Solution/grey noise 1 #8931

punkrokk · 2023-09-02T03:15:11Z

Required items, please complete

Change(s):

Add GreyNoise Solution

Reason for Change(s):

See guidance below

Version Updated:

First Release
See guidance below

Testing Completed:

No

Checked that the validations are passing and have addressed any issues that are present:

See guidance below

Guidance <- remove section before submitting

Before submitting this PR please ensure that you have read the following sections and filled out the changes, reason for change and testing complete sections:

Thank you for your contribution to the Microsoft Sentinel Github repo.

Details of the code changes in your submitted PR. Providing descriptions for pull requests ensures there is context to changes being made and greatly enhances the code review process. Providing associated Issues that this resolves also easily connects the reason.

Change(s):

Updated syntax for XYZ.yaml

Reason for Change(s):

New schema used for XYZ.yaml
Resolves ISSUE Add Logstash required version to Readme file #1234

Version updated:

Yes
Detections/Analytic Rule templates are required to have the version updated

The code should have been tested in a Microsoft Sentinel environment that does not have any custom parsers, functions or tables, so that you validate no incorrect syntax and execution functions properly. If your submission requires a custom parser or function, it must be submitted with the PR.

Testing Completed:

Yes/No/Need Help

Note: If updating a detection, you must update the version field.

Before the submission has been made, please look at running the KQL and Yaml Validation Checks locally.
https://github.com/Azure/Azure-Sentinel#run-kql-validation-locally

Checked that the validations are passing and have addressed any issues that are present:

Yes/No/Need Help

Note: Let us know if you have tried fixing the validation error and need help.

References:

Guidance for Detection checks

General contribution guidance

PR validation troubleshooting

punkrokk · 2023-09-02T03:18:35Z

@punkrokk please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
@microsoft-github-policy-service agree [company="{your company}"]
Options:

(default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
@microsoft-github-policy-service agree
(when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
@microsoft-github-policy-service agree company="Microsoft"
Contributor License Agreement

@microsoft-github-policy-service agree

v-prasadboke · 2023-09-04T06:15:21Z

Hello @punkrokk, Thank you for raising this PR. Please repackage the solution using V3 tool for which input file and solution metadata are required.
You can go through this instructions for more help on how to create input file, Solution metadata and V3 tool.

https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.md

Solutions/GreyNoise/Data Connectors/GreyNoiseAPISentinelConnector/main.py

punkrokk · 2023-09-05T22:30:41Z

I believe in order to setup and test my deploy to Azure Function link, I need to get this merged.

v-prasadboke · 2023-09-06T06:24:30Z

Hello @punkrokk, Thank you for committing the requested changes.
We will examine this PR and update you about the same before 11 September, 2023.

Solutions/GreyNoiseThreatIntelligence/Data Connectors/GreyNoiseAPISentinelConnector/main.py

v-prasadboke · 2023-09-11T10:07:24Z

Hello @punkrokk, Please repackage the solution again with adding workbook in the input file. I did the changes in my local but came to know I dont have access to the branch.
Also please add latest sample data of ThreatIntellegenceIndicator to test the content of the solution, Thanks.

punkrokk · 2023-09-11T18:00:03Z

Hello @punkrokk, Please repackage the solution again with adding workbook in the input file. I did the changes in my local but came to know I dont have access to the branch. Also please add latest sample data of ThreatIntellegenceIndicator to test the content of the solution, Thanks.

I have added the workbook to the input file and added some Stix samples you can submit to the ThreatIntellegenceIndicator upload-api.

v-prasadboke · 2023-09-12T05:24:11Z

Hello @punkrokk, Thank you for committing the changes. I'll examine this commits and update you about the same before 14 September, 2023.

...ions/GreyNoiseThreatIntelligence/Data Connectors/GreyNoiseConnector_UploadIndicatorsAPI.json

v-prasadboke · 2023-09-14T09:24:31Z

...atIntelligence/Data Connectors/azuredeploy_Connector_GreyNoiseAPISentinel_AzureFunction.json

+                          "CLIENT_ID": "[parameters('CLIENT_ID')]",
+                          "CLIENT_SECRET": "[parameters('CLIENT_SECRET')]",
+                          "GREYNOISE_CLASSIFICATIONS": "[parameters('GREYNOISE_CLASSIFICATIONS')]",
+                          "WEBSITE_RUN_FROM_PACKAGE": "https://github.com/Azure/Azure-Sentinel/raw/db458a54839b084eac0e70bbe6e2a41f34f37e2b/Solutions/GreyNoiseThreatIntelligence/Data%20Connectors/GreyNoiseAPISentinelConn.zip"


Zip package download link should have the master branch, currently its on your branch.

How do I get it on Master Branch? Do I need a PR with just the zip file?

Just replace the branch name with "master"

Regarding this: I'm following the instructions here: https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/Templates/Connector_REST_API_AzureFunctionApp_template/README.md#3-create-an-encoded-url which say to get my zip file up into master so I can update the link in azure_deploy file.

v-prasadboke · 2023-09-14T09:34:35Z

And the workbook is unable to access this subscription which I'm using. Is it ok too.

punkrokk · 2023-09-14T17:02:39Z

And the workbook is unable to access this subscription which I'm using. Is it ok too.

