Azure-Sentinel
Azure-Sentinel copied to clipboard
On-Premises Exchange Security Configuration first commit
Change(s):
- First PR of new solution "ESI - On-Premises Exchange Security Configuration" without package
Reason for Change(s):
- Adding new REST API Connector with its parser and the first Workbook
Version Updated:
- First version 1.0.0
Testing Completed:
- Yes
Checked that the validations are passing and have addressed any issues that are present:
- No
@v-spadarthi Can you please look into this
@nlepagnez Parser query is falling please take a look and resolve it. thanks!!!
@nlepagnez Workbook query's is also failing could you please check it once. thanks!!!
@nlepagnez Parser query is falling please take a look and resolve it. thanks!!!
Hi @v-marimanda, as you can read at the beginning of the parser, that you need to save the parser as a function called "ExchangeConfiguration" and this function has parameters. SpecificSectionList is one of the 4th parameters.
Also for the Workbook, the "ExchangeConfiguration" parser function is needed. If you have this error, it's because you didn't follow the installation steps and you didn't savce the parser as function.
I just added a new instruction part on Connectors to be more explicit than just the previous "Note".
Hi @v-marimanda, @v-spadarthi, there is any update on that PR ?
@nlepagnez I have followed all the steps you have mention on parser but i could only one sample data attached.
I have used this sample data for ESIExchangeConfig_CL. can i use the same sample data for another table ESIExchangeOnlineConfig_CL, If not please provide sample data for ESIExchangeOnlineConfig_CL. Currently i am getting below error as i don't have any table with name ESIExchangeOnlineConfig_CL.
@v-marimanda, yes you can use the same content for the other table. But what you say is something interesting as we can have condition where one of the two tables doesn't exist and in this case, the parser has errors.
I have to work on the parser to see how to avoid that.
@v-marimanda you can find an update of the parsers with the fuzzy mode to be able to be agnostic of missing tables.
This can allow you to be able to finish your tests.
@nlepagnez thank for update we are checking ...
@v-laanjana : Could you please provide an update on this.
@v-laanjana : Could you please provide an update on this.
Hi @v-laanjana, Did you get a chance to check on this. Can you please provide an update. Thanks
@v-mchatla we are working ..
Hi @v-laanjana this is a long pending one. Can you please have a look?
Hi @nlepagnez,
I have save the parsers with parameter's and sending default value as well but still Workbook query's are failing can you please take a look once for your reference i am attaching screen shot below.
Workbook
Parsers
Hi @nlepagnez can you please address the above comment. thanks!!!
Hi @nlepagnez can you please address the above comment. thanks!!!
Hi @v-marimanda, I think it's because the sample data are too old, as we can't use TimeGenerated for filtering but another property. How do you fill the sample data in your table ? I want to try in my side and be sure that the Sample data is correct before launching a new round.
@v-marimanda, I have just updated Sample Data, Parser and Workbook so that they can show you results on potentially old "Sample" data (which will never be the case in normal use).
Hi @nlepagnez, Thanks for sharing the sample data. We will check and provide more details once done. Thanks
Hi @nlepagnez, Sorry for the delay. I'm going to start working on it today and provide you the update by EOD. Thanks
Hi @nlepagnez, Sorry for the delay. I'm going to start working on it today and provide you the update by EOD. Thanks
@v-mchatla Perfect. Do not hesitate to ask me everything if you need.
ExchangeConfiguration Parser is working fine
Getting below issue for the other parser ESI_ExchConfigAvailableEnvironments
Can you please have a look at it and let me know if I'm missing something.
Thanks
ExchangeConfiguration Parser is working fine Getting below issue for the other parser ESI_ExchConfigAvailableEnvironments
Can you please have a look at it and let me know if I'm missing something. Thanks
Hi @v-mchatla, the error message indicates that the tables ESIExchangeConfig_CL and/or ESIExchangeOnlineConfig_CL are missing. Did you create one of them with sample data ?
Hi @nlepagnez
The data is getting reflected now. Yesterday I just ingested and tested may be data ingestion to log analytics is not completed by that time as it will take time. Now its working.
let me check workbook queries as well.
Thanks
Parsers are working fine. Need your help in fixing the below workbook related issues.
- Workbook should be of json format, please update it accordingly.
- Role Assignee dropdown should populate with some data but its not fetching any data while rendering the workbook page.
- Getting below issue for ExchangeAdminAuditLogs
- Workbook is referring data from watchlist (ExchCUSU), please share those watchlist data to test end to end.
- server data is not rendering in the dropdown.
Thanks
@nlepagnez please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
@microsoft-github-policy-service agree [company="{your company}"]
Options:
- (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
- (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
Contributor License Agreement
Contribution License Agreement
This Contribution License Agreement (“Agreement”) is agreed to by the party signing below (“You”), and conveys certain license rights to Microsoft Corporation and its affiliates (“Microsoft”) for Your contributions to Microsoft open source projects. This Agreement is effective as of the latest signature date below.
- Definitions. “Code” means the computer software code, whether in human-readable or machine-executable form, that is delivered by You to Microsoft under this Agreement. “Project” means any of the projects owned or managed by Microsoft and offered under a license approved by the Open Source Initiative (www.opensource.org). “Submit” is the act of uploading, submitting, transmitting, or distributing code or other content to any Project, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Project for the purpose of discussing and improving that Project, but excluding communication that is conspicuously marked or otherwise designated in writing by You as “Not a Submission.” “Submission” means the Code and any other copyrightable material Submitted by You, including any associated comments and documentation.
