Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MailGuard 365 Sentinel Solution #7992

Merged
merged 24 commits into from
Sep 7, 2023
Merged

MailGuard 365 Sentinel Solution #7992

Show file tree
Hide file tree
Changes from 12 commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
79cdf44
Initial Commit for MailGuard 365 Sentinel Solution
prathikc May 9, 2023
f30c31c
Updated templates, resolved failed tests.
prathikc May 9, 2023
90970c9
Resolved more validation issues.
prathikc May 9, 2023
5fdfd95
Updated logo and added table schema.
prathikc May 9, 2023
084a880
Update UUID to GUID in logo
prathikc May 9, 2023
339c85a
Resized Logo and fixed validation issues
prathikc May 9, 2023
97ec1b3
Fixed xlink:href tag in logo
prathikc May 9, 2023
3d0c22a
Updates to address review comments
prathikc Jun 2, 2023
43f6676
Added Sample Data
prathikc Jun 9, 2023
2a47ba1
Repackaging solution to V2
prathikc Jun 9, 2023
5bf01b8
Fixed json error
prathikc Jun 9, 2023
16fd2cc
Fixing validation errors
prathikc Jun 9, 2023
1b8c9f8
Fixed repeated word
prathikc Jun 9, 2023
30c3dd3
Fixed ARM TTM validation
prathikc Jun 9, 2023
3d7ceb0
added workbook version and content id
prathikc Jun 27, 2023
cdcff8f
Merge branch 'Azure:master' into mailguard365-1
prathikc Aug 3, 2023
5df908f
Merge branch 'Azure:master' into mailguard365-1
prathikc Aug 29, 2023
bcc30e3
Merge branch 'Azure:master' into mailguard365-1
prathikc Aug 31, 2023
aa1b182
Updated to V3
prathikc Aug 31, 2023
6628486
Added release notes
prathikc Aug 31, 2023
46c71a9
Resolved conflict with workbook metadata
prathikc Aug 31, 2023
ae71a53
Fixed typo
prathikc Sep 4, 2023
c1bb12c
Repackaged solution
prathikc Sep 4, 2023
dc665ca
Minor changes
prathikc Sep 5, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
133 changes: 133 additions & 0 deletions .script/tests/KqlvalidationsTests/CustomTables/MailGuard365_Threats_CL.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,133 @@
{
"Name": "MailGuard365_Threats_CL",
"Properties": [
{
"Name": "TenantId",
"Type": "String"
},
{
"Name": "SourceSystem",
"Type": "String"
},
{
"Name": "TimeGenerated",
"Type": "DateTime"
},
{
"Name": "MessageId_s",
"Type": "String"
},
{
"Name": "HeaderMessageId_s",
"Type": "String"
},
{
"Name": "UserId_g",
"Type": "String"
},
{
"Name": "CustomerTenantId_g",
"Type": "String"
},
{
"Name": "Score_d",
"Type": "Real"
},
{
"Name": "Virus_b",
"Type": "Bool"
},
{
"Name": "Category",
devikamehra marked this conversation as resolved.
Show resolved Hide resolved
"Type": "String"
},
{
"Name": "Attachments_s",
"Type": "String"
},
{
"Name": "Sender_Email_s",
"Type": "Double"
},
{
"Name": "Sender_Domain_s",
"Type": "DateTime"
},
{
"Name": "Recipients_s",
"Type": "String"
},
{
"Name": "ReceivedHeaders_s",
"Type": "String"
},
{
"Name": "SenderHeader_s",
"Type": "String"
},
{
"Name": "ToHeader_s",
"Type": "Guid"
},
{
"Name": "CcHeader_s",
"Type": "String"
},
{
"Name": "Subject_s",
"Type": "String"
},
{
"Name": "OriginCountry_s",
"Type": "String"
},
{
"Name": "MessageDate_t",
"Type": "DateTime"
},
{
"Name": "MessageSize_d",
"Type": "Real"
