Add IncludeRequiredDataConnectors,OmitDataTypeExtension - requiredDataConnectors to ARM template

src/public/Convert-SentinelARYamlToArm.ps1

@@ -37,6 +37,12 @@ Set prefix for the name of the ARM template. Default is none
 .PARAMETER Severity
 Overwrite the severity of the provided YAML file with a custom one. Default is emtpy
 
+.PARAMETER IncludeRequiredDataConnectors
+If set, the requiredDataConnectors property of the ARM template will be set to the value from the YAML file. Default is not to include it.
+
+.PARAMETER OmitDataTypeExtension
+If set, the requiredDataConnectors property will not include the data connector type extension. (the stuff in the brackets) Default is to include it.
+
 .PARAMETER StartRunningAt
 Set the startTimeUtc property of the ARM template. Default is empty
 To successfully deploy the ARM template the startTimeUtc property must be set to a future date.
@@ -92,6 +98,13 @@ function Convert-SentinelARYamlToArm {
         [Parameter(ParameterSetName = 'UseIdAsFilename')]
         [switch]$UseIdAsFilename,
 
+        [Parameter(Mandatory = $false)]
+        [array]$SkipYamlValues = @(
+            "metadata",
+            "kind",
+            "requiredDataConnectors"
+        ),
+
         [ValidatePattern('^\d{4}-\d{2}-\d{2}(-preview)?$')]
         [Parameter()]
         [string]$APIVersion = "2023-02-01-preview",
@@ -107,7 +120,13 @@ function Convert-SentinelARYamlToArm {
         [datetime]$StartRunningAt,
 
         [Parameter()]
-        [switch]$DisableIncidentCreation
+        [switch]$DisableIncidentCreation,
+
+        [Parameter()]
+        [switch]$IncludeRequiredDataConnectors,
+
+        [Parameter()]
+        [switch]$OmitDataTypeExtension
     )
 
     begin {
@@ -163,6 +182,21 @@ function Convert-SentinelARYamlToArm {
             $analyticRule.severity = $Severity
         }
 
+        if ($OmitDataTypeExtension) {
+            # Remove data connector type extension from requiredDataConnectors and trim whitespace
+            forEach ($requiredDc in $analyticRule.requiredDataConnectors) {
+
+                if ($requiredDc.dataTypes.Count -eq 1) {
+                    # ,@ makes sure it's an array
+                    $requiredDc.dataTypes = ,@(($requiredDc.dataTypes -replace '\s*\(.*\)', '').Trim())
+                } else {
+                    forEach ($i in 0..($requiredDc.dataTypes.Count - 1)) {
+                        $requiredDc.dataTypes[$i] = ($requiredDc.dataTypes[$i] -replace '\s*\(.*\)', '').Trim()
+                    }
+                }
+            }
+        }
+
         Write-Verbose "Convert Analytics Rule $($analyticRule.name) ($($analyticRule.id)) to ARM template"
 
         #region Set output filename to defined value if not specified by user
@@ -272,6 +306,11 @@ function Convert-SentinelARYamlToArm {
             }
         }
 
+        # Add requiredDataConnectors if specified
+        if ($IncludeRequiredDataConnectors -and $analyticRule.requiredDataConnectors) {
+            $ARMTemplate.Add("requiredDataConnectors", $analyticRule.requiredDataConnectors)
+        }
+
         # Remove any subtechniques from the techniques array
         if ($ARMTemplate.techniques) {
             $ARMTemplate.techniques = $ARMTemplate.techniques -replace "(T\d{4})\.\d{3}", '$1'

