cyborgsecurity-hunter-solution-v1 #9041

nbyt3 · 2023-09-19T13:01:49Z

Required items, please complete

Change(s):

Initial submission for the cyborgsecurity-hunter-solution

Reason for Change(s):

See guidance below

Testing Completed:

Yes

Checked that the validations are passing and have addressed any issues that are present:

Need Help

=======Starting Package Creation using V3 tool=========
Enter solution data file path : /home/cyborgmike/projects/Azure-Sentinel/Solutions/Cyborg Security HUNTER/Data
Path /home/cyborgmike/projects/Azure-Sentinel/Solutions/Cyborg Security HUNTER/Data, DefaultPackageVersion is 3.0.0
SolutionBasePath is /home/cyborgmike/projects/Azure-Sentinel/Solutions/, Solution Name Cyborg Security HUNTER
CatelogAPI Details not found for offerId azure-sentinel-solution-cyborgsecurity-hunter
CatalogAPI Offer details not found for given offerId azure-sentinel-solution-cyborgsecurity-hunter. Package Version set to Default version 3.0.0
Package version updated to 3.0.0
Package version identified is 3.0.0
Downloading /home/cyborgmike/projects/Azure-Sentinel/Solutions/Cyborg Security HUNTER/Data Connectors/Connector_CyborgSecurity_HUNTER.json
Generating Data Connector using Data Connectors/Connector_CyborgSecurity_HUNTER.json
Downloading /home/cyborgmike/projects/Azure-Sentinel/Solutions/Cyborg Security HUNTER/Hunting Queries/Prohibited Applications Spawning cmd.exe or powershell.exe.yaml
Generating Hunting Query using Hunting Queries/Prohibited Applications Spawning cmd.exe or powershell.exe.yaml
Downloading /home/cyborgmike/projects/Azure-Sentinel/Solutions/Cyborg Security HUNTER/SolutionMetadata.json
Inside of PrepareSolutionMetadata
                                                                                                                        
Validating Package\createUiDefinition.json                                                                              
  JSONFiles Should Be Valid                                                                                             
    [+] JSONFiles Should Be Valid (4 ms)                                                                                
  Allowed Values Should Actually Be Allowed                                                                             
    [+] Allowed Values Should Actually Be Allowed (70 ms)                                                               
  Controls In Outputs Must Exist                                                                                        
    [+] Controls In Outputs Must Exist (2 ms)                                                                           
  CreateUIDefinition Must Not Have Blanks                                                                               
    [+] CreateUIDefinition Must Not Have Blanks (2 ms)                                                                  
  CreateUIDefinition Should Have Schema                                                                                 
    [+] CreateUIDefinition Should Have Schema (2 ms)                                                                    
  Credential Confirmation Should Not Be Hidden                                                                          
    [+] Credential Confirmation Should Not Be Hidden (75 ms)                                                            
  Handler Must Be Correct                                                                                               
    [+] Handler Must Be Correct (3 ms)                                                                                  
  HideExisting Must Be Correctly Handled                                                                                
    [+] HideExisting Must Be Correctly Handled (149 ms)                                                                 
  Location Should Be In Outputs                                                                                         
    [+] Location Should Be In Outputs (2 ms)                                                                            
  Outputs Must Be Present In Template Parameters                                                                        
    [+] Outputs Must Be Present In Template Parameters (2 ms)                                                           
  Parameters Without Default Must Exist In CreateUIDefinition                                                           
    [+] Parameters Without Default Must Exist In CreateUIDefinition (3 ms)                                              
  Password Textboxes Must Be Used For Password Parameters                                                               
    [+] Password Textboxes Must Be Used For Password Parameters (57 ms)                                                 
  PasswordBoxes Must Have Min Length                                                                                    
    [+] PasswordBoxes Must Have Min Length (48 ms)                                                                      
  Textboxes Are Well Formed                                                                                             
    [+] Textboxes Are Well Formed (70 ms)                                                                               
  Tooltips Should Be Present                                                                                            
    [+] Tooltips Should Be Present (80 ms)                                                                              
  Usernames Should Not Have A Default                                                                                   
    [+] Usernames Should Not Have A Default (69 ms)                                                                     
  Validations Must Have Message                                                                                         
    [+] Validations Must Have Message (83 ms)                                                                           
  VMSizes Must Match Template                                                                                           
    [+] VMSizes Must Match Template (55 ms)                                                                             
Validating Package\mainTemplate.json                                                                                    
  adminUsername Should Not Be A Literal                                                                                 
    [+] adminUsername Should Not Be A Literal (163 ms)                                                                  
  apiVersions Should Be Recent In Reference Functions                                                                   
    [+] apiVersions Should Be Recent In Reference Functions (4 ms)                                                      
  apiVersions Should Be Recent                                                                                          
    [?] apiVersions Should Be Recent (128 ms)                                                                           
        Could not identify provider resource for Microsoft.OperationalInsights/workspaces/providers/contentTemplates    
        The apiVersion 2021-03-01-preview was not found for the resource type: Microsoft.SecurityInsights               
        The apiVersion 2023-04-01-preview was not found for the resource type: Microsoft.SecurityInsights               
        The apiVersion 2023-04-01-preview was not found for the resource type: Microsoft.SecurityInsights               
        The apiVersion 2021-03-01-preview was not found for the resource type: Microsoft.SecurityInsights               
        Could not identify provider resource for Microsoft.OperationalInsights/workspaces/providers/contentTemplates    
        Could not identify provider resource for Microsoft.OperationalInsights/workspaces/providers/contentTemplates/Microsoft.OperationalInsights/savedSearches
        The apiVersion 2022-01-01-preview was not found for the resource type: Microsoft.SecurityInsights               
        The apiVersion 2023-04-01-preview was not found for the resource type: Microsoft.SecurityInsights               
                                                                                                                        
