Skip to content

Commit f0d18f7

Browse files
v-atulyadavv-atulyadav
committed
Merge branch 'master' into dependabot/pip/Solutions/WithSecureElementsViaFunction/Data-Connectors/urllib3-2.5.0
2 parents 0f455be + 31d7ce6 commit f0d18f7

File tree

68 files changed

+7945
-886
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

68 files changed

+7945
-886
lines changed

‎.script/tests/KqlvalidationsTests/CustomTables/GoogleCloudSCC.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"Name": "GoogleCloudSCC",
3+
"Properties": [
4+
{
5+
"Name": "TimeGenerated",
6+
"Type": "DateTime"
7+
},
8+
{
9+
"Name": "TenantId",
10+
"Type": "String"
11+
},
12+
{
13+
"Name": "Findings",
14+
"Type": "Dynamic"
15+
},
16+
{
17+
"Name": "FindingsResource",
18+
"Type": "Dynamic"
19+
},
20+
{
21+
"Name": "SourceProperties",
22+
"Type": "Dynamic"
23+
},
24+
{
25+
"Name": "SourceSystem",
26+
"Type": "String"
27+
},
28+
{
29+
"Name": "Type",
30+
"Type": "String"
31+
}
32+
]
33+
}

‎.script/tests/KqlvalidationsTests/CustomTables/secRMM_CL.json‎

Lines changed: 135 additions & 151 deletions
Original file line numberDiff line numberDiff line change
@@ -1,153 +1,137 @@
11
{
2-
"Name":"secRMM_CL",
3-
"Properties":[
4-
{
5-
"Name": "_ResourceId",
6-
"Type": "string"
7-
},
8-
{
9-
"Name": "AdditionalProgramInfo",
10-
"Type": "string"
11-
},
12-
{
13-
"Name": "Computer",
14-
"Type": "string"
15-
},
16-
{
17-
"Name": "ConfigurationTarget",
18-
"Type": "string"
19-
},
20-
{
21-
"Name": "DeviceDescription",
22-
"Type": "string"
23-
},
24-
{
25-
"Name": "Drive",
26-
"Type": "string"
27-
},
28-
{
29-
"Name": "Event",
30-
"Type": "string"
31-
},
32-
{
33-
"Name": "InternalID",
34-
"Type": "string"
35-
},
36-
{
37-
"Name": "ManagementGroupName",
38-
"Type": "string"
39-
},
40-
{
41-
"Name": "Message",
42-
"Type": "string"
43-
},
44-
{
45-
"Name": "MG",
46-
"Type": "string"
47-
},
48-
{
49-
"Name": "Model",
50-
"Type": "string"
51-
},
52-
{
53-
"Name": "PreviousPropertyValue",
54-
"Type": "string"
55-
},
56-
{
57-
"Name": "ProgramName",
58-
"Type": "string"
59-
},
60-
{
61-
"Name": "ProgramPID_d",
62-
"Type": "real"
63-
},
64-
{
65-
"Name": "PropertyAction",
66-
"Type": "string"
67-
},
68-
{
69-
"Name": "PropertyName",
70-
"Type": "string"
71-
},
72-
{
73-
"Name": "PropertyOperationStatus",
74-
"Type": "string"
75-
},
76-
{
77-
"Name": "PropertyValue",
78-
"Type": "string"
79-
},
80-
{
81-
"Name": "RawData",
82-
"Type": "string"
83-
},
84-
{
85-
"Name": "SerialNumber_g",
86-
"Type": "string"
87-
},
88-
{
89-
"Name": "SourceFile",
90-
"Type": "string"
91-
},
92-
{
93-
"Name": "SourceFileLastWrite",
94-
"Type": "string"
95-
},
96-
{
97-
"Name": "SourceFileSize_d",
98-
"Type": "real"
99-
},
100-
{
101-
"Name": "SourceSystem",
102-
"Type": "string"
103-
},
104-
{
105-
"Name": "TargetFile",
106-
"Type": "string"
107-
},
108-
{
109-
"Name": "TenantId",
110-
"Type": "string"
111-
},
112-
{
113-
"Name": "TimeGenerated",
114-
"Type": "datetime"
115-
},
116-
{
117-
"Name": "Type",
118-
"Type": "string"
119-
},
120-
{
121-
"Name": "User",
122-
"Type": "string"
123-
},
124-
{
125-
"Name": "UserSID",
126-
"Type": "string"
127-
},
128-
{
129-
"Name": "Volume",
130-
"Type": "string"
131-
},
132-
{
133-
"Name": "Event_s",
134-
"Type": "string"
135-
},
136-
{
137-
"Name": "User_s",
138-
"Type": "string"
139-
},
140-
{
141-
"Name": "DeviceDescription_s",
142-
"Type": "string"
143-
},
144-
{
145-
"Name": "Drive_s",
146-
"Type": "string"
147-
},
148-
{
149-
"Name": "AdditionalProgramInfo_s",
150-
"Type": "string"
151-
}
152-
]
2+
"Name": "secRMM_CL",
3+
"Properties": [
4+
{
5+
"Name": "TenantId",
6+
"Type": "String"
7+
},
8+
{
9+
"Name": "SourceSystem",
10+
"Type": "String"
11+
},
12+
{
13+
"Name": "MG",
14+
"Type": "String"
15+
},
16+
{
17+
"Name": "ManagementGroupName",
18+
"Type": "String"
19+
},
20+
{
21+
"Name": "TimeGenerated",
22+
"Type": "DateTime"
23+
},
24+
{
25+
"Name": "Computer",
26+
"Type": "String"
27+
},
28+
{
29+
"Name": "RawData",
30+
"Type": "String"
31+
},
32+
{
33+
"Name": "Event_s",
34+
"Type": "String"
35+
},
36+
{
37+
"Name": "Time_s",
38+
"Type": "String"
39+
},
40+
{
41+
"Name": "UserSID_s",
42+
"Type": "String"
43+
},
44+
{
45+
"Name": "Drive_s",
46+
"Type": "String"
47+
},
48+
{
49+
"Name": "Volume_s",
50+
"Type": "String"
51+
},
52+
{
53+
"Name": "DeviceDescription_s",
54+
"Type": "String"
55+
},
56+
{
57+
"Name": "SerialNumber_s",
58+
"Type": "String"
59+
},
60+
{
61+
"Name": "Model_s",
62+
"Type": "String"
63+
},
64+
{
65+
"Name": "InternalID_s",
66+
"Type": "String"
67+
},
68+
{
69+
"Name": "TargetFile_s",
70+
"Type": "String"
71+
},
72+
{
73+
"Name": "SourceFile_s",
74+
"Type": "String"
75+
},
76+
{
77+
"Name": "SourceFileSize_s",
78+
"Type": "String"
79+
},
80+
{
81+
"Name": "SourceFileLastWrite_s",
82+
"Type": "String"
83+
},
84+
{
85+
"Name": "ProgramPID_s",
86+
"Type": "String"
87+
},
88+
{
89+
"Name": "Message",
90+
"Type": "String"
91+
},
92+
{
93+
"Name": "PropertyName_s",
94+
"Type": "String"
95+
},
96+
{
97+
"Name": "PropertyAction_s",
98+
"Type": "String"
99+
},
100+
{
101+
"Name": "PropertyValue_s",
102+
"Type": "String"
103+
},
104+
{
105+
"Name": "PreviousPropertyValue_s",
106+
"Type": "String"
107+
},
108+
{
109+
"Name": "ConfigurationTarget_s",
110+
"Type": "String"
111+
},
112+
{
113+
"Name": "PropertyOperationStatus_s",
114+
"Type": "String"
115+
},
116+
{
117+
"Name": "AdditionalProgramInfo_s",
118+
"Type": "String"
119+
},
120+
{
121+
"Name": "ProgramName_s",
122+
"Type": "String"
123+
},
124+
{
125+
"Name": "User_s",
126+
"Type": "String"
127+
},
128+
{
129+
"Name": "Type",
130+
"Type": "String"
131+
},
132+
{
133+
"Name": "_ResourceId",
134+
"Type": "String"
135+
}
136+
]
153137
}

