Skip to content

Commit 1bdcdcb

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #288827 from meganbradley/meganbradley/docutune-autopr-20241020-030949-3884606-ignore-build
[BULK] - DocuTune remediation - Sensitive terms with GUIDs (part 67)
2 parents 72faf6a + 7bacc66 commit 1bdcdcb

8 files changed

+15
-16
lines changed

‎articles/sentinel/api-dcr-reference.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -302,7 +302,7 @@ The `outputStream` parameter is required only if the transform changes the schem
302302
{
303303
"properties": {
304304
"immutableId": "dcr-00112233445566778899aabbccddeeff",
305-
"dataCollectionEndpointId": "/subscriptions/aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb/resourceGroups/Contoso-RG-1/providers/Microsoft.Insights/dataCollectionEndpoints/Microsoft-Sentinel-aaaabbbbccccddddeeeefff",
305+
"dataCollectionEndpointId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/Contoso-RG-1/providers/Microsoft.Insights/dataCollectionEndpoints/Microsoft-Sentinel-aaaabbbbccccddddeeeefff",
306306
"streamDeclarations": {
307307
"Custom-Text-ApacheHTTPServer_CL": {
308308
"columns": [
@@ -339,7 +339,7 @@ The `outputStream` parameter is required only if the transform changes the schem
339339
"destinations": {
340340
"logAnalytics": [
341341
{
342-
"workspaceResourceId": "/subscriptions/aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb/resourceGroups/contoso-rg-1/providers/Microsoft.OperationalInsights/workspaces/CyberSOC",
342+
"workspaceResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/contoso-rg-1/providers/Microsoft.OperationalInsights/workspaces/CyberSOC",
343343
"workspaceId": "cccccccc-3333-4444-5555-dddddddddddd",
344344
"name": "DataCollectionEvent"
345345
}
@@ -363,7 +363,7 @@ The `outputStream` parameter is required only if the transform changes the schem
363363
"tags": {
364364
"createdBy": "Sentinel"
365365
},
366-
"id": "/subscriptions/aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb/resourceGroups/Contoso-RG-1/providers/Microsoft.Insights/dataCollectionRules/DCR-CustomLogs-01",
366+
"id": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/Contoso-RG-1/providers/Microsoft.Insights/dataCollectionRules/DCR-CustomLogs-01",
367367
"name": "DCR-CustomLogs-01",
368368
"type": "Microsoft.Insights/dataCollectionRules",
369369
"etag": "\"00000000-1111-2222-3333-444444444444\"",

‎articles/sentinel/connect-aws.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -351,4 +351,3 @@ In this document, you learned how to connect to AWS resources to ingest their lo
351351
- Learn how to [get visibility into your data, and potential threats](get-visibility.md).
352352
- Get started [detecting threats with Microsoft Sentinel](detect-threats-built-in.md).
353353
- [Use workbooks](monitor-your-data.md) to monitor your data.
354-

‎articles/sentinel/create-incident-manually.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,7 @@ Here's an example of what a request body might look like:
149149
"description": "This is a demo incident",
150150
"title": "My incident",
151151
"owner": {
152-
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
152+
"objectId": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb"
153153
},
154154
"severity": "High",
155155
"classification": "FalsePositive",

‎articles/sentinel/normalization-about-schemas.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ The allowed values for a user ID type are:
119119
| ---- | ------- | ------------- |
120120
| **SID** | A Windows user ID. | `S-1-5-21-1377283216-344919071-3415362939-500` |
121121
| **UID** | A Linux user ID. | `4578` |
122-
| **AADID**| A Microsoft Entra user ID.| `9267d02c-5f76-40a9-a9eb-b686f3ca47aa` |
122+
| **AADID**| A Microsoft Entra user ID.| `00aa00aa-bb11-cc22-dd33-44ee44ee44ee` |
123123
| **OktaId** | An Okta user ID. | `00urjk4znu3BcncfY0h7` |
124124
| **AWSId** | An AWS user ID. | `72643944673` |
125125
| **PUID** | A Microsoft 365 user ID. | `10032001582F435C` |

