Merge pull request #11042 from Azure/v-visodadasi/cloudflare
Python Version Updated to 3.11 in CloudFlare
This commit is contained in:
v-atulyadav
GitHub
Коммит
d3c2d354f4
Двоичные данные
Solutions/Cloudflare/Data Connectors/CloudflareConn.zip
Двоичные данные
Solutions/Cloudflare/Data Connectors/CloudflareConn.zip
Двоичный файл не отображается.
|
|
@ -33,7 +33,7 @@
|
|||
],
|
||||
"availability": {
|
||||
"status": 1,
|
||||
"isPreview": false
|
||||
"isPreview": false
|
||||
},
|
||||
"permissions": {
|
||||
"resourceProvider": [
|
||||
|
|
@ -120,7 +120,7 @@
|
|||
},
|
||||
{
|
||||
"title": "",
|
||||
"description": "**1. Deploy a Function App**\n\n> **NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/create-first-function-vs-code-python) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-CloudflareDataConnector-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files.\n4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.\nIf you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**\nIf you're already signed in, go to the next step.\n5. Provide the following information at the prompts:\n\n\ta. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.\n\n\tb. **Select Subscription:** Choose the subscription to use.\n\n\tc. Select **Create new Function App in Azure** (Don't choose the Advanced option)\n\n\td. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. CloudflareXX).\n\n\te. **Select a runtime:** Choose Python 3.8.\n\n\tf. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.\n\n6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.\n7. Go to Azure Portal for the Function App configuration."
|
||||
"description": "**1. Deploy a Function App**\n\n> **NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/create-first-function-vs-code-python) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-CloudflareDataConnector-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files.\n4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.\nIf you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**\nIf you're already signed in, go to the next step.\n5. Provide the following information at the prompts:\n\n\ta. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.\n\n\tb. **Select Subscription:** Choose the subscription to use.\n\n\tc. Select **Create new Function App in Azure** (Don't choose the Advanced option)\n\n\td. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. CloudflareXX).\n\n\te. **Select a runtime:** Choose Python 3.11.\n\n\tf. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.\n\n6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.\n7. Go to Azure Portal for the Function App configuration."
|
||||
},
|
||||
{
|
||||
"title": "",
|
||||
|
|
|
|||
|
|
@ -167,7 +167,7 @@
|
|||
"alwaysOn": true,
|
||||
"reserved": true,
|
||||
"siteConfig": {
|
||||
"linuxFxVersion": "python|3.8"
|
||||
"linuxFxVersion": "python|3.11"
|
||||
}
|
||||
},
|
||||
|
||||
|
|
|
|||
Двоичные данные
Solutions/Cloudflare/Package/3.0.2.zip
Двоичные данные
Solutions/Cloudflare/Package/3.0.2.zip
Двоичный файл не отображается.
|
|
@ -6,7 +6,7 @@
|
|||
"config": {
|
||||
"isWizard": false,
|
||||
"basics": {
|
||||
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\"width=\"75px\"height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Cloudflare](https://www.cloudflare.com/) solution provides the capability to ingest [Cloudflare logs](https://developers.cloudflare.com/logs/) into Microsoft Sentinel using the Cloudflare Logpush and Azure Blob Storage. Refer to [Cloudflare documentation](https://developers.cloudflare.com/logs/about/) for more information.\n \n **Underlying Microsoft Technologies used:** \r \n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api) \n\n b.[Azure Functions](https://azure.microsoft.com/services/functions/#overview)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
|
||||
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\"width=\"75px\"height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cloudflare/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Cloudflare](https://www.cloudflare.com/) solution provides the capability to ingest [Cloudflare logs](https://developers.cloudflare.com/logs/) into Microsoft Sentinel using the Cloudflare Logpush and Azure Blob Storage. Refer to [Cloudflare documentation](https://developers.cloudflare.com/logs/about/) for more information.\n \n **Underlying Microsoft Technologies used:** \r \n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api) \n\n b.[Azure Functions](https://azure.microsoft.com/services/functions/#overview)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
|
||||
"subscription": {
|
||||
"resourceProviders": [
|
||||
"Microsoft.OperationsManagement/solutions",
|
||||
|
|
|
|||
|
|
@ -329,7 +329,7 @@
|
|||
"title": "Option 2 - Manual Deployment of Azure Functions"
|
||||
},
|
||||
{
|
||||
"description": "**1. Deploy a Function App**\n\n> **NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/create-first-function-vs-code-python) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-CloudflareDataConnector-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files.\n4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.\nIf you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**\nIf you're already signed in, go to the next step.\n5. Provide the following information at the prompts:\n\n\ta. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.\n\n\tb. **Select Subscription:** Choose the subscription to use.\n\n\tc. Select **Create new Function App in Azure** (Don't choose the Advanced option)\n\n\td. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. CloudflareXX).\n\n\te. **Select a runtime:** Choose Python 3.8.\n\n\tf. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.\n\n6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.\n7. Go to Azure Portal for the Function App configuration."