},
{
"Name": "Action_s",
"Type": "String"
},
{
"Name": "ReceivedDateTime_d",
"Type": "Real"
},
{
"Name": "ForefrontAntiSpam_s",
"Type": "String"
},
{
"Name": "MicrosoftAntiSpam_s",
"Type": "String"
},
{
"Name": "IsInWhiteList_b",
"Type": "Bool"
},
{
"Name": "IsInBlackList_b",
"Type": "Bool"
},
{
"Name": "Email_s",
"Type": "String"
},
{
"Name": "HasAttachment_b",
"Type": "Bool"
},
{
"Name": "HasImage_b",
"Type": "Bool"
},
{
"Name": "Type",
"Type": "String"
}
]
}
1 change: 1 addition & 0 deletions Logos/MailGuard365_logo.svg
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
160 changes: 160 additions & 0 deletions Sample Data/MailGuard365_Threats_CL.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,160 @@
TenantId,SourceSystem,MG,ManagementGroupName,"TimeGenerated [UTC]",Computer,RawData,"MessageId_s","HeaderMessageId_s","UserId_g","CustomerTenantId_g","Score_d","Virus_b",Category,"Attachments_s","Sender_Email_s","Sender_Domain_s","Recipients_s","ReceivedHeaders_s","SenderHeader_s","ToHeader_s","CcHeader_s","Subject_s","OriginCountry_s","MessageDate_t [UTC]","MessageSize_d","Action_s","ReceivedDateTime_d","ForefrontAntiSpam_s","MicrosoftAntiSpam_s","IsInWhiteList_b","IsInBlackList_b","Email_s","HasAttachment_b","HasImage_b",Type,"_ResourceId","MailMessage_0_NetworkMessageId","MailMessage_0_Recipient"
"e51bd602-0194-11ee-be56-0242ac120002",RestAPI,,,"5/30/2023, 2:30:00.000 PM",,,"c17d72c2-0195-11ee-be56-0242ac120002","<f81fe5f8787371d246fc46de9@bad-domain.com>","1bff3a60-0195-11ee-be56-0242ac120002","21979fe4-0195-11ee-be56-0242ac120002","30.1",false,Phishing,"[]","bounce@bad-domain.com","bad-domain.com","[
{
""Email"": ""usera@mailguard.com.au"",
""Domain"": ""mailguard.com.au""
}
]","[
{
""Time"": ""Tue, 30 May 2023 14:29:59 +0000"",
""TimeUtc"": ""2023-05-30 14:29:59"",
""DnsHost"": null,
""Helo"": ""ME3PR0QBE0000.ausprd01.prod.outlook.com"",
""Host"": null,
""Ip"": ""2603:1111:111:111::11"",
""Mta"": ""ME3PR0QBE0000.ausprd01.prod.outlook.com"",
""GeoIp"": null,
""ReceivedDateTime"": ""2023-05-30T14:29:59+00:00""
},
{
""Time"": ""Tue, 30 May 2023 14:29:56 +0000"",
""TimeUtc"": ""2023-05-30 14:29:56"",
""DnsHost"": null,
""Helo"": ""SYBPR0HGF0000.ausprd01.prod.outlook.com"",
""Host"": null,
""Ip"": ""2603:10c6:10:5::31"",
""Mta"": ""SYBPR0HGF0000.ausprd01.prod.outlook.com"",
""GeoIp"": null,
""ReceivedDateTime"": ""2023-05-30T14:29:56+00:00""
}
]","Admin-Reset <info@bad-domain.com>","<usera@mailguard.com.au>",,"Forgot your password",US,"5/30/2023, 2:29:59.000 PM",86592,Moved,1685457000,"CIP:198.11.111.111;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:bad-domain.com;PTR:bad-domain.com;CAT:NONE;SFS:(13230028)(966005)(26005)(559001)(579004);DIR:INB;","BCL:5;",false,false,"usera@mailguard.com.au",false,false,"MailGuard365_Threats_CL",,"74971cc8-0196-11ee-be56-0242ac120002","usera@mailguard.com.au"
"e51bd602-0194-11ee-be56-0242ac120002",RestAPI,,,"5/30/2023, 2:30:00.000 PM",,,"c17d72c2-0195-11ee-be56-0242ac120002","<f81fe5f8787371d246fc46de9@bad-domain.com>","1bff3a60-0195-11ee-be56-0242ac120002","21979fe4-0195-11ee-be56-0242ac120002","20.1",false,"Malicious Attachment","[
