From 124d8bdef33da88d2c1bb44daf10a214bac599f8 Mon Sep 17 00:00:00 2001 From: Murali Krishna Dev Uppugunduri <139563098+v-muuppugund@users.noreply.github.com> Date: Fri, 15 Dec 2023 13:40:24 +0530 Subject: [PATCH 1/4] Updates --- .../Data Connectors/AzureSecurityCenter.JSON | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/Microsoft Defender for Cloud/Data Connectors/AzureSecurityCenter.JSON b/Solutions/Microsoft Defender for Cloud/Data Connectors/AzureSecurityCenter.JSON index 1dd88b5546a..050a144c2b1 100644 --- a/Solutions/Microsoft Defender for Cloud/Data Connectors/AzureSecurityCenter.JSON +++ b/Solutions/Microsoft Defender for Cloud/Data Connectors/AzureSecurityCenter.JSON @@ -55,7 +55,7 @@ "customs": [ { "name": "License", - "description": "standard tier is no longer required. The connector is available for all deployments of Microsoft Defender for Cloud." + "description": "The connector is available for all deployments of Microsoft Defender for Cloud." }, { "name": "Subscription", From e2da9a0968b34193ff84e5f7869de776b074d4a5 Mon Sep 17 00:00:00 2001 From: Murali Krishna Dev Uppugunduri <139563098+v-muuppugund@users.noreply.github.com> Date: Thu, 21 Dec 2023 16:45:21 +0530 Subject: [PATCH 2/4] Packaged it ,but waiting for review based on that will push the packaging for any major change --- .../Solution_MicrosoftDefenderforCloud.json | 4 +- .../Package/3.0.1.zip | Bin 0 -> 7015 bytes .../Package/createUiDefinition.json | 4 +- .../Package/mainTemplate.json | 194 ++++-------------- .../ReleaseNotes.md | 2 +- 5 files changed, 43 insertions(+), 161 deletions(-) create mode 100644 Solutions/Microsoft Defender for Cloud/Package/3.0.1.zip diff --git a/Solutions/Microsoft Defender for Cloud/Data/Solution_MicrosoftDefenderforCloud.json b/Solutions/Microsoft Defender for Cloud/Data/Solution_MicrosoftDefenderforCloud.json index 5a29491e509..fb60ff1ba40 100644 --- a/Solutions/Microsoft Defender for Cloud/Data/Solution_MicrosoftDefenderforCloud.json +++ b/Solutions/Microsoft Defender for Cloud/Data/Solution_MicrosoftDefenderforCloud.json @@ -8,10 +8,10 @@ ], "Data Connectors": [ "Microsoft Defender for Cloud/Data Connectors/AzureSecurityCenter.json", - "Microsoft Defender for Cloud/Data Connectors/AzureSecurityCenterTenantBased.json" + "Microsoft Defender for Cloud/Data Connectors/MicrosoftDefenderForCloudTenantBased.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions", - "Version": "3.0.0", + "Version": "3.0.1", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": true diff --git a/Solutions/Microsoft Defender for Cloud/Package/3.0.1.zip b/Solutions/Microsoft Defender for Cloud/Package/3.0.1.zip new file mode 100644 index 0000000000000000000000000000000000000000..6737c1d0c12edbf45ae2922b9847dbfc92eb0348 GIT binary patch literal 7015 zcmZ{pRZtvIv#ker4Gx35Yp@|`aCetM2MzA-E(z}LWC*UoCAdo1WDDnHx>2uBs1UYH_m55nzmayBMGvOC~S2cFL(TtfhS>c6~ zNe`>V81@Oz^Ycvq^u>e^KBeCzR6BX5Kakyr5&^3 z$mE`l-};oo`Z0906_2v{TDa}I?jn<+g~^#LOz(R123ATBwpw<>7yi&x_Q|C-d_+7T zB+6}vjwztr$(d23&`OmcBWL}nws~+}(w%U5_|&%Nj@yL``Q;L81<7wn!qHqOFt9;h z=Wu1kr167}we^V^4jPSaAC^7avP=4r|F4p!Ht2nE%;)aV+mrD$w;F9h6blhI7?4#a zXF|XJVVdBCAuF4&0j#oa8GK6!aXn61D*+0!Bd^Wayigq;IU?2onE-ffH4mKt4-#e# zuv(JeSL@d;ktC&UI+TO_X|hs#w26_KOCp~bs@eW+Zi}pWWNs>P&L(`2qYE$EH|vl= zdWhK?9z;NGu_}PGl_xSx3kP(pg{JYs=0preHYMX+pFq1l3YU8GHjZo4aytM8Iaus( z5;&{ix||rL4cu7S7G`k{ z;N~%e9AfnL>fahr(`^8kxN)LZ%~i>ZFkRy$(tn{uiOf}zsZ z7ZUd2u~_V?1|4JPI3)W+n$WJ95%QoH z=lWK2{xxS0jKj~e*4G_N9A9YPg_Tf2JO{rfsW&qt@bj3ac3Yu3a+FH1;iVVtInag% zK_ZX<@sE5Lx|d4?5#2wij_PTu=od|sMu{qU0|oo#r~_Qj48nuzpL6}+oPmQ${)V)@ z+}108>&p7IZV?KUK^&3WlLs;=?gTe_w}vd2>>~}VHlJL57i8h$ zqNiHscbxYh2>oY93U3Z<e)|60wW!h*M}%qXRQuQcn%2NV znD6c(Ad)qr-1P#d12L9vf|#D?E-DRy=%$c3_?yMwNDHSZvoglm!C)!>31j9#ycMJJ zsy$q`M5xID?jkX-$mAVTLR7$CRQh{FMX!&{WGhZEK)hMKO zh+h|aTxSEHA;|NsjXNmLu6IhH%Bu{mxytqV!f}fI1%ekPLPX{W7wPG^7%#q*K zEf@4Pen|?;P%ruc`FhJS?0eoKqy=^>IX+J{x0^Wvf8nJvs=!n2lK#mf??`A1n&AJk zqkVs#S>qFm!eYg7v|Yi2&lI_VXFixrDSM`*(lKEp3%N$>1L_N?SQtT~h&I$gLd?dHm6p?Cr8v84;=% z?RONJi+atqtun>b@z@%uN1^7~^4jM2$2Z>NpgHVd(IhUbqU$29%Ce&lm_SyaP9)M# zw&L$uJm-=AdU!}OJGGUrotV||?gy^#axaeVj^VT7bTac#D&TPK3;49?->`;xgGv9) zBJEnNL}C7}<@|CUt(i`vB6p%jZO?&I&ra{~8>05@r~gmnlnZg`?`O~m7)`cA$$F4I zhx|{*?w_)+gd9sC0>@7`2^73ax#=G!vT!yozudD+DinozW(nqfnx&seoRCiPm7YL# zI@9rD$jFbGChvU;KaQXOe)E0maanC1H6nSIjA%&op+DlIJ4l4HUfeUn3~}%S2AL-# zqyv0Sl3WLGumdnx5;Qc$9+;&{!^_k~H(TAJk7G)z9Hj}nv%xrGD03l}HOAs2v@^0Q z1P&=knz|Ke0h?l5C+Aen4^G%`#HcPun_2BX38$l*3(9BM98iE;TB6*$<1;7vmt(c` zgy-90Kn$?iZYXYIW{~aPk`^=F8c8X;?C`CUWjB(%?RSy#l%wjdbY!ss4e_!7iI+$+ zG#zN1h4od95Fa?3#gT+tcSlryer)Gv;e$E@(tUnyp-cm=X4>BRV?