Skip to content

Commit c4144d9

Browse files
v-prasadbokev-prasadboke
authored
New Solution GCP Waf (Azure#11810)
* CCP connector added * input file and solution metadata added * Solution packaged * column type format corrected * Create ReleaseNotes.md * Solution folder renamed * Solution name changes * Solution packaged * Typo error corrected * Naming convention
1 parent cb2490c commit c4144d9

File tree

11 files changed

+1272
-0
lines changed

11 files changed

+1272
-0
lines changed

‎Solutions/Google Cloud Platform Load Balancer Logs/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_DCR.json‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
[
2+
{
3+
"name": "gcpLoadBalancerLogsDCR",
4+
"apiVersion": "2021-09-01-preview",
5+
"type": "Microsoft.Insights/dataCollectionRules",
6+
"location": "{{location}}",
7+
"properties": {
8+
"streamDeclarations": {
9+
"Custom-GCPLoadBalancerStream": {
10+
"columns": [
11+
{
12+
"name": "insertId",
13+
"type": "string"
14+
},
15+
{
16+
"name": "jsonPayload",
17+
"type": "dynamic"
18+
},
19+
{
20+
"name": "logName",
21+
"type": "string"
22+
},
23+
{
24+
"name": "receiveTimestamp",
25+
"type": "datetime"
26+
},
27+
{
28+
"name": "resource",
29+
"type": "dynamic"
30+
},
31+
{
32+
"name": "timestamp",
33+
"type": "datetime"
34+
},
35+
{
36+
"name": "httpRequest",
37+
"type": "dynamic"
38+
},
39+
{
40+
"name": "severity",
41+
"type": "string"
42+
}
43+
]
44+
}
45+
},
46+
"dataSources": {},
47+
"destinations": {
48+
"logAnalytics": [
49+
{
50+
"workspaceResourceId": "{{workspaceResourceId}}",
51+
"name": "clv2ws1"
52+
}
53+
]
54+
},
55+
"dataFlows": [
56+
{
57+
"streams": [
58+
"Custom-GCPLoadBalancerStream"
59+
],
60+
"destinations": [
61+
"clv2ws1"
62+
],
63+
"transformKql": "source | extend jsonPayload = parse_json(todynamic(jsonPayload)) | extend resourceLabel = todynamic(resource).labels | extend httpRequest = parse_json(httpRequest) | project TimeGenerated=todatetime(receiveTimestamp),Timestamp=todatetime(timestamp),LogName=tostring(logName),InsertId=tostring(insertId),BackendTargetProjectNumber=tostring(jsonPayload.backendTargetProjectNumber),CacheDecision=todynamic(jsonPayload.cacheDecision),EnforcedSecurityPolicy=todynamic(jsonPayload.enforcedSecurityPolicy),PreviewSecurityPolicy=todynamic(jsonPayload.previewSecurityPolicy),EnforcedEdgeSecurityPolicy=todynamic(jsonPayload.enforcedEdgeSecurityPolicy),PayloadRemoteIp=tostring(jsonPayload.remoteIp),SecurityPolicyRequestData=todynamic(jsonPayload.securityPolicyRequestData),PreviewEdgeSecurityPolicy=todynamic(jsonPayload.previewEdgeSecurityPolicy),StatusDetails=tostring(jsonPayload.statusDetails),Latency=tostring(httpRequest.latency),RemoteIp=tostring(httpRequest.remoteIp),RequestMethod=tostring(httpRequest.requestMethod),RequestSize=tostring(httpRequest.requestSize),RequestUrl=tostring(httpRequest.requestUrl),RequestStatus=tostring(httpRequest.status),UserAgent=tostring(httpRequest.userAgent),BackendServiceName=tostring(resourceLabel.backend_service_name),ForwardingRuleName=tostring(resourceLabel.forwarding_rule_name),ProjectId=tostring(resourceLabel.project_id),UrlMapName=tostring(resourceLabel.url_map_name),Zone=tostring(resourceLabel.zone),Severity=tostring(severity)",
64+
"outputStream": "Custom-GCPLoadBalancerLogs_CL"
65+
}
66+
],
67+
"dataCollectionEndpointId": "{{dataCollectionEndpointId}}"
68+
}
69+
}
70+
]

