diff --git a/Logos/VaronisLogo.svg b/Logos/VaronisLogo.svg
new file mode 100644
index 0000000000..4552c72d2f
--- /dev/null
+++ b/Logos/VaronisLogo.svg
@@ -0,0 +1,11 @@
+
\ No newline at end of file
diff --git a/Sample Data/VaronisAlerts_CL.csv b/Sample Data/VaronisAlerts_CL.csv
new file mode 100644
index 0000000000..91d0d14863
--- /dev/null
+++ b/Sample Data/VaronisAlerts_CL.csv
@@ -0,0 +1,11 @@
+"TimeGenerated [UTC]","DeviceName_s","ID_g","Name_s","Time_t [UTC]","Severity_s","SeverityId_d","Status_s","StatusId_d","NumOfAlertedEvents_d","UserName_s","SamAccountName_s","Asset_s","AssetContainsFlaggedData_s","AssetContainsSensitiveData_s","Platform_s","FileServerOrDomain_s","EventUTC_t [UTC]","IngestTime_t [UTC]",Category
+"12/15/2023, 11:00:06.143 AM","[""dev3cf41col01""]","534a1d7f-21bf-4a05-8574-cc6d46b80616","Capture Account authentication for varadm","12/15/2023, 10:54:00.000 AM",Medium,1,New,1,1,"[""varadm (dev3cf41.com)""]","[""varadm""]","[""dev3cf41.com(AD-dev3cf41.com)""]","[false]","[false]","[""Active Directory""]","[""AD-dev3cf41.com""]","12/15/2023, 10:53:00.000 AM","12/15/2023, 10:59:34.000 AM","Privilege Escalation"
+"12/15/2023, 11:00:06.143 AM","[""dev3cf41col01""]","b871d1e2-eb98-4ae1-b2e0-202bf46d6dab","Capture Access request for varadm","12/15/2023, 10:54:00.000 AM",Low,2,New,1,1,"[""varadm (dev3cf41.com)""]","[""varadm""]","[""dev3cf41.com(AD-dev3cf41.com)""]","[false]","[false]","[""Active Directory""]","[""AD-dev3cf41.com""]","12/15/2023, 10:53:00.000 AM","12/15/2023, 10:59:31.000 AM","Privilege Escalation"
+"12/15/2023, 11:10:05.152 AM","[""dev3cf41col01""]","811a536a-e64c-45f2-b66f-45c799ef1604","Capture Access request for varadm","12/15/2023, 11:04:00.000 AM",Low,2,New,1,1,"[""varadm (dev3cf41.com)""]","[""varadm""]","[""dev3cf41.com(AD-dev3cf41.com)""]","[false]","[false]","[""Active Directory""]","[""AD-dev3cf41.com""]","12/15/2023, 11:03:00.000 AM","12/15/2023, 11:09:34.000 AM","Privilege Escalation"
+"12/15/2023, 11:10:05.152 AM","[""dev3cf41col01""]","8d8c3027-06ea-4e18-b22a-49f1dd84e5ab","Capture Account authentication for varadm","12/15/2023, 11:04:00.000 AM",Medium,1,New,1,1,"[""varadm (dev3cf41.com)""]","[""varadm""]","[""dev3cf41.com(AD-dev3cf41.com)""]","[false]","[false]","[""Active Directory""]","[""AD-dev3cf41.com""]","12/15/2023, 11:03:00.000 AM","12/15/2023, 11:09:31.000 AM","Privilege Escalation"
+"12/15/2023, 11:11:04.496 AM",,"ee030abc-9127-4fb1-a0da-061db55eb8a7","Capture Network Service activity","12/15/2023, 11:05:00.000 AM",Low,2,New,1,1,"[""Network Service (Abstract)""]","[""Network Service""]","[""dev3cf41.com(AD-dev3cf41.com)""]","[false]","[false]","[""Active Directory""]","[""AD-dev3cf41.com""]","12/15/2023, 11:04:00.000 AM","12/15/2023, 11:10:08.000 AM","Privilege Escalation"
+"12/15/2023, 11:12:04.977 AM","[""dev3cf41col01""]","d5dc935e-c36d-47f8-a734-8ed274e74700","Capture Account authentication for varadm","12/15/2023, 11:06:00.000 AM",Medium,1,New,1,1,"[""varadm (dev3cf41.com)""]","[""varadm""]","[""dev3cf41.com(AD-dev3cf41.com)""]","[false]","[false]","[""Active Directory""]","[""AD-dev3cf41.com""]","12/15/2023, 11:05:00.000 AM","12/15/2023, 11:11:34.000 AM","Privilege Escalation"
+"12/15/2023, 11:12:04.977 AM","[""dev3cf41col01""]","8a218cb7-7a34-47fb-8ac8-796034e0d565","Capture Access request for varadm","12/15/2023, 11:06:00.000 AM",Low,2,New,1,1,"[""varadm (dev3cf41.com)""]","[""varadm""]","[""dev3cf41.com(AD-dev3cf41.com)""]","[false]","[false]","[""Active Directory""]","[""AD-dev3cf41.com""]","12/15/2023, 11:05:00.000 AM","12/15/2023, 11:11:31.000 AM","Privilege Escalation"
+"12/15/2023, 11:14:04.411 AM","[""dev3cf41col01""]","83616a14-81a3-46f5-85e7-3ce110ef3878","Capture Access request for varadm","12/15/2023, 11:08:00.000 AM",Low,2,New,1,1,"[""varadm (dev3cf41.com)""]","[""varadm""]","[""dev3cf41.com(AD-dev3cf41.com)""]","[false]","[false]","[""Active Directory""]","[""AD-dev3cf41.com""]","12/15/2023, 11:07:00.000 AM","12/15/2023, 11:13:34.000 AM","Privilege Escalation"
