Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ZeroFox Solution #8661

Merged
merged 25 commits into from
Sep 18, 2023
+6,073 −0
Merged

ZeroFox Solution #8661

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
25 commits
Select commit Hold shift + click to select a range
422ac63
Add ZeroFox data connector
figarrido Jul 21, 2023
9da3e33
Add data connectors for ZeroFox CTI
DNRRomero Jul 24, 2023
fe4b5ae
Add configuration json file for CTI connector
DNRRomero Jul 25, 2023
238284b
Organize data connectors and include configuration file for azure fun…
DNRRomero Jul 27, 2023
d1889c7
Add solution Metadata
DNRRomero Jul 28, 2023
5ed4294
Add Azure-Sentinel CI fix (#20)
DNRRomero Jul 31, 2023
45902b1
Add unique ids to analytic rules
figarrido Aug 1, 2023
97ba40d
Fix code issues in CTI connectors
DNRRomero Aug 1, 2023
29bd2ae
Fix ZeroFox's logo formattin
DNRRomero Aug 1, 2023
ffe6939
Add connector id and alert table schema
figarrido Aug 1, 2023
5793b05
Fix typo in alerts schema
figarrido Aug 1, 2023
9792965
Fix custom table scheme duplicate
DNRRomero Aug 2, 2023
9764fa0
Merge branch 'master' into master
DNRRomero Aug 2, 2023
4ff3137
Fix typo related to email addresses connector
DNRRomero Aug 2, 2023
e16ebd0
Add release files
DNRRomero Aug 4, 2023
2059213
Add PR comments regarding Azure's KqlValidations
DNRRomero Aug 11, 2023
2f8b63e
Add comma tu validConnectorIds file
DNRRomero Aug 18, 2023
7747494
Attempt at fixing the mainTemplate file
DNRRomero Aug 18, 2023
4bb0c13
Fix formatting in mainTemplate file according to arm-ttk guidelines
DNRRomero Aug 21, 2023
20df511
Repackage solution by running solutionPackagerV3 and fix arm-template
DNRRomero Aug 25, 2023
8b02186
Fix description in uiDefinition.json file
DNRRomero Aug 25, 2023
219bec7
Fix CTI connector filename in Data packaging file (#41)
DNRRomero Aug 30, 2023
5c154a4
Add required tactics and techniques (#42)
figarrido Sep 5, 2023
42a18d3
Repackage solution to include analytic rules tactics (#43)
DNRRomero Sep 5, 2023
9103a2e
Merge branch 'master' into master
DNRRomero Sep 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
205 changes: 205 additions & 0 deletions .script/tests/KqlvalidationsTests/CustomTables/ZeroFoxAlertPoller_CL.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,205 @@
{
"Name": "ZeroFoxAlertPoller_CL",
"Properties": [
{
"Name": "TimeGenerated",
"Type": "DateTime"
},
{
"Name": "alert_type_s",
"Type": "String"
},
{
"Name": "logs_s",
"Type": "String"
},
{
"Name": "offending_content_url_s",
"Type": "String"
},
{
"Name": "asset_term_s",
"Type": "String"
},
{
"Name": "assignee_s",
"Type": "String"
},
{
"Name": "entity_id_d",
"Type": "Double"
},
{
"Name": "entity_name_s",
"Type": "String"
},
{
"Name": "entity_image_s",
"Type": "String"
},
{
"Name": "entity_labels_s",
"Type": "String"
},
{
"Name": "entity_entity_group_id_d",
"Type": "Double"
},
{
"Name": "entity_entity_group_name_s",
"Type": "String"
},
{
"Name": "entity_term_s",
"Type": "String"
},
{
"Name": "content_created_at_t",
"Type": "DateTime"
},
{
"Name": "id_d",
"Type": "Double"
},
{
"Name": "Severity",
"Type": "Double"
},
{
"Name": "perpetrator_name_s",
"Type": "String"
},
{
"Name": "perpetrator_display_name_s",
