ZeroFox Solution #8661

DNRRomero · 2023-07-28T16:22:46Z

Required items, please complete

Change(s):

Add ZeroFox Data connectors into the ZeroFox API and CTI feeds as Solutions

Reason for Change(s):

Provides an Integration of Sentinel with ZeroFox by way of a marketplace solution

Testing Completed:

Yes

Checked that the validations are passing and have addressed any issues that are present:

Need help

It also adds analytic rules to map ZeroFox alerts to Microsoft Sentinel Incidents based on severity.

Adds all ZeroFox connectors to CTI feeds by way of Azure Functions, as per task ZFE-73125

Adds configuration info for CTI connectors according to ZF-73126

…ctions * Add configuration file ZeroFox_CTI_FunctionApp.json for azure functions * Add unit test for ZeroFox Client * Move Data Connectors from connectors folder According to task ZFE-73126

Add Data folder and solution metadata file as per task ZF-7126

DNRRomero · 2023-07-28T16:38:43Z

@microsoft-github-policy-service agree company="ZeroFox"

Solutions/ZeroFox/Data Connectors/CTI/advanced_dark_web_connector/__init__.py

Solutions/ZeroFox/Data Connectors/CTI/botnet_compromised_credentials_connector/__init__.py

Solutions/ZeroFox/Data Connectors/CTI/credit_cards_connector/__init__.py

Solutions/ZeroFox/Data Connectors/CTI/connections/zerofox.py

* Add fixes shown by Azure's CI pipeline * Add custom log schemas for CTI data connectors * Add custom table specifications for CTI tables Table description specifications added: - Identity breach - IRC - Malware - National IDs - Phishing - Phone Numbers - Ransomware - Telegram - Threat Actors - Vulnerabilities * Fix comments * Fix types on custom tables schemas --------- Co-authored-by: Diego Ramirez <dramirez@zerofox.com> Co-authored-by: Felipe Garrido <fgarridob.95+github@gmail.com>

v-rbajaj · 2023-08-01T09:35:34Z

Hi @DNRRomero, thanks for raising this PR, we will review and provide an update by 4 Aug 2023

v-rbajaj · 2023-08-04T11:33:41Z

Hi @DNRRomero,
Please add the missing files in data connector folder according to these files
https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Bitglass/Data%20Connectors

For example: the zip file, azuredeploy file, host file, requirements etc are missing, please add them.

Then package the solution using this tool https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Create-Azure-Sentinel-Solution/V3
Please go through the readme.md file and follow the instructions mentioned there.

Please do add release note as well, follow below mentioned link for the same.
https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ReleaseNotesGuidance.md

Add release notes, versioning files in Package folder, as well as template fails from ARM toolkit

DNRRomero · 2023-08-04T19:28:45Z

Hi @v-rbajaj , we added the missing files, which where the release notes and package folder. As for the rest you mentioned, they are located in the CTI subfolder of Data Connectors.
Also, could you help us with the CI pipeline errors? the KqlValidations step is throwing an error which we have not been able to identify and it would be great to hear what you think on it

v-rbajaj · 2023-08-07T13:34:16Z

Hi @DNRRomero, we are checking the KQL validation failure, we will provide you an update by 9 Aug 2023

Solutions/ZeroFox/ReleaseNotes.md

Solutions/ZeroFox/Data/Solution_ZeroFox.json

v-rbajaj · 2023-08-09T13:55:54Z

We are still checking on the KQL validation failure, will update you by 11 Aug 2023

v-rbajaj · 2023-08-11T13:46:27Z

Hi @DNRRomero, Please add these two lines in properties of .script/tests/KqlvalidationsTests/CustomTables/ZeroFox_CTI_national_ids_CL.json


"name": "TimeGenerated",
"type": "DateTime"

v-atulyadav · 2023-08-14T09:57:10Z

Hi @DNRRomero,
Thank you for accommodating the suggested changes! We will review the Pull Request and get back to you by 16 Aug 2023.

v-rbajaj · 2023-08-16T18:41:34Z

Hi @DNRRomero, we are investigating on both the failures, sorry for the delay, will get back to you by 18 Aug 2023.

