Skip to content

Commit 2d1af4c

Browse files
punkrokkpunkrokk
authored
Merge branch 'Azure:master' into gn-3.1.0-1
2 parents 7696e92 + 2b09372 commit 2d1af4c

File tree

325 files changed

+22717
-2411
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

325 files changed

+22717
-2411
lines changed

‎.github/instructions/detections.instructions.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -317,6 +317,26 @@ Analytic Rules are YAML files that define scheduled queries to detect threats, s
317317
- Must include all connectors required for query execution
318318
- Specify exact data types needed
319319
- Use official connector IDs
320+
321+
#### **connectorId Validation**
322+
- **Source of Truth**: All `connectorId` values must be validated against the official list:
323+
```
324+
https://github.com/Azure/Azure-Sentinel/blob/master/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json
325+
```
326+
- **Validation Process**:
327+
- Check if the `connectorId` value exists in ValidConnectorIds.json
328+
- If NOT found: Flag as invalid and request update to ValidConnectorIds.json
329+
- Case-sensitive matching required
330+
- **Valid Examples**:
331+
- `CiscoDuoSecurity` ✅ (exists in valid list)
332+
- `AzureActiveDirectory` ✅ (exists in valid list)
333+
- `CiscoASA` ✅ (exists in valid list)
334+
- **Invalid Examples**:
335+
- `CiscoDuo` ❌ (correct ID is `CiscoDuoSecurity`)
336+
- `AzureAD` ❌ (correct ID is `AzureActiveDirectory`)
337+
- `CustomConnectorXYZ` ❌ (not in official list - needs to be added to ValidConnectorIds.json)
338+
- **Action if Invalid**:
339+
- Comment: "connectorId `[value]` is not found in the ValidConnectorIds.json file. Please update ValidConnectorIds.json to include this connector or use a valid connector ID from the official list."
320340
321341
#### **entityMappings** (Entity Extraction)
322342
- **Required**: Yes for Detections

‎.script/tests/KqlvalidationsTests/CustomFunctions/_ASIM_LookupSyslogSeverityLevel.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"FunctionName": "_ASIM_LookupSyslogSeverityLevel",
3+
"FunctionParameters": [
4+
{
5+
"Name": "SeverityLevelInput",
6+
"Type": "string",
7+
"IsRequired": true
8+
}
9+
],
10+
"FunctionResultColumns": [
11+
{
12+
"Name": "EventSeverity",
13+
"Type": "string"
14+
}
15+
]
16+
}