‎Solutions/Google Cloud Platform Load Balancer Logs/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
{
2+
"name": "GCPFLoadBalancerLogsCCPDefinition",
3+
"apiVersion": "2022-09-01-preview",
4+
"type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
5+
"location": "{{location}}",
6+
"kind": "Customizable",
7+
"properties": {
8+
"connectorUiConfig": {
9+
"id": "GCPFLoadBalancerLogsCCPDefinition",
10+
"title": "GCP Pub/Sub Load Balancer Logs (Preview)",
11+
"publisher": "Microsoft",
12+
"descriptionMarkdown": "Google Cloud Platform (GCP) Load Balancer logs provide detailed insights into network traffic, capturing both inbound and outbound activities. These logs are used for monitoring access patterns and identifying potential security threats across GCP resources. Additionally, these logs also include GCP Web Application Firewall (WAF) logs, enhancing the ability to detect and mitigate risks effectively.",
13+
"graphQueriesTableName": "GCPLoadBalancerLogs_CL",
14+
"graphQueries": [
15+
{
16+
"metricName": "Total events received",
17+
"legend": "GCP Pub/Sub Load Balancer Logs",
18+
"baseQuery": "{{graphQueriesTableName}}"
19+
}
20+
],
21+
"sampleQueries": [
22+
{
23+
"description": "Get Sample of GCP Load Balancer Logs",
24+
"query": "{{graphQueriesTableName}}\n | take 10"
25+
}
26+
],
27+
"dataTypes": [
28+
{
29+
"name": "{{graphQueriesTableName}}",
30+
"lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
31+
}
32+
],
33+
"availability": {
34+
"status": 1,
35+
"isPreview": false
36+
},
37+
"connectivityCriteria": [
38+
{
39+
"type": "HasDataConnectors"
40+
}
41+
],
42+
"permissions": {
43+
"resourceProvider": [
44+
{
45+
"provider": "Microsoft.OperationalInsights/workspaces",
46+
"permissionsDisplayText": "Read and Write permissions are required.",
47+
"providerDisplayName": "Workspace",
48+
"scope": "Workspace",
49+
"requiredPermissions": {
50+
"read": true,
51+
"write": true,
52+
"delete": true,
53+
"action": false
54+
}
55+
}
56+
]
57+
},
58+
"instructionSteps": [
59+
{
60+
"instructions": [
61+
{
62+
"type": "MarkdownControlEnvBased",
63+
"parameters": {
64+
"prodScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation).",
65+
"govScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Gov Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov)."
66+
}
67+
},
68+
{
69+
"type": "CopyableLabel",
70+
"parameters": {
71+
"label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.",
72+
"fillWith": [
73+
"TenantId"
74+
],
75+
"name": "PoolId",
76+
"disabled": true
77+
}
78+
},
79+
{
80+
"type": "Markdown",
81+
"parameters": {
82+
"content": "#### 2. Enable Load Balancer logs \nIn your GCP account, navigate to the Load Balancer section. In here you can nevigate to [**Backend Service**] -> [**Edit**], once you are in the [**Backend Service**] on the [**Logging**] section **enable** the checkbox of [**Enable Logs**]. Once you open the rule, switch the toggle button under the **Logs** section to **On**, and save the changes.\n\nFor more information: [Link to documentation](https://cloud.google.com/load-balancing/docs/https/https-logging-monitoring)"
83+
}
84+
},
85+
{
86+
"type": "Markdown",
87+
"parameters": {
88+
"content": "#### 3. Connect new collectors \n To enable GCP Load Balancer Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect."
89+
}
90+
},
91+
{
92+
"type": "GCPGrid",
93+
"parameters": {}
94+
},
95+
{
96+
"type": "GCPContextPane",
97+
"parameters": {}
98+
}
99+
]
100+
}
101+
]
102+
}
103+
}
104+
}

‎Solutions/Google Cloud Platform Load Balancer Logs/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_PollingConfig.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
[
2+
{
3+
"name": "GCPFirewallLogsTemplateConnections",
4+
"apiVersion": "2023-02-01-preview",
5+
"type": "Microsoft.SecurityInsights/dataConnectors",
6+
"location": "{{location}}",
7+
"kind": "GCP",
8+
"properties": {
9+
"connectorDefinitionName": "GCPFLoadBalancerLogsCCPDefinition",
10+
"dcrConfig": {
11+
"streamName": "Custom-GCPLoadBalancerStream",
12+
"dataCollectionEndpoint": "{{dataCollectionEndpoint}}",
13+
"dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}"
14+
},
15+
"dataType": "GCPLoadBalancerLogs_CL",
16+
"auth": {
17+
"serviceAccountEmail": "{{GCPServiceAccountEmail}}",
18+
"projectNumber": "{{GCPProjectNumber}}",
19+
"workloadIdentityProviderId": "{{GCPWorkloadIdentityProviderId}}"
20+
},
21+
"request": {
22+
"projectId": "{{GCPProjectId}}",
23+
"subscriptionNames": [
24+
"{{GCPSubscriptionName}}"
25+
]
26+
}
27+
}
28+
}
29+
]

