Merge pull request Azure#13190 from bdudnyk-varonis/feature/varonis-informational-severity

Added support of Informational alerts severity

Author: v-atulyadav

Solutions/VaronisSaaS/Data Connectors/Varonis.Sentinel.Functions.zip

@@ -20,7 +20,8 @@ public static class AlertExtensions
             {
                 ["High"] = 0,
                 ["Medium"] = 1,
-                ["Low"] = 2
+                ["Low"] = 2,
+                ["Informational"] = 3
             };
     }
 }

Solutions/VaronisSaaS/Data Connectors/VaronisSaaSFunction/Varonis.Sentinel.Functions/Helpers/AlertExtensions.cs

@@ -9,7 +9,7 @@
     "LogAnalyticsKey": "",
     "LogAnalyticsWorkspace": "",
     "AlertRetrievalStart": "2 weeks",
-    "AlertSeverity": "Low, Medium, High",
+    "AlertSeverity": "Low, Medium, High, Informational",
     "ThreatDetectionPolicies": "",
     "AlertStatus": "New, Under Investigation",
     "MaxAlertRetrieval": "1000"

Solutions/VaronisSaaS/Data Connectors/VaronisSaaSFunction/Varonis.Sentinel.Functions/local.settings.json

@@ -23,6 +23,11 @@
       "baseQuery": "VaronisAlerts_CL\n| where Severity_s == \"Low\"",
       "legend": "Low severity alerts",
       "metricName": "Low severity alerts"
+    },
+    {
+      "baseQuery": "VaronisAlerts_CL\n| where Severity_s == \"Informational\"",
+      "legend": "Informational severity alerts",
+      "metricName": "Informational severity alerts"
     }
   ],
   "sampleQueries": [

Solutions/VaronisSaaS/Data Connectors/VaronisSaaS_API_FunctionApp.json

@@ -31,7 +31,7 @@ param threatDetectionPolicies string = ''
 param alertStatus string = 'New, Under Investigation'
 
 @description('Specify the alert severity.')
-param alertSeverity string = 'Low, Medium, High'
+param alertSeverity string = 'Low, Medium, High, Informational'
 
 var functionAppName = 'VaronisSaaS-${uniqueString(resourceGroup().id)}'
 var functionWorkerRuntime = 'dotnet'

Solutions/VaronisSaaS/Data Connectors/azuredeploy.bicep

@@ -71,7 +71,7 @@
     },
     "alertSeverity": {
       "type": "string",
-      "defaultValue": "Low, Medium, High",
+      "defaultValue": "Low, Medium, High, Informational",
       "metadata": {
         "description": "Specify the alert severity."
       }

Solutions/VaronisSaaS/Data Connectors/azuredeploy.json

@@ -6,7 +6,7 @@
   "Workbooks": ["Workbooks/VaronisSaaS.json"],
   "Data Connectors": ["Data Connectors/VaronisSaaS_API_FunctionApp.json"],
   "BasePath": "C:\\Projects\\DataIntegration\\Azure-Sentinel\\Solutions\\VaronisSaaS",
-  "Version": "3.0.2",
+  "Version": "3.0.3",
   "Metadata": "SolutionMetadata.json",
   "TemplateSpec": true,
   "Is1PConnector": false

Solutions/VaronisSaaS/Data/Solution_VaronisSaaS.json

@@ -39,7 +39,7 @@
   },
   "variables": {
     "_solutionName": "VaronisSaaS",
-    "_solutionVersion": "3.0.2",
+    "_solutionVersion": "3.0.3",
     "solutionId": "varonis.microsoft-sentinel-solution-varonissaas",
     "_solutionId": "[variables('solutionId')]",
     "workbookVersion1": "1.0.0",
@@ -70,7 +70,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "VaronisSaaS Workbook with template version 3.0.2",
+        "description": "VaronisSaaS Workbook with template version 3.0.3",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('workbookVersion1')]",
@@ -157,7 +157,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "VaronisSaaS data connector with template version 3.0.2",
+        "description": "VaronisSaaS data connector with template version 3.0.3",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('dataConnectorVersion1')]",
@@ -196,6 +196,11 @@
                       "baseQuery": "VaronisAlerts_CL\n| where Severity_s == \"Low\"",
                       "legend": "Low severity alerts",
                       "metricName": "Low severity alerts"
+                    },
+                    {
+                      "baseQuery": "VaronisAlerts_CL\n| where Severity_s == \"Informational\"",
+                      "legend": "Informational severity alerts",
+                      "metricName": "Informational severity alerts"
                     }
                   ],
                   "sampleQueries": [
@@ -387,6 +392,11 @@
               "baseQuery": "VaronisAlerts_CL\n| where Severity_s == \"Low\"",
               "legend": "Low severity alerts",
               "metricName": "Low severity alerts"
+            },
+            {
+              "baseQuery": "VaronisAlerts_CL\n| where Severity_s == \"Informational\"",
+              "legend": "Informational severity alerts",
+              "metricName": "Informational severity alerts"
             }
           ],
           "dataTypes": [
@@ -484,7 +494,7 @@
       "apiVersion": "2023-04-01-preview",
       "location": "[parameters('workspace-location')]",
       "properties": {
-        "version": "3.0.2",
+        "version": "3.0.3",
         "kind": "Solution",
         "contentSchemaVersion": "3.0.0",
         "displayName": "VaronisSaaS",

Solutions/VaronisSaaS/Package/3.0.3.zip

@@ -1,5 +1,6 @@
 | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History**                          |
 |-------------|--------------------------------|---------------------------------------------|
+| 3.0.3       | 25-11-2025                     | Add Informational severity level support    |
 | 3.0.2       | 12-09-2025                     | Save last alert ingest time                 |
 | 3.0.1       | 02-12-2025                     | Bug fixes                                   |
 | 3.0.0       | 02-07-2024                     | Refactor azure function                     |