  artifacts parameter                                                                                                   
    [+] artifacts parameter (3 ms)                                                                                      
  CommandToExecute Must Use ProtectedSettings For Secrets                                                               
    [+] CommandToExecute Must Use ProtectedSettings For Secrets (116 ms)                                                
  DependsOn Best Practices                                                                                              
    [+] DependsOn Best Practices (93 ms)                                                                                
  Deployment Resources Must Not Be Debug                                                                                
    [+] Deployment Resources Must Not Be Debug (80 ms)                                                                  
  DeploymentTemplate Must Not Contain Hardcoded Uri                                                                     
    [+] DeploymentTemplate Must Not Contain Hardcoded Uri (5 ms)                                                        
  DeploymentTemplate Schema Is Correct                                                                                  
    [+] DeploymentTemplate Schema Is Correct (1 ms)                                                                     
  Dynamic Variable References Should Not Use Concat                                                                     
    [+] Dynamic Variable References Should Not Use Concat (1 ms)                                                        
  IDs Should Be Derived From ResourceIDs                                                                                
    [-] IDs Should Be Derived From ResourceIDs (185 ms)                                                                 
        Property: "contentProductId" must use one of the following expressions for an resourceId property:              
            extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid
        Property: "id" must use one of the following expressions for an resourceId property:                            
            extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid
        Property: "contentProductId" must use one of the following expressions for an resourceId property:              
            extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid
        Property: "id" must use one of the following expressions for an resourceId property:                            
            extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid
        Property: "contentProductId" must use one of the following expressions for an resourceId property:              
            extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid
        Property: "id" must use one of the following expressions for an resourceId property:                            
            extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid
                                                                                                                        
  Location Should Not Be Hardcoded                                                                                      
    [+] Location Should Not Be Hardcoded (341 ms)                                                                       
  ManagedIdentityExtension must not be used                                                                             
    [+] ManagedIdentityExtension must not be used (3 ms)                                                                
  Min And Max Value Are Numbers                                                                                         
    [+] Min And Max Value Are Numbers (5 ms)                                                                            
  Outputs Must Not Contain Secrets                                                                                      
    [+] Outputs Must Not Contain Secrets (4 ms)                                                                         
  Parameter Types Should Be Consistent                                                                                  
    [+] Parameter Types Should Be Consistent (192 ms)                                                                   
  Parameters Must Be Referenced                                                                                         
    [+] Parameters Must Be Referenced (17 ms)                                                                           
  Password params must be secure                                                                                        
    [+] Password params must be secure (2 ms)                                                                           
  providers apiVersions Is Not Permitted                                                                                
    [+] providers apiVersions Is Not Permitted (7 ms)                                                                   
  ResourceIds should not contain                                                                                        
    [+] ResourceIds should not contain (2 ms)                                                                           
  Resources Should Have Location                                                                                        
    [+] Resources Should Have Location (2 ms)                                                                           
  Resources Should Not Be Ambiguous                                                                                     
    [+] Resources Should Not Be Ambiguous (2 ms)                                                                        
  Secure Params In Nested Deployments                                                                                   
    [+] Secure Params In Nested Deployments (148 ms)                                                                    
  Secure String Parameters Cannot Have Default                                                                          
    [+] Secure String Parameters Cannot Have Default (1 ms)                                                             
  Template Should Not Contain Blanks                                                                                    
    [-] Template Should Not Contain Blanks (452 ms)                                                                     
        Empty property:  [] Line: 86, Column: 34                                                                        
        Empty property:  [] Line: 87, Column: 35                                                                        
        Empty property:  [] Line: 88, Column: 31                                                                        
        Empty property:  [] Line: 89, Column: 43                                                                        
        Empty property:  [] Line: 95, Column: 40                                                                        
        Empty property:  [] Line: 228, Column: 26                                                                       
        Empty property:  [] Line: 229, Column: 23                                                                       
        Empty property:  [] Line: 230, Column: 35                                                                       
        Empty property:  [] Line: 231, Column: 27                                                                       
        Empty property:  [] Line: 237, Column: 32                                                                       
                                                                                                                        
