Azure-Sentinel icon indicating copy to clipboard operation
Azure-Sentinel copied to clipboard

On-Premises Exchange Security Configuration first commit

Open nlepagnez opened this issue 2 years ago • 19 comments

Change(s):

  • First PR of new solution "ESI - On-Premises Exchange Security Configuration" without package

Reason for Change(s):

  • Adding new REST API Connector with its parser and the first Workbook

Version Updated:

  • First version 1.0.0

Testing Completed:

  • Yes

Checked that the validations are passing and have addressed any issues that are present:

  • No

nlepagnez avatar Aug 30 '22 11:08 nlepagnez

CLA assistant check
All CLA requirements met.

ghost avatar Aug 30 '22 11:08 ghost

@v-spadarthi Can you please look into this

NikTripathi avatar Sep 08 '22 19:09 NikTripathi

@nlepagnez Parser query is falling please take a look and resolve it. thanks!!! image

v-marimanda avatar Sep 09 '22 09:09 v-marimanda

@nlepagnez Workbook query's is also failing could you please check it once. thanks!!! image

v-marimanda avatar Sep 09 '22 09:09 v-marimanda

@nlepagnez Parser query is falling please take a look and resolve it. thanks!!! image

Hi @v-marimanda, as you can read at the beginning of the parser, that you need to save the parser as a function called "ExchangeConfiguration" and this function has parameters. SpecificSectionList is one of the 4th parameters.

Also for the Workbook, the "ExchangeConfiguration" parser function is needed. If you have this error, it's because you didn't follow the installation steps and you didn't savce the parser as function.

I just added a new instruction part on Connectors to be more explicit than just the previous "Note".

nlepagnez avatar Sep 09 '22 10:09 nlepagnez

Hi @v-marimanda, @v-spadarthi, there is any update on that PR ?

nlepagnez avatar Sep 13 '22 07:09 nlepagnez

@nlepagnez I have followed all the steps you have mention on parser but i could only one sample data attached. I have used this sample data for ESIExchangeConfig_CL. can i use the same sample data for another table ESIExchangeOnlineConfig_CL, If not please provide sample data for ESIExchangeOnlineConfig_CL. Currently i am getting below error as i don't have any table with name ESIExchangeOnlineConfig_CL. image

v-marimanda avatar Sep 13 '22 11:09 v-marimanda

@v-marimanda, yes you can use the same content for the other table. But what you say is something interesting as we can have condition where one of the two tables doesn't exist and in this case, the parser has errors.

I have to work on the parser to see how to avoid that.

nlepagnez avatar Sep 13 '22 14:09 nlepagnez

@v-marimanda you can find an update of the parsers with the fuzzy mode to be able to be agnostic of missing tables.

This can allow you to be able to finish your tests.

nlepagnez avatar Sep 19 '22 21:09 nlepagnez

@nlepagnez thank for update we are checking ...

v-laanjana avatar Sep 23 '22 03:09 v-laanjana

@v-laanjana : Could you please provide an update on this.

v-spadarthi avatar Sep 28 '22 05:09 v-spadarthi

@v-laanjana : Could you please provide an update on this.

v-spadarthi avatar Sep 30 '22 06:09 v-spadarthi

Hi @v-laanjana, Did you get a chance to check on this. Can you please provide an update. Thanks

v-mchatla avatar Oct 04 '22 19:10 v-mchatla

@v-mchatla we are working ..

v-laanjana avatar Oct 07 '22 04:10 v-laanjana

Hi @v-laanjana this is a long pending one. Can you please have a look?

NikTripathi avatar Oct 07 '22 04:10 NikTripathi

Hi @nlepagnez,

I have save the parsers with parameter's and sending default value as well but still Workbook query's are failing can you please take a look once for your reference i am attaching screen shot below.

Workbook image

Parsers

image

v-marimanda avatar Oct 10 '22 09:10 v-marimanda

Hi @nlepagnez can you please address the above comment. thanks!!!

v-marimanda avatar Oct 12 '22 05:10 v-marimanda

Hi @nlepagnez can you please address the above comment. thanks!!!

