Skip to content

Commit 940d011

Browse files
shdyasshdyas
authored
Merge pull request #1188 from MicrosoftDocs/main
merge to live
2 parents bd2893d + d93b58b commit 940d011

File tree

8 files changed

+172
-11
lines changed

8 files changed

+172
-11
lines changed

‎.github/workflows/AutoLabelAssign.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Assign and label PR
2+
3+
permissions:
4+
pull-requests: write
5+
contents: read
6+
actions: read
7+
8+
on:
9+
workflow_run:
10+
workflows: [Background tasks]
11+
types:
12+
- completed
13+
14+
jobs:
15+
download-payload:
16+
name: Download and extract payload artifact
17+
uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-ExtractPayload.yml@workflows-prod
18+
with:
19+
WorkflowId: ${{ github.event.workflow_run.id }}
20+
OrgRepo: ${{ github.repository }}
21+
secrets:
22+
AccessToken: ${{ secrets.GITHUB_TOKEN }}
23+
24+
label-assign:
25+
name: Run assign and label
26+
needs: [download-payload]
27+
uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-AutoLabelAssign.yml@workflows-prod
28+
with:
29+
PayloadJson: ${{ needs.download-payload.outputs.WorkflowPayload }}
30+
AutoAssignUsers: 1
31+
AutoLabel: 1
32+
ExcludedUserList: '["user1", "user2"]'
33+
ExcludedBranchList: '["branch1", "branch2"]'
34+
secrets:
35+
AccessToken: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/AutoLabelMsftContributor.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: Auto label Microsoft contributors
2+
3+
permissions:
4+
pull-requests: write
5+
contents: read
6+
actions: read
7+
8+
on:
9+
workflow_run:
10+
workflows: [Background tasks]
11+
types:
12+
- completed
13+
14+
jobs:
15+
download-payload:
16+
if: github.repository_visibility == 'public'
17+
name: Download and extract payload artifact
18+
uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-ExtractPayload.yml@workflows-prod
19+
with:
20+
WorkflowId: ${{ github.event.workflow_run.id }}
21+
OrgRepo: ${{ github.repository }}
22+
secrets:
23+
AccessToken: ${{ secrets.GITHUB_TOKEN }}
24+
25+
label-msft:
26+
name: Label Microsoft contributors
27+
if: github.repository_visibility == 'public'
28+
needs: [download-payload]
29+
uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-AutoLabelMsftContributor.yml@workflows-prod
30+
with:
31+
PayloadJson: ${{ needs.download-payload.outputs.WorkflowPayload }}
32+
secrets:
33+
AccessToken: ${{ secrets.GITHUB_TOKEN }}
34+
TeamReadAccessToken: ${{ secrets.ORG_READTEAMS_TOKEN }}

‎.github/workflows/BackgroundTasks.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: Background tasks
2+
3+
permissions:
4+
pull-requests: write
5+
contents: read
6+
7+
on:
8+
pull_request_target:
9+
10+
jobs:
11+
upload:
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- name: Save payload data
16+
env:
17+
PayloadJson: ${{ toJSON(github) }}
18+
AccessToken: ${{ github.token }}
19+
run: |
20+
mkdir -p ./pr
21+
echo $PayloadJson > ./pr/PayloadJson.json
22+
sed -i -e "s/$AccessToken/XYZ/g" ./pr/PayloadJson.json
23+
- uses: actions/upload-artifact@v4
24+
with:
25+
name: PayloadJson
26+
path: pr/