‎articles/sentinel/normalization-schema-v1.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ Below is the schema of the network sessions table, versioned 1.0.0
7070
| **DvcHostname** | Device Name (String) | syslogserver1.contoso.com | The device name of the device generating the message. | Device |
7171
| **EventProduct** | String | OfficeSharepoint | The product generating the event. | Event |
7272
| **EventProductVersion** | string | 9.0 | The version of the product generating the event. | Event |
73-
| **EventResourceId** | Device ID (String) | /subscriptions/3c1bb38c-82e3-4f8d-a115-a7110ba70d05 /resourcegroups/contoso77/providers /microsoft.compute/virtualmachines /syslogserver1 | The resource ID of the device generating the message. | Event |
73+
| **EventResourceId** | Device ID (String) | /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e /resourcegroups/contoso77/providers /microsoft.compute/virtualmachines /syslogserver1 | The resource ID of the device generating the message. | Event |
7474
| **EventReportUrl** | String | https://192.168.1.1/repoerts/ae3-56.htm | A link to the full report created by the reporting device | Event |
7575
| **EventVendor** | String | Microsoft | The vendor of the product generating the event. | Event |
7676
| **EventResult** | Multivalue: Success, Partial, Failure, [Empty] (String) | Success | The result reported for the activity. Empty value when not applicable. | Event |
@@ -102,7 +102,7 @@ Below is the schema of the network sessions table, versioned 1.0.0
102102
| **DstDvcDomain** | String | CONTOSO | The Domain of the destination device. | Destination,<br>Device |
103103
| **DstPortNumber** | Integer | 443 | The destination IP port. | Destination,<br>Port |
104104
| **DstGeoRegion** | Region (String) | Vermont | The region associated with the destination IP address | Destination,<br>Geo |
105-
| **DstResourceId** | Device ID (String) | /subscriptions/3c1bb38c-82e3-4f8d-a115-a7110ba70d05 /resourcegroups/contoso77/providers /microsoft.compute/virtualmachines /victim | The resource ID of the destination device. | Destination |
105+
| **DstResourceId** | Device ID (String) | /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e /resourcegroups/contoso77/providers /microsoft.compute/virtualmachines /victim | The resource ID of the destination device. | Destination |
106106
| **DstNatIpAddr** | IP address | 2::1 | If reported by an intermediary NAT device such as a firewall, the IP address used by the NAT device for communication with the source. | Destination NAT,<br>IP |
107107
| **DstNatPortNumber** | int | 443 | If reported by an intermediary NAT device such as a firewall, the port used by the NAT device for communication with the source. | Destination NAT,<br>Port |
108108
| **DstUserSid** | User SID | S-12-1445 | The User ID of the identity associated with the session’s destination. Typically, the identity used to authenticate a server. For more information, see [Data types and formats](#data-types-and-formats). | Destination,<br>User |
@@ -145,7 +145,7 @@ Below is the schema of the network sessions table, versioned 1.0.0
145145
| **SrcDvcMacAddr** | String | 06:10:9f:eb:8f:14 | The source MAC address of a device that is not directly associated with the network packet. | Source,<br>Device,<br>Mac |
146146
| **SrcPortNumber** | Integer | 2335 | The IP port from which the connection originated. May not be relevant for a session comprising multiple connections. | Source,<br>Port |
147147
| **SrcGeoRegion** | Region (String) | Vermont | The region within a country/region associated with the source IP address | Source,<br>Geo |
148-
| **SrcResourceId** | String | /subscriptions/3c1bb38c-82e3-4f8d-a115-a7110ba70d05 /resourcegroups/contoso77/providers /microsoft.compute/virtualmachines /syslogserver1 | The resource ID of the device generating the message. | Source |
148+
| **SrcResourceId** | String | /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e /resourcegroups/contoso77/providers /microsoft.compute/virtualmachines /syslogserver1 | The resource ID of the device generating the message. | Source |
149149
| **SrcNatIpAddr** | IP address | 4.3.2.1 | If reported by an intermediary NAT device such as a firewall, the IP address used by the NAT device for communication with the destination. | Source NAT,<br>IP |
150150
| **SrcNatPortNumber** | Integer | 345 | If reported by an intermediary NAT device such as a firewall, the port used by the NAT device for communication with the destination. | Source NAT,<br>Port |
151151
| **SrcUserSid** | User ID (String) | S-15-1445 | The user ID of the identity associated with the sessions source. Typically, user performing an action on the client. For more information, see [Data types and formats](#data-types-and-formats). | Source,<br>User |