Hi @v-marimanda, I think it's because the sample data are too old, as we can't use TimeGenerated for filtering but another property. How do you fill the sample data in your table ? I want to try in my side and be sure that the Sample data is correct before launching a new round.

nlepagnez avatar Oct 12 '22 15:10 nlepagnez

@v-marimanda, I have just updated Sample Data, Parser and Workbook so that they can show you results on potentially old "Sample" data (which will never be the case in normal use).

nlepagnez avatar Oct 13 '22 13:10 nlepagnez

Hi @nlepagnez, Thanks for sharing the sample data. We will check and provide more details once done. Thanks

v-mchatla avatar Oct 18 '22 20:10 v-mchatla

Hi @nlepagnez, Sorry for the delay. I'm going to start working on it today and provide you the update by EOD. Thanks

v-mchatla avatar Oct 21 '22 05:10 v-mchatla

Hi @nlepagnez, Sorry for the delay. I'm going to start working on it today and provide you the update by EOD. Thanks

@v-mchatla Perfect. Do not hesitate to ask me everything if you need.

nlepagnez avatar Oct 21 '22 06:10 nlepagnez

ExchangeConfiguration Parser is working fine Getting below issue for the other parser ESI_ExchConfigAvailableEnvironments image Can you please have a look at it and let me know if I'm missing something. Thanks

v-mchatla avatar Oct 25 '22 11:10 v-mchatla

ExchangeConfiguration Parser is working fine Getting below issue for the other parser ESI_ExchConfigAvailableEnvironments image Can you please have a look at it and let me know if I'm missing something. Thanks

Hi @v-mchatla, the error message indicates that the tables ESIExchangeConfig_CL and/or ESIExchangeOnlineConfig_CL are missing. Did you create one of them with sample data ?

nlepagnez avatar Oct 25 '22 22:10 nlepagnez

Hi @nlepagnez The data is getting reflected now. Yesterday I just ingested and tested may be data ingestion to log analytics is not completed by that time as it will take time. Now its working. image let me check workbook queries as well. Thanks

v-mchatla avatar Oct 26 '22 06:10 v-mchatla

Parsers are working fine. Need your help in fixing the below workbook related issues.

  1. Workbook should be of json format, please update it accordingly.
  2. Role Assignee dropdown should populate with some data but its not fetching any data while rendering the workbook page. image
  3. Getting below issue for ExchangeAdminAuditLogs image
  4. Workbook is referring data from watchlist (ExchCUSU), please share those watchlist data to test end to end. image
  5. server data is not rendering in the dropdown. image

Thanks

v-mchatla avatar Oct 26 '22 08:10 v-mchatla

@nlepagnez please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

  • (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
  • (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
Contributor License Agreement

Contribution License Agreement

This Contribution License Agreement (“Agreement”) is agreed to by the party signing below (“You”), and conveys certain license rights to Microsoft Corporation and its affiliates (“Microsoft”) for Your contributions to Microsoft open source projects. This Agreement is effective as of the latest signature date below.

