Merge branch 'develop' into auto_update_187

Author: ljstella

contentctl.yml

@@ -161,9 +161,9 @@ apps:
 - uid: 3110
   title: Splunk Add-on for Microsoft Cloud Services
   appid: SPLUNK_TA_MICROSOFT_CLOUD_SERVICES
-  version: 5.4.2
+  version: 5.4.3
   description: description of app
-  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_542.tgz
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_543.tgz
 - uid: 4055
   title: Splunk Add-on for Microsoft Office 365
   appid: SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365

data_sources/azure_active_directory.yml

@@ -10,4 +10,4 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.2
+  version: 5.4.3

data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml

@@ -11,7 +11,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.2
+  version: 5.4.3
 fields:
 - _time
 - Level

data_sources/azure_active_directory_add_member_to_role.yml

@@ -1,68 +1,69 @@
 name: Azure Active Directory Add member to role
 id: 1660d196-127f-4678-81b2-472d51711b07
 version: 1
-date: '2024-07-18'
+date: "2024-07-18"
 author: Patrick Bareiss, Splunk
 description: Data source object for Azure Active Directory Add member to role
 source: Azure AD
 sourcetype: azure:monitor:aad
 separator: operationName
 supported_TA:
-- name: Splunk Add-on for Microsoft Cloud Services
-  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.2
+  - name: Splunk Add-on for Microsoft Cloud Services
+    url: https://splunkbase.splunk.com/app/3110
+    version: 5.4.3
 fields:
-- _time
-- Level
-- callerIpAddress
-- category
-- correlationId
-- date_hour
-- date_mday
-- date_minute
-- date_month
-- date_second
-- date_wday
-- date_year
-- date_zone
-- durationMs
-- host
-- index
-- linecount
-- operationName
-- operationVersion
-- properties.activityDateTime
-- properties.activityDisplayName
-- properties.category
-- properties.correlationId
-- properties.id
-- properties.initiatedBy.user.displayName
-- properties.initiatedBy.user.id
-- properties.initiatedBy.user.ipAddress
-- properties.initiatedBy.user.userPrincipalName
-- properties.loggedByService
-- properties.operationType
-- properties.result
-- properties.resultReason
-- properties.targetResources{}.displayName
-- properties.targetResources{}.id
-- properties.targetResources{}.modifiedProperties{}.displayName
-- properties.targetResources{}.modifiedProperties{}.newValue
-- properties.targetResources{}.modifiedProperties{}.oldValue
-- properties.targetResources{}.type
-- properties.targetResources{}.userPrincipalName
-- properties.userAgent
-- punct
-- resourceId
-- resultSignature
-- source
-- sourcetype
-- splunk_server
-- tenantId
-- time
-- timeendpos
-- timestartpos
-example_log: '{"time": "2023-04-28T16:39:51.9312625Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam",
+  - _time
+  - Level
+  - callerIpAddress
+  - category
+  - correlationId
+  - date_hour
+  - date_mday
+  - date_minute
+  - date_month
+  - date_second
+  - date_wday
+  - date_year
+  - date_zone
+  - durationMs
+  - host
+  - index
+  - linecount
+  - operationName
+  - operationVersion
+  - properties.activityDateTime
+  - properties.activityDisplayName
+  - properties.category
+  - properties.correlationId
+  - properties.id
+  - properties.initiatedBy.user.displayName
+  - properties.initiatedBy.user.id
+  - properties.initiatedBy.user.ipAddress
+  - properties.initiatedBy.user.userPrincipalName
+  - properties.loggedByService
+  - properties.operationType
+  - properties.result
+  - properties.resultReason
+  - properties.targetResources{}.displayName
+  - properties.targetResources{}.id
+  - properties.targetResources{}.modifiedProperties{}.displayName
+  - properties.targetResources{}.modifiedProperties{}.newValue
+  - properties.targetResources{}.modifiedProperties{}.oldValue
+  - properties.targetResources{}.type
+  - properties.targetResources{}.userPrincipalName
+  - properties.userAgent
+  - punct
+  - resourceId
+  - resultSignature
+  - source
+  - sourcetype
+  - splunk_server
+  - tenantId
+  - time
+  - timeendpos
+  - timestartpos
+example_log:
+  '{"time": "2023-04-28T16:39:51.9312625Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam",
   "operationName": "Add member to role", "operationVersion": "1.0", "category": "AuditLogs",
   "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs":
   0, "callerIpAddress": "52.177.250.168", "correlationId": "b425f2d7-2245-4952-b599-61dff8054f2b",

