Skip to content

Commit 7290884

Browse files
v-sreddytv-sreddyt
committed
updated
1 parent 59eac13 commit 7290884

File tree

3 files changed

+15
-17
lines changed

3 files changed

+15
-17
lines changed

‎Solutions/Amazon Web Services NetworkFirewall/Data Connectors/AWSNetworkFirewallLogs_CCP/AWSNetworkFirewallLog_DCR.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@
8585
"destinations": [
8686
"clv2ws1"
8787
],
88-
"transformKql": "source | extend TimeGenerated = now() | extend FirewallName = firewall_name, EventTimestamp = event_timestamp, AvailabilityZone = availability_zone, TCPFlags = tostring(event.tcp.tcp_flags), Syn = tobool(event.tcp.syn), Fin = tobool(event.tcp.fin), Psh = tobool(event.tcp.psh), Ack = tobool(event.tcp.ack), Ecn= tobool(event.tcp.ecn), Rst = tobool(event.tcp.rst),AppProto = tostring(event.app_proto), SrcIp = tostring(event.src_ip), SrcPort = tostring(event.src_port), NetFlowPkts = tostring(event.netflow.pkts), NetFlowBytes = tostring(event.netflow.bytes), NetFlowStart = todatetime(event.netflow.start), NetFlowEnd = todatetime(event.netflow.end), NetFlowAge = tostring(event.netflow.age), NetFlowMinttl = tostring(event.netflow.min_ttl), NetFlowMaxttl = tostring(event.netflow.max_ttl), EventType = tostring(event.event_type) | where EventType == \"netflow\" |extend FlowId = tostring(event.flow_id), DestIp = tostring(event.dest_ip), DestPort = tostring(event.dest_port), Proto = tostring(event.proto) | project-away event, availability_zone, firewall_name",
88+
"transformKql": "source | extend TimeGenerated = now() | extend FirewallName = firewall_name, EventTimestamp = event_timestamp, AvailabilityZone = availability_zone, TCPFlags = tostring(event.tcp.tcp_flags), Syn = tobool(event.tcp.syn), Fin = tobool(event.tcp.fin), Psh = tobool(event.tcp.psh), Ack = tobool(event.tcp.ack), Ecn= tobool(event.tcp.ecn), Rst = tobool(event.tcp.rst),AppProto = tostring(event.app_proto), SrcIp = tostring(event.src_ip), SrcPort = tostring(event.src_port), NetFlowPkts = tostring(event.netflow.pkts), NetFlowBytes = tostring(event.netflow.bytes), NetFlowStart = todatetime(event.netflow.start), NetFlowEnd = todatetime(event.netflow.end), NetFlowAge = tostring(event.netflow.age), NetFlowMinttl = tostring(event.netflow.min_ttl), NetFlowMaxttl = tostring(event.netflow.max_ttl), EventType = tostring(event.event_type) | where EventType == \"netflow\" |extend FlowId = tostring(event.flow_id), DestIp = tostring(event.dest_ip), DestPort = tostring(event.dest_port), Proto = tostring(event.proto), EventType",
8989
"outputStream": "Microsoft-AWSNetworkFirewallFlow"
9090
},
9191
{
@@ -95,7 +95,7 @@
9595
"destinations": [
9696
"clv2ws1"
9797
],
98-
