Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mimecast SEG #8865

Merged
merged 24 commits into from
Sep 27, 2023
Merged

Mimecast SEG #8865

merged 24 commits into from
Sep 27, 2023

Conversation

nipun-crestdatasystem
Copy link
Contributor

This is a draft PR to run the validation checks for MimecastSEG.

@nipun-crestdatasystem
Copy link
Contributor Author

nipun-crestdatasystem commented Aug 23, 2023 via email

@nipun-crestdatasystem nipun-crestdatasystem marked this pull request as ready for review August 25, 2023 06:10
@nipun-crestdatasystem nipun-crestdatasystem requested review from a team as code owners August 25, 2023 06:10
@v-rusraut v-rusraut added Solution Solution specialty review needed and removed draft labels Aug 25, 2023
@v-rbajaj
Copy link
Contributor

Hi @nipun-crestdatasystem, thanks for marking this PR as ready for review, we will review this PR by 29 Aug 2023

@@ -0,0 +1,39 @@
id: 1818aeaa-4cc8-426b-ba54-539de896d299
name: Mimecast Data Leak Prevention - Notifications
description: Mimecast DLP - Notifications analytical rule
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please make the description more descriptive.

@@ -0,0 +1,38 @@
id: 3e12b7b1-75e5-497c-ba01-b6cb30b60d7f
name: Mimecast Data Leak Prevention - Hold
description: Mimecast Data Leak Prevention - Hold
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Description needs to be a bit more descriptive.

@@ -0,0 +1,54 @@
id: 0f0dc725-29dc-48c3-bf10-bd2f34fd1cbb
name: Mimecast Secure Email Gateway - AV
description: Mimecast Secure Email Gateway - AV
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Description needs to be a bit more descriptive.

@@ -0,0 +1,50 @@
id: 72264f4f-61fb-4f4f-96c4-635571a376c2
name: Mimecast Secure Email Gateway - Attachment Protect
description: Mimecast Secure Email Gateway - Attachment Protect
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Description needs to be a bit more descriptive.

@@ -0,0 +1,58 @@
id: 7034abc9-6b66-4533-9bf3-056672fd9d9e
name: Mimecast Secure Email Gateway - Impersonation Protect
description: Mimecast Secure Email Gateway - Targeted Threat Protection - Impersonation Protect
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Description needs to be a bit more descriptive.

@@ -0,0 +1,49 @@
id: 5b66d176-e344-4abf-b915-e5f09a6430ef
name: Mimecast Secure Email Gateway - Internal Email Protect
description: Mimecast Secure Email Gateway - Internal Email Protect
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Description needs to be a bit more descriptive.

@@ -0,0 +1,44 @@
id: df1b9377-5c29-4928-872f-9934a6b4f611
name: Mimecast Secure Email Gateway - Spam Event Thread
description: Mimecast Secure Email Gateway - Spam Event Thread
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Description needs to be a bit more descriptive.

@@ -0,0 +1,52 @@
id: 30f73baa-602c-4373-8f02-04ff5e51fc7f
name: Mimecast Secure Email Gateway - Virus
description: Mimecast Secure Email Gateway - Virus
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Description needs to be a bit more descriptive.

@@ -0,0 +1,50 @@
id: ea19dae6-bbb3-4444-a1b8-8e9ae6064aab
name: Mimecast Secure Email Gateway - URL Protect
description: Mimecast Secure Email Gateway - Targeted Threat Protection - URL Protect
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Description needs to be a bit more descriptive.

suppressionDuration: 5h
suppressionEnabled: false
tactics:
- Execution
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add relevantTechniques, Relevant MITRE Techniques ID.

This needs to be added in all the analytical rules of the PR.

Example :- https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure%20Active%20Directory/Analytic%20Rules/FailedLogonToAzurePortal.yaml

@@ -0,0 +1,20 @@
{
"publisherId": "azuresentinel",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The tier is mentioned as Partner. So the publisherID needs to be changed according to the publisherID of the partner.

@v-rbajaj
Copy link
Contributor

Also apart from the above mentioned changes, please make the following changes :

@v-atulyadav
Copy link
Contributor

Hi @nipun-crestdatasystem,
We are waiting for your response to the above. Thanks

@nipun-crestdatasystem
Copy link
Contributor Author

Hi @nipun-crestdatasystem, We are waiting for your response to the above. Thanks

@v-atulyadav we are working on the changes that you have suggested, there is some delay due to long weekend but we shall update the PR by tomorrow EOD.

@@ -0,0 +1,3 @@
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
|-------------|--------------------------------|---------------------------------------------|
| 1.0.0 | 23-08-2023 | Initial solution release |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @nipun-crestdatasystem, please change the version to 3.0.0

@v-rbajaj
Copy link
Contributor

v-rbajaj commented Sep 5, 2023

Apart from this, please resolve merge conflicts.

@@ -1,6 +1,6 @@
{
"publisherId": "mimecast",
"offerId": "azure-sentinel-solution-mimecastseg",
"offerId": "mimecastseg",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @nipun-crestdatasystem, please revert this change in Offer ID, as per documentation the earlier offer ID was correct.
Refer - https://github.com/Azure/Azure-Sentinel/tree/master/Solutions#author-and-publish-a-solution-offer
Please let us the know the reason behind changing the offer ID if you want the updated offer ID.

v-rbajaj
v-rbajaj previously approved these changes Sep 12, 2023
@v-rbajaj
Copy link
Contributor

Hi @nipun-crestdatasystem, please fix the merge conflicts and also wanted to confirm if we you guys are the ones going to publish this solution right?

@v-rbajaj v-rbajaj dismissed their stale review September 12, 2023 14:16

Need to fix merge conflicts.

@v-rbajaj
Copy link
Contributor

Hi @nipun-crestdatasystem, please confirm if we you guys are the ones going to publish this solution right?

@nipun-crestdatasystem
Copy link
Contributor Author

Hi @nipun-crestdatasystem, please confirm if we you guys are the ones going to publish this solution right?

@v-rbajaj No our client that is Mimecast will be publishing the solution. But we will be assisting them in case if it is required.

"active_directory_tenant_id": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'active-directory-tenant-id', '/)')]",
"log_analytics_workspace_id": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'log-analytics-workspace-id', '/)')]",
"log_analytics_workspace_key": "[concat('@Microsoft.KeyVault(SecretUri=https://', variables('functionAppName'), '.vault.azure.net/secrets/', 'log-analytics-workspace-key', '/)')]",
"WEBSITE_RUN_FROM_PACKAGE": "https://aka.ms/sentinel-MimecastSEG-functionapp"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @nipun-crestdatasystem, this short link isn't working.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@v-rbajaj Yes this link does not work, but based on our past experience in previous PRs this was taken care of by the PR reviewers.
@v-prasadboke had previously taken care of such links in our other PRs.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @nipun-crestdatasystem, we have updated the short link, will review this PR again by 26 Sep 2023.

@v-atulyadav v-atulyadav merged commit f3be9da into Azure:master Sep 27, 2023
31 checks passed
@nipun-crestdatasystem
Copy link
Contributor Author

@v-atulyadav @v-rbajaj the current template link is not pointing to the right template can you please update it to point to the latest template.

@v-rbajaj
Copy link
Contributor

v-rbajaj commented Oct 4, 2023

Hi @nipun-crestdatasystem, you have to update the package on partner center, the latest zip.

@nipun-crestdatasystem
Copy link
Contributor Author

@v-rbajaj we have already added the shorthand link problem is that it is not yet pointing to the correct location, based on my previous experience in other integrations establishing this link is done at your end as we do not have any access or control over it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Solution Solution specialty review needed
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants