Skip to content

Adding a new workbook on Log4j hunting#3888

Merged
v-rucdu merged 10 commits into
Azure:masterfrom
samikroy:patch-17
Jan 19, 2022
Merged

Adding a new workbook on Log4j hunting#3888
v-rucdu merged 10 commits into
Azure:masterfrom
samikroy:patch-17

Conversation

@samikroy
Copy link
Copy Markdown
Contributor

Change(s):

Azure-Sentinel/Workbooks/Log4jPostCompromiseHunting - A new workbook added with the following tabs
FindTrace - A lookup to curated IOCs across all sentinel tables.
SecurityNestedRecommendation - This section uses the Azure Defender Security Nested Recommendations data to find
machines vulnerable to log4j CVE-2021-44228. Log4j is an open-source Apache logging library that is used in many Java-
based applications. Security Nested Recommendations data is sent to Microsoft Sentinel using the continuous export
feature of Azure Defender
AzureDiagnostics - Azure Diagnostics
MultipleDataSources - Across multiple data sources
Syslog - From Syslog Sources

Azure-Sentinel/Workbooks/WorkbooksMetadata.json - To add workbook metadata.

Azure-Sentinel/Workbooks/Images/Logos - To add workbook logo.

Azure-Sentinel/Workbooks/Images/Preview - To add preview images.

Copy link
Copy Markdown
Contributor

@v-rucdu v-rucdu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@samikroy : I think you missed to add workbook.json here, can you please add it... Thanks!!

@aprakash13 aprakash13 added the Workbook Workbook specialty review needed label Jan 12, 2022
@samikroy
Copy link
Copy Markdown
Contributor Author

samikroy commented Jan 12, 2022

@samikroy : I think you missed to add workbook.json here, can you please add it... Thanks!!

@v-rucdu & @v-jayakal - Thank you for highlighting this.
Have added the files as requested.
Please let me know for further changes.

@samikroy samikroy requested a review from v-rucdu January 17, 2022 09:44
@v-rucdu
Copy link
Copy Markdown
Contributor

v-rucdu commented Jan 19, 2022

@samikroy : I think you missed to add workbook.json here, can you please add it... Thanks!!

@v-rucdu & @v-jayakal - Thank you for highlighting this. Have added the files as requested. Please let me know for further changes.

@samikroy : You have added the workbook.json under Workbooks-->Images folder, can you please delete and add it under Workbooks folder... and in solutions WorkbookMetadata.json is not required... please delete it... thanks!!!

@samikroy samikroy requested a review from ashishsyal as a code owner January 19, 2022 12:20
@samikroy
Copy link
Copy Markdown
Contributor Author

@samikroy : I think you missed to add workbook.json here, can you please add it... Thanks!!

@v-rucdu & @v-jayakal - Thank you for highlighting this. Have added the files as requested. Please let me know for further changes.

@samikroy : You have added the workbook.json under Workbooks-->Images folder, can you please delete and add it under Workbooks folder... and in solutions WorkbookMetadata.json is not required... please delete it... thanks!!!

Done.

@v-rucdu v-rucdu merged commit aeb8852 into Azure:master Jan 19, 2022
@samikroy
Copy link
Copy Markdown
Contributor Author

Thank you @v-rucdu for the approval & merge.

@samikroy samikroy deleted the patch-17 branch January 19, 2022 12:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Workbook Workbook specialty review needed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants