Skip to content

Commit decdefb

Browse files
Powlinettmariotjabesq
authored
[microsoft-sentinel-intel] Update connector to be "manager_supported" (#4711)
Co-authored-by: Mariot Tsitoara <[email protected]> Co-authored-by: Hugo DUPRAS <[email protected]>
1 parent bcaa00f commit decdefb

File tree

24 files changed

+564
-528
lines changed

24 files changed

+564
-528
lines changed

‎stream/microsoft-sentinel-intel/__metadata__/CONNECTOR_CONFIG_DOC.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Connector Configurations
2+
3+
Below is an exhaustive enumeration of all configurable parameters available, each accompanied by detailed explanations of their purposes, default behaviors, and usage guidelines to help you understand and utilize them effectively.
4+
5+
### Type: `object`
6+
7+
| Property | Type | Required | Possible values | Deprecated | Default | Description |
8+
| -------- | ---- | -------- | --------------- | ---------- | ------- | ----------- |
9+
| OPENCTI_URL | `string` | ✅ | Format: [`uri`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) | | | The base URL of the OpenCTI instance. |
10+
| OPENCTI_TOKEN | `string` | ✅ | string | | | The API token to connect to OpenCTI. |
11+
| CONNECTOR_LIVE_STREAM_ID | `string` | ✅ | string | | | The ID of the live stream to connect to. |
12+
| MICROSOFT_SENTINEL_INTEL_TENANT_ID | `string` | ✅ | string | | | Your Azure App Tenant ID, see the screenshot to help you find this information. |
13+
| MICROSOFT_SENTINEL_INTEL_CLIENT_ID | `string` | ✅ | string | | | Your Azure App Client ID, see the screenshot to help you find this information. |
14+
| MICROSOFT_SENTINEL_INTEL_CLIENT_SECRET | `string` | ✅ | Format: [`password`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) | | | Your Azure App Client secret, See the screenshot to help you find this information. |
15+
| MICROSOFT_SENTINEL_INTEL_WORKSPACE_ID | `string` | ✅ | string | | | Your Azure Workspace ID |
16+
| MICROSOFT_SENTINEL_INTEL_WORKSPACE_NAME | `string` | ✅ | string | | | The name of the log analytics workspace |
17+
| MICROSOFT_SENTINEL_INTEL_SUBSCRIPTION_ID | `string` | ✅ | string | | | The subscription id where the Log Analytics is |
18+
| CONNECTOR_NAME | `string` | | string | | `"MicrosoftSentinelIntel"` | The name of the connector. |
19+
| CONNECTOR_SCOPE | `array` | | string | | `["sentinel"]` | The scope of the stream connector. |
20+
| CONNECTOR_LOG_LEVEL | `string` | | `debug` `info` `warn` `warning` `error` | | `"error"` | The minimum level of logs to display. |
21+
| CONNECTOR_TYPE | `const` | | `STREAM` | | `"STREAM"` | |
22+
| CONNECTOR_LIVE_STREAM_LISTEN_DELETE | `boolean` | | boolean | | `true` | Whether to listen for delete events on the live stream. |
23+
| CONNECTOR_LIVE_STREAM_NO_DEPENDENCIES | `boolean` | | boolean | | `true` | Whether to ignore dependencies when processing events from the live stream. |
24+
| MICROSOFT_SENTINEL_INTEL_SOURCE_SYSTEM | `string` | | string | | `"Opencti Stream Connector"` | The name of the source system displayed in Microsoft Sentinel |
25+
| MICROSOFT_SENTINEL_INTEL_DELETE_EXTENSIONS | `boolean` | | boolean | | `true` | Delete the extensions in the stix bundle sent to the SIEM |
26+
| MICROSOFT_SENTINEL_INTEL_EXTRA_LABELS | `array` | | string | | `[]` | Extra labels added to the bundle sent. String separated by comma |
27+
| MICROSOFT_SENTINEL_INTEL_WORKSPACE_API_VERSION | `string` | | string | | `"2024-02-01-preview"` | API version of the Microsoft log analytics workspace interface |
28+
| MICROSOFT_SENTINEL_INTEL_MANAGEMENT_API_VERSION | `string` | | string | | `"2025-03-01"` | API version of the Microsoft management interface |
29+
| MICROSOFT_SENTINEL_INTEL_RESOURCE_GROUP | `string` | | string | ⛔️ | `"default"` | The name of the resource group where the log analytics is |

