Skip to content

Commit 27f7737

Browse files
author
Kyle West
committed
pr feedback
1 parent 21a9749 commit 27f7737

File tree

7 files changed

+161
-10
lines changed

7 files changed

+161
-10
lines changed

‎Solutions/Halcyon/Data/Solution_Halcyon.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
{
22
"Name": "Halcyon",
3-
"Author": "Halcyon",
3+
"Author": "Halcyon - support@halcyon.ai",
44
"Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/halcyon.svg\" width=\"75px\" height=\"75px\">",
5-
"Description": "The [Halcyon](https://www.halcyon.ai) solution for Microsoft Sentinel enables you to ingest Halcyon Events and Alerts into Microsoft Sentinel using the Microsoft Sentinel Analytics Workspace.\n\nInstalling this solution automatically provisions a Data Collection Endpoint (DCE) and Data Collection Rule (DCR) in your Azure environment. These resources are updated automatically with each solution upgrade. To complete the connector setup, use the **Deploy** button on the Halcyon connector page to create the required Entra app registration and link it to the DCR.",
5+
"Description": "The [Halcyon](https://www.halcyon.ai) solution for Microsoft Sentinel enables you to ingest Halcyon Events and Alerts into Microsoft Sentinel using the Microsoft Sentinel Analytics Workspace.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following Microsoft technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional data ingestion or operational costs:\n\na. [Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/)\n\nb. [Azure Monitor Data Collection Rules (DCR)](https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview)\n\nc. [Azure Monitor Data Collection Endpoints (DCE)](https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-endpoint-overview)\n\nd. [Azure Log Analytics workspaces](https://learn.microsoft.com/azure/azure-monitor/logs/log-analytics-workspace-overview)",
66
"Data Connectors": [
77
"Data Connectors/Halcyon_ccp/Halcyon_connectorDefinition.json"
88
],
@@ -17,9 +17,9 @@
1717
"Analytic Rules": [],
1818
"Hunting Queries": [],
1919
"Playbooks": [],
20-
"BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Halcyon",
20+
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Halcyon",
2121
"Version": "3.1.0",
2222
"Metadata": "SolutionMetadata.json",
23-
"TemplateSpec": true,
23+
"TemplateSpec": false,
2424
"Is1PConnector": false
2525
}

‎Solutions/Halcyon/Parsers/ASimAuthenticationHalcyon.yaml‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,30 @@ FunctionQuery: |
3535
| extend
3636
User = ActorUsername,
3737
Dvc = DvcHostname
38-
| project-away _ResourceId
38+
| project
39+
TimeGenerated,
40+
EventVendor,
41+
EventProduct,
42+
EventProductVersion,
43+
EventSchema,
44+
EventSchemaVersion,
45+
EventCount,
46+
EventStartTime,
47+
EventEndTime,
48+
EventType,
49+
EventResult,
50+
EventOriginalType,
51+
EventOriginalSeverity,
52+
EventSeverity,
53+
EventMessage,
54+
ActorUsername,
55+
ActorUserId,
56+
ActorUsernameType,
57+
DvcHostname,
58+
DvcIpAddr,
59+
DvcId,
60+
User,
61+
Dvc
3962
};
4063
parser(disabled=disabled)
4164
FunctionParams:

‎Solutions/Halcyon/Parsers/ASimDnsHalcyon.yaml‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,37 @@ FunctionQuery: |
4242
Dvc = DvcHostname,
4343
IpAddr = SrcIpAddr,
4444
Src = SrcIpAddr
45-
| project-away _ResourceId
45+
| project
46+
TimeGenerated,
47+
EventVendor,
48+
EventProduct,
49+
EventProductVersion,
50+
EventSchema,
51+
EventSchemaVersion,
52+
EventCount,
53+
EventStartTime,
54+
EventEndTime,
55+
EventType,
56+
EventResult,
57+
EventOriginalType,
58+
EventOriginalSeverity,
59+
EventSeverity,
60+
EventMessage,
61+
DnsQuery,
62+
DnsQueryTypeName,
63+
DnsResponseCodeName,
64+
DnsResponseCode,
65+
SrcIpAddr,
66+
SrcPortNumber,
67+
DstIpAddr,
68+
DstPortNumber,
69+
DvcHostname,
70+
DvcIpAddr,
71+
DvcId,
72+
Domain,
73+
Dvc,
74+
IpAddr,
75+
Src
4676
};
4777
parser(disabled=disabled)
4878
FunctionParams:

