Skip to content

Commit f1620c7

Browse files
v-prasadbokev-prasadboke
authored
Merge pull request Azure#11830 from Azure/v-prasadboke-forescout
duplicating PR Azure#11788
2 parents c4144d9 + ffe2d04 commit f1620c7

18 files changed

+1124
-434
lines changed

‎.script/tests/KqlvalidationsTests/CustomTables/ForescoutComplianceStatus_CL.json‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"Name": "ForescoutComplianceStatus_CL",
3+
"Properties": [
4+
{
5+
"Name": "TimeGenerated",
6+
"Type": "datetime"
7+
},
8+
{
9+
"name": "TimeGenerated",
10+
"type": "datetime"
11+
},
12+
{
13+
"name": "UploadTime",
14+
"type": "datetime"
15+
},
16+
{
17+
"name": "Ipv4Addr",
18+
"type": "string"
19+
},
20+
{
21+
"name": "Ipv6Addr",
22+
"type": "dynamic"
23+
},
24+
{
25+
"name": "MacAddr",
26+
"type": "string"
27+
},
28+
{
29+
"name": "EmIpAddr",
30+
"type": "string"
31+
},
32+
{
33+
"name": "HostProperties",
34+
"type": "dynamic"
35+
}
36+
]
37+
}

‎.script/tests/KqlvalidationsTests/CustomTables/ForescoutHostProperties_CL.json‎

Lines changed: 30 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,27 +3,51 @@
33
"Properties": [
44
{
55
"Name": "HostProperties_DnsniffEvent_s",
6-
"Type": "String"
6+
"Type": "string"
77
},
88
{
99
"Name": "HostProperties_Ipv4Addr_s",
10-
"Type": "String"
10+
"Type": "string"
1111
},
1212
{
1313
"Name": "HostProperties_Ipv6Addr_s",
14-
"Type": "String"
14+
"Type": "string"
1515
},
1616
{
1717
"Name": "HostProperties_IpAddr_s",
18-
"Type": "String"
18+
"Type": "string"
1919
},
2020
{
2121
"Name": "HostProperties_EmIpAddr_s",
22-
"Type": "String"
22+
"Type": "string"
2323
},
2424
{
2525
"Name": "TimeGenerated",
2626
"Type": "datetime"
27-
}
27+
},
28+
{
29+
"name": "UploadTime",
30+
"type": "datetime"
31+
},
32+
{
33+
"name": "Ipv4Addr",
34+
"type": "string"
35+
},
36+
{
37+
"name": "Ipv6Addr",
38+
"type": "dynamic"
39+
},
40+
{
41+
"name": "MacAddr",
42+
"type": "string"
43+
},
44+
{
45+
"name": "EmIpAddr",
46+
"type": "string"
47+
},
48+
{
49+
"name": "HostProperties",
50+
"type": "dynamic"
51+
}
2852
]
2953
}

‎.script/tests/KqlvalidationsTests/CustomTables/ForescoutPolicyStatus_CL.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"Name": "ForescoutPolicyStatus_CL",
3+
"Properties": [
4+
{
5+
"name": "TimeGenerated",
6+
"type": "datetime"
7+
},
8+
{
9+
"name": "UploadTime",
10+
"type": "datetime"
11+
},
12+
{
13+
"name": "Ipv4Addr",
14+
"type": "string"
15+
},
16+
{
17+
"name": "Ipv6Addr",
18+
"type": "dynamic"
19+
},
20+
{
21+
"name": "MacAddr",
22+
"type": "string"
23+
},
24+
{
25+
"name": "EmIpAddr",
26+
"type": "string"
27+
},
28+
{
29+
"name": "HostProperties",
30+
"type": "dynamic"
31+
}
32+
]
33+
}