‎stream/microsoft-sentinel-intel/__metadata__/connector_config_schema.json‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://www.filigran.io/connectors/microsoft-sentinel-intel_config.schema.json",
4+
"type": "object",
5+
"properties": {
6+
"OPENCTI_URL": {
7+
"description": "The base URL of the OpenCTI instance.",
8+
"format": "uri",
9+
"maxLength": 2083,
10+
"minLength": 1,
11+
"type": "string"
12+
},
13+
"OPENCTI_TOKEN": {
14+
"description": "The API token to connect to OpenCTI.",
15+
"type": "string"
16+
},
17+
"CONNECTOR_NAME": {
18+
"default": "MicrosoftSentinelIntel",
19+
"description": "The name of the connector.",
20+
"type": "string"
21+
},
22+
"CONNECTOR_SCOPE": {
23+
"default": [
24+
"sentinel"
25+
],
26+
"description": "The scope of the stream connector.",
27+
"items": {
28+
"type": "string"
29+
},
30+
"type": "array"
31+
},
32+
"CONNECTOR_LOG_LEVEL": {
33+
"default": "error",
34+
"description": "The minimum level of logs to display.",
35+
"enum": [
36+
"debug",
37+
"info",
38+
"warn",
39+
"warning",
40+
"error"
41+
],
42+
"type": "string"
43+
},
44+
"CONNECTOR_TYPE": {
45+
"const": "STREAM",
46+
"default": "STREAM",
47+
"type": "string"
48+
},
49+
"CONNECTOR_LIVE_STREAM_ID": {
50+
"description": "The ID of the live stream to connect to.",
51+
"type": "string"
52+
},
53+
"CONNECTOR_LIVE_STREAM_LISTEN_DELETE": {
54+
"default": true,
55+
"description": "Whether to listen for delete events on the live stream.",
56+
"type": "boolean"
57+
},
58+
"CONNECTOR_LIVE_STREAM_NO_DEPENDENCIES": {
59+
"default": true,
60+
"description": "Whether to ignore dependencies when processing events from the live stream.",
61+
"type": "boolean"
62+
},
63+
"MICROSOFT_SENTINEL_INTEL_TENANT_ID": {
64+
"description": "Your Azure App Tenant ID, see the screenshot to help you find this information.",
65+
"type": "string"
66+
},
67+
"MICROSOFT_SENTINEL_INTEL_CLIENT_ID": {
68+
"description": "Your Azure App Client ID, see the screenshot to help you find this information.",
69+
"type": "string"
70+
},
71+
"MICROSOFT_SENTINEL_INTEL_CLIENT_SECRET": {
72+
"description": "Your Azure App Client secret, See the screenshot to help you find this information.",
73+
"format": "password",
74+
"type": "string",
75+
"writeOnly": true
76+
},
77+
"MICROSOFT_SENTINEL_INTEL_WORKSPACE_ID": {
78+
"description": "Your Azure Workspace ID",
79+
"type": "string"
80+
},
81+
"MICROSOFT_SENTINEL_INTEL_WORKSPACE_NAME": {
82+
"description": "The name of the log analytics workspace",
83+
"type": "string"
84+
},
85+
"MICROSOFT_SENTINEL_INTEL_SUBSCRIPTION_ID": {
86+
"description": "The subscription id where the Log Analytics is",
87+
"type": "string"
88+
},
89+
"MICROSOFT_SENTINEL_INTEL_RESOURCE_GROUP": {
90+
"default": "default",
91+
"deprecated": true,
92+
"description": "The name of the resource group where the log analytics is",
93+
"type": "string"
94+
},
95+
"MICROSOFT_SENTINEL_INTEL_SOURCE_SYSTEM": {
96+
"default": "Opencti Stream Connector",
97+
"description": "The name of the source system displayed in Microsoft Sentinel",
98+
"type": "string"
99+
},
100+
"MICROSOFT_SENTINEL_INTEL_DELETE_EXTENSIONS": {
101+
"default": true,
102+
"description": "Delete the extensions in the stix bundle sent to the SIEM",
103+
"type": "boolean"
104+
},
105+
"MICROSOFT_SENTINEL_INTEL_EXTRA_LABELS": {
106+
"default": [],
107+
"description": "Extra labels added to the bundle sent. String separated by comma",
108+
"items": {
109+
"type": "string"
110+
},
111+
"type": "array"
112+
},
113+
"MICROSOFT_SENTINEL_INTEL_WORKSPACE_API_VERSION": {
114+
"default": "2024-02-01-preview",
115+
"description": "API version of the Microsoft log analytics workspace interface",
116+
"type": "string"
117+
},
118+
"MICROSOFT_SENTINEL_INTEL_MANAGEMENT_API_VERSION": {
119+
"default": "2025-03-01",
120+
"description": "API version of the Microsoft management interface",
121+
"type": "string"
122+
}
123+
},
124+
"required": [
125+
"OPENCTI_URL",
126+
"OPENCTI_TOKEN",
127+
"CONNECTOR_LIVE_STREAM_ID",
128+
"MICROSOFT_SENTINEL_INTEL_TENANT_ID",
129+
"MICROSOFT_SENTINEL_INTEL_CLIENT_ID",
130+
"MICROSOFT_SENTINEL_INTEL_CLIENT_SECRET",
131+
"MICROSOFT_SENTINEL_INTEL_WORKSPACE_ID",
132+
"MICROSOFT_SENTINEL_INTEL_WORKSPACE_NAME",
133+
"MICROSOFT_SENTINEL_INTEL_SUBSCRIPTION_ID"
134+
],
135+
"additionalProperties": true
136+
}

‎stream/microsoft-sentinel-intel/src/base_connector/__init__.py‎

Lines changed: 0 additions & 9 deletions
This file was deleted.

‎stream/microsoft-sentinel-intel/src/base_connector/config.py‎

Lines changed: 0 additions & 170 deletions
This file was deleted.

‎stream/microsoft-sentinel-intel/src/base_connector/enums.py‎

Lines changed: 0 additions & 9 deletions
This file was deleted.

‎stream/microsoft-sentinel-intel/src/base_connector/errors.py‎

Lines changed: 0 additions & 14 deletions
This file was deleted.

‎stream/microsoft-sentinel-intel/src/config.yml.sample‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,12 @@ opencti:
55
connector:
66
type: 'STREAM'
77
id: 'ChangeMe'
8-
name: 'Microsoft Sentinel Intel'
9-
scope: 'sentinel' # MIME type or SCO
10-
log_level: 'info'
118
live_stream_id: 'ChangeMe'
12-
live_stream_listen_delete: true
13-
live_stream_no_dependencies: true
9+
#name: 'Microsoft Sentinel Intel'
10+
#scope: 'sentinel' # MIME type or SCO
11+
#log_level: 'info'
12+
#live_stream_listen_delete: true
13+
#live_stream_no_dependencies: true
1414

1515
microsoft_sentinel_intel:
1616
tenant_id: 'ChangeMe'

0 commit comments

Comments
 (0)