‎.script/tests/KqlvalidationsTests/CustomFunctions/_Im_AlertEvent.json‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
{
2+
"FunctionName": "_Im_AlertEvent",
3+
"FunctionParameters": [
4+
{
5+
"Name": "starttime",
6+
"Type": "datetime",
7+
"IsRequired": false
8+
},
9+
{
10+
"Name": "endtime",
11+
"Type": "datetime",
12+
"IsRequired": false
13+
},
14+
{
15+
"Name": "ipaddr_has_any_prefix",
16+
"Type": "dynamic",
17+
"IsRequired": false
18+
},
19+
{
20+
"Name": "hostname_has_any",
21+
"Type": "dynamic",
22+
"IsRequired": false
23+
},
24+
{
25+
"Name": "username_has_any",
26+
"Type": "dynamic",
27+
"IsRequired": false
28+
},
29+
{
30+
"Name": "attacktactics_has_any",
31+
"Type": "dynamic",
32+
"IsRequired": false
33+
},
34+
{
35+
"Name": "attacktechniques_has_any",
36+
"Type": "dynamic",
37+
"IsRequired": false
38+
},
39+
{
40+
"Name": "threatcategory_has_any",
41+
"Type": "dynamic",
42+
"IsRequired": false
43+
},
44+
{
45+
"Name": "alertverdict_has_any",
46+
"Type": "dynamic",
47+
"IsRequired": false
48+
},
49+
{
50+
"Name": "eventseverity_has_any",
51+
"Type": "dynamic",
52+
"IsRequired": false
53+
},
54+
{
55+
"Name": "pack",
56+
"Type": "bool",
57+
"IsRequired": false
58+
}
59+
],
60+
"FunctionResultColumns": [
61+
{ "Name": "TimeGenerated", "Type": "datetime" },
62+
{ "Name": "_ResourceId", "Type": "string" },
63+
{ "Name": "Type", "Type": "string" },
64+
{ "Name": "AdditionalFields", "Type": "dynamic" },
65+
{ "Name": "AlertDescription", "Type": "string" },
66+
{ "Name": "AlertId", "Type": "string" },
67+
{ "Name": "AlertName", "Type": "string" },
68+
{ "Name": "AlertOriginalStatus", "Type": "string" },
69+
{ "Name": "AlertStatus", "Type": "string" },
70+
{ "Name": "AlertVerdict", "Type": "string" },
71+
{ "Name": "AttackRemediationSteps", "Type": "string" },
72+
{ "Name": "AttackTactics", "Type": "string" },
73+
{ "Name": "AttackTechniques", "Type": "string" },
74+
{ "Name": "DetectionMethod", "Type": "string" },
75+
{ "Name": "DvcAction", "Type": "string" },
76+
{ "Name": "DvcDescription", "Type": "string" },
77+
{ "Name": "DvcDomain", "Type": "string" },
78+
{ "Name": "DvcDomainType", "Type": "string" },
79+
{ "Name": "DvcFQDN", "Type": "string" },
80+
{ "Name": "DvcHostname", "Type": "string" },
81+
{ "Name": "DvcId", "Type": "string" },
82+
{ "Name": "DvcIdType", "Type": "string" },
83+
{ "Name": "DvcInterface", "Type": "string" },
84+
{ "Name": "DvcIpAddr", "Type": "string" },
85+
{ "Name": "DvcMacAddr", "Type": "string" },
86+
{ "Name": "DvcOriginalAction", "Type": "string" },
87+
{ "Name": "DvcOs", "Type": "string" },
88+
{ "Name": "DvcOsVersion", "Type": "string" },
89+
{ "Name": "DvcScope", "Type": "string" },
90+
{ "Name": "DvcScopeId", "Type": "string" },
91+
{ "Name": "DvcZone", "Type": "string" },
92+
{ "Name": "EmailMessageId", "Type": "string" },
93+
{ "Name": "EmailSubject", "Type": "string" },
94+
{ "Name": "EventCount", "Type": "int" },
95+
{ "Name": "EventEndTime", "Type": "datetime" },
96+
{ "Name": "EventMessage", "Type": "string" },
97+
{ "Name": "EventOriginalSeverity", "Type": "string" },
98+