"Type": "String"
},
{
"Name": "perpetrator_id_d",
"Type": "Double"
},
{
"Name": "perpetrator_url_s",
"Type": "String"
},
{
"Name": "perpetrator_content_s",
"Type": "String"
},
{
"Name": "perpetrator_type_s",
"Type": "String"
},
{
"Name": "perpetrator_timestamp_t",
"Type": "DateTime"
},
{
"Name": "perpetrator_network_s",
"Type": "String"
},
{
"Name": "rule_group_id_d",
"Type": "Double"
},
{
"Name": "asset_id_d",
"Type": "Double"
},
{
"Name": "asset_name_s",
"Type": "String"
},
{
"Name": "asset_image_s",
"Type": "String"
},
{
"Name": "asset_labels_s",
"Type": "String"
},
{
"Name": "asset_entity_group_id_d",
"Type": "Double"
},
{
"Name": "asset_entity_group_name_s",
"Type": "String"
},
{
"Name": "entered_by_s",
"Type": "String"
},
{
"Name": "metadata_s",
"Type": "String"
},
{
"Name": "status_s",
"Type": "String"
},
{
"Name": "timestamp_t",
"Type": "DateTime"
},
{
"Name": "rule_name_s",
"Type": "String"
},
{
"Name": "last_modified_t",
"Type": "DateTime"
},
{
"Name": "protected_locations_s",
"Type": "String"
},
{
"Name": "darkweb_term_s",
"Type": "String"
},
{
"Name": "business_network_s",
"Type": "String"
},
{
"Name": "reviewed_b",
"Type": "Boolean"
},
{
"Name": "escalated_b",
"Type": "Boolean"
},
{
"Name": "network_s",
"Type": "String"
},
{
"Name": "protected_social_object_s",
"Type": "String"
},
{
"Name": "notes_s",
"Type": "String"
},
{
"Name": "reviews_s",
"Type": "String"
},
{
"Name": "rule_id_d",
"Type": "Double"
},
{
"Name": "entity_account_s",
"Type": "String"
},
{
"Name": "entity_email_receiver_id_s",
"Type": "String"
},
{
"Name": "tags_s",
"Type": "String"
}
]
}
33 changes: 33 additions & 0 deletions .script/tests/KqlvalidationsTests/CustomTables/ZeroFox_CTI_C2_CL.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
{
"Name": "ZeroFox_CTI_C2_CL",
"Properties": [
{
"Name": "TimeGenerated",
"Type": "DateTime"
},
{
"Name": "domain_s",
"Type": "String"
},
{
"Name": "port_d",
"Type": "Double"
},
{
"Name": "tags_s",
"Type": "String"
},
{
"Name": "ip_addresses_s",
"Type": "String"
},
{
"Name": "updated_at_t",
"Type": "DateTime"
},
{
"Name": "created_at_t",
"Type": "DateTime"
}
]
}
78 changes: 78 additions & 0 deletions .script/tests/KqlvalidationsTests/CustomTables/ZeroFox_CTI_advanced_dark_web_CL.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,78 @@
{
"Name": "ZeroFox_CTI_advanced_dark_web_CL",
"Properties": [
{
"Name": "TimeGenerated",
"Type": "DateTime"
},
{
"Name": "id_d",
"Type": "Double"
},
{
"Name": "created_at_t",
"Type": "DateTime"
},
{
"Name": "title_s",
"Type": "String"
},
{
"Name": "confidence_s",
"Type": "String"
},
{
"Name": "reliability_s",
"Type": "String"
},
{
"Name": "tlp",
"Type": "String"
},
{
"Name": "contents_s",
"Type": "String"
},
{
"Name": "comments_s",
"Type": "String"
},
{
"Name": "threat_types_s",
"Type": "String"
},
{
"Name": "target_targets_s",
"Type": "String"
},
{
"Name": "target_regions_s",
"Type": "String"
},
{
"Name": "target_industries_s",
"Type": "String"
},
{
"Name": "languages_s",
"Type": "String"
},
{
"Name": "actors_s",
"Type": "String"
},
{
"Name": "tags_s",
"Type": "String"
}
,
{
"Name": "source_urls_s",
"Type": "String"
},
{
"Name": "source_names_s",
"Type": "String"
}
]
}
Loading
Loading