdf44

- Added MailGuard 365 Logo - Added Data Connector - Added Hunting Queries - Added Workbooks

prathikc requested review from a team as code owners May 9, 2023 03:44

Updated templates, resolved failed tests.

f30c31c

v-atulyadav assigned v-rbajaj May 9, 2023

v-atulyadav added the Solution Solution specialty review needed label May 9, 2023

prathikc added 3 commits May 9, 2023 15:03

Resolved more validation issues.

90970c9

Updated logo and added table schema.

5fdfd95

Update UUID to GUID in logo

084a880

prathikc changed the title ~~Initial Commit for MailGuard 365 Sentinel Solution~~ MailGuard 365 Sentinel Solution May 9, 2023

prathikc added 2 commits May 10, 2023 09:10

Resized Logo and fixed validation issues

339c85a

Fixed xlink:href tag in logo

97ec1b3

v-rbajaj assigned devikamehra May 11, 2023

devikamehra suggested changes May 16, 2023

View reviewed changes

Solutions/MailGuard 365/Hunting Queries/MailGuard365HighConfidenceThreats.yaml Show resolved Hide resolved

.script/tests/KqlvalidationsTests/CustomTables/MailGuard365_Threats_CL.json Show resolved Hide resolved

Updates to address review comments

3d0c22a

- Updated entity mappings in the query - Added sample data

Added Sample Data

43f6676

prathikc added 3 commits June 9, 2023 16:37

Repackaging solution to V2

2a47ba1

Fixed json error

5bf01b8

Fixing validation errors

16fd2cc

v-rbajaj reviewed Jun 9, 2023

View reviewed changes

prathikc added 2 commits June 9, 2023 19:32

Fixed repeated word

1b8c9f8

Fixed ARM TTM validation

30c3dd3

Merge branch 'Azure:master' into mailguard365-1

cdcff8f

prathikc force-pushed the mailguard365-1 branch from 689e1e7 to cdcff8f Compare August 29, 2023 06:47

Merge branch 'Azure:master' into mailguard365-1

5df908f

prathikc force-pushed the mailguard365-1 branch from a2fdbe0 to 5df908f Compare August 31, 2023 05:59

prathikc and others added 4 commits August 31, 2023 15:59

Merge branch 'Azure:master' into mailguard365-1

bcc30e3

Updated to V3

aa1b182

Added release notes

6628486

Resolved conflict with workbook metadata

46c71a9

v-rbajaj reviewed Sep 1, 2023

View reviewed changes

prathikc added 2 commits September 4, 2023 12:27

Fixed typo

ae71a53

Repackaged solution

c1bb12c

v-rbajaj reviewed Sep 5, 2023

View reviewed changes

Solutions/MailGuard 365/SolutionMetadata.json Outdated Show resolved Hide resolved

Minor changes

dc665ca

v-rbajaj approved these changes Sep 7, 2023

View reviewed changes

v-dvedak approved these changes Sep 7, 2023

View reviewed changes

v-dvedak merged commit f78fc4d into Azure:master Sep 7, 2023
29 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

MailGuard 365 Sentinel Solution #7992

MailGuard 365 Sentinel Solution #7992

prathikc commented May 9, 2023 •

edited

Loading

prathikc commented May 9, 2023

v-rbajaj commented May 11, 2023

devikamehra left a comment

v-rbajaj commented May 17, 2023 •

edited

Loading

v-rbajaj commented May 18, 2023

v-rbajaj commented Jun 6, 2023

prathikc commented Jun 9, 2023

prathikc commented Jun 9, 2023

v-rbajaj Jun 9, 2023 •

edited

Loading

v-rbajaj Jun 9, 2023

prathikc Jun 9, 2023

v-rbajaj commented Aug 3, 2023 •

edited

Loading

v-rbajaj commented Aug 8, 2023

v-rbajaj commented Aug 10, 2023

prathikc commented Aug 11, 2023

v-atulyadav commented Aug 14, 2023

v-rbajaj commented Aug 16, 2023

v-rbajaj commented Aug 18, 2023

v-rbajaj commented Aug 22, 2023

prathikc commented Aug 23, 2023

v-rbajaj commented Aug 24, 2023

v-rbajaj commented Aug 28, 2023

v-rbajaj commented Aug 30, 2023

prathikc commented Aug 31, 2023

v-rbajaj Sep 1, 2023

prathikc Sep 4, 2023

v-rbajaj commented Sep 5, 2023

MailGuard 365 Sentinel Solution #7992

MailGuard 365 Sentinel Solution #7992

Conversation

prathikc commented May 9, 2023 • edited Loading

prathikc commented May 9, 2023

v-rbajaj commented May 11, 2023

devikamehra left a comment

Choose a reason for hiding this comment

v-rbajaj commented May 17, 2023 • edited Loading

v-rbajaj commented May 18, 2023

v-rbajaj commented Jun 6, 2023

prathikc commented Jun 9, 2023

prathikc commented Jun 9, 2023

v-rbajaj Jun 9, 2023 • edited Loading

Choose a reason for hiding this comment

v-rbajaj Jun 9, 2023

Choose a reason for hiding this comment

prathikc Jun 9, 2023

Choose a reason for hiding this comment

v-rbajaj commented Aug 3, 2023 • edited Loading

v-rbajaj commented Aug 8, 2023

v-rbajaj commented Aug 10, 2023

prathikc commented Aug 11, 2023

v-atulyadav commented Aug 14, 2023

v-rbajaj commented Aug 16, 2023

v-rbajaj commented Aug 18, 2023

v-rbajaj commented Aug 22, 2023

prathikc commented Aug 23, 2023

v-rbajaj commented Aug 24, 2023

v-rbajaj commented Aug 28, 2023

v-rbajaj commented Aug 30, 2023

prathikc commented Aug 31, 2023

v-rbajaj Sep 1, 2023

Choose a reason for hiding this comment

prathikc Sep 4, 2023

Choose a reason for hiding this comment

v-rbajaj commented Sep 5, 2023

prathikc commented May 9, 2023 •

edited

Loading

v-rbajaj commented May 17, 2023 •

edited

Loading

v-rbajaj Jun 9, 2023 •

edited

Loading

v-rbajaj commented Aug 3, 2023 •

edited

Loading