Update on GitHub Advanced Security workbook #8862

AlexDeMichieli · 2023-08-22T18:08:30Z

In this PR I am updating the current GitHub Advanced Security workbook.

New features:

Filtering by organizations
Filtering by repository topics

I could not find a way to conditionally render filters (repositories and repo topics). The idea behind these filters is that if repositories are selected, the topics filter should not be enabled, and vice versa. I was able to find a workaround where you have to deselect all repositories in order to activate the repo topics filter, but it's not ideal. Do you have any recommendations on how to improve this functionality?

adding updated version of the GitHub Advanced Security workbook

v-prasadboke · 2023-08-23T06:33:16Z

Hello @AlexDeMichieli, Thank you for raising this PR. This PR will be investigated and will update you by 25 August, 2023.

v-prasadboke · 2023-08-24T12:07:05Z

Hello @AlexDeMichieli, I was trying to test the workbook but I have incomplete sample data.
Can you please share the sample data to the test the workbook, Thanks.

AlexDeMichieli · 2023-08-24T17:31:56Z

Hello @AlexDeMichieli, I was trying to test the playbook but I have incomplete sample data. Can you please share the sample data to the test the workbook, Thanks.

Hi @v-prasadboke ; what test data are you missing? and how can I export test data from Sentinel? thanks!

v-prasadboke · 2023-08-25T05:53:39Z

Hello @AlexDeMichieli, We already have sample data for table githubscanaudit_CL but its incomplete.
Please modify these sample data (

Azure-Sentinel/Sample Data/githubscanaudit_CL.json

Line 4 in 0527617

"action": "reopened",

) as per required results.

Also please share the working images of these workbook.
Thanks,
Prasad Boke.

AlexDeMichieli · 2023-08-28T05:18:53Z

Hi @v-prasadboke, please find below the screenshots of the dashboards

I've included additional data in the document you've shared (here's the link to download it). It should be enough to test the "topics" filter. I left some comments in the JSON file that describe the data:

https://drive.google.com/file/d/1aBrcCORfJnTxO4IrTUIvrfTXxV1l2Z0P/view?usp=sharing

v-prasadboke · 2023-08-28T05:52:27Z

Hello @AlexDeMichieli, Thank you for sharing the sample data and working images of workbook.
Will examine this images and update you about the same before EOD.

v-prasadboke · 2023-08-28T11:50:26Z

Hello @AlexDeMichieli, all looks good. Please resolve the Branch conflicts so this PR can get merged and repackage the solution using V3 tool.
Link to instruction on how to use V3 tool :- https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.md

AlexDeMichieli · 2023-08-28T22:09:15Z

Hi @v-prasadboke , for some reason I cannot solve the merge conflict nor see what areas of the workbook should get fixed. When I pull the master branch into my feature branch, no changes occur. The new file should completely override the previous one.

v-prasadboke · 2023-08-29T12:48:53Z

Hi @v-prasadboke , for some reason I cannot solve the merge conflict nor see what areas of the workbook should get fixed. When I pull the master branch into my feature branch, no changes occur. The new file should completely override the previous one.

Yes that is right, Or what we can do is we can overwrite the older workbook with the new one.
First pull the latest from master and as you see a merge conflict overwrite the older one with new one.
Thanks.

…o alexdemichieli/github-workbook-update-august-2023

AlexDeMichieli · 2023-08-30T00:53:45Z

Hi @v-prasadboke , I'm stuck, sorry! I tried following your steps with no avail. I can't seem to fix the merge conflict. Is there anything you could do on your end? Thanks!

v-prasadboke · 2023-08-30T08:34:35Z

Hello @AlexDeMichieli, I've resolved the merge conflicts. You can proceed with repackaging the solution.
Thank you.

AlexDeMichieli · 2023-08-30T20:46:19Z

Hi @v-prasadboke , thanks for the help! Before moving forward, I wanted to pick your brain on something. Currently, the repository and topics filters are mutually exclusive, but not in a smart way. You'll need to deselect all repositories in order to activate the repo topics filter, but it's not ideal. Do you have any recommendations on how to improve this functionality?

v-prasadboke · 2023-08-31T09:29:24Z

Hello @AlexDeMichieli, We are having a discussion about this. And update you about the same before 04 September, 2023.
Meanwhile you can repackage the solution using V3 tool.
Thanks.

v-prasadboke · 2023-09-04T09:08:54Z

Hi @v-prasadboke , thanks for the help! Before moving forward, I wanted to pick your brain on something. Currently, the repository and topics filters are mutually exclusive, but not in a smart way. You'll need to deselect all repositories in order to activate the repo topics filter, but it's not ideal. Do you have any recommendations on how to improve this functionality?