"transformKql": "source | extend TimeGenerated = now(), FirewallName = firewall_name, AvailabilityZone = availability_zone, EventTimestamp = event_timestamp, TxId = tostring(event.tx_id), AppProto = tostring(event.app_proto), SrcIp = tostring(event.src_ip), SrcPort = tostring(event.src_port), EventType = tostring(event.event_type) | where EventType == \"alert\" | extend Severity = tostring(event.alert.severity), SignatureId = tostring(event.alert.signature_id), Rev = tostring(event.alert.rev), Signature = tostring(event.alert.signature), AlertAction = tostring(event.alert.action), Category = tostring(event.alert.category), FlowId = tostring(event.flow_id), DestIp = tostring(event.dest_ip), DestPort = tostring(event.dest_port), Proto = tostring(event.proto), VerdictAction = tostring(event.verdict.action), Sni = tostring(event.tls.sni), Version = tostring(event.tls.version), PktSrc = tostring(event.pkt_src), Direction = tostring(event.direction) | project-away event",
98+
"transformKql": "source | extend TimeGenerated = now(), FirewallName = firewall_name, AvailabilityZone = availability_zone, EventTimestamp = todatetime(event_timestamp), TxId = tostring(event.tx_id), AppProto = tostring(event.app_proto), SrcIp = tostring(event.src_ip), SrcPort = tostring(event.src_port), EventType = tostring(event.event_type) | where EventType == \"alert\" | extend Severity = tostring(event.alert.severity), SignatureId = tostring(event.alert.signature_id), Rev = tostring(event.alert.rev), Signature = tostring(event.alert.signature), AlertAction = tostring(event.alert.action), Category = tostring(event.alert.category), FlowId = tostring(event.flow_id), DestIp = tostring(event.dest_ip), DestPort = tostring(event.dest_port), Proto = tostring(event.proto), VerdictAction = tostring(event.verdict.action), Sni = tostring(event.tls.sni), Version = tostring(event.tls.version), PktSrc = tostring(event.pkt_src), Direction = tostring(event.direction), EventType",
9999
"outputStream": "Microsoft-AWSNetworkFirewallAlert"
100100
},
101101
{
@@ -105,7 +105,7 @@
105105
"destinations": [
106106
"clv2ws1"
107107
],
108-
"transformKql": "source | extend TimeGenerated = now(), FirewallName = firewall_name, AvailabilityZone = availability_zone, EventTimestamp = event_timestamp, SrcIp = tostring(event.src_ip), SrcPort = tostring(event.src_port), DestIp = tostring(event.dest_ip), DestPort = tostring(event.dest_port), Sni = tostring(event.sni), LeafCertificateFingerprint = tostring(event.leaf_cert_fpr), Status = tostring(event.status), Action = tostring(event.action), ErrorMessage = tostring(event.tls_error.error_message) | project-away event",
108+
"transformKql": "source | extend TimeGenerated = now(), FirewallName = firewall_name, AvailabilityZone = availability_zone, EventTimestamp = todatetime(event_timestamp), SrcIp = tostring(event.src_ip), SrcPort = tostring(event.src_port), DestIp = tostring(event.dest_ip), DestPort = tostring(event.dest_port), Sni = tostring(event.sni), LeafCertificateFingerprint = tostring(event.leaf_cert_fpr), Status = tostring(event.status), Action = tostring(event.action), ErrorMessage = tostring(event.tls_error.error_message)",
109109
"outputStream": "Microsoft-AWSNetworkFirewallTls"
110110
}
111111
]

