Recorded Future solution2.5

[RecordedFutureOskbo]

Changes:

• New playbooks using the new TI Api for ingesting ThreatIntelligenceIndicator
• Message in app and documetaion about deprecating graph API for TI indicators.
• New correlation workbooks using the format of the TI data.
• New Alert logic app and workbook, downloading alerts from Recorded Future into custom log and visualizing the result.
• New "PlaybookAlert" logic app and workbook, pulling playbookalerts from Recorded Future to a custom log and visualizing the result.
• Render incident comments serverside for entity enrichment.
• Solution versioning, tagging and changelog improvements.
• Readme updates

Reason for Changes:

• Deprication of GraphAPI for ingesting Threat Intelligence.
• New Alert and PlaybookAlert integration.

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes

Please contact us if you have questions or want to set up a meeting where we talk through the changes.

[v-prasadboke]

We wanted to check on the status of PR #8473. PR is pending for more than 30 days. Please let us know if you need any assistance to review this PR. Per our standard operating procedures if no response is received in the next 7 business days, we will close this PR. Thank you for your cooperation.

[RecordedFutureOskbo]

We wanted to check on the status of PR #8473. PR is pending for more than 30 days. Please let us know if you need any assistance to review this PR. Per our standard operating procedures if no response is received in the next 7 business days, we will close this PR. Thank you for your cooperation.

We have been waiting for our Power Platform Connector to be certified and rolled out before activating this PR. Good news is that it's released since last week. We are doing final testing and will activate this PR within days.

[RecordedFutureOskbo]

@v-prasadboke we are ready for review finally.

[v-prasadboke]

Hello @RecordedFutureOskbo, Thank you for marking this PR as ready for review. This PR will be investigated and will update you about the same before 19 September, 2023. Till Then please repackage the solution using V3 tool. You can refer this readme for more clarification.
https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.md
Thanks.

[RecordedFutureOskbo]

I did a merge with master yesterday and did used the V3 tool for packaging the solution.

[v-prasadboke]

Hello @RecordedFutureOskbo, Please update the branch from master.

[RecordedFutureOskbo]

@v-prasadboke I need help!
After I updated the version in the Solution_RecordedFuture.json to 3.0.0 I get validation errors that I have a hard time to track back to my ARM files.

My current ARM files works when I run them in [Deploy custom template] and the same files validated in previous versions.

[v-prasadboke]

Hello @RecordedFutureOskbo, Is there any other except this

[v-prasadboke]

Thank you @RecordedFutureOskbo, For adding the sample data. I'll test the content and update you about the same before 22 September, 2023.

[RecordedFutureOskbo]

I see the Azure.Sentinel test is failing on "RecordedFutureURLCorrelationWhite.png" but the file is in the PR if I'm not mistaken.

[v-prasadboke]

Hello @RecordedFutureOskbo, Please rename the underlined text to
"RecordedFutureUrlCorrelationWhite.png"
"RecordedFutureUrlCorrelationBlack.png"

[v-prasadboke]

Hello @RecordedFutureOskbo, Can you provide me access to your branch.
Thanks.

[v-prasadboke]

Hello @RecordedFutureOskbo, Sorry for the inconvenience. This PR is still under investigation and will update you before 26 September, 2023.

[v-prasadboke]

Hello @RecordedFutureOskbo, We have uploaded the sample data to test the content of the solution. Will review the content and update you before 29 September, 2023.

[v-prasadboke]

Hello @RecordedFutureOskbo, Deployment is failing for Recorded Future Alert Importer playbook.

[RecordedFutureOskbo]

Hello @RecordedFutureOskbo, Deployment is failing for Recorded Future Alert Importer playbook.

Thanks, found and fixed.

[v-atulyadav]

Hi @RecordedFutureOskbo, validations are stuck could you please take latest of master into your branch. Thanks

[v-atulyadav]

Thanks @RecordedFutureOskbo.

[v-prasadboke]

Thank you @RecordedFutureOskbo for committing the requested changes.
Will take a look at it and update you about the same before 09 October, 2023.

[RecordedFutureOskbo]

@v-prasadboke I don't mind going on a teams call in order to get progression on this PR.

[v-prasadboke]

Hello @RecordedFutureOskbo Can you please tell me your time zone and availability as per the same.
I work in IST time zone and I'm available tomorrow from 4:30 PM IST onwards.
Also can you please provide me your branch access. I'm unable to pull all the latest changes.
Thanks.

[RecordedFutureOskbo]

c

I'm in Europe CET and will make time for you if you set up a call.

[v-prasadboke]

Hello @RecordedFutureOskbo, I've setup a call for 4:30 PM IST which is 1:00 PM in CET.
Joining link: https://teams.microsoft.com/l/meetup-join/19%3ameeting_NDU3ZGZhZTEtM2FiZi00ODY5LTk3YjctYzk5Njc0ZGI4NDBl%40thread.v2/0?context=%7b%22Tid%22%3a%2272f988bf-86f1-41af-91ab-2d7cd011db47%22%2c%22Oid%22%3a%2228263f0a-981b-4a56-a4c9-1e91e9ea44fb%22%7d

[v-prasadboke]

https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/BloodHound%20Enterprise/Package/createUiDefinition.json

Adding release note hyperlink to createui

[v-prasadboke]

Screenshot received