Skip to content

Commit 50a1bf9

Browse files
v-dvedakv-dvedak
authored
Merge pull request Azure#13303 from ermes-cyber-security/feature/ermes_3.1.0
Ermes Browser Security integration 3.1.0
2 parents 4c41053 + 632a5fa commit 50a1bf9

File tree

9 files changed

+118
-39
lines changed

9 files changed

+118
-39
lines changed

Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/data_connector_definition.json renamed to Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_CCF/ErmesBrowserSecurityEvents_ConnectorDefinition.json

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,18 @@
7272
{
7373
"description": "Connect using OAuth2 credentials",
7474
"instructions": [
75+
{
76+
"type": "Textbox",
77+
"parameters": {
78+
"label": "API URL (optional)",
79+
"placeholder": "https://api.shield.ermessecurity.com",
80+
"type": "text",
81+
"name": "apiUrl",
82+
"validations": {
83+
"required": false
84+
}
85+
}
86+
},
7587
{
7688
"type": "OAuthForm",
7789
"parameters": {

Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/dcr.json renamed to Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_CCF/ErmesBrowserSecurityEvents_DCR.json

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,12 @@
1111
{
1212
"name": "_created",
1313
"type": "string",
14-
"description": "Event Timestamp"
14+
"description": "Event creation timestamp (server ingestion/generation time)"
15+
},
16+
{
17+
"name": "timestamp",
18+
"type": "string",
19+
"description": "Event timestamp"
1520
},
1621
{
1722
"name": "username",
@@ -42,6 +47,11 @@
4247
"name": "message",
4348
"type": "dynamic",
4449
"description": "Message"
50+
},
51+
{
52+
"name": "log_data",
53+
"type": "dynamic",
54+
"description": "Event-specific log data"
4555
}
4656
]
4757
}
@@ -62,9 +72,9 @@
6272
"destinations": [
6373
"clv2ws1"
6474
],
65-
"transformKql": "source | project TimeGenerated = todatetime([\"_created\"]), Username = username, ClientIP = client_ip, EventCategory = event_cat, EventId = event_id, Level = level, Message = tostring(message.en)",
75+
"transformKql": "source | extend actual_timestamp = iff(isnotnull(timestamp), todatetime(timestamp), todatetime([\"_created\"])) | extend log_data_final = case(event_cat in (\"general\", \"dashboard_auth\", \"dashboard_audit\", \"device_status\"), parse_json('null'), log_data) | project TimeGenerated = actual_timestamp, Username = username, ClientIP = client_ip, EventCategory = event_cat, EventId = event_id, Level = level, Message = tostring(message.en), LogData = log_data_final",
6676
"outputStream": "Custom-ErmesBrowserSecurityEvents_CL"
6777
}
6878
]
6979
}
70-
}]
80+
}]

Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/data_connector_poller.json renamed to Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_CCF/ErmesBrowserSecurityEvents_PollerConfig.json

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,24 +16,24 @@
1616
"ClientSecret": "{{clientSecret}}",
1717
"ClientId": "{{clientId}}",
1818
"GrantType": "client_credentials",
19-
"TokenEndpoint": "https://api.shield.ermessecurity.com/oauth/token",
19+
"TokenEndpoint": "[[concat(if(empty(parameters('apiUrl')), 'https://api.shield.ermessecurity.com', parameters('apiUrl')),'/oauth/token')]",
2020
"TokenEndpointHeaders": {
2121
"Content-Type": "application/x-www-form-urlencoded"
2222
},
2323
"TokenEndpointQueryParameters": {}
2424
},
2525
"request": {
26-
"apiEndpoint": "https://api.shield.ermessecurity.com/public/v1/events",
26+
"apiEndpoint": "[[concat(if(empty(parameters('apiUrl')), 'https://api.shield.ermessecurity.com', parameters('apiUrl')),'/public/v1/events')]",
2727
"httpMethod": "GET",
2828
"queryParameters": {
2929
"max_results": 100,
30-
"sort": "-_created",
30+
"sort": "_created",
3131
"is_azure": "[variables('_solutionVersion')]"
3232
},
3333
"queryWindowInMin": 5,
3434
"queryTimeFormat": "yyyy-MM-ddTHH:mm:ss.000000+00:00",
35-
"startTimeAttributeName": "gte__created",
36-
"endTimeAttributeName": "lt__created",
35+
"startTimeAttributeName": "gt__created",
36+
"endTimeAttributeName": "lte__created",
3737
"rateLimitQps": 1,
3838
"retryCount": 3,
3939
"timeoutInSeconds": 30,

Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/table.json renamed to Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_CCF/ErmesBrowserSecurityEvents_Table.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,11 @@
4242
"name": "Message",
4343
"type": "String",
4444
"description": "Message"
45+
},
46+
{
47+
"name": "LogData",
48+
"type": "Dynamic",
49+
"description": "Event-specific log data"
4550
}
4651
]
4752
}

‎Solutions/Ermes Browser Security/Data/Solution_ErmesBrowserSecurity.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@
44
"Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Ermes_Browser_Security_Logo.svg\" width=\"75px\" height=\"75px\">",
55
"Description": "The [Ermes Browser Security](https://www.ermes.company) Solution for Microsoft Sentinel provides a simple way to ingest Security and Audit events from Ermes into Microsoft Sentinel.",
66
"Data Connectors": [
7-
"Data Connectors/ErmesBrowserSecurityEvents_ccp/data_connector_definition.json"
7+
"Data Connectors/ErmesBrowserSecurityEvents_CCF/ErmesBrowserSecurityEvents_ConnectorDefinition.json"
88
],
99
"BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Ermes Browser Security",
10-
"Version": "3.0.3",
10+
"Version": "3.1.0",
1111
"Metadata": "SolutionMetadata.json",
1212
"TemplateSpec": true,
1313
"Is1PConnector": false

‎Solutions/Ermes Browser Security/Package/3.1.0.zip‎

6.45 KB
Binary file not shown.

‎Solutions/Ermes Browser Security/Package/createUiDefinition.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,11 +60,11 @@
6060
"name": "dataconnectors1-text",
6161
"type": "Microsoft.Common.TextBlock",
6262
"options": {
63-
"text": "This Solution installs the data connector for Ermes Browser Security. You can get Ermes Browser Security data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
63+
"text": "This Solution installs the data connector for Ermes Browser Security Events. You can get Ermes Browser Security Events data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
6464
}
6565
},
6666
{
67-
"name": "dataconnectors-link2",
67+
"name": "dataconnectors-link1",
6868
"type": "Microsoft.Common.TextBlock",
6969
"options": {
7070
"link": {