+"12/15/2023, 11:14:04.411 AM","[""dev3cf41col01""]","46366252-ce0a-4b72-9b09-abd7be7a5d79","Capture Account authentication for varadm","12/15/2023, 11:08:00.000 AM",Medium,1,New,1,1,"[""varadm (dev3cf41.com)""]","[""varadm""]","[""dev3cf41.com(AD-dev3cf41.com)""]","[false]","[false]","[""Active Directory""]","[""AD-dev3cf41.com""]","12/15/2023, 11:07:00.000 AM","12/15/2023, 11:13:31.000 AM","Privilege Escalation"
+"12/15/2023, 11:26:04.737 AM","[""dev3cf41col01""]","d81abc48-0ace-408e-89e7-512bcf2cdb35","Capture Access request for varadm","12/15/2023, 11:20:00.000 AM",Low,2,New,1,1,"[""varadm (dev3cf41.com)""]","[""varadm""]","[""dev3cf41.com(AD-dev3cf41.com)""]","[false]","[false]","[""Active Directory""]","[""AD-dev3cf41.com""]","12/15/2023, 11:20:00.000 AM","12/15/2023, 11:25:35.000 AM","Privilege Escalation"
diff --git a/Solutions/VaronisSaaS/Data Connectors/VaronisSaaS_API_FunctionApp.json b/Solutions/VaronisSaaS/Data Connectors/VaronisSaaS_API_FunctionApp.json
index 3f6828e42f..dfac6d22de 100644
--- a/Solutions/VaronisSaaS/Data Connectors/VaronisSaaS_API_FunctionApp.json
+++ b/Solutions/VaronisSaaS/Data Connectors/VaronisSaaS_API_FunctionApp.json
@@ -2,7 +2,7 @@
"id": "VaronisSaaS",
"title": "Varonis SaaS",
"publisher": "Varonis",
- "descriptionMarkdown": "Varonis SaaS provides the capability to ingest [Varonis Alerts](https://varonisdatalertservicemockwebapi20230907161659.azurewebsites.net/Alert/alerts) into Microsoft Sentinel.",
+ "descriptionMarkdown": "Varonis SaaS provides the capability to ingest [Varonis Alerts](https://www.varonis.com/products/datalert) into Microsoft Sentinel.",
"graphQueriesTableName": "VaronisAlerts_CL",
"graphQueries": [
{
@@ -78,12 +78,7 @@
},
{
"title": "",
- "description": "**For Azure function and related services installation use:**\n\n [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Fvkorenkov-varonis%2Fsentinel%2Fmaster%2Fazuredeploy.json)"
- },
-
- {
- "title": "",
- "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**CiscoSecureEndpoint**](https://aka.ms/sentinel-ciscosecureendpoint-parser) which is deployed with the Microsoft Sentinel Solution."
+ "description": "**For Azure function and related services installation use:**\n\n [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FVaronisSaaS%2FData%2520Connectors%2Fazuredeploy.json)"
},
{
"title": "",
diff --git a/Solutions/VaronisSaaS/Data Connectors/azuredeploy.json b/Solutions/VaronisSaaS/Data Connectors/azuredeploy.json
index f47177e33a..dcb04c9861 100644
--- a/Solutions/VaronisSaaS/Data Connectors/azuredeploy.json
+++ b/Solutions/VaronisSaaS/Data Connectors/azuredeploy.json
@@ -78,7 +78,7 @@
},
"packageUri": {
"type": "string",
- "defaultValue": "https://github.com/vkorenkov-varonis/sentinel/raw/master/Varonis.Sentinel.Functions.zip",
+ "defaultValue": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/VaronisSaaS/Data%20Connectors/Varonis.Sentinel.Functions.zip",
"metadata": {
"description": "The zip content url."
}
diff --git a/Solutions/VaronisSaaS/Data/Solution_VaronisSaaS.json b/Solutions/VaronisSaaS/Data/Solution_VaronisSaaS.json
index b948a9f235..08c6be7ea9 100644
--- a/Solutions/VaronisSaaS/Data/Solution_VaronisSaaS.json
+++ b/Solutions/VaronisSaaS/Data/Solution_VaronisSaaS.json
@@ -1,7 +1,7 @@
{
"Name": "VaronisSaaS",
"Author": "Varonis",
- "Logo": "",
+ "Logo": "",
"Description": "The Varonis SaaS integration allows you to retrieve Varonis DatAlert alerts, create incident and pull activities related to the alerts for conducting investigations.",
"Workbooks": ["Workbooks/VaronisSaaS.json"],
"Data Connectors": ["Data Connectors/VaronisSaaS_API_FunctionApp.json"],
diff --git a/Solutions/VaronisSaaS/REDME.md b/Solutions/VaronisSaaS/README.md
similarity index 100%
rename from Solutions/VaronisSaaS/REDME.md
rename to Solutions/VaronisSaaS/README.md