{
""FileName"": ""VoiceMail.html"",
""FileType"": ""html"",
""FileSize"": 3265,
""ProcessedDate"": 0
}
]","bounce@bad-domain.com","bad-domain.com","[
{
""Email"": ""usera@mailguard.com.au"",
""Domain"": ""mailguard.com.au""
}
]","[
{
""Time"": ""Tue, 30 May 2023 14:29:59 +0000"",
""TimeUtc"": ""2023-05-30 14:29:59"",
""DnsHost"": null,
""Helo"": ""ME3PR0QBE0000.ausprd01.prod.outlook.com"",
""Host"": null,
""Ip"": ""2603:1111:111:111::11"",
""Mta"": ""ME3PR0QBE0000.ausprd01.prod.outlook.com"",
""GeoIp"": null,
""ReceivedDateTime"": ""2023-05-30T14:29:59+00:00""
},
{
""Time"": ""Tue, 30 May 2023 14:29:56 +0000"",
""TimeUtc"": ""2023-05-30 14:29:56"",
""DnsHost"": null,
""Helo"": ""SYBPR0HGF0000.ausprd01.prod.outlook.com"",
""Host"": null,
""Ip"": ""2603:10c6:10:5::31"",
""Mta"": ""SYBPR0HGF0000.ausprd01.prod.outlook.com"",
""GeoIp"": null,
""ReceivedDateTime"": ""2023-05-30T14:29:56+00:00""
}
]","VoiceMail <info@bad-domain.com>","<usera@mailguard.com.au>",,"You have a new voicemail",US,"5/30/2023, 2:29:59.000 PM",86592,Moved,1685457000,"CIP:198.11.111.111;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:bad-domain.com;PTR:bad-domain.com;CAT:NONE;SFS:(13230028)(966005)(26005)(559001)(579004);DIR:INB;","BCL:5;",false,false,"usera@mailguard.com.au",false,false,"MailGuard365_Threats_CL",,"74971cc8-0196-11ee-be56-0242ac120002","usera@mailguard.com.au"
"e51bd602-0194-11ee-be56-0242ac120002",RestAPI,,,"5/30/2023, 2:30:00.000 PM",,,"c17d72c2-0195-11ee-be56-0242ac120002","<f81fe5f8787371d246fc46de9@bad-domain.com>","1bff3a60-0195-11ee-be56-0242ac120002","21979fe4-0195-11ee-be56-0242ac120002","22.4",false,"Malicious Attachment","[
{
""FileName"": ""Invoice#2345.html"",
""FileType"": ""html"",
""FileSize"": 3265,
""ProcessedDate"": 0
}
]","bounce@bad-domain.com","bad-domain.com","[
{
""Email"": ""usera@mailguard.com.au"",
""Domain"": ""mailguard.com.au""
}
]","[
{
""Time"": ""Tue, 30 May 2023 14:29:59 +0000"",
""TimeUtc"": ""2023-05-30 14:29:59"",
""DnsHost"": null,
""Helo"": ""ME3PR0QBE0000.ausprd01.prod.outlook.com"",
""Host"": null,
""Ip"": ""2603:1111:111:111::11"",
""Mta"": ""ME3PR0QBE0000.ausprd01.prod.outlook.com"",
""GeoIp"": null,
""ReceivedDateTime"": ""2023-05-30T14:29:59+00:00""
},
{
""Time"": ""Tue, 30 May 2023 14:29:56 +0000"",
""TimeUtc"": ""2023-05-30 14:29:56"",
""DnsHost"": null,
""Helo"": ""SYBPR0HGF0000.ausprd01.prod.outlook.com"",
""Host"": null,
""Ip"": ""2603:10c6:10:5::31"",
""Mta"": ""SYBPR0HGF0000.ausprd01.prod.outlook.com"",
""GeoIp"": null,
""ReceivedDateTime"": ""2023-05-30T14:29:56+00:00""
}
]","Invoice Mailer <info@bad-domain.com>","<usera@mailguard.com.au>",,"Pay your Invoice",US,"5/30/2023, 2:29:59.000 PM",86592,Moved,1685457000,"CIP:198.11.111.111;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:bad-domain.com;PTR:bad-domain.com;CAT:NONE;SFS:(13230028)(966005)(26005)(559001)(579004);DIR:INB;","BCL:5;",false,false,"usera@mailguard.com.au",false,false,"MailGuard365_Threats_CL",,"74971cc8-0196-11ee-be56-0242ac120002","usera@mailguard.com.au"
