diff --git a/Solutions/GitHub/Data Connectors/GitHubAuditLogs_CCF/GitHubAuditLogs_PollerConfig.json b/Solutions/GitHub/Data Connectors/GitHubAuditLogs_CCF/GitHubAuditLogs_PollerConfig.json index 4ca80fbcd03..233f5cdc708 100644 --- a/Solutions/GitHub/Data Connectors/GitHubAuditLogs_CCF/GitHubAuditLogs_PollerConfig.json +++ b/Solutions/GitHub/Data Connectors/GitHubAuditLogs_CCF/GitHubAuditLogs_PollerConfig.json @@ -37,7 +37,7 @@ "rateLimitQPS": 50, "queryWindowInMin": 15, "httpMethod": "GET", - "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ss'Z'", "retryCount": 2, "timeoutInSeconds": 60, "headers": { diff --git a/Solutions/GitHub/Package/3.5.2.zip b/Solutions/GitHub/Package/3.5.2.zip new file mode 100644 index 00000000000..daa7745358b Binary files /dev/null and b/Solutions/GitHub/Package/3.5.2.zip differ diff --git a/Solutions/GitHub/Package/mainTemplate.json b/Solutions/GitHub/Package/mainTemplate.json index a65afdb85a8..d8799a1c876 100644 --- a/Solutions/GitHub/Package/mainTemplate.json +++ b/Solutions/GitHub/Package/mainTemplate.json @@ -63,7 +63,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "GitHub", - "_solutionVersion": "3.5.1", + "_solutionVersion": "3.5.2", "solutionId": "microsoftcorporation1622712991604.sentinel4github", "_solutionId": "[variables('solutionId')]", "workbookVersion1": "1.0.1", @@ -222,7 +222,7 @@ "_parserName1": "[concat(parameters('workspace'),'/','GitHubAuditData')]", "_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'GitHubAuditData')]", "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('GitHubAuditData-Parser')))]", - "parserVersion1": "1.1.0", + "parserVersion1": "1.2.0", "parserContentId1": "GitHubAuditData-Parser" }, "parserObject2": { @@ -253,13 +253,12 @@ "parserVersion5": "1.0.0", "parserContentId5": "githubscanaudit-Parser" }, - "dataConnectorCCPVersion": "3.5.1", + "dataConnectorCCPVersion": "3.5.2", "_dataConnectorContentIdConnectorDefinition1": "GitHubAuditBlobConnector", "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]", "_dataConnectorContentIdConnections1": "GitHubAuditBlobConnectorConnections", "dataConnectorTemplateNameConnections1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections1')))]", "DataCollectionEndpointId1": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]", - "blanks": "[replace('b', 'b', '')]", "_dataConnectorContentIdConnectorDefinition2": "GitHubAuditDefinitionV2", "dataConnectorTemplateNameConnectorDefinition2": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition2')))]", "_dataConnectorContentIdConnections2": "GitHubAuditDefinitionV2Connections", @@ -304,7 +303,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHubAdvancedSecurity Workbook with template version 3.5.1", + "description": "GitHubAdvancedSecurity Workbook with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -392,7 +391,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHub Workbook with template version 3.5.1", + "description": "GitHub Workbook with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion2')]", @@ -480,7 +479,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHub - A payment method was removed_AnalyticalRules Analytics Rule with template version 3.5.1", + "description": "GitHub - A payment method was removed_AnalyticalRules Analytics Rule with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -515,21 +514,21 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Actor" + "columnName": "Actor", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "AccountName" + "columnName": "AccountName", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "AccountUPNSuffix" + "columnName": "AccountUPNSuffix", + "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ] } @@ -585,7 +584,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHub - Activities from Infrequent Country_AnalyticalRules Analytics Rule with template version 3.5.1", + "description": "GitHub - Activities from Infrequent Country_AnalyticalRules Analytics Rule with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -620,21 +619,21 