Skip to content

Commit 7018c2c

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request #12602 from jpkeepersecurity/master
Keeper Security Solution v3.0.1 - Add New Analytic Rules and Dashboard
2 parents 9a9547b + 37277fd commit 7018c2c

20 files changed

+1841
-7
lines changed

‎.script/tests/KqlvalidationsTests/CustomTables/KeeperSecurityEventNewLogs_CL.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"Name": "KeeperSecurityEventNewLogs_CL",
3+
"Properties": [
4+
{
5+
"Name": "TimeGenerated",
6+
"Type": "datetime"
7+
},
8+
{
9+
"Name": "AuditEvent",
10+
"Type": "string"
11+
},
12+
{
13+
"Name": "RemoteAddress",
14+
"Type": "string"
15+
},
16+
{
17+
"Name": "Category",
18+
"Type": "string"
19+
},
20+
{
21+
"Name": "ClientVersion",
22+
"Type": "string"
23+
},
24+
{
25+
"Name": "EnterpriseId",
26+
"Type": "int"
27+
},
28+
{
29+
"Name": "Username",
30+
"Type": "string"
31+
},
32+
{
33+
"Name": "Timestamp",
34+
"Type": "datetime"
35+
},
36+
{
37+
"Name": "Data",
38+
"Type": "dynamic"
39+
}
40+
]
41+
}

‎.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,7 @@
111111
"JamfProtect",
112112
"JiraAuditAPI",
113113
"JuniperSRX",
114+
"KeeperSecurityPush2",
114115
"LastPass",
115116
"LookoutAPI",
116117
"McAfeeePO",

‎Solutions/Keeper Security/Analytic Rules/Keeper Security - Alternate Master Password.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
id: f031fbbc-37d8-4667-b795-d386bf2b5ab2
2+
name: Keeper Security - Password Changed
3+
description: |
4+
'Creates an informational incident based on Keeper Security Password Changed data in Microsoft Sentinel'
5+
severity: Informational
6+
status: Available
7+
requiredDataConnectors:
8+
- connectorId: KeeperSecurityPush2
9+
dataTypes:
10+
- KeeperSecurityEventNewLogs_CL
11+
suppressionDuration: PT5H
12+
eventGroupingSettings:
13+
aggregationKind: AlertPerResult
14+
suppressionEnabled: false
15+
tactics:
16+
- Persistence
17+
relevantTechniques:
18+
- T1556
19+
query: |
20+
KeeperSecurityEventNewLogs_CL
21+
| where AuditEvent == "change_master_password"
22+
incidentConfiguration:
23+
createIncident: true
24+
groupingConfiguration:
25+
enabled: false
26+
reopenClosedIncident: false
27+
lookbackDuration: PT5H
28+
matchingMethod: AllEntities
29+
alertDetailsOverride:
30+
alertDisplayNameFormat: "{{AuditEvent}} on {{RemoteAddress}}"
31+
alertDescriptionFormat: "{{AuditEvent}} has been captured in the Keeper Security Event Logs"
32+
entityMappings:
33+
- entityType: Account
34+
fieldMappings:
35+
- identifier: FullName
36+
columnName: Username
37+
- entityType: IP
38+
fieldMappings:
39+
- identifier: Address
40+
columnName: RemoteAddress
41+
version: 1.0.3
42+
kind: NRT

‎Solutions/Keeper Security/Analytic Rules/Keeper Security - User MFA Changed.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
id: 75ffc8a4-86db-4f48-8506-cb4c049be484
2+
name: Keeper Security - User MFA Changed
3+
description: |
4+
'Creates an informational incident based on Keeper Security User MFA Changed data in Microsoft Sentinel'
5+
severity: Informational
6+
status: Available
7+
requiredDataConnectors:
8+
- connectorId: KeeperSecurityPush2
9+
dataTypes:
10+
- KeeperSecurityEventNewLogs_CL
11+
suppressionDuration: PT5H
12+
eventGroupingSettings:
13+
aggregationKind: AlertPerResult
14+
suppressionEnabled: false
15+
tactics:
16+
- Persistence
17+
relevantTechniques:
18+
- T1556
19+
query: |
20+
KeeperSecurityEventNewLogs_CL
21+
| where AuditEvent in (```set_two_factor_off```, ```set_two_factor_on```)
22+
incidentConfiguration:
23+
createIncident: true
24+
groupingConfiguration:
25+
enabled: false
26+
reopenClosedIncident: false
27+
lookbackDuration: PT5H
28+
matchingMethod: AllEntities
29+
alertDetailsOverride:
30+
alertDisplayNameFormat: "{{AuditEvent}} on {{RemoteAddress}}"
31+
alertDescriptionFormat: "{{AuditEvent}} has been captured in the Keeper Security Event Logs"
32+
entityMappings:
33+
- entityType: Account
34+
fieldMappings:
35+
- identifier: FullName
36+
columnName: Username
37+
- entityType: IP
38+
fieldMappings:
39+
- identifier: Address
40+
columnName: RemoteAddress
41+
version: 1.0.3
42+
kind: NRT