tests/examples/yamlwithRequiredMultiple.yaml

@@ -0,0 +1,88 @@
+tactics:
+  - ImpairProcessControl
+id: 70be4a31-9d2b-433b-bdc7-da8928988069
+kind: Scheduled
+requiredDataConnectors:
+  - dataTypes:
+      - SecurityAlert (ASC for IoT)
+    connectorId: IoT
+  - dataTypes:
+      - SomeOtherDataType
+      - SecurityAlert (ASC for IoT)
+    connectorId: IoT
+entityMappings:
+  - entityType: IP
+    fieldMappings:
+      - identifier: Address
+        columnName: SourceDeviceAddress
+  - entityType: IP
+    fieldMappings:
+      - identifier: Address
+        columnName: DestDeviceAddress
+status: Available
+relevantTechniques:
+  - T0855
+triggerThreshold: 0
+query: |
+  let alertList = dynamic(["Function Code Not Supported by Outstation", "Illegal BACNet message", "Illegal Connection Attempt on Port 0", "Illegal DNP3 Operation", "Illegal MODBUS Operation (Exception Raised by Master)",  "Illegal MODBUS Operation (Function Code Zero)", "Incorrect Parameter Sent to Outstation", "Initiation of an Obsolete Function Code (Initialize Data)", "Initiation of an Obsolete Function Code (Save Config)", "Modbus Exception", "Unknown Object Sent to Outstation", "Usage of a Reserved Function Code",  "Usage of Improper Formatting by Outstation", "Usage of Reserved Status Flags (IIN)", "Unauthorized communication was detected by a User Defined Protocol Rule", "Unauthorized Operation was detected by a User Defined whitelist Alert", "Illegal Protocol Version", "New Activity Detected - LonTalk Network Variable", "New Activity Detected - Ovation Data Request", "New Activity Detected - Read/Write Command (AMS Index Group)", "New Activity Detected - Read/Write Command (AMS Index Offset)", "New Activity Detected - Unauthorized DeltaV Message Type", "New Activity Detected - Unauthorized DeltaV ROC Operation", "New Activity Detected - Using AMS Protocol Command", "New Activity Detected - Using Siemens SICAM Command", "New Activity Detected - Using Suitelink Protocol command", "New Activity Detected - Using Suitelink Protocol sessions", "New Activity Detected - Using Yokogawa VNetIP Command", "Omron FINS Unauthorized Command", "Toshiba Computer Link Unauthorized Command", "Unauthorized ABB Totalflow File Operation", "Unauthorized ABB Totalflow Register Operation", "Unauthorized Access to Siemens S7 Plus Object", "Unauthorized BACNet Object Access", "Unauthorized BACNet Route", "Unauthorized Emerson ROC Operation", "Unauthorized GE SRTP File Access", "Unauthorized GE SRTP Protocol Command", "Unauthorized GE SRTP System Memory Operation", "Unauthorized Mitsubishi MELSEC Command", "Unauthorized MMS Service", "Unauthorized OPC UA Activity", "Unauthorized OPC UA Request/Response", "Unauthorized Profinet Frame Type", "Unauthorized SAIA S-Bus Command", "Unauthorized Siemens S7 Execution of Control Function", "Unauthorized Siemens S7 Execution of User Defined Function", "Unauthorized Siemens S7 Plus Block Access", "Unauthorized Siemens S7 Plus Operation", "Unauthorized SNMP Operation", "Unpermitted Modbus Schneider Electric Extension", "Unpermitted Usage of ASDU Types", "Unpermitted Usage of DNP3 Function Code", "Unpermitted Usage of Modbus Function Code", "Unauthorized Operation was detected by a User Defined Rule", "Unauthorized PLC Configuration Read", "Unauthorized PLC Programming", "Unauthorized PLC Configuration Write", "Unauthorized PLC Program Upload", "Slave Device Received Illegal"]);
+  SecurityAlert
+  | where ProviderName == "IoTSecurity"
+  | where AlertName has_any (alertList)
+  | extend ExtendedProperties = parse_json(ExtendedProperties)
+  | where tostring(ExtendedProperties.isNew) == "True"
+  | extend DeviceId = tostring(ExtendedProperties.DeviceId), 
+           SourceDeviceAddress = tostring(ExtendedProperties.SourceDeviceAddress), 
+           DestDeviceAddress = tostring(ExtendedProperties.DestinationDeviceAddress), 
+           RemediationSteps = tostring(parse_json(RemediationSteps)[0]), 
+           Protocol = tostring(ExtendedProperties.Protocol), 
+           AlertManagementUri = tostring(ExtendedProperties.AlertManagementUri)
+  | project
+    TimeGenerated,
+    DeviceId,
+    ProductName,
+    ProductComponentName,
+    AlertSeverity,
+    AlertName,
+    Description,
+    Protocol,
+    SourceDeviceAddress,
+    DestDeviceAddress,
+    RemediationSteps,
+    Tactics,
+    Entities,
+    VendorOriginalId,
+    AlertLink,
+    AlertManagementUri,
+    Techniques
+triggerOperator: gt
+description: |
+  'This alert leverages Defender for IoT to detect Illegal function codes in SCADA equipment indicating improper application configuration or malicious activity such using illegal values within a protocol to exploit a PLC vulnerability.'
+version: 1.0.2
+queryPeriod: 1h
+customDetails:
+  AlertManagementUri: AlertManagementUri
+  VendorOriginalId: VendorOriginalId
+  Sensor: DeviceId
+  Protocol: Protocol
+severity: Medium
+eventGroupingSettings:
+  aggregationKind: AlertPerResult
+queryFrequency: 1h
+alertDetailsOverride:
+  alertDescriptionFormat: (MDIoT) {{Description}}
+  alertSeverityColumnName: AlertSeverity
+  alertDynamicProperties:
+    - value: ProductName
+      alertProperty: ProductName
+    - value: RemediationSteps
+      alertProperty: RemediationSteps
+    - value: Techniques
+      alertProperty: Techniques
+    - value: ProductComponentName
+      alertProperty: ProductComponentName
+    - value: AlertLink
+      alertProperty: AlertLink
+  alertTacticsColumnName: Tactics
+  alertDisplayNameFormat: (MDIoT) {{AlertName}}
+name: Illegal Function Codes for ICS traffic (Microsoft Defender for IoT)
+OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTIllegalFunctionCodes.yaml