This commit is contained in:
Alex Verbniak 2021-06-23 10:31:15 +03:00
Родитель 34bb70895a
Коммит 7281e29184
7 изменённых файлов: 8 добавлений и 4 удалений

Просмотреть файл

@ -19,6 +19,7 @@
"host_name":"srv-elk-056.company.com",
"id":"1b09c714-daaa-4d5e-88af-730e1167c6fc-default-asset-45",
"ip":"101.111.152.56",
"mac":"00:1B:44:11:3A:B7",
"last_assessed_for_vulnerabilities":"2021-06-10T11:43:56.447Z",
"last_scan_end":"2021-06-10T11:43:56.447Z",
"last_scan_start":"2021-06-10T11:36:42.804Z",
@ -178,6 +179,7 @@
"host_name":"srv-log-000.company.com",
"id":"1b09c714-daaa-4d5e-88af-730e1167c6fc-default-asset-66",
"ip":"101.111.152.10",
"mac":"00:1B:44:11:3A:B7",
"last_assessed_for_vulnerabilities":"2021-06-10T11:56:30.146Z",
"last_scan_end":"2021-06-10T11:56:30.146Z",
"last_scan_start":"2021-06-10T11:36:42.393Z",
@ -347,6 +349,7 @@
"host_name":"srv-arclog-001.company.com",
"id":"1b09c714-daaa-4d5e-88af-730e1167c6fc-default-asset-24",
"ip":"101.111.152.11",
"mac":"00:1B:44:11:3A:B7",
"last_assessed_for_vulnerabilities":"2021-06-10T11:41:58.401Z",
"last_scan_end":"2021-06-10T11:41:58.401Z",
"last_scan_start":"2021-06-10T11:36:42.366Z",
@ -656,6 +659,7 @@
"host_name":"srv-elk-053.company.com",
"id":"1b09c714-daaa-4d5e-88af-730e1167c6fc-default-asset-30",
"ip":"101.111.152.53",
"mac":"00:1B:44:11:3A:B7",
"last_assessed_for_vulnerabilities":"2021-06-10T11:44:03.362Z",
"last_scan_end":"2021-06-10T11:44:03.362Z",
"last_scan_start":"2021-06-10T11:36:43.216Z",

Просмотреть файл

@ -2,7 +2,7 @@
"id":"InsightVMCloudAPI",
"title":"Rapid7 Insight Platform Vulnerability Management Reports",
"publisher":"Rapid7",
"descriptionMarkdown":"The [Rapid7 Insight VM](https://www.rapid7.com/products/insightvm/) Report data connector provides the capability to ingest Scan reports and vulnerability data into Azure Sentinel through the REST API from the Rapid7 Insight platform (Managed in the cloud). Refer to [API documentation](https://docs.rapid7.com/insight/api-overview/) for more information. The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more",
"descriptionMarkdown":"The [Rapid7 Insight VM](https://www.rapid7.com/products/insightvm/) Report data connector provides the capability to ingest Scan reports and vulnerability data into Azure Sentinel through the REST API from the Rapid7 Insight platform (Managed in the cloud). Refer to [API documentation](https://docs.rapid7.com/insight/api-overview/) for more information. The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.",
"additionalRequirementBanner":"These queries and workbooks are dependent on a parser based on Kusto to work as expected. Follow the steps to use this Kusto functions aliases [InsightVMAssets](https://aka.ms/) and [InsightVMVulnerabilities](https://aka.ms/) in queries and workbooks",
"graphQueries":[
{
@ -129,7 +129,7 @@
},
{
"title":"Option 2 - Manual Deployment of Azure Functions",
"description":"Use the following step-by-step instructions to deploy the Rapid7 Insight Vulnerability Management Repor data connector manually with Azure Functions (Deployment via Visual Studio Code)."
"description":"Use the following step-by-step instructions to deploy the Rapid7 Insight Vulnerability Management Report data connector manually with Azure Functions (Deployment via Visual Studio Code)."
},
{
"title":"",
@ -137,7 +137,7 @@
},
{
"title":"",
"description":"**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select ** New application setting**.\n3. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tInsightVMAPIKey\n\t\tInsightVMCloudRegion\n\t\tWorkspaceID\n\t\tWorkspaceKey\n3. Once all application settings have been entered, click **Save**."
"description":"**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select ** New application setting**.\n3. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tInsightVMAPIKey\n\t\tInsightVMCloudRegion\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n3. Once all application settings have been entered, click **Save**."
}
]
}

Просмотреть файл

@ -166,7 +166,7 @@
"InsightVMAPIKey": "[parameters('InsightVMAPIKey')]",
"InsightVMCloudRegion": "[parameters('InsightVMCloudRegion')]",
"logAnalyticsUri": "[variables('LogAnaltyicsUri')]",
"WEBSITE_RUN_FROM_PACKAGE": "https://github.com/averbn/azure_sentinel_data_connectors/raw/main/insight-vm-cloud-azure-sentinel-data-connector/InsightVMCloudAPISentinelConn.zip"
"WEBSITE_RUN_FROM_PACKAGE": "https://aka.ms/sentinel-InsightVMCloudAPI-functionapp"
}
}
]