‎.github/workflows/LiveMergeCheck.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: PR can merge into branch
2+
3+
permissions:
4+
pull-requests: write
5+
statuses: write
6+
contents: read
7+
8+
on:
9+
pull_request_target:
10+
types: [opened, reopened, synchronize, edited]
11+
12+
jobs:
13+
14+
live-merge:
15+
uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-LiveMergeCheck.yml@workflows-prod
16+
with:
17+
PayloadJson: ${{ toJSON(github) }}
18+
secrets:
19+
AccessToken: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/PrFileCount.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: PR file count less than limit
2+
3+
permissions:
4+
pull-requests: write
5+
statuses: write
6+
contents: read
7+
8+
on:
9+
pull_request_target:
10+
types: [opened, reopened, synchronize, labeled, unlabeled, edited]
11+
12+
jobs:
13+
14+
file-count:
15+
uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-PrFileCount.yml@workflows-prod
16+
with:
17+
PayloadJson: ${{ toJSON(github) }}
18+
secrets:
19+
AccessToken: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/ProtectedFiles.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: PR has no protected files
2+
3+
permissions:
4+
pull-requests: write
5+
statuses: write
6+
contents: read
7+
8+
on: [pull_request_target]
9+
10+
jobs:
11+
12+
protected-files:
13+
uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-ProtectedFiles.yml@workflows-prod
14+
with:
15+
PayloadJson: ${{ toJSON(github) }}
16+
secrets:
17+
AccessToken: ${{ secrets.GITHUB_TOKEN }}

‎defender-xdr/TOC.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -478,9 +478,11 @@
478478
items:
479479
- name: SOC optimization overview
480480
display name: SOC optimization
481-
href: https://aka.ms/soc-opt-from-defender
481+
href: /azure/sentinel/soc-optimization/soc-optimization-access?toc=/defender-xdr/toc.json&bc=/defender-xdr/breadcrumb/toc.json
482+
- name: Use SOC optimizations programmatically
483+
href: /azure/sentinel/soc-optimization/soc-optimization-api?toc=/defender-xdr/toc.json&bc=/defender-xdr/breadcrumb/toc.json
482484
- name: SOC optimization reference
483-
href: https://aka.ms/soc-opt-ref
485+
href: /azure/sentinel/soc-optimization/soc-optimization-reference?toc=/defender-xdr/toc.json&bc=/defender-xdr/breadcrumb/toc.json
484486
- name: Manage multitenant environments
485487
items:
486488
- name: Overview

‎defender-xdr/microsoft-threat-actor-naming.md‎

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,16 @@ ms.service: defender-xdr
66
ms.mktglfcycl: secure
77
ms.sitesec: library
88
ms.localizationpriority: medium
9-
ms.author: vpattnaik
10-
author: diannegali
9+
ms.author: diannegali
10+
author: vpattnaik
1111
manager: dansimp
1212
audience: ITPro
1313
ms.collection:
1414
- m365-security
1515
- tier2
1616
ms.topic: conceptual
1717
search.appverid: met150
18-
ms.date: 06/12/2024
18+
ms.date: 08/19/2024
1919
---
2020

2121
# How Microsoft names threat actors
@@ -54,6 +54,7 @@ Use the following reference table to understand how our previously publicly disc
5454

