Skip to content

Fixes to Anvilogic CCF Data Connector #12648

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rahul0216 merged 16 commits into from
Sep 1, 2025
Merged

Fixes to Anvilogic CCF Data Connector #12648

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
6bc795a
Adds Anvilogic_Alerts_CL table and fixes Analytics Rule template and …
jesweene Aug 13, 2025
0069f95
Updating version numbers to 3.0.1 for connector and 1.0.1 for AR
jesweene Aug 14, 2025
802a688
Merge branch 'master' into pr/12648
v-maheshbh Aug 19, 2025
89fa161
Removing hardcoded URL
jesweene Aug 19, 2025
b79cff8
repackaging the new mainTemplate.json
jesweene Aug 19, 2025
7380dfb
Merge branch 'master' into pr/12648
v-maheshbh Aug 22, 2025
23ffd26
Re-sorting release notes
jesweene Aug 26, 2025
fa1a870
Using the packaging tool to generate MainTemplate.json
jesweene Aug 26, 2025
659fb18
reverting the changes to queryFrequency, queryPeriod, and suppression…
jesweene Aug 28, 2025
a4f30a2
solution Packaged.
v-maheshbh Aug 29, 2025
65ef760
Add template ID to skip ID validations list
v-maheshbh Aug 29, 2025
9d1b06f
Merge branch 'master' into pr/12648
v-maheshbh Aug 29, 2025
10d0e7a
Update Anvilogic_Alerts.yaml
v-maheshbh Aug 29, 2025
acb4623
Remove trailing space in alertDisplayNameFormat
v-maheshbh Aug 29, 2025
be26bd3
Merge branch 'master' into pr/12648
v-maheshbh Aug 29, 2025
82d2de0
Revert "Add template ID to skip ID validations list"
v-maheshbh Sep 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions Solutions/Anvilogic/Analytic Rules/Anvilogic_Alerts.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,21 +12,21 @@ queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: 5h
suppressionDuration: 1h
suppressionEnabled: false
tactics: []
relevantTechniques: []
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
enabled: false
reopenClosedIncident: false
lookbackDuration: 5h
lookbackDuration: PT5M
matchingMethod: AllEntities
eventGroupingSettings:
aggregationKind: AlertPerResult
alertDetailsOverride:
alertDisplayNameFormat: "{{avl_rule_id}} - {{avl_use_case_title}} - {{avl_use_case_type}} "
alertDisplayNameFormat: "{{avl_rule_id}} - {{avl_use_case_title}} - {{avl_use_case_type}}"
alertDescriptionFormat: "avl_rule_id: {{avl_rule_id}} \n{{avl_definition}}"
"alertTacticsColumnName": "avl_mitre_tactic"
alertDynamicProperties:
Expand Down Expand Up @@ -89,5 +89,5 @@ entityMappings:
columnName: registry_value_data
- identifier: ValueType
columnName: registry_value_type
version: 1.0.0
version: 1.0.1
kind: Scheduled
4 changes: 2 additions & 2 deletions Solutions/Anvilogic/Data Connectors/AnviLogic_CCF/Anvilogic_DCR.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1173,7 +1173,7 @@
"logAnalytics": [
{
"workspaceResourceId": "{{workspaceResourceId}}",
"name": "{{workspaceId}}"
"name": "clv2ws1"
}
]
},
Expand All @@ -1183,7 +1183,7 @@
"Custom-Anvilogic_Alerts_CL"
],
"destinations": [
"{{workspaceId}}"
"clv2ws1"
],
"transformKql": "source",
"outputStream": "Custom-Anvilogic_Alerts_CL"
Expand Down
2 changes: 1 addition & 1 deletion Solutions/Anvilogic/Data Connectors/AnviLogic_CCF/Anvilogic_DataConnectorDefinition.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@
"type": "Textbox",
"parameters": {
"label": "Token Endpoint",
"placeholder": "https://login.microsoftonline.com/<tenant_id>/oauth2/v2.0/token",
"placeholder": "https://login[.]microsoftonline[.]com/<tenant_id>/oauth2/v2.0/token",
"type": "text",
"name": "tokenEndpoint"
}
Expand Down
Loading
Loading