Skip to content

Commit ecf0bf8

Browse files
author
Shubhangi Pagar
committed
Merge branch 'master' into fixPodDuplicateDataIssue
2 parents c5bc50b + 318ccfe commit ecf0bf8

File tree

1,118 files changed

+41753
-2604
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,118 files changed

+41753
-2604
lines changed

‎.github/workflows/update-solutions-analyzer.yml‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,15 @@ jobs:
4141
cd "Tools/Solutions Analyzer"
4242
python solution_connector_tables.py
4343
44+
- name: Generate Connector Documentation
45+
run: |
46+
cd "Tools/Solutions Analyzer"
47+
python generate_connector_docs.py
48+
4449
- name: Check for changes
4550
id: check_changes
4651
run: |
47-
if git diff --quiet "Tools/Solutions Analyzer/solutions_connectors_tables_mapping.csv" "Tools/Solutions Analyzer/solutions_connectors_tables_issues_and_exceptions_report.csv"; then
52+
if git diff --quiet "Tools/Solutions Analyzer/solutions_connectors_tables_mapping.csv" "Tools/Solutions Analyzer/solutions_connectors_tables_issues_and_exceptions_report.csv" "Tools/Solutions Analyzer/connector-docs/"; then
4853
echo "changed=false" >> $GITHUB_OUTPUT
4954
else
5055
echo "changed=true" >> $GITHUB_OUTPUT
@@ -57,23 +62,25 @@ jobs:
5762
git config --local user.name "github-actions[bot]"
5863
git add "Tools/Solutions Analyzer/solutions_connectors_tables_mapping.csv"
5964
git add "Tools/Solutions Analyzer/solutions_connectors_tables_issues_and_exceptions_report.csv"
60-
git commit -m "chore: Update Solutions Analyzer CSV files [skip ci]"
65+
git add "Tools/Solutions Analyzer/connector-docs/"
66+
git commit -m "chore: Update Solutions Analyzer CSV files and documentation [skip ci]"
6167
git push
6268
6369
- name: Create summary
6470
if: steps.check_changes.outputs.changed == 'true'
6571
run: |
6672
echo "### Solutions Analyzer Updated :white_check_mark:" >> $GITHUB_STEP_SUMMARY
6773
echo "" >> $GITHUB_STEP_SUMMARY
68-
echo "CSV files have been regenerated and committed." >> $GITHUB_STEP_SUMMARY
74+
echo "CSV files and documentation have been regenerated and committed." >> $GITHUB_STEP_SUMMARY
6975
echo "" >> $GITHUB_STEP_SUMMARY
7076
echo "**Modified files:**" >> $GITHUB_STEP_SUMMARY
7177
echo "- Tools/Solutions Analyzer/solutions_connectors_tables_mapping.csv" >> $GITHUB_STEP_SUMMARY
7278
echo "- Tools/Solutions Analyzer/solutions_connectors_tables_issues_and_exceptions_report.csv" >> $GITHUB_STEP_SUMMARY
79+
echo "- Tools/Solutions Analyzer/connector-docs/" >> $GITHUB_STEP_SUMMARY
7380
7481
- name: No changes summary
7582
if: steps.check_changes.outputs.changed == 'false'
7683
run: |
7784
echo "### Solutions Analyzer :information_source:" >> $GITHUB_STEP_SUMMARY
7885
echo "" >> $GITHUB_STEP_SUMMARY
79-
echo "No changes detected. CSV files are already up-to-date." >> $GITHUB_STEP_SUMMARY
86+
echo "No changes detected. CSV files and documentation are already up-to-date." >> $GITHUB_STEP_SUMMARY

‎.script/package-automation/catalogAPI.ps1‎

Lines changed: 31 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -123,15 +123,37 @@ function GetOfferVersion($offerId, $mainTemplateUrl)
123123

124124
function GetPackageVersion($defaultPackageVersion, $offerId, $offerDetails, $packageVersionAttribute, $userInputPackageVersion)
125125
{
126+
$setPackageVersion = $defaultPackageVersion
127+
126128
if ($packageVersionAttribute)
127129
{
128130
$userInputMajor,$userInputMinor,$userInputBuild,$userInputRevision = $userInputPackageVersion.split(".")
129131
$defaultMajor,$defaultMinor,$defaultBuild,$defaultRevision = $defaultPackageVersion.split(".")
130132

