Skip to content

Commit ce52f06

Browse files
authored
Merge pull request #11388 from Azure/v-rusraut/removingdepracteddc1
Repackaged - PaloAltoPANOS
2 parents 90624b5 + 1335a9f commit ce52f06

File tree

13 files changed

+32
-879
lines changed

13 files changed

+32
-879
lines changed

Solutions/PaloAlto-PAN-OS/Analytic Rules/FileHashEntity_Covid19_CommonSecurityLog.yaml

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,6 @@ description: |
55
severity: Medium
66
status: Available
77
requiredDataConnectors:
8-
- connectorId: PaloAltoNetworks
9-
dataTypes:
10-
- CommonSecurityLog
11-
- connectorId: PaloAltoNetworksAma
12-
dataTypes:
13-
- CommonSecurityLog
148
- connectorId: CefAma
159
dataTypes:
1610
- CommonSecurityLog
@@ -72,5 +66,5 @@ entityMappings:
7266
columnName: FileHashValue
7367
- identifier: Algorithm
7468
columnName: FileHashType
75-
version: 1.3.5
69+
version: 1.3.6
7670
kind: Scheduled

Solutions/PaloAlto-PAN-OS/Analytic Rules/PaloAlto-NetworkBeaconing.yaml

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,6 @@ description: |
1010
severity: Low
1111
status: Available
1212
requiredDataConnectors:
13-
- connectorId: PaloAltoNetworks
14-
dataTypes:
15-
- CommonSecurityLog
16-
- connectorId: PaloAltoNetworksAma
17-
dataTypes:
18-
- CommonSecurityLog
1913
- connectorId: CefAma
2014
dataTypes:
2115
- CommonSecurityLog
@@ -68,5 +62,5 @@ entityMappings:
6862
fieldMappings:
6963
- identifier: Address
7064
columnName: IPCustomEntity
71-
version: 1.0.4
65+
version: 1.0.5
7266
kind: Scheduled

Solutions/PaloAlto-PAN-OS/Analytic Rules/PaloAlto-PortScanning.yaml

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,6 @@ description: |
77
severity: Low
88
status: Available
99
requiredDataConnectors:
10-
- connectorId: PaloAltoNetworks
11-
dataTypes:
12-
- CommonSecurityLog
13-
- connectorId: PaloAltoNetworksAma
14-
dataTypes:
15-
- CommonSecurityLog
1610
- connectorId: CefAma
1711
dataTypes:
1812
- CommonSecurityLog
@@ -68,5 +62,5 @@ entityMappings:
6862
fieldMappings:
6963
- identifier: Address
7064
columnName: IPCustomEntity
71-
version: 1.0.6
65+
version: 1.0.7
7266
kind: Scheduled

Solutions/PaloAlto-PAN-OS/Analytic Rules/PaloAlto-UnusualThreatSignatures.yaml

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,6 @@ description: |
77
severity: Medium
88
status: Available
99
requiredDataConnectors:
10-
- connectorId: PaloAltoNetworks
11-
dataTypes:
12-
- CommonSecurityLog
13-
- connectorId: PaloAltoNetworksAma
14-
dataTypes:
15-
- CommonSecurityLog
1610
- connectorId: CefAma
1711
dataTypes:
1812
- CommonSecurityLog
@@ -59,5 +53,5 @@ entityMappings:
5953
fieldMappings:
6054
- identifier: Address
6155
columnName: SourceIP
62-
version: 1.0.2
56+
version: 1.0.3
6357
kind: Scheduled

Solutions/PaloAlto-PAN-OS/Hunting Queries/Palo Alto - potential beaconing detected.yaml

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,6 @@ description: |
66
severity: Low
77
status: Available
88
requiredDataConnectors:
9-
- connectorId: PaloAltoNetworks
10-
dataTypes:
11-
- CommonSecurityLog
12-
- connectorId: PaloAltoNetworksAma
13-
dataTypes:
14-
- CommonSecurityLog
159
- connectorId: CefAma
1610
dataTypes:
1711
- CommonSecurityLog
@@ -64,4 +58,4 @@ entityMappings:
6458
fieldMappings:
6559
- identifier: Address
6660
columnName: IPCustomEntity
67-
version: 1.0.4
61+
version: 1.0.5

Solutions/PaloAlto-PAN-OS/Hunting Queries/PaloAlto-HighRiskPorts.yaml

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,6 @@ description: |
44
'Identifies network connections whose ports are frequent targets of attacks and should not cross network boundaries or reach untrusted public networks.
55
Consider updating the firewall policies to block the connections.'
66
requiredDataConnectors:
7-
- connectorId: PaloAltoNetworks
8-
dataTypes:
9-
- CommonSecurityLog
10-
- connectorId: PaloAltoNetworksAma
11-
dataTypes:
12-
- CommonSecurityLog
137
- connectorId: CefAma
148
dataTypes:
159
- CommonSecurityLog
@@ -116,4 +110,4 @@ entityMappings:
116110
fieldMappings:
117111
- identifier: Address
118112
columnName: DestinationIP
119-
version: 1.0.1
113+
version: 1.0.2
-4.83 KB
Binary file not shown.