‎Solutions/Amazon Web Services NetworkFirewall/Package/3.0.0.zip‎

-19 Bytes
Binary file not shown.

‎Solutions/Amazon Web Services NetworkFirewall/Package/mainTemplate.json‎

Lines changed: 12 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -410,7 +410,7 @@
410410
"destinations": [
411411
"clv2ws1"
412412
],
413-
"transformKql": "source | extend TimeGenerated = now() | extend FirewallName = firewall_name, EventTimestamp = event_timestamp, AvailabilityZone = availability_zone, TCPFlags = tostring(event.tcp.tcp_flags), Syn = tobool(event.tcp.syn), Fin = tobool(event.tcp.fin), Psh = tobool(event.tcp.psh), Ack = tobool(event.tcp.ack), Ecn= tobool(event.tcp.ecn), Rst = tobool(event.tcp.rst),AppProto = tostring(event.app_proto), SrcIp = tostring(event.src_ip), SrcPort = tostring(event.src_port), NetFlowPkts = tostring(event.netflow.pkts), NetFlowBytes = tostring(event.netflow.bytes), NetFlowStart = todatetime(event.netflow.start), NetFlowEnd = todatetime(event.netflow.end), NetFlowAge = tostring(event.netflow.age), NetFlowMinttl = tostring(event.netflow.min_ttl), NetFlowMaxttl = tostring(event.netflow.max_ttl), EventType = tostring(event.event_type) | where EventType == \"netflow\" |extend FlowId = tostring(event.flow_id), DestIp = tostring(event.dest_ip), DestPort = tostring(event.dest_port), Proto = tostring(event.proto) | project-away event, availability_zone, firewall_name",
413+
"transformKql": "source | extend TimeGenerated = now() | extend FirewallName = firewall_name, EventTimestamp = event_timestamp, AvailabilityZone = availability_zone, TCPFlags = tostring(event.tcp.tcp_flags), Syn = tobool(event.tcp.syn), Fin = tobool(event.tcp.fin), Psh = tobool(event.tcp.psh), Ack = tobool(event.tcp.ack), Ecn= tobool(event.tcp.ecn), Rst = tobool(event.tcp.rst),AppProto = tostring(event.app_proto), SrcIp = tostring(event.src_ip), SrcPort = tostring(event.src_port), NetFlowPkts = tostring(event.netflow.pkts), NetFlowBytes = tostring(event.netflow.bytes), NetFlowStart = todatetime(event.netflow.start), NetFlowEnd = todatetime(event.netflow.end), NetFlowAge = tostring(event.netflow.age), NetFlowMinttl = tostring(event.netflow.min_ttl), NetFlowMaxttl = tostring(event.netflow.max_ttl), EventType = tostring(event.event_type) | where EventType == \"netflow\" |extend FlowId = tostring(event.flow_id), DestIp = tostring(event.dest_ip), DestPort = tostring(event.dest_port), Proto = tostring(event.proto), EventType",
414414
"outputStream": "Microsoft-AWSNetworkFirewallFlow"
415415
},
416416
{
@@ -420,7 +420,7 @@
420420
"destinations": [
421421
"clv2ws1"
422422
],
423-
"transformKql": "source | extend TimeGenerated = now(), FirewallName = firewall_name, AvailabilityZone = availability_zone, EventTimestamp = event_timestamp, TxId = tostring(event.tx_id), AppProto = tostring(event.app_proto), SrcIp = tostring(event.src_ip), SrcPort = tostring(event.src_port), EventType = tostring(event.event_type) | where EventType == \"alert\" | extend Severity = tostring(event.alert.severity), SignatureId = tostring(event.alert.signature_id), Rev = tostring(event.alert.rev), Signature = tostring(event.alert.signature), AlertAction = tostring(event.alert.action), Category = tostring(event.alert.category), FlowId = tostring(event.flow_id), DestIp = tostring(event.dest_ip), DestPort = tostring(event.dest_port), Proto = tostring(event.proto), VerdictAction = tostring(event.verdict.action), Sni = tostring(event.tls.sni), Version = tostring(event.tls.version), PktSrc = tostring(event.pkt_src), Direction = tostring(event.direction) | project-away event",
423+
"transformKql": "source | extend TimeGenerated = now(), FirewallName = firewall_name, AvailabilityZone = availability_zone, EventTimestamp = todatetime(event_timestamp), TxId = tostring(event.tx_id), AppProto = tostring(event.app_proto), SrcIp = tostring(event.src_ip), SrcPort = tostring(event.src_port), EventType = tostring(event.event_type) | where EventType == \"alert\" | extend Severity = tostring(event.alert.severity), SignatureId = tostring(event.alert.signature_id), Rev = tostring(event.alert.rev), Signature = tostring(event.alert.signature), AlertAction = tostring(event.alert.action), Category = tostring(event.alert.category), FlowId = tostring(event.flow_id), DestIp = tostring(event.dest_ip), DestPort = tostring(event.dest_port), Proto = tostring(event.proto), VerdictAction = tostring(event.verdict.action), Sni = tostring(event.tls.sni), Version = tostring(event.tls.version), PktSrc = tostring(event.pkt_src), Direction = tostring(event.direction), EventType",