I have no idea what would cause this.... I am able to load and use this in 4 different environments/tenants.

v-prasadboke · 2023-09-15T05:13:03Z

Hello @punkrokk, I'll take a look at it and update you about the same before 20 September, 2023.

v-prasadboke · 2023-09-20T12:06:45Z

Hello @punkrokk, Everything looks good. Just add a reference link to release notes in Create ui.
You can refer this createui for more reference https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure%20Active%20Directory/Package/createUiDefinition.json
Please update the zip package with latest maintemplate and createui after modifying the create ui

Also please move the workbook metadata from V2 folder to this file https://github.com/Azure/Azure-Sentinel/blob/master/Workbooks/WorkbooksMetadata.json
Also add the logo and previewimages of workbook in the specific folder
https://github.com/Azure/Azure-Sentinel/tree/master/Workbooks/Images

This are the only changes requested. Other than this all looks good.
Thanks.

punkrokk · 2023-09-21T21:42:55Z

@v-prasadboke I messed up rebase, new PR here: #9070

punkrokk · 2023-09-22T13:08:32Z

@v-prasadboke I messed up rebase, new PR here: #9070

All changes requested in #9070 @v-prasadboke

punkrokk requested review from a team as code owners September 2, 2023 03:15

v-atulyadav assigned v-prasadboke Sep 4, 2023

v-atulyadav added the Solution Solution specialty review needed label Sep 4, 2023

github-advanced-security bot found potential problems Sep 4, 2023

View reviewed changes

Solutions/GreyNoise/Data Connectors/GreyNoiseAPISentinelConnector/main.py Fixed Show resolved Hide resolved

Solutions/GreyNoise/Data Connectors/GreyNoiseAPISentinelConnector/main.py Fixed Show resolved Hide resolved

github-advanced-security bot found potential problems Sep 11, 2023

View reviewed changes

Solutions/GreyNoiseThreatIntelligence/Data Connectors/GreyNoiseAPISentinelConnector/main.py Fixed Show resolved Hide resolved

v-prasadboke reviewed Sep 14, 2023

View reviewed changes

punkrokk mentioned this pull request Sep 14, 2023

zip and azuredeploy #9010

Merged

github-actions bot added the auto-package label Sep 20, 2023

punkrokk closed this Sep 21, 2023

punkrokk force-pushed the solution/GreyNoise-1 branch from 4404764 to aabbea1 Compare September 21, 2023 21:20

punkrokk mentioned this pull request Sep 21, 2023

Solution/grey noise1.1 #9070

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Solution/grey noise 1 #8931

Solution/grey noise 1 #8931

punkrokk commented Sep 2, 2023 •

edited

Loading

punkrokk commented Sep 2, 2023 •

edited

Loading

v-prasadboke commented Sep 4, 2023

punkrokk commented Sep 5, 2023

v-prasadboke commented Sep 6, 2023

v-prasadboke commented Sep 11, 2023

punkrokk commented Sep 11, 2023

v-prasadboke commented Sep 12, 2023

v-prasadboke Sep 14, 2023

punkrokk Sep 14, 2023

punkrokk Sep 14, 2023

v-prasadboke Sep 15, 2023

punkrokk Sep 16, 2023

v-prasadboke commented Sep 14, 2023

punkrokk commented Sep 14, 2023

v-prasadboke commented Sep 15, 2023

v-prasadboke commented Sep 20, 2023

punkrokk commented Sep 21, 2023 •

edited

Loading

punkrokk commented Sep 22, 2023

Solution/grey noise 1 #8931

Solution/grey noise 1 #8931

Conversation

punkrokk commented Sep 2, 2023 • edited Loading

Guidance <- remove section before submitting

Before submitting this PR please ensure that you have read the following sections and filled out the changes, reason for change and testing complete sections:

punkrokk commented Sep 2, 2023 • edited Loading

v-prasadboke commented Sep 4, 2023

punkrokk commented Sep 5, 2023

v-prasadboke commented Sep 6, 2023

v-prasadboke commented Sep 11, 2023

punkrokk commented Sep 11, 2023

v-prasadboke commented Sep 12, 2023

v-prasadboke Sep 14, 2023

Choose a reason for hiding this comment

punkrokk Sep 14, 2023

Choose a reason for hiding this comment

punkrokk Sep 14, 2023

Choose a reason for hiding this comment

v-prasadboke Sep 15, 2023

Choose a reason for hiding this comment

punkrokk Sep 16, 2023

Choose a reason for hiding this comment

v-prasadboke commented Sep 14, 2023

punkrokk commented Sep 14, 2023

v-prasadboke commented Sep 15, 2023

v-prasadboke commented Sep 20, 2023

punkrokk commented Sep 21, 2023 • edited Loading

punkrokk commented Sep 22, 2023

punkrokk commented Sep 2, 2023 •

edited

Loading

punkrokk commented Sep 2, 2023 •

edited

Loading

punkrokk commented Sep 21, 2023 •

edited

Loading