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Actor" + "columnName": "Actor", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "AccountName" + "columnName": "AccountName", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "AccountUPNSuffix" + "columnName": "AccountUPNSuffix", + "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ] } @@ -690,7 +689,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHub - Oauth application - a client secret was removed_AnalyticalRules Analytics Rule with template version 3.5.1", + "description": "GitHub - Oauth application - a client secret was removed_AnalyticalRules Analytics Rule with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -725,21 +724,21 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Actor" + "columnName": "Actor", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "AccountName" + "columnName": "AccountName", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "AccountUPNSuffix" + "columnName": "AccountUPNSuffix", + "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ] } @@ -795,7 +794,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHub - Repository was created_AnalyticalRules Analytics Rule with template version 3.5.1", + "description": "GitHub - Repository was created_AnalyticalRules Analytics Rule with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -830,21 +829,21 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Actor" + "columnName": "Actor", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "AccountName" + "columnName": "AccountName", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "AccountUPNSuffix" + "columnName": "AccountUPNSuffix", + "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ] } @@ -900,7 +899,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHub - Repository was destroyed_AnalyticalRules Analytics Rule with template version 3.5.1", + "description": "GitHub - Repository was destroyed_AnalyticalRules Analytics Rule with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -935,21 +934,21 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Actor" + "columnName": "Actor", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "AccountName" + "columnName": "AccountName", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "AccountUPNSuffix" + "columnName": "AccountUPNSuffix", + "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ] } @@ -1005,7 +1004,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHub - Two Factor Authentication Disabled in GitHub_AnalyticalRules Analytics Rule with template version 3.5.1", + "description": "GitHub - Two Factor Authentication Disabled in GitHub_AnalyticalRules Analytics Rule with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -1040,21 +1039,21 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Actor" + "columnName": "Actor", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ] } @@ -1110,7 +1109,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHub - User visibility Was changed_AnalyticalRules Analytics Rule with template version 3.5.1", + "description": "GitHub - User visibility Was changed_AnalyticalRules Analytics Rule with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -1145,21 +1144,21 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Actor" + "columnName": "Actor", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ] } @@ -1215,7 +1214,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHub - User was added to the organization_AnalyticalRules Analytics Rule with template version 3.5.1", + "description": "GitHub - User was added to the organization_AnalyticalRules Analytics Rule with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -1250,21 +1249,21 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Actor" + "columnName": "Actor", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ] } @@ -1320,7 +1319,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHub - User was blocked_AnalyticalRules Analytics Rule with template version 3.5.1", + "description": "GitHub - User was blocked_AnalyticalRules Analytics Rule with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -1355,21 +1354,21 