Skip to content

Commit 29e8902

Browse files
artafresartafres
committed
feat(SlackAudit): update parser version and standardize entity mappings
- Bump parser version from 1.0.0 to 1.0.1 - Reorder entity mapping fields for consistent formatting - Standardize fieldMappings structure across all analytics rules - Update package binary with latest changes
1 parent 20a709b commit 29e8902

File tree

4 files changed

+54
-53
lines changed

4 files changed

+54
-53
lines changed

‎Solutions/SlackAudit/Package/3.0.5.zip‎

-10 Bytes
Binary file not shown.

‎Solutions/SlackAudit/Package/mainTemplate.json‎

Lines changed: 51 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,7 @@
139139
"_parserName1": "[concat(parameters('workspace'),'/','SlackAudit Data Parser')]",
140140
"_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'SlackAudit Data Parser')]",
141141
"parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('SlackAudit-Parser')))]",
142-
"parserVersion1": "1.0.0",
142+
"parserVersion1": "1.0.1",
143143
"parserContentId1": "SlackAudit-Parser"
144144
},
145145
"huntingQueryObject1": {
@@ -334,13 +334,13 @@
334334
],
335335
"entityMappings": [
336336
{
337-
"entityType": "Account",
338337
"fieldMappings": [
339338
{
340-
"identifier": "FullName",
341-
"columnName": "AccountCustomEntity"
339+
"columnName": "AccountCustomEntity",
340+
"identifier": "FullName"
342341
}
343-
]
342+
],
343+
"entityType": "Account"
344344
}
345345
]
346346
}
@@ -438,13 +438,13 @@
438438
],
439439
"entityMappings": [
440440
{
441-
"entityType": "Account",
442441
"fieldMappings": [
443442
{
444-
"identifier": "FullName",
445-
"columnName": "AccountCustomEntity"
443+
"columnName": "AccountCustomEntity",
444+
"identifier": "FullName"
446445
}
447-
]
446+
],
447+
"entityType": "Account"
448448
}
449449
]
450450
}
@@ -542,13 +542,13 @@
542542
],
543543
"entityMappings": [
544544
{
545-
"entityType": "Account",
546545
"fieldMappings": [
547546
{
548-
"identifier": "FullName",
549-
"columnName": "AccountCustomEntity"
547+
"columnName": "AccountCustomEntity",
548+
"identifier": "FullName"
550549
}
551-
]
550+
],
551+
"entityType": "Account"
552552
}
553553
]
554554
}
@@ -646,22 +646,22 @@
646646
],
647647
"entityMappings": [
648648
{
649-
"entityType": "Account",
650649
"fieldMappings": [
651650
{
652-
"identifier": "FullName",
653-
"columnName": "AccountCustomEntity"
651+
"columnName": "AccountCustomEntity",
652+
"identifier": "FullName"
654653
}
655-
]
654+
],
655+
"entityType": "Account"
656656
},
657657
{
658-
"entityType": "IP",
659658
"fieldMappings": [
660659
{
661-
"identifier": "Address",
662-
"columnName": "IPCustomEntity"
660+
"columnName": "IPCustomEntity",
661+
"identifier": "Address"
663662
}
664-
]
663+
],
664+
"entityType": "IP"
665665
}
666666
]
667667
}
@@ -759,22 +759,22 @@
759759
],
760760
"entityMappings": [
761761
{
762-
"entityType": "Account",
763762
"fieldMappings": [
764763
{
765-
"identifier": "FullName",
766-
"columnName": "AccountCustomEntity"
764+
"columnName": "AccountCustomEntity",
765+
"identifier": "FullName"
767766
}
768-
]
767+
],
768+
"entityType": "Account"
769769
},
770770
{
771-
"entityType": "File",
772771
"fieldMappings": [
773772
{
774-
"identifier": "Name",
775-
"columnName": "FileCustomEntity"
773+
"columnName": "FileCustomEntity",