{ "Name": "EventOriginalSubType", "Type": "string" },
99+
{ "Name": "EventOriginalType", "Type": "string" },
100+
{ "Name": "EventOriginalUid", "Type": "string" },
101+
{ "Name": "EventOwner", "Type": "string" },
102+
{ "Name": "EventProduct", "Type": "string" },
103+
{ "Name": "EventProductVersion", "Type": "string" },
104+
{ "Name": "EventReportUrl", "Type": "string" },
105+
{ "Name": "EventResult", "Type": "string" },
106+
{ "Name": "EventSchema", "Type": "string" },
107+
{ "Name": "EventSchemaVersion", "Type": "string" },
108+
{ "Name": "EventSeverity", "Type": "string" },
109+
{ "Name": "EventStartTime", "Type": "datetime" },
110+
{ "Name": "EventSubType", "Type": "string" },
111+
{ "Name": "EventType", "Type": "string" },
112+
{ "Name": "EventUid", "Type": "string" },
113+
{ "Name": "EventVendor", "Type": "string" },
114+
{ "Name": "FileMD5", "Type": "string" },
115+
{ "Name": "FileName", "Type": "string" },
116+
{ "Name": "FilePath", "Type": "string" },
117+
{ "Name": "FileSHA1", "Type": "string" },
118+
{ "Name": "FileSHA256", "Type": "string" },
119+
{ "Name": "FileSize", "Type": "long" },
120+
{ "Name": "Hostname", "Type": "string" },
121+
{ "Name": "IndicatorAssociation", "Type": "string" },
122+
{ "Name": "IndicatorType", "Type": "string" },
123+
{ "Name": "IpAddr", "Type": "string" },
124+
{ "Name": "OriginalUserType", "Type": "string" },
125+
{ "Name": "ProcessCommandLine", "Type": "string" },
126+
{ "Name": "ProcessFileCompany", "Type": "string" },
127+
{ "Name": "ProcessId", "Type": "string" },
128+
{ "Name": "ProcessName", "Type": "string" },
129+
{ "Name": "RegistryKey", "Type": "string" },
130+
{ "Name": "RegistryValue", "Type": "string" },
131+
{ "Name": "RegistryValueData", "Type": "string" },
132+
{ "Name": "RegistryValueType", "Type": "string" },
133+
{ "Name": "Rule", "Type": "string" },
134+
{ "Name": "RuleDescription", "Type": "string" },
135+
{ "Name": "RuleName", "Type": "string" },
136+
{ "Name": "RuleNumber", "Type": "int" },
137+
{ "Name": "ThreatCategory", "Type": "string" },
138+
{ "Name": "ThreatConfidence", "Type": "int" },
139+
{ "Name": "ThreatFirstReportedTime", "Type": "datetime" },
140+
{ "Name": "ThreatId", "Type": "string" },
141+
{ "Name": "ThreatIsActive", "Type": "bool" },
142+
{ "Name": "ThreatLastReportedTime", "Type": "datetime" },
143+
{ "Name": "ThreatName", "Type": "string" },
144+
{ "Name": "ThreatOriginalCategory", "Type": "string" },
145+
{ "Name": "ThreatOriginalConfidence", "Type": "string" },
146+
{ "Name": "ThreatOriginalRiskLevel", "Type": "string" },
147+
{ "Name": "ThreatRiskLevel", "Type": "int" },
148+
{ "Name": "Url", "Type": "string" },
149+
{ "Name": "User", "Type": "string" },
150+
{ "Name": "UserId", "Type": "string" },
151+
{ "Name": "UserIdType", "Type": "string" },
152+
{ "Name": "Username", "Type": "string" },
153+
{ "Name": "UsernameType", "Type": "string" },
154+
{ "Name": "UserScope", "Type": "string" },
155+
{ "Name": "UserScopeId", "Type": "string" },
156+
{ "Name": "UserSessionId", "Type": "string" },
157+
{ "Name": "UserType", "Type": "string" }
158+
]
159+
}