Hello @AlexDeMichieli, Sorry but for repo and topic I'm seeing only 1 option

v-prasadboke · 2023-09-06T06:16:35Z

Hello @AlexDeMichieli, Hope you are doing well. We just wanted to know if there are any updates on the above requested changes.
Thanks.

AlexDeMichieli · 2023-09-06T17:48:10Z

Hi @v-prasadboke, sorry for the late response.

I'm currently in the process of deploying the solution (i am at the last step of the guide), but I am getting the following error. Do you know what could be causing the issue? ( tried changing all references of 3.0.0 to 3.1.0 but it did not work)

Deployment template validation failed: 'The template resource '/Microsoft.SecurityInsights/-wb-lu5sbrmz6jq6c' for type 'Microsoft.OperationalInsights/workspaces/providers/contentTemplates' at line '266' and column '87' has incorrect segment lengths. A nested resource type must have identical number of segments as its resource name. A root resource type must have segment length one greater than its resource name. Please see https://aka.ms/arm-syntax-resources for usage details.'. (Code: InvalidTemplate)

Here's the link to my JSON file:

https://drive.google.com/file/d/1B3afcgMy8MTv5mTIH2t5OKeVCvSzqNGW/view?usp=drive_link

In regards to the repository topics filter, I recorded a video that illustrates the issue:

https://drive.google.com/file/d/1IqeiuyDwN5DUngkmxsgKVsx6VrguoozZ/view?usp=sharing

If you're not fetching repository topics, it means that you probably are missing some test data. I checked the data I provided and I can see that all the JSON objects include an array of topics (e.g "advanced-security","codeql","ghas","java","javascript","security", etc.) Please let me know if you need additional data from me.

v-prasadboke · 2023-09-07T06:00:28Z

Hello @AlexDeMichieli, Please drop me a mail with attached json file.
v-prasadboke@microsoft.com
Thanks.

v-prasadboke · 2023-09-08T08:48:17Z

Hello @AlexDeMichieli, I've received the json file. Will review it and update you about the same before 12 September, 2023.

v-prasadboke · 2023-09-12T12:23:34Z

Hello @AlexDeMichieli , Reason behind zip 3.0.0 even if repackaged to 3.0.1 is the latest 3.0.0 is not live yet.

I dont have the access to partner center where github solution can be pushed to live, If you have the access to the partner center please push the solution to live

v-prasadboke · 2023-09-12T13:48:37Z

Hello @AlexDeMichieli, Looks like you have not repackaged the solution properly.

Please Repackage the solution again properly.

AlexDeMichieli · 2023-09-13T18:25:53Z

Hi @v-prasadboke , I'll give it another shot and I'll let you know if I have any issues

v-prasadboke · 2023-09-14T05:58:33Z

Hello @AlexDeMichieli, Thank you for the updates.

v-prasadboke · 2023-09-18T09:47:31Z

Hello @AlexDeMichieli, The 3.0.0 of Github is live. You can repackage the solution with 3.0.1 Thanks

v-prasadboke · 2023-09-20T08:09:41Z

Hello @AlexDeMichieli, Hope the issue is resolved with 3.0.1 repackaging and you are repackaging it too. Just wanted to know some updates on the solution. Thanks.

v-prasadboke · 2023-09-22T08:31:55Z

Hello @AlexDeMichieli, Please confirm on the maintemplate.
Thanks.

AlexDeMichieli · 2023-09-22T16:37:05Z

Hello @AlexDeMichieli, Please confirm on the maintemplate. Thanks.

Hi @v-prasadboke , I'll be back to the office next Tuesday. Thanks so much for repackaging the solution! I just wanted to confirm the next steps. Can I pull from the branch, get the mainTemplate.json and publish it?

v-prasadboke · 2023-09-25T05:01:19Z

Hello @AlexDeMichieli, Review is not completed yet. I was waiting for your confirmation on maintemplate. Is it ok or not?
I'll review the maintemplate and get it merged.
Please keep the solution on hold for publishing.
I'll update you before 27 September, 2023.

AlexDeMichieli · 2023-09-25T17:39:56Z

Hi @v-prasadboke , the maintemplate looks fine to me! Thanks!

v-prasadboke · 2023-09-26T06:03:31Z

Thank you @AlexDeMichieli for confirmation.

AlexDeMichieli · 2023-09-27T03:19:08Z

Hi @v-prasadboke, what would be the next step? Thanks!