  URIs Should Be Properly Constructed                                                                                   
    [+] URIs Should Be Properly Constructed (145 ms)                                                                    
  Variables Must Be Referenced                                                                                          
    [-] Variables Must Be Referenced (69 ms)                                                                            
        Unreferenced variable: workspaceResourceId                                                                      
                                                                                                                        
  Virtual Machines Should Not Be Preview                                                                                
    [+] Virtual Machines Should Not Be Preview (191 ms)                                                                 
  VM Images Should Use Latest Version                                                                                   
    [+] VM Images Should Use Latest Version (1 ms)                                                                      
  VM Size Should Be A Parameter                                                                                         
    [+] VM Size Should Be A Parameter (110 ms)                                                                          
Pass  : 45                                                                                                              
Total : 48                                                                                                              
Fail  : 3                                                                                                               
                                                                                                                        
                                                                                                                        
                                                                                                                        
Failed arm-ttk (Test-AzTemplate): Package                                                                               
Failed arm-ttk (Test-AzTemplate) on solutions: Package

nbyt3 · 2023-09-20T12:37:37Z

@microsoft-github-policy-service agree [company="Cyborg Security, Inc"]

nbyt3 · 2023-09-21T13:53:04Z

@microsoft-github-policy-service agree company="Cyborg Security, Inc"

v-rbajaj · 2023-09-22T13:15:49Z

Hi @nbyt3, Thanks for raising this PR, will review it by 28 Sep 2023.

nbyt3 · 2023-09-22T15:26:38Z

When running the 'createSolutionV3.ps1' tool, I'm getting the following errors but am unable to resolve due to a lack of detail in the error messaging.

IDs Should Be Derived From ResourceIDs [-] IDs Should Be Derived From ResourceIDs (163 ms) Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid

nbyt3 · 2023-09-22T15:28:19Z

When running the 'createSolutionV3.ps1' tool, i am receiving the following error but when resolving the issue on the 'mainTemplate.json' and 'createUiDefinition.json' and re-running the 'createSolutionV3.ps1' tool, the changes are overwritten.

...es/Excessive Windows Discovery and Execution Processes - Potential Malware Installation.yaml

v-rbajaj · 2023-09-28T09:37:17Z

Hi @nbyt3, in all Hunting Queries tactics , relevantTechniques , Version is required, please add these missing fields

v-rbajaj · 2023-09-28T09:41:01Z

For logo Validation failure, please ensure raw file of logo does not have xmlns:xlink

Solutions/Cyborg Security HUNTER/Data Connectors/CyborgSecurity_HUNTER.json

v-rbajaj · 2023-09-28T09:45:21Z

Also do add release notes, please follow this link -https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ReleaseNotesGuidance.md

v-rbajaj · 2023-09-28T09:46:00Z

After doing all the above changes, repackage the solution

…l Malware Installation.yaml

nbyt3 · 2023-10-02T01:37:27Z

@v-rbajaj I've completed the changes and resubmitted!

nbyt3 · 2023-10-10T13:02:21Z

@v-rbajaj I just updated maintemplate, and the data_connector file. When running the arm-ttk locally im getting the following errors:

This solution does not have a dataType or connectivityCriteria as it is not pulling in data from a source. I'm working with Eric Burkholder to define this V1 of the solution.