‎.script/tests/KqlvalidationsTests/CustomFunctions/_Im_AssetEntity.json‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
{
2+
"FunctionName": "_Im_AssetEntity",
3+
"FunctionParameters": [
4+
{ "Name": "starttime", "Type": "datetime", "IsRequired": false },
5+
{ "Name": "endtime", "Type": "datetime", "IsRequired": false },
6+
{ "Name": "entityid_has_any", "Type": "dynamic", "IsRequired": false },
7+
{ "Name": "entityname_has_any", "Type": "dynamic", "IsRequired": false },
8+
{ "Name": "assettype_in", "Type": "string", "IsRequired": false },
9+
{ "Name": "path_has_any", "Type": "dynamic", "IsRequired": false },
10+
{ "Name": "assetowner_has_any", "Type": "dynamic", "IsRequired": false },
11+
{ "Name": "entitysource_has_any", "Type": "dynamic", "IsRequired": false },
12+
{ "Name": "pack", "Type": "bool", "IsRequired": false }
13+
],
14+
"FunctionResultColumns": [
15+
{ "Name": "EntitySchema", "Type": "string" },
16+
{ "Name": "EntitySchemaVersion", "Type": "string" },
17+
{ "Name": "EntityUpdatedTime", "Type": "datetime" },
18+
{ "Name": "EntityIngestionTime", "Type": "datetime" },
19+
{ "Name": "EntityId", "Type": "string" },
20+
{ "Name": "EntityOriginalId", "Type": "string" },
21+
{ "Name": "EntityName", "Type": "string" },
22+
{ "Name": "EntityNameType", "Type": "string" },
23+
{ "Name": "AssetType", "Type": "string" },
24+
{ "Name": "AssetOriginalType", "Type": "string" },
25+
{ "Name": "EntityVendor", "Type": "string" },
26+
{ "Name": "EntitySource", "Type": "string" },
27+
{ "Name": "EntityProduct", "Type": "string" },
28+
{ "Name": "EntitySubProduct", "Type": "string" },
29+
{ "Name": "EntityCreatedTime", "Type": "datetime" },
30+
{ "Name": "EntityLastAccessedTime", "Type": "datetime" },
31+
{ "Name": "EntityLastModifiedTime", "Type": "datetime" },
32+
{ "Name": "EntityIsDeleted", "Type": "bool" },
33+
{ "Name": "EntityFeedType", "Type": "string" },
34+
{ "Name": "AssetOwnerId", "Type": "string" },
35+
{ "Name": "AssetOwnerIdType", "Type": "string" },
36+
{ "Name": "AssetOwnerType", "Type": "string" },
37+
{ "Name": "AssetOwnerScope", "Type": "string" },
38+
{ "Name": "AssetOwnerScopeId", "Type": "string" },
39+
{ "Name": "AdditionalAssetOwners", "Type": "dynamic" },
40+
{ "Name": "AssetOriginalPermissions", "Type": "dynamic" },
41+
{ "Name": "AssetOriginalRiskDetails", "Type": "dynamic" },
42+
{ "Name": "AssetRiskName", "Type": "string" },
43+
{ "Name": "AssetRiskLevel", "Type": "string" },
44+
{ "Name": "AssetOriginalRiskLevel", "Type": "string" },
45+
{ "Name": "AssetRiskFirstReportedTime", "Type": "datetime" },
46+
{ "Name": "AssetRiskLastReportedTime", "Type": "datetime" },
47+
{ "Name": "AssetSensitivityLabel", "Type": "string" },
48+
{ "Name": "AssetOriginalSensitivityLevel", "Type": "string" },
49+
{ "Name": "AssetIsProtectedByDlp", "Type": "bool" },
50+
{ "Name": "AssetRelatedIndicators", "Type": "dynamic" },
51+
{ "Name": "AssetOriginalDataClassificationType", "Type": "dynamic" },
52+
{ "Name": "AssetClassificationLastScanDateTime", "Type": "datetime" },
53+
{ "Name": "AADTenantId", "Type": "string" },
54+
{ "Name": "IdentityDirectoryName", "Type": "string" },
55+
{ "Name": "IdentityDirectoryId", "Type": "string" },
56+
{ "Name": "AdditionalFields", "Type": "dynamic" },
57+
{ "Name": "InternalUsersCount", "Type": "int" },
58+
{ "Name": "ExternalUsersCount", "Type": "int" },
59+
{ "Name": "FilePath", "Type": "string" },
60+
{ "Name": "FileSize", "Type": "long" },
61+
{ "Name": "FileMD5", "Type": "string" },
62+
{ "Name": "FileSHA1", "Type": "string" },
63+
{ "Name": "FileSHA256", "Type": "string" },
64+
{ "Name": "FileSHA512", "Type": "string" },
65+
{ "Name": "FileExtension", "Type": "string" },
66+
{ "Name": "FileIsSignatureValid", "Type": "bool" },
67+
{ "Name": "FileSignatureDetails", "Type": "string" },
68+
{ "Name": "SitePath", "Type": "string" },
69+
{ "Name": "SitePrimaryUri", "Type": "string" },
70+
{ "Name": "AssetPath", "Type": "string" },
71+
{ "Name": "User", "Type": "string" }
72+
]
73+
}