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Actor" + "columnName": "Actor", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ] } @@ -1425,7 +1424,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHub - User was invited to the repository_AnalyticalRules Analytics Rule with template version 3.5.1", + "description": "GitHub - User was invited to the repository_AnalyticalRules Analytics Rule with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -1460,21 +1459,21 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Actor" + "columnName": "Actor", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ] } @@ -1530,7 +1529,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHub - pull request was created_AnalyticalRules Analytics Rule with template version 3.5.1", + "description": "GitHub - pull request was created_AnalyticalRules Analytics Rule with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject11').analyticRuleVersion11]", @@ -1565,21 +1564,21 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Actor" + "columnName": "Actor", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "AccountName" + "columnName": "AccountName", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "AccountUPNSuffix" + "columnName": "AccountUPNSuffix", + "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ] } @@ -1635,7 +1634,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHub - pull request was merged_AnalyticalRules Analytics Rule with template version 3.5.1", + "description": "GitHub - pull request was merged_AnalyticalRules Analytics Rule with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject12').analyticRuleVersion12]", @@ -1670,21 +1669,21 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Actor" + "columnName": "Actor", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "AccountName" + "columnName": "AccountName", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "AccountUPNSuffix" + "columnName": "AccountUPNSuffix", + "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ] } @@ -1740,7 +1739,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NRT Two Factor Authentication Disabled_AnalyticalRules Analytics Rule with template version 3.5.1", + "description": "NRT Two Factor Authentication Disabled_AnalyticalRules Analytics Rule with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject13').analyticRuleVersion13]", @@ -1771,21 +1770,21 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Actor" + "columnName": "Actor", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ] } @@ -1841,7 +1840,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Security Vulnerability in Repo_AnalyticalRules Analytics Rule with template version 3.5.1", + "description": "Security Vulnerability in Repo_AnalyticalRules Analytics Rule with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject14').analyticRuleVersion14]", @@ -1886,13 +1885,13 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { - "identifier": "Url", - "columnName": "Link" + "columnName": "Link", + "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -1948,7 +1947,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "First Time User Invite and Add Member to Org_HuntingQueries Hunting Query with template version 3.5.1", + "description": "First Time User Invite and Add Member to Org_HuntingQueries Hunting Query with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -2033,7 +2032,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Inactive or New Account Usage_HuntingQueries Hunting Query with template version 3.5.1", + "description": "Inactive or New Account Usage_HuntingQueries Hunting Query with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -2118,7 +2117,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mass Deletion of Repositories _HuntingQueries Hunting Query with template version 3.5.1", + "description": "Mass Deletion of Repositories _HuntingQueries Hunting Query with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -2203,7 +2202,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Oauth App Restrictions Disabled_HuntingQueries Hunting Query with template version 3.5.1", + "description": "Oauth App Restrictions