Also, it looks like the arm-ttk is failing due to the ID's for the included HuntingQueries. These IDs are UUID4, that I generated. Should there be another way to generate the IDs?
Template Should Not Contain Blanks [-] Template Should Not Contain Blanks (723 ms) Empty property: [] Line: 143, Column: 34 Empty property: [] Line: 144, Column: 35 Empty property: [] Line: 145, Column: 31 Empty property: [] Line: 146, Column: 43 Empty property: [] Line: 278, Column: 26 Empty property: [] Line: 279, Column: 23 Empty property: [] Line: 280, Column: 35 Empty property: [] Line: 281, Column: 27 Empty property: null Line: 286, Column: 25

IDs Should Be Derived From ResourceIDs [-] IDs Should Be Derived From ResourceIDs (298 ms) Property: "contentProductId" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "contentProductId" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "contentProductId" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "contentProductId" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "contentProductId" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "contentProductId" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "contentProductId" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "contentProductId" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "contentProductId" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "contentProductId" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "contentProductId" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "contentProductId" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid

v-rbajaj · 2023-10-12T14:08:18Z

Hi @nbyt3,

I don't think so these are errors because of hunting queries GUID.

Sorry, I think you have interpreted my message wrongly, we don't need below empty arrays

You need add KQL queries like in this json file https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cybersixgill-Actionable-Alerts/Data%20Connectors/Cybersixgill_FunctionApp.json

Also, I think you have repackage the solution after modifying the data connector file, please do repackage it otherwise the changes won't reflect in maintemplate.

v-rbajaj · 2023-10-16T12:47:04Z

Hi @nbyt3, please provide update on the above comment..

nbyt3 · 2023-10-16T13:01:18Z

@v-rbajaj Based on guidance from my Product Partnership contact at Microsoft, it was suggested to not include graphQueries, sampleQueries, or connectivityCristerias, as this integration is not actually pulling in data into Microsoft Sentinel. This version of the integration is more aligned to guidance on how to configure the HUNTER platform in order to utilize our 'deeplink' feature. I will reach back out to my contact, but in order to get past the arm-ttk errros, I've added in the required key/value items that are causing the error. The connectivityCriteria will make sure that there is atleast some SecurityEvents ingested in order to verify the visibility needed to utilize our hunt packages.

v-rbajaj · 2023-10-18T18:39:54Z

Hi @nbyt3, we are still investigating on the ARM ttk failure and your question which is asked, we will get back to you by 19 Oct 2023.

v-rbajaj · 2023-10-20T16:50:30Z

Hi @nbyt3, we are still investigating on the ARM ttk failure and your question which is asked, we will get back to you by 19 Oct 2023.

Hi @nbyt3, sorry for delay, we are still figuring out a fix for ARM TTK failure, will get back to you by 23 Oct 2023.

v-rbajaj · 2023-10-23T11:48:34Z

Hi @nbyt3, can you please remove this maintemplate from the PR - Solutions/CyberArkEPM/Package/mainTemplate.json

And also look into the logo validation?

nbyt3

@v-rbajaj Reviewed your feedback. I removed the file in question and updated the logo

v-rbajaj · 2023-10-25T15:02:32Z

Hi @nbyt3, please update the ID in GUID format for the logo so that logo validation is passed.
You can generate the GUID from here - https://guidgenerator.com/

nbyt3 · 2023-10-26T02:07:29Z

@v-rbajaj I just update the id in the cyborg logo svg file. I wasn't sure where else that 'id' needed to be changed.

v-rbajaj · 2023-10-27T04:36:32Z

Hi @nbyt3, I am still reviewing the contents of the solution for cyborg security hunter. But if we decide to merge this PR, this kind of commit will delete the maintemplate file, which we don't want.
Please revert the initial commit where in this maintemplate was added in the PR, I hope you understand my point, in case you have questions regarding this please let me know

This reverts commit af568df.

nbyt3 · 2023-10-31T02:20:15Z

@v-rbajaj I found the commit were the file was added, but there are some other changes that need to be included in that commit.

Commit hash: a7cf2c7

v-rbajaj · 2023-10-31T16:01:39Z

Hi @nbyt3, then you would need to raise a new PR and close this PR.

Copy the changed contents and create a new branch and paste the contents in the repo, please do not include the other solution while raising the new PR.

nbyt3 · 2023-10-31T17:18:42Z

Closing for #9309

cyborgsecurity-hunter-solution-v1

0022197

nbyt3 requested review from a team as code owners September 19, 2023 13:01

cyborg-security-updating-logos

1672b3e

v-atulyadav assigned v-rbajaj Sep 20, 2023

v-atulyadav added the Solution Solution specialty review needed label Sep 20, 2023

nbyt3 and others added 4 commits September 22, 2023 09:25

updates

38a46fd

update-issue with resourceIDs

a7cf2c7

Merge branch 'Azure:master' into cyborgsecurity-hunter-solution

4859b16

bump version

7862663

v-rbajaj reviewed Sep 28, 2023

View reviewed changes

...es/Excessive Windows Discovery and Execution Processes - Potential Malware Installation.yaml Outdated Show resolved Hide resolved

