Skip to content

Commit 66a5975

Browse files
v-prasadbokev-prasadboke
authored
Merge pull request #11634 from Azure/v-shukore/PaloAltoPANOS
solution packaged for Removed Custom Entity mappings
2 parents 9bd0292 + b8d9e77 commit 66a5975

File tree

8 files changed

+51
-53
lines changed

8 files changed

+51
-53
lines changed

‎Solutions/Pulse Connect Secure/Data/Solution_Pulse Connect Secure.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
"azuresentinel.azure-sentinel-solution-syslog"
1818
],
1919
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Pulse Connect Secure",
20-
"Version": "3.0.3",
20+
"Version": "3.0.4",
2121
"Metadata": "SolutionMetadata.json",
2222
"TemplateSpec": true
2323
}

‎Solutions/Pulse Connect Secure/Package/3.0.4.zip‎

8.57 KB
Binary file not shown.

‎Solutions/Pulse Connect Secure/Package/mainTemplate.json‎

Lines changed: 25 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@
4141
"email": "support@microsoft.com",
4242
"_email": "[variables('email')]",
4343
"_solutionName": "Pulse Connect Secure",
44-
"_solutionVersion": "3.0.3",
44+
"_solutionVersion": "3.0.4",
4545
"solutionId": "azuresentinel.azure-sentinel-solution-pulseconnectsecure",
4646
"_solutionId": "[variables('solutionId')]",
4747
"parserObject1": {
@@ -59,18 +59,18 @@
5959
"workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
6060
"_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]",
6161
"analyticRuleObject1": {
62-
"analyticRuleVersion1": "1.0.3",
62+
"analyticRuleVersion1": "1.0.4",
6363
"_analyticRulecontentId1": "34663177-8abf-4db1-b0a4-5683ab273f44",
6464
"analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '34663177-8abf-4db1-b0a4-5683ab273f44')]",
6565
"analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('34663177-8abf-4db1-b0a4-5683ab273f44')))]",
66-
"_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','34663177-8abf-4db1-b0a4-5683ab273f44','-', '1.0.3')))]"
66+
"_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','34663177-8abf-4db1-b0a4-5683ab273f44','-', '1.0.4')))]"
6767
},
6868
"analyticRuleObject2": {
69-
"analyticRuleVersion2": "1.0.3",
69+
"analyticRuleVersion2": "1.0.4",
7070
"_analyticRulecontentId2": "1fa1528e-f746-4794-8a41-14827f4cb798",
7171
"analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1fa1528e-f746-4794-8a41-14827f4cb798')]",
7272
"analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1fa1528e-f746-4794-8a41-14827f4cb798')))]",
73-
"_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1fa1528e-f746-4794-8a41-14827f4cb798','-', '1.0.3')))]"
73+
"_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1fa1528e-f746-4794-8a41-14827f4cb798','-', '1.0.4')))]"
7474
},
7575
"_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
7676
},
@@ -84,7 +84,7 @@
8484
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
8585
],
8686
"properties": {
87-
"description": "PulseConnectSecure Data Parser with template version 3.0.3",
87+
"description": "PulseConnectSecure Data Parser with template version 3.0.4",
8888
"mainTemplate": {
8989
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
9090
"contentVersion": "[variables('parserObject1').parserVersion1]",
@@ -216,7 +216,7 @@
216216
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
217217
],
218218
"properties": {
219-
"description": "PulseConnectSecure Workbook with template version 3.0.3",
219+
"description": "PulseConnectSecure Workbook with template version 3.0.4",
220220
"mainTemplate": {
221221
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
222222
"contentVersion": "[variables('workbookVersion1')]",
@@ -272,10 +272,6 @@
272272
"contentId": "Syslog",
273273
"kind": "DataType"
274274
},
275-
{
276-
"contentId": "PulseConnectSecure",
277-
"kind": "DataConnector"
278-
},
279275
{
280276
"contentId": "SyslogAma",
281277
"kind": "DataConnector"
@@ -308,7 +304,7 @@
308304
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
309305
],
310306
"properties": {
311-
"description": "PulseConnectSecureVPN-BruteForce_AnalyticalRules Analytics Rule with template version 3.0.3",
307+
"description": "PulseConnectSecureVPN-BruteForce_AnalyticalRules Analytics Rule with template version 3.0.4",
312308
"mainTemplate": {
313309
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
314310
"contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]",
@@ -325,7 +321,7 @@
325321
