Commit 3dc8d03
File tree
1,675 files changed
+168633
-59573
lines changed- .github/workflows
- .script
- package-automation
- tests
- KqlvalidationsTests
- CustomFunctions
- CustomTables
- asimParsersTest
- detectionTemplateSchemaValidation
- .vscode
- ASIM/dev/ASimTester
- DataConnectors
- AWS-S3
- CloudFormation
- DNSRoute53
- CybleLogicApp
- GCP/Terraform/sentinel_resources_creation/GCPVPCFlowLogsSetup
- microsoft-sentinel-log-analytics-logstash-output-plugin/examples/auxiliry-logs/arm-template
- Detections/ASimWebSession
- Hunting Queries
- AzureStorage
- Microsoft 365 Defender/Email Queries
- General
- Malware
- Overrides
- Phish
- Quarantine
- Submissions
- URL
- ZAP
- Logos
- Parsers
- ASimAuthentication
- ARM
- ASimAuthenticationCiscoASA
- ASimAuthenticationCiscoMeraki
- vimAuthenticationCiscoASA
- vimAuthenticationCiscoMeraki
- Parsers
- ASimUserManagement
- ARM
- ASimUserManagementCiscoISE
- ASimUserManagementLinuxAuthpriv
- ASimUserManagementMicrosoftSecurityEvent
- ASimUserManagementMicrosoftWindowsEvent
- ASimUserManagementNative
- ASimUserManagementSentinelOne
- ASimUserManagement
- imUserManagement
- vimUserManagementCiscoISE
- vimUserManagementEmpty
- vimUserManagementLinuxAuthpriv
- vimUserManagementMicrosoftSecurityEvent
- vimUserManagementMicrosoftWindowsEvent
- vimUserManagementNative
- vimUserManagementSentinelOne
- Parsers
- ASimWebSession
- ARM
- ASimWebSessionApacheHTTPServer
- ASimWebSessionBarracudaCEF
- ASimWebSessionBarracudaWAF
- ASimWebSessionCiscoFirepower
- ASimWebSessionCiscoMeraki
- ASimWebSessionCitrixNetScaler
- ASimWebSessionF5ASM
- ASimWebSessionFortinetFortiGate
- ASimWebSessionIIS
- ASimWebSessionNative
- ASimWebSessionPaloAltoCEF
- ASimWebSessionPaloAltoCortexDataLake
- ASimWebSessionSonicWallFirewall
- ASimWebSessionSquidProxy
- ASimWebSessionVectraAI
- ASimWebSessionzScalerZIA
- ASimWebSession
- imWebSession
- vimWebSessionApacheHTTPServer
- vimWebSessionBarracudaCEF
- vimWebSessionBarracudaWAF
- vimWebSessionCiscoFirepower
- vimWebSessionCiscoMeraki
- vimWebSessionCitrixNetScaler
- vimWebSessionEmpty
- vimWebSessionF5ASM
- vimWebSessionFortinetFortiGate
- vimWebSessionIIS
- vimWebSessionNative
- vimWebSessionPaloAltoCEF
- vimWebSessionPaloAltoCortexDataLake
- vimWebSessionSonicWallFirewall
- vimWebSessionSquidProxy
- vimWebSessionVectraAI
- vimWebSessionzScalerZIA
- Parsers
- Playbooks/CybleLogicApp
- Sample Data
- ASIM
- Custom
- Solutions
- AWS Security Hub
- CloudFormationTemplates
- Data Connectors/AWSSecurityHubFindings_CCP
- Data
- Package
- AWS_IAM/Playbooks
- AWS_IAM_FunctionAppConnector
- DisableS3BucketPublicAccess
- GetUser
- Playbooks/AWS-DisableS3BucketPublicAccess
- images
- AbnormalSecurity/Data Connectors
- SentinelFunctionsOrchestrator
- Tests
- Amazon Web Services NetworkFirewall
- Data Connectors
- AWSNetworkFirewallLogs_CCP
- CloudFormationTemplates
- Data
- Package
- Amazon Web Services Route 53
- Data Connectors/AWSRoute53Resolver_CCP