v-rbajaj reviewed Sep 28, 2023

View reviewed changes

Solutions/Cyborg Security HUNTER/Data Connectors/CyborgSecurity_HUNTER.json Outdated Show resolved Hide resolved

v-rbajaj reviewed Sep 28, 2023

View reviewed changes

Solutions/Cyborg Security HUNTER/Data Connectors/CyborgSecurity_HUNTER.json Outdated Show resolved Hide resolved

nbyt3 and others added 5 commits October 1, 2023 20:55

Update Excessive Windows Discovery and Execution Processes - Potentia…

a790c9c

…l Malware Installation.yaml

feedback-updates

5b85650

feedback-updates

9bfe5e6

fixed-logo

2e66498

resubmission

4c2fdd1

update-image

e720a42

nbyt3 added 2 commits October 10, 2023 08:57

feedback-10-10-2023

2e5c7ed

update-main-template

d6580e5

local-arm-ttk-run

db567f0

nbyt3 added 4 commits October 16, 2023 09:24

feedback10-16-2023

f4e7812

arm-ttk run

ce1e2c1

arm-ttk run-2

6556a67

arm-ttk3

34d2834

Delete Solutions/CyberArkEPM/Package/mainTemplate.json

af568df

github-actions bot added the auto-package label Oct 23, 2023

updated-logo

5d5c18a

nbyt3 commented Oct 23, 2023

View reviewed changes

nbyt3 added 2 commits October 23, 2023 13:49

update_link

c64acef

update style for png

abf3e87

update_logo

b63f99f

Revert "Delete Solutions/CyberArkEPM/Package/mainTemplate.jso"

58a36ea

This reverts commit af568df.

nbyt3 mentioned this pull request Oct 31, 2023

v1-update-pr #9309

Merged

nbyt3 closed this Oct 31, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

cyborgsecurity-hunter-solution-v1 #9041

cyborgsecurity-hunter-solution-v1 #9041

nbyt3 commented Sep 19, 2023

nbyt3 commented Sep 20, 2023

nbyt3 commented Sep 21, 2023

v-rbajaj commented Sep 22, 2023

nbyt3 commented Sep 22, 2023

nbyt3 commented Sep 22, 2023

v-rbajaj commented Sep 28, 2023

v-rbajaj commented Sep 28, 2023

v-rbajaj commented Sep 28, 2023

v-rbajaj commented Sep 28, 2023

nbyt3 commented Oct 2, 2023

nbyt3 commented Oct 10, 2023 •

edited

Loading

v-rbajaj commented Oct 12, 2023

v-rbajaj commented Oct 16, 2023

nbyt3 commented Oct 16, 2023

v-rbajaj commented Oct 18, 2023

v-rbajaj commented Oct 20, 2023

v-rbajaj commented Oct 23, 2023

nbyt3 left a comment •

edited

Loading

v-rbajaj commented Oct 25, 2023

nbyt3 commented Oct 26, 2023

v-rbajaj commented Oct 27, 2023

nbyt3 commented Oct 31, 2023

v-rbajaj commented Oct 31, 2023

nbyt3 commented Oct 31, 2023

cyborgsecurity-hunter-solution-v1 #9041

cyborgsecurity-hunter-solution-v1 #9041

Conversation

nbyt3 commented Sep 19, 2023

nbyt3 commented Sep 20, 2023

nbyt3 commented Sep 21, 2023

v-rbajaj commented Sep 22, 2023

nbyt3 commented Sep 22, 2023

nbyt3 commented Sep 22, 2023

v-rbajaj commented Sep 28, 2023

v-rbajaj commented Sep 28, 2023

v-rbajaj commented Sep 28, 2023

v-rbajaj commented Sep 28, 2023

nbyt3 commented Oct 2, 2023

nbyt3 commented Oct 10, 2023 • edited Loading

v-rbajaj commented Oct 12, 2023

v-rbajaj commented Oct 16, 2023

nbyt3 commented Oct 16, 2023

v-rbajaj commented Oct 18, 2023

v-rbajaj commented Oct 20, 2023

v-rbajaj commented Oct 23, 2023

nbyt3 left a comment • edited Loading

Choose a reason for hiding this comment

v-rbajaj commented Oct 25, 2023

nbyt3 commented Oct 26, 2023

v-rbajaj commented Oct 27, 2023

nbyt3 commented Oct 31, 2023

v-rbajaj commented Oct 31, 2023

nbyt3 commented Oct 31, 2023

nbyt3 commented Oct 10, 2023 •

edited

Loading

nbyt3 left a comment •

edited

Loading