add new ReversingLabs solution v1.0.0
This commit is contained in:
Aaron Hoffman
Родитель
ccd79bd86b
Коммит
2a963db141
|
|
@ -1,12 +1,23 @@
|
|||
{
|
||||
"Name": "ReversingLabs",
|
||||
"Author": "Nikhil Tripathi - v-ntripathi@microsoft.com",
|
||||
"Description": "[ReversingLabs](https://www.reversinglabs.com/) provides explainable threat intelligence into malware infected files and objects, for any file, any location, and any threat.",
|
||||
"Playbooks": [
|
||||
"Playbooks/Enrich-SentinelIncident-ReversingLabs-File-Information/azuredeploy.json"
|
||||
],
|
||||
"Metadata": "SolutionMetadata.json",
|
||||
"BasePath": "C:\\GitHub\\azure\\Solutions\\ReversingLabs",
|
||||
"Version": "1.1.0"
|
||||
}
|
||||
|
||||
"Name": "ReversingLabs",
|
||||
"Author": "ReversingLabs - support@reversinglabs.com",
|
||||
"Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/reversinglabs.svg\" width=\"75px\" height=\"75px\">",
|
||||
"Description": "The ReversingLabs solution for Microsoft Sentinel includes a number of Sentinel resources designed to automate your security operations using the power of TitaniumCloud APIs and visualize your threat intelligence capabilities using included workbooks.",
|
||||
"Workbooks": [
|
||||
"Workbooks\\ReversingLabs-CapabilitiesOverview\\ReversingLabs-CapabilitiesOverview.json"
|
||||
],
|
||||
"Analytic Rules": [],
|
||||
"Playbooks": [
|
||||
"Playbooks\\ReversingLabs-EnrichFilehash\\azuredeploy.json"
|
||||
],
|
||||
"Parsers": [],
|
||||
"SavedSearches": [],
|
||||
"Hunting Queries": [],
|
||||
"Data Connectors": [],
|
||||
"Watchlists": [],
|
||||
"WatchlistDescription": [],
|
||||
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\ReversingLabs",
|
||||
"Version": "1.0.0",
|
||||
"Metadata": "SolutionMetadata.json",
|
||||
"TemplateSpec": false
|
||||
}
|
||||
Двоичные данные
Solutions/ReversingLabs/Package/1.0.0.zip
Двоичные данные
Solutions/ReversingLabs/Package/1.0.0.zip
Двоичный файл не отображается.
Двоичные данные
Solutions/ReversingLabs/Package/1.1.0.zip
Двоичные данные
Solutions/ReversingLabs/Package/1.1.0.zip
Двоичный файл не отображается.
|
|
@ -6,7 +6,7 @@
|
|||
"config": {
|
||||
"isWizard": false,
|
||||
"basics": {
|
||||
"description": "**Important:** _This Azure Sentinel Solution is currently in public preview. This feature is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/)._\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\n[ReversingLabs](https://www.reversinglabs.com/) provides explainable threat intelligence into malware infected files and objects, for any file, any location, and any threat.\n\nAzure Sentinel Solutions provide a consolidated way to acquire Azure Sentinel content like data connectors, workbooks, analytics, and automations in your workspace with a single deployment step.\n\n**Playbooks:** 1\n\n[Learn more about Azure Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
|
||||
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/reversinglabs.svg\" width=\"75px\" height=\"75px\">\n\n**Important:** _This Microsoft Sentinel Solution is currently in public preview. This feature is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/)._\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe ReversingLabs solution for Microsoft Sentinel includes a number of Sentinel resources designed to automate your security operations using the power of TitaniumCloud APIs and visualize your threat intelligence capabilities using included workbooks.\n\nMicrosoft Sentinel Solutions provide a consolidated way to acquire Microsoft Sentinel content like data connectors, workbooks, analytics, and automations in your workspace with a single deployment step.\n\n**Workbooks:** 1, **Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
|
||||
"subscription": {
|
||||
"resourceProviders": [
|
||||
"Microsoft.OperationsManagement/solutions",
|
||||
|
|
@ -44,13 +44,58 @@
|
|||
"placeholder": "Select a workspace",
|
||||
"toolTip": "This dropdown will list only workspace that exists in the Resource Group selected",