.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json

DNRRomero · 2023-08-18T16:47:39Z

@v-rbajaj I always able to fix the pipeline, there was a problem in the mainTemplaje.json file

v-rbajaj · 2023-08-21T10:35:41Z

Hi @DNRRomero, we will check the ARM TTK validation and provide you an update by 23 Aug 2023

DNRRomero · 2023-08-21T17:32:56Z

Hello @v-rbajaj I fixed the arm-ttk validation step

Solutions/ZeroFox/Package/createUiDefinition.json

v-rbajaj · 2023-08-22T13:35:36Z

Hi @DNRRomero,I also deployed maintemplate, but for some reason the contents are not visible, need to check on this issue, will get back by 24 Aug 2023.

v-rbajaj · 2023-08-24T12:38:20Z

Hi @DNRRomero, seems like the maintemplate does not have any contents like Data connectors, analytical rules. Request you repackage the solution and push the changes.

If ARM ttk validation fails, we will take care of it.

Please make the suggested changes.

DNRRomero · 2023-08-25T15:19:20Z

Hello @v-rbajaj I repackaged the solution and fixed the arm-ttk validation

v-rbajaj · 2023-08-28T14:17:43Z

Hi @DNRRomero, thanks for making these changes, I can now see the contents post deployment of maintemplate.

I am ingesting data to check and verify the contents. Ill get back to you by 30 Aug 2023.

v-rbajaj · 2023-08-30T12:52:56Z

Solutions/ZeroFox/Data/Solution_ZeroFox.json

+    "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/foxy-mark.svg\" width=\"75px\" height=\"75px\">",
+    "Description": "The [ZeroFox](https://www.zerofox.com/) solution for Microsoft Sentinel enables you to ingest [ZeroFox Alerts](https://www.zerofox.com/platform/) and [ZeroFox CTI events]](https://www.zerofox.com/threat-intelligence/) into Microsoft Sentinel using the ZeroFox API. \n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\nb. [Azure Functions](https://azure.microsoft.com/services/functions/#overview)",
+    "Data Connectors": [
+      "Data Connectors/CTI/ZeroFox_API_FunctionApp.json",


This file ZeroFox_API_FunctionApp.json doesn't exist in this folder.

I think you were trying to refer ZeroFox_CTI_FunctionApp.json, if yes, then please update the name here and repackage the solution.

Hi @v-rbajaj , the file has been fixed, and the solution repackaged

Co-authored-by: Diego Ramirez <dramirez@zerofox.com>

v-rbajaj · 2023-09-01T10:21:13Z

Hi @DNRRomero, all the analytical rules are missing tactics and relevanttechniques, please add them.

Refer : - https://github.com/Azure/Azure-Sentinel/wiki/Query-Style-Guide#tactics

We would need to repackage the solution.

v-rbajaj · 2023-09-05T06:38:35Z

Hi @DNRRomero, can you please provide some update on the above comment?

Co-authored-by: Diego Ramirez <dramirez@zerofox.com>

DNRRomero · 2023-09-05T14:51:25Z

Hello @v-rbajaj , I have just added the changes you requested, could you take a look?

v-rbajaj · 2023-09-07T08:00:45Z

Hi @DNRRomero, you would need to update this branch from master for the validations to run.

DNRRomero · 2023-09-07T13:16:23Z

Hi @v-rbajaj , I updated the branch with respect to master

v-rbajaj · 2023-09-12T18:41:28Z

Hi @DNRRomero, we will provide you an update by 15 Sep 2023.

figarrido and others added 5 commits July 24, 2023 12:22

Add ZeroFox data connector

422ac63

It also adds analytic rules to map ZeroFox alerts to Microsoft Sentinel Incidents based on severity.

Add data connectors for ZeroFox CTI

9da3e33

Adds all ZeroFox connectors to CTI feeds by way of Azure Functions, as per task ZFE-73125

Add configuration json file for CTI connector

fe4b5ae

Adds configuration info for CTI connectors according to ZF-73126

Organize data connectors and include configuration file for azure fun…

238284b

…ctions * Add configuration file ZeroFox_CTI_FunctionApp.json for azure functions * Add unit test for ZeroFox Client * Move Data Connectors from connectors folder According to task ZFE-73126

Add solution Metadata

d1889c7

Add Data folder and solution metadata file as per task ZF-7126

DNRRomero requested review from a team as code owners July 28, 2023 16:22

v-atulyadav assigned v-rbajaj Jul 31, 2023

v-atulyadav added the Solution Solution specialty review needed label Jul 31, 2023

github-advanced-security bot found potential problems Jul 31, 2023

View reviewed changes

figarrido and others added 8 commits August 1, 2023 11:05

Add unique ids to analytic rules

45902b1

Fix code issues in CTI connectors

97ba40d

Fix ZeroFox's logo formattin

29bd2ae

Add connector id and alert table schema

ffe6939

Fix typo in alerts schema

5793b05

Fix custom table scheme duplicate

9792965

Merge branch 'master' into master

9764fa0

Fix typo related to email addresses connector

4ff3137

Add release files

e16ebd0

Add release notes, versioning files in Package folder, as well as template fails from ARM toolkit

v-rbajaj reviewed Aug 9, 2023

View reviewed changes

Solutions/ZeroFox/ReleaseNotes.md Outdated Show resolved Hide resolved

v-rbajaj reviewed Aug 9, 2023

View reviewed changes

Solutions/ZeroFox/Data/Solution_ZeroFox.json Outdated Show resolved Hide resolved

v-rbajaj reviewed Aug 18, 2023

View reviewed changes

.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json Outdated Show resolved Hide resolved

