Skip to content

Commit f2897f0

Browse files
v-dvedakv-dvedak
authored
Merge pull request Azure#12995 from mhebrard-bigid/bigid-ccf-updates
BigID CCF Connector UserToken based auth
2 parents 164c98a + cc47156 commit f2897f0

File tree

5 files changed

+107
-56
lines changed

5 files changed

+107
-56
lines changed

‎Solutions/BigID/Data Connectors/BigIDDSPMLogs_ccp/BigIDDSPMLogs_PollerConfig.json‎

Lines changed: 32 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,13 @@
1414
},
1515
"dataType": "BigIDDSPMCatalog_CL",
1616
"auth": {
17-
"type": "APIKey",
18-
"ApiKey": "{{bigidToken}}",
19-
"ApiKeyName": "Authorization",
20-
"ApiKeyIdentifier": "",
21-
"isApiKeyInPostPayload": false
17+
"type": "JwtToken",
18+
"UserToken": "{{bigidToken}}",
19+
"UserTokenPrepend": "",
20+
"TokenEndpoint": "https://{{bigidFqdn}}/api/v1/refresh-access-token",
21+
"TokenEndpointHttpMethod": "GET",
22+
"NoAccessTokenPrepend": true,
23+
"JwtTokenJsonPath": "$.systemToken"
2224
},
2325
"request": {
2426
"apiEndpoint": "https://{{bigidFqdn}}/api/v1/actionable-insights/all-cases",
@@ -29,7 +31,7 @@
2931
"timeoutInSeconds": 10,
3032
"headers": {
3133
"Accept": "application/json",
32-
"User-Agent": "BigID-MSFT-Sentinel-CCF-Connector"
34+
"User-Agent": "BigID-MSFT-Sentinel-CCF-Connector (all-cases)"
3335
}
3436
},
3537
"response": {
@@ -49,54 +51,59 @@
4951
"stepInfo": {
5052
"stepType": "Nested",
5153
"nextSteps": [
52-
{
53-
"stepId": "fetchObjectsDetails",
54-
"stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project dataSourceName = res.dataSourceName, policyName = res.policyName"
55-
},
5654
{
5755
"stepId": "fetchDataSourceDetails",
58-
"stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project dataSourceName = res.dataSourceName"
56+
"stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project dataSourceName = res.dataSourceName, policyName = res.policyName"
5957
}
6058
]
6159
},
6260
"stepCollectorConfigs": {
63-
"fetchObjectsDetails": {
61+
"fetchDataSourceDetails": {
6462
"shouldJoinNestedData": true,
65-
"joinedDataStepName": "affectedObjects",
63+
"joinedDataStepName": "datasource",
64+
"stepInfo": {
65+
"stepType": "Nested",
66+
"nextSteps": [
67+
{
68+
"stepId": "fetchObjectsDetails",
69+
"stepPlaceholdersParsingKql": "source"
70+
}
71+
]
72+
},
6673
"request": {
6774
"httpMethod": "GET",
68-
"apiEndpoint": "https://{{bigidFqdn}}/api/v1/data-catalog/",
75+
"apiEndpoint": "https://{{bigidFqdn}}/api/v1/ds_connections/$dataSourceName$",
6976
"queryParameters": {
70-
"limit": 32,
71-
"requireTotalCount": "true",
72-
"filter": "SYSTEM = \"$dataSourceName$\" AND policy IN (\"$policyName$\")"
77+
"withoutCredentialValue": "true"
7378
},
7479
"headers": {
7580
"Accept": "application/json",
76-
"User-Agent": "BigID-MSFT-Sentinel-CCF-Connector"
81+
"User-Agent": "BigID-MSFT-Sentinel-CCF-Connector (datasources)"
7782
}
7883
},
7984
"response": {
80-
"eventsJsonPaths": ["$.results"],
85+
"eventsJsonPaths": ["$.ds_connection"],
8186
"format": "json"
8287
}
8388
},
84-
"fetchDataSourceDetails": {
89+
"fetchObjectsDetails": {
8590
"shouldJoinNestedData": true,
86-
"joinedDataStepName": "datasource",
91+
"joinedDataStepName": "affectedObjects",
8792
"request": {
8893
"httpMethod": "GET",
89-
"apiEndpoint": "https://{{bigidFqdn}}/api/v1/ds_connections/$dataSourceName$",
94+
"apiEndpoint": "https://{{bigidFqdn}}/api/v1/data-catalog/",
9095
"queryParameters": {
91-
"withoutCredentialValue": "true"
96+
"limit": 32,
97+
"requireTotalCount": "true",
98+
"filter": "SYSTEM = \"$dataSourceName$\" AND policy IN (\"$policyName$\")"
9299
},
93100
"headers": {
94101
"Accept": "application/json",
95-
"User-Agent": "BigID-MSFT-Sentinel-CCF-Connector"
102+
"User-Agent": "BigID-MSFT-Sentinel-CCF-Connector (data-catalog)"
96103
}
97104
},
98105
"response": {
99-
"eventsJsonPaths": ["$.ds_connection"],
106+
"eventsJsonPaths": ["$.results"],
100107
"format": "json"
101108
}
102109
}