"e51bd602-0194-11ee-be56-0242ac120002",RestAPI,,,"5/30/2023, 2:30:00.000 PM",,,"c17d72c2-0195-11ee-be56-0242ac120002","<f81fe5f8787371d246fc46de9@bad-domain.com>","1bff3a60-0195-11ee-be56-0242ac120002","21979fe4-0195-11ee-be56-0242ac120002","34.2",false,Phishing,"[]","bounce@bad-domain.com","bad-domain.com","[
{
""Email"": ""usera@mailguard.com.au"",
""Domain"": ""mailguard.com.au""
}
]","[
{
""Time"": ""Tue, 30 May 2023 14:29:59 +0000"",
""TimeUtc"": ""2023-05-30 14:29:59"",
""DnsHost"": null,
""Helo"": ""ME3PR0QBE0000.ausprd01.prod.outlook.com"",
""Host"": null,
""Ip"": ""2603:1111:111:111::11"",
""Mta"": ""ME3PR0QBE0000.ausprd01.prod.outlook.com"",
""GeoIp"": null,
""ReceivedDateTime"": ""2023-05-30T14:29:59+00:00""
},
{
""Time"": ""Tue, 30 May 2023 14:29:56 +0000"",
""TimeUtc"": ""2023-05-30 14:29:56"",
""DnsHost"": null,
""Helo"": ""SYBPR0HGF0000.ausprd01.prod.outlook.com"",
""Host"": null,
""Ip"": ""2603:10c6:10:5::31"",
""Mta"": ""SYBPR0HGF0000.ausprd01.prod.outlook.com"",
""GeoIp"": null,
""ReceivedDateTime"": ""2023-05-30T14:29:56+00:00""
}
]","Admin <info@bad-domain.com>","<usera@mailguard.com.au>",,"Reset your password",US,"5/30/2023, 2:29:59.000 PM",86592,Moved,1685457000,"CIP:198.11.111.111;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:bad-domain.com;PTR:bad-domain.com;CAT:NONE;SFS:(13230028)(966005)(26005)(559001)(579004);DIR:INB;","BCL:5;",false,false,"usera@mailguard.com.au",false,false,"MailGuard365_Threats_CL",,"74971cc8-0196-11ee-be56-0242ac120002","usera@mailguard.com.au"
"e51bd602-0194-11ee-be56-0242ac120002",RestAPI,,,"5/30/2023, 2:30:00.000 PM",,,"c17d72c2-0195-11ee-be56-0242ac120002","<f81fe5f8787371d246fc46de9@bad-domain.com>","1bff3a60-0195-11ee-be56-0242ac120002","21979fe4-0195-11ee-be56-0242ac120002","10.1",false,Spam,"[]","bounce@bad-domain.com","bad-domain.com","[
{
""Email"": ""usera@mailguard.com.au"",
""Domain"": ""mailguard.com.au""
}
]","[
{
""Time"": ""Tue, 30 May 2023 14:29:59 +0000"",
""TimeUtc"": ""2023-05-30 14:29:59"",
""DnsHost"": null,
""Helo"": ""ME3PR0QBE0000.ausprd01.prod.outlook.com"",
""Host"": null,
""Ip"": ""2603:1111:111:111::11"",
""Mta"": ""ME3PR0QBE0000.ausprd01.prod.outlook.com"",
""GeoIp"": null,
""ReceivedDateTime"": ""2023-05-30T14:29:59+00:00""
},
{
""Time"": ""Tue, 30 May 2023 14:29:56 +0000"",
""TimeUtc"": ""2023-05-30 14:29:56"",
""DnsHost"": null,
""Helo"": ""SYBPR0HGF0000.ausprd01.prod.outlook.com"",
""Host"": null,
""Ip"": ""2603:10c6:10:5::31"",
""Mta"": ""SYBPR0HGF0000.ausprd01.prod.outlook.com"",
""GeoIp"": null,
""ReceivedDateTime"": ""2023-05-30T14:29:56+00:00""
}
]","Insurance <info@bad-domain.com>","<usera@mailguard.com.au>",,"Your options",US,"5/30/2023, 2:29:59.000 PM",86592,Moved,1685457000,"CIP:198.11.111.111;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:bad-domain.com;PTR:bad-domain.com;CAT:NONE;SFS:(13230028)(966005)(26005)(559001)(579004);DIR:INB;","BCL:5;",false,false,"usera@mailguard.com.au",false,false,"MailGuard365_Threats_CL",,"74971cc8-0196-11ee-be56-0242ac120002","usera@mailguard.com.au"
Loading