Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Initial Branch from old Closed PR #7696 #8603

Merged
merged 13 commits into from
Nov 2, 2023
Merged

Initial Branch from old Closed PR #7696 #8603

merged 13 commits into from
Nov 2, 2023

Conversation

sriley0975
Copy link
Contributor

This is the NEW AUHOMIZE Solution
Files modified:
modified: .script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json
modified: Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json
Files added:
.script/tests/KqlvalidationsTests/CustomTables/Authomize_v2_CL.json
Logos/Authomize.svg
Sample Data/Authomize_v2_CL.csv
Solutions/Authomize/Analytic Rules/
Solutions/Authomize/Data Connectors/
Solutions/Authomize/Data/
Solutions/Authomize/Hunting queries/
Solutions/Authomize/Package/
Solutions/Authomize/SolutionMetadata.json
Solutions/Authomize/Workbooks/
Workbooks/Images/Logos/authomize.svg

Required items, please complete

Change(s):

  • See guidance below

Reason for Change(s):

  • See guidance below

Version Updated:

  • Required only for Detections/Analytic Rule templates
  • See guidance below

Testing Completed:

  • See guidance below

Checked that the validations are passing and have addressed any issues that are present:

  • See guidance below

Guidance <- remove section before submitting

Before submitting this PR please ensure that you have read the following sections and filled out the changes, reason for change and testing complete sections:

Thank you for your contribution to the Microsoft Sentinel Github repo.

Details of the code changes in your submitted PR. Providing descriptions for pull requests ensures there is context to changes being made and greatly enhances the code review process. Providing associated Issues that this resolves also easily connects the reason.

Change(s):

  • Updated syntax for XYZ.yaml

Reason for Change(s):

Version updated:

  • Yes
  • Detections/Analytic Rule templates are required to have the version updated

The code should have been tested in a Microsoft Sentinel environment that does not have any custom parsers, functions or tables, so that you validate no incorrect syntax and execution functions properly. If your submission requires a custom parser or function, it must be submitted with the PR.

Testing Completed:

  • Yes/No/Need Help

Note: If updating a detection, you must update the version field.

Before the submission has been made, please look at running the KQL and Yaml Validation Checks locally.
https://github.com/Azure/Azure-Sentinel#run-kql-validation-locally

Checked that the validations are passing and have addressed any issues that are present:

  • Yes/No/Need Help

Note: Let us know if you have tried fixing the validation error and need help.

References:

@sriley0975
Initial Branch from old Closed PR Azure#7696
e9cc14d 
This is the NEW AUHOMIZE Solution
Files modified:
	modified:   .script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json
	modified:   Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json
Files added:
	.script/tests/KqlvalidationsTests/CustomTables/Authomize_v2_CL.json
	Logos/Authomize.svg
	Sample Data/Authomize_v2_CL.csv
	Solutions/Authomize/Analytic Rules/
	Solutions/Authomize/Data Connectors/
	Solutions/Authomize/Data/
	Solutions/Authomize/Hunting queries/
	Solutions/Authomize/Package/
	Solutions/Authomize/SolutionMetadata.json
	Solutions/Authomize/Workbooks/
	Workbooks/Images/Logos/authomize.svg
@sriley0975 sriley0975 requested review from a team as code owners July 21, 2023 22:40
@sriley0975
Copy link
Contributor Author

This is a continuation of work from the original - We closed out PR @7696 to remove files that should not have been modified and were missed -
NOTE: Created initial Data Connector Azure Function - testing right now - will update the Data Connector components as needed.

@sriley0975
Copy link
Contributor Author

@v-atulyadav Hi - this is the new updated content - I copied the original and updated a new branch with details. Working the data connector for verification of tests this weekend. Let me know if you find anything in this initial.

@v-atulyadav v-atulyadav added the Solution Solution specialty review needed label Jul 24, 2023
@v-atulyadav
Copy link
Contributor

Hi @sriley0975,

As per latest guidelines issued by Microsoft Sentinel, please repackage the solution using V3 tool Please go through this readme file on how to use the V3 tool https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.md

And we need to add ReleaseNotes file for solution.Please refer below link for how to create ReleaseNotes.
https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ReleaseNotesGuidance.md

Thanks

@sriley0975
Copy link
Contributor Author

OK - understood - will look at t he new V3 guidance and repackage solution.

@v-atulyadav
Copy link
Contributor

OK - understood - will look at t he new V3 guidance and repackage solution.

Thanks @sriley0975.

@sriley0975
Release Notes added and V3 Package re-run
01ee156 
Added the release notes as requested.
Ran the new /Tools/Create-Azure-Sentinel-Solution/V3/createSolutionV3.ps1

NOTE: will be adding a readme.md in data connector to detail how to deploy and configur.
@sriley0975
Copy link
Contributor Author

Doing a walkthrough of app function to update readme.md with final install instructions. Expect to have that done today. I will also supply a deployment ARM file (not sure if this is required).

@v-atulyadav
Copy link
Contributor

Hi @sriley0975,
Thanks for packaging this solution with v3. We need to rectify below mentioned points.

