HYAS Protect Initial Commit #8804

RamboV · 2023-08-17T14:03:45Z

Required items, please complete

Change(s):

See guidance below

Reason for Change(s):

See guidance below

Version Updated:

Required only for Detections/Analytic Rule templates
See guidance below

Testing Completed:

See guidance below

Checked that the validations are passing and have addressed any issues that are present:

See guidance below

Guidance <- remove section before submitting

Before submitting this PR please ensure that you have read the following sections and filled out the changes, reason for change and testing complete sections:

Thank you for your contribution to the Microsoft Sentinel Github repo.

Details of the code changes in your submitted PR. Providing descriptions for pull requests ensures there is context to changes being made and greatly enhances the code review process. Providing associated Issues that this resolves also easily connects the reason.

Change(s):

Updated syntax for XYZ.yaml

Reason for Change(s):

New schema used for XYZ.yaml
Resolves ISSUE Add Logstash required version to Readme file #1234

Version updated:

Yes
Detections/Analytic Rule templates are required to have the version updated

The code should have been tested in a Microsoft Sentinel environment that does not have any custom parsers, functions or tables, so that you validate no incorrect syntax and execution functions properly. If your submission requires a custom parser or function, it must be submitted with the PR.

Testing Completed:

Yes/No/Need Help

Note: If updating a detection, you must update the version field.

Before the submission has been made, please look at running the KQL and Yaml Validation Checks locally.
https://github.com/Azure/Azure-Sentinel#run-kql-validation-locally

Checked that the validations are passing and have addressed any issues that are present:

Yes/No/Need Help

Note: Let us know if you have tried fixing the validation error and need help.

References:

Guidance for Detection checks

General contribution guidance

PR validation troubleshooting

v-rusraut · 2023-08-18T05:43:31Z

Hi @RamboV,
Thanks for raising PR with us, we will provide you an update by 23 Aug 2023.

v-rusraut · 2023-08-22T13:03:48Z

Hi @RamboV,

Please work on below points:

Please package the solution using V3 tool, please go through this readme file on how to use the V3 tool
https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.md
Add ReleaseNotes file for solution,please refer below link for how to create ReleaseNotes.
https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ReleaseNotesGuidance.md
We need to create parser with yaml file , don't create parser with txt file,use this as reference.
Provide sample data for table HYASProtectDnsSecurityLogs_CL , we need sample data for testing parser.

Thanks

v-rusraut · 2023-08-25T06:12:08Z

Hi @RamboV,

Before repackaging the solution, please resolve below validation erros:

Below hyperlink is present in HYASProtect_FunctionApp.json file, it is not working, please correct it
link : https://github.com/moin-loginsoft/HyasProtect/blob/main/Data%20Connectors/HyasProtect.zip?raw=true

There is KqlValidation issue, please refer below screen shots.

To resolve this issue please add table definition of HYASProtectDnsSecurityLogs_CL at below mentioned path.
Path : https://github.com/Azure/Azure-Sentinel/tree/master/.script/tests/KqlvalidationsTests/CustomTables

Thanks

v-rbajaj · 2023-08-29T11:37:59Z

Hi @RamboV, can you please look into the above comment and make the necessary changes?

v-atulyadav · 2023-08-31T07:03:48Z

Hi @RamboV,
We are still waiting for your response to the above. Thanks

v-rbajaj · 2023-09-05T06:34:29Z

Hi @RamboV, can you please provide some update on the above comments?

RamboV · 2023-09-05T10:24:16Z

Hi @v-rbajaj,
We are looking into it and will update you by 7 sep 2023.

v-rbajaj · 2023-09-07T08:36:52Z

Hi @RamboV, Ok thank, waiting for update.

v-atulyadav · 2023-09-11T06:47:46Z

Hi @RamboV,
We look forward to hearing from you once your updates are complete. Thanks

v-rbajaj · 2023-09-13T12:50:47Z

Hi @RamboV, please provide some update on this PR.

v-rbajaj · 2023-09-15T08:37:59Z

Hi @RamboV, request you to please provide some update on this PR.

v-rbajaj · 2023-09-19T12:46:07Z

Hi @RamboV, please provide update on this PR.

v-atulyadav · 2023-09-21T09:25:59Z

Hi @RamboV, hope you are doing well. Just wanted to check if you got a chance to look at the suggestions shared. Please feel free to reach out to us for any queries and/or support. Thanks

v-rbajaj · 2023-09-25T09:57:22Z

Hi @RamboV, please provide update on this PR.

v-rbajaj · 2023-09-27T09:05:13Z

Hi @RamboV, Please move the Logo file to https://github.com/Azure/Azure-Sentinel/tree/master/Logos

RamboV · 2023-09-27T09:24:26Z

Hi @RamboV, Please move the Logo file to https://github.com/Azure/Azure-Sentinel/tree/master/Logos

Hi @v-rbajaj we already have a logo for HYAS we are using the same.

v-rbajaj · 2023-09-27T09:50:07Z

Ok, can you please remove the logo from here Solutions/HYAS Protect/Data Connectors/Logo/Hyas.svg

Hi @RamboV, Please move the Logo file to https://github.com/Azure/Azure-Sentinel/tree/master/Logos

Hi @v-rbajaj we already have a logo for HYAS we are using the same.

RamboV · 2023-09-27T10:00:49Z

Ok, can you please remove the logo from here Solutions/HYAS Protect/Data Connectors/Logo/Hyas.svg

Hi @RamboV, Please move the Logo file to https://github.com/Azure/Azure-Sentinel/tree/master/Logos

Hi @v-rbajaj we already have a logo for HYAS we are using the same.

