Skip to content

Commit efef14d

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request Azure#12275 from niralishah-crest/ExtraHopSolution
Updated parser and workbook for ExtraHop to fix minor issue
2 parents df79902 + d06606b commit efef14d

File tree

10 files changed

+69
-58
lines changed

10 files changed

+69
-58
lines changed

‎Solutions/ExtraHop/Analytic Rules/ExtraHopSentinelAlerts.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,11 @@ alertDetailsOverride:
3030
alertSeverityColumnName: "Severity"
3131
alertDynamicProperties:
3232
- alertProperty: AlertLink
33-
columnName: Url
33+
value: Url
3434
- alertProperty: Techniques
35-
columnName: TechniqueIds
35+
value: TechniqueIds
3636
- alertProperty: ProductName
37-
columnName: EventVendor
37+
value: EventVendor
3838
entityMappings:
3939
- entityType: Host
4040
fieldMappings:
@@ -60,5 +60,5 @@ entityMappings:
6060
fieldMappings:
6161
- identifier: Name
6262
columnName: DestinationUsername
63-
version: 1.0.1
63+
version: 1.0.2
6464
kind: Scheduled

‎Solutions/ExtraHop/Data/Solution_ExtraHop.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
"Data Connectors/ExtraHopDataConnector/ExtraHop_FunctionApp.json"
1717
],
1818
"BasePath": "C:\\Azure-Sentinel\\Solutions\\ExtraHop",
19-
"Version": "3.0.0",
19+
"Version": "3.0.1",
2020
"Metadata": "SolutionMetadata.json",
2121
"TemplateSpec": true,
2222
"Is1PConnector": false

‎Solutions/ExtraHop/Package/3.0.1.zip‎

16.5 KB
Binary file not shown.

‎Solutions/ExtraHop/Package/createUiDefinition.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@
117117
"name": "workbook1-text",
118118
"type": "Microsoft.Common.TextBlock",
119119
"options": {
120-
"text": "This Workbook provides immediate insight into the data coming from ExtraHop."
120+
"text": "This workbook provides immediate insight into detection data ingested from ExtraHop."
121121
}
122122
}
123123
]
@@ -153,13 +153,13 @@
153153
{
154154
"name": "analytic1",
155155
"type": "Microsoft.Common.Section",
156-
"label": "Create alerts based on recommended detections from ExtraHop",
156+
"label": "Generate alerts based on ExtraHop detections recommended for triage",
157157
"elements": [
158158
{
159159
"name": "analytic1-text",
160160
"type": "Microsoft.Common.TextBlock",
161161
"options": {
162-
"text": "This Analytic rule will generate alerts in Microsoft Sentinel for Recommended detections from ExtraHop."
162+
"text": "This analytics rule will generate alerts in Microsoft Sentinel for detections from ExtraHop that are recommended for triage."
163163
}
164164
}
165165
]

‎Solutions/ExtraHop/Package/mainTemplate.json‎

Lines changed: 34 additions & 34 deletions
Large diffs are not rendered by default.

