Skip to content

Commit 51f0f49

Browse files
v-dvedakv-dvedak
authored
Merge pull request #11794 from Azure/v-atulyadav/proofpointtapicm
Update analytical rule MalwareLinkClicked.yaml
2 parents 12ce962 + fc88608 commit 51f0f49

File tree

6 files changed

+31
-26
lines changed

6 files changed

+31
-26
lines changed

‎.script/tests/KqlvalidationsTests/CustomTables/ProofPointTAPClicksPermitted_CL.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,10 @@
4040
{
4141
"Name": "classification_s",
4242
"Type": "String"
43+
},
44+
{
45+
"Name": "threatStatus_s",
46+
"Type": "String"
4347
}
4448
]
4549
}

‎Solutions/ProofPointTap/Analytic Rules/MalwareLinkClicked.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ relevantTechniques:
1919
query: |
2020
ProofPointTAPClicksPermitted_CL
2121
| where classification_s =~ "malware"
22+
| where threatStatus_s != "cleared"
2223
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by TimeGenerated, Sender = sender_s, SenderIPAddress = senderIP_s, Recipient = recipient_s, TimeClicked = clickTime_t, URLClicked = url_s
2324
| extend RecipientName = tostring(split(Recipient, "@")[0]), RecipientUPNSuffix = tostring(split(Recipient, "@")[1])
2425
| extend SenderName = tostring(split(Sender, "@")[0]), SenderUPNSuffix = tostring(split(Sender, "@")[1])
@@ -47,5 +48,5 @@ entityMappings:
4748
fieldMappings:
4849
- identifier: Url
4950
columnName: URLClicked
50-
version: 1.0.4
51+
version: 1.0.5
5152
kind: Scheduled

‎Solutions/ProofPointTap/Package/3.0.5.zip‎

-471 Bytes
Binary file not shown.

‎Solutions/ProofPointTap/Package/createUiDefinition.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@
7171
}
7272
},
7373
{
74-
"name": "dataconnectors-link2",
74+
"name": "dataconnectors-link1",
7575
"type": "Microsoft.Common.TextBlock",
7676
"options": {
7777
"link": {