‎.script/tests/KqlvalidationsTests/CustomFunctions/_Im_DhcpEvent.json‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
{
2+
"FunctionName": "_Im_DhcpEvent",
3+
"FunctionParameters": [
4+
{ "Name": "starttime", "Type": "datetime", "IsRequired": false },
5+
{ "Name": "endtime", "Type": "datetime", "IsRequired": false },
6+
{ "Name": "srcipaddr_has_any_prefix", "Type": "dynamic", "IsRequired": false },
7+
{ "Name": "srchostname_has_any", "Type": "dynamic", "IsRequired": false },
8+
{ "Name": "srcusername_has_any", "Type": "dynamic", "IsRequired": false },
9+
{ "Name": "eventresult", "Type": "string", "IsRequired": false },
10+
{ "Name": "disabled", "Type": "bool", "IsRequired": false },
11+
{ "Name": "pack", "Type": "bool", "IsRequired": false }
12+
],
13+
"FunctionResultColumns": [
14+
{ "Name": "TimeGenerated", "Type": "datetime" },
15+
{ "Name": "_ResourceId", "Type": "string" },
16+
{ "Name": "Type", "Type": "string" },
17+
{ "Name": "AdditionalFields", "Type": "dynamic" },
18+
{ "Name": "DhcpCircuitId", "Type": "string" },
19+
{ "Name": "DhcpLeaseDuration", "Type": "int" },
20+
{ "Name": "DhcpSessionDuration", "Type": "int" },
21+
{ "Name": "DhcpSessionId", "Type": "string" },
22+
{ "Name": "DhcpSrcDHCId", "Type": "string" },
23+
{ "Name": "DhcpSubscriberId", "Type": "string" },
24+
{ "Name": "DhcpUserClass", "Type": "string" },
25+
{ "Name": "DhcpUserClassId", "Type": "string" },
26+
{ "Name": "DhcpVendorClass", "Type": "string" },
27+
{ "Name": "DhcpVendorClassId", "Type": "string" },
28+
{ "Name": "Duration", "Type": "int" },
29+
{ "Name": "Dvc", "Type": "string" },
30+
{ "Name": "DvcAction", "Type": "string" },
31+
{ "Name": "DvcDescription", "Type": "string" },
32+
{ "Name": "DvcDomain", "Type": "string" },
33+
{ "Name": "DvcDomainType", "Type": "string" },
34+
{ "Name": "DvcFQDN", "Type": "string" },
35+
{ "Name": "DvcHostname", "Type": "string" },
36+
{ "Name": "DvcId", "Type": "string" },
37+
{ "Name": "DvcIdType", "Type": "string" },
38+
{ "Name": "DvcInterface", "Type": "string" },
39+
{ "Name": "DvcIpAddr", "Type": "string" },
40+
{ "Name": "DvcMacAddr", "Type": "string" },
41+
{ "Name": "DvcOriginalAction", "Type": "string" },
42+
{ "Name": "DvcOs", "Type": "string" },
43+
{ "Name": "DvcOsVersion", "Type": "string" },
44+
{ "Name": "DvcScope", "Type": "string" },
45+
{ "Name": "DvcScopeId", "Type": "string" },
46+
{ "Name": "DvcZone", "Type": "string" },
47+
{ "Name": "EventCount", "Type": "int" },
48+
{ "Name": "EventEndTime", "Type": "datetime" },
49+
{ "Name": "EventMessage", "Type": "string" },
50+
{ "Name": "EventOriginalResultDetails", "Type": "string" },
51+
{ "Name": "EventOriginalSeverity", "Type": "string" },
52+
{ "Name": "EventOriginalSubType", "Type": "string" },
53+
{ "Name": "EventOriginalType", "Type": "string" },
54+
{ "Name": "EventOriginalUid", "Type": "string" },
55+
{ "Name": "EventOwner", "Type": "string" },
56+
{ "Name": "EventProduct", "Type": "string" },
57+
{ "Name": "EventProductVersion", "Type": "string" },
58+
{ "Name": "EventReportUrl", "Type": "string" },
59+
