Skip to content

Commit

Permalink
change query param for alerts connector to fetch modified alerts inst…
Browse files Browse the repository at this point in the history 
…ead of created alerts
  • Loading branch information
@DNRRomero
DNRRomero committed Sep 26, 2024
1 parent 21ed3ea commit b4e94f1
Show file tree
Hide file tree
Showing 5 changed files with 38 additions and 28 deletions.
7 changes: 5 additions & 2 deletions Solutions/ZeroFox/Data Connectors/Alerts/alerts_connector.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -104,10 +104,13 @@
"apiEndpoint": "https://api.zerofox.com/1.0/alerts/",
"httpMethod": "Get",
"queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
"startTimeAttributeName": "min_timestamp",
"endTimeAttributeName": "max_timestamp",
"startTimeAttributeName": "last_modified_min_date",
"endTimeAttributeName": "last_modified_max_date",
"queryParameters": {
"sort_direction": "asc"
},
"headers": {
"zf-source": "Microsoft-Sentinel"
}
},
"response": {
Expand Down
2 changes: 1 addition & 1 deletion Solutions/ZeroFox/Data/Solution_ZeroFox.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"Analytic Rules/ZF_Alerts_MediumSeverityRule.yaml"
],
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\ZeroFox",
"Version": "3.0.1",
"Version": "3.2.0",
"Metadata": "SolutionMetadata.json",
"TemplateSpec": true,
"Is1Pconnector": false
Expand Down
Binary file added Solutions/ZeroFox/Package/3.2.0.zip
View file
Binary file not shown.
46 changes: 26 additions & 20 deletions Solutions/ZeroFox/Package/mainTemplate.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@
"email": "[email protected]",
"_email": "[variables('email')]",
"_solutionName": "ZeroFox",
"_solutionVersion": "3.0.0",
"_solutionVersion": "3.2.0",
"solutionId": "zerofoxinc1695922129370.zerofox-sentinel-connector",
"_solutionId": "[variables('solutionId')]",
"uiConfigId1": "ZeroFoxCTIDataConnector",
Expand Down Expand Up @@ -94,7 +94,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
"description": "ZeroFox data connector with template version 3.0.0",
"description": "ZeroFox data connector with template version 3.2.0",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('dataConnectorVersion1')]",
Expand Down Expand Up @@ -811,7 +811,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
"description": "ZeroFox data connector with template version 3.0.0",
"description": "ZeroFox data connector with template version 3.2.0",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('dataConnectorVersion2')]",
Expand Down Expand Up @@ -914,10 +914,13 @@
"apiEndpoint": "https://api.zerofox.com/1.0/alerts/",
"httpMethod": "Get",
"queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
"startTimeAttributeName": "min_timestamp",
"endTimeAttributeName": "max_timestamp",
"startTimeAttributeName": "last_modified_min_date",
"endTimeAttributeName": "last_modified_max_date",
"queryParameters": {
"sort_direction": "asc"
},
"headers": {
"zf-source": "Microsoft-Sentinel"
}
},
"response": {
Expand Down Expand Up @@ -1101,10 +1104,13 @@
"apiEndpoint": "https://api.zerofox.com/1.0/alerts/",
"httpMethod": "Get",
"queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
"startTimeAttributeName": "min_timestamp",
"endTimeAttributeName": "max_timestamp",
"startTimeAttributeName": "last_modified_min_date",
"endTimeAttributeName": "last_modified_max_date",
"queryParameters": {
"sort_direction": "asc"
},
"headers": {
"zf-source": "Microsoft-Sentinel"
}
},
"response": {
Expand All @@ -1130,7 +1136,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
"description": "ZF_Alerts_HighSeverityRule_AnalyticalRules Analytics Rule with template version 3.0.0",
"description": "ZF_Alerts_HighSeverityRule_AnalyticalRules Analytics Rule with template version 3.2.0",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]",
Expand Down Expand Up @@ -1178,8 +1184,8 @@
"entityType": "Account",
"fieldMappings": [
{
"columnName": "entity_name_s",
"identifier": "FullName"
"identifier": "FullName",
"columnName": "entity_name_s"
}
]
}
Expand Down Expand Up @@ -1240,7 +1246,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
"description": "ZF_Alerts_InformationalSeverityRule_AnalyticalRules Analytics Rule with template version 3.0.0",
"description": "ZF_Alerts_InformationalSeverityRule_AnalyticalRules Analytics Rule with template version 3.2.0",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]",
Expand Down Expand Up @@ -1288,8 +1294,8 @@
"entityType": "Account",
"fieldMappings": [
{
"columnName": "entity_name_s",
"identifier": "FullName"
"identifier": "FullName",
"columnName": "entity_name_s"
}
]
}
Expand Down Expand Up @@ -1350,7 +1356,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
"description": "ZF_Alerts_LowSeverityRule_AnalyticalRules Analytics Rule with template version 3.0.0",
"description": "ZF_Alerts_LowSeverityRule_AnalyticalRules Analytics Rule with template version 3.2.0",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]",
Expand Down Expand Up @@ -1398,8 +1404,8 @@
"entityType": "Account",
"fieldMappings": [
{
"columnName": "entity_name_s",
"identifier": "FullName"
"identifier": "FullName",
"columnName": "entity_name_s"
}
]
}
Expand Down Expand Up @@ -1460,7 +1466,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
"description": "ZF_Alerts_MediumSeverityRule_AnalyticalRules Analytics Rule with template version 3.0.0",
"description": "ZF_Alerts_MediumSeverityRule_AnalyticalRules Analytics Rule with template version 3.2.0",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]",
Expand Down Expand Up @@ -1508,8 +1514,8 @@
"entityType": "Account",
"fieldMappings": [
{
"columnName": "entity_name_s",
"identifier": "FullName"
"identifier": "FullName",
"columnName": "entity_name_s"
}
]
}
Expand Down Expand Up @@ -1566,7 +1572,7 @@
"apiVersion": "2023-04-01-preview",
"location": "[parameters('workspace-location')]",
"properties": {
"version": "3.0.0",
"version": "3.2.0",
"kind": "Solution",
"contentSchemaVersion": "3.0.0",
"displayName": "ZeroFox",
Expand Down
11 changes: 6 additions & 5 deletions Solutions/ZeroFox/ReleaseNotes.md
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
|---------------|----------------------------------|---------------------------------------------------------------------------------------------------------------|
| 3.1.0 | 26-07-2024 | Updated ZeroFox connector to generate result batches and implemented async Sentinel connector logic |
| 3.0.1 | 30-04-2024 | Fixed Solution Metadata for deployment |
| 3.0.0 | 04-08-2023 | Added **Data Connectors** for ZeroFox's Alerts and CTI feeds |
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
|---------------|----------------------------------|-----------------------------------------------------------------------------------------------------|
| 3.2.0 | 26-09-2024 | Changed query parameter in alerts connector for fetching updates |
| 3.1.0 | 26-07-2024 | Updated ZeroFox connector to generate result batches and implemented async Sentinel connector logic |
| 3.0.1 | 30-04-2024 | Fixed Solution Metadata for deployment |
| 3.0.0 | 04-08-2023 | Added **Data Connectors** for ZeroFox's Alerts and CTI feeds |

0 comments on commit b4e94f1

Please sign in to comment.