131-
if ($userInputMajor -ge '2' -and $userInputMinor -gt $defaultMinor)
132-
{
133-
#return as is value of package version as middle value is greater
134-
return $userInputPackageVersion
133+
# Convert to integers for proper numeric comparison
134+
[int]$userInputMajor = $userInputMajor
135+
[int]$userInputMinor = $userInputMinor
136+
[int]$userInputBuild = $userInputBuild
137+
[int]$defaultMajor = $defaultMajor
138+
[int]$defaultMinor = $defaultMinor
139+
[int]$defaultBuild = $defaultBuild
140+
141+
if ($userInputMajor -ge 3) {
142+
# Version 3.x.x or higher: use user input if minor and build are greater than default
143+
if ($userInputMinor -ge $defaultMinor -and $userInputBuild -gt $defaultBuild) {
144+
$setPackageVersion = $userInputPackageVersion
145+
if ($null -eq $offerDetails) {
146+
Write-Host "Package version set to $setPackageVersion"
147+
return $setPackageVersion
148+
}
149+
} elseif ($null -eq $offerDetails) {
150+
Write-Host "Package version set to $userInputPackageVersion"
151+
return $userInputPackageVersion
152+
}
153+
} elseif ($userInputMajor -le 2) {
154+
# Version 2.x.x: always use default
155+
Write-Host "Package version set to $defaultPackageVersion"
156+
return $defaultPackageVersion
135157
}
136158
}
137159

@@ -174,13 +196,13 @@ function GetPackageVersion($defaultPackageVersion, $offerId, $offerDetails, $pac
174196
{
175197
$identifiedOfferVersion = $offerMetadataVersion
176198
$catalogMajor,$catalogminor,$catalogbuild,$catalogrevision = $identifiedOfferVersion.split(".")
177-
$defaultMajor,$defaultminor,$defaultbuild,$defaultrevision = $defaultPackageVersion.split(".")
199+
$defaultMajor,$defaultminor,$defaultbuild,$defaultrevision = $setPackageVersion.split(".")
178200

179-
if ($defaultMajor -gt $catalogMajor)
201+
if ($defaultMajor -gt $catalogMajor -and $defaultminor -gt $catalogminor -and $defaultbuild -ge $catalogbuild)
180202
{
181-
# eg: 3.0.0 > 2.0.1 ==> 3.0.0
182-
Write-Host "Default Package version is greater then the CatalogAPI version so $defaultVersionMessage"
183-
return $defaultPackageVersion
203+
# eg: 3.0.0 > 2.0.1 ==> 3.0.0 or 3.1.2 > 3.1.1 ==> 3.1.2
204+
Write-Host "Package version $setPackageVersion greater then the CatalogAPI version so $defaultVersionMessage"
205+
return $setPackageVersion
184206
}
185207
else
186208
{

‎.script/tests/KqlvalidationsTests/CustomTables/AZFWApplicationRule.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@
99
"Name": "ActionReason",
1010
"Type": "string"
1111
},
12+
{
13+
"Name": "_BilledSize",
14+
"Type": "real"
15+
},
1216
{
1317
"Name": "DestinationPort",
1418
"Type": "int"
@@ -17,6 +21,14 @@
1721
"Name": "Fqdn",
1822
"Type": "string"
1923
},
24+
{
25+
"Name": "_IsBillable",
26+
"Type": "string"
27+
},
28+
{
29+
"Name": "IsExplicitProxyRequest",
30+
"Type": "bool"
31+
},
2032
{
2133
"Name": "IsTlsInspected",
2234
"Type": "bool"
@@ -57,6 +69,10 @@
5769
"Name": "SourceSystem",
5870
"Type": "string"
5971
},
72+
{
73+
"Name": "_SubscriptionId",
74+
"Type": "string"
75+
},
6076
{
6177
"Name": "TargetUrl",
6278
"Type": "string"
@@ -76,6 +92,14 @@
7692
{
7793
"Name": "WebCategory",
7894
"Type": "string"
95+
},
96+
{
97+
"Name": "_TimeReceived",
98+
"Type": "datetime"
99+
},
100+
{
101+
"Name": "_ItemId",
102+
"Type": "string"
79103
}
80104
]
81105
}