DNRRomero added 2 commits August 18, 2023 10:08

Add comma tu validConnectorIds file

2f8b63e

Attempt at fixing the mainTemplate file

7747494

Fix formatting in mainTemplate file according to arm-ttk guidelines

4bb0c13

v-rbajaj reviewed Aug 22, 2023

View reviewed changes

Solutions/ZeroFox/Package/createUiDefinition.json Outdated Show resolved Hide resolved

Repackage solution by running solutionPackagerV3 and fix arm-template

20df511

Fix description in uiDefinition.json file

8b02186

v-rbajaj reviewed Aug 30, 2023

View reviewed changes

Fix CTI connector filename in Data packaging file (#41)

219bec7

Co-authored-by: Diego Ramirez <dramirez@zerofox.com>

figarrido and others added 2 commits September 5, 2023 10:36

Add required tactics and techniques (#42)

5c154a4

Repackage solution to include analytic rules tactics (#43)

42a18d3

Co-authored-by: Diego Ramirez <dramirez@zerofox.com>

Merge branch 'master' into master

9103a2e

v-rbajaj approved these changes Sep 18, 2023

View reviewed changes

v-atulyadav approved these changes Sep 18, 2023

View reviewed changes

v-atulyadav merged commit da97c45 into Azure:master Sep 18, 2023
31 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ZeroFox Solution #8661

ZeroFox Solution #8661

DNRRomero commented Jul 28, 2023

DNRRomero commented Jul 28, 2023

v-rbajaj commented Aug 1, 2023

v-rbajaj commented Aug 4, 2023

DNRRomero commented Aug 4, 2023

v-rbajaj commented Aug 7, 2023

v-rbajaj commented Aug 9, 2023

v-rbajaj commented Aug 11, 2023

v-atulyadav commented Aug 14, 2023

v-rbajaj commented Aug 16, 2023

DNRRomero commented Aug 18, 2023

v-rbajaj commented Aug 21, 2023

DNRRomero commented Aug 21, 2023

v-rbajaj commented Aug 22, 2023 •

edited

Loading

v-rbajaj commented Aug 24, 2023

DNRRomero commented Aug 25, 2023

v-rbajaj commented Aug 28, 2023

v-rbajaj Aug 30, 2023

DNRRomero Aug 30, 2023

v-rbajaj commented Sep 1, 2023

v-rbajaj commented Sep 5, 2023

DNRRomero commented Sep 5, 2023

v-rbajaj commented Sep 7, 2023

DNRRomero commented Sep 7, 2023

v-rbajaj commented Sep 12, 2023

ZeroFox Solution #8661

ZeroFox Solution #8661

Conversation

DNRRomero commented Jul 28, 2023

DNRRomero commented Jul 28, 2023

v-rbajaj commented Aug 1, 2023

v-rbajaj commented Aug 4, 2023

DNRRomero commented Aug 4, 2023

v-rbajaj commented Aug 7, 2023

v-rbajaj commented Aug 9, 2023

v-rbajaj commented Aug 11, 2023

v-atulyadav commented Aug 14, 2023

v-rbajaj commented Aug 16, 2023

DNRRomero commented Aug 18, 2023

v-rbajaj commented Aug 21, 2023

DNRRomero commented Aug 21, 2023

v-rbajaj commented Aug 22, 2023 • edited Loading

v-rbajaj commented Aug 24, 2023

DNRRomero commented Aug 25, 2023

v-rbajaj commented Aug 28, 2023

v-rbajaj Aug 30, 2023

Choose a reason for hiding this comment

DNRRomero Aug 30, 2023

Choose a reason for hiding this comment

v-rbajaj commented Sep 1, 2023

v-rbajaj commented Sep 5, 2023

DNRRomero commented Sep 5, 2023

v-rbajaj commented Sep 7, 2023

DNRRomero commented Sep 7, 2023

v-rbajaj commented Sep 12, 2023

v-rbajaj commented Aug 22, 2023 •

edited

Loading