Hello @v-rbajaj done

v-rbajaj · 2023-09-29T09:51:52Z

Solutions/HYAS Protect/Data/Solution_HyasProtectLogs.json

+{
+    "Name": "HYAS Protect",
+    "Author": "Hyas",
+    "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/blob/master/Logos/Hyas.svg\" width=\"75px\" height=\"75px\">",


Hi @RamboV, please update this link https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Hyas.svg

Then repackage this solution

v-rbajaj · 2023-10-03T12:27:23Z

Solutions/HYAS Protect/Package/mainTemplate.json

+    "_solutionVersion": "3.0.0",
+    "solutionId": "hyas.microsoft-sentinel-solution-hyas-protect",
+    "_solutionId": "[variables('solutionId')]",
+    "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",


Hi @RamboV, please remove this line from maintemplate.json and update this file inside 3.0.0 zip file as well.

v-rbajaj · 2023-10-05T09:31:26Z

Hi @RamboV, please provide some update on the above comment.

v-rbajaj · 2023-10-09T09:25:31Z

Hi @RamboV, please provide some update on the above comment.

RamboV · 2023-10-10T14:57:08Z

Hi @RamboV, please provide some update on the above comment.

Hello @v-rbajaj I have modified accordingly

HYAS Protect Initial Commit

a4f8ed0

RamboV requested review from a team as code owners August 17, 2023 14:03

v-atulyadav assigned v-rusraut Aug 18, 2023

v-atulyadav added the Solution Solution specialty review needed label Aug 18, 2023

v-atulyadav assigned v-rbajaj Aug 29, 2023

RamboV added 8 commits September 26, 2023 16:50

Add files via upload

c0552ec

Delete Solutions/HYAS Protect/Parsers directory

28a6d27

Add files via upload

c97e82e

Add files via upload

383c91e

Delete Solutions/HYAS Protect/Package directory

539ae52

Add files via upload

ad8f01a

Add files via upload

f5cde6b

Update HYASProtect_FunctionApp.json

64034fc

Delete Solutions/HYAS Protect/Data Connectors/Logo directory

30df28f

v-rbajaj reviewed Sep 29, 2023

View reviewed changes

RamboV added 3 commits September 30, 2023 11:59

Delete Solutions/HYAS Protect/Data directory

8fdc590

Delete Solutions/HYAS Protect/Package directory

447beca

Updated Logo Path

b887810

v-rbajaj reviewed Oct 3, 2023

View reviewed changes

RamboV added 2 commits October 10, 2023 20:25

Delete Solutions/HYAS Protect/Package directory

0023b24

removed workspaceResourceId from maintemplate.json

27647ca

v-rbajaj approved these changes Oct 11, 2023

View reviewed changes

v-atulyadav approved these changes Oct 11, 2023

View reviewed changes

v-atulyadav merged commit 7990f3e into Azure:master Oct 11, 2023
29 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

HYAS Protect Initial Commit #8804

HYAS Protect Initial Commit #8804

RamboV commented Aug 17, 2023

v-rusraut commented Aug 18, 2023 •

edited

Loading

v-rusraut commented Aug 22, 2023

v-rusraut commented Aug 25, 2023

v-rbajaj commented Aug 29, 2023

v-atulyadav commented Aug 31, 2023

v-rbajaj commented Sep 5, 2023

RamboV commented Sep 5, 2023

v-rbajaj commented Sep 7, 2023

v-atulyadav commented Sep 11, 2023

v-rbajaj commented Sep 13, 2023

v-rbajaj commented Sep 15, 2023

v-rbajaj commented Sep 19, 2023

v-atulyadav commented Sep 21, 2023

v-rbajaj commented Sep 25, 2023

v-rbajaj commented Sep 27, 2023

RamboV commented Sep 27, 2023

v-rbajaj commented Sep 27, 2023

RamboV commented Sep 27, 2023

v-rbajaj Sep 29, 2023 •

edited

Loading

v-rbajaj Oct 3, 2023

v-rbajaj commented Oct 5, 2023

v-rbajaj commented Oct 9, 2023

RamboV commented Oct 10, 2023

HYAS Protect Initial Commit #8804

HYAS Protect Initial Commit #8804

Conversation

RamboV commented Aug 17, 2023

Guidance <- remove section before submitting

Before submitting this PR please ensure that you have read the following sections and filled out the changes, reason for change and testing complete sections:

v-rusraut commented Aug 18, 2023 • edited Loading

v-rusraut commented Aug 22, 2023

v-rusraut commented Aug 25, 2023

v-rbajaj commented Aug 29, 2023

v-atulyadav commented Aug 31, 2023

v-rbajaj commented Sep 5, 2023

RamboV commented Sep 5, 2023

v-rbajaj commented Sep 7, 2023

v-atulyadav commented Sep 11, 2023

v-rbajaj commented Sep 13, 2023

v-rbajaj commented Sep 15, 2023

v-rbajaj commented Sep 19, 2023

v-atulyadav commented Sep 21, 2023

v-rbajaj commented Sep 25, 2023

v-rbajaj commented Sep 27, 2023

RamboV commented Sep 27, 2023

v-rbajaj commented Sep 27, 2023

RamboV commented Sep 27, 2023

v-rbajaj Sep 29, 2023 • edited Loading

Choose a reason for hiding this comment

v-rbajaj Oct 3, 2023

Choose a reason for hiding this comment

v-rbajaj commented Oct 5, 2023

v-rbajaj commented Oct 9, 2023

RamboV commented Oct 10, 2023

v-rusraut commented Aug 18, 2023 •

edited

Loading

v-rbajaj Sep 29, 2023 •

edited

Loading