‎.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,7 @@
9999
"Fortinet",
100100
"FortiWeb",
101101
"GCPDNSDataConnector",
102+
"GoogleSCCDefinition",
102103
"GWorkspaceRAPI",
103104
"GoogleWorkspaceReportsAPI",
104105
"GreyNoise2SentinelAPI",

‎DataConnectors/AWS-S3-AzureFunction/AzFun-AWS-S3-Ingestion.zip‎

23.6 MB
Binary file not shown.

‎DataConnectors/AWS-S3-AzureFunction/AzFun-AWS-S3-Ingestion/__init__.py‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -179,7 +179,10 @@ def get_files_list(self, ts_from, ts_to):
179179

180180
marker_end = (ts_from - datetime.timedelta(minutes=60)).strftime("/%Y-%m-%d/%Y-%m-%d-%H-%M")
181181

182-
for o in folders.get('CommonPrefixes'):
182+
# Handle case where CommonPrefixes might be None or empty (newer boto3 behavior)
183+
common_prefixes = folders.get('CommonPrefixes') or []
184+
185+
for o in common_prefixes:
183186
marker = o.get('Prefix') + s3_folder + marker_end
184187
folder = o.get('Prefix') + s3_folder
185188
while True:

‎DataConnectors/AWS-S3-AzureFunction/azuredeploy_awss3.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,7 @@
198198
"alwaysOn": true,
199199
"reserved": true,
200200
"siteConfig": {
201-
"linuxFxVersion": "python|3.9"
201+
"linuxFxVersion": "python|3.11"
202202
},
203203
"serverFarmId": "[concat('/subscriptions/', subscription().subscriptionId,'/resourcegroups/', resourceGroup().name, '/providers/Microsoft.Web/serverfarms/', variables('HostingPlanName'))]"
204204
},

‎DataConnectors/AWS-S3-AzureFunction/host.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,6 @@
1111
},
1212
"extensionBundle": {
1313
"id": "Microsoft.Azure.Functions.ExtensionBundle",
14-
"version": "[3.*, 4.0.0)"
14+
"version": "[4.*, 5.0.0)"
1515
}
1616
}

‎DataConnectors/AWS-S3-AzureFunction/requirements.txt‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,6 @@
33
# Manually managing azure-functions-worker may cause unexpected issues
44

55
azure-functions
6-
boto3==1.9.180
6+
boto3==1.28.85
7+
botocore==1.31.85
78
requests==2.31.0

‎DataConnectors/AWS-S3/README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,10 @@ When the script(s) complete, you must complete the Azure Sentinel data connector
5454

5555
By default, a log is created in the directory where the script is executed.
5656

57+
## Attack Disruption advance option Setup
58+
59+
The `awsScriptBash.zip` file contains a bash script for setting up AWS attack disruption capabilities. This script can be used in AWS CloudShell as an alternative to manual configuration for enhanced security response permissions.
60+
5761
## Advanced usage
5862

5963
The `ConfigAwsConnector.ps1` script has two parameters:

‎DataConnectors/AWS-S3/awsScriptBash.zip‎

888 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)