‎Solutions/Ermes Browser Security/Package/mainTemplate.json‎

Lines changed: 78 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@
4545
},
4646
"variables": {
4747
"_solutionName": "Ermes Browser Security",
48-
"_solutionVersion": "3.0.3",
48+
"_solutionVersion": "3.1.0",
4949
"solutionId": "ermes.azure-sentinel-solution-ermes-browser-security",
5050
"_solutionId": "[variables('solutionId')]",
5151
"workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
@@ -79,7 +79,7 @@
7979
"resources": [
8080
{
8181
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]",
82-
"apiVersion": "2022-09-01-preview",
82+
"apiVersion": "2025-09-01",
8383
"type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
8484
"location": "[parameters('workspace-location')]",
8585
"kind": "Customizable",
@@ -151,6 +151,18 @@
151151
{
152152
"description": "Connect using OAuth2 credentials",
153153
"instructions": [
154+
{
155+
"type": "Textbox",
156+
"parameters": {
157+
"label": "API URL (optional)",
158+
"placeholder": "https://api.shield.ermessecurity.com",
159+
"type": "text",
160+
"name": "apiUrl",
161+
"validations": {
162+
"required": false
163+
}
164+
}
165+
},
154166
{
155167
"type": "OAuthForm",
156168
"parameters": {
@@ -203,7 +215,7 @@
203215
},
204216
{
205217
"name": "ErmesOauthDCR1",
206-
"apiVersion": "2022-06-01",
218+
"apiVersion": "2024-03-11",
207219
"type": "Microsoft.Insights/dataCollectionRules",
208220
"location": "[parameters('workspace-location')]",
209221
"kind": "[variables('blanks')]",
@@ -215,7 +227,12 @@
215227
{
216228
"name": "_created",
217229
"type": "string",
218-
"description": "Event Timestamp"
230+
"description": "Event creation timestamp (server ingestion/generation time)"
231+
},
232+
{
233+
"name": "timestamp",
234+
"type": "string",
235+
"description": "Event timestamp"
219236
},
220237
{
221238
"name": "username",
@@ -246,6 +263,11 @@
246263
"name": "message",
247264
"type": "dynamic",
248265
"description": "Message"
266+
},
267+
{
268+
"name": "log_data",
269+
"type": "dynamic",
270+
"description": "Event-specific log data"
249271
}
250272
]
251273
}
@@ -266,15 +288,15 @@
266288
"destinations": [
267289
"clv2ws1"
268290
],
269-
"transformKql": "source | project TimeGenerated = todatetime([\"_created\"]), Username = username, ClientIP = client_ip, EventCategory = event_cat, EventId = event_id, Level = level, Message = tostring(message.en)",
291+
"transformKql": "source | extend actual_timestamp = iff(isnotnull(timestamp), todatetime(timestamp), todatetime([\"_created\"])) | extend log_data_final = case(event_cat in (\"general\", \"dashboard_auth\", \"dashboard_audit\", \"device_status\"), parse_json('null'), log_data) | project TimeGenerated = actual_timestamp, Username = username, ClientIP = client_ip, EventCategory = event_cat, EventId = event_id, Level = level, Message = tostring(message.en), LogData = log_data_final",
270292
"outputStream": "Custom-ErmesBrowserSecurityEvents_CL"
271293
}
272294
]
273295
}
274296
},
275297
{
276298
"name": "ErmesBrowserSecurityEvents_CL",
277-
"apiVersion": "2022-10-01",
299+
"apiVersion": "2025-07-01",
278300
"type": "Microsoft.OperationalInsights/workspaces/tables",
279301
"location": "[parameters('workspace-location')]",
280302
"kind": null,
@@ -317,6 +339,11 @@
317339
"name": "Message",
318340
"type": "String",
319341
"description": "Message"
342+
},
343+
{
344+
"name": "LogData",
345+
"type": "Dynamic",
346+
"description": "Event-specific log data"
320347
}
321348
]
322349
}
@@ -335,7 +362,7 @@
335362
},
336363
{
337364
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]",
338-
"apiVersion": "2022-09-01-preview",
365+
"apiVersion": "2025-09-01",
339366
"type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
340367
"location": "[parameters('workspace-location')]",
341368
"kind": "Customizable",
@@ -407,6 +434,18 @@
407434
{
408435
"description": "Connect using OAuth2 credentials",
409436
"instructions": [
437+
{
438+
"type": "Textbox",
439+
"parameters": {
440+
"label": "API URL (optional)",
441+
"placeholder": "https://api.shield.ermessecurity.com",
442+
"type": "text",
443+
"name": "apiUrl",
444+
"validations": {
445+
"required": false
446+
}
447+
}
448+
},
410449
{
411450
"type": "OAuthForm",
412451
"parameters": {
@@ -473,24 +512,22 @@
