Veritas analytics rules

[swapnildombaleveritas]

Required items, please complete

Change(s):
Added Analytic Rules for Veritas NetBackup product. These rules includes many login failures detection and many anomalies being generated detection.

Reason for Change(s):
Analytic rules for Veritas NetBackup product.

Version Updated:
V1

Testing Completed:
Yes

Checked that the validations are passing and have addressed any issues that are present:
Yes

[v-prasadboke]

Hello @swapnildombaleveritas, I went through the PR but I think some content is missing from the PR. The following folder contains images of playbook as well.
So does this solution have Playbook as well, If yes please add it to the solution folder. And move all the images in a folder named as images.
Please repackage the solution using V3 tool, guidance to V3 tool https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.md

[swapnildombaleveritas]

Hello @swapnildombaleveritas, I went through the PR but I think some content is missing from the PR. The following folder contains images of playbook as well. So does this solution have Playbook as well, If yes please add it to the solution folder. And move all the images in a folder named as images. Please repackage the solution using V3 tool, guidance to V3 tool https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.md

We don't have a playbook yet and that's not a goal for this activity at this time

[swapnildombaleveritas]

Added packaging changes

[v-prasadboke]

Hello @swapnildombaleveritas, Thank you for committing the requested changes. Will investigate this and update you about the same before 4 October, 2023.

[v-atulyadav]

Hi @swapnildombaleveritas,
We apologize for the delay, but due to lack of availability, we will update you on this by 06 Oct 2023. Thanks

[v-prasadboke]

Hello @swapnildombaleveritas Correct me if I'm wrong as per my knowledge the offer id should be "azure-sentinel-solution-netbackup ".
If yes please replace it with this offer id

[v-prasadboke]

Tactics, relevant techniques and entity mappings is missing from this analytic rule.
Also add required data connector field and can be kept as null. A validation check is failing for requiredDataConnectors.
requiredDataConnectors: []

Need more changes and accidently clicked on approve

[v-prasadboke]

Please add a custom table named as ' NetBackupAlerts_CL ' in path https://github.com/Azure/Azure-Sentinel/tree/master/.script/tests/KqlvalidationsTests/CustomTables
You can refer any table from the table for more clarification.

Please repackage the solution after making the above changes.
Thanks.

[v-prasadboke]

Hello @swapnildombaleveritas, Please respond to the above requested changes.

[v-prasadboke]

Hello @swapnildombaleveritas please respond to the above messages.

[v-prasadboke]

Hello @swapnildombaleveritas Please respond to the above comments

[v-prasadboke]

Hello @swapnildombaleveritas, We know you may be busy into something and havent got time to check this. But just wanted know the progress on the above requested changes. Thanks.

[v-prasadboke]

Hello @swapnildombaleveritas we are waiting for your response.
Thanks.

[v-prasadboke]

Hello @swapnildombaleveritas, We would like to hear about the progress on requested changes.

[v-prasadboke]

Hello @swapnildombaleveritas, We wanted to check on the status of PR #9047 . PR is pending for more than 30 days. Please let us know if you need any assistance to review this PR. Per our standard operating procedures if no response is received in the next 7 business days, we will close this PR. Thank you for your cooperation.

[v-prasadboke]

Since we have not received a response in the last 7 days, we are closing your PR #9047 per our standard operating procedures. If you still need support for this issue, you can re-open the PR at any time.
If you do re-open, we simply request that you ensure the PR has response to the last request. Thank you for your cooperation.

[swapnildombaleveritas]

We will reopen the PR