Merge branch 'master' into Srinivas-AWS-Netwrok-Firewall

Author: v-sreddyt

.github/workflows/codeql-analysis.yml

@@ -32,8 +32,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'javascript', 'python', 'ruby' ]
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        language: [ 'javascript', 'python', 'ruby', 'actions' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'actions' ]
         # Learn more about CodeQL language support at https://git.io/codeql-language-support
 
     steps:

.gitignore

@@ -26,6 +26,9 @@ bld/
 [Oo]bj/
 [Ll]og/
 
+# Execution results
+[Ll]ogs/
+
 # Visual Studio 2015/2017 cache/options directory
 .vs/
 # Uncomment if you have tasks that create the project's static files in wwwroot
@@ -336,4 +339,4 @@ Hunting Queries/DeployedQueries.json
 
 #Mac OSx
 .DS_Store
-!*Microsoft.Azure.Sentinel.KustoServices.*.nupkg
+!*Microsoft.Azure.Sentinel.KustoServices.*.nupkg

.script/dataConnectorValidator.ts

@@ -47,7 +47,7 @@ export async function IsValidDataConnectorSchema(filePath: string): Promise<Exit
   }
 
 function isPotentialConnectorJson(jsonFile: any) {
-  if(typeof jsonFile.id != "undefined" && typeof jsonFile.connectivityCriterias != "undefined")
+  if(typeof jsonFile.id != "undefined" && typeof jsonFile.connectivityCriterias != "undefined" && jsonFile.dataTypes.length > 0)
   {
     return true;
   }

.script/package-automation/hyperlink-validation.ps1

@@ -111,7 +111,7 @@ foreach($item in $filteredFiles)
 $exclusionList = @(".py$",".png$",".jpg$",".jpeg$",".conf$", ".svg$", ".html$", ".ps1$", ".psd1$", "requirements.txt$", "host.json$", "proxies.json$", "/function.json$", ".xml$", ".zip$", ".md$")
 $filterOutExclusionList = $finalFilteredFiles | Where-Object { $_ -notmatch ($exclusionList -join '|')  }
 
-$exclusionDomainList = @("&&sudo","schema.management","schemas.microsoft","twitter.com", "s-platform.api.opendns.com", "github.com", "azure.microsoft.com", "sts.windows.net")
+$exclusionDomainList = @("&&sudo","schema.management","schemas.microsoft","twitter.com", "s-platform.api.opendns.com", "github.com", "azure.microsoft.com", "sts.windows.net", "oauth2.googleapis.com", "monitoring.googleapis.com")
 
 foreach ($currentFile in $filterOutExclusionList)
 {

.script/package-automation/validateFieldTypes.ps1

@@ -71,7 +71,7 @@ try {
     }
 
     # identify in active resource parameters
-    $resourceContent = $mainTemplateFileContent.resources | Where-Object { $_.type -eq 'Microsoft.OperationalInsights/workspaces/providers/contentTemplates' }
+    $resourceContent = $mainTemplateFileContent.resources | Where-Object { $_.type -eq 'Microsoft.OperationalInsights/workspaces/providers/contentTemplates' -and $_.properties.contentKind -eq "ResourcesDataConnector"  }
 
     if ($null -ne $resourceContent -and $resourceContent.Count -gt 0) {
       $resourceLevelInvalidFields = @();
@@ -80,15 +80,15 @@ try {
         foreach ($param in $parameters) {
             $type = $param.Value.type.ToLower()
 
-            if ($type -ne 'securestring' -and $type -ne 'object') {
+            if ($type -ne 'securestring' -and $type -ne 'object' -and $type -ne 'array') {
                 $resourceLevelInvalidFields += $param.Name
             }
         }
       }
 
       if ($resourceLevelInvalidFields.Count -gt 0) {
         $hasInvalidResourceParameterType = $true
-        Write-Host "Invalid resource level parameters field(s) type. Please update the 'type' value for below given list to 'securestring' or 'object'"
+        Write-Host "Invalid resource level parameters field(s) type. Please update the 'type' value for below given list to 'securestring', 'object' or 'array'."
         foreach ($item in $resourceLevelInvalidFields) {
           Write-Host "--> $item"
         }

.script/tests/KqlvalidationsTests/CustomTables/Communication_Data_CL.json

@@ -0,0 +1,101 @@
+{
+    "Name": "Communication_Data_CL",
+    "Properties": [
+        {
+            "Name": "TimeGenerated",
+            "Type": "datetime"
+        },
+        {
+            "Name": "proto_d",
+            "Type": "real"
+        },
+        {
+            "Name": "proto_text_s",
+            "Type": "string"
+        },
+        {
+            "Name": "local_ip_s",
+            "Type": "string"
+        },
+        {
+            "Name": "local_min_port_d",
+            "Type": "real"
+        },
+        {
+            "Name": "local_max_port_d",
+            "Type": "real"
+        },
+        {
+            "Name": "local_country_codes_s",
+            "Type": "string"
+        },
+        {
+            "Name": "local_as_info_s",
+            "Type": "string"
+        },
+        {
+            "Name": "local_tags_s",
+            "Type": "string"
+        },
+        {
+            "Name": "local_unique_ports_d",
+            "Type": "real"
+        },
+        {
+            "Name": "local_top_services_s",
+            "Type": "string"
+        },
+        {
+            "Name": "peer_ip_s",
+            "Type": "string"
+        },
+        {
+            "Name": "peer_min_port_d",
+            "Type": "real"
+        },
+        {
+            "Name": "peer_max_port_d",
+            "Type": "real"
+        },
+        {
+            "Name": "peer_country_codes_s",
+            "Type": "string"
+        },
+        {
+            "Name": "peer_as_info_s",
+            "Type": "string"
+        },
+        {
+            "Name": "peer_tags_s",
+            "Type": "string"
+        },
+        {
+            "Name": "peer_unique_ports_d",
+            "Type": "real"
+        },
+        {
+            "Name": "peer_top_services_s",
+            "Type": "string"
+        },
+        {
+            "Name": "event_count_d",
+            "Type": "real"
+        },
+        {
+            "Name": "first_seen_s",
+            "Type": "string"
+        },
+        {
+            "Name": "last_seen_s",
+            "Type": "string"
+        },
+        {
+            "Name": "ip_s",
+            "Type": "string"
+        },
+        {
+            "Name": "Type",
+            "Type": "string"
+        }
+    ]
+}