473512
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
474513
"contentVersion": "[variables('dataConnectorCCPVersion')]",
475514
"parameters": {
476-
"ClientId": {
477-
"defaultValue": "-NA-",
478-
"type": "securestring",
479-
"minLength": 1
515+
"guidValue": {
516+
"defaultValue": "[[newGuid()]",
517+
"type": "securestring"
480518
},
481-
"ClientSecret": {
482-
"defaultValue": "-NA-",
483-
"type": "securestring",
484-
"minLength": 1
519+
"innerWorkspace": {
520+
"defaultValue": "[parameters('workspace')]",
521+
"type": "securestring"
485522
},
486523
"connectorDefinitionName": {
487524
"defaultValue": "Ermes Browser Security Events",
488-
"type": "string",
525+
"type": "securestring",
489526
"minLength": 1
490527
},
491528
"workspace": {
492529
"defaultValue": "[parameters('workspace')]",
493-
"type": "string"
530+
"type": "securestring"
494531
},
495532
"dcrConfig": {
496533
"defaultValue": {
@@ -499,6 +536,20 @@
499536
},
500537
"type": "object"
501538
},
539+
"apiUrl": {
540+
"defaultValue": "",
541+
"type": "securestring"
542+
},
543+
"ClientId": {
544+
"defaultValue": "-NA-",
545+
"type": "securestring",
546+
"minLength": 1
547+
},
548+
"ClientSecret": {
549+
"defaultValue": "-NA-",
550+
"type": "securestring",
551+
"minLength": 1
552+
},
502553
"AuthorizationCode": {
503554
"defaultValue": "-NA-",
504555
"type": "securestring",
@@ -535,8 +586,8 @@
535586
}
536587
},
537588
{
538-
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', 'ErmesBrowserSecurityEvents')]",
539-
"apiVersion": "2023-02-01-preview",
589+
"name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'ErmesBrowserSecurityEvents', parameters('guidValue'))]",
590+
"apiVersion": "2025-09-01",
540591
"type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
541592
"location": "[parameters('workspace-location')]",
542593
"kind": "RestApiPoller",
@@ -550,27 +601,27 @@
550601
},
551602
"auth": {
552603
"type": "OAuth2",
553-
"ClientSecret": "[[parameters('ClientSecret')]",
554-
"ClientId": "[[parameters('ClientId')]",
604+
"ClientSecret": "[[parameters('clientSecret')]",
605+
"ClientId": "[[parameters('clientId')]",
555606
"GrantType": "client_credentials",
556-
"TokenEndpoint": "https://api.shield.ermessecurity.com/oauth/token",
607+
"TokenEndpoint": "[[concat(if(empty(parameters('apiUrl')), 'https://api.shield.ermessecurity.com', parameters('apiUrl')),'/oauth/token')]",
557608
"TokenEndpointHeaders": {
558609
"Content-Type": "application/x-www-form-urlencoded"
559610
},
560611
"TokenEndpointQueryParameters": {}
561612
},
562613
"request": {
563-
"apiEndpoint": "https://api.shield.ermessecurity.com/public/v1/events",
614+
"apiEndpoint": "[[concat(if(empty(parameters('apiUrl')), 'https://api.shield.ermessecurity.com', parameters('apiUrl')),'/public/v1/events')]",
564615
"httpMethod": "GET",
565616
"queryParameters": {
566617
"max_results": 100,
567-
"sort": "-_created",
618+
"sort": "_created",
568619
"is_azure": "[variables('_solutionVersion')]"
569620
},
570621
"queryWindowInMin": 5,
571622
"queryTimeFormat": "yyyy-MM-ddTHH:mm:ss.000000+00:00",
572-
"startTimeAttributeName": "gte__created",
573-
"endTimeAttributeName": "lt__created",
623+
"startTimeAttributeName": "gt__created",
624+
"endTimeAttributeName": "lte__created",
574625
"rateLimitQps": 1,
575626
"retryCount": 3,
576627
"timeoutInSeconds": 30,
@@ -605,7 +656,7 @@
605656
"apiVersion": "2023-04-01-preview",
606657
"location": "[parameters('workspace-location')]",
607658
"properties": {
608-
"version": "3.0.3",
659+
"version": "3.1.0",
609660
"kind": "Solution",
610661
"contentSchemaVersion": "3.0.0",
611662
"displayName": "Ermes Browser Security",

‎Solutions/Ermes Browser Security/ReleaseNotes.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
22
|-------------|--------------------------------|----------------------------------------------------|
3+
| 3.1.0 | 12-12-2025 | Added custom API URL support and LogData field with additional event details |
34
| 3.0.3 | 19-02-2024 | Updated _solutionVersion to dataConnectorCCPVersion. <br/> Removed grant_type and added the Solution version to the query parameters |
45
| 3.0.2 | 23-01-2024 | Updated paging type in **CCP Data Connector** |
56
| 3.0.1 | 28-11-2023 | Updated **CCP Data Connector** |

0 commit comments

Comments
 (0)