  1. Release Note file
  • Version should be 3.0.0 instead of 1.0.0
  • Date format of Date Modified column is DD-MM-YYYY
image
  1. Please revert 2.0.0 commit as we need only 3.0.0.
image
  1. Please remove older version from 3.0.0 zip.
image
  1. Data connector validation failure.
  • In AuthomizeCustomConnector.json file you have mentioned link for readme file but in this solution readme file was not attached please include this file.
image
  1. Solution validation failure
  • PublisherId should be in lowercase so please change this in SolutionMetadata.json and repackage the solution again
image

@sriley0975
Copy link
Contributor Author

Got it - working this today. Cheers

@v-atulyadav
Copy link
Contributor

Hi @sriley0975, hope you are doing well. Just wanted to check if you got a chance to look at the suggestions shared. Please feel free to reach out to us for any queries and/or support. Thanks

@sriley0975
Copy link
Contributor Author

Hi @v-atulyadav sorry for the delay - found an issue with my app when doing the readme.md file - The current readme.md needed some heavy lifting to make it easier for customer to install function app. I'm new to function apps so it has been a bit of a learning curve as I try and make it work correctly on my test environment.

I'm currently on vacation, but I did make all the other suggested changes which I can submit if you want to start reviewing those. Let me know if you want me to do that? Meanwhile I have to work on the final piece at thee end of this week when I come back from my holidays. I should have something for you over this coming weekend.

Let me know if you want me to release to you what I have current done and then send you the latest on the data connector and readme.md file this weekend or wait until I have finished everything and release.

@v-atulyadav
Copy link
Contributor

Hi @sriley0975,
It will be easier for us to review all of the changes if you commit them in one go.
Thanks

@sriley0975
Copy link
Contributor Author

sriley0975 commented Aug 1, 2023 via email

@v-atulyadav
Copy link
Contributor

Hi @sriley0975,
I would appreciate if you could let us know once you've completed the suggested changes and also checked for conflicts in the branch.
Thanks

@sriley0975
Copy link
Contributor Author

sriley0975 commented Aug 9, 2023 via email

@v-atulyadav
Copy link
Contributor

Noted @sriley0975. Thanks

@v-atulyadav
Copy link
Contributor

Hi @sriley0975, waiting for your response. Thanks

@sriley0975
Copy link
Contributor Author

sriley0975 commented Aug 16, 2023 via email

@v-atulyadav
Copy link
Contributor

Thanks @sriley0975.

@v-atulyadav
Copy link
Contributor

Hi @sriley0975,
Please inform us once you've completed the suggested changes and checked for conflicts in the branch. Thanks

@sriley0975
Copy link
Contributor Author

sriley0975 commented Aug 22, 2023 via email

@v-atulyadav
Copy link
Contributor

Noted @sriley0975, thanks.

@v-atulyadav
Copy link
Contributor

Hi @sriley0975.
To follow up appropriately, we would appreciate some indication of the timeframe for these changes. Thanks

@sriley0975
Copy link
Contributor Author

sriley0975 commented Oct 16, 2023 via email

@sriley0975
Copy link
Contributor Author

sriley0975 commented Oct 17, 2023 via email

@sriley0975
Copy link
Contributor Author

Updated with new AuthomizeCustomConnector

@v-atulyadav
Copy link
Contributor

Hi @sriley0975, we are still getting connector validation failures.
The data connector permission block has been modified. Please replace the attached connector (extract the zip file for the connector file).
AuthomizeCustomConnector.zip

And also could you please grant me the access for your branch so I can push few commits. Thanks

@sriley0975
Copy link
Contributor Author

sriley0975 commented Oct 18, 2023 via email

@v-atulyadav
Copy link
Contributor

Thanks @sriley0975.

@sriley0975 sriley0975 force-pushed the Authomize-Solution-v2 branch from d015f38 to e293e94 Compare October 18, 2023 13:53
@v-atulyadav v-atulyadav force-pushed the Authomize-Solution-v2 branch from fb02269 to f2baaed Compare October 23, 2023 06:41
@v-atulyadav
Copy link
Contributor

v-atulyadav commented Nov 2, 2023 •
edited
Loading

Hi @sriley0975,
The solution has been tested and all failed validations have been cleared. Please attach here screenshots of the running connector so we can proceed with merging. Thanks

@v-atulyadav v-atulyadav force-pushed the Authomize-Solution-v2 branch from 23140a1 to dd3afee Compare November 2, 2023 10:28
@v-atulyadav
Copy link
Contributor

AuthomizeConnector

@v-atulyadav v-atulyadav force-pushed the Authomize-Solution-v2 branch from c47de78 to c6baebe Compare November 2, 2023 14:36
v-atulyadav
v-atulyadav previously approved these changes Nov 2, 2023
View reviewed changes
@v-atulyadav v-atulyadav force-pushed the Authomize-Solution-v2 branch from 353291a to cf26ebe Compare November 2, 2023 15:21
@v-atulyadav v-atulyadav merged commit fa78ae1 into Azure:master Nov 2, 2023
31 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@v-atulyadav v-atulyadav v-atulyadav approved these changes

Assignees

@vakohl vakohl

@v-atulyadav v-atulyadav

Labels
Solution Solution specialty review needed
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@sriley0975 @v-atulyadav @vakohl