Azure
/
Azure-Sentinel
зеркало из
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
11 193 коммитов 3 464 Ветки 0 Теги 12 GiB
Граф коммитов

11193 Коммитов

Автор SHA1 Сообщение Дата
yaronMSFT 7dfe3cc1c7
Adding single schema deploy buttons (#3411) 
Co-authored-by: Yaron <49263271+YaronFruchtmann@users.noreply.github.com>
 2021-11-09 19:33:50 +02:00
Yaron 7ea472b68d Fixing typo call parameters 2021-11-09 15:48:14 +02:00
v-jayakal 3d96352773
Merge pull request #3407 from Azure/v-rucdu/ProofpointPODICMFIxes 
Fix for ProofpointPOD ICM
 2021-11-08 23:07:10 -08:00
v-rucdu ad952495ec updated zip package 2021-11-09 12:13:29 +05:30
v-rucdu a5174b4983 Fix for ProofpointPOD ICM 2021-11-09 12:05:48 +05:30
v-jayakal ac94a89c29
Merge pull request #3324 from SecureHats/master 
updated text module 2
 2021-11-08 20:44:23 -08:00
v-jayakal 5986bd85f0
Merge pull request #2697 from Flared/jct/FlareSystems-improve-Solution-wizard 
FlareSystemsFirework: update to 1.0.1 solution
 2021-11-08 20:43:34 -08:00
Ashwin Patil 4d256a7306
Merge pull request #3406 from Azure/Dev-0322BLOG_Queries 
Updating the query
 2021-11-08 16:19:48 -08:00
Ajeet Prakash (MSTIC) 93e5695871 Updating the query 2021-11-08 15:56:58 -08:00
aprakash13 c5dbae756c
Merge pull request #3404 from Azure/pebryan/2021118_BlogSupport 
Added new hunting queries for MSTIC blog support.
 2021-11-08 14:33:34 -08:00
Pete Bryan bff25588f8 Additional YAML fixes 2021-11-08 14:28:49 -08:00
Pete Bryan e1ab0812f9 Updated yaml to fix error 2021-11-08 14:25:11 -08:00
Pete Bryan dd04dc88fb Added new hunting queries: 
Looking for Command Line Activity Associated with Dev-0322
Looking for file creation events associated with Dev-0322
Including queries for both MDE events and MSIM model.
 2021-11-08 14:19:50 -08:00
Ashwin Patil e5641bdd07
Merge pull request #3351 from Azure/ashwin/aadsecops 
AADSecops Detection and hunting Queries
 2021-11-08 13:40:09 -08:00
Pete Bryan 7455fb2a7a
Merge pull request #3275 from Azure/AADAdditionforPrivAccounts 
Adding AAD related hunting query
 2021-11-08 08:39:24 -08:00
Yaron 83ed56b7b5
Fixing how dvcaction param works (#3399) 2021-11-08 12:12:05 +02:00
Yaron 5a8ac1ee25
doh 2021-11-08 10:59:58 +02:00
Yaron 105b44402a
Updating Empty Schema location 2021-11-08 10:55:07 +02:00
Yaron e96cfc53df
Network Sesion ARM templates 2021-11-08 10:46:48 +02:00
aprakash13 475a129f75
Merge pull request #3372 from javiersoriano/patch-6 
Update README.md in Sentinel Training Lab
 2021-11-08 00:17:57 -08:00
sagamzu 60acf01fce
[Data connectors] Aws S3 Script- Add Sentinel tag when creating a new resources in AWS (#3391) 
[Data connectors] Aws S3 Script- Add Sentinel tag when creating a new resources in AWS.

it will be easier for us to write an offboarding script in the future because we can get AWS resources by a specific tag..
 AWS Command: 
aws resourcegroupstaggingapi get-resources --tag-filters Key=Operator,Values=Microsoft_Sentinel_Automation_Script
 2021-11-08 09:54:40 +02:00
aprakash13 33228c7b4b
Merge pull request #3185 from ep3p/patch-2 
Join Kind leftouter might be preferred
 2021-11-07 21:21:23 -08:00
aprakash13 f2cab376bd
Update NonDCActiveDirectoryReplication.yaml 
Updated the version number.
 2021-11-07 21:12:09 -08:00
aprakash13 989fa5b019
Merge branch 'master' into patch-2 2021-11-07 21:10:37 -08:00
aprakash13 b7828f93f6
Merge pull request #3389 from Azure/BackUpWithAlertCorrelationAddition 
Adding query for review
 2021-11-07 12:19:41 -08:00
Yaron aac7efe4f9
Adding parameters to YAML (#3369) 
* Adding parameter:disabled to ASimNetwork*