‎articles/sentinel/resource-context-rbac.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ For example, the following code shows a sample Logstash configuration file:
123123
workspace_id => "4g5tad2b-a4u4-147v-a4r7-23148a5f2c21" # <your workspace id>
124124
workspace_key => "u/saRtY0JGHJ4Ce93g5WQ3Lk50ZnZ8ugfd74nk78RPLPP/KgfnjU5478Ndh64sNfdrsMni975HJP6lp==" # <your workspace key>
125125
custom_log_table_name => "tableName"
126-
azure_resource_id => "/subscriptions/wvvu95a2-99u4-uanb-hlbg-2vatvgqtyk7b/resourceGroups/contosotest" # <your resource ID>
126+
azure_resource_id => "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/contosotest" # <your resource ID>
127127
}
128128
}
129129
```

‎articles/sentinel/ueba-reference.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ The following table describes the enrichments featured in the **UsersInsights**
9090
| --- | --- | --- |
9191
| **Account display name**<br>*(AccountDisplayName)* | The account display name of the user. | Admin, Hayden Cook |
9292
| **Account domain**<br>*(AccountDomain)* | The account domain name of the user. | |
93-
| **Account object ID**<br>*(AccountObjectID)* | The account object ID of the user. | a58df659-5cab-446c-9dd0-5a3af20ce1c2 |
93+
| **Account object ID**<br>*(AccountObjectID)* | The account object ID of the user. | aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb |
9494
| **Blast radius**<br>*(BlastRadius)* | The blast radius is calculated based on several factors: the position of the user in the org tree, and the user's Microsoft Entra roles and permissions. User must have *Manager* property populated in Microsoft Entra ID for *BlastRadius* to be calculated. | Low, Medium, High |
9595
| **Is dormant account**<br>*(IsDormantAccount)* | The account has not been used for the past 180 days. | True, False |
9696
| **Is local admin**<br>*(IsLocalAdmin)* | The account has local administrator privileges. | True, False |

‎articles/sentinel/watchlist-schemas.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ The High Value Assets watchlist lists devices, resources, and other assets that
2424
| Field name | Format | Example | Mandatory/Optional |
2525
| ---------- | ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | ------------------ |
2626
| **Asset Type** | String | `Device`, `Azure resource`, `AWS resource`, `URL`, `SPO`, `File share`, `Other` | Mandatory |
27-
| **Asset Id** | String, depending on asset type | `/subscriptions/d1d8779d-38d7-4f06-91db-9cbc8de0176f/resourceGroups/SOC-Purview/providers/Microsoft.Storage/storageAccounts/purviewadls` | Mandatory |
27+
| **Asset Id** | String, depending on asset type | `/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/SOC-Purview/providers/Microsoft.Storage/storageAccounts/purviewadls` | Mandatory |
2828
| **Asset Name** | String | `Microsoft.Storage/storageAccounts/purviewadls` | Optional |
2929
| **Asset FQDN** | FQDN | `Finance-SRv.local.microsoft.com` | Mandatory |
3030
| **IP Address** | IP | `1.1.1.1` | Optional |
@@ -38,7 +38,7 @@ The VIP Users watchlist lists user accounts of employees that have high impact v
3838
| Field name | Format | Example | Mandatory/Optional |
3939
| ------------------- | ------ | --------------------------------------------------- | ------------------ |
4040