*Xhd2QFcX0f63M008G7QaG4F95pQ+zS#c*i~oTMBVX6GW}Nq* zJdcuE1hD@)~W# zq-+kZ)L(I_t7heuoX3x`13Tr8Ny{Skd!BNtvNWhtFkK{aj;3n%+=1{|J6a=9QF57t zpQ6me^mzczng`zGghct&Gz zBz~Yuv_I^7J`yt7m=>*C2tTGFtmqj!iLn&+cfGMRW5?iPR}O`-tgD&#k7Bze7HStz zQw7H8dYy2iy)RPi>NhOuoIgK5>l}M?K-YRQ^?vKuzhEs;Tn4KaK23!p2wqlp!~kRa zb$>)bv|V8S?mmnUZtbxu_o1?6&8*Fi6fUvPIUtgS@1VwzvfVpqpD8W=GByF7gueU$ z+gcdIK7QU%HJ?h=&wBTU|6`q!s){ga@5cZFstBeBI8_8-YR#ApMdjY10}XCpe_6Rt zUhxb0@&Y4uqQ?R{-|**c)m717{eO)~3C>lPp*!7%RGy18e4Ys%9eBE`f8DznW4I38 z+L19KL;wEs<>m6r({dKb=VceA)I?-af0k68;8$ItsHqkynSqMR`t6&b ze6?y>Nz`%Z$=spZ+^u%b6QwWFMCxsaqs}lG{O(sFG8O*|cV}8ultH z#KguC?bSQQZgK>Bj^vlAG(Tfkv{P8|4k6ad<;bL+}R?Ha?Qj#cfjC=6|41L1_ z)a;qajgizdUAsr_=rTEaiUBEyYWt#7_=4C1)v6OCEcBGs2;lFhN^D#;>y#!{qfvwbGP^s21YG^0FPW%w93pw zdHm1@YZiUxxA?%PdXo3X@Jp2rlJ}broNo|?9S$_cElQJGl1uXHg95I}Ep!uyW}AaJi>)r{->y|CB*fUm1G>{8IDs zL$+x+S!R2xtr%*y`V5bKkUwAC=b}Gw_UZ1L;pgp4Mf$2XwzLSwVk-e0-K+&DrJj6? zRd0Aw7SKNgz6;c)!1!tCJA1v!IeZyCLy}gTv)`6GhbhS6pr?+hq0)U{(j1ELRml)` z4XGQXk8|M*NF6VvFMNxE3T{$!F)Xn>$k~vEZUN+JdOmWJOV@?d;oyB>6vh@5lftnN zYXEZ;sXSP#5gd9Jom(lJw8;ZSiRBpl*Q8Z%mn%UTLp$5 zgo4Tt+#Wo0q^wYSfv1KHc-J0FK`62fE2@qg9{`F|5m$lr-c=0fR;!QuKqgLABIof{ zOZ)?VF5-cAzec?ICBZm`Y8L8wX~xDgaqG9hs0=mxtJ4mmg=Dfq zGC|*1c3Uj+?b(e_Q+Vza)m|-6~UKUyEsG%L#}YDf;D$+9HTBl3dlsIXHx6^;FxG2TCREM&(f$ zRow~lmOm;Mfat1gS#$nT>}-URo7~4cnI2i`uuc5Ro#_4E&L<~iUO{sE-HJ#=mEu8z z#O~i6Vb&Ww8NlgF^bwPL=TA5R61HB8CcPgEgmY4^36Ok%rPiVL1xKsIyNlc-mXWpZ zBt6sH7Jj=uf0(i!eR(Ky%f+boo;dk8Vu{K_ir-U+AM|qWPxLqfv)Q6b|Clqa^bj+~ zv1TNYpDl>7&-Pt&e;-snLYLw>esx%!8#YKP-u73;H}G=(!bd4;o^&|=2^Wk0LhRB{ z(^;cvMAK%EY3M=VZv14au;%5UN_%x$53+{ZXo0sYlAcW=+lC6YnpcQzO3LvT=>(sVGm- zO;LrAE-MWRgj#+Wp8<7)Kl-+z`7%HLViQw<3Y$&x93n5mMgN@F(B==)rcQw zM)=y4P;1H6-)>xAK5TY*b8q)jC%?r3t3~(n2mwR#%T(@y@}e{qTJ6_ZvYntF?a8Jk z_l4|XHZufu(zp981eK=!TFsOtu`QW;y zg2%19Fu`+we_^o;=4@`1_soYBg|_}+#;SZ>xhjJ*^UlQ*iLu^4cSWBYG(wWIMC&`1 zt+GmC6lG3jLTka0Ulkfk-pgwWlV1HKeafpt&F zgCH7z^#%1+qfmB5VD+O~T|7bE7pGJTpyK{a#*%xe-h%!!J89YY}Trxp)4lBg=B&Toeqz$m!};rRI=BRtnO0|i2C zd>g$p%Hw0o1Cyv=IeqD-%rg43<2enxR+D|3+x#q@#ZtsH7V2-Jyf!(^=22~0aH~4* zO$#p?2KXi#~*!pIp&?ocwBIxQ$FH+#mm@ih>hi@eAwgE3|aaZ8!`Z9~4vD z_w=rIO|VI>T%3Xah@FYEB7~C!9`^BX9yO+%dtQQ^RXcBK-ah-R`mu$phbg09Q>0`X zT1yLdO7AvZVw0`-P7=)PpOUU(e6?HJ8uO?YoS^6|n286j)!w6F((3ODlDDl(*sy=G z{DI_71sWV>mbD;>&KTi>#Z2mS->JJ;)+UOI6431F0nj^%r6)y%4~bHaEx7NB*&wiZ zV;49_Z0{xr)c!@B|4ZZ21~2dOu6gpI4;<(7z*4na9Q9d}C-xJsnuvLLC1nvD8n^s3 z_f>nJorYv>Jn#!j`!p77`dA4tHY#E)KZv{X39)7{s&SL4c?72cI>Lks z9vQ>wlok6=}4h?NK& zR0HjJp6aPh16yILd|E&@*^&11-ltUX)@rL9dds1>Bn_|hk)%f1w$6R}=UB?5%s{?9 zd>J<^-sOUpB7$uRq6y#Bs?{_+^S{Sk2i}-Oq>?~&uIh?FCivy(mQ9K@r90Vcix0eI%&I5Os{Swv@ zUR&(~X6X-`^v=C^bI<2?xjT`t#=?L)ESN^evmfI2&o;~~TC>L#r z7d2pdQa}zcXaWhIH`W`2&VfJF{jZlM%a=0^q`j^_MFR7$L>eQmVAgW4WKD!L>C@&b?6)Zp z+GMj|Y~LKVe+!n$7ag@+x0;B1cfB;Fr>wtPM13Ye#OCPjHDGx2enORvm7=EkV_JAH zV891$1n#2XhDc|kC%47H?CM6@(e6I!=Y)%?um{B4w%e2jRM!1!(oZ{|Mg0`q7((dW z`mv!%NnX5KqbOf9p_hHIz?;*93Gp6HK=FM;10DT%5CaUDyUzlfo;aj~p$c4##{=wx zo94<~8ICN2n|awazE*^a=h;T8kb-LAHA_N!?iHtRMyg5o>>UMjs5@_%;OZ5G)J4w~ zgzYKzj?GuG#*UMar;`w0$+C`t5TMj5kb0et(w+gvEIn{q9LGK_7W#^A>d>SoVzTiqb=6GAX!W>R2|U5jtDyns4X}5>tjIICV7-$v-Z%5| zL*8obF(LaIHlF((Yxt1EWu$XQA$k6*F@2!yC^z`JSnvBcoU(3&icO?|9VE~0e(%1A z8c)^$oX6`giiwvbo}H`4VZSe=xTR22yu<s$f=wclFNE6}R2xSbJHr;7Q{=U9Xb{>Qv7|mG%DpiV+X?XUk_Fw%>bV0=7IT=}?Z7cz)tWR;&#%1_iaFcm`G)ZHY(%(X0tmE_4) zq+iVqqh@%3Wv0W31ed)qXq*X$MN?`@nM?xwu%v+}!=)rmE=f=6K3thdw5_3&6JLIY z?FVZ^A7|U%{tb?iJ$Hyz=0?3WPj-!{gU#;_5Q)(i?y|yfZymBzRU3bVZtFyeSNAA_|4lK8ZGp#c?CTlH-u19r|!s2wt6BUFB@n5u=0HWRxeT zlA8LtumKiva4iB?5NCX?=@VZe%BrMxTG_R_vh>W|EDP?pzG3m;-TgS}Zbh0@llTgf z7^2wsBo8GkWrQ%jrOqp|z9w0h?9CB+QO5{OB?@0#7?S2XRD>`|k4}WGK<7DCCg!JiNLX|$x3)j(U zvL746Y+K|!tM={D-wS_XHbVj#OU4QlJvK-ky;n=tQE(mj^bGxW6Mpuo7Z@1@T>Wrc z@R^cN-*M31Vf(J-*IEs1@s8KkikndUjxy_bxcNAQ#30Hmd~3EJPs8VKz!7>il^Zp@ z@4|&;SpRaj#Lz!V_<6tbPQlV)X`DN-=KR(NdTJI+DdMZf%V}V!XxNZHarbJ0?D?{} zC+1}f_>L`+oZ&Ur9Bm*P+WtoBUgSFJiKPuNgB5mEym&oPxj26Zs4Bp~;sO5mIP0JN t^nacICEWVYCjV(*{htmR|B|x*&(2a+KtTNOFR=e^*gu{47o`CJ{{>vVMLPfh literal 0 HcmV?d00001 diff --git a/Solutions/Microsoft Defender for Cloud/Package/createUiDefinition.json b/Solutions/Microsoft Defender for Cloud/Package/createUiDefinition.json index 406484d801b..b72f642f489 100644 --- a/Solutions/Microsoft Defender for Cloud/Package/createUiDefinition.json +++ b/Solutions/Microsoft Defender for Cloud/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Microsoft%20Defender%20for%20Cloud/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Microsoft Defender for Cloud](https://docs.microsoft.com/azure/defender-for-cloud/) solution for Microsoft Sentinel allows you to ingest Security alerts reported in Microsoft Defender for Cloud on assessing your hybrid cloud workload's security posture. \n\n**Underlying Microsoft