Disabled_HuntingQueries Hunting Query with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -2288,7 +2287,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Org Repositories Default Permissions Change_HuntingQueries Hunting Query with template version 3.5.1", + "description": "Org Repositories Default Permissions Change_HuntingQueries Hunting Query with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -2373,7 +2372,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Repository Permission Switched to Public_HuntingQueries Hunting Query with template version 3.5.1", + "description": "Repository Permission Switched to Public_HuntingQueries Hunting Query with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]", @@ -2458,7 +2457,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User First Time Repository Delete Activity_HuntingQueries Hunting Query with template version 3.5.1", + "description": "User First Time Repository Delete Activity_HuntingQueries Hunting Query with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]", @@ -2543,7 +2542,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Grant Access and Grants Other Access_HuntingQueries Hunting Query with template version 3.5.1", + "description": "User Grant Access and Grants Other Access_HuntingQueries Hunting Query with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]", @@ -2628,7 +2627,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHubAuditData Data Parser with template version 3.5.1", + "description": "GitHubAuditData Data Parser with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", @@ -2645,7 +2644,7 @@ "displayName": "Parser for GitHubAuditData", "category": "Microsoft Sentinel Parser", "functionAlias": "GitHubAuditData", - "query": "let GitHubAuditLogPolling_view = view () {\nGitHubAuditLogPolling_CL\n | extend \n TimeGenerated=unixtime_milliseconds_todatetime(created_at_d),\n Organization=column_ifexists('org_s', ''),\n Action=column_ifexists('action_s', ''),\n Repository=column_ifexists('repo_s', ''),\n Actor=column_ifexists('actor_s', ''),\n Country=column_ifexists('actor_location_country_code_s', ''),\n ImpactedUser=column_ifexists('user_s', ''),\n InvitedUserPermission=column_ifexists('permission_s', ''),\n Visibility=column_ifexists('visibility_s', ''),\n PreviousVisibility=column_ifexists('previous_visibility_s', ''),\n CurrentPermission=column_ifexists('permission_s', ''),\n PreviousPermission=column_ifexists('old_permission_s', ''),\n TeamName=column_ifexists('team_s', ''),\n BlockedUser=column_ifexists('blocked_user_s', '')\n};\nlet GitHubAuditLogsV2_view = view () {\nGitHubAuditLogsV2_CL\n | extend \n TimeGenerated=unixtime_milliseconds_todatetime(CreatedAt),\n Organization=column_ifexists('Org', ''),\n Action=column_ifexists('Action', ''),\n Repository=column_ifexists('Repo', ''),\n Actor=column_ifexists('Actor', ''),\n Country=column_ifexists('CountryCode', ''),\n ImpactedUser=column_ifexists('User', ''),\n InvitedUserPermission=column_ifexists('Permission', ''),\n Visibility=column_ifexists('Visibility', ''),\n PreviousVisibility=column_ifexists('PreviousVisibility', ''),\n CurrentPermission=column_ifexists('Permission', ''),\n PreviousPermission=column_ifexists('OldPermission', ''),\n TeamName=column_ifexists('Team', ''),\n BlockedUser=column_ifexists('BlockedUser', '')\n};\nlet GitHubAuditLogsV3_view = view () {\nGitHubAuditLogsV3_CL\n | extend \n TimeGenerated=unixtime_milliseconds_todatetime(CreatedAt),\n Organization=column_ifexists('Org', ''),\n Action=column_ifexists('Action', ''),\n Repository=column_ifexists('Repo', ''),\n Actor=column_ifexists('Actor', ''),\n Country=column_ifexists('CountryCode', ''),\n ImpactedUser=column_ifexists('User', ''),\n InvitedUserPermission=column_ifexists('Permission', ''),\n Visibility=column_ifexists('Visibility', ''),\n PreviousVisibility=column_ifexists('PreviousVisibility', ''),\n CurrentPermission=column_ifexists('Permission', ''),\n PreviousPermission=column_ifexists('OldPermission', ''),\n TeamName=column_ifexists('Team', ''),\n BlockedUser=column_ifexists('BlockedUser', '')\n};\nunion isfuzzy=true (GitHubAuditLogPolling_view), (GitHubAuditLogsV2_view), (GitHubAuditLogsV3_view)\n | project\n TimeGenerated,\n Organization,\n Action,\n Repository,\n Actor,\n Country,\n ImpactedUser,\n InvitedUserPermission,\n Visibility,\n PreviousVisibility,\n CurrentPermission,\n PreviousPermission,\n TeamName,\n BlockedUser\n | project-reorder TimeGenerated, Organization, Action, Repository, Actor, Country, ImpactedUser, InvitedUserPermission, Visibility, PreviousVisibility, CurrentPermission, PreviousPermission, TeamName, BlockedUser\n", + "query": "let GitHubAuditLogPolling_view = view () {\nGitHubAuditLogPolling_CL\n | extend \n TimeGenerated=coalesce(unixtime_milliseconds_todatetime(column_ifexists('created_at_d', real(null))), TimeGenerated),\n Organization=column_ifexists('org_s', ''),\n Action=column_ifexists('action_s', ''),\n Repository=column_ifexists('repo_s', ''),\n Actor=column_ifexists('actor_s', ''),\n Country=column_ifexists('actor_location_country_code_s', ''),\n ImpactedUser=column_ifexists('user_s', ''),\n InvitedUserPermission=column_ifexists('permission_s', ''),\n Visibility=column_ifexists('visibility_s', ''),\n PreviousVisibility=column_ifexists('previous_visibility_s', ''),\n CurrentPermission=column_ifexists('permission_s', ''),\n PreviousPermission=column_ifexists('old_permission_s', ''),\n TeamName=column_ifexists('team_s', ''),\n BlockedUser=column_ifexists('blocked_user_s', '')\n};\nlet GitHubAuditLogsV2_view = view () {\nGitHubAuditLogsV2_CL\n | extend \n Organization=column_ifexists('Org', ''),\n Action=column_ifexists('Action', ''),\n Repository=column_ifexists('Repo', ''),\n Actor=column_ifexists('Actor', ''),\n Country=column_ifexists('CountryCode', ''),\n ImpactedUser=column_ifexists('User', ''),\n InvitedUserPermission=column_ifexists('Permission', ''),\n Visibility=column_ifexists('Visibility', ''),\n PreviousVisibility=column_ifexists('PreviousVisibility', ''),\n CurrentPermission=column_ifexists('Permission', ''),\n PreviousPermission=column_ifexists('OldPermission', ''),\n TeamName=column_ifexists('Team', ''),\n BlockedUser=column_ifexists('BlockedUser', '')\n};\nlet GitHubAuditLogsV3_view = view () {\nGitHubAuditLogsV3_CL\n | extend \n Organization=column_ifexists('Org', ''),\n Action=column_ifexists('Action', ''),\n Repository=column_ifexists('Repo', ''),\n Actor=column_ifexists('Actor', ''),\n Country=column_ifexists('CountryCode', ''),\n ImpactedUser=column_ifexists('User', ''),\n InvitedUserPermission=column_ifexists('Permission', ''),\n Visibility=column_ifexists('Visibility', ''),\n PreviousVisibility=column_ifexists('PreviousVisibility', ''),\n CurrentPermission=column_ifexists('Permission', ''),\n PreviousPermission=column_ifexists('OldPermission', ''),\n TeamName=column_ifexists('Team', ''),\n BlockedUser=column_ifexists('BlockedUser', '')\n};\nunion isfuzzy=true (GitHubAuditLogPolling_view), (GitHubAuditLogsV2_view), (GitHubAuditLogsV3_view)\n | project\n TimeGenerated,\n Organization,\n Action,\n Repository,\n Actor,\n Country,\n ImpactedUser,\n InvitedUserPermission,\n Visibility,\n PreviousVisibility,\n CurrentPermission,\n PreviousPermission,\n TeamName,\n BlockedUser\n | project-reorder TimeGenerated, Organization, Action, Repository, Actor, Country, ImpactedUser, InvitedUserPermission, Visibility, PreviousVisibility, CurrentPermission, PreviousPermission, TeamName, BlockedUser\n", "functionParameters": "", "version": 2, "tags": [ @@ -2695,8 +2694,8 @@ "contentId": "[variables('parserObject1').parserContentId1]", "contentKind": "Parser", "displayName": "Parser for GitHubAuditData", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.1.0')))]", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.2.