- Data
- Package
- Amazon Web Services
- Data Connectors
- Package
- Armis
- Data Connectors
- ArmisAlertsActivities
- ArmisAlertActivitySentinelConnector
- Exceptions
- ArmisDevice
- ArmisDeviceSentinelConnector
- Data
- Package
- AtlassianConfluenceAudit
- Data Connectors
- AtlassianConfluenceAuditDataConnector
- AtlassianConfluenceAuditLogs_CCP
- ConfluenceNativePollerConnector
- Data
- Package
- Parsers
- AzureDevOpsAuditing
- Analytic Rules
- Data Connectors/AzureDevOpsAuditLogs_CCP
- Data
- Hunting Queries
- Package
- Parsers
- BlinkOps
- Data
- Package
- Playbooks
- blink-sentinel-incident-handler
- Check Point Cyberint Alerts
- Data Connectors/CyberintArgosAlertsLogs_ccp
- Data
- Package
- Check Point Cyberint IOC
- Data Connectors/CyberintArgosIOCLogs_ccp
- Data
- Package
- Cisco Secure Endpoint
- Data Connectors
- CiscoSecureEndpointLogs_ccp
- Data
- Package
- Parsers
- CiscoASA
- Analytic Rules
- Data
- Package
- CiscoDuoSecurity/Data Connectors
- AzureFunctionCiscoDuo
- CiscoUmbrella
- Data Connectors
- ciscoUmbrellaDataConn
- Package
- CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector
- CofenseTriage
- Data Connectors/CofenseTriageDataConnector
- Package
- Workbooks
- CognyteLuminar
- Data Connectors
- Cognyte Luminar
- CognyteLuminar
- Data
- Package
- Common Event Format
- Data Connectors
- Data
- Package
- Commvault Security IQ
- Analytic Rules
- Data Connectors
- AzureFunctionCommvaultSecurityIQ
- Data
- Playbooks/Runbooks
- Tools
- ContrastADR
- Analytic Rules
- Data Connectors
- AzureFunctionContrastADR
- Data
- Package
- Parsers
- Workbooks
- CrowdStrike Falcon Endpoint Protection
- Data Connectors
- CrowdStrikeS3FDR_ccp
- CrowdstrikeReplicatorCLv2
- Data
- Package
- CyberArkAudit/Data Connectors
- CyberArkEPM
- DataConnectors
- Package
- data
- Cyble Vision
- Data
- Package
- Playbooks
- IoC-Enrichment
- TI-Ingest
- Cyfirma Attack Surface
- Data Connectors/CyfirmaASAlerts_ccp
- Data
- Package
- Cyfirma Brand Intelligence
- Data Connectors/CyfirmaBIAlerts_ccp
- Data
- Package
- Cyfirma Compromised Accounts
- Data Connectors/CyfirmaCompromisedAccounts_ccp
- Data
- Package
- Cyfirma Cyber Intelligence
- Data Connectors/CyfirmaCyberIntelligence_ccp
- Data
- Package
- Cyfirma Digital Risk
- Data Connectors/CyfirmaDigitalRiskAlerts_ccp
- Data
- Package
- Cyfirma Vulnerabilities Intel
- Data Connectors/CyfirmaVulnerabilitiesIntel_ccp
- Data
- Package
- DruvaDataSecurityCloud
- Data Connectors/Druva_ccp
- Package
- Playbooks
- DruvaQuarantineEnterpriseWorkload
- DruvaQuarantineInsyncWorkloads
- DruvaQuarantineUsingResourceID
- ESET Protect Platform
- Data Connectors
- Data
- Package
- ExtraHop
- Analytic Rules
- Data
- Package
- Parsers
- Workbooks
- Fortinet FortiNDR Cloud
- Data Connectors
- fortinetFortiNdrCloudDataConn/OrchestratorWatchdog
- Data
- Package
- GitHub/Data Connectors
- Global Secure Access
- Analytic Rules
- Data
