Users/v dhbedu/checkpoint email security

.script/tests/KqlvalidationsTests/CustomTables/CheckPointEmailSecAntiPhishingExceptions_CL.json

@@ -0,0 +1,8 @@
+{
+  "Name": "CheckPointEmailSecAntiPhishingExceptions_CL",
+  "Properties": [
+    { "Name": "TimeGenerated", "Type": "DateTime" },
+    { "Name": "EntityId", "Type": "String" },
+    { "Name": "UpdateTime", "Type": "DateTime" }
+  ]
+}

.script/tests/KqlvalidationsTests/CustomTables/CheckPointEmailSecuritySpamExceptions_CL.json

@@ -0,0 +1,8 @@
+{
+  "Name": "CheckPointEmailSecuritySpamExceptions_CL",
+  "Properties": [
+    { "Name": "TimeGenerated", "Type": "DateTime" },
+    { "Name": "EntityId", "Type": "String" },
+    { "Name": "UpdateTime", "Type": "DateTime" }
+  ]
+}

Solutions/Checkpoint Email Security/Data Connectors/CheckPointEmailSecurity_CCF/CheckPointEmailSecurity_ConnectorDefinition.json

@@ -19,12 +19,12 @@
         {
           "metricName": "Total anti-phishing exceptions received",
           "legend": "Check Point Anti-Phishing Exceptions",
-          "baseQuery": "CheckPointEmailSecAntiPhishingExceptions_CL"
+          "baseQuery": "CheckPointEmailSecAntiPhishingExceptions"
         },
         {
           "metricName": "Total spam exceptions received",
           "legend": "Check Point Spam Exceptions",
-          "baseQuery": "CheckPointEmailSecuritySpamExceptions_CL"
+          "baseQuery": "CheckPointEmailSecuritySpamExceptions"
         },
         {
           "metricName": "Total audit logs received",
@@ -39,11 +39,11 @@
         },
         {
           "description": "Get sample of Check Point Anti-Phishing Exceptions",
-          "query": "CheckPointEmailSecAntiPhishingExceptions_CL\n | take