Technologies used:**\n\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs: \n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\n**Data Connectors:** 2, **Analytic Rules:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Microsoft Defender for Cloud](https://docs.microsoft.com/azure/defender-for-cloud/) solution for Microsoft Sentinel allows you to ingest Security alerts reported in Microsoft Defender for Cloud on assessing your hybrid cloud workload's security posture. \n\n**Underlying Microsoft Technologies used:**\n\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs: \n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\n**Data Connectors:** 2, **Analytic Rules:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -67,7 +67,7 @@ "name": "dataconnectors2-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Microsoft Defender for Cloud is a security management tool that allows you to detect and quickly respond to threats across Azure, hybrid, and multi-cloud workloads. This connector allows you to stream your MDC security alerts from Microsoft 365 Defender into Microsoft Sentinel, so you can can leverage the advantages of XDR correlations connecting the dots across your cloud resources, devices and identities and view the data in workbooks, queries and investigate and respond to incidents." + "text": "This Solution installs the data connector for Microsoft Defender for Cloud. You can get Microsoft Defender for Cloud custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { diff --git a/Solutions/Microsoft Defender for Cloud/Package/mainTemplate.json b/Solutions/Microsoft Defender for Cloud/Package/mainTemplate.json index c8518c9181f..d3b7ecf6ccf 100644 --- a/Solutions/Microsoft Defender for Cloud/Package/mainTemplate.json +++ b/Solutions/Microsoft Defender for Cloud/Package/mainTemplate.json @@ -33,7 +33,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Microsoft Defender for Cloud", - "_solutionVersion": "3.0.0", + "_solutionVersion": "3.0.1", "solutionId": "azuresentinel.azure-sentinel-solution-microsoftdefenderforcloud", "_solutionId": "[variables('solutionId')]", "analyticRuleObject1": { @@ -41,22 +41,26 @@ "_analyticRulecontentId1": "011c84d8-85f0-4370-b864-24c13455aa94", "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '011c84d8-85f0-4370-b864-24c13455aa94')]", "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('011c84d8-85f0-4370-b864-24c13455aa94')))]", - "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','011c84d8-85f0-4370-b864-24c13455aa94','-', '1.0.1')))]" + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','011c84d8-85f0-4370-b864-24c13455aa94','-', '1.0.2')))]" }, - "_uiConfigId1": "AzureSecurityCenter", - "_dataConnectorContentId1": "AzureSecurityCenter", + "uiConfigId1": "AzureSecurityCenter", + "_uiConfigId1": "[variables('uiConfigId1')]", + "dataConnectorContentId1": "AzureSecurityCenter", + "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", - "_uiConfigId2": "MicrosoftDefenderForCloudTenantBased", - "_dataConnectorContentId2": "MicrosoftDefenderForCloudTenantBased", + "uiConfigId2": "MicrosoftDefenderForCloudTenantBased", + "_uiConfigId2": "[variables('uiConfigId2')]", + "dataConnectorContentId2": "MicrosoftDefenderForCloudTenantBased", + "_dataConnectorContentId2": "[variables('dataConnectorContentId2')]", "dataConnectorId2": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", "_dataConnectorId2": "[variables('dataConnectorId2')]", "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", "dataConnectorVersion2": "1.0.0", - "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", + "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ @@ -69,7 +73,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CoreBackupDeletionwithSecurityAlert_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "CoreBackupDeletionwithSecurityAlert_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -102,8 +106,8 @@ "SecurityAlert" ] }, - { - "connectorId": "MicrosoftDefenderForCloudTenantBased", + { + "connectorId": "MicrosoftDefenderForCloudTenantBased", "dataTypes": [ "SecurityAlert" ] @@ -117,6 +121,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "identifier": "Name", @@ -126,19 +131,19 @@ "identifier": "NTDomain", "columnName": "NTDomain" } - ], - "entityType": "Account" + ] }, { + "entityType": "AzureResource", "fieldMappings": [ { "identifier": "ResourceId", "columnName": "_ResourceId" } - ], - "entityType": "AzureResource" + ] }, { + "entityType": "Host", "fieldMappings": [ { "identifier": "HostName", @@ -148,17 +153,16 @@ "identifier": "DnsDomain", "columnName": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "IpAddress" } - ], - "entityType": "IP" + ] } ] } @@ -214,7 +218,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Microsoft Defender for Cloud data connector with template version 3.0.0", + "description": "Microsoft Defender for Cloud data connector with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -229,7 +233,7 @@ "kind": "StaticUI", "properties": { "connectorUiConfig": { - "id": "AzureSecurityCenter", + "id": "[variables('_uiConfigId1')]", "title": "Subscription-based Microsoft Defender for Cloud (Legacy)", "publisher": "Microsoft", "descriptionMarkdown": "Microsoft Defender for Cloud is a security management tool that allows you to detect and quickly respond to threats across Azure, hybrid, and multi-cloud workloads. This connector allows you to stream your security alerts from Microsoft Defender for Cloud into Microsoft Sentinel, so you can view Defender data in workbooks, query it to produce alerts, and investigate and respond to incidents.\n\n[For more information>](https://aka.ms/ASC-Connector)", @@ -373,7 +377,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Microsoft Defender for Cloud data connector with template version 3.0.0", + "description": "Microsoft Defender for Cloud data connector with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -385,15 +389,13 @@ "apiVersion": "2021-03-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", + "kind": "StaticUI", "properties": { "connectorUiConfig": { - "id": "MicrosoftDefenderForCloudTenantBased", + "id": "[variables('_uiConfigId2')]", "title": "Tenant-based Microsoft Defender for Cloud (Preview)", "publisher": "Microsoft", "descriptionMarkdown": "Microsoft Defender for Cloud is a security management tool that allows you to detect and quickly respond to threats across Azure, hybrid, and multi-cloud workloads. This connector allows you to stream your MDC security alerts from Microsoft 365 Defender into Microsoft Sentinel, so you can can leverage the advantages of XDR correlations connecting the dots across your cloud resources, devices and identities and view the data in workbooks, queries and investigate and respond to incidents.", - "logo": "Microsoft.svg", - "graphQueriesTableName": "SecurityAlerts", "graphQueries": [ { "metricName": "Total data received", @@ -401,22 +403,6 @@ "baseQuery": "SecurityAlert | where ProductName == \"Azure Security Center\"" } ], - "sampleQueries": [ - { - "description": "All logs", - "query": "SecurityAlert | where ProductName == \"Azure Security Center\"\n | sort by TimeGenerated" - }, - { - "description": "Summarize by severity", - "query": "SecurityAlert\n| where ProductName == \"Azure Security Center\"\n| summarize count() by AlertSeverity" - } - ], - "dataTypes": [ - { - "name": "SecurityAlert (ASC)", - "lastDataReceivedQuery": "SecurityAlert | where ProductName == \"Azure Security Center\"\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], "connectivityCriterias": [ { "type": "MtpAlerts", @@ -425,54 +411,10 @@ ] } ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "tenant": [ - "SecurityAdmin", - "GlobalAdmin" - ], - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "read": true, - "write": true, - "delete": true - } - } - ], - "tenantMember": true - }, - "instructionSteps": [ + "dataTypes": [ { - "description": "After connecting this connector, **all** your Microsoft Defender for Cloud subscriptions' alerts will be sent to this Microsoft Sentinel workspace.\n\n> Your Microsoft Defender for Cloud alerts are connected to stream through the Microsoft 365 Defender. To benefit from automated grouping of the alerts into incidents, connect the Microsoft 365 Defender incidents connector. Incidents can be viewed in the incidents queue.", - "instructions": [ - { - "parameters": { - "connectorKind": "MicrosoftDefenderForCloudTenantBased", - "enable": true, - "newPipelineEnabledFeatureFlagConfig": { - "feature": "MdcAlertsByMtp", - "featureStates": { - "1": 2, - "2": 2, - "3": 2, - "4": 2 - } - }, - "infoBoxMessage": "Your Microsoft Defender for Cloud alerts are connected to stream through the Microsoft 365 Defender. To benefit from automated grouping of the alerts into incidents, connect the Microsoft 365 Defender incidents connector. Incidents can be viewed in the incidents queue", - "shouldAlwaysDisplayInfoMessage": true - }, - "type": "MicrosoftDefenderForCloudTenantBased" - } - ], - "title": "Connect Tenant-based Microsoft Defender for Cloud to Microsoft Sentinel" + "name": "SecurityAlert(ASC)", + "lastDataReceivedQuery": "SecurityAlert | where ProductName == \"Azure Security Center\"\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ] } @@ -514,8 +456,8 @@ "contentId": "[variables('_dataConnectorContentId2')]", "contentKind": "DataConnector", "displayName": "Tenant-based Microsoft Defender for Cloud (Preview)", - "contentProductId": "[variables('_dataConnectorcontentProductId1')]", - "id": "[variables('_dataConnectorcontentProductId1')]", + "contentProductId": "[variables('_dataConnectorcontentProductId2')]", + "id": "[variables('_dataConnectorcontentProductId2')]", "version": "[variables('dataConnectorVersion2')]" } }, @@ -554,7 +496,7 @@ "apiVersion": "2021-03-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", + "kind": "StaticUI", "properties": { "connectorUiConfig": { "title": "Tenant-based Microsoft Defender for Cloud (Preview)", @@ -569,7 +511,7 @@ ], "dataTypes": [ { - "name": "SecurityAlert", + "name": "SecurityAlert(ASC)", "lastDataReceivedQuery": "SecurityAlert | where ProductName == \"Azure Security Center\"\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], @@ -581,81 +523,21 @@ ] } ], - "sampleQueries": [ - { - "description": "All logs", - "query": "SecurityAlert | where ProductName == \"Azure Security Center\"\n | sort by TimeGenerated" - }, - { - "description": "Summarize by severity", - "query": "SecurityAlert\n| where ProductName == \"Azure Security Center\"\n| summarize count() by AlertSeverity" - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "tenant": [ - "SecurityAdmin", - "GlobalAdmin" - ], - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "read": true, - "write": true, - "delete": true - } - } - ], - "tenantMember": true - }, - "instructionSteps": [ - { - "description": "After connecting this connector, **all** your Microsoft Defender for Cloud subscriptions' alerts will be sent to this Microsoft Sentinel workspace.\n\n> Your Microsoft Defender for Cloud alerts are connected to stream through the Microsoft 365 Defender. To benefit from automated grouping of the alerts into incidents, connect the Microsoft 365 Defender incidents connector. Incidents can be viewed in the incidents queue.", - "instructions": [ - { - "parameters": { - "connectorKind": "MicrosoftDefenderForCloudTenantBased", - "enable": true, - "newPipelineEnabledFeatureFlagConfig": { - "feature": "MdcAlertsByMtp", - "featureStates": { - "1": 2, - "2": 2, - "3": 2, - "4": 2 - } - }, - "infoBoxMessage": "Your Microsoft Defender for Cloud alerts are connected to stream through the Microsoft 365 Defender. To benefit from automated grouping of the alerts into incidents, connect the Microsoft 365 Defender incidents connector. Incidents can be viewed in the incidents queue", - "shouldAlwaysDisplayInfoMessage": true - }, - "type": "MicrosoftDefenderForCloudTenantBased" - } - ], - "title": "Connect Tenant-based Microsoft Defender for Cloud to Microsoft Sentinel" - } - ], "id": "[variables('_uiConfigId2')]" } } }, - { + { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.0", + "version": "3.0.1", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Microsoft Defender for Cloud", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Microsoft Defender for Cloud solution for Microsoft Sentinel allows you to ingest Security alerts reported in Microsoft Defender for Cloud on assessing your hybrid cloud workload's security posture.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Azure Monitor HTTP Data Collector API
    2. \n
\n

Data Connectors: 1, Analytic Rules: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Microsoft Defender for Cloud solution for Microsoft Sentinel allows you to ingest Security alerts reported in Microsoft Defender for Cloud on assessing your hybrid cloud workload's security posture.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Azure Monitor HTTP Data Collector API
    2. \n
\n

Data Connectors: 2, Analytic Rules: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -690,7 +572,7 @@ "contentId": "[variables('_dataConnectorContentId1')]", "version": "[variables('dataConnectorVersion1')]" }, - { + { "kind": "DataConnector", "contentId": "[variables('_dataConnectorContentId2')]", "version": "[variables('dataConnectorVersion2')]" diff --git a/Solutions/Microsoft Defender for Cloud/ReleaseNotes.md b/Solutions/Microsoft Defender for Cloud/ReleaseNotes.md index d4a8ae0d85a..7ce84291277 100644 --- a/Solutions/Microsoft Defender for Cloud/ReleaseNotes.md +++ b/Solutions/Microsoft Defender for Cloud/ReleaseNotes.md @@ -1,4 +1,4 @@ | **Version** | **Date Modified (DD-MM-YYY)** | **Change History** | |-------------|-------------------------------|-------------------------------------------------| | 3.0.0 | 08-11-2023 |New **Data Connector** included | -| | | | +| 3.0.1 | 21-12-2023 |Corrected the standard tier | | From a1a9f53b6b835b2c197d85279c9cf380ec324c3c Mon Sep 17 00:00:00 2001 From: Sentinel Date: Mon, 18 Mar 2024 14:21:32 +0530 Subject: [PATCH 3/4] CorrectCreateUi file --- .../Package/3.0.1.zip | Bin 7015 -> 7220 bytes .../Package/createUiDefinition.json | 9 +-------- 2 files changed, 1 insertion(+), 8 deletions(-) diff --git a/Solutions/Microsoft Defender for Cloud/Package/3.0.1.zip b/Solutions/Microsoft Defender for Cloud/Package/3.0.1.zip index 6737c1d0c12edbf45ae2922b9847dbfc92eb0348..fb69418af24ff84db7d35261f58b08b2f3d897f0 100644 GIT binary patch literal 7220 zcmZ{pRZtxOlcfpn7Thin{NnEJ?he58zRELu3IGC9=E!yHT@?W7wL_ZngAxVm_f7P@*TEAB3Mi1I$V=!i!ThX;& zg`t;u75SJ{hy`(IY078iV7Ib17?{ux4@gQL)+WDMX4t25%vPE25f8TRNOlx!V{76` zyY7?S#L@$=S8%PS`T)+lXEq&DzpRaeDbcS-e%~rRWx%(~=-<7b znYT>F$A1*&aP#q+XvsPP(=lv~)8{8CgKL^qy@8D=dQr`s!DExWwOBPXJ&Tp3A=BWw zI`iR=zX<^it($4xcJ6nYKi6f_yNQ=^(v}463)w^$+paVpgF9U!mL$H+h42gE>%o#_R%Q)4yzi`$Cr1W0t7jSGy0u6HG^|9Sz7)EZi*LKq)mv2q?I)j_CI`dtpr@jW2e3*Z22u5!sG-xHI{^wk96 zJ3?D85+Z6Re#SrLcPex7e6a`!k!^~_&{u!)PhB(~>wbm?sLz&6X? zlLI;HEFzpL?qo+jHNJgaUlS8)TO`)^;vS0R#fIK3_OfW$G|AW6%+_6YJu#ERQciC6 zIgdMEsMTe;pp(Vb*06j(H{1XjRz3Q=l%j&$ESIp<&|{vwr{aSyP{)L3H9CtA-Mj*V z0=dMW*6zNn!2@EgYvt^&F>98F+wF=;QiDiEcSubr0yZEmQH*D10_U(_;#FUxdN)xxZi%DKtl9<;m-Gb4KIVI)K_l zXOHh1?w?t?^plkXmn}ybjeo zTJ|SyF#0XZm2kqwkp3u+ZQoP<7n||%FDV_|r}7fRL0Qg~U^eKn?h9+KuvjmgXVm5& zJgd3sx__9DJ1+}f8@~(Xd33Xt`+K~U{7wr+wsYLx4@vV%rB`u zIYQZnj|>?&#)FOfXh+I%TdOndIit=nM){s;NHF#B83jV6O67d9Sxl#;(UyoFP(VZN zB{=KJI)(L4NO=#QUH6_J0pmU#PV7Dfe66Sz&P~Q^GTosuF%aEsX=JqxxZB~CFG^tb zcMIboR*x$IOi(vny6nX4zDisQdG#D^sVL5`^ar(^`tYet#XY4;d0e?H&{OhT;c$B^ zDKYrhvIcMCw>t16eGa?yJ=epR^cGa{Gutz(3Y<*b93%(?)hFA1Z4Nd*WabNhhVay$ zS3~{dE?=$Elam*#ywffw(+T{3Xmb0@2uPoQRnws)kC-m|RVJyTT9R*4;iodG8m=(% z#U@{dLq*jxxv0Rpes_VcXT;4Zc`4TF>QKo!c?^4L@<$9BMX}(DrumfRk?c;=-)t*7 zA{KAn1rU{SOC+X)rr%l;qxv}q1|hSeUqk%@CZG4EE;bI8?phCx!bBPKAlqB-!7wn^ z=86Fl<3v5$IzI6OgNeSGMB2S{^i1O$XV`8jwrN;4+;fr+9-}@;>E&whv5Yp>TPLq z$S+uM(wb_I4xjEnqBWnnIdw zrV&#w^QKY~g9eVfLX3AyqK2e{-zh%6{2N)meCs}f>shgOIBg%q15;pLN9!TUUgxdX zyiH+wqh~|tM}G@44_~ySjM#_ky#0?%iG@-O)oVh-Ksok!P5;Pz2O{8odvD}u;x#w? z8}rMAu7OxE1t!ZBfy_4d>AJ@rJk>W9QFNUrvN6Y;I+(j3IMEX$wSYB&p<5YDteHee z6=8>Xise=-iW4Qqe$X+a5jP+~bVQF%HIaJ6XR6D*DY!G`ykQE5-MuKUf-uGjAUgcc z-2_f30KoBee&d*sAkmT#L}0WJQ%sy$@HvyBIGiL&tl}moG39KO*-r^{R{d_WIJ?KK_LVsByqgukO5~bo2qjK;wa&555+x z=-sas!=bv>Jao+=r99zF;}1d?)3`emb*U(DNw0+g0JPJ`I%Y@1cL|ZcbKV_^tCEWp@S>%M(J_y$Ic>hE4xV12 zzU&duy@r&|iV>i`hJal@Fxaf!`54;44A%vEKO1LSP33ChOehMMe^8gvr+L}ocY(zU zUqS>?UU$*Rt@+ZLD7j+?K{E^6NjOm@#7fQsJ<8l;Mq@>w>G~^%Z1aIR41xsA7Z%6K zfk}SZIQ*TmLm+9iIIi^C6eD09AUDc1m3+OuA-NJK&N91I0 zc)pgJxQizWrI?|)XeXXLYcK3O$}i@eJPe_R*j@pFJj@?c=~CUte25w4(@SL*dU>2{ zFR*IMq&A%XY%++TfWjLk+qhmsb~jd9!q0mbjt^_3y*zi056ITMiW?<8f&d-ilQ;8H zuI-FY!n^oP-H zmuDqIDq5%a6XF6@1sj8TN}$g`SMYwzJ}$mxosF>e{ytaTKO#4{uLm?-86|Ub2XzY> zcDoh+B9}V%Vblm$FwjTHT{GG92!?7HUx-tOQU(8v&M<~LuP~>_lpyK-k)~*-G48Q} zr9z2?OW6gYTPxe066GjxRWhwPz0k-{&hD0koMr8q%>`ROAfPTxx&C@M3m3rRm?Lk3pgb?AK&PaKz|r$q!}tazjv)<$Q06af7>0ci2aMG^9o1DBOmo z9=;IrxjCndj%=O1O@l5`(wt329DJ{bCD(v@={(4-tR>bGYd~Nz?})R>ZA4Xcinxc# zOZ4+yadA%3h@(1^=ITL^bi6z18z_&)FC1B6h-y4Gk{J*;)<=|>_`M*yhXP4ksT2ys z<{K98mB`U%Z)7A5=kteY=&3ZSa(uQyVa)2Y;kxOAPGxx~x0xTC835|E02AzC)DYi% zCva?vn7HkGa0ibMS3GS}zvuWz%7bX*Lfk)Df@XM3V**ysunU?SOrjcvkNBQpqJ$wEh8N^Z#C`qFz9Rb0x@)2Y_gWRJDD&CyZ zxUvzJi8>RcDa0n9ixDLtBj4@5P1Mpv*qwaJ2 zOmw+!DVnHlEG$V#s;USdj>MRzYvjXjuuM*{)nWH%&g1PF!>G!UA2SwCLV-&M*Q?+ER*vs8vG(Q zy4{;g8GOF7KZNWxEIQJ9*2f*vgkaJnU7m3)6ZoX zLbhGMK^ak!6X6Yy72SwiPoNuy?7`G%#Cm~J;s8hgBo~@7@@T#Hb+Xjlh+?*kWcwE=H*gw{3U=mE0 ziFXn)0v@d@sO^j}6Z?Cg)GBLNft~RVziy{q4WHfr{LZ64$eY!KEktZ3>+1#AF-IoZ z(LrND9Rp+_<3+^|^8XVyS!f7Xe_(QuB8Lj~c16qlOW74&i+7);SxCWw7dr{hZ z;8kFmS>}>gnoa>8AgQ_-gWZNHuhV8%SzPmndv3EaTDa+8O2*G?Ue4@+c_bX9iOY}U zOq-C5C}T?2y6^$*f|CGpHuGReUvjJcrG!Mqt1)=mUJgVub~Be4gp@&gw{vRw?UGXc z!$2FIVSfrLkB!1A<+$7+hsf_VQpI7j!n@^!pB_aa#4xIUV0IyFSmIdUbcwXavP`rr zh{kU3zH_uxTL)!MFq6>2iLW%}*T!kO+evm4W1`9pW zNhUD-msIHxa@H~&(m@yX);FxXa!s^fc$mVfjaOWzmA}bwQl*is!D}sYQ(uYJf(uaX z^_bUjkb!#yZtOzC9RdAyC3`elaB==c`ozAG25P1nbvr6^tW23TMqJPaeuV@tc%W_@ z*cr0hfF+DA{iiCa5{70w-5TcQ$mX@_c+$Xz_no8Rbkl;+u(86+Fx#I{>3^Ev(Dl`_IgnYt~F zbXR2(nQASKDw*&-q>bmv9vulv)j2`k6#`}OfxlgVuh1nadbpe}5(C!*(n|V`ME|00(BCXOff8MB2c+@qAS!8{WLq4e z2Q3UriWI@GHenUZ8a)0iw|=u+F|D&>DUVod!CSxTGk)3HG%*^*m3d@?P$O9I#Yq%( z=l;q(-D1Zw)88zprkrONBeD@@7t;^bg7;IwYY!*H$G+im#X#A($ksyyMnub_JX}x` z|61;taR%-+t^*12cGDf#b)5O~ij;sYdb%_P(0RdFuGn(HXmwVkTXEOYncv>IojaS| z1pH+$SG4j2fZp;BSK8sIpfarwS9>7${ z%(9c@MD-jlPo3bbvOI9}GL0~Bv;MutIW-x)9fcrrxIx(1OeE63_fsFOcr$V3}mdIN~n-#_LMi_uK8+ zM>@%_?fT8)19_^^TPSn+5E36@TF^kqt3jReriE>~AKB|1_mkx)ds@*uOJb`KD(VqQ zU7*9-?