- Hunting Queries
- Package
- Workbooks
- Google Cloud Platform Audit Logs
- Data Connectors/GCPAuditLogs_ccp
- Package
- Google Cloud Platform Firewall Logs
- Data Connectors/GCPFirewallLogs_ccp
- Data
- Package
- Google Cloud Platform VPC Flow Logs
- Data Connectors/GCPVPCFlowLogs_GCP_CCP
- Data
- Package
- Google Threat Intelligence
- Data
- Package
- Playbooks
- CustomConnector/GTICustomConnector
- GTIIocStream
- GTIThreatList
- GoogleCloudPlatformCDN
- Data Connectors
- GCPCDNLogs_ccp
- Data
- Package
- GoogleCloudPlatformDNS
- Data Connectors
- GCPDNSLog_CCP
- Data
- Package
- Parsers
- GoogleCloudPlatformIAM
- Data Connectors
- GCPIAMLog_CCP
- Data
- Package
- Parsers
- GoogleCloudPlatformIDS
- Data Connectors/GCPCloudIDSLog_CCP
- Data
- Package
- GoogleCloudPlatformSQL
- Data Connectors/GCPCloudSQLLog_CCP
- Data
- Package
- HolmSecurity/Data Connectors
- AzureFunctionHolmSecurityAssetsConn
- ImpervaCloudWAF/Data Connectors
- Infoblox
- Analytic Rules
- Data
- Package
- Parsers
- Playbooks
- Infoblox SOC Get Insight Details
- Infoblox SOC Get Open Insights API
- Infoblox SOC Import Indicators TI
- Workbooks
- Images/Preview/Infoblox Workbook
- Juniper SRX
- Package
- Parsers
- KeeperSecurity
- Data Connectors/KeeperSecurity_ccp
- Data
- Package
- Microsoft Business Applications
- Analytic Rules
- Audit Settings
- Data Connectors/DynamicsFinOpsPollerConnector
- Data
- Package
- Microsoft Defender XDR/Hunting Queries/Email Queries
- General
- Malware
- Overrides
- Phish
- Quarantine
- Submissions
- URL
- ZAP
- Microsoft Defender for Cloud
- Data Connectors
- Data
- Package
- Microsoft Defender for Office 365
- Package
- Playbooks/CustomConnector/O365_Defender_FunctionAppConnector
- Microsoft Entra ID
- Analytic Rules
- Data
- Package
- Playbooks
- Block-AADUser
- alert-trigger
- entity-trigger
- images
- incident-trigger
- Reset-AADUserPassword
- alert-trigger
- entity-trigger
- images
- incident-trigger
- Revoke-AADSignInSessions
- alert-trigger
- entity-trigger
- images
- incident-trigger
- MimecastAudit
- Data Connectors
- Package
- MimecastSEG
- Data Connectors
- Package
- MimecastTIRegional
- Data Connectors
- Package
- MimecastTTP
- Data Connectors
- Package
- Mimecast
- Package
- Network Session Essentials
- Analytic Rules
- Data
- Hunting Queries
- Package
- Summary rules
- Workbooks
- NordPass
- Analytics Rules
- Data Connectors
- deployment
- src
- cmd/api
- internal
- activity
- apierrors
- api
- client
- config
- container
- controller
- router
- sentinel
- storage
- utils
- Data
- Package
- Workbooks
- OneLoginIAM
- Data Connectors
- OneLoginIAMLogs_ccp
- Data
- Package
- Parsers
- PingOne
- Data Connectors/PingOneAuditLogs_ccp
- Data
- Package
- ProofPointTap
- Data Connectors/ProofpointTAP_CCP
- Data
- Package
- Parsers
- Proofpoint On demand(POD) Email Security
- Data Connectors/ProofPointEmailSecurity_CCP
- Data
- Package
- QualysVM
- Data Connectors
- AzureFunctionQualysVM_V2