‎Solutions/ExtraHop/Parsers/ExtraHopDetections.yaml‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
id: a4fddd3e-9993-4c86-b5e8-8e36d8ce1197
22
Function:
33
Title: Parser for ExtraHopDetections
4-
Version: '1.0.0'
5-
LastUpdated: '2024-12-10'
4+
Version: '1.0.1'
5+
LastUpdated: '2025-06-02'
66
Category: Microsoft Sentinel Parser
77
FunctionName: ExtraHopDetections
88
FunctionAlias: ExtraHopDetections
@@ -18,7 +18,7 @@ FunctionQuery: |
1818
Time = column_ifexists('time_d', long(null))
1919
| extend ParsedMitreTechniques = parse_json(MitreTechniques)
2020
| mv-apply ParsedMitreTechniques on (summarize TechniqueIds = make_list(ParsedMitreTechniques.id), TechniqueNames = make_list(ParsedMitreTechniques.name))
21-
| extend ParsedMitreTactics = split(mitre_tactics_string_s, ", ")
21+
| extend ParsedMitreTactics = split(MitreTactics, ", ")
2222
| mv-apply tactic = ParsedMitreTactics on
2323
(summarize TacticNames = make_list(replace_string(replace(@"TA\d{4}: ", "", tostring(tactic)), " ", "")),
2424
TacticIds=make_list(extract(@"(TA\d{4})", 1, tostring(tactic))))
@@ -37,6 +37,7 @@ FunctionQuery: |
3737
SourceIpAddress = column_ifexists('src_ipaddr_s', ''),
3838
SourceRole = column_ifexists('src_role_s', ''),
3939
SourceEndpoint = column_ifexists('src_endpoint_s', ''),
40+
IsSourceExternal = column_ifexists('src_external_b', ''),
4041
SourceDeviceObjectId = column_ifexists('src_device_oid_d', int(null)),
4142
SourceDeviceName = column_ifexists('src_device_name_s', ''),
4243
SourceDeviceIpAddress = column_ifexists('src_device_ipaddrs_s', ''),
@@ -48,6 +49,7 @@ FunctionQuery: |
4849
DestinationIpAddress = column_ifexists('dst_ipaddr_s', ''),
4950
DestinationRole = column_ifexists('dst_role_s', ''),
5051
DestinationEndpoint = column_ifexists('dst_endpoint_s', ''),
52+
IsDestinationExternal = column_ifexists('dst_external_b', ''),
5153
DestinationDeviceObjectId = column_ifexists('dst_device_oid_d', int(null)),
5254
DestinationDeviceName = column_ifexists('dst_device_name_s', ''),
5355
DestinationDeviceIpAddress = column_ifexists('dst_device_ipaddrs_s', ''),
@@ -64,6 +66,7 @@ FunctionQuery: |
6466
IsUserCreated = column_ifexists('is_user_created_b', ''),
6567
ModificationTime = column_ifexists('mod_time_d', long(null)),
6668
Status = column_ifexists('status_s', ''),
69+
Resolution = column_ifexists('resolution_s', ''),
6770
TicketId = column_ifexists('ticket_id_d', ''),
6871
Assignee = column_ifexists('assignee_s', ''),
6972
Categories = column_ifexists('categories_array_s', ''),
@@ -87,6 +90,7 @@ FunctionQuery: |
8790
SourceIpAddress,
8891
SourceRole,
8992
SourceEndpoint,
93+
IsSourceExternal,
9094
SourceDeviceObjectId,
9195
SourceDeviceName,
9296
SourceDeviceIpAddress,
@@ -98,6 +102,7 @@ FunctionQuery: |
98102
DestinationIpAddress,
99103
DestinationRole,
100104
DestinationEndpoint,
105+
IsDestinationExternal,
101106
DestinationDeviceObjectId,
102107
DestinationDeviceName,
103108
DestinationDeviceIpAddress,
@@ -117,6 +122,7 @@ FunctionQuery: |
117122
IsUserCreated,
118123
ModificationTime,
119124
Status,
125+
Resolution,
120126
TicketId,
121127
Assignee,
122128
Categories,

‎Solutions/ExtraHop/ReleaseNotes.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
22
|-------------|--------------------------------|---------------------------------------------|
3-
| 3.0.0 | 19-03-2024 | Initial Solution Release. |
3+
| 3.0.1 | 04-06-2025 | Updated **Parser** and **Workbook** to fix issue. |
4+
| 3.0.0 | 19-03-2025 | Initial Solution Release. |

‎Solutions/ExtraHop/SolutionMetadata.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"publisherId": "extrahop",
33
"offerId": "extrahop_sentinel",
44
"firstPublishDate": "2025-02-11",
5-
"lastPublishDate": "2025-02-11",
5+
"lastPublishDate": "2025-06-04",
66
"providers": [
77
"ExtraHop"
88
],
@@ -17,4 +17,4 @@
1717
"tier": "Partner",
1818
"link": "https://www.extrahop.com/customer-support"
1919
}
20-
}
20+
}