‎Solutions/ForescoutHostPropertyMonitor/Analytic Rules/ForeScout-DNSSniffEventMonitor.yaml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,15 @@ tactics: []
1111
relevantTechniques: []
1212
query:
1313
ForescoutHostProperties_CL
14-
| where HostProperties_DnsniffEvent_s matches regex "DNS Query Type:.A;DNS Query/Response:.Query"
15-
| extend ipaddress = iif(isnotempty(HostProperties_Ipv4Addr_s), HostProperties_Ipv4Addr_s, (iif(isnotempty(HostProperties_Ipv6Addr_s), HostProperties_Ipv6Addr_s, HostProperties_IpAddr_s)))
16-
| summarize NumEvents_d =count() by ipaddress, HostProperties_DnsniffEvent_s, HostProperties_EmIpAddr_s
14+
| extend d = parse_json(HostProperties)
15+
| where d.DnsniffEvent matches regex "DNS Query Type:.A;DNS Query/Response:.Query"
16+
| extend ipaddress = iif(isnotempty(Ipv4Addr), Ipv4Addr, (iif(isnotempty(Ipv6Addr), Ipv6Addr, "")))
17+
| where isnotempty(ipaddress) and isnotempty(EmIpAddr)
18+
| summarize NumEvents_d =count() by ipaddress, EmIpAddr
1719
| where NumEvents_d > 2
18-
| where isnotempty(ipaddress) and isnotempty(HostProperties_EmIpAddr_s)
1920
| sort by NumEvents_d asc
20-
| project NumEvents_d, ipaddress, HostProperties_EmIpAddr_s
21+
| project NumEvents_d, ipaddress, EmIpAddr
22+
2123
entityMappings:
2224
- entityType: IP
2325
fieldMappings:
@@ -30,5 +32,5 @@ customDetails:
3032
alertDetailsOverride:
3133
alertDisplayNameFormat: Dnsniff-Address-Check
3234
alertDescriptionFormat: Dnsniff-Address-Check alert
33-
version: 1.0.1
35+
version: 1.0.2
3436
kind: Scheduled

‎Solutions/ForescoutHostPropertyMonitor/Data Connectors/ForescoutHostPropertyMonitor.json‎

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"id": "ForescoutHostPropertyMonitor",
33
"title": "Forescout Host Property Monitor",
44
"publisher": "Forescout",
5-
"descriptionMarkdown": "The Forescout Host Property Monitor connector allows you to connect host properties from Forescout platform with Microsoft Sentinel, to view, create custom incidents, and improve investigation. This gives you more insight into your organization network and improves your security operation capabilities.",
5+
"descriptionMarkdown": "The Forescout Host Property Monitor connector allows you to connect host/policy/compliance properties from Forescout platform with Microsoft Sentinel, to view, create custom incidents, and improve investigation. This gives you more insight into your organization network and improves your security operation capabilities.",
66
"graphQueries": [
77
{
88
"metricName": "Total data received",
@@ -14,19 +14,37 @@
1414
{
1515
"description" : "Get 5 latest host property entries",
1616
"query": "ForescoutHostProperties_CL | take 5"
17+
},
18+
{
19+
"description" : "Get 5 latest host policy entries",
20+
"query": "ForescoutPolicyStatus_CL | take 5"
21+
},
22+
{
23+
"description" : "Get 5 latest host compliance entries",
24+
"query": "ForescoutComplianceStatus_CL | take 5"
1725
}
1826
],
1927
"dataTypes": [
2028
{
2129
"name": "ForescoutHostProperties_CL",
2230
"lastDataReceivedQuery": "ForescoutHostProperties_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
31+
},
32+
{
33+
"name": "ForescoutPolicyStatus_CL",
34+
"lastDataReceivedQuery": "ForescoutPolicyStatus_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
35+
},
36+
{
37+
"name": "ForescoutComplianceStatus_CL",
38+
"lastDataReceivedQuery": "ForescoutComplianceStatus_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
2339
}
2440
],
2541
"connectivityCriterias": [
2642
{
2743
"type": "IsConnectedQuery",
2844
"value": [
29-
"ForescoutHostProperties_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)"
45+
"ForescoutHostProperties_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)",
46+
"ForescoutPolicyStatus_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)",
47+
"ForescoutComplianceStatus_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)"
3048
]
3149
}
3250
],
@@ -67,7 +85,7 @@
6785
"instructionSteps": [
6886
{
6987
"title": "",
70-
"description": "Instructions on how to configure Forescout Microsoft Sentinel plugin are provided at Forescout Documentation Portal (https://docs.forescout.com/bundle/sentinel-1-0-h)",
88+
"description": "Instructions on how to configure Forescout Microsoft Sentinel plugin are provided at Forescout Documentation Portal (https://docs.forescout.com/bundle/microsoft-sentinel-module-v2-0-0-h)",
7189
"instructions": [
7290
{
7391
"parameters": {
@@ -92,7 +110,7 @@
92110
],
93111
"metadata": {
94112
"id": "1430b3a9-a48c-40d5-bb81-029f6c63c2ad",
95-
"version": "1.0.0",
113+
"version": "3.0.0",
96114
"kind": "dataConnector",
97115
"source": {
98116
"kind": "community"