‎Solutions/ProofPointTap/Package/mainTemplate.json‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -68,11 +68,11 @@
6868
"_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','0558155e-4556-447e-9a22-828f2a7de06b','-', '1.0.4')))]"
6969
},
7070
"analyticRuleObject2": {
71-
"analyticRuleVersion2": "1.0.4",
71+
"analyticRuleVersion2": "1.0.5",
7272
"_analyticRulecontentId2": "8675dd7a-795e-4d56-a79c-fc848c5ee61c",
7373
"analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '8675dd7a-795e-4d56-a79c-fc848c5ee61c')]",
7474
"analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('8675dd7a-795e-4d56-a79c-fc848c5ee61c')))]",
75-
"_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','8675dd7a-795e-4d56-a79c-fc848c5ee61c','-', '1.0.4')))]"
75+
"_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','8675dd7a-795e-4d56-a79c-fc848c5ee61c','-', '1.0.5')))]"
7676
},
7777
"workbookVersion1": "1.0.0",
7878
"workbookContentId1": "ProofPointTAPWorkbook",
@@ -756,10 +756,10 @@
756756
"status": "Available",
757757
"requiredDataConnectors": [
758758
{
759+
"connectorId": "ProofpointTAP",
759760
"dataTypes": [
760761
"ProofPointTAPMessagesDelivered_CL"
761-
],
762-
"connectorId": "ProofpointTAP"
762+
]
763763
}
764764
],
765765
"tactics": [
@@ -773,7 +773,6 @@
773773
],
774774
"entityMappings": [
775775
{
776-
"entityType": "Account",
777776
"fieldMappings": [
778777
{
779778
"columnName": "Recipient",
@@ -787,10 +786,10 @@
787786
"columnName": "RecipientUPNSuffix",
788787
"identifier": "UPNSuffix"
789788
}
790-
]
789+
],
790+
"entityType": "Account"
791791
},
792792
{
793-
"entityType": "Account",
794793
"fieldMappings": [
795794
{
796795
"columnName": "Sender",
@@ -804,16 +803,17 @@
804803
"columnName": "SenderUPNSuffix",
805804
"identifier": "UPNSuffix"
806805
}
807-
]
806+
],
807+
"entityType": "Account"
808808
},
809809
{
810-
"entityType": "IP",
811810
"fieldMappings": [
812811
{
813812
"columnName": "SenderIPAddress",
814813
"identifier": "Address"
815814
}
816-
]
815+
],
816+
"entityType": "IP"
817817
}
818818
]
819819
}
@@ -886,7 +886,7 @@
886886
"description": "This query identifies a user clicking on an email link whose threat category is classified as a malware",
887887
"displayName": "Malware Link Clicked",
888888
"enabled": false,
889-
"query": "ProofPointTAPClicksPermitted_CL\n| where classification_s =~ \"malware\"\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by TimeGenerated, Sender = sender_s, SenderIPAddress = senderIP_s, Recipient = recipient_s, TimeClicked = clickTime_t, URLClicked = url_s\n| extend RecipientName = tostring(split(Recipient, \"@\")[0]), RecipientUPNSuffix = tostring(split(Recipient, \"@\")[1])\n| extend SenderName = tostring(split(Sender, \"@\")[0]), SenderUPNSuffix = tostring(split(Sender, \"@\")[1])\n",
889+
"query": "ProofPointTAPClicksPermitted_CL\n| where classification_s =~ \"malware\"\n| where threatStatus_s != \"cleared\"\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by TimeGenerated, Sender = sender_s, SenderIPAddress = senderIP_s, Recipient = recipient_s, TimeClicked = clickTime_t, URLClicked = url_s\n| extend RecipientName = tostring(split(Recipient, \"@\")[0]), RecipientUPNSuffix = tostring(split(Recipient, \"@\")[1])\n| extend SenderName = tostring(split(Sender, \"@\")[0]), SenderUPNSuffix = tostring(split(Sender, \"@\")[1])\n",
890890
"queryFrequency": "PT1H",
891891
"queryPeriod": "PT1H",
892892
"severity": "Medium",
@@ -897,10 +897,10 @@
897897
"status": "Available",
898898
"requiredDataConnectors": [
899899
{
900+
"connectorId": "ProofpointTAP",
900901
"dataTypes": [
901902
"ProofPointTAPClicksPermitted_CL"
902-
],
903-
"connectorId": "ProofpointTAP"
903+
]
904904
}
905905
],
906906
"tactics": [
@@ -914,7 +914,6 @@
914914
],
915915
"entityMappings": [
916916
{
917-
"entityType": "Account",
918917
"fieldMappings": [
919918
{
920919
"columnName": "Recipient",
@@ -928,10 +927,10 @@
928927
"columnName": "RecipientUPNSuffix",
929928
"identifier": "UPNSuffix"
930929
}
931-
]
930+
],
931+
"entityType": "Account"
932932
},
933933
{
934-
"entityType": "Account",
935934
"fieldMappings": [
936935
{
937936
"columnName": "Sender",
@@ -945,25 +944,26 @@
945944
"columnName": "SenderUPNSuffix",
946945
"identifier": "UPNSuffix"
947946
}
948-
]
947+
],
948+
"entityType": "Account"
949949
},
950950
{
951-
"entityType": "IP",
952951
"fieldMappings": [
953952
{
954953
"columnName": "SenderIPAddress",
955954
"identifier": "Address"
956955
}
957-
]
956+
],
957+
"entityType": "IP"
958958
},
959959
{
960-
"entityType": "URL",
961960
"fieldMappings": [
962961
{
963962
"columnName": "URLClicked",
964963
"identifier": "Url"
965964
}
966-
]
965+
],
966+
"entityType": "URL"
967967
}
968968
]
969969
}

‎Solutions/ProofPointTap/ReleaseNotes.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
22
|-------------|--------------------------------|--------------------------------------------------------------|
3-
| 3.0.5 | 05-07-2024 | Updated **Analytic Rules** MalwareAttachmentDelivered.yaml and MalwareLinkClicked.yaml |
4-
| 3.0.4 | 26-04-2024 | Repackaged for fix on parser in maintemplate to have old parsername and parentid |
5-
| 3.0.3 | 16-04-2024 | Repackaged for parser issue in maintemplate |
3+
| 3.0.5 | 12-01-2025 | Updated **Analytic Rule** MalwareLinkClicked.yaml |
4+
| 3.0.4 | 26-04-2024 | Repackaged for fix on parser in maintemplate to have old parsername and parentid |
5+
| 3.0.3 | 16-04-2024 | Repackaged for parser issue in maintemplate |
66
| 3.0.2 | 10-04-2024 | Added Azure Deploy button for government portal deployments |
77
| 3.0.1 | 10-10-2023 | Manual deployment instructions updated for **Data Connector**|
88
| 3.0.0 | 01-08-2023 | Updated solution logo with Microsoft Sentinel logo |

0 commit comments

Comments
 (0)