Skip to content

ACNCD_DataConnectors_final#767

Merged
preetikr merged 6 commits into
masterfrom
unknown repository
Jul 7, 2020
Merged

ACNCD_DataConnectors_final#767
preetikr merged 6 commits into
masterfrom
unknown repository

Conversation

@ghost
Copy link
Copy Markdown

@ghost ghost commented Jun 19, 2020

Fixes #

Proposed Changes

  • Sophos XG Firewall
  • Okta SSO
  • All previous 4 syslog connector Detections modified
  • Pulse Connect Secure parser update

@ghost
Copy link
Copy Markdown
Author

ghost commented Jun 19, 2020

Re-submission of ACNCD_DataConnectors_sub3 #750 (#750) -- (will delete), due to significant changes from previous PR (#729) approval/merge.

@shainw -- I went back and made modifications to the (4) previously submitted Syslog detections rules to accommodate for threshold variables, bin_TimeGenerated, and dataTypes.

@preetikr
Copy link
Copy Markdown
Contributor

preetikr commented Jun 19, 2020

@chicduong - @shainw and I'll review this PR and skip reviewing PR #750 - that's ok right?

@ghost
Copy link
Copy Markdown
Author

ghost commented Jun 22, 2020

@preetikr - I'm good with that. I'll wait on @shainw 's confirmation before deleting the previous PR

shainw
shainw requested changes Jun 26, 2020
View reviewed changes
Copy link
Copy Markdown
Contributor

@shainw shainw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some minor fixes before I can approve. :)

Comment thread Detections/InfobloxNIOS/PotentialDHCPStarvationAttack.yaml
Comment thread Detections/InfobloxNIOS/ExcessiveNXDOMAINDNSQueries.yaml Outdated
@shainw shainw mentioned this pull request Jun 26, 2020
Closed
preetikr
preetikr suggested changes Jun 29, 2020
View reviewed changes
Copy link
Copy Markdown
Contributor

@preetikr preetikr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In addition,

  1. Sample Data/Custom/SophosXGFirewall.json has the hostname and host IP having the same values. Can you check if the parser is formatting the same output to both fields as the host name should be different from the IP? Also please fix the sample file for this after fixing (if needed) the parser.

Comment thread DataConnectors/Okta Single Sign-On/azuredeploy_OktaSingleSignOn_API_FunctionApp.json Outdated
Comment thread DataConnectors/Okta Single Sign-On/Connector_REST_API_FunctionApp_Okta.json Outdated
Comment thread DataConnectors/Okta Single Sign-On/Connector_REST_API_FunctionApp_Okta.json Outdated
Comment thread DataConnectors/Sophos XG Firewall/Connector_Syslog_SophosXGFirewall.json Outdated
Comment thread DataConnectors/Sophos XG Firewall/Connector_Syslog_SophosXGFirewall.json Outdated
Comment thread Detections/SymantecVIP/ExcessiveFailedAuthenticationsfromInvalidInputs.yaml Outdated
Comment thread Workbooks/Images/Logos/okta_logo.svg Outdated
Comment thread Workbooks/Images/Logos/sophos_logo.svg Outdated
Comment thread Logos/sophos_logo.svg Outdated
Comment thread Logos/okta_logo.svg Outdated
shainw
shainw requested changes Jun 29, 2020
View reviewed changes
Copy link
Copy Markdown
Contributor

@shainw shainw left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@chicduong - In general, all the dataTypes specified should match your JSON dataType value. Most of these should be Syslog, some are your custom Okta_CL which is fine.

Also, these can get a bit confusing because of their number of files and the details in each. I would suggest in the future to submit a PR for each data connector and detections for that data connector. :)

ghost
ghost commented Jun 30, 2020
View reviewed changes
Copy link
Copy Markdown
Author

@ghost ghost left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@shainw As mentioned above, I'm confused on this, because based on our discussion in PR #750 (#750) the Dataypes should be the name of the table, since these alerts depend on a Kusto Function that would make the table name SymantecVIP instead of Syslog.

They dataTypes value in the JSON are currently listed as Syslog (SymantecVIP), Syslog (Infoblox) and so forth, is this incorrect? Should it be either SymantecVIP or Syslog?