|
||||
"description": "**1. Deploy a Function App**\n\n> **NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/create-first-function-vs-code-python) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-CloudflareDataConnector-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files.\n4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.\nIf you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**\nIf you're already signed in, go to the next step.\n5. Provide the following information at the prompts:\n\n\ta. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.\n\n\tb. **Select Subscription:** Choose the subscription to use.\n\n\tc. Select **Create new Function App in Azure** (Don't choose the Advanced option)\n\n\td. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. CloudflareXX).\n\n\te. **Select a runtime:** Choose Python 3.11.\n\n\tf. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.\n\n6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.\n7. Go to Azure Portal for the Function App configuration."
|
||||
},
|
||||
{
|
||||
"description": "**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select **+ New application setting**.\n3. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tCONTAINER_NAME\n\t\tAZURE_STORAGE_CONNECTION_STRING\n\t\tWORKSPACE_ID\n\t\tSHARED_KEY\n\t\tlogAnalyticsUri (Optional)\n - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://WORKSPACE_ID.ods.opinsights.azure.us`. \n4. Once all application settings have been entered, click **Save**."
|
||||
|
|
@ -530,7 +530,7 @@
|
|||
"title": "Option 2 - Manual Deployment of Azure Functions"
|
||||
},
|
||||
{
|
||||
"description": "**1. Deploy a Function App**\n\n> **NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/create-first-function-vs-code-python) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-CloudflareDataConnector-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files.\n4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.\nIf you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**\nIf you're already signed in, go to the next step.\n5. Provide the following information at the prompts:\n\n\ta. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.\n\n\tb. **Select Subscription:** Choose the subscription to use.\n\n\tc. Select **Create new Function App in Azure** (Don't choose the Advanced option)\n\n\td. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. CloudflareXX).\n\n\te. **Select a runtime:** Choose Python 3.8.\n\n\tf. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.\n\n6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.\n7. Go to Azure Portal for the Function App configuration."
|
||||
"description": "**1. Deploy a Function App**\n\n> **NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/create-first-function-vs-code-python) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-CloudflareDataConnector-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files.\n4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.\nIf you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**\nIf you're already signed in, go to the next step.\n5. Provide the following information at the prompts:\n\n\ta. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.\n\n\tb. **Select Subscription:** Choose the subscription to use.\n\n\tc. Select **Create new Function App in Azure** (Don't choose the Advanced option)\n\n\td. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. CloudflareXX).\n\n\te. **Select a runtime:** Choose Python 3.11.\n\n\tf. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.\n\n6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.\n7. Go to Azure Portal for the Function App configuration."
|
||||
},
|
||||
{
|
||||
"description": "**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select **+ New application setting**.\n3. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tCONTAINER_NAME\n\t\tAZURE_STORAGE_CONNECTION_STRING\n\t\tWORKSPACE_ID\n\t\tSHARED_KEY\n\t\tlogAnalyticsUri (Optional)\n - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://WORKSPACE_ID.ods.opinsights.azure.us`. \n4. Once all application settings have been entered, click **Save**."