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.2.0')))]", "version": "[variables('parserObject1').parserVersion1]" } }, @@ -2710,7 +2709,7 @@ "displayName": "Parser for GitHubAuditData", "category": "Microsoft Sentinel Parser", "functionAlias": "GitHubAuditData", - "query": "let GitHubAuditLogPolling_view = view () {\nGitHubAuditLogPolling_CL\n | extend \n TimeGenerated=unixtime_milliseconds_todatetime(created_at_d),\n Organization=column_ifexists('org_s', ''),\n Action=column_ifexists('action_s', ''),\n Repository=column_ifexists('repo_s', ''),\n Actor=column_ifexists('actor_s', ''),\n Country=column_ifexists('actor_location_country_code_s', ''),\n ImpactedUser=column_ifexists('user_s', ''),\n InvitedUserPermission=column_ifexists('permission_s', ''),\n Visibility=column_ifexists('visibility_s', ''),\n PreviousVisibility=column_ifexists('previous_visibility_s', ''),\n CurrentPermission=column_ifexists('permission_s', ''),\n PreviousPermission=column_ifexists('old_permission_s', ''),\n TeamName=column_ifexists('team_s', ''),\n BlockedUser=column_ifexists('blocked_user_s', '')\n};\nlet GitHubAuditLogsV2_view = view () {\nGitHubAuditLogsV2_CL\n | extend \n TimeGenerated=unixtime_milliseconds_todatetime(CreatedAt),\n Organization=column_ifexists('Org', ''),\n Action=column_ifexists('Action', ''),\n Repository=column_ifexists('Repo', ''),\n Actor=column_ifexists('Actor', ''),\n Country=column_ifexists('CountryCode', ''),\n ImpactedUser=column_ifexists('User', ''),\n InvitedUserPermission=column_ifexists('Permission', ''),\n Visibility=column_ifexists('Visibility', ''),\n PreviousVisibility=column_ifexists('PreviousVisibility', ''),\n CurrentPermission=column_ifexists('Permission', ''),\n PreviousPermission=column_ifexists('OldPermission', ''),\n TeamName=column_ifexists('Team', ''),\n BlockedUser=column_ifexists('BlockedUser', '')\n};\nlet GitHubAuditLogsV3_view = view () {\nGitHubAuditLogsV3_CL\n | extend \n TimeGenerated=unixtime_milliseconds_todatetime(CreatedAt),\n Organization=column_ifexists('Org', ''),\n Action=column_ifexists('Action', ''),\n Repository=column_ifexists('Repo', ''),\n Actor=column_ifexists('Actor', ''),\n Country=column_ifexists('CountryCode', ''),\n ImpactedUser=column_ifexists('User', ''),\n InvitedUserPermission=column_ifexists('Permission', ''),\n Visibility=column_ifexists('Visibility', ''),\n PreviousVisibility=column_ifexists('PreviousVisibility', ''),\n CurrentPermission=column_ifexists('Permission', ''),\n PreviousPermission=column_ifexists('OldPermission', ''),\n TeamName=column_ifexists('Team', ''),\n BlockedUser=column_ifexists('BlockedUser', '')\n};\nunion isfuzzy=true (GitHubAuditLogPolling_view), (GitHubAuditLogsV2_view), (GitHubAuditLogsV3_view)\n | project\n TimeGenerated,\n Organization,\n Action,\n Repository,\n Actor,\n Country,\n ImpactedUser,\n InvitedUserPermission,\n Visibility,\n PreviousVisibility,\n CurrentPermission,\n PreviousPermission,\n TeamName,\n BlockedUser\n | project-reorder TimeGenerated, Organization, Action, Repository, Actor, Country, ImpactedUser, InvitedUserPermission, Visibility, PreviousVisibility, CurrentPermission, PreviousPermission, TeamName, BlockedUser\n", + "query": "let GitHubAuditLogPolling_view = view () {\nGitHubAuditLogPolling_CL\n | extend \n TimeGenerated=coalesce(unixtime_milliseconds_todatetime(column_ifexists('created_at_d', real(null))), TimeGenerated),\n Organization=column_ifexists('org_s', ''),\n Action=column_ifexists('action_s', ''),\n Repository=column_ifexists('repo_s', ''),\n Actor=column_ifexists('actor_s', ''),\n Country=column_ifexists('actor_location_country_code_s', ''),\n ImpactedUser=column_ifexists('user_s', ''),\n InvitedUserPermission=column_ifexists('permission_s', ''),\n Visibility=column_ifexists('visibility_s', ''),\n PreviousVisibility=column_ifexists('previous_visibility_s', ''),\n CurrentPermission=column_ifexists('permission_s', ''),\n PreviousPermission=column_ifexists('old_permission_s', ''),\n TeamName=column_ifexists('team_s', ''),\n BlockedUser=column_ifexists('blocked_user_s', '')\n};\nlet GitHubAuditLogsV2_view = view () {\nGitHubAuditLogsV2_CL\n | extend \n Organization=column_ifexists('Org', ''),\n Action=column_ifexists('Action', ''),\n Repository=column_ifexists('Repo', ''),\n Actor=column_ifexists('Actor', ''),\n Country=column_ifexists('CountryCode', ''),\n ImpactedUser=column_ifexists('User', ''),\n InvitedUserPermission=column_ifexists('Permission', ''),\n Visibility=column_ifexists('Visibility', ''),\n