5555
|Threat actor name|Previous name|Origin/Threat|Other names|
5656
|:---:|:---:|:---:|:---:|
57+
|Antique Typhoon|Storm-0558|China||
5758
|Aqua Blizzard|ACTINIUM|Russia|UNC530, Primitive Bear, Gamaredon|
5859
|Blue Tsunami||Private sector offensive actor|Black Cube|
5960
|Brass Typhoon|BARIUM|China|APT41|
@@ -97,7 +98,7 @@ Use the following reference table to understand how our previously publicly disc
9798
|Night Tsunami|DEV-0336|Private sector offensive actor|NSO Group|
9899
|Nylon Typhoon|NICKEL|China|ke3chang, APT15, Vixen Panda|
99100
|Octo Tempest|Storm-0875|Financially motivated|0ktapus, Scattered Spider, UNC3944|
100-
|Onyx Sleet|PLUTONIUM|North Korea|Silent Chollima, Andariel, DarkSeoul|
101+
|Onyx Sleet|PLUTONIUM|North Korea|APT45, Silent Chollima, Andariel, DarkSeoul|
101102
|Opal Sleet|OSMIUM|North Korea|Konni|
102103
|Peach Sandstorm|HOLMIUM|Iran|APT33, Refined Kitten|
103104
|Pearl Sleet|DEV-0215 (LAWRENCIUM)|North Korea||
@@ -110,13 +111,15 @@ Use the following reference table to understand how our previously publicly disc
110111
|Purple Typhoon|POTASSIUM|China|APT10, Cloudhopper, MenuPass|
111112
|Raspberry Typhoon|RADIUM|China|APT30, LotusBlossom|
112113
|Ruby Sleet|CERIUM|North Korea||
114+
|Ruza Flood|Storm-1099|Russia, Influence operations||
113115
|Salmon Typhoon|SODIUM|China|APT4, Maverick Panda|
114116
|Sangria Tempest|ELBRUS|Financially motivated|Carbon Spider, FIN7|
115117
|Sapphire Sleet|COPERNICIUM|North Korea|Genie Spider, BlueNoroff|
116118
|Seashell Blizzard|IRIDIUM|Russia|APT44, Sandworm|
117119
|Secret Blizzard|KRYPTON|Russia|Venomous Bear, Turla, Snake|
120+
|Sefid Flood|Storm-1364|Iran, Influence operations||
118121
|Silk Typhoon|HAFNIUM|China||
119-
|Smoke Sandstorm|BOHRIUM|Iran||
122+
|Smoke Sandstorm|BOHRIUM|Iran|UNC1549|
120123
|Spandex Tempest|CHIMBORAZO|Financially motivated|TA505|
121124
|Star Blizzard|SEABORGIUM|Russia|Callisto, Reuse Team|
122125
|Storm-0062||China|DarkShadow, Oro0lxy|
@@ -125,23 +128,24 @@ Use the following reference table to understand how our previously publicly disc
125128
|Storm-0257||Group in development|UNC1151|
126129
|Storm-0324||Financially motivated|TA543, Sagrid|
127130
|Storm-0381||Financially motivated||
131+
|Storm-0501||Group in development||
132+
|Storm-0506||Group in development||
128133
|Storm-0530||North Korea|H0lyGh0st|
129134
|Storm-0539||Financially motivated|Atlas Lion|
130-
|Storm-0558||China||
131135
|Storm-0569||Financially motivated||
132136
|Storm-0587||Russia|SaintBot, Saint Bear, TA471|
133137
|Storm-0744||Financially motivated||
134138
|Storm-0784||Iran||
135139
|Storm-0829||Group in development|Nwgen Team|
136140
|Storm-0835||Group in development|EvilProxy|
137141
|Storm-0842||Iran||
142+
|Storm-0844||Group in development||
138143
|Storm-0861||Iran||
139144
|Storm-0867||Egypt|Caffeine|
140145
|Storm-0971||Financially motivated|(Merged into Octo Tempest)|
141146
|Storm-0978||Group in development|RomCom, Underground Team|
142147
|Storm-1044||Financially motivated|Danabot|
143148
|Storm-1084||Iran|DarkBit|
144-
|Storm-1099||Russia||
145149
|Storm-1101||Group in development|NakedPages|
146150
|Storm-1113||Financially motivated||
147151
|Storm-1133||Palestinian Authority||
@@ -151,17 +155,22 @@ Use the following reference table to understand how our previously publicly disc
151155
|Storm-1283||Group in development||
152156
|Storm-1286||Group in development||
153157
|Storm-1295||Group in development|Greatness|
154-
|Storm-1364||Iran||
155-
|Storm-1376||China, Influence operations||
156158
|Storm-1516||Russia, Influence operations||
157159
|Storm-1567||Financially motivated|Akira|
158160
|Storm-1575||Group in development|Dadsec|
161+
|Storm-1660||Iran, Influence operations||
159162
|Storm-1674||Financially motivated||
160163
|Storm-1679||Russia, Influence operations||
164+
|Storm-1804||Iran, Influence operations||
165+
|Storm-1805||Iran, Influence operations||
161166
|Storm-1811||Financially motivated||
167+
|Storm-1841||Russia, Influence operations||
162168
|Storm-1849||China|UAT4356|
169+
|Storm-1852||Group in development||
170+
|Storm-2035||Iran, Influence operations||
163171
|Strawberry Tempest||Financially motivated|LAPSUS$|
164172
|Sunglow Blizzard||Russia||
173+
|Taizi Flood|Storm-1376|China, Influence operations|Spamouflage, Dragonbridge|
165174
|Tomato Tempest|SPURR|Financially motivated|Vatet|
166175
|Vanilla Tempest|DEV-0832|Financially motivated||
167176
|Velvet Tempest|DEV-0504|Financially motivated||

0 commit comments

Comments
 (0)