{ "Name": "EventResult", "Type": "string" },
60+
{ "Name": "EventResultDetails", "Type": "string" },
61+
{ "Name": "EventSchema", "Type": "string" },
62+
{ "Name": "EventSchemaVersion", "Type": "string" },
63+
{ "Name": "EventSeverity", "Type": "string" },
64+
{ "Name": "EventStartTime", "Type": "datetime" },
65+
{ "Name": "EventSubType", "Type": "string" },
66+
{ "Name": "EventType", "Type": "string" },
67+
{ "Name": "EventUid", "Type": "string" },
68+
{ "Name": "EventVendor", "Type": "string" },
69+
{ "Name": "Hostname", "Type": "string" },
70+
{ "Name": "IpAddr", "Type": "string" },
71+
{ "Name": "RequestedIpAddr", "Type": "string" },
72+
{ "Name": "Rule", "Type": "string" },
73+
{ "Name": "RuleName", "Type": "string" },
74+
{ "Name": "RuleNumber", "Type": "int" },
75+
{ "Name": "SessionId", "Type": "string" },
76+
{ "Name": "Src", "Type": "string" },
77+
{ "Name": "SrcDescription", "Type": "string" },
78+
{ "Name": "SrcDeviceType", "Type": "string" },
79+
{ "Name": "SrcDomain", "Type": "string" },
80+
{ "Name": "SrcDomainType", "Type": "string" },
81+
{ "Name": "SrcDvcId", "Type": "string" },
82+
{ "Name": "SrcDvcIdType", "Type": "string" },
83+
{ "Name": "SrcDvcScope", "Type": "string" },
84+
{ "Name": "SrcDvcScopeId", "Type": "string" },
85+
{ "Name": "SrcFQDN", "Type": "string" },
86+
{ "Name": "SrcGeoCity", "Type": "string" },
87+
{ "Name": "SrcGeoCountry", "Type": "string" },
88+
{ "Name": "SrcGeoLatitude", "Type": "real" },
89+
{ "Name": "SrcGeoLongitude", "Type": "real" },
90+
{ "Name": "SrcGeoRegion", "Type": "string" },
91+
{ "Name": "SrcHostname", "Type": "string" },
92+
{ "Name": "SrcIpAddr", "Type": "string" },
93+
{ "Name": "SrcMacAddr", "Type": "string" },
94+
{ "Name": "SrcOriginalRiskLevel", "Type": "string" },
95+
{ "Name": "SrcOriginalUserType", "Type": "string" },
96+
{ "Name": "SrcPortNumber", "Type": "int" },
97+
{ "Name": "SrcRiskLevel", "Type": "int" },
98+
{ "Name": "SrcUserId", "Type": "string" },
99+
{ "Name": "SrcUserIdType", "Type": "string" },
100+
{ "Name": "SrcUsername", "Type": "string" },
101+
{ "Name": "SrcUsernameType", "Type": "string" },
102+
{ "Name": "SrcUserScope", "Type": "string" },
103+
{ "Name": "SrcUserScopeId", "Type": "string" },
104+
{ "Name": "SrcUserSessionId", "Type": "string" },
105+
{ "Name": "SrcUserType", "Type": "string" },
106+
{ "Name": "SrcUserUid", "Type": "string" },
107+
{ "Name": "ThreatCategory", "Type": "string" },
108+
{ "Name": "ThreatConfidence", "Type": "int" },
109+
{ "Name": "ThreatField", "Type": "string" },
110+
{ "Name": "ThreatFirstReportedTime", "Type": "datetime" },
111+
{ "Name": "ThreatId", "Type": "string" },
112+
{ "Name": "ThreatIsActive", "Type": "bool" },
113+
{ "Name": "ThreatLastReportedTime", "Type": "datetime" },
114+
{ "Name": "ThreatName", "Type": "string" },
115+
{ "Name": "ThreatOriginalConfidence", "Type": "string" },
116+
{ "Name": "ThreatOriginalRiskLevel", "Type": "string" },
117+
{ "Name": "ThreatRiskLevel", "Type": "int" },
118+
{ "Name": "User", "Type": "string" }
119+
]
120+
}

0 commit comments

Comments
 (0)