|
6 | 6 | "config": { |
7 | 7 | "isWizard": false, |
8 | 8 | "basics": { |
9 | | - "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/salesforce_logo.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Salesforce%20Service%20Cloud/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Salesforce Service Cloud](https://www.salesforce.com/in/products/service-cloud/overview/) solution for Microsoft Sentinel enables you to ingest Service Cloud events into Microsoft Sentinel.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", |
| 9 | + "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/salesforce_logo.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Salesforce%20Service%20Cloud/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Salesforce Service Cloud](https://www.salesforce.com/in/products/service-cloud/overview/) solution for Microsoft Sentinel enables you to ingest Service Cloud events into Microsoft Sentinel.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", |
10 | 10 | "subscription": { |
11 | 11 | "resourceProviders": [ |
12 | 12 | "Microsoft.OperationsManagement/solutions", |
|
60 | 60 | "name": "dataconnectors1-text", |
61 | 61 | "type": "Microsoft.Common.TextBlock", |
62 | 62 | "options": { |
63 | | - "text": "The Salesforce Service Cloud data connector provides the capability to ingest information about your Salesforce operational events into Microsoft Sentinel through the REST API. The connector provides the ability to review events in your org on an accelerated basis and get event log files in hourly increments for recent activity. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." |
| 63 | + "text": "This Solution installs the data connector for Salesforce Service Cloud. You can get Salesforce Service Cloud custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." |
64 | 64 | } |
65 | 65 | }, |
66 | 66 | { |
67 | 67 | "name": "dataconnectors-parser-text", |
68 | 68 | "type": "Microsoft.Common.TextBlock", |
69 | 69 | "options": { |
70 | | - "text": "The solution installs a parser that transforms ingested data. The transformed logs can be accessed using the SalesforceServiceCloud Kusto Function alias." |
| 70 | + "text": "The Solution installs a parser that transforms the ingested data into Microsoft Sentinel normalized format. The normalized format enables better correlation of different types of data from different data sources to drive end-to-end outcomes seamlessly in security monitoring, hunting, incident investigation and response scenarios in Microsoft Sentinel." |
71 | 71 | } |
72 | 72 | }, |
73 | 73 | { |
|
159 | 159 | "name": "analytic1-text", |
160 | 160 | "type": "Microsoft.Common.TextBlock", |
161 | 161 | "options": { |
162 | | - "text": "Identifies evidence of brute force activity against a user based on multiple authentication failures \nand at least one successful authentication within a given time window. This query limits IPAddresses to 100 and may not potentially cover all IPAddresses\nThe default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes." |
| 162 | + "text": "Identifies evidence of brute force activity against a user based on multiple authentication failures and at least one successful authentication within a given time window. This query limits IPAddresses to 100 and may not potentially cover all IPAddresses.\nThe default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes." |
163 | 163 | } |
164 | 164 | } |
165 | 165 | ] |
|
173 | 173 | "name": "analytic2-text", |
174 | 174 | "type": "Microsoft.Common.TextBlock", |
175 | 175 | "options": { |
176 | | - "text": "This query searches for failed attempts to log in from more than 15 various users within a 5 minute timeframe from the same source. This is a potential indication of a password spray attack." |
| 176 | + "text": "This query searches for failed attempts to log in from more than 15 various users within a 5 minutes timeframe from the same source. This is a potential indication of a password spray attack." |
177 | 177 | } |
178 | 178 | } |
179 | 179 | ] |
|
187 | 187 | "name": "analytic3-text", |
188 | 188 | "type": "Microsoft.Common.TextBlock", |
189 | 189 | "options": { |
190 | | - "text": "This query searches for successful user logins from different countries within 30min." |
| 190 | + "text": "This query searches for successful user logins from different countries within 30 mins." |
191 | 191 | } |
192 | 192 | } |
193 | 193 | ] |
|
0 commit comments