‎Solutions/BigID/Package/3.0.0.zip‎

51 Bytes
Binary file not shown.

‎Solutions/BigID/Package/mainTemplate.json‎

Lines changed: 32 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -544,11 +544,13 @@
544544
},
545545
"dataType": "BigIDDSPMCatalog_CL",
546546
"auth": {
547-
"type": "APIKey",
548-
"ApiKey": "[[parameters('bigidToken')]",
549-
"ApiKeyName": "Authorization",
550-
"ApiKeyIdentifier": "",
551-
"isApiKeyInPostPayload": false
547+
"type": "JwtToken",
548+
"UserToken": "[[parameters('bigidToken')]",
549+
"UserTokenPrepend": "",
550+
"TokenEndpoint": "[[concat('https://',parameters('bigidFqdn'),'/api/v1/refresh-access-token')]",
551+
"TokenEndpointHttpMethod": "GET",
552+
"NoAccessTokenPrepend": true,
553+
"JwtTokenJsonPath": "$.systemToken"
552554
},
553555
"request": {
554556
"apiEndpoint": "[[concat('https://',parameters('bigidFqdn'),'/api/v1/actionable-insights/all-cases')]",
@@ -559,7 +561,7 @@
559561
"timeoutInSeconds": 10,
560562
"headers": {
561563
"Accept": "application/json",
562-
"User-Agent": "BigID-MSFT-Sentinel-CCF-Connector"
564+
"User-Agent": "BigID-MSFT-Sentinel-CCF-Connector (all-cases)"
563565
}
564566
},
565567
"response": {
@@ -579,57 +581,62 @@
579581
"stepInfo": {
580582
"stepType": "Nested",
581583
"nextSteps": [
582-
{
583-
"stepId": "fetchObjectsDetails",
584-
"stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project dataSourceName = res.dataSourceName, policyName = res.policyName"
585-
},
586584
{
587585
"stepId": "fetchDataSourceDetails",
588-
"stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project dataSourceName = res.dataSourceName"
586+
"stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project dataSourceName = res.dataSourceName, policyName = res.policyName"
589587
}
590588
]
591589
},
592590
"stepCollectorConfigs": {
593-
"fetchObjectsDetails": {
591+
"fetchDataSourceDetails": {
594592
"shouldJoinNestedData": true,
595-
"joinedDataStepName": "affectedObjects",
593+
"joinedDataStepName": "datasource",
594+
"stepInfo": {
595+
"stepType": "Nested",
596+
"nextSteps": [
597+
{
598+
"stepId": "fetchObjectsDetails",
599+
"stepPlaceholdersParsingKql": "source"
600+
}
601+
]
602+
},
596603
"request": {
597604
"httpMethod": "GET",
598-
"apiEndpoint": "[[concat('https://',parameters('bigidFqdn'),'/api/v1/data-catalog/')]",
605+
"apiEndpoint": "[[concat('https://',parameters('bigidFqdn'),'/api/v1/ds_connections/$dataSourceName$')]",
599606
"queryParameters": {
600-
"limit": 32,
601-
"requireTotalCount": "true",
602-
"filter": "SYSTEM = \"$dataSourceName$\" AND policy IN (\"$policyName$\")"
607+
"withoutCredentialValue": "true"
603608
},
604609
"headers": {
605610
"Accept": "application/json",
606-
"User-Agent": "BigID-MSFT-Sentinel-CCF-Connector"
611+
"User-Agent": "BigID-MSFT-Sentinel-CCF-Connector (datasources)"
607612
}
608613
},
609614
"response": {
610615
"eventsJsonPaths": [
611-
"$.results"
616+
"$.ds_connection"
612617
],
613618
"format": "json"
614619
}
615620
},
616-
"fetchDataSourceDetails": {
621+
"fetchObjectsDetails": {
617622
"shouldJoinNestedData": true,
618-
"joinedDataStepName": "datasource",
623+
"joinedDataStepName": "affectedObjects",
619624
"request": {
620625
"httpMethod": "GET",
621-
"apiEndpoint": "[[concat('https://',parameters('bigidFqdn'),'/api/v1/ds_connections/$dataSourceName$')]",
626+
"apiEndpoint": "[[concat('https://',parameters('bigidFqdn'),'/api/v1/data-catalog/')]",
622627
"queryParameters": {
623-
"withoutCredentialValue": "true"
628+
"limit": 32,
629+
"requireTotalCount": "true",
630+
"filter": "SYSTEM = \"$dataSourceName$\" AND policy IN (\"$policyName$\")"
624631
},
625632
"headers": {
626633
"Accept": "application/json",
627-
"User-Agent": "BigID-MSFT-Sentinel-CCF-Connector"
634+
"User-Agent": "BigID-MSFT-Sentinel-CCF-Connector (data-catalog)"
628635
}
629636
},
630637
"response": {
631638
"eventsJsonPaths": [
632-
"$.ds_connection"
639+
"$.results"
633640
],
634641
"format": "json"
635642
}