|
||||
|
|
@ -1630,7 +1630,7 @@
|
|||
{
|
||||
"type": "Microsoft.SecurityInsights/AlertRuleTemplates",
|
||||
"name": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
|
||||
"apiVersion": "2022-04-01-preview",
|
||||
"apiVersion": "2023-02-01-preview",
|
||||
"kind": "Scheduled",
|
||||
"location": "[parameters('workspace-location')]",
|
||||
"properties": {
|
||||
|
|
@ -1663,22 +1663,22 @@
|
|||
],
|
||||
"entityMappings": [
|
||||
{
|
||||
"entityType": "IP",
|
||||
"fieldMappings": [
|
||||
{
|
||||
"identifier": "Address",
|
||||
"columnName": "IPCustomEntity"
|
||||
"columnName": "IPCustomEntity",
|
||||
"identifier": "Address"
|
||||
}
|
||||
],
|
||||
"entityType": "IP"
|
||||
]
|
||||
},
|
||||
{
|
||||
"entityType": "URL",
|
||||
"fieldMappings": [
|
||||
{
|
||||
"identifier": "Url",
|
||||
"columnName": "UrlCustomEntity"
|
||||
"columnName": "UrlCustomEntity",
|
||||
"identifier": "Url"
|
||||
}
|
||||
],
|
||||
"entityType": "URL"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -1744,7 +1744,7 @@
|
|||
{
|
||||
"type": "Microsoft.SecurityInsights/AlertRuleTemplates",
|
||||
"name": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
|
||||
"apiVersion": "2022-04-01-preview",
|
||||
"apiVersion": "2023-02-01-preview",
|
||||
"kind": "Scheduled",
|
||||
"location": "[parameters('workspace-location')]",
|
||||
"properties": {
|
||||
|
|
@ -1777,13 +1777,13 @@
|
|||
],
|
||||
"entityMappings": [
|
||||
{
|
||||
"entityType": "IP",
|
||||
"fieldMappings": [
|
||||
{
|
||||
"identifier": "Address",
|
||||
"columnName": "IPCustomEntity"
|
||||
"columnName": "IPCustomEntity",
|
||||
"identifier": "Address"
|
||||
}
|
||||
],
|
||||
"entityType": "IP"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -1849,7 +1849,7 @@
|
|||
{
|
||||
"type": "Microsoft.SecurityInsights/AlertRuleTemplates",
|
||||
"name": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
|
||||
"apiVersion": "2022-04-01-preview",
|
||||
"apiVersion": "2023-02-01-preview",
|
||||
"kind": "Scheduled",
|
||||
"location": "[parameters('workspace-location')]",
|
||||
"properties": {
|
||||
|
|
@ -1882,13 +1882,13 @@
|
|||
],
|
||||
"entityMappings": [
|
||||
{
|
||||
"entityType": "IP",
|
||||
"fieldMappings": [
|
||||
{
|
||||
"identifier": "Address",
|
||||
"columnName": "IPCustomEntity"
|
||||
"columnName": "IPCustomEntity",
|
||||
"identifier": "Address"
|
||||
}
|
||||
],
|
||||
"entityType": "IP"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -1954,7 +1954,7 @@
|
|||
{
|
||||
"type": "Microsoft.SecurityInsights/AlertRuleTemplates",
|
||||
"name": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
|
||||
"apiVersion": "2022-04-01-preview",
|
||||
"apiVersion": "2023-02-01-preview",
|
||||
"kind": "Scheduled",
|
||||
"location": "[parameters('workspace-location')]",
|
||||
"properties": {
|
||||
|
|
@ -1987,13 +1987,13 @@
|
|||
],
|
||||
"entityMappings": [
|
||||
{
|
||||
"entityType": "IP",
|
||||
"fieldMappings": [
|
||||
{
|
||||
"identifier": "Address",
|
||||
"columnName": "IPCustomEntity"
|
||||
"columnName": "IPCustomEntity",
|
||||
"identifier": "Address"
|
||||
}
|
||||
],
|
||||
"entityType": "IP"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -2059,7 +2059,7 @@
|
|||
{
|
||||
"type": "Microsoft.SecurityInsights/AlertRuleTemplates",
|
||||
"name": "[variables('analyticRuleObject5')._analyticRulecontentId5]",
|
||||
"apiVersion": "2022-04-01-preview",
|
||||
"apiVersion": "2023-02-01-preview",
|
||||
"kind": "Scheduled",
|
||||
"location": "[parameters('workspace-location')]",
|
||||
"properties": {
|
||||
|
|
@ -2092,22 +2092,22 @@
|
|||
],
|
||||
"entityMappings": [
|
||||
{
|
||||
"entityType": "IP",
|
||||
"fieldMappings": [
|
||||
{
|
||||
"identifier": "Address",
|
||||
"columnName": "IPCustomEntity"
|
||||
"columnName": "IPCustomEntity",
|
||||
"identifier": "Address"
|
||||
}
|
||||
],
|
||||
"entityType": "IP"