data_sources/azure_active_directory_add_owner_to_application.yml

@@ -1,73 +1,74 @@
 name: Azure Active Directory Add owner to application
 id: e895ed56-7be4-4b3a-b782-ecd0f594ec4c
 version: 1
-date: '2024-07-18'
+date: "2024-07-18"
 author: Patrick Bareiss, Splunk
 description: Data source object for Azure Active Directory Add owner to application
 source: Azure AD
 sourcetype: azure:monitor:aad
 separator: operationName
 supported_TA:
-- name: Splunk Add-on for Microsoft Cloud Services
-  url: https://splunkbase.splunk.com/app/3110
-  version: 5.4.2
+  - name: Splunk Add-on for Microsoft Cloud Services
+    url: https://splunkbase.splunk.com/app/3110
+    version: 5.4.3
 fields:
-- _time
-- Level
-- callerIpAddress
-- category
-- correlationId
-- date_hour
-- date_mday
-- date_minute
-- date_month
-- date_second
-- date_wday
-- date_year
-- date_zone
-- durationMs
-- eventtype
-- host
-- index
-- linecount
-- operationName
-- operationVersion
-- properties.activityDateTime
-- properties.activityDisplayName
-- properties.additionalDetails{}.key
-- properties.additionalDetails{}.value
-- properties.category
-- properties.correlationId
-- properties.id
-- properties.initiatedBy.user.displayName
-- properties.initiatedBy.user.id
-- properties.initiatedBy.user.ipAddress
-- properties.initiatedBy.user.userPrincipalName
-- properties.loggedByService
-- properties.operationType
-- properties.result
-- properties.resultReason
-- properties.targetResources{}.displayName
-- properties.targetResources{}.id
-- properties.targetResources{}.modifiedProperties{}.displayName
-- properties.targetResources{}.modifiedProperties{}.newValue
-- properties.targetResources{}.modifiedProperties{}.oldValue
-- properties.targetResources{}.type
-- properties.targetResources{}.userPrincipalName
-- properties.userAgent
-- punct
-- resourceId
-- resultSignature
-- source
-- sourcetype
-- splunk_server
-- tag
-- tag::eventtype
-- tenantId
-- time
-- timeendpos
-- timestartpos
-example_log: '{"time": "2023-06-20T15:54:13.2420879Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam",
+  - _time
+  - Level
+  - callerIpAddress
+  - category
+  - correlationId
+  - date_hour
+  - date_mday
+  - date_minute
+  - date_month
+  - date_second
+  - date_wday
+  - date_year
+  - date_zone
+  - durationMs
+  - eventtype
+  - host
+  - index
+  - linecount
+  - operationName
+  - operationVersion
+  - properties.activityDateTime
+  - properties.activityDisplayName
+  - properties.additionalDetails{}.key
+  - properties.additionalDetails{}.value
+  - properties.category
+  - properties.correlationId
+  - properties.id
+  - properties.initiatedBy.user.displayName
+  - properties.initiatedBy.user.id
+  - properties.initiatedBy.user.ipAddress
+  - properties.initiatedBy.user.userPrincipalName
+  - properties.loggedByService
+  - properties.operationType
+  - properties.result
+  - properties.resultReason
+  - properties.targetResources{}.displayName
+  - properties.targetResources{}.id
+  - properties.targetResources{}.modifiedProperties{}.displayName
+  - properties.targetResources{}.modifiedProperties{}.newValue
+  - properties.targetResources{}.modifiedProperties{}.oldValue
+  - properties.targetResources{}.type
+  - properties.targetResources{}.userPrincipalName
+  - properties.userAgent
+  - punct
+  - resourceId
+  - resultSignature
+  - source
+  - sourcetype
+  - splunk_server
+  - tag
+  - tag::eventtype
+  - tenantId
+  - time
+  - timeendpos
+  - timestartpos
+example_log:
+  '{"time": "2023-06-20T15:54:13.2420879Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam",
   "operationName": "Add owner to application", "operationVersion": "1.0", "category":
   "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature":
   "None", "durationMs": 0, "callerIpAddress": "20.190.135.43", "correlationId": "231de5d4-2156-433a-8163-48956bdaa040",