|
||||
"constraints": {
|
||||
"allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(filter.id, toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]",
|
||||
"allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]",
|
||||
"required": true
|
||||
},
|
||||
"visible": true
|
||||
}
|
||||
],
|
||||
"steps": [
|
||||
{
|
||||
"name": "workbooks",
|
||||
"label": "Workbooks",
|
||||
"subLabel": {
|
||||
"preValidation": "Configure the workbooks",
|
||||
"postValidation": "Done"
|
||||
},
|
||||
"bladeTitle": "Workbooks",
|
||||
"elements": [
|
||||
{
|
||||
"name": "workbooks-text",
|
||||
"type": "Microsoft.Common.TextBlock",
|
||||
"options": {
|
||||
"text": "This Microsoft Sentinel Solution installs workbooks. Workbooks provide a flexible canvas for data monitoring, analysis, and the creation of rich visual reports within the Azure portal. They allow you to tap into one or many data sources from Microsoft Sentinel and combine them into unified interactive experiences.",
|
||||
"link": {
|
||||
"label": "Learn more",
|
||||
"uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "workbook1",
|
||||
"type": "Microsoft.Common.Section",
|
||||
"label": "ReversingLabs",
|
||||
"elements": [
|
||||
{
|
||||
"name": "workbook1-text",
|
||||
"type": "Microsoft.Common.TextBlock"
|
||||
},
|
||||
{
|
||||
"name": "workbook1-name",
|
||||
"type": "Microsoft.Common.TextBox",
|
||||
"label": "Display Name",
|
||||
"defaultValue": "ReversingLabs - Capabilities Overview",
|
||||
"toolTip": "Display name for the workbook.",
|
||||
"constraints": {
|
||||
"required": true,
|
||||
"regex": "[a-z0-9A-Z]{1,256}$",
|
||||
"validationMessage": "Please enter a workbook name"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "playbooks",
|
||||
"label": "Playbooks",
|
||||
|
|
@ -64,7 +109,7 @@
|
|||
"name": "playbooks-text",
|
||||
"type": "Microsoft.Common.TextBlock",
|
||||
"options": {
|
||||
"text": "This solution installs playbook resources. A security playbook is a collection of procedures that can be run from Azure Sentinel in response to an alert. A security playbook can help automate and orchestrate your response, and can be run manually or set to run automatically when specific alerts are triggered. Security playbooks in Azure Sentinel are based on Azure Logic Apps, which means that you get all the power, customizability, and built-in templates of Logic Apps. Each playbook is created for the specific subscription you choose, but when you look at the Playbooks page, you will see all the playbooks across any selected subscriptions.",
|
||||
"text": "This solution installs playbook resources. A security playbook is a collection of procedures that can be run from Microsoft Sentinel in response to an alert. A security playbook can help automate and orchestrate your response, and can be run manually or set to run automatically when specific alerts are triggered. Security playbooks in Microsoft Sentinel are based on Azure Logic Apps, which means that you get all the power, customizability, and built-in templates of Logic Apps. Each playbook is created for the specific subscription you choose, but when you look at the Playbooks page, you will see all the playbooks across any selected subscriptions.",
|
||||
"link": {
|
||||
"label": "Learn more",
|
||||
"uri": "https://docs.microsoft.com/azure/sentinel/tutorial-respond-threats-playbook?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef"
|
||||
|
|
@ -74,7 +119,7 @@
|
|||
{
|
||||
"name": "playbook1",
|
||||
"type": "Microsoft.Common.Section",
|
||||
"label": "ReversingLabsFileInfo",
|
||||
"label": "ReversingLabs-EnrichFileHash",
|
||||
"elements": [
|
||||
{
|
||||
"name": "playbook1-text",
|
||||
|
|
@ -87,25 +132,13 @@
|
|||
"name": "playbook1-PlaybookName",
|
||||
"type": "Microsoft.Common.TextBox",
|
||||
"label": "Playbook Name",
|
||||
"defaultValue": "ReversingLabsFileInfo",
|
||||
"defaultValue": "ReversingLabs-EnrichFileHash",