"description": "This query identifies evidence of potential brute force attack by looking at multiple failed attempts to log into the VPN server",
326322
"displayName": "PulseConnectSecure - Potential Brute Force Attempts",
327323
"enabled": false,
328-
"query": "let threshold = 20;\nPulseConnectSecure\n| where Messages contains \"Login failed\"\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by User, Source_IP\n| where count_ > threshold\n| extend timestamp = StartTime, AccountCustomEntity = User, IPCustomEntity = Source_IP\n",
324+
"query": "let threshold = 20;\nPulseConnectSecure\n| where Messages contains \"Login failed\"\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by User, Source_IP\n| where count_ > threshold\n",
329325
"queryFrequency": "PT1H",
330326
"queryPeriod": "PT1H",
331327
"severity": "Low",
@@ -336,10 +332,10 @@
336332
"status": "Available",
337333
"requiredDataConnectors": [
338334
{
335+
"connectorId": "SyslogAma",
339336
"datatypes": [
340337
"Syslog"
341-
],
342-
"connectorId": "SyslogAma"
338+
]
343339
}
344340
],
345341
"tactics": [
@@ -350,22 +346,22 @@
350346
],
351347
"entityMappings": [
352348
{
353-
"entityType": "Account",
354349
"fieldMappings": [
355350
{
356351
"identifier": "FullName",
357-
"columnName": "AccountCustomEntity"
352+
"columnName": "User"
358353
}
359-
]
354+
],
355+
"entityType": "Account"
360356
},
361357
{
362-
"entityType": "IP",
363358
"fieldMappings": [
364359
{
365360
"identifier": "Address",
366-
"columnName": "IPCustomEntity"
361+
"columnName": "Source_IP"
367362
}
368-
]
363+
],
364+
"entityType": "IP"
369365
}
370366
]
371367
}
@@ -421,7 +417,7 @@
421417
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
422418
],
423419
"properties": {
424-
"description": "PulseConnectSecureVPN-DistinctFailedUserLogin_AnalyticalRules Analytics Rule with template version 3.0.3",
420+
"description": "PulseConnectSecureVPN-DistinctFailedUserLogin_AnalyticalRules Analytics Rule with template version 3.0.4",
425421
"mainTemplate": {
426422
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
427423
"contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]",
@@ -438,7 +434,7 @@
438434
"description": "This query identifies evidence of failed login attempts from a large number of distinct users on a Pulse Connect Secure VPN server",
439435
"displayName": "PulseConnectSecure - Large Number of Distinct Failed User Logins",
440436
"enabled": false,
441-
"query": "let threshold = 100;\nPulseConnectSecure\n| where Messages startswith \"Login failed\"\n| summarize dcount(User) by Computer, bin(TimeGenerated, 15m)\n| where dcount_User > threshold\n| extend timestamp = TimeGenerated, HostCustomEntity = Computer\n",
437+
"query": "let threshold = 100;\nPulseConnectSecure\n| where Messages startswith \"Login failed\"\n| summarize dcount(User) by Computer, bin(TimeGenerated, 15m)\n| where dcount_User > threshold\n",
442438
"queryFrequency": "PT1H",
443439
"queryPeriod": "PT1H",
444440
"severity": "Medium",
@@ -449,10 +445,10 @@
449445
"status": "Available",
450446
"requiredDataConnectors": [
451447
{
448+
"connectorId": "SyslogAma",
452449
"datatypes": [
453450
"Syslog"
454-
],
455-
"connectorId": "SyslogAma"
451+
]
456452
}
457453
],
458454
"tactics": [
@@ -463,13 +459,13 @@
463459
],
464460
"entityMappings": [
465461
{
466-
"entityType": "Host",
467462
"fieldMappings": [
468463
{
469464
"identifier": "FullName",
470-
"columnName": "HostCustomEntity"
465+
"columnName": "Computer"
471466
}
472-
]
467+
],
468+
"entityType": "Host"
473469
}
474470
]
475471
}
@@ -521,7 +517,7 @@
521517
"apiVersion": "2023-04-01-preview",
522518
"location": "[parameters('workspace-location')]",
523519
"properties": {
524-
"version": "3.0.3",
520+
"version": "3.0.4",
525521
"kind": "Solution",
526522
"contentSchemaVersion": "3.0.0",
527523
"displayName": "Pulse Connect Secure",

‎Solutions/Pulse Connect Secure/ReleaseNotes.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
22
|-------------|--------------------------------|-----------------------------------------------------|
3+
| 3.0.4 | 07-01-2025 | Removed Custom Entity mappings from **Analytic Rule** |
34
| 3.0.3 | 16-12-2024 | Removed Deprecated **Data Connector** |
45
| 3.0.2 | 01-08-2024 | Update **Parser** as part of Syslog migration |
56
| | | Deprecating data connectors |

‎Solutions/QualysVM/Package/3.0.1.zip‎

54.1 KB
Binary file not shown.

0 commit comments

Comments
 (0)