Solutions/PaloAlto-PAN-OS/Package/createUiDefinition.json

Lines changed: 3 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"config": {
77
"isWizard": false,
88
"basics": {
9-
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/PaloAlto-PAN-OS/logo/Palo-alto-logo.png\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/PaloAlto-PAN-OS/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Palo Alto Networks (Firewall)](https://www.paloaltonetworks.com/network-security/next-generation-firewall) Solution for Microsoft Sentinel allows you to easily connect your Palo Alto Networks Firewall logs with Microsoft Sentinel, to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization's network and improves your security operation capabilities. This solution also contains playbooks to help in automated remediation.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.\n\n**Data Connectors:** 2, **Workbooks:** 2, **Analytic Rules:** 4, **Hunting Queries:** 2, **Custom Azure Logic Apps Connectors:** 2, **Playbooks:** 7\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
9+
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/PaloAlto-PAN-OS/logo/Palo-alto-logo.png\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/PaloAlto-PAN-OS/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Palo Alto Networks (Firewall)](https://www.paloaltonetworks.com/network-security/next-generation-firewall) Solution for Microsoft Sentinel allows you to easily connect your Palo Alto Networks Firewall logs with Microsoft Sentinel, to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization's network and improves your security operation capabilities. This solution also contains playbooks to help in automated remediation.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.\n\n**Data Connector:** 1,**Workbooks:** 2, **Analytic Rules:** 4, **Hunting Queries:** 2, **Custom Azure Logic Apps Connectors:** 2, **Playbooks:** 7\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
1010
"subscription": {
1111
"resourceProviders": [
1212
"Microsoft.OperationsManagement/solutions",
@@ -51,30 +51,6 @@
5151
}
5252
],
5353
"steps": [
54-
{
55-
"name": "dataconnectors",
56-
"label": "Data Connectors",
57-
"bladeTitle": "Data Connectors",
58-
"elements": [
59-
{
60-
"name": "dataconnectors1-text",
61-
"type": "Microsoft.Common.TextBlock",
62-
"options": {
63-
"text": "This Solution installs the data connector for PaloAlto-PAN-OS. You can get PaloAlto-PAN-OS CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
64-
}
65-
},
66-
{
67-
"name": "dataconnectors-link2",
68-
"type": "Microsoft.Common.TextBlock",
69-
"options": {
70-
"link": {
71-
"label": "Learn more about connecting data sources",
72-
"uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources"
73-
}
74-
}
75-
}
76-
]
77-
},
7854
{
7955
"name": "workbooks",
8056
"label": "Workbooks",
@@ -246,7 +222,7 @@
246222
"name": "huntingquery1-text",
247223
"type": "Microsoft.Common.TextBlock",
248224
"options": {
249-
"text": "Identifies network connections whose ports are frequent targets of attacks and should not cross network boundaries or reach untrusted public networks.\nConsider updating the firewall policies to block the connections. This hunting query depends on PaloAltoNetworks PaloAltoNetworksAma CefAma data connector (CommonSecurityLog CommonSecurityLog CommonSecurityLog Parser or Table)"
225+
"text": "Identifies network connections whose ports are frequent targets of attacks and should not cross network boundaries or reach untrusted public networks.\nConsider updating the firewall policies to block the connections. This hunting query depends on CefAma data connector (CommonSecurityLog Parser or Table)"
250226
}
251227
}
252228
]
@@ -260,7 +236,7 @@
260236
"name": "huntingquery2-text",
261237
"type": "Microsoft.Common.TextBlock",
262238
"options": {
263-
"text": "Identifies beaconing patterns from PAN traffic logs based on recurrent timedelta patterns.\n Reference Blog:https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/detect-network-beaconing-via-intra-request-time-delta-patterns/ba-p/779586 This hunting query depends on PaloAltoNetworks PaloAltoNetworksAma CefAma data connector (CommonSecurityLog CommonSecurityLog CommonSecurityLog Parser or Table)"
239+
"text": "Identifies beaconing patterns from PAN traffic logs based on recurrent timedelta patterns.\n Reference Blog:https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/detect-network-beaconing-via-intra-request-time-delta-patterns/ba-p/779586 This hunting query depends on CefAma data connector (CommonSecurityLog Parser or Table)"
264240
}
265241
}
266242
]

0 commit comments

Comments
 (0)