774+
"identifier": "Name"
776775
}
777-
]
776+
],
777+
"entityType": "File"
778778
}
779779
]
780780
}
@@ -872,13 +872,13 @@
872872
],
873873
"entityMappings": [
874874
{
875-
"entityType": "Account",
876875
"fieldMappings": [
877876
{
878-
"identifier": "FullName",
879-
"columnName": "AccountCustomEntity"
877+
"columnName": "AccountCustomEntity",
878+
"identifier": "FullName"
880879
}
881-
]
880+
],
881+
"entityType": "Account"
882882
}
883883
]
884884
}
@@ -978,13 +978,13 @@
978978
],
979979
"entityMappings": [
980980
{
981-
"entityType": "Account",
982981
"fieldMappings": [
983982
{
984-
"identifier": "FullName",
985-
"columnName": "AccountCustomEntity"
983+
"columnName": "AccountCustomEntity",
984+
"identifier": "FullName"
986985
}
987-
]
986+
],
987+
"entityType": "Account"
988988
}
989989
]
990990
}
@@ -1082,22 +1082,22 @@
10821082
],
10831083
"entityMappings": [
10841084
{
1085-
"entityType": "Account",
10861085
"fieldMappings": [
10871086
{
1088-
"identifier": "FullName",
1089-
"columnName": "AccountCustomEntity"
1087+
"columnName": "AccountCustomEntity",
1088+
"identifier": "FullName"
10901089
}
1091-
]
1090+
],
1091+
"entityType": "Account"
10921092
},
10931093
{
1094-
"entityType": "IP",
10951094
"fieldMappings": [
10961095
{
1097-
"identifier": "Address",
1098-
"columnName": "IPCustomEntity"
1096+
"columnName": "IPCustomEntity",
1097+
"identifier": "Address"
10991098
}
1100-
]
1099+
],
1100+
"entityType": "IP"
11011101
}
11021102
]
11031103
}
@@ -1197,13 +1197,13 @@
11971197
],
11981198
"entityMappings": [
11991199
{
1200-
"entityType": "Account",
12011200
"fieldMappings": [
12021201
{
1203-
"identifier": "FullName",
1204-
"columnName": "AccountCustomEntity"
1202+
"columnName": "AccountCustomEntity",
1203+
"identifier": "FullName"
12051204
}
1206-
]
1205+
],
1206+
"entityType": "Account"
12071207
}
12081208
]
12091209
}
@@ -1968,8 +1968,8 @@
19681968
"contentId": "[variables('parserObject1').parserContentId1]",
19691969
"contentKind": "Parser",
19701970
"displayName": "SlackAudit Data Parser",
1971-
"contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]",
1972-
"id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]",
1971+
"contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.1')))]",
1972+
"id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.1')))]",
19731973
"version": "[variables('parserObject1').parserVersion1]"
19741974
}
19751975
},

‎Solutions/SlackAudit/Parsers/SlackAudit.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
id: fb5aaeb6-14fa-45e8-bb4a-6d4c642a710e
22
Function:
33
Title: Parser for SlackAudit
4-
Version: "1.0.0"
5-
LastUpdated: "2023-08-23"
4+
Version: "1.0.1"
5+
LastUpdated: "2025-12-12"
66
Category: Microsoft Sentinel Parser
77
FunctionName: SlackAudit
88
FunctionAlias: SlackAudit

‎Solutions/SlackAudit/ReleaseNotes.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
22
|-------------|--------------------------------|--------------------------------------------------------------------|
3+
| 3.0.5 | 12-12-2025 | Updated the **Parser** yaml file. |
34
| 3.0.4 | 28-07-2025 | Removed Deprecated **Data Connector**. |
45
| 3.0.3 | 30-06-2025 | Moving **CCF Data Connector** to GA. |
56
| 3.0.2 | 30-05-2025 | Preview tag added to **CCF Data Connector**. |

0 commit comments

Comments
 (0)