InsightVMCloud: fixes
This commit is contained in:
Родитель
34bb70895a
Коммит
7281e29184
|
@ -19,6 +19,7 @@
|
||||||
"host_name":"srv-elk-056.company.com",
|
"host_name":"srv-elk-056.company.com",
|
||||||
"id":"1b09c714-daaa-4d5e-88af-730e1167c6fc-default-asset-45",
|
"id":"1b09c714-daaa-4d5e-88af-730e1167c6fc-default-asset-45",
|
||||||
"ip":"101.111.152.56",
|
"ip":"101.111.152.56",
|
||||||
|
"mac":"00:1B:44:11:3A:B7",
|
||||||
"last_assessed_for_vulnerabilities":"2021-06-10T11:43:56.447Z",
|
"last_assessed_for_vulnerabilities":"2021-06-10T11:43:56.447Z",
|
||||||
"last_scan_end":"2021-06-10T11:43:56.447Z",
|
"last_scan_end":"2021-06-10T11:43:56.447Z",
|
||||||
"last_scan_start":"2021-06-10T11:36:42.804Z",
|
"last_scan_start":"2021-06-10T11:36:42.804Z",
|
||||||
|
@ -178,6 +179,7 @@
|
||||||
"host_name":"srv-log-000.company.com",
|
"host_name":"srv-log-000.company.com",
|
||||||
"id":"1b09c714-daaa-4d5e-88af-730e1167c6fc-default-asset-66",
|
"id":"1b09c714-daaa-4d5e-88af-730e1167c6fc-default-asset-66",
|
||||||
"ip":"101.111.152.10",
|
"ip":"101.111.152.10",
|
||||||
|
"mac":"00:1B:44:11:3A:B7",
|
||||||
"last_assessed_for_vulnerabilities":"2021-06-10T11:56:30.146Z",
|
"last_assessed_for_vulnerabilities":"2021-06-10T11:56:30.146Z",
|
||||||
"last_scan_end":"2021-06-10T11:56:30.146Z",
|
"last_scan_end":"2021-06-10T11:56:30.146Z",
|
||||||
"last_scan_start":"2021-06-10T11:36:42.393Z",
|
"last_scan_start":"2021-06-10T11:36:42.393Z",
|
||||||
|
@ -347,6 +349,7 @@
|
||||||
"host_name":"srv-arclog-001.company.com",
|
"host_name":"srv-arclog-001.company.com",
|
||||||
"id":"1b09c714-daaa-4d5e-88af-730e1167c6fc-default-asset-24",
|
"id":"1b09c714-daaa-4d5e-88af-730e1167c6fc-default-asset-24",
|
||||||
"ip":"101.111.152.11",
|
"ip":"101.111.152.11",
|
||||||
|
"mac":"00:1B:44:11:3A:B7",
|
||||||
"last_assessed_for_vulnerabilities":"2021-06-10T11:41:58.401Z",
|
"last_assessed_for_vulnerabilities":"2021-06-10T11:41:58.401Z",
|
||||||
"last_scan_end":"2021-06-10T11:41:58.401Z",
|
"last_scan_end":"2021-06-10T11:41:58.401Z",
|
||||||
"last_scan_start":"2021-06-10T11:36:42.366Z",
|
"last_scan_start":"2021-06-10T11:36:42.366Z",
|
||||||
|
@ -656,6 +659,7 @@
|
||||||
"host_name":"srv-elk-053.company.com",
|
"host_name":"srv-elk-053.company.com",
|
||||||
"id":"1b09c714-daaa-4d5e-88af-730e1167c6fc-default-asset-30",
|
"id":"1b09c714-daaa-4d5e-88af-730e1167c6fc-default-asset-30",
|
||||||
"ip":"101.111.152.53",
|
"ip":"101.111.152.53",
|
||||||
|
"mac":"00:1B:44:11:3A:B7",
|
||||||
"last_assessed_for_vulnerabilities":"2021-06-10T11:44:03.362Z",
|
"last_assessed_for_vulnerabilities":"2021-06-10T11:44:03.362Z",
|
||||||
"last_scan_end":"2021-06-10T11:44:03.362Z",
|
"last_scan_end":"2021-06-10T11:44:03.362Z",
|
||||||
"last_scan_start":"2021-06-10T11:36:43.216Z",
|
"last_scan_start":"2021-06-10T11:36:43.216Z",
|
||||||
|
|
|
@ -2,7 +2,7 @@
|
||||||
"id":"InsightVMCloudAPI",
|
"id":"InsightVMCloudAPI",
|
||||||
"title":"Rapid7 Insight Platform Vulnerability Management Reports",
|
"title":"Rapid7 Insight Platform Vulnerability Management Reports",
|
||||||
"publisher":"Rapid7",
|
"publisher":"Rapid7",
|
||||||
"descriptionMarkdown":"The [Rapid7 Insight VM](https://www.rapid7.com/products/insightvm/) Report data connector provides the capability to ingest Scan reports and vulnerability data into Azure Sentinel through the REST API from the Rapid7 Insight platform (Managed in the cloud). Refer to [API documentation](https://docs.rapid7.com/insight/api-overview/) for more information. The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more",
