Skip to content

Commit

Permalink
Merge pull request #11189 from riskive/zerofox/change_alert_connector…
Browse files Browse the repository at this point in the history 
…_param

[ZeroFox] Change query param in Alerts codeless connector
  • Loading branch information
@v-prasadboke
v-prasadboke committed Sep 27, 2024
2 parents b274cec + b4e94f1 commit 2551576
Show file tree
Hide file tree
Showing 5 changed files with 38 additions and 28 deletions.
7 changes: 5 additions & 2 deletions Solutions/ZeroFox/Data Connectors/Alerts/alerts_connector.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -104,10 +104,13 @@
"apiEndpoint": "https://api.zerofox.com/1.0/alerts/",
"httpMethod": "Get",
"queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
"startTimeAttributeName": "min_timestamp",
"endTimeAttributeName": "max_timestamp",
"startTimeAttributeName": "last_modified_min_date",
"endTimeAttributeName": "last_modified_max_date",
"queryParameters": {
"sort_direction": "asc"
},
"headers": {
"zf-source": "Microsoft-Sentinel"
}
},
"response": {
Expand Down
2 changes: 1 addition & 1 deletion Solutions/ZeroFox/Data/Solution_ZeroFox.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"Analytic Rules/ZF_Alerts_MediumSeverityRule.yaml"
],
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\ZeroFox",
"Version": "3.0.1",
"Version": "3.2.0",
"Metadata": "SolutionMetadata.json",
"TemplateSpec": true,
"Is1Pconnector": false
Expand Down
Binary file added Solutions/ZeroFox/Package/3.2.0.zip
View file
Binary file not shown.
46 changes: 26 additions & 20 deletions Solutions/ZeroFox/Package/mainTemplate.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@
"email": "[email protected]",
"_email": "[variables('email')]",
"_solutionName": "ZeroFox",
"_solutionVersion": "3.0.0",
"_solutionVersion": "3.2.0",
"solutionId": "zerofoxinc1695922129370.zerofox-sentinel-connector",
"_solutionId": "[variables('solutionId')]",
"uiConfigId1": "ZeroFoxCTIDataConnector",
Expand Down Expand Up @@ -94,7 +94,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
"description": "ZeroFox data connector with template version 3.0.0",
"description": "ZeroFox data connector with template version 3.2.0",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('dataConnectorVersion1')]",
Expand Down Expand Up @@ -811,7 +811,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
"description": "ZeroFox data connector with template version 3.0.0",
"description": "ZeroFox data connector with template version 3.2.0",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('dataConnectorVersion2')]",
Expand Down Expand Up @@ -914,10 +914,13 @@
"apiEndpoint": "https://api.zerofox.com/1.0/alerts/",
"httpMethod": "Get",
"queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
"startTimeAttributeName": "min_timestamp",
"endTimeAttributeName": "max_timestamp",
"startTimeAttributeName": "last_modified_min_date",
"endTimeAttributeName": "last_modified_max_date",
"queryParameters": {
"sort_direction": "asc"
},
"headers": {
"zf-source": "Microsoft-Sentinel"
}
},
"response": {
Expand Down Expand Up @@ -1101,10 +1104,13 @@
"apiEndpoint": "https://api.zerofox.com/1.0/alerts/",
"httpMethod": "Get",
"queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
"startTimeAttributeName": "min_timestamp",
"endTimeAttributeName": "max_timestamp",
"startTimeAttributeName": "last_modified_min_date",
"endTimeAttributeName": "last_modified_max_date",
"queryParameters": {
"sort_direction": "asc"
},
"headers": {
"zf-source": "Microsoft-Sentinel"
}
},
"response": {
Expand All @@ -1130,7 +1136,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
"description": "ZF_Alerts_HighSeverityRule_AnalyticalRules Analytics Rule with template version 3.0.0",
"description": "ZF_Alerts_HighSeverityRule_AnalyticalRules Analytics Rule with template version 3.2.0",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]",
Expand Down Expand Up @@ -1178,8 +1184,8 @@
"entityType": "Account",
"fieldMappings": [
{
"columnName": "entity_name_s",
"identifier": "FullName"
"identifier": "FullName",
"columnName": "entity_name_s"
}
]
}
Expand Down Expand Up @@ -1240,7 +1246,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
"description": "ZF_Alerts_InformationalSeverityRule_AnalyticalRules Analytics Rule with template version 3.0.0",
"description": "ZF_Alerts_InformationalSeverityRule_AnalyticalRules Analytics Rule with template version 3.2.0",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]",
Expand Down Expand Up @@ -1288,8 +1294,8 @@
"entityType": "Account",
"fieldMappings": [
{
"columnName": "entity_name_s",
"identifier": "FullName"
"identifier": "FullName",
"columnName": "entity_name_s"
}
]
}
Expand Down Expand Up @@ -1350,7 +1356,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
"description": "ZF_Alerts_LowSeverityRule_AnalyticalRules Analytics Rule with template version 3.0.0",
"description": "ZF_Alerts_LowSeverityRule_AnalyticalRules Analytics Rule with template version 3.2.0",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]",
Expand Down Expand Up @@ -1398,8 +1404,8 @@
"entityType": "Account",
"fieldMappings": [
{
"columnName": "entity_name_s",
"identifier": "FullName"
"identifier": "FullName",
"columnName": "entity_name_s"
}
]
}
Expand Down Expand Up @@ -1460,7 +1466,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
"description": "ZF_Alerts_MediumSeverityRule_AnalyticalRules Analytics Rule with template version 3.0.0",
"description": "ZF_Alerts_MediumSeverityRule_AnalyticalRules Analytics Rule with template version 3.2.0",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]",
Expand Down Expand Up @@ -1508,8 +1514,8 @@
"entityType": "Account",
"fieldMappings": [
{
"columnName": "entity_name_s",
"identifier": "FullName"
"identifier": "FullName",
"columnName": "entity_name_s"
}
]
}
Expand Down Expand Up @@ -1566,7 +1572,7 @@
"apiVersion": "2023-04-01-preview",
"location": "[parameters('workspace-location')]",
"properties": {
"version": "3.0.0",
"version": "3.2.0",
"kind": "Solution",
"contentSchemaVersion": "3.0.0",
"displayName": "ZeroFox",
Expand Down
11 changes: 6 additions & 5 deletions Solutions/ZeroFox/ReleaseNotes.md
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
|---------------|----------------------------------|---------------------------------------------------------------------------------------------------------------|
| 3.1.0 | 26-07-2024 | Updated ZeroFox connector to generate result batches and implemented async Sentinel connector logic |
| 3.0.1 | 30-04-2024 | Fixed Solution Metadata for deployment |
| 3.0.0 | 04-08-2023 | Added **Data Connectors** for ZeroFox's Alerts and CTI feeds |
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
|---------------|----------------------------------|-----------------------------------------------------------------------------------------------------|
| 3.2.0 | 26-09-2024 | Changed query parameter in alerts connector for fetching updates |
| 3.1.0 | 26-07-2024 | Updated ZeroFox connector to generate result batches and implemented async Sentinel connector logic |
| 3.0.1 | 30-04-2024 | Fixed Solution Metadata for deployment |
| 3.0.0 | 04-08-2023 | Added **Data Connectors** for ZeroFox's Alerts and CTI feeds |

0 comments on commit 2551576

Please sign in to comment.