_|qY9HzrO)7ds=&0b}0=xSERgrMmT2@F@@hiq?l<_DD-OEA>0r}@I8l0IVA zNmqQy)|W2$@11{mdZ2LjDNL#-X{A|`j_>HX;C)GqO(p4Yo13mMT74qY8+a_AP!+fS zrr|l;np#@@UL6b-=gQPJP4|u^Z>|ZrG#uyJECDUb%(!P1q zPEwPy4O$}!`2R z6$UQI1rMz)-ZH1ir^pX~e{xbLedZ`Cpk9+c_${f9B2f+Mo%|>cWObt>l_&N-;Az8x zO0K$_ZFXCCX84WCgpFa|ha)k#B*uWx_mJ~9`FdtNin6%1h*DeD7e=!ZF+nsd)PM97 zKz9j3T9(Xi@#F}qwb*0$ zUS+j(_Hc#4_7<8{;N3oEJG5Wc&XiwYoZ07AvvCT5xl+wz;NaUkIswlD_&kg)D~+i? z7hN;k97RcT#>_s%TQ;a10{mFAeGOc5ZF<$09En;xL+CDU% zOy?kv$^UF{T#kof!itLG`fEA7FQ#FX^;!1WDDnHx>2uBs1UYH_m55nzmayBMGvOC~S2cFL(TtfhS>c6~ zNe`>V81@Oz^Ycvq^u>e^KBeCzR6BX5Kakyr5&^3 z$mE`l-};oo`Z0906_2v{TDa}I?jn<+g~^#LOz(R123ATBwpw<>7yi&x_Q|C-d_+7T zB+6}vjwztr$(d23&`OmcBWL}nws~+}(w%U5_|&%Nj@yL``Q;L81<7wn!qHqOFt9;h z=Wu1kr167}we^V^4jPSaAC^7avP=4r|F4p!Ht2nE%;)aV+mrD$w;F9h6blhI7?4#a zXF|XJVVdBCAuF4&0j#oa8GK6!aXn61D*+0!Bd^Wayigq;IU?2onE-ffH4mKt4-#e# zuv(JeSL@d;ktC&UI+TO_X|hs#w26_KOCp~bs@eW+Zi}pWWNs>P&L(`2qYE$EH|vl= zdWhK?9z;NGu_}PGl_xSx3kP(pg{JYs=0preHYMX+pFq1l3YU8GHjZo4aytM8Iaus( z5;&{ix||rL4cu7S7G`k{ z;N~%e9AfnL>fahr(`^8kxN)LZ%~i>ZFkRy$(tn{uiOf}zsZ z7ZUd2u~_V?1|4JPI3)W+n$WJ95%QoH z=lWK2{xxS0jKj~e*4G_N9A9YPg_Tf2JO{rfsW&qt@bj3ac3Yu3a+FH1;iVVtInag% zK_ZX<@sE5Lx|d4?5#2wij_PTu=od|sMu{qU0|oo#r~_Qj48nuzpL6}+oPmQ${)V)@ z+}108>&p7IZV?KUK^&3WlLs;=?gTe_w}vd2>>~}VHlJL57i8h$ zqNiHscbxYh2>oY93U3Z<e)|60wW!h*M}%qXRQuQcn%2NV znD6c(Ad)qr-1P#d12L9vf|#D?E-DRy=%$c3_?yMwNDHSZvoglm!C)!>31j9#ycMJJ zsy$q`M5xID?jkX-$mAVTLR7$CRQh{FMX!&{WGhZEK)hMKO zh+h|aTxSEHA;|NsjXNmLu6IhH%Bu{mxytqV!f}fI1%ekPLPX{W7wPG^7%#q*K zEf@4Pen|?;P%ruc`FhJS?0eoKqy=^>IX+J{x0^Wvf8nJvs=!n2lK#mf??`A1n&AJk zqkVs#S>qFm!eYg7v|Yi2&lI_VXFixrDSM`*(lKEp3%N$>1L_N?SQtT~h&I$gLd?dHm6p?Cr8v84;=% z?RONJi+atqtun>b@z@%uN1^7~^4jM2$2Z>NpgHVd(IhUbqU$29%Ce&lm_SyaP9)M# zw&L$uJm-=AdU!}OJGGUrotV||?gy^#axaeVj^VT7bTac#D&TPK3;49?->`;xgGv9) zBJEnNL}C7}<@|CUt(i`vB6p%jZO?&I&ra{~8>05@r~gmnlnZg`?`O~m7)`cA$$F4I zhx|{*?w_)+gd9sC0>@7`2^73ax#=G!vT!yozudD+DinozW(nqfnx&seoRCiPm7YL# zI@9rD$jFbGChvU;KaQXOe)E0maanC1H6nSIjA%&op+DlIJ4l4HUfeUn3~}%S2AL-# zqyv0Sl3WLGumdnx5;Qc$9+;&{!^_k~H(TAJk7G)z9Hj}nv%xrGD03l}HOAs2v@^0Q z1P&=knz|Ke0h?l5C+Aen4^G%`#HcPun_2BX38$l*3(9BM98iE;TB6*$<1;7vmt(c` zgy-90Kn$?iZYXYIW{~aPk`^=F8c8X;?C`CUWjB(%?RSy#l%wjdbY!ss4e_!7iI+$+ zG#zN1h4od95Fa?3#gT+tcSlryer)Gv;e$E@(tUnyp-cm=X4>BRV?*Xhd2QFcX0f63M008G7QaG4F95pQ+zS#c*i~oTMBVX6GW}Nq* zJdcuE1hD@)~W# zq-+kZ)L(I_t7heuoX3x`13Tr8Ny{Skd!BNtvNWhtFkK{aj;3n%+=1{|J6a=9QF57t zpQ6me^mzczng`zGghct&Gz zBz~Yuv_I^7J`yt7m=>*C2tTGFtmqj!iLn&+cfGMRW5?iPR}O`-tgD&#k7Bze7HStz zQw7H8dYy2iy)RPi>NhOuoIgK5>l}M?K-YRQ^?vKuzhEs;Tn4KaK23!p2wqlp!~kRa zb$>)bv|V8S?mmnUZtbxu_o1?6&8*Fi6fUvPIUtgS@1VwzvfVpqpD8W=GByF7gueU$ z+gcdIK7QU%HJ?h=&wBTU|6`q!s){ga@5cZFstBeBI8_8-YR#ApMdjY10}XCpe_6Rt zUhxb0@&Y4uqQ?R{-|**c)m717{eO)~3C>lPp*!7%RGy18e4Ys%9eBE`f8DznW4I38 z+L19KL;wEs<>m6r({dKb=VceA)I?-af0k68;8$ItsHqkynSqMR`t6&b ze6?y>Nz`%Z$=spZ+^u%b6QwWFMCxsaqs}lG{O(sFG8O*|cV}8ultH z#KguC?bSQQZgK>Bj^vlAG(Tfkv{P8|4k6ad<;bL+}R?Ha?Qj#cfjC=6|41L1_ z)a;qajgizdUAsr_=rTEaiUBEyYWt#7_=4C1)v6OCEcBGs2;lFhN^D#;>y#!{qfvwbGP^s21YG^0FPW%w93pw zdHm1@YZiUxxA?%PdXo3X@Jp2rlJ}broNo|?9S$_cElQJGl1uXHg95I}Ep!uyW}AaJi>)r{->y|CB*fUm1G>{8IDs zL$+x+S!R2xtr%*y`V5bKkUwAC=b}Gw_UZ1L;pgp4Mf$2XwzLSwVk-e0-K+&DrJj6? zRd0Aw7SKNgz6;c)!1!tCJA1v!IeZyCLy}gTv)`6GhbhS6pr?+hq0)U{(j1ELRml)` z4XGQXk8|M*NF6VvFMNxE3T{$!F)Xn>$k~vEZUN+JdOmWJOV@?d;oyB>6vh@5lftnN zYXEZ;sXSP#5gd9Jom(lJw8;ZSiRBpl*Q8Z%mn%UTLp$5 zgo4Tt+#Wo0q^wYSfv1KHc-J0FK`62fE2@qg9{`F|5m$lr-c=0fR;!QuKqgLABIof{ zOZ)?VF5-cAzec?ICBZm`Y8L8wX~xDgaqG9hs0=mxtJ4mmg=Dfq zGC|*1c3Uj+?b(e_Q+Vza)m|-6~UKUyEsG%L#}YDf;D$+9HTBl3dlsIXHx6^;FxG2TCREM&(f$ zRow~lmOm;Mfat1gS#$nT>}-URo7~4cnI2i`uuc5Ro#_4E&L<~iUO{sE-HJ#=mEu8z z#O~i6Vb&Ww8NlgF^bwPL=TA5R61HB8CcPgEgmY4^36Ok%rPiVL1xKsIyNlc-mXWpZ zBt6sH7Jj=uf0(i!eR(Ky%f+boo;dk8Vu{K_ir-U+AM|qWPxLqfv)Q6b|Clqa^bj+~ zv1TNYpDl>7&-Pt&e;-snLYLw>esx%!8#YKP-u73;H}G=(!bd4;o^&|=2^Wk0LhRB{ z(^;cvMAK%EY3M=VZv14au;%5UN_%x$53+{ZXo0sYlAcW=+lC6YnpcQzO3LvT=>(sVGm- zO;LrAE-MWRgj#+Wp8<7)Kl-+z`7%HLViQw<3Y$&x93n5mMgN@F(B==)rcQw zM)=y4P;1H6-)>xAK5TY*b8q)jC%?r3t3~(n2mwR#%T(@y@}e{qTJ6_ZvYntF?a8Jk z_l4|XHZufu(zp981eK=!TFsOtu`QW;y zg2%19Fu`+we_^o;=4@`1_soYBg|_}+#;SZ>xhjJ*^UlQ*iLu^4cSWBYG(wWIMC&`1 zt+GmC6lG3jLTka0Ulkfk-pgwWlV1HKeafpt&F zgCH7z^#%1+qfmB5VD+O~T|7bE7pGJTpyK{a#*%xe-h%!!J89YY}Trxp)4lBg=B&Toeqz$m!};rRI=BRtnO0|i2C zd>g$p%Hw0o1Cyv=IeqD-%rg43<2enxR+D|3+x#q@#ZtsH7V2-Jyf!(^=22~0aH~4* zO$#p?2KXi#~*!pIp&?ocwBIxQ$FH+#mm@ih>hi@eAwgE3|aaZ8!`Z9~4vD z_w=rIO|VI>T%3Xah@FYEB7~C!9`^BX9yO+%dtQQ^RXcBK-ah-R`mu$phbg09Q>0`X zT1yLdO7AvZVw0`-P7=)PpOUU(e6?HJ8uO?YoS^6|n286j)!w6F((3ODlDDl(*sy=G z{DI_71sWV>mbD;>&KTi>#Z2mS->JJ;)+UOI6431F0nj^%r6)y%4~bHaEx7NB*&wiZ zV;49_Z0{xr)c!