- QualysVMHostLogs_ccp
- Package
- Parsers
- data
- Recorded Future Identity
- Data
- Package
- Playbooks
- RFI-Playbook-Alert-Importer-LAW-Sentinel
- RFI-Playbook-Alert-Importer-LAW
- RFI-Playbook-Alert-Importer
- v3.0/RFI-confirm-EntraID-risky-user
- Recorded Future
- Analytic Rules
- ThreatHunting
- Data
- Hunting Queries
- Package
- Playbooks
- Alerts
- Enrichment
- IndicatorImport
- Sandboxing
- ThreatHunting
- Workbooks
- RubrikSecurityCloud
- Data Connectors/RubrikWebhookEvents
- Data
- Package
- Playbooks
- RubrikAnomalyAnalysis
- RubrikAnomalyGenerateDownloadableLink
- RubrikAnomalyIncidentResponse
- RubrikCustomConnector
- RubrikDataObjectDiscovery
- RubrikFileObjectContextAnalysis
- RubrikFilesetRansomwareDiscovery
- RubrikIOCScan
- RubrikPollAsyncResult
- RubrikRansomwareDiscoveryAndFileRecovery
- RubrikRansomwareDiscoveryAndVMRecovery
- RubrikRetrieveUserIntelligenceInformation
- RubrikUpdateAnomalyStatusViaIncident
- Images
- RubrikUpdateAnomalyStatus
- Images
- RubrikUserIntelligenceAnalysis
- RubrikWorkloadAnalysis
- SAP ETD Cloud
- Analytic Rules
- Data Connectors
- SAPETD_PUSH_CCP
- Data
- Package
- SAP LogServ
- Analytic Rules
- Data Connectors
- SAPLogServ_PUSH_CCP
- Data
- Package
- SAP/Agentless
- SIGNL4
- Package
- SOC Handbook
- Package
- Workbooks
- Samsung Knox Asset Intelligence
- Analytic Rules
- Data Connectors
- Package
- Semperis Directory Services Protector
- Analytic Rules
- Data
- Package
- Parsers
- Workbooks
- SentinelSOARessentials
- Data
- Package
- Playbooks
- Notify-IncidentClosed
- Notify-IncidentSeverityChanged
- Post-Message-Slack
- incident-trigger
- Post-Message-Teams
- alert-trigger
- incident-trigger
- Send-basic-email
- Send-email-with-formatted-incident-report
- relateAlertsToIncident-basedOnIP
- SlackAudit
- Data Connectors
- SlackAuditLog_CCP
- Package
- Parsers
- data
- SquidProxy
- Package
- Parsers
- Styx Intelligence
- Data Connectors/Alerts
- Data
- Package
- Tanium
- Data
- Package
- Playbooks
- Tanium-Apply-SecurityPatches-WithReboot
- images
- Tanium-Apply-SecurityPatches-WithoutReboot
- images
- Tanium-ComplyFindings
- Tanium-GeneralHostInfo
- Tanium-MSDefenderHealth
- Tanium-QuarantineHosts
- Tanium-ResolveThreatResponseAlert
- Tanium-SCCMClientHealth
- Tanium-SecurityPatches
- Tanium-UnquarantineHosts
- Workbooks
- Team Cymru Scout
- Data Connectors/TeamCymruScout
- AccountUsageDataCollector
- DomainDataCollector
- IPDataCollector
- Data
- Package
- Parsers
- Playbooks
- TeamCymruScoutCreateIncidentAndNotify
- TeamCymruScoutEnrichIncident
- TeamCymruScoutLiveInvestigation
- Workbooks
- Images
- Tenable App/Data Connectors/TenableVM
- Threat Intelligence (NEW)
- Analytic Rules
- Data
- Hunting Queries
- Package
- Parsers
- Workbooks
- Threat Intelligence
- Analytic Rules
- Data
- ThreatIntelligence-Update/Analytic Rules
- Trend Micro Vision One/Data Connectors
- AzureFunctionTrendMicroXDR
- queue_trigger_wb