PreviousVisibility=column_ifexists('PreviousVisibility', ''),\n CurrentPermission=column_ifexists('Permission', ''),\n PreviousPermission=column_ifexists('OldPermission', ''),\n TeamName=column_ifexists('Team', ''),\n BlockedUser=column_ifexists('BlockedUser', '')\n};\nlet GitHubAuditLogsV3_view = view () {\nGitHubAuditLogsV3_CL\n | extend \n Organization=column_ifexists('Org', ''),\n Action=column_ifexists('Action', ''),\n Repository=column_ifexists('Repo', ''),\n Actor=column_ifexists('Actor', ''),\n Country=column_ifexists('CountryCode', ''),\n ImpactedUser=column_ifexists('User', ''),\n InvitedUserPermission=column_ifexists('Permission', ''),\n Visibility=column_ifexists('Visibility', ''),\n PreviousVisibility=column_ifexists('PreviousVisibility', ''),\n CurrentPermission=column_ifexists('Permission', ''),\n PreviousPermission=column_ifexists('OldPermission', ''),\n TeamName=column_ifexists('Team', ''),\n BlockedUser=column_ifexists('BlockedUser', '')\n};\nunion isfuzzy=true (GitHubAuditLogPolling_view), (GitHubAuditLogsV2_view), (GitHubAuditLogsV3_view)\n | project\n TimeGenerated,\n Organization,\n Action,\n Repository,\n Actor,\n Country,\n ImpactedUser,\n InvitedUserPermission,\n Visibility,\n PreviousVisibility,\n CurrentPermission,\n PreviousPermission,\n TeamName,\n BlockedUser\n | project-reorder TimeGenerated, Organization, Action, Repository, Actor, Country, ImpactedUser, InvitedUserPermission, Visibility, PreviousVisibility, CurrentPermission, PreviousPermission, TeamName, BlockedUser\n", "functionParameters": "", "version": 2, "tags": [ @@ -2760,7 +2759,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHubCodeScanningData Data Parser with template version 3.5.1", + "description": "GitHubCodeScanningData Data Parser with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject2').parserVersion2]", @@ -2892,7 +2891,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHubDependabotData Data Parser with template version 3.5.1", + "description": "GitHubDependabotData Data Parser with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject3').parserVersion3]", @@ -3024,7 +3023,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHubSecretScanningData Data Parser with template version 3.5.1", + "description": "GitHubSecretScanningData Data Parser with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject4').parserVersion4]", @@ -3156,7 +3155,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHubScanAudit Data Parser with template version 3.5.1", + "description": "GitHubScanAudit Data Parser with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject5').parserVersion5]", @@ -3562,7 +3561,6 @@ "apiVersion": "2022-06-01", "type": "Microsoft.Insights/dataCollectionRules", "location": "[parameters('workspace-location')]", - "kind": "[variables('blanks')]", "properties": { "dataCollectionEndpointId": "[variables('DataCollectionEndpointId1')]", "streamDeclarations": { @@ -4566,7 +4564,6 @@ "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", - "kind": null, "properties": { "schema": { "name": "GitHubAuditLogsV3_CL", @@ -5790,7 +5787,6 @@ "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", - "kind": null, "properties": { "schema": { "name": "GitHubAuditLogsV2_CL", @@ -7408,13 +7404,6 @@ "[[format('Microsoft.EventGrid/systemTopics/{0}', variables('EGSystemTopicName'))]" ], "properties": { - "destination": { - "endpointType": "StorageQueue", - "properties": { - "queueName": "[[variables('queueName')]", - "resourceId": "[[variables('storageAccountId')]" - } - }, "filter": { "includedEventTypes": [ "Microsoft.Storage.BlobCreated" @@ -7429,6 +7418,13 @@ ] } ] + }, + "destination": { + "endpointType": "StorageQueue", + "properties": { + "queueName": "[[variables('queueName')]", + "resourceId": "[[variables('storageAccountId')]" + } } } }, @@ -7707,7 +7703,6 @@ "apiVersion": "2022-06-01", "type": "Microsoft.Insights/dataCollectionRules", "location": "[parameters('workspace-location')]", - "kind": "[variables('blanks')]", "properties": { "dataCollectionEndpointId": "[variables('dataCollectionEndpointId2')]", "streamDeclarations": { @@ -8671,7 +8666,6 @@ "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", - "kind": null, "properties": { "schema": { "name": "GitHubAuditLogsV2_CL", @@ -9902,7 +9896,7 @@ "rateLimitQPS": 50, "queryWindowInMin": 15, "httpMethod": "GET", - "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ss'Z'", "retryCount": 2, "timeoutInSeconds": 60, "headers": { @@ -9936,7 +9930,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHub data connector with template version 3.5.1", + "description": "GitHub data connector with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion3')]", @@ -10281,7 +10275,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHub data connector with template version 3.5.1", + "description": "GitHub data connector with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion4')]", @@ -10720,7 +10714,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "GitHub data connector with template version 3.5.1", + "description": "GitHub data connector with template version 3.5.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion5')]", @@ -11161,7 +11155,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.5.1", + "version": "3.5.2", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "GitHub", diff --git a/Solutions/GitHub/Parsers/GitHubAuditData.yaml b/Solutions/GitHub/Parsers/GitHubAuditData.yaml index fd4cca56312..146c18cd92b 100644 --- a/Solutions/GitHub/Parsers/GitHubAuditData.yaml +++ b/Solutions/GitHub/Parsers/GitHubAuditData.yaml @@ -1,8 +1,8 @@ id: 32d7c900-875f-43d6-9e48-987fd5df3762 Function: Title: Parser for GitHubAuditData - Version: '1.1.0' - LastUpdated: '2026-06-26' + Version: '1.2.0' + LastUpdated: '2026-08-24' Category: Microsoft Sentinel Parser FunctionName: GitHubAuditData FunctionAlias: GitHubAuditData @@ -10,7 +10,7 @@ FunctionQuery: | let GitHubAuditLogPolling_view = view () { GitHubAuditLogPolling_CL | extend - TimeGenerated=unixtime_milliseconds_todatetime(created_at_d), + TimeGenerated=coalesce(unixtime_milliseconds_todatetime(column_ifexists('created_at_d', real(null))), TimeGenerated), Organization=column_ifexists('org_s', ''), Action=column_ifexists('action_s', ''), Repository=column_ifexists('repo_s', ''), @@ -28,7 +28,6 @@ FunctionQuery: | let GitHubAuditLogsV2_view = view () { GitHubAuditLogsV2_CL | extend - TimeGenerated=unixtime_milliseconds_todatetime(CreatedAt), Organization=column_ifexists('Org', ''), Action=column_ifexists('Action', ''), Repository=column_ifexists('Repo', ''), @@ -46,7 +45,6 @@ FunctionQuery: | let GitHubAuditLogsV3_view = view () { GitHubAuditLogsV3_CL | extend - TimeGenerated=unixtime_milliseconds_todatetime(CreatedAt), Organization=column_ifexists('Org', ''), Action=column_ifexists('Action', ''), Repository=column_ifexists('Repo', ''), diff --git a/Solutions/GitHub/data/Solution_GitHub.json b/Solutions/GitHub/data/Solution_GitHub.json index 9597391e741..8e40b2837ff 100644 --- a/Solutions/GitHub/data/Solution_GitHub.json +++ b/Solutions/GitHub/data/Solution_GitHub.json @@ -49,7 +49,7 @@ ], "Metadata": "SolutionMetadata.json", "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\GitHub", - "Version": "3.5.1", + "Version": "3.5.2", "TemplateSpec": true, "Is1PConnector": false } diff --git a/Tools/Create-Azure-Sentinel-Solution/common/createCCPConnector.ps1 b/Tools/Create-Azure-Sentinel-Solution/common/createCCPConnector.ps1 index 1008e6add92..159b91c1fd0 100644 --- a/Tools/Create-Azure-Sentinel-Solution/common/createCCPConnector.ps1 +++ b/Tools/Create-Azure-Sentinel-Solution/common/createCCPConnector.ps1 @@ -277,14 +277,20 @@ function Get-ArmResource($name, $type, $kind, $properties) { "Microsoft.Insights/dataCollectionRules" = "2022-06-01"; } - return [PSCustomObject]@{ + $resource = [ordered]@{ name = $name; apiVersion = $apiVersion[$type] type = $type; location = "[parameters('workspace-location')]"; - kind = $kind; - properties = $properties; } + + if (-not [string]::IsNullOrEmpty($kind)) { + $resource["kind"] = $kind + } + + $resource["properties"] = $properties + + return [PSCustomObject]$resource } function addNewParameter($templateResourceObj, $parameterName, $isSecret = $false, $minLength = 1) {