Azure-Sentinel icon indicating copy to clipboard operation
Azure-Sentinel copied to clipboard

feat(imAuthSigninsMultipleCountries): include countries, ip, whitelist

Open hazcod opened this issue 3 years ago • 5 comments

Change(s):

  • This adds countries & IPs columns
  • Allows user to specify an IP whitelist to exclude entries

Reason for Change(s):

  • See guidance below

Version Updated:

  • imAuthSigninsMultipleCountries 1.3.2

hazcod avatar Nov 17 '22 08:11 hazcod

@hazcod : Please fix the below validation errors image

v-spadarthi avatar Nov 21 '22 10:11 v-spadarthi

@v-spadarthi odd, since it works in Sentinel. Can you replicate on your (test) Sentinel env?

hazcod avatar Nov 21 '22 10:11 hazcod

Hi @hazcod, so a few points:

  • The validation error is indeed not your fault. The schema was updated to use SrcIpAddr instead of SrcDvcIpAddr, but the validation has not.
  • That said, you also use SrcDvcIpAddr in the query, so once I update the validation, the query will fail (this time correctly) on SrcDvcIpAddr.

All that said, while the update is great and useful, I tend to prefer not to include the new version in the out of the box rules. Out of the box rules do not lend themselves well to "in rule", undocumented, configuration. Sound like a good idea for a blog post rather than a built-in rule.

oshezaf avatar Nov 21 '22 10:11 oshezaf

Hi @oshezaf , thank you for chiming in. I've converted it to SrcIpAddr now. Can you elaborate on what you mean with 'in rule' undocumented configuration, since I did not add any of that? I merely added some query columns which are returned.

hazcod avatar Nov 23 '22 14:11 hazcod

Well, apologies for not explaining myself well. I meant "ipWhitelist", the dynamic value that one can update in the rule. Unrelatedly, In general, note that we prefer "ipAllowlist".

oshezaf avatar Nov 23 '22 15:11 oshezaf

Hi @hazcod, could you please check @devikamehra's comment and act accordingly. Thank you.

v-atulyadav avatar Jun 20 '23 08:06 v-atulyadav

Hi @hazcod, waiting for your response on @devikamehra's comment. Thanks

v-atulyadav avatar Jun 27 '23 05:06 v-atulyadav

Hi @hazcod, I look forward to hearing back from you. Thanks

v-atulyadav avatar Jul 05 '23 05:07 v-atulyadav

Hi @hazcod, waiting for your response on comment. Thanks

v-atulyadav avatar Jul 11 '23 09:07 v-atulyadav

Hi @hazcod, waiting for your response on @devikamehra's comment. Thanks

v-atulyadav avatar Jul 13 '23 09:07 v-atulyadav

I've added the comment from @oshezaf too.

hazcod avatar Jul 13 '23 10:07 hazcod

Hi @hazcod, we will provide you with an update on this soon, but in the meantime, can you please resolve branch conflicts by updating master in your branch? Thanks

v-atulyadav avatar Jul 24 '23 05:07 v-atulyadav

Thanks @devikamehra. @hazcod please resolve branch conflicts by updating master in your branch.

v-atulyadav avatar Jul 26 '23 04:07 v-atulyadav

Hi @hazcod, please resolve branch conflicts. Thanks

v-atulyadav avatar Jul 27 '23 17:07 v-atulyadav