‎Solutions/Keeper Security/Data/Solution_KeeperSecurity.json‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,16 @@
33
"Author": "Joao Paulo Oliveira Santos - jsantos@keepersecurity.com",
44
"Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/keeper_security.svg\" width=\"75px\" height=\"75px\">",
55
"Description": "The [Keeper Security](https://keepersecurity.com/) solution for Microsoft Sentinel enables you to ingest [Keeper Security](https://keepersecurity.com/) forwarded into Microsoft Sentinel using the Microsoft Sentinel Analytics Workspace.",
6+
"Analytic Rules": [
7+
"Analytic Rules/Keeper Security - Alternate Master Password.yaml",
8+
"Analytic Rules/Keeper Security - User MFA Changed.yaml"
9+
],
610
"Data Connectors": [
711
"Data Connectors/KeeperSecurity_ccp/KepperSecurity_Definition.json"
812
],
13+
"Workbooks": [
14+
"Workbooks/KeeperSecurityDashboard.json"
15+
],
916
"BasePath": "/Users/joaopaulooliveriasantos/Projects/Azure-Sentinel/Solutions/KeeperSecurity",
1017
"Version": "3.0.0",
1118
"Metadata": "SolutionMetadata.json",

‎Solutions/Keeper Security/Package/3.0.1.zip‎

11.7 KB
Binary file not shown.

‎Solutions/Keeper Security/Package/createUiDefinition.json‎

Lines changed: 99 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"config": {
77
"isWizard": false,
88
"basics": {
9-
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/keeper_security.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Keeper%20Security/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Keeper Security](https://keepersecurity.com/) solution for Microsoft Sentinel enables you to ingest [Keeper Security](https://keepersecurity.com/) forwarded into Microsoft Sentinel using the Microsoft Sentinel Analytics Workspace.\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
9+
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/keeper_security.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Keeper%20Security/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Keeper Security](https://keepersecurity.com/) solution for Microsoft Sentinel enables you to ingest [Keeper Security](https://keepersecurity.com/) forwarded into Microsoft Sentinel using the Microsoft Sentinel Analytics Workspace.\n\n**Data Connectors:** 1, **Workbooks:** 1, **Analytic Rules:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
1010
"subscription": {
1111
"resourceProviders": [
1212
"Microsoft.OperationsManagement/solutions",
@@ -74,6 +74,104 @@
7474
}
7575
}
7676
]
77+
},
78+
{
79+
"name": "workbooks",
80+
"label": "Workbooks",
81+
"subLabel": {
82+
"preValidation": "Configure the workbooks",
83+
"postValidation": "Done"
84+
},
85+
"bladeTitle": "Workbooks",
86+
"elements": [
87+
{
88+
"name": "workbooks-text",
89+
"type": "Microsoft.Common.TextBlock",
90+
"options": {
91+
"text": "This solution installs workbook(s) to help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view."
92+
}
93+
},
94+
{
95+
"name": "workbooks-link",
96+
"type": "Microsoft.Common.TextBlock",
97+
"options": {
98+
"link": {
99+
"label": "Learn more",
100+
"uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data"
101+
}
102+
}
103+
},
104+
{
105+
"name": "workbook1",
106+
"type": "Microsoft.Common.Section",
107+
"label": "Keeper Security Dashboard",
108+
"elements": [
109+
{
110+
"name": "workbook1-text",
111+
"type": "Microsoft.Common.TextBlock",
112+
"options": {
113+
"text": "This workbook contains visualizations and insights in the Keeper Security environment."
114+
}
115+
}
116+
]
117+
}
118+
]
119+
},
120+
{
121+
"name": "analytics",
122+
"label": "Analytics",
123+
"subLabel": {
124+
"preValidation": "Configure the analytics",
125+
"postValidation": "Done"
126+
},
127+
"bladeTitle": "Analytics",
128+
"elements": [
129+
{
130+
"name": "analytics-text",
131+
"type": "Microsoft.Common.TextBlock",
132+
"options": {
133+
"text": "This solution installs the following analytic rule templates. After installing the solution, create and enable analytic rules in Manage solution view."
134+
}
135+
},
136+
{
137+
"name": "analytics-link",
138+
"type": "Microsoft.Common.TextBlock",
139+
"options": {
140+
"link": {
141+
"label": "Learn more",
142+
"uri": "https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef"
143+
}
144+
}
145+
},
146+
{
147+
"name": "analytic1",
148+
"type": "Microsoft.Common.Section",
149+
"label": "Keeper Security - Password Changed",
150+
"elements": [
151+
{
152+
"name": "analytic1-text",
153+
"type": "Microsoft.Common.TextBlock",
154+
"options": {
155+
"text": "Creates an informational incident based on Keeper Security Password Changed data in Microsoft Sentinel"
156+
}
157+
}
158+
]
159+
},
160+
{
161+
"name": "analytic2",
162+
"type": "Microsoft.Common.Section",
163+
"label": "Keeper Security - User MFA Changed",
164+
"elements": [
165+
{
166+
"name": "analytic2-text",
167+
"type": "Microsoft.Common.TextBlock",
168+
"options": {
169+
"text": "Creates an informational incident based on Keeper Security User MFA Changed data in Microsoft Sentinel"
170+
}
171+
}
172+
]
173+
}
174+
]
77175
}
78176
],
79177
"outputs": {

0 commit comments

Comments
 (0)