* Adding Parameters to YAML code:
      starttime:datetime=datetime(null)
    , endtime:datetime=datetime(null)
    , srcipaddr_has_any_ipv4_prefix:dynamic=dynamic([])
    , dstipaddr_has_any_ipv4_prefix:dynamic=dynamic([])
    , dstportnumber:int=int(null)
    , url_has_any:dynamic=dynamic([])
    , httpuseragent_has_any:dynamic=dynamic([])
    , hostname_has_any:dynamic=dynamic([])
    , dvcaction:dynamic=dynamic([])
    , disabled:bool=false
 2021-11-07 12:42:29 +02:00
sagamzu 4a1267c17b
[Data connectors] Aws-S3 script update (#3360) 2021-11-07 10:05:34 +02:00
gitj121 6dcda7ee6a Readding with changes 2021-11-05 15:10:01 -07:00
gitj121 9ffad045a3 Adding query for review 2021-11-05 14:47:39 -07:00
v-jayakal ced21b74ce
Update Solution README.md with metadata details (#3246) 
* Update README.md

* Solution Metadata file details

* Update README.md

* Update README.md

* Example file for metadata

* Updated as per review comments

* Renamed planId to offerId

* Renamed planId to offerId

Co-authored-by: v-rucdu <v-rucdu@microsoft.com>
 2021-11-05 10:06:10 -07:00
v-jayakal 1a4b4a1330
Merge pull request #3383 from elforb/v-eliforbes/defenderIotUpdate 
Defender IOT - Analytics Update
 2021-11-05 09:30:31 -07:00
v-jayakal aa2070ace2
Merge pull request #3380 from YoavDaniely/patch-3 
Updated private preview to preview in "echo"
 2021-11-04 21:34:56 -07:00
Eli Forbes 9e6f70b114 Defender IOT - Analytics Update 2021-11-04 14:23:37 -07:00
Ashwin Patil 67e39f2cbe
Merge pull request #3381 from thmcelro/runcommand-fixes 
Update run command join key
 2021-11-04 09:37:41 -07:00
Thomas McElroy 577e15db68 Update RunCommandUEBABreach.yaml 2021-11-04 16:18:17 +00:00
Thomas McElroy b262d535cb Update run command join key 
- The join key merged the IP address and UPN, this is not required and the join can be performed on just the UPN.
 2021-11-04 16:15:38 +00:00
YoavDaniely 0aa346d9a7
Updated private preview to preview in "echo" 2021-11-04 16:50:10 +02:00
haneuvir 1e8ee205c1
Merge pull request #3373 from kingwil/htfix2 
Audit policy logic update
 2021-11-03 16:37:34 +02:00
v-jayakal e4b7cc4142
Merge pull request #3374 from Azure/v-ntripathi/CMMCPlaybookSolution 
update
 2021-11-03 06:01:32 -07:00
NikTripathi ed0f6c6b18 update 2021-11-03 18:26:01 +05:30
kingwil 33f0e28213 Audit policy logic update 2021-11-03 12:46:32 +00:00
Javier Soriano 0c8085b279
Update README.md 
fixing type on link to exercise 2
 2021-11-03 13:36:53 +01:00
Ofer Shezaf 76b74c6033
Update README.md 2021-11-03 10:44:34 +02:00
Ofer Shezaf ab7166e370
Merge pull request #3368 from Azure/dev/normalizaton/product-rename 
Rename product
 2021-11-03 10:43:56 +02:00
Ofer Shezaf 9b8247c42e Rename product 2021-11-03 10:40:18 +02:00
v-jayakal e3e4e78d3e
Merge pull request #3356 from Azure/anknar/BugFix_Fortigate-Custom-Connector 
Fortigate Bugfix - Update to function app code for custom connector
 2021-11-02 21:42:23 -07:00
v-jayakal 84c1e11fd2
Merge pull request #3349 from Azure/v-manoj/CreatingPackageInfoSecGlobal 
Solution Package for InfoSecGlobal
 2021-11-02 18:25:03 -07:00
v-jayakal ab9cd61208
Update stats.md 2021-11-02 13:04:27 -07:00
v-jayakal acdfd33ea4
Update stats.md 2021-11-02 12:25:22 -07:00
NikTripathi 59db0f8211
Update mainTemplate.json 2021-11-02 17:15:05 +05:30