  1. Definitions. “Code” means the computer software code, whether in human-readable or machine-executable form, that is delivered by You to Microsoft under this Agreement. “Project” means any of the projects owned or managed by Microsoft and offered under a license approved by the Open Source Initiative (www.opensource.org). “Submit” is the act of uploading, submitting, transmitting, or distributing code or other content to any Project, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Project for the purpose of discussing and improving that Project, but excluding communication that is conspicuously marked or otherwise designated in writing by You as “Not a Submission.” “Submission” means the Code and any other copyrightable material Submitted by You, including any associated comments and documentation.
  2. Your Submission. You must agree to the terms of this Agreement before making a Submission to any Project. This Agreement covers any and all Submissions that You, now or in the future (except as described in Section 4 below), Submit to any Project.
  3. Originality of Work. You represent that each of Your Submissions is entirely Your original work. Should You wish to Submit materials that are not Your original work, You may Submit them separately to the Project if You (a) retain all copyright and license information that was in the materials as You received them, (b) in the description accompanying Your Submission, include the phrase “Submission containing materials of a third party:” followed by the names of the third party and any licenses or other restrictions of which You are aware, and (c) follow any other instructions in the Project’s written guidelines concerning Submissions.
  4. Your Employer. References to “employer” in this Agreement include Your employer or anyone else for whom You are acting in making Your Submission, e.g. as a contractor, vendor, or agent. If Your Submission is made in the course of Your work for an employer or Your employer has intellectual property rights in Your Submission by contract or applicable law, You must secure permission from Your employer to make the Submission before signing this Agreement. In that case, the term “You” in this Agreement will refer to You and the employer collectively. If You change employers in the future and desire to Submit additional Submissions for the new employer, then You agree to sign a new Agreement and secure permission from the new employer before Submitting those Submissions.
  5. Licenses.
  • Copyright License. You grant Microsoft, and those who receive the Submission directly or indirectly from Microsoft, a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license in the Submission to reproduce, prepare derivative works of, publicly display, publicly perform, and distribute the Submission and such derivative works, and to sublicense any or all of the foregoing rights to third parties.
  • Patent License. You grant Microsoft, and those who receive the Submission directly or indirectly from Microsoft, a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license under Your patent claims that are necessarily infringed by the Submission or the combination of the Submission with the Project to which it was Submitted to make, have made, use, offer to sell, sell and import or otherwise dispose of the Submission alone or with the Project.
  • Other Rights Reserved. Each party reserves all rights not expressly granted in this Agreement. No additional licenses or rights whatsoever (including, without limitation, any implied licenses) are granted by implication, exhaustion, estoppel or otherwise.
  1. Representations and Warranties. You represent that You are legally entitled to grant the above licenses. You represent that each of Your Submissions is entirely Your original work (except as You may have disclosed under Section 3). You represent that You have secured permission from Your employer to make the Submission in cases where Your Submission is made in the course of Your work for Your employer or Your employer has intellectual property rights in Your Submission by contract or applicable law. If You are signing this Agreement on behalf of Your employer, You represent and warrant that You have the necessary authority to bind the listed employer to the obligations contained in this Agreement. You are not expected to provide support for Your Submission, unless You choose to do so. UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING, AND EXCEPT FOR THE WARRANTIES EXPRESSLY STATED IN SECTIONS 3, 4, AND 6, THE SUBMISSION PROVIDED UNDER THIS AGREEMENT IS PROVIDED WITHOUT WARRANTY OF ANY KIND, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTY OF NONINFRINGEMENT, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE.
  2. Notice to Microsoft. You agree to notify Microsoft in writing of any facts or circumstances of which You later become aware that would make Your representations in this Agreement inaccurate in any respect.
  3. Information about Submissions. You agree that contributions to Projects and information about contributions may be maintained indefinitely and disclosed publicly, including Your name and other information that You submit with Your Submission.
  4. Governing Law/Jurisdiction. This Agreement is governed by the laws of the State of Washington, and the parties consent to exclusive jurisdiction and venue in the federal courts sitting in King County, Washington, unless no federal subject matter jurisdiction exists, in which case the parties consent to exclusive jurisdiction and venue in the Superior Court of King County, Washington. The parties waive all defenses of lack of personal jurisdiction and forum non-conveniens.
  5. Entire Agreement/Assignment. This Agreement is the entire agreement between the parties, and supersedes any and all prior agreements, understandings or communications, written or oral, between the parties relating to the subject matter hereof. This Agreement may be assigned by Microsoft.

Parsers are working fine. Need your help in fixing the below workbook related issues.

  1. Workbook should be of json format, please update it accordingly.
  2. Role Assignee dropdown should populate with some data but its not fetching any data while rendering the workbook page. image
  3. Getting below issue for ExchangeAdminAuditLogs image
  4. Workbook is referring data from watchlist (ExchCUSU), please share those watchlist data to test end to end. image
  5. server data is not rendering in the dropdown. image

Thanks

Hi @v-mchatla,

  • For the point 1, I transformed the Workbook to JSON Extension file.
  • For the point 2 and 5, with gave you a sample data file but with only 2 to 3 entries. There are many and many entries from a production environment and Workbooks are made to display Real production data. I update the sample data with a complete simulated infrastructure data file.
  • For the point 3, we removed the part calling ExchangeAdminAuditLogs that is planned for a V2 of this solution package, we want to validate a simple V1 version before adding all connectors, workbooks, analytic rules, etc..
  • For the point 4, sorry, we have changed our strategy since August on how we want to manage this list. The new version of the Workbook that I commit reflect that.

I hope this new commit will be good for you.

nlepagnez avatar Oct 26 '22 20:10 nlepagnez

Hi @nlepagnez, With the Latest sample data Role Assignee details are auto populated. But help page is not rendering any data. Is that okay? image Rest all things looks good. Please fix the validation errors to proceed with approval and merge. Hope the below clues can help you in resolving the validation errors.

  1. should not contain hardcoded values. image
  2. should not contain reference to any resources. image

v-mchatla avatar Oct 27 '22 11:10 v-mchatla

@v-mchatla,

I removed the hardcoded values and commit the new version.

For the Help page, it's added, it was planned for a future version, in August.

nlepagnez avatar Oct 27 '22 12:10 nlepagnez

@nlepagnez please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

  • (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
  • (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.

Contributor License Agreement

Can you please respond to this with your company details

v-mchatla avatar Oct 27 '22 12:10 v-mchatla