- timer_trigger_oat
- timer_trigger
- VMware vCenter
- Package
- Parsers
- Vectra XDR
- Data Connectors/VectraDataConnector
- Package
- VirusTotal
- Package
- Playbooks
- Get-VirusTotalDomainReport
- alert-trigger
- incident-trigger
- Get-VirusTotalFileInfo
- alert-trigger
- incident-trigger
- Get-VirusTotalIPReport
- alert-trigger
- incident-trigger
- Get-VirusTotalURLReport
- alert-trigger
- incident-trigger
- Windows Firewall/Data Connectors
- WithSecureElementsViaFunction
- Data Connectors
- WithSecureElementsAzureFunction/lib
- Data
- Package
- ZoomReports/Data Connectors
- Tools
- Create-Azure-Sentinel-Solution
- V3
- ccpimages
- arm-ttk
- common
- Playbook-ARM-Template-Generator/src
- Sample Code/AzureSentinel-ManagementAPICsharp
- AzureSentinel_ManagementAPI
- .vscode
- Actions
- Models
- AlertRuleTemplates
- AlertRules
- Models
- Bookmarks
- Models
- DataConnectors
- Models
- Hunting
- Models
- IncidentRelation
- Models
- Incidents
- Models
- Comments
- Infrastructure
- Authentication
- Configuration
- Templates
- ActionPayload
- BookmarkPayload
- DataConnectorPayload
- FusionAlertRulePayload
- IncidentCommentPayload
- IncidentPayload
- SavedSearchPayload
- ScheduledAlertRulePayload
- SecurityAlertRulePayload
- Images
- stats
- Workbooks
- Images
- Logos
- Preview
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
1,675 files changed
+168633
-59573
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
32 | 32 | | |
33 | 33 | | |
34 | 34 | | |
35 | | - | |
36 | | - | |
| 35 | + | |
| 36 | + | |
37 | 37 | | |
38 | 38 | | |
39 | 39 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
26 | 26 | | |
27 | 27 | | |
28 | 28 | | |
| 29 | + | |
| 30 | + | |
| 31 | + | |
29 | 32 | | |
30 | 33 | | |
31 | 34 | | |
| |||
336 | 339 | | |
337 | 340 | | |
338 | 341 | | |
339 | | - | |
| 342 | + | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
16 | 16 | | |
17 | 17 | | |
18 | 18 | | |
| 19 | + | |
| 20 | + | |
| 21 | + | |
| 22 | + | |
| 23 | + | |
| 24 | + | |
19 | 25 | | |
20 | 26 | | |
21 | 27 | | |
| |||
47 | 53 | | |
48 | 54 | | |
49 | 55 | | |
50 | | - | |
| 56 | + | |
51 | 57 | | |
52 | 58 | | |
53 | 59 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
111 | 111 | | |
112 | 112 | | |
113 | 113 | | |
114 | | - | |
| 114 | + | |
115 | 115 | | |
116 | 116 | | |
117 | 117 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
71 | 71 | | |
72 | 72 | | |
73 | 73 | | |
74 | | - | |
| 74 | + | |
75 | 75 | | |
76 | 76 | | |
77 | | - | |
78 | | - | |
79 | | - | |
80 | | - | |
81 | | - | |
82 | | - | |
83 | | - | |
84 | | - | |
85 | | - | |
86 | | - | |
87 | | - | |
| 77 | + | |
| 78 | + | |
| 79 | + | |
| 80 | + | |
| 81 | + | |
| 82 | + | |
| 83 | + | |
| 84 | + | |
| 85 | + | |
| 86 | + | |
| 87 | + | |
| 88 | + | |
| 89 | + | |
| 90 | + | |
| 91 | + | |
| 92 | + | |
| 93 | + | |
88 | 94 | | |
89 | 95 | | |
90 | 96 | | |
| |||
95 | 101 | | |
96 | 102 | | |
97 | 103 | | |