@B|4ZZ21~2dOu6gpI4;<(7z*4na9Q9d}C-xJsnuvLLC1nvD8n^s3 z_f>nJorYv>Jn#!j`!p77`dA4tHY#E)KZv{X39)7{s&SL4c?72cI>Lks z9vQ>wlok6=}4h?NK& zR0HjJp6aPh16yILd|E&@*^&11-ltUX)@rL9dds1>Bn_|hk)%f1w$6R}=UB?5%s{?9 zd>J<^-sOUpB7$uRq6y#Bs?{_+^S{Sk2i}-Oq>?~&uIh?FCivy(mQ9K@r90Vcix0eI%&I5Os{Swv@ zUR&(~X6X-`^v=C^bI<2?xjT`t#=?L)ESN^evmfI2&o;~~TC>L#r z7d2pdQa}zcXaWhIH`W`2&VfJF{jZlM%a=0^q`j^_MFR7$L>eQmVAgW4WKD!L>C@&b?6)Zp z+GMj|Y~LKVe+!n$7ag@+x0;B1cfB;Fr>wtPM13Ye#OCPjHDGx2enORvm7=EkV_JAH zV891$1n#2XhDc|kC%47H?CM6@(e6I!=Y)%?um{B4w%e2jRM!1!(oZ{|Mg0`q7((dW z`mv!%NnX5KqbOf9p_hHIz?;*93Gp6HK=FM;10DT%5CaUDyUzlfo;aj~p$c4##{=wx zo94<~8ICN2n|awazE*^a=h;T8kb-LAHA_N!?iHtRMyg5o>>UMjs5@_%;OZ5G)J4w~ zgzYKzj?GuG#*UMar;`w0$+C`t5TMj5kb0et(w+gvEIn{q9LGK_7W#^A>d>SoVzTiqb=6GAX!W>R2|U5jtDyns4X}5>tjIICV7-$v-Z%5| zL*8obF(LaIHlF((Yxt1EWu$XQA$k6*F@2!yC^z`JSnvBcoU(3&icO?|9VE~0e(%1A z8c)^$oX6`giiwvbo}H`4VZSe=xTR22yu<s$f=wclFNE6}R2xSbJHr;7Q{=U9Xb{>Qv7|mG%DpiV+X?XUk_Fw%>bV0=7IT=}?Z7cz)tWR;&#%1_iaFcm`G)ZHY(%(X0tmE_4) zq+iVqqh@%3Wv0W31ed)qXq*X$MN?`@nM?xwu%v+}!=)rmE=f=6K3thdw5_3&6JLIY z?FVZ^A7|U%{tb?iJ$Hyz=0?3WPj-!{gU#;_5Q)(i?y|yfZymBzRU3bVZtFyeSNAA_|4lK8ZGp#c?CTlH-u19r|!s2wt6BUFB@n5u=0HWRxeT zlA8LtumKiva4iB?5NCX?=@VZe%BrMxTG_R_vh>W|EDP?pzG3m;-TgS}Zbh0@llTgf z7^2wsBo8GkWrQ%jrOqp|z9w0h?9CB+QO5{OB?@0#7?S2XRD>`|k4}WGK<7DCCg!JiNLX|$x3)j(U zvL746Y+K|!tM={D-wS_XHbVj#OU4QlJvK-ky;n=tQE(mj^bGxW6Mpuo7Z@1@T>Wrc z@R^cN-*M31Vf(J-*IEs1@s8KkikndUjxy_bxcNAQ#30Hmd~3EJPs8VKz!7>il^Zp@ z@4|&;SpRaj#Lz!V_<6tbPQlV)X`DN-=KR(NdTJI+DdMZf%V}V!XxNZHarbJ0?D?{} zC+1}f_>L`+oZ&Ur9Bm*P+WtoBUgSFJiKPuNgB5mEym&oPxj26Zs4Bp~;sO5mIP0JN t^nacICEWVYCjV(*{htmR|B|x*&(2a+KtTNOFR=e^*gu{47o`CJ{{>vVMLPfh diff --git a/Solutions/Microsoft Defender for Cloud/Package/createUiDefinition.json b/Solutions/Microsoft Defender for Cloud/Package/createUiDefinition.json index b72f642f489..f4f31d7603d 100644 --- a/Solutions/Microsoft Defender for Cloud/Package/createUiDefinition.json +++ b/Solutions/Microsoft Defender for Cloud/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Microsoft Defender for Cloud](https://docs.microsoft.com/azure/defender-for-cloud/) solution for Microsoft Sentinel allows you to ingest Security alerts reported in Microsoft Defender for Cloud on assessing your hybrid cloud workload's security posture. \n\n**Underlying Microsoft Technologies used:**\n\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs: \n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\n**Data Connectors:** 2, **Analytic Rules:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Microsoft%20Defender%20for%20Cloud/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Microsoft Defender for Cloud](https://docs.microsoft.com/azure/defender-for-cloud/) solution for Microsoft Sentinel allows you to ingest Security alerts reported in Microsoft Defender for Cloud on assessing your hybrid cloud workload's security posture. \n\n**Underlying Microsoft Technologies used:**\n\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs: \n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\n**Data Connectors:** 2, **Analytic Rules:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -63,13 +63,6 @@ "text": "This Solution installs the data connector for Microsoft Defender for Cloud. You can get Microsoft Defender for Cloud custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, - { - "name": "dataconnectors2-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "This Solution installs the data connector for Microsoft Defender for Cloud. You can get Microsoft Defender for Cloud custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." - } - }, { "name": "dataconnectors-link2", "type": "Microsoft.Common.TextBlock", From a39feb477c485e0caa972c1d80c1b7fab5d4bbb8 Mon Sep 17 00:00:00 2001 From: Sentinel Date: Mon, 18 Mar 2024 14:26:03 +0530 Subject: [PATCH 4/4] Update ReleaseNotes.md --- Solutions/Microsoft Defender for Cloud/ReleaseNotes.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Solutions/Microsoft Defender for Cloud/ReleaseNotes.md b/Solutions/Microsoft Defender for Cloud/ReleaseNotes.md index 7ce84291277..18f1593cf71 100644 --- a/Solutions/Microsoft Defender for Cloud/ReleaseNotes.md +++ b/Solutions/Microsoft Defender for Cloud/ReleaseNotes.md @@ -1,4 +1,4 @@ | **Version** | **Date Modified (DD-MM-YYY)** | **Change History** | -|-------------|-------------------------------|-------------------------------------------------| -| 3.0.0 | 08-11-2023 |New **Data Connector** included | -| 3.0.1 | 21-12-2023 |Corrected the standard tier | | +|-------------|-------------------------------|-------------------------------------------------| +| 3.0.1 | 18-03-2023 |Corrected the standard tier in **Data Connector** | | +| 3.0.0 | 08-11-2023 |New **Data Connector** included | \ No newline at end of file