| **User Identifier** | UID | `52322ec8-6ebf-11eb-9439-0242ac130002` | Optional |
41-
| **User AAD Object Id** | SID | `03fa4b4e-dc26-426f-87b7-98e0c9e2955e` | Optional |
41+
| **User AAD Object Id** | SID | `aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb` | Optional |
4242
| **User On-Prem Sid** | SID | `S-1-12-1-4141952679-1282074057-627758481-2916039507` | Optional |
4343
| **User Principal Name** | UPN | `[email protected]` | Mandatory |
4444
| **Tags** | List | `["SAW user","Blue Ocean team"]` for CSV files created in Microsoft Excel or `[""SAW user"",""Blue Ocean team""]` for CSV files created in a text editor | Optional |
@@ -62,7 +62,7 @@ The Terminated Employees watchlist lists user accounts of employees that have be
6262
| Field name | Format | Example | Mandatory/Optional |
6363
| ------------------- | ------------------------------------------------------------------------------- | ------------------------------------ | ------------------ |
6464
| **User Identifier** | UID | `52322ec8-6ebf-11eb-9439-0242ac130002` | Optional |
65-
| **User AAD Object Id** | SID | `03fa4b4e-dc26-426f-87b7-98e0c9e2955e` | Optional |
65+
| **User AAD Object Id** | SID | `aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb` | Optional |
6666
| **User On-Prem Sid** | SID | `S-1-12-1-4141952679-1282074057-123` | Optional |
6767
| **User Principal Name** | UPN | `[email protected]` | Mandatory |
6868
| **UserState** | String <br><br>We recommend using either `Notified` or `Terminated` | `Terminated` | Mandatory |
@@ -79,7 +79,7 @@ The Identity Correlation watchlist lists related user accounts that belong to th
7979
| Field name | Format | Example | Mandatory/Optional |
8080
| -------------------------------- | ------- | --------------------------------------------------- | ------------------ |
8181
| **User Identifier** | UID | `52322ec8-6ebf-11eb-9439-0242ac130002` | Optional |
82-
| **User AAD Object Id** | SID | `03fa4b4e-dc26-426f-87b7-98e0c9e2955e` | Optional |
82+
| **User AAD Object Id** | SID | `aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb` | Optional |
8383
| **User On-Prem Sid** | SID | `S-1-12-1-4141952679-1282074057-627758481-2916039507` | Optional |
8484
| **User Principal Name** | UPN | `[email protected]` | Mandatory |
8585
| **Employee Id** | String | `8234123` | Optional |
@@ -100,7 +100,7 @@ The Service Accounts watchlist lists service accounts and their owners, and incl
100100
| **Service On-Prem Sid** | SID | `S-1-12-1-3123123-123213123-12312312-2916039507` | Optional |
101101
| **Service Principal Name** | UPN | `[email protected]` | Mandatory |
102102
| **Owner User Identifier** | UID | `52322ec8-6ebf-11eb-9439-0242ac130002` | Optional |
103-
| **Owner User AAD Object Id** | SID | `03fa4b4e-dc26-426f-87b7-98e0c9e2955e` | Optional |
103+
| **Owner User AAD Object Id** | SID | `aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb` | Optional |
104104
| **Owner User On-Prem Sid** | SID | `S-1-12-1-4141952679-1282074057-627758481-2916039507` | Optional |
105105
| **Owner User Principal Name** | UPN | `[email protected]` | Mandatory |
106106
| **Tags** | List | `["Automation Account","GitHub Account"]` for CSV files created in Microsoft Excel or `[""Automation Account"",""GitHub Account""]`for CSV files created in a text editor | Optional |

0 commit comments

Comments
 (0)