‎Solutions/Halcyon/Parsers/ASimFileEventHalcyon.yaml‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,37 @@ FunctionQuery: |
4242
FilePath = TargetFilePath,
4343
User = ActorUsername,
4444
Dvc = DvcHostname
45-
| project-away _ResourceId
45+
| project
46+
TimeGenerated,
47+
EventVendor,
48+
EventProduct,
49+
EventProductVersion,
50+
EventSchema,
51+
EventSchemaVersion,
52+
EventCount,
53+
EventStartTime,
54+
EventEndTime,
55+
EventType,
56+
EventResult,
57+
EventOriginalType,
58+
EventOriginalSeverity,
59+
EventSeverity,
60+
EventMessage,
61+
TargetFileName,
62+
TargetFilePath,
63+
TargetFileExtension,
64+
ActorUsername,
65+
ActorUserId,
66+
ActorUsernameType,
67+
ActingProcessName,
68+
ActingProcessId,
69+
ActingProcessCommandLine,
70+
DvcHostname,
71+
DvcIpAddr,
72+
DvcId,
73+
FilePath,
74+
User,
75+
Dvc
4676
};
4777
parser(disabled=disabled)
4878
FunctionParams:

‎Solutions/Halcyon/Parsers/ASimNetworkSessionHalcyon.yaml‎

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,40 @@ FunctionQuery: |
4545
Dst = DstIpAddr,
4646
IpAddr = SrcIpAddr,
4747
Dvc = DvcHostname
48-
| project-away _ResourceId
48+
| project
49+
TimeGenerated,
50+
EventVendor,
51+
EventProduct,
52+
EventProductVersion,
53+
EventSchema,
54+
EventSchemaVersion,
55+
EventCount,
56+
EventStartTime,
57+
EventEndTime,
58+
EventType,
59+
EventResult,
60+
EventOriginalType,
61+
EventOriginalSeverity,
62+
EventSeverity,
63+
EventMessage,
64+
DvcAction,
65+
SrcIpAddr,
66+
SrcPortNumber,
67+
SrcHostname,
68+
SrcDomain,
69+
SrcMacAddr,
70+
DstIpAddr,
71+
DstPortNumber,
72+
DstHostname,
73+
DstDomain,
74+
DstMacAddr,
75+
DvcHostname,
76+
DvcIpAddr,
77+
DvcId,
78+
Src,
79+
Dst,
80+
IpAddr,
81+
Dvc
4982
};
5083
parser(disabled=disabled)
5184
FunctionParams:

‎Solutions/Halcyon/Parsers/ASimProcessEventHalcyon.yaml‎

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,42 @@ FunctionQuery: |
4747
User = ActorUsername,
4848
Dvc = DvcHostname,
4949
Process = TargetProcessName
50-
| project-away _ResourceId
50+
| project
51+
TimeGenerated,
52+
EventVendor,
53+
EventProduct,
54+
EventProductVersion,
55+
EventSchema,
56+
EventSchemaVersion,
57+
EventCount,
58+
EventStartTime,
59+
EventEndTime,
60+
EventType,
61+
EventResult,
62+
EventOriginalType,
63+
EventOriginalSeverity,
64+
EventSeverity,
65+
EventMessage,
66+
TargetProcessName,
67+
TargetProcessId,
68+
TargetProcessCommandLine,
69+
TargetProcessFilename,
70+
TargetProcessFilePath,
71+
ParentProcessName,
72+
ParentProcessId,
73+
ParentProcessCommandLine,
74+
ActorUsername,
75+
ActorUserId,
76+
ActorUsernameType,
77+
ActingProcessName,
78+
ActingProcessId,
79+
ActingProcessCommandLine,
80+
DvcHostname,
81+
DvcIpAddr,
82+
DvcId,
83+
User,
84+
Dvc,
85+
Process
5186
};
5287
parser(disabled=disabled)
5388
FunctionParams:

‎Solutions/Halcyon/ReleaseNotes.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
22
|-------------|--------------------------------|---------------------------------------------|
3-
|3.1.0 | 24-03-2026 | Update Connector to recieve events with OCSF schemas |
3+
|3.1.0 | 24-03-2026 | Update Connector to receive events with OCSF schemas |
44
|3.0.0 | 09-12-2025 | Initial Solution release

0 commit comments

Comments
 (0)