‎Solutions/BigID/ReleaseNotes.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
**Version** | **Date Modified (DD-MM-YYYY)**| **ChangeHistory** |
22
|------------|-------------------------------|-------------------------------------------------------------------------------------------|
3-
| 3.0.0 | 07-10-2025 | First version of a BigID DSPM CCF Connector |
3+
| 3.0.0 | 15-10-2025 | First version of a BigID DSPM CCF Connector. <br/> BigID DSPM CCF Connector now using JWT user token authentication |

‎Tools/Create-Azure-Sentinel-Solution/common/createCCPConnector.ps1‎

Lines changed: 42 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1134,10 +1134,29 @@ function CreateRestApiPollerResourceProperties($armResource, $templateContentCon
11341134
}
11351135
elseif ($armResource.properties.auth.type.ToLower() -eq 'jwttoken')
11361136
{
1137-
ProcessPropertyPlaceholders -armResource $armResource -templateContentConnections $templateContentConnections -isOnlyObjectCheck $false -propertyObject $armResource.properties.auth.userName -propertyName 'value' -isInnerObject $true -innerObjectName 'userName' -kindType $kindType -isSecret $false -isRequired $true -fileType $fileType -minLength 4 -isCreateArray $false
1137+
# Check for userName.value format OR UserToken format
1138+
$hasUserName = $armResource.properties.auth.userName -and $armResource.properties.auth.userName.value
1139+
$hasPassword = $armResource.properties.auth.password -and $armResource.properties.auth.password.value
1140+
$hasUserToken = $armResource.properties.auth.UserToken
11381141