|
"descriptionMarkdown":"The [Rapid7 Insight VM](https://www.rapid7.com/products/insightvm/) Report data connector provides the capability to ingest Scan reports and vulnerability data into Azure Sentinel through the REST API from the Rapid7 Insight platform (Managed in the cloud). Refer to [API documentation](https://docs.rapid7.com/insight/api-overview/) for more information. The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.",
|
||||||
"additionalRequirementBanner":"These queries and workbooks are dependent on a parser based on Kusto to work as expected. Follow the steps to use this Kusto functions aliases [InsightVMAssets](https://aka.ms/) and [InsightVMVulnerabilities](https://aka.ms/) in queries and workbooks",
|
"additionalRequirementBanner":"These queries and workbooks are dependent on a parser based on Kusto to work as expected. Follow the steps to use this Kusto functions aliases [InsightVMAssets](https://aka.ms/) and [InsightVMVulnerabilities](https://aka.ms/) in queries and workbooks",
|
||||||
"graphQueries":[
|
"graphQueries":[
|
||||||
{
|
{
|
||||||
|
@ -129,7 +129,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"title":"Option 2 - Manual Deployment of Azure Functions",
|
"title":"Option 2 - Manual Deployment of Azure Functions",
|
||||||
"description":"Use the following step-by-step instructions to deploy the Rapid7 Insight Vulnerability Management Repor data connector manually with Azure Functions (Deployment via Visual Studio Code)."
|
"description":"Use the following step-by-step instructions to deploy the Rapid7 Insight Vulnerability Management Report data connector manually with Azure Functions (Deployment via Visual Studio Code)."
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"title":"",
|
"title":"",
|
||||||
|
@ -137,7 +137,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"title":"",
|
"title":"",
|
||||||
"description":"**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select ** New application setting**.\n3. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tInsightVMAPIKey\n\t\tInsightVMCloudRegion\n\t\tWorkspaceID\n\t\tWorkspaceKey\n3. Once all application settings have been entered, click **Save**."
|
"description":"**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select ** New application setting**.\n3. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tInsightVMAPIKey\n\t\tInsightVMCloudRegion\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n3. Once all application settings have been entered, click **Save**."
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
|
@ -166,7 +166,7 @@
|
||||||
"InsightVMAPIKey": "[parameters('InsightVMAPIKey')]",
|
"InsightVMAPIKey": "[parameters('InsightVMAPIKey')]",
|
||||||
"InsightVMCloudRegion": "[parameters('InsightVMCloudRegion')]",
|
"InsightVMCloudRegion": "[parameters('InsightVMCloudRegion')]",
|
||||||
"logAnalyticsUri": "[variables('LogAnaltyicsUri')]",
|
"logAnalyticsUri": "[variables('LogAnaltyicsUri')]",
|
||||||
"WEBSITE_RUN_FROM_PACKAGE": "https://github.com/averbn/azure_sentinel_data_connectors/raw/main/insight-vm-cloud-azure-sentinel-data-connector/InsightVMCloudAPISentinelConn.zip"
|
"WEBSITE_RUN_FROM_PACKAGE": "https://aka.ms/sentinel-InsightVMCloudAPI-functionapp"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
|
Загрузка…
Ссылка в новой задаче