‎Solutions/ForescoutHostPropertyMonitor/Data/Solution_ForescoutHostProp.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
{
22
"Name": "ForescoutHostPropertyMonitor",
33
"Author": "Julian Wang - [email protected]",
4+
"Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/forescout-logo.svg\" width=\"75px\" height=\"75px\">",
45
"Description": "Forescout Host Property Monitor offers host property analysis, incident generation and action dispatching for hosts managed by Forescout Continuum platform.",
56
"Analytic Rules": [
67
"Analytic Rules/ForeScout-DNSSniffEventMonitor.yaml"
@@ -11,9 +12,12 @@
1112
"Data Connectors": [
1213
"Data Connectors/ForescoutHostPropertyMonitor.json"
1314
],
15+
"Workbooks": [
16+
"Workbooks/ForescoutHostPropertyMonitorWorkbook.json"
17+
],
1418

1519
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\ForescoutHostPropertyMonitor",
16-
"Version": "2.0.1",
20+
"Version": "3.0.0",
1721
"Metadata": "SolutionMetadata.json",
1822
"TemplateSpec": true,
1923
"Is1PConnector": false

‎Solutions/ForescoutHostPropertyMonitor/Package/3.0.0.zip‎

10.7 KB
Binary file not shown.

‎Solutions/ForescoutHostPropertyMonitor/Package/createUiDefinition.json‎

Lines changed: 44 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"config": {
77
"isWizard": false,
88
"basics": {
9-
"description": "**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nForescout Host Property Monitor offers host property analysis, incident generation and action dispatching for hosts managed by Forescout Continuum platform.\n\n**Data Connectors:** 1, **Analytic Rules:** 1, **Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
9+
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/forescout-logo.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/ForescoutHostPropertyMonitor/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nForescout Host Property Monitor offers host property analysis, incident generation and action dispatching for hosts managed by Forescout Continuum platform.\n\n**Data Connectors:** 1, **Workbooks:** 1, **Analytic Rules:** 1, **Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
1010
"subscription": {
1111
"resourceProviders": [
1212
"Microsoft.OperationsManagement/solutions",
@@ -64,7 +64,7 @@
6464
}
6565
},
6666
{
67-
"name": "dataconnectors-link2",
67+
"name": "dataconnectors-link1",
6868
"type": "Microsoft.Common.TextBlock",
6969
"options": {
7070
"link": {
@@ -75,6 +75,48 @@
7575
}
7676
]
7777
},
78+
{
79+
"name": "workbooks",
80+
"label": "Workbooks",
81+
"subLabel": {
82+
"preValidation": "Configure the workbooks",
83+
"postValidation": "Done"
84+
},
85+
"bladeTitle": "Workbooks",
86+
"elements": [
87+
{
88+
"name": "workbooks-text",
89+
"type": "Microsoft.Common.TextBlock",
90+
"options": {
91+
"text": "This solution installs workbook(s) to help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view."
92+
}
93+
},
94+
{
95+
"name": "workbooks-link",
96+
"type": "Microsoft.Common.TextBlock",
97+
"options": {
98+
"link": {
99+
"label": "Learn more",
100+
"uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data"
101+
}
102+
}
103+
},
104+
{
105+
"name": "workbook1",
106+
"type": "Microsoft.Common.Section",
107+
"label": "Forescout Host Property Monitor Workbook",
108+
"elements": [
109+
{
110+
"name": "workbook1-text",
111+
"type": "Microsoft.Common.TextBlock",
112+
"options": {
113+
"text": "Gain insights into host properties in Forescout platform"
114+
}
115+
}
116+
]
117+
}
118+
]
119+
},
78120
{
79121
"name": "analytics",
80122
"label": "Analytics",
@@ -152,5 +194,4 @@
152194
"workspace": "[basics('workspace')]"
153195
}
154196
}
155-
156197
}

0 commit comments

Comments
 (0)