424424
"outputStream": "Microsoft-AWSNetworkFirewallAlert"
425425
},
426426
{
@@ -430,7 +430,7 @@
430430
"destinations": [
431431
"clv2ws1"
432432
],
433-
"transformKql": "source | extend TimeGenerated = now(), FirewallName = firewall_name, AvailabilityZone = availability_zone, EventTimestamp = event_timestamp, SrcIp = tostring(event.src_ip), SrcPort = tostring(event.src_port), DestIp = tostring(event.dest_ip), DestPort = tostring(event.dest_port), Sni = tostring(event.sni), LeafCertificateFingerprint = tostring(event.leaf_cert_fpr), Status = tostring(event.status), Action = tostring(event.action), ErrorMessage = tostring(event.tls_error.error_message) | project-away event",
433+
"transformKql": "source | extend TimeGenerated = now(), FirewallName = firewall_name, AvailabilityZone = availability_zone, EventTimestamp = todatetime(event_timestamp), SrcIp = tostring(event.src_ip), SrcPort = tostring(event.src_port), DestIp = tostring(event.dest_ip), DestPort = tostring(event.dest_port), Sni = tostring(event.sni), LeafCertificateFingerprint = tostring(event.leaf_cert_fpr), Status = tostring(event.status), Action = tostring(event.action), ErrorMessage = tostring(event.tls_error.error_message)",
434434
"outputStream": "Microsoft-AWSNetworkFirewallTls"
435435
}
436436
]
@@ -718,6 +718,9 @@
718718
"defaultValue": "[parameters('workspace')]",
719719
"type": "securestring"
720720
},
721+
"streamName": {
722+
"type": "array"
723+
},
721724
"connectorDefinitionName": {
722725
"defaultValue": "Amazon Web Services NetworkFirewall (via Codeless Connector Platform) (Preview)",
723726
"type": "securestring",
@@ -743,11 +746,6 @@
743746
"defaultValue": "queueUrl",
744747
"type": "securestring",
745748
"minLength": 1
746-
},
747-
"streamName": {
748-
"defaultValue": "streamName",
749-
"type": "array",
750-
"minLength": 1
751749
}
752750
},
753751
"variables": {
@@ -787,14 +785,14 @@
787785
"kind": "AmazonWebServicesS3",
788786
"properties": {
789787
"connectorDefinitionName": "AwsNetworkFirewallCcpDefinition",
790-
"destinationTable": "AWSNetworkFirewallAlert",
788+
"destinationTable": "[[concat(parameters('streamName')[0],'_CL')]",
791789
"dataTypes": {
792790
"logs": {
793791
"state": "enabled"
794792
}
795793
},
796794
"dcrConfig": {
797-
"streamName": "Custom-AWSNetworkFirewall-AlertLog",
795+
"streamName": "[[parameters('streamName')[0]]",
798796
"dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]",
799797
"dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]"
800798
},
@@ -817,14 +815,14 @@
817815
"kind": "AmazonWebServicesS3",
818816
"properties": {
819817
"connectorDefinitionName": "AwsNetworkFirewallCcpDefinition",
820-
"destinationTable": "AWSNetworkFirewallFlow",
818+
"destinationTable": "[[concat(parameters('streamName')[0],'_CL')]",
821819
"dataTypes": {
822820
"logs": {
823821
"state": "enabled"
824822
}
825823
},
826824
"dcrConfig": {
827-
"streamName": "Custom-AWSNetworkFirewall-FlowLog",
825+
"streamName": "[[parameters('streamName')[0]]",
828826
"dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]",
829827
"dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]"
830828
},
@@ -847,14 +845,14 @@
847845
"kind": "AmazonWebServicesS3",
848846
"properties": {
849847
"connectorDefinitionName": "AwsNetworkFirewallCcpDefinition",
850-
"destinationTable": "AWSNetworkFirewallTls",
848+
"destinationTable": "[[concat(parameters('streamName')[0],'_CL')]",
851849
"dataTypes": {
852850
"logs": {
853851
"state": "enabled"
854852
}
855853
},
856854
"dcrConfig": {
857-
"streamName": "Custom-AWSNetworkFirewall-TlsLog",
855+
"streamName": "[[parameters('streamName')[0]]",
858856
"dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]",
859857
"dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]"
860858
},

0 commit comments

Comments
 (0)