- Your Submission. You must agree to the terms of this Agreement before making a Submission to any Project. This Agreement covers any and all Submissions that You, now or in the future (except as described in Section 4 below), Submit to any Project.
- Originality of Work. You represent that each of Your Submissions is entirely Your original work. Should You wish to Submit materials that are not Your original work, You may Submit them separately to the Project if You (a) retain all copyright and license information that was in the materials as You received them, (b) in the description accompanying Your Submission, include the phrase “Submission containing materials of a third party:” followed by the names of the third party and any licenses or other restrictions of which You are aware, and (c) follow any other instructions in the Project’s written guidelines concerning Submissions.
- Your Employer. References to “employer” in this Agreement include Your employer or anyone else for whom You are acting in making Your Submission, e.g. as a contractor, vendor, or agent. If Your Submission is made in the course of Your work for an employer or Your employer has intellectual property rights in Your Submission by contract or applicable law, You must secure permission from Your employer to make the Submission before signing this Agreement. In that case, the term “You” in this Agreement will refer to You and the employer collectively. If You change employers in the future and desire to Submit additional Submissions for the new employer, then You agree to sign a new Agreement and secure permission from the new employer before Submitting those Submissions.
- Licenses.
- Copyright License. You grant Microsoft, and those who receive the Submission directly or indirectly from Microsoft, a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license in the Submission to reproduce, prepare derivative works of, publicly display, publicly perform, and distribute the Submission and such derivative works, and to sublicense any or all of the foregoing rights to third parties.
- Patent License. You grant Microsoft, and those who receive the Submission directly or indirectly from Microsoft, a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license under Your patent claims that are necessarily infringed by the Submission or the combination of the Submission with the Project to which it was Submitted to make, have made, use, offer to sell, sell and import or otherwise dispose of the Submission alone or with the Project.
- Other Rights Reserved. Each party reserves all rights not expressly granted in this Agreement. No additional licenses or rights whatsoever (including, without limitation, any implied licenses) are granted by implication, exhaustion, estoppel or otherwise.
- Representations and Warranties. You represent that You are legally entitled to grant the above licenses. You represent that each of Your Submissions is entirely Your original work (except as You may have disclosed under Section 3). You represent that You have secured permission from Your employer to make the Submission in cases where Your Submission is made in the course of Your work for Your employer or Your employer has intellectual property rights in Your Submission by contract or applicable law. If You are signing this Agreement on behalf of Your employer, You represent and warrant that You have the necessary authority to bind the listed employer to the obligations contained in this Agreement. You are not expected to provide support for Your Submission, unless You choose to do so. UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING, AND EXCEPT FOR THE WARRANTIES EXPRESSLY STATED IN SECTIONS 3, 4, AND 6, THE SUBMISSION PROVIDED UNDER THIS AGREEMENT IS PROVIDED WITHOUT WARRANTY OF ANY KIND, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTY OF NONINFRINGEMENT, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE.
- Notice to Microsoft. You agree to notify Microsoft in writing of any facts or circumstances of which You later become aware that would make Your representations in this Agreement inaccurate in any respect.
- Information about Submissions. You agree that contributions to Projects and information about contributions may be maintained indefinitely and disclosed publicly, including Your name and other information that You submit with Your Submission.
- Governing Law/Jurisdiction. This Agreement is governed by the laws of the State of Washington, and the parties consent to exclusive jurisdiction and venue in the federal courts sitting in King County, Washington, unless no federal subject matter jurisdiction exists, in which case the parties consent to exclusive jurisdiction and venue in the Superior Court of King County, Washington. The parties waive all defenses of lack of personal jurisdiction and forum non-conveniens.
- Entire Agreement/Assignment. This Agreement is the entire agreement between the parties, and supersedes any and all prior agreements, understandings or communications, written or oral, between the parties relating to the subject matter hereof. This Agreement may be assigned by Microsoft.
Parsers are working fine. Need your help in fixing the below workbook related issues.
- Workbook should be of json format, please update it accordingly.
- Role Assignee dropdown should populate with some data but its not fetching any data while rendering the workbook page.
![]()
- Getting below issue for ExchangeAdminAuditLogs
![]()
- Workbook is referring data from watchlist (ExchCUSU), please share those watchlist data to test end to end.
![]()
- server data is not rendering in the dropdown.
![]()
Thanks
Hi @v-mchatla,
- For the point 1, I transformed the Workbook to JSON Extension file.
- For the point 2 and 5, with gave you a sample data file but with only 2 to 3 entries. There are many and many entries from a production environment and Workbooks are made to display Real production data. I update the sample data with a complete simulated infrastructure data file.
- For the point 3, we removed the part calling ExchangeAdminAuditLogs that is planned for a V2 of this solution package, we want to validate a simple V1 version before adding all connectors, workbooks, analytic rules, etc..
- For the point 4, sorry, we have changed our strategy since August on how we want to manage this list. The new version of the Workbook that I commit reflect that.
I hope this new commit will be good for you.
Hi @nlepagnez,
With the Latest sample data Role Assignee details are auto populated. But help page is not rendering any data. Is that okay?
Rest all things looks good.
Please fix the validation errors to proceed with approval and merge.
Hope the below clues can help you in resolving the validation errors.
- should not contain hardcoded values.
- should not contain reference to any resources.
@v-mchatla,
I removed the hardcoded values and commit the new version.
For the Help page, it's added, it was planned for a future version, in August.
@nlepagnez please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
@microsoft-github-policy-service agree [company="{your company}"]
Options:
- (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
- (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
Contributor License Agreement
Can you please respond to this with your company details