Cohesity security

[yinghuang123]

Change(s):

• add cohesity security solution and build related stuffs.

Reason for Change(s):

• add cohesity security solution package

Testing Completed:

• Need Help

Checked that the validations are passing and have addressed any issues that are present:

• Yes

[kishannerella]

@v-sabiraj We have added the deployment packaged as suggested. Please take a look.

[v-rucdu]

@yinghuang123: This file does not need to be checked-in to master, instead you are already maintaining a copy of it under Solution/Data folder. So, please delete this file from PR.

[kishannerella]

Deleted.

[v-rucdu]

@yinghuang123: Please update the version value to 2.0.0 and regenerate the solution package. Asking to change this as our system expects the initial version for these types of solutions to be starting from 2.0.0.

[kishannerella]

Done.

[v-rucdu]

@yinghuang123 : Please use the link that would be pointing to the master of Azure Sentinel repo instead of your forked repo
e.g. For One Azure function
Current: https://github.com/cohesity/Azure-Sentinel/tree/CohesitySecurity.internal/Solutions/CohesitySecurity/Data%20Connectors/Helios2Sentinel/IncidentProducer

Expected: https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CohesitySecurity/Data%20Connectors/Helios2Sentinel/IncidentProducer

[kishannerella]

Done.

[v-rucdu]

@yinghuang123 : Both the links are pointing to same Azure Function code, is that intended? Please check and update both the function links accordingly

[kishannerella]

Fixed. Thanks for pointing it out.

[v-rucdu]

@yinghuang123 : Same as above, the url should point to master branch of Azure Sentinel repo, instead of your forked repo. Please update here as well as all places in this file

[kishannerella]

I have changed these URLs in all the places in the code. We were hoping to do this after PR approval as many of these links are not going to valid till PR is approved. But changed all of them now.

[v-rucdu]

@yinghuang123: In the manual deployment steps you are asking the author to clone entire Sentinel Repo, which we feel is not correct. Instead, you can refer instructions from other function app-based connectors to do the manual deployment and update them as needed. Also, please make sure all these urls are updated and pointing to Azure-Sentinel repo master branch.

For Your Reference: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Agari/Data%20Connectors/Agari_API_FunctionApp.json

[kishannerella]

We have removed the manual option as it's getting too complicated to list down all the required steps as we require creation of storage accounts, key vaults, providing many permissions before even starting to compilation. One other issue is that we require keyvault with a specific name to be present which is dependent on ARM template function which maybe difficult for the user to generate. For these reasons, we have removed the manual option.

[v-rucdu]

@yinghuang123 : this url also needs to be pointing to Azure Sentinel --> Master branch

[kishannerella]

Done.

[v-rucdu]

@yinghuang123 : Please use https://aka.ms/sentinel-Cohesity-functionapp-IncidentProducer short url instead of hardcoded url pointing to your forked repo

[kishannerella]

At this point, this shortened URL still points to our internal branch. Hope this will be changed to Azure master branch.

[v-rucdu]

@yinghuang123 : please use below short url for website_run_frompackage path https://aka.ms/sentinel-Cohesity-functionapp-IncidentConsumer

[kishannerella]

At this point, this shortened URL still points to our internal branch. Hope this will be changed to Azure master branch.

[v-sabiraj]

@kishannerella, yes.

Author deleted the analytic rules from this PR

[v-sabiraj]

@yinghuang123/ @kishannerella, can you please check and confirm on the support information? Should it be of cohesity?

[eerus]

@v-sabiraj , that's what we originally thought, too but we were getting an error in one of the tools when we changed it to Cohesity.
That's why we followed the example that was suggested earlier in this thread (see https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoUmbrella/SolutionMetadata.json) and did the same as Cisco Umbrella, which eliminated the error.

{
	"publisherId": "azuresentinel",
	"offerId": "azure-sentinel-solution-ciscoumbrella",
	"firstPublishDate": "2022-04-01",
	"providers": [ "Cisco" ],
	"categories": {
		"domains": [ "Security - Cloud Security", "Security - Automation (SOAR)" ],
		"verticals": []
	},
	"support": {
		"tier": "Microsoft",
		"name": "Microsoft Corporation",
		"email": "support@microsoft.com",
		"link": "https://support.microsoft.com/"
	}

[v-sabiraj]

Can you please check changing that, we will check on the error, thanks.

[eerus]

@v-sabiraj , we retested, and now the package tool doesn't give an error. So, we put Cohesity info.

[v-sabiraj]

Package looks fine and is getting deployed successfully. Please check and confirm on the support information. Thanks.

[v-sabiraj]

@yinghuang123/ @eerus, the recent package created is with version v1 tool of solution, can you please create package using this tool script ?

[eerus]

@v-sabiraj , ok. Please check now.

[v-sabiraj]

@yinghuang123 / @eerus, hope the function app is running well, as I don't have correct credentials I am getting unauthorized error and other errors as in image.

[v-sabiraj]

@yinghuang123 / @eerus / @kishannerella, everything looks good. Can you please share the latest invocation logs of the running function app, thanks.

[v-sabiraj]

The function app looks good as well.