|
||||
"toolTip": "Resource name for the logic app playbook. No spaces are allowed",
|
||||
"constraints": {
|
||||
"required": true,
|
||||
"regex": "[a-z0-9A-Z]{1,256}$",
|
||||
"validationMessage": "Please enter a playbook resource name"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "playbook1-UserName",
|
||||
"type": "Microsoft.Common.TextBox",
|
||||
"label": "ReversingLabs Username",
|
||||
"defaultValue": "<username>@<domain>",
|
||||
"toolTip": "Username to connect to ReversingLabs API",
|
||||
"constraints": {
|
||||
"required": true,
|
||||
"regex": "[a-z0-9A-Z]{1,256}$",
|
||||
"validationMessage": "Please enter a playbook username"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -113,11 +146,11 @@
|
|||
}
|
||||
],
|
||||
"outputs": {
|
||||
"workspace-location": "[resourceGroup().location]",
|
||||
"workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
|
||||
"location": "[location()]",
|
||||
"workspace": "[basics('workspace')]",
|
||||
"playbook1-PlaybookName": "[steps('playbooks').playbook1.playbook1-PlaybookName]",
|
||||
"playbook1-UserName": "[steps('playbooks').playbook1.playbook1-UserName]"
|
||||
"workbook1-name": "[steps('workbooks').workbook1.workbook1-name]",
|
||||
"playbook1-PlaybookName": "[steps('playbooks').playbook1.playbook1-PlaybookName]"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Различия файлов скрыты, потому что одна или несколько строк слишком длинны
|
|
@ -1,60 +0,0 @@
|
|||
# Enrich-SentinelIncident-ReversingLabs-File-Information
|
||||
This playbook utilizes the ReversingLabs Intelligence connector to automatically enrich incident comments section with file information.
|
||||
|
||||
Learn more about the integration via the [connector documentation](https://docs.microsoft.com/connectors/reversinglabsintelligence/).
|
||||
|
||||
In order to successfully run this playbook you will need a valid ReversingLabs TitaniumCloud subscription with the XREF(Historic Multi-AV Scan Records), File Reputation and File Hash Analysis Detail APIs enabled. You can obtain your subscription at support@reversinglabs.com.
|
||||
|
||||
Playbook extracts hashes (SHA-1, SHA-256 or MD5) by utilizing Azure Sentinel-recognized entity FileHashCustomEntity. In your custom rule, map your hash field to this entity:
|
||||
```
|
||||
YourLog_CL
|
||||
| extend FileHashCustomEntity = <your_hash_field>
|
||||
```
|
||||
|
||||
Sample comment output:
|
||||
```
|
||||
ReversingLabs Multi-AV Scan Records:
|
||||
|
||||
ahnlab_online : antivir : detectedavast : Win32:Malware-genbitdefender : carbonblack_online : clamav : PUA.Win.Packer.Exe-6crowdstrike : crowdstrike_online : drweb : Trojan.DownLoader33.21319ensilo_online : esetnod32 : f_prot : fireeye_online : fortinet : gdata : ikarus : invincea_online : k7computing : kaspersky_online : mcafee_online : Artemis!08490DB63F89 (trojan)microsoft_online : panda_online : quickheal : rising_online : Trojan.MalCert!1.C446sentinelone_online : sophos_online : sunbelt : symantec_beta : trendmicro_consumer : vba32 : Trojan.Downloaderwatchguard_online :
|
||||
|
||||
|
||||
ReversingLabs File Hash Details:
|
||||
|
||||
This file (SHA1: db2363303dfa061ae92c8e2c114277174c5f5e38) is a 32-bit portable executable application. Additionally, it was identified as InnoSetup installer, and unpacking was successful. The application uses the Windows graphical user interface (GUI) subsystem, while the languages used are Dutch from Netherlands and English from United States. According to version information, this is CoronaVirus Status [Plugin for Google Chrome] from CENTR MBR LLC. Appended data was detected at the file's end. Its length is greater than the size of the image. Cryptography related data was found in the file. This application has access to device configuration, monitoring, networking and running processes and has security related capabilities. The application is digitally signed, and its certificate is valid. There are 874 extracted files.
|
||||
|
||||
Sha1: db2363303dfa061ae92c8e2c114277174c5f5e38
|
||||
|
||||
Sd5: 08490db63f89b78bdfbc3dd3ae17c706
|
||||
|
||||
Sha256: 33cc2944588599a4c70215483e3a59c957c6e7be091a230f9ab9297d12f00933
|
||||
|
||||
Sha384: deb41647a35986dff1b82faf8f957a7ab78b98109ca3c7bdb67dd27ec42a9cd26d6f4e5a26e63b716703bd497db70032
|
||||
|
||||
Sha512: b015c0ff6efc24a35b954021d8fdb9ab3b7d69cb1314b629607aae197642ab3999a5aa32388708586058ade19d91ec558e6170e42f92c46cafceed54a829dd0e
|
||||
|
||||
Sample size: 11135784KB
|
||||
|
||||
|
||||
ReversingLabs File Hash Reputation:
|
||||
|
||||
File name: Win32.Trojan.Generic
|
||||
|
||||
File status: MALICIOUS
|
||||
|
||||
Reason: analyst_sample_override
|
||||
|
||||
Scanner count: 31
|
||||
|
||||
Scanner percent: 22.5806446075439
|
||||
|
||||
Scanner match: 7
|
||||
|
||||
First seen: 2020-04-03T06:41:18
|
||||
|
||||
Last seen: 2021-02-07T09:45:35
|
||||
|
||||
Threat level: 5
|
||||
|
||||
Trust factor: 5
|
||||
```
|
||||
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
# ReversingLabs-EnrichFileHash
|
||||
|
||||
Author: Aaron Hoffmann (ReversingLabs)
|
||||
|
||||
This playbook enriches file hash entities with information from the ReversingLabs TitaniumCloud API.
|
||||
|
||||
[](https://portal.azure.com/#create/Microsoft.Template/uri/)
|
||||
[](https://portal.azure.us/#create/Microsoft.Template/uri/)
|
||||
|
||||
## Prerequisites
|
||||
|
||||
You'll need the following:
|
||||
* A ReversingLabs TitaniumCloud subscription
|
||||
* A ReversingLabs TitaniumCloud username
|
||||
* A ReversingLabs TitaniumCloud password
|
||||
|
||||
|
||||
## Post-deployment
|
||||
|
||||
After deploying the template, you'll want to update the playbook connections with your TitaniumCloud API username and password.
|
||||
|
||||
## Screenshots
|
||||
|
||||
|
||||
Разница между файлами не показана из-за своего большого размера
Загрузить разницу
Двоичные данные
Solutions/ReversingLabs/Playbooks/ReversingLabs-EnrichFileHash/playbook.jpg
Normal file
Двоичные данные
Solutions/ReversingLabs/Playbooks/ReversingLabs-EnrichFileHash/playbook.jpg
Normal file
Двоичный файл не отображается.
|
После Ширина: | Высота: | Размер: 105 KiB |
|
|
@ -1,7 +1,8 @@
|
|||
{
|
||||
"publisherId": "reversinglabs1597673283347",
|
||||
"offerId": "reversinglabsticloudenrichment",
|
||||
"firstPublishDate": "2021-10-20",
|
||||
"offerId": "rl_offer_content_hub_aoae",
|
||||
"firstPublishDate": "2022-09-12",
|
||||
"lastPublishDate": "2022-09-12",
|
||||
"providers": ["ReversingLabs"],
|
||||
"categories": {
|
||||
"domains" : ["Security - Threat Intelligence"],
|
||||
|
|
@ -10,6 +11,7 @@
|
|||
"support": {
|
||||
"name": "ReversingLabs",
|
||||
"tier": "Partner",
|
||||
"email": "support@reversinglabs.com",
|
||||
"link": "https://support.reversinglabs.com/hc/en-us"
|
||||
}
|
||||
}
|
||||
Различия файлов скрыты, потому что одна или несколько строк слишком длинны
Загрузка…
Ссылка в новой задаче