‎Solutions/ExtraHop/Workbooks/ExtraHopDetectionsOverview.json‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -940,25 +940,25 @@
940940
"version": "KqlParameterItem/1.0",
941941
"name": "AlertSeverity",
942942
"type": 2,
943-
"isRequired": true,
944943
"multiSelect": true,
945944
"quote": "'",
946945
"delimiter": ",",
947946
"query": "SecurityAlert\r\n| summarize Count = count() by AlertSeverity\r\n| order by Count desc, AlertSeverity asc\r\n| project Value = AlertSeverity, Label = strcat(AlertSeverity, ' - ', Count)",
948-
"value": [
949-
"value::all"
950-
],
951947
"typeSettings": {
952948
"additionalResourceOptions": [
953949
"value::all"
954-
]
950+
],
951+
"selectAllValue": "*",
952+
"showDefault": false
955953
},
956954
"timeContext": {
957955
"durationMs": 0
958956
},
959957
"timeContextFromParameter": "TimeRange",
958+
"defaultValue": "value::all",
960959
"queryType": 0,
961-
"resourceType": "microsoft.operationalinsights/workspaces"
960+
"resourceType": "microsoft.operationalinsights/workspaces",
961+
"label": "Alert Severity"
962962
},
963963
{
964964
"id": "9636b674-c842-4c91-b7a8-68c297b21754",
@@ -973,6 +973,7 @@
973973
"additionalResourceOptions": [
974974
"value::all"
975975
],
976+
"selectAllValue": "*",
976977
"showDefault": false
977978
},
978979
"timeContext": {
@@ -981,7 +982,8 @@
981982
"timeContextFromParameter": "TimeRange",
982983
"defaultValue": "value::all",
983984
"queryType": 0,
984-
"resourceType": "microsoft.operationalinsights/workspaces"
985+
"resourceType": "microsoft.operationalinsights/workspaces",
986+
"label": "MITRE Technique"
985987
},
986988
{
987989
"id": "d6ab142d-62c9-4c21-befc-b9107d5d8187",
@@ -996,6 +998,7 @@
996998
"additionalResourceOptions": [
997999
"value::all"
9981000
],
1001+
"selectAllValue": "*",
9991002
"showDefault": false
10001003
},
10011004
"timeContext": {
@@ -1004,7 +1007,8 @@
10041007
"timeContextFromParameter": "TimeRange",
10051008
"defaultValue": "value::all",
10061009
"queryType": 0,
1007-
"resourceType": "microsoft.operationalinsights/workspaces"
1010+
"resourceType": "microsoft.operationalinsights/workspaces",
1011+
"label": "MITRE Tactic"
10081012
}
10091013
],
10101014
"style": "pills",

‎Workbooks/WorkbooksMetadata.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8867,7 +8867,7 @@
88678867
{
88688868
"workbookKey": "ExtraHopDetectionsOverview",
88698869
"logoFileName": "ExtraHop.svg",
8870-
"description": "This Workbook provides immediate insight into the data coming from ExtraHop.",
8870+
"description": "This workbook provides immediate insight into detection data ingested from ExtraHop.",
88718871
"dataTypesDependencies": [
88728872
"ExtraHop_Detections_CL"
88738873
],
@@ -8881,7 +8881,7 @@
88818881
"ExtraHopDetectionsOverviewWhite2.png"
88828882
],
88838883
"version": "1.0.0",
8884-
"title": "ExtraHop Detections Ovevriew",
8884+
"title": "ExtraHop Detections Overview",
88858885
"templateRelativePath": "ExtraHopDetectionsOverview.json",
88868886
"provider": "ExtraHop"
88878887
},

0 commit comments

Comments
 (0)