|
||||
]
|
||||
},
|
||||
{
|
||||
"entityType": "URL",
|
||||
"fieldMappings": [
|
||||
{
|
||||
"identifier": "Url",
|
||||
"columnName": "UrlCustomEntity"
|
||||
"columnName": "UrlCustomEntity",
|
||||
"identifier": "Url"
|
||||
}
|
||||
],
|
||||
"entityType": "URL"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -2173,7 +2173,7 @@
|
|||
{
|
||||
"type": "Microsoft.SecurityInsights/AlertRuleTemplates",
|
||||
"name": "[variables('analyticRuleObject6')._analyticRulecontentId6]",
|
||||
"apiVersion": "2022-04-01-preview",
|
||||
"apiVersion": "2023-02-01-preview",
|
||||
"kind": "Scheduled",
|
||||
"location": "[parameters('workspace-location')]",
|
||||
"properties": {
|
||||
|
|
@ -2207,13 +2207,13 @@
|
|||
],
|
||||
"entityMappings": [
|
||||
{
|
||||
"entityType": "IP",
|
||||
"fieldMappings": [
|
||||
{
|
||||
"identifier": "Address",
|
||||
"columnName": "IPCustomEntity"
|
||||
"columnName": "IPCustomEntity",
|
||||
"identifier": "Address"
|
||||
}
|
||||
],
|
||||
"entityType": "IP"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -2279,7 +2279,7 @@
|
|||
{
|
||||
"type": "Microsoft.SecurityInsights/AlertRuleTemplates",
|
||||
"name": "[variables('analyticRuleObject7')._analyticRulecontentId7]",
|
||||
"apiVersion": "2022-04-01-preview",
|
||||
"apiVersion": "2023-02-01-preview",
|
||||
"kind": "Scheduled",
|
||||
"location": "[parameters('workspace-location')]",
|
||||
"properties": {
|
||||
|
|
@ -2312,13 +2312,13 @@
|
|||
],
|
||||
"entityMappings": [
|
||||
{
|
||||
"entityType": "IP",
|
||||
"fieldMappings": [
|
||||
{
|
||||
"identifier": "Address",
|
||||
"columnName": "IPCustomEntity"
|
||||
"columnName": "IPCustomEntity",
|
||||
"identifier": "Address"
|
||||
}
|
||||
],
|
||||
"entityType": "IP"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -2384,7 +2384,7 @@
|
|||
{
|
||||
"type": "Microsoft.SecurityInsights/AlertRuleTemplates",
|
||||
"name": "[variables('analyticRuleObject8')._analyticRulecontentId8]",
|
||||
"apiVersion": "2022-04-01-preview",
|
||||
"apiVersion": "2023-02-01-preview",
|
||||
"kind": "Scheduled",
|
||||
"location": "[parameters('workspace-location')]",
|
||||
"properties": {
|
||||
|
|
@ -2417,13 +2417,13 @@
|
|||
],
|
||||
"entityMappings": [
|
||||
{
|
||||
"entityType": "IP",
|
||||
"fieldMappings": [
|
||||
{
|
||||
"identifier": "Address",
|
||||
"columnName": "IPCustomEntity"
|
||||
"columnName": "IPCustomEntity",
|
||||
"identifier": "Address"
|
||||
}
|
||||
],
|
||||
"entityType": "IP"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -2489,7 +2489,7 @@
|
|||
{
|
||||
"type": "Microsoft.SecurityInsights/AlertRuleTemplates",
|
||||
"name": "[variables('analyticRuleObject9')._analyticRulecontentId9]",
|
||||
"apiVersion": "2022-04-01-preview",
|
||||
"apiVersion": "2023-02-01-preview",
|
||||
"kind": "Scheduled",
|
||||
"location": "[parameters('workspace-location')]",
|
||||
"properties": {
|
||||
|
|
@ -2522,22 +2522,22 @@
|
|||
],
|
||||
"entityMappings": [
|
||||
{
|
||||
"entityType": "IP",
|
||||
"fieldMappings": [
|
||||
{
|
||||
"identifier": "Address",
|
||||
"columnName": "IPCustomEntity"
|
||||
"columnName": "IPCustomEntity",
|
||||
"identifier": "Address"
|
||||
}
|
||||
],
|
||||
"entityType": "IP"
|
||||
]
|
||||
},
|
||||
{
|
||||
"entityType": "URL",
|
||||
"fieldMappings": [
|
||||
{
|
||||
"identifier": "Url",
|
||||
"columnName": "UrlCustomEntity"
|
||||
"columnName": "UrlCustomEntity",
|
||||
"identifier": "Url"
|
||||
}
|
||||
],
|
||||
"entityType": "URL"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -2603,7 +2603,7 @@
|
|||
{
|
||||
"type": "Microsoft.SecurityInsights/AlertRuleTemplates",
|
||||
"name": "[variables('analyticRuleObject10')._analyticRulecontentId10]",
|
||||
"apiVersion": "2022-04-01-preview",
|
||||
"apiVersion": "2023-02-01-preview",
|
||||
"kind": "Scheduled",
|
||||
"location": "[parameters('workspace-location')]",
|
||||
"properties": {
|
||||
|
|
@ -2636,22 +2636,22 @@
|
|||
],
|
||||
"entityMappings": [
|
||||
{
|
||||
"entityType": "IP",
|
||||
"fieldMappings": [
|
||||
{
|
||||
"identifier": "Address",
|
||||
"columnName": "IPCustomEntity"
|
||||
"columnName": "IPCustomEntity",
|
||||
"identifier": "Address"
|
||||
}
|
||||
],
|
||||
"entityType": "IP"
|
||||
]
|
||||
},
|
||||
{
|
||||
"entityType": "URL",
|
||||
"fieldMappings": [
|
||||
{
|
||||
"identifier": "Url",
|
||||
"columnName": "UrlCustomEntity"
|
||||
"columnName": "UrlCustomEntity",
|
||||
"identifier": "Url"
|
||||
}
|
||||
],
|
||||
"entityType": "URL"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -2708,7 +2708,7 @@
|
|||
"contentSchemaVersion": "3.0.0",
|
||||
"displayName": "Cloudflare",
|
||||
"publisherDisplayName": "Cloudflare",
|
||||
"descriptionHtml": "<p><strong>Note:</strong> <em>There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</em></p>\n<p>The <a href=\"https://www.cloudflare.com/\">Cloudflare</a> solution provides the capability to ingest <a href=\"https://developers.cloudflare.com/logs/\">Cloudflare logs</a> into Microsoft Sentinel using the Cloudflare Logpush and Azure Blob Storage. Refer to <a href=\"https://developers.cloudflare.com/logs/about/\">Cloudflare documentation</a> for more information.</p>\n<p><strong>Underlying Microsoft Technologies used:</strong></p>\n<p>This solution takes a dependency on the following technologies, and some of these dependencies either may be in <a href=\"https://azure.microsoft.com/support/legal/preview-supplemental-terms/\">Preview</a> state or might result in additional ingestion or operational costs:</p>\n<ol type=\"a\">\n<li><a href=\"https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api\">Azure Monitor HTTP Data Collector API</a></li>\n</ol>\n<p>b.<a href=\"https://azure.microsoft.com/services/functions/#overview\">Azure Functions</a></p>\n<p><strong>Data Connectors:</strong> 1, <strong>Parsers:</strong> 1, <strong>Workbooks:</strong> 1, <strong>Analytic Rules:</strong> 10, <strong>Hunting Queries:</strong> 10</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n",
|
||||
"descriptionHtml": "<p><strong>Note:</strong> Please refer to the following before installing the solution:</p>\n<p>• Review the solution <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cloudflare/ReleaseNotes.md\">Release Notes</a></p>\n<p>• There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</p>\n<p>The <a href=\"https://www.cloudflare.com/\">Cloudflare</a> solution provides the capability to ingest <a href=\"https://developers.cloudflare.com/logs/\">Cloudflare logs</a> into Microsoft Sentinel using the Cloudflare Logpush and Azure Blob Storage. Refer to <a href=\"https://developers.cloudflare.com/logs/about/\">Cloudflare documentation</a> for more information.</p>\n<p><strong>Underlying Microsoft Technologies used:</strong></p>\n<p>This solution takes a dependency on the following technologies, and some of these dependencies either may be in <a href=\"https://azure.microsoft.com/support/legal/preview-supplemental-terms/\">Preview</a> state or might result in additional ingestion or operational costs:</p>\n<ol type=\"a\">\n<li><a href=\"https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api\">Azure Monitor HTTP Data Collector API</a></li>\n</ol>\n<p>b.<a href=\"https://azure.microsoft.com/services/functions/#overview\">Azure Functions</a></p>\n<p><strong>Data Connectors:</strong> 1, <strong>Parsers:</strong> 1, <strong>Workbooks:</strong> 1, <strong>Analytic Rules:</strong> 10, <strong>Hunting Queries:</strong> 10</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n",
|
||||
"contentKind": "Solution",
|
||||
"contentProductId": "[variables('_solutioncontentProductId')]",
|
||||
"id": "[variables('_solutioncontentProductId')]",
|
||||
|
|
|
|||
Загрузка…
Ссылка в новой задаче