Update GithubWorkbook.json

10b3a79

adding updated version of the GitHub Advanced Security workbook

AlexDeMichieli requested review from a team as code owners August 22, 2023 18:08

v-atulyadav assigned v-prasadboke Aug 23, 2023

v-atulyadav added Workbook Workbook specialty review needed Solution Solution specialty review needed labels Aug 23, 2023

adding workbook

75ec361

Merge branch 'master' of github.com:AlexDeMichieli/Azure-Sentinel int…

44a463b

…o alexdemichieli/github-workbook-update-august-2023

v-prasadboke and others added 4 commits August 30, 2023 11:43

Merge branch 'master' into pr/8862

7d7488c

Update GitHubWorkbook.json

3d5bd47

Delete Solutions/GitHub/Workbooks/GithubWorkbook.json

5e4673a

Merge branch 'master' into pr/8862

8d789eb

Merge branch 'master' into pr/8862

93cd589

Solution Repackaged

95401c1

Validation resolved

c58f17c

v-prasadboke approved these changes Sep 26, 2023

View reviewed changes

v-atulyadav approved these changes Sep 26, 2023

View reviewed changes

v-atulyadav merged commit 12393a0 into Azure:master Sep 26, 2023
29 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update on GitHub Advanced Security workbook #8862

Update on GitHub Advanced Security workbook #8862

AlexDeMichieli commented Aug 22, 2023

v-prasadboke commented Aug 23, 2023

v-prasadboke commented Aug 24, 2023 •

edited

Loading

AlexDeMichieli commented Aug 24, 2023

v-prasadboke commented Aug 25, 2023

AlexDeMichieli commented Aug 28, 2023

v-prasadboke commented Aug 28, 2023

v-prasadboke commented Aug 28, 2023 •

edited

Loading

AlexDeMichieli commented Aug 28, 2023

v-prasadboke commented Aug 29, 2023

AlexDeMichieli commented Aug 30, 2023

v-prasadboke commented Aug 30, 2023

AlexDeMichieli commented Aug 30, 2023

v-prasadboke commented Aug 31, 2023

v-prasadboke commented Sep 4, 2023

v-prasadboke commented Sep 6, 2023

AlexDeMichieli commented Sep 6, 2023 •

edited

Loading

v-prasadboke commented Sep 7, 2023

v-prasadboke commented Sep 8, 2023

v-prasadboke commented Sep 12, 2023

v-prasadboke commented Sep 12, 2023

AlexDeMichieli commented Sep 13, 2023

v-prasadboke commented Sep 14, 2023

v-prasadboke commented Sep 18, 2023

v-prasadboke commented Sep 20, 2023

v-prasadboke commented Sep 22, 2023

AlexDeMichieli commented Sep 22, 2023 •

edited

Loading

v-prasadboke commented Sep 25, 2023 •

edited

Loading

AlexDeMichieli commented Sep 25, 2023

v-prasadboke commented Sep 26, 2023

AlexDeMichieli commented Sep 27, 2023

Update on GitHub Advanced Security workbook #8862

Update on GitHub Advanced Security workbook #8862

Conversation

AlexDeMichieli commented Aug 22, 2023

v-prasadboke commented Aug 23, 2023

v-prasadboke commented Aug 24, 2023 • edited Loading

AlexDeMichieli commented Aug 24, 2023

v-prasadboke commented Aug 25, 2023

AlexDeMichieli commented Aug 28, 2023

v-prasadboke commented Aug 28, 2023

v-prasadboke commented Aug 28, 2023 • edited Loading

AlexDeMichieli commented Aug 28, 2023

v-prasadboke commented Aug 29, 2023

AlexDeMichieli commented Aug 30, 2023

v-prasadboke commented Aug 30, 2023

AlexDeMichieli commented Aug 30, 2023

v-prasadboke commented Aug 31, 2023

v-prasadboke commented Sep 4, 2023

v-prasadboke commented Sep 6, 2023

AlexDeMichieli commented Sep 6, 2023 • edited Loading

v-prasadboke commented Sep 7, 2023

v-prasadboke commented Sep 8, 2023

v-prasadboke commented Sep 12, 2023

v-prasadboke commented Sep 12, 2023

AlexDeMichieli commented Sep 13, 2023

v-prasadboke commented Sep 14, 2023

v-prasadboke commented Sep 18, 2023

v-prasadboke commented Sep 20, 2023

v-prasadboke commented Sep 22, 2023

AlexDeMichieli commented Sep 22, 2023 • edited Loading

v-prasadboke commented Sep 25, 2023 • edited Loading

AlexDeMichieli commented Sep 25, 2023

v-prasadboke commented Sep 26, 2023

AlexDeMichieli commented Sep 27, 2023

v-prasadboke commented Aug 24, 2023 •

edited

Loading

v-prasadboke commented Aug 28, 2023 •

edited

Loading

AlexDeMichieli commented Sep 6, 2023 •

edited

Loading

AlexDeMichieli commented Sep 22, 2023 •

edited

Loading

v-prasadboke commented Sep 25, 2023 •

edited

Loading