@ghost
Copy link
Copy Markdown
Author

ghost commented Jul 1, 2020

@shainw I wanted to follow up on the comments I provided above.

preetikr
preetikr suggested changes Jul 1, 2020
View reviewed changes
Comment thread DataConnectors/Sophos XG Firewall/Connector_Syslog_SophosXGFirewall.json Outdated
Comment thread DataConnectors/Sophos XG Firewall/Connector_Syslog_SophosXGFirewall.json Outdated
Comment thread Detections/InfobloxNIOS/ExcessiveNXDOMAINDNSQueries.yaml Outdated
- connectorId: InfobloxNIOS
dataTypes:
- Syslog
- InfobloxNIOS
Copy link
Copy Markdown
Contributor

@preetikr preetikr Jul 1, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@chicduong - leave this as dataType Syslog - this change can be dropped from the PR.

Comment thread Detections/InfobloxNIOS/PotentialDHCPStarvationAttack.yaml Outdated
- connectorId: InfobloxNIOS
dataTypes:
- Syslog
- InfobloxNIOS
Copy link
Copy Markdown
Contributor

@preetikr preetikr Jul 1, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@chicduong - leave this as dataType Syslog - this change can be dropped from the PR.

Comment thread Detections/PulseConnectSecure/LargeNumberofDistinctFailedUserLogins.yaml Outdated
- connectorId: PulseConnectSecure
dataTypes:
- Syslog
- PulseConnectSecure
Copy link
Copy Markdown
Contributor

@preetikr preetikr Jul 1, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@chicduong - leave this as dataType Syslog - this change can be dropped from the PR.

Comment thread Detections/SophosXGFirewall/PortScanDetected.yaml Outdated
requiredDataConnectors:
- connectorId: SophosXGFirewall
dataTypes:
- SophosXGFirewall
Copy link
Copy Markdown
Contributor

@preetikr preetikr Jul 1, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@chicduong - change this as dataType Syslog

Comment thread Detections/SymantecProxySG/ExcessiveDeniedProxyTraffic.yaml Outdated
- connectorId: SymantecProxySG
dataTypes:
- Syslog
- SymantecProxySG
Copy link
Copy Markdown
Contributor

@preetikr preetikr Jul 1, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@chicduong - change this as dataType Syslog - drop this change from the PR

Comment thread Detections/SymantecProxySG/UserAccessedSuspiciousURLCategories.yaml Outdated
- connectorId: SymantecProxySG
dataTypes:
- Syslog
- SymantecProxySG
Copy link
Copy Markdown
Contributor

@preetikr preetikr Jul 1, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@chicduong - this should be dataType Syslog

Comment thread Detections/SymantecVIP/ClientDeniedAccess.yaml Outdated
- connectorId: SymantecVIP
dataTypes:
- Syslog
- SymantecVIP
Copy link
Copy Markdown
Contributor

@preetikr preetikr Jul 1, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@chicduong - this dataType should be Syslog - drop this change from the PR

Comment thread Detections/SymantecVIP/ExcessiveFailedAuthenticationsfromInvalidInputs.yaml Outdated
@preetikr preetikr merged commit 32f9b39 into Azure:master Jul 7, 2020
@ghost ghost deleted the acn_cd_connectorfinal branch July 7, 2020 23:06
This was referenced Mar 11, 2022
Open
Open
Open
This was referenced Mar 29, 2022
Open
Open
Open
Open
@GrandmasterCJ GrandmasterCJ mentioned this pull request Oct 5, 2022
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Amitbergman Amitbergman Awaiting requested review from Amitbergman

@dicolanl dicolanl Awaiting requested review from dicolanl

@ianhelle ianhelle Awaiting requested review from ianhelle

@juliango2100 juliango2100 Awaiting requested review from juliango2100

@KobyKoren KobyKoren Awaiting requested review from KobyKoren

@liemilyg liemilyg Awaiting requested review from liemilyg

@mgladi mgladi Awaiting requested review from mgladi

@morshabi morshabi Awaiting requested review from morshabi

@orco365 orco365 Awaiting requested review from orco365

@sagamzu sagamzu Awaiting requested review from sagamzu

@timbMSFT timbMSFT Awaiting requested review from timbMSFT

@YaronFruchtmann YaronFruchtmann Awaiting requested review from YaronFruchtmann

Assignees

@preetikr preetikr

@shainw shainw

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@preetikr @shainw