98 | | - | |
| 104 | + | |
99 | 105 | | |
100 | 106 | | |
Lines changed: 114 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
| 1 | + | |
| 2 | + | |
| 3 | + | |
| 4 | + | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
| 8 | + | |
| 9 | + | |
| 10 | + | |
| 11 | + | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
| 20 | + | |
| 21 | + | |
| 22 | + | |
| 23 | + | |
| 24 | + | |
| 25 | + | |
| 26 | + | |
| 27 | + | |
| 28 | + | |
| 29 | + | |
| 30 | + | |
| 31 | + | |
| 32 | + | |
| 33 | + | |
| 34 | + | |
| 35 | + | |
| 36 | + | |
| 37 | + | |
| 38 | + | |
| 39 | + | |
| 40 | + | |
| 41 | + | |
| 42 | + | |
| 43 | + | |
| 44 | + | |
| 45 | + | |
| 46 | + | |
| 47 | + | |
| 48 | + | |
| 49 | + | |
| 50 | + | |
| 51 | + | |
| 52 | + | |
| 53 | + | |
| 54 | + | |
| 55 | + | |
| 56 | + | |
| 57 | + | |
| 58 | + | |
| 59 | + | |
| 60 | + | |
| 61 | + | |
| 62 | + | |
| 63 | + | |
| 64 | + | |
| 65 | + | |
| 66 | + | |
| 67 | + | |
| 68 | + | |
| 69 | + | |
| 70 | + | |
| 71 | + | |
| 72 | + | |
| 73 | + | |
| 74 | + | |
| 75 | + | |
| 76 | + | |
| 77 | + | |
| 78 | + | |
| 79 | + | |
| 80 | + | |
| 81 | + | |
| 82 | + | |
| 83 | + | |
| 84 | + | |
| 85 | + | |
| 86 | + | |
| 87 | + | |
| 88 | + | |
| 89 | + | |
| 90 | + | |
| 91 | + | |
| 92 | + | |
| 93 | + | |
| 94 | + | |
| 95 | + | |
| 96 | + | |
| 97 | + | |
| 98 | + | |
| 99 | + | |
| 100 | + | |
| 101 | + | |
| 102 | + | |
| 103 | + | |
| 104 | + | |
| 105 | + | |
| 106 | + | |
| 107 | + | |
| 108 | + | |
| 109 | + | |
| 110 | + | |
| 111 | + | |
| 112 | + | |
| 113 | + | |
| 114 | + | |
Lines changed: 101 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
| 1 | + | |
| 2 | + | |
| 3 | + | |
| 4 | + | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
| 8 | + | |
| 9 | + | |
| 10 | + | |
| 11 | + | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
| 20 | + | |
| 21 | + | |
| 22 | + | |
| 23 | + | |
| 24 | + | |
| 25 | + | |
| 26 | + | |
| 27 | + | |
| 28 | + | |
| 29 | + | |
| 30 | + | |
| 31 | + | |
| 32 | + | |
| 33 | + | |
| 34 | + | |
| 35 | + | |
| 36 | + | |
| 37 | + | |
| 38 | + | |
| 39 | + | |
| 40 | + | |
| 41 | + | |
| 42 | + | |
| 43 | + | |
| 44 | + | |
| 45 | + | |
| 46 | + | |
| 47 | + | |
| 48 | + | |
| 49 | + | |
| 50 | + | |
| 51 | + | |
| 52 | + | |
| 53 | + | |
| 54 | + | |
| 55 | + | |
| 56 | + | |
| 57 | + | |
| 58 | + | |
| 59 | + | |
| 60 | + | |
| 61 | + | |
| 62 | + | |
| 63 | + | |
| 64 | + | |
| 65 | + | |
| 66 | + | |
| 67 | + | |
| 68 | + | |
| 69 | + | |
| 70 | + | |
| 71 | + | |
| 72 | + | |
| 73 | + | |
| 74 | + | |
| 75 | + | |
| 76 | + | |
| 77 | + | |
| 78 | + | |
| 79 | + | |
| 80 | + | |
| 81 | + | |
| 82 | + | |
| 83 | + | |
| 84 | + | |
| 85 | + | |
| 86 | + | |
| 87 | + | |
| 88 | + | |
| 89 | + | |
| 90 | + | |
| 91 | + | |
| 92 | + | |
| 93 | + | |
| 94 | + | |
| 95 | + | |
| 96 | + | |
| 97 | + | |
| 98 | + | |
| 99 | + | |
| 100 | + | |
| 101 | + | |
0 commit comments