‎.script/tests/KqlvalidationsTests/CustomTables/AZFWDnsQuery.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,14 @@
8888
{
8989
"Name": "Type",
9090
"Type": "string"
91+
},
92+
{
93+
"Name": "_TimeReceived",
94+
"Type": "datetime"
95+
},
96+
{
97+
"Name": "_ItemId",
98+
"Type": "string"
9199
}
92100
]
93101
}

‎.script/tests/KqlvalidationsTests/CustomTables/AZFWIdpsSignature.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,14 @@
8080
{
8181
"Name": "SignatureId",
8282
"Type": "string"
83+
},
84+
{
85+
"Name": "_TimeReceived",
86+
"Type": "datetime"
87+
},
88+
{
89+
"Name": "_ItemId",
90+
"Type": "string"
8391
}
8492
]
8593
}

‎.script/tests/KqlvalidationsTests/CustomTables/AZFWNatRule.json‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
{
2+
"Name": "AZFWNatRule",
3+
"Properties": [
4+
{
5+
"Name": "_BilledSized",
6+
"Type": "real"
7+
},
8+
{
9+
"Name": "DestinationIp",
10+
"Type": "string"
11+
},
12+
{
13+
"Name": "DestinationPort",
14+
"Type": "int"
15+
},
16+
{
17+
"Name": "_IsBillable",
18+
"Type": "string"
19+
},
20+
{
21+
"Name": "Policy",
22+
"Type": "string"
23+
},
24+
{
25+
"Name": "Protocol",
26+
"Type": "string"
27+
},
28+
{
29+
"Name": "_ResourceId",
30+
"Type": "string"
31+
},
32+
{
33+
"Name": "Rule",
34+
"Type": "string"
35+
},
36+
{
37+
"Name": "RuleCollection",
38+
"Type": "string"
39+
},
40+
{
41+
"Name": "RuleCollectionGroup",
42+
"Type": "string"
43+
},
44+
{
45+
"Name": "SourceIp",
46+
"Type": "string"
47+
},
48+
{
49+
"Name": "SourcePort",
50+
"Type": "int"
51+
},
52+
{
53+
"Name": "SourceSystem",
54+
"Type": "string"
55+
},
56+
{
57+
"Name": "_SubscriptionId",
58+
"Type": "string"
59+
},
60+
{
61+
"Name": "TenantId",
62+
"Type": "string"
63+
},
64+
{
65+
"Name": "TimeGenerated",
66+
"Type": "datetime"
67+
},
68+
{
69+
"Name": "TranslatedIp",
70+
"Type": "string"
71+
},
72+
{
73+
"Name": "TranslatedPort",
74+
"Type": "int"
75+
},
76+
{
77+
"Name": "Type",
78+
"Type": "string"
79+
},
80+
{
81+
"Name": "_TimeReceived",
82+
"Type": "datetime"
83+
},
84+
{
85+
"Name": "_ItemId",
86+
"Type": "string"
87+
}
88+
]
89+
}

‎.script/tests/KqlvalidationsTests/CustomTables/AZFWNetworkRule.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,14 @@
6868
{
6969
"Name": "Type",
7070
"Type": "string"
71+
},
72+
{
73+
"Name": "_TimeReceived",
74+
"Type": "datetime"
75+
},
76+
{
77+
"Name": "_ItemId",
78+
"Type": "string"
7179
}
7280
]
7381
}

‎.script/tests/KqlvalidationsTests/CustomTables/AZFWThreatIntel.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,14 @@
6868
{
6969
"Name": "Type",
7070
"Type": "string"
71+
},
72+
{
73+
"Name": "_TimeReceived",
74+
"Type": "datetime"
75+
},
76+
{
77+
"Name": "_ItemId",
78+
"Type": "string"
7179
}
7280
]
7381
}

‎.script/tests/asimParsersTest/ExclusionListForASimTests.csv‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@ _ASim_NetworkSession_NTANetAnalytics
33
_Im_NetworkSession_NTANetAnalytics
44
_Im_NetworkSession_AzureFirewall
55
_ASim_NetworkSession_AzureFirewall
6+
_Im_WebSession_AzureFirewall
7+
_ASim_WebSession_AzureFirewall
8+
_Im_Dns_AzureFirewall
9+
_ASim_Dns_AzureFirewall
610
_Im_Authentication_Sshd
711
_ASim_Authentication_M365Defender
812
_Im_Authentication_M365Defender