1139-
ProcessPropertyPlaceholders -armResource $armResource -templateContentConnections $templateContentConnections -isOnlyObjectCheck $false -propertyObject $armResource.properties.auth.password -propertyName 'value' -isInnerObject $true -innerObjectName 'password' -kindType $kindType -isSecret $true -isRequired $true -fileType $fileType -minLength 4 -isCreateArray $false
1142+
if ($hasUserName -and $hasPassword) {
1143+
Write-Host "Processing userName+password format for JwtToken auth."
1144+
# Process userName.value format
1145+
ProcessPropertyPlaceholders -armResource $armResource -templateContentConnections $templateContentConnections -isOnlyObjectCheck $false -propertyObject $armResource.properties.auth.userName -propertyName 'value' -isInnerObject $true -innerObjectName 'userName' -kindType $kindType -isSecret $false -isRequired $true -fileType $fileType -minLength 4 -isCreateArray $false
1146+
ProcessPropertyPlaceholders -armResource $armResource -templateContentConnections $templateContentConnections -isOnlyObjectCheck $false -propertyObject $armResource.properties.auth.password -propertyName 'value' -isInnerObject $true -innerObjectName 'password' -kindType $kindType -isSecret $true -isRequired $true -fileType $fileType -minLength 4 -isCreateArray $false
11401147

1148+
}
1149+
elseif ($hasUserToken) {
1150+
Write-Host "Processing UserToken format for JwtToken auth."
1151+
# Process UserToken format
1152+
ProcessPropertyPlaceholders -armResource $armResource -templateContentConnections $templateContentConnections -isOnlyObjectCheck $false -propertyObject $armResource.properties.auth -propertyName 'UserToken' -isInnerObject $true -innerObjectName 'auth' -kindType $kindType -isSecret $true -isRequired $true -fileType $fileType -minLength 4 -isCreateArray $false
1153+
}
1154+
else {
1155+
Write-Host "Error: For kind $kindType with JwtToken auth, either 'userName.value' + 'password.value' or 'UserToken' is required." -BackgroundColor Red
1156+
exit 1;
1157+
}
1158+
1159+
# TokenEndpoint is required for both formats
11411160
ProcessPropertyPlaceholders -armResource $armResource -templateContentConnections $templateContentConnections -isOnlyObjectCheck $false -propertyObject $armResource.properties.auth -propertyName 'TokenEndpoint' -isInnerObject $true -innerObjectName 'auth' -kindType $kindType -isSecret $false -isRequired $true -fileType $fileType -minLength 4 -isCreateArray $false
11421161
}
11431162
else {
@@ -1177,13 +1196,31 @@ function CreateRestApiPollerResourceProperties($armResource, $templateContentCon
11771196
else {
11781197
Write-Host "Warning: 'stepInfo' object is missing 'nextSteps' array."
11791198
}
1199+
}
11801200

1181-
if ($stepIds.Count -gt 0) {
1182-
$stepIdsString = $stepIds -join ', '
1183-
Write-Host "List of identified 'stepId' in 'stepInfo' are: $stepIdsString"
1201+
# Also collect stepIds from nested stepCollectorConfigs
1202+
$hasStepCollectorConfigs = [bool]($armResource.properties.PSobject.Properties.name -match "stepCollectorConfigs")
1203+
if ($hasStepCollectorConfigs) {
1204+
foreach ($stepConfig in $armResource.properties.stepCollectorConfigs.PSObject.Properties) {
1205+
$stepConfigName = $stepConfig.Name
1206+
$stepConfigValue = $stepConfig.Value
1207+
1208+
# Check if this step has nested nextSteps
1209+
if ($stepConfigValue.stepInfo -and $stepConfigValue.stepInfo.nextSteps) {
1210+
foreach ($nestedStep in $stepConfigValue.stepInfo.nextSteps) {
1211+
if ($stepIds -notcontains $nestedStep.stepId) {
1212+
$stepIds += $nestedStep.stepId
1213+
}
1214+
}
1215+
}
11841216
}
11851217
}
11861218

1219+
if ($stepIds.Count -gt 0) {
1220+
$stepIdsString = $stepIds -join ', '
1221+
Write-Host "List of identified 'stepId' in 'stepInfo' are: $stepIdsString"
1222+
}
1223+
11871224
# stepCollectorConfigs placeholder
11881225
$hasStepCollectorConfigs = [bool]($armResource.properties.PSobject.Properties.name -match "stepCollectorConfigs")
11891226
if ($hasStepCollectorConfigs) {

0 commit comments

Comments
 (0)