Repackaging - Infoblox Cloud Data Connector (MMA to AMA Migration)

[v-rusraut]

Required items, please complete

Change(s):

• Repackaging

Reason for Change(s):

• Addition of new Infoblox Cloud Data Connector AMA Data Connector

Version Updated:

• 3.0.1
  Testing Completed:
• Done

[github-actions]

Hello how are you I am GitHub bot
😀😀
I see that you changed templates under the detections/analytic rules folder. Did you remember to update the version of the templates you changed?
If not, and if you want customers to be aware that a new version of this template is available, please update the version property of the template you changed.

[github-actions]

Hello how are you I am GitHub bot
😀😀
I see that you changed templates under the detections/analytic rules folder. Did you remember to update the version of the templates you changed?
If not, and if you want customers to be aware that a new version of this template is available, please update the version property of the template you changed.

[github-actions]

Hello how are you I am GitHub bot
😀😀
I see that you changed templates under the detections/analytic rules folder. Did you remember to update the version of the templates you changed?
If not, and if you want customers to be aware that a new version of this template is available, please update the version property of the template you changed.

[github-actions]

Hello how are you I am GitHub bot
😀😀
I see that you changed templates under the detections/analytic rules folder. Did you remember to update the version of the templates you changed?
If not, and if you want customers to be aware that a new version of this template is available, please update the version property of the template you changed.

[manishkumar1991]

Parser of Infoblox is not correct, as I didn't understand that how come the DeviceProduct == "Data Connector"

Data is not a product of any kind , need to recheck

[sschuur]

Hi Microsoft, thank you for migrating this! Let me know if I can help. I am the engineer contact for this Infoblox integration.

@manishkumar1991 The DeviceProduct is parsed from the product field in the CEF header. The Data Connector is the name of the Infoblox product sending the logs.

Sentinel parses this automatically. It's not actually custom parsed by the InfobloxCDC parser. Hopefully this helps.

[github-actions]

Hello how are you I am GitHub bot
😀😀
I see that you changed templates under the detections/analytic rules folder. Did you remember to update the version of the templates you changed?
If not, and if you want customers to be aware that a new version of this template is available, please update the version property of the template you changed.

[github-actions]

Hello how are you I am GitHub bot
😀😀
I see that you changed templates under the detections/analytic rules folder. Did you remember to update the version of the templates you changed?
If not, and if you want customers to be aware that a new version of this template is available, please update the version property of the template you changed.

[github-actions]

Hello how are you I am GitHub bot
😀😀
I see that you changed templates under the detections/analytic rules folder. Did you remember to update the version of the templates you changed?
If not, and if you want customers to be aware that a new version of this template is available, please update the version property of the template you changed.

[manishkumar1991]

Approved