‎.script/tests/asimParsersTest/ingestASimSampleData.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -317,7 +317,7 @@ def convert_data_type(schema_result, data_result):
317317
SAMPLE_DATA_PATH = 'Sample%20Data/ASIM/'
318318
dcr_directory=[]
319319

320-
lia_supported_builtin_table = ['ADAssessmentRecommendation','ADSecurityAssessmentRecommendation','Anomalies','ASimAuditEventLogs','ASimAuthenticationEventLogs','ASimDhcpEventLogs','ASimDnsActivityLogs','ASimDnsAuditLogs','ASimFileEventLogs','ASimNetworkSessionLogs','ASimProcessEventLogs','ASimRegistryEventLogs','ASimUserManagementActivityLogs','ASimWebSessionLogs','AWSCloudTrail','AWSCloudWatch','AWSGuardDuty','AWSVPCFlow','AzureAssessmentRecommendation','CommonSecurityLog','DeviceTvmSecureConfigurationAssessmentKB','DeviceTvmSoftwareVulnerabilitiesKB','ExchangeAssessmentRecommendation','ExchangeOnlineAssessmentRecommendation','GCPAuditLogs','GoogleCloudSCC','SCCMAssessmentRecommendation','SCOMAssessmentRecommendation','SecurityEvent','SfBAssessmentRecommendation','SharePointOnlineAssessmentRecommendation','SQLAssessmentRecommendation','StorageInsightsAccountPropertiesDaily','StorageInsightsDailyMetrics','StorageInsightsHourlyMetrics','StorageInsightsMonthlyMetrics','StorageInsightsWeeklyMetrics','Syslog','UCClient','UCClientReadinessStatus','UCClientUpdateStatus','UCDeviceAlert','UCDOAggregatedStatus','UCServiceUpdateStatus','UCUpdateAlert','WindowsEvent','WindowsServerAssessmentRecommendation','NTANetAnalytics']
320+
lia_supported_builtin_table = ['ADAssessmentRecommendation','ADSecurityAssessmentRecommendation','Anomalies','ASimAuditEventLogs','ASimAuthenticationEventLogs','ASimDhcpEventLogs','ASimDnsActivityLogs','ASimDnsAuditLogs','ASimFileEventLogs','ASimNetworkSessionLogs','ASimProcessEventLogs','ASimRegistryEventLogs','ASimUserManagementActivityLogs','ASimWebSessionLogs','AWSCloudTrail','AWSCloudWatch','AWSGuardDuty','AWSVPCFlow','AzureAssessmentRecommendation','CommonSecurityLog','DeviceTvmSecureConfigurationAssessmentKB','DeviceTvmSoftwareVulnerabilitiesKB','ExchangeAssessmentRecommendation','ExchangeOnlineAssessmentRecommendation','GCPAuditLogs','GoogleCloudSCC','SCCMAssessmentRecommendation','SCOMAssessmentRecommendation','SecurityEvent','SfBAssessmentRecommendation','SharePointOnlineAssessmentRecommendation','SQLAssessmentRecommendation','StorageInsightsAccountPropertiesDaily','StorageInsightsDailyMetrics','StorageInsightsHourlyMetrics','StorageInsightsMonthlyMetrics','StorageInsightsWeeklyMetrics','Syslog','UCClient','UCClientReadinessStatus','UCClientUpdateStatus','UCDeviceAlert','UCDOAggregatedStatus','UCServiceUpdateStatus','UCUpdateAlert','WindowsEvent','WindowsServerAssessmentRecommendation','NTANetAnalytics', 'AZFWNetworkRule', 'AZFWNatRule', 'AZFWApplicationRule', 'AZFWDnsQuery', 'AZFWIdspSignature', 'AZFWThreatIntel']
321321
reserved_columns = ["_ResourceId", "id", "_SubscriptionId", "TenantId", "Type", "UniqueId", "Title","_ItemId","verbose_b","verbose","MG","_ResourceId_s"]
322322

323323
SentinelRepoUrl = "https://github.com/Azure/Azure-Sentinel"

0 commit comments

Comments
 (0)