‎Solutions/Google Cloud Platform Load Balancer Logs/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_table.json‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
[{
2+
"name": "GCPLoadBalancerLogs_CL",
3+
"type": "Microsoft.OperationalInsights/workspaces/tables",
4+
"apiVersion": "2021-03-01-privatepreview",
5+
"tags": {},
6+
"properties": {
7+
"schema": {
8+
"name": "GCPLoadBalancerLogs_CL",
9+
"columns": [
10+
{
11+
"name": "TimeGenerated",
12+
"type": "datetime",
13+
"description": "The time the log entry was received by logging."
14+
},
15+
{
16+
"name": "BackendTargetProjectNumber",
17+
"type": "String",
18+
"description": "The Backend Service Project Number."
19+
},
20+
{
21+
"name": "CacheDecision",
22+
"type": "Dynamic",
23+
"description": "Indicates whether a request was served from the cache or the backend."
24+
},
25+
{
26+
"name": "EnforcedSecurityPolicy",
27+
"type": "Dynamic",
28+
"description": "Indicates whether a security policy (such as a WAF or access control rules) was applied to a request."
29+
},
30+
{
31+
"name": "PreviewSecurityPolicy",
32+
"type": "Dynamic",
33+
"description": "Request matches a rule configured for preview (present only when a preview rule would have taken priority over the enforced rule)."
34+
},
35+
{
36+
"name": "EnforcedEdgeSecurityPolicy",
37+
"type": "Dynamic",
38+
"description": "the edge security policy rule that was enforced."
39+
},
40+
{
41+
"name": "PreviewEdgeSecurityPolicy",
42+
"type": "Dynamic",
43+
"description": "populated if a request matches an edge security policy rule configured for preview."
44+
},
45+
{
46+
"name": "PayloadRemoteIp",
47+
"type": "String",
48+
"description": "The remote ip address of the payload."
49+
},
50+
{
51+
"name": "SecurityPolicyRequestData",
52+
"type": "Dynamic",
53+
"description": "The security policy data of the request."
54+
},
55+
{
56+
"name": "StatusDetails",
57+
"type": "String",
58+
"description": "The status details of the request."
59+
},
60+
{
61+
"name": "Latency",
62+
"type": "String",
63+
"description": "The latency of the request."
64+
},
65+
{
66+
"name": "RemoteIp",
67+
"type": "String",
68+
"description": "The remote ip of the request."
69+
},
70+
{
71+
"name": "RequestMethod",
72+
"type": "String",
73+
"description": "The http method of the request."
74+
},
75+
{
76+
"name": "RequestSize",
77+
"type": "String",
78+
"description": "The size of the request."
79+
},
80+
{
81+
"name": "RequestUrl",
82+
"type": "String",
83+
"description": "The url of the request."
84+
},
85+
{
86+
"name": "RequestStatus",
87+
"type": "String",
88+
"description": "The status code of the request."
89+
},
90+
{
91+
"name": "UserAgent",
92+
"type": "String",
93+
"description": "The user agent of the request."
94+
},
95+
{
96+
"name": "BackendServiceName",
97+
"type": "String",
98+
"description": "The backend service name in Google Cloud Platform ."
99+
},
100+
{
101+
"name": "ForwardingRuleName",
102+
"type": "String",
103+
"description": "The forwarding rule resource of the load balancer in Google Cloud Platform."
104+
},
105+
{
106+
"name": "ProjectId",
107+
"type": "String",
108+
"description": "The Project id in Google Cloud Platform"
109+
},
110+
{
111+
"name": "UrlMapName",
112+
"type": "String",
113+
"description": "The url map resource name in Google Cloud Platform.",
114+
"dataTypeHint": "URI"
115+
},
116+
{
117+
"name": "Zone",
118+
"type": "String",
119+
"description": "The Zone name of the Load Balancer."
120+
},
121+
{
122+
"name": "Severity",
123+
"type": "String",
124+
"description": "The severity of the incident."
125+
},
126+
{
127+
"name": "LogName",
128+
"type": "String",
129+
"description": "Information including a suffix identifying the log sub-type (e.g., admin activity, system access, data access) and where in the hierarchy the request was made."
130+
},
131+
{
132+
"name": "Timestamp",
133+
"type": "DateTime",
134+
"description": "The time the event described by the log entry occurred."
135+
},
136+
{
137+
"name": "InsertId",
138+
"type": "String",
139+
"description": "Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result."
140+
}
141+
]
142+
}
143+
}
144+
}]

‎Solutions/Google Cloud Platform Load Balancer Logs/Data/Solution_GCPWAF.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"Name": "Google Cloud Platform Load Balancer Logs",
3+
"Author": "Microsoft - [email protected]",
4+
"Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Logos/google_logo.svg\"width=\"75px\" height=\"75px\">",
5+
"Description": "The Google Cloud Platform Load Balancer data connector allows you to seamlessly ingest and monitor logs from GCP's Pub/Sub Load Balancer logs into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP Load Balancer logs, enabling proactive threat detection and response.",
6+
"Data Connectors": [
7+
"Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json"
8+
],
9+
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Google Cloud Platform Load Balancer Logs\\",
10+
"Version": "3.0.0",
11+
"Metadata": "SolutionMetadata.json",
12+
"TemplateSpec": true,
13+
"StaticDataConnectorIds": [
14+
"WAF"
15+
]
16+
}

‎Solutions/Google Cloud Platform Load Balancer Logs/Package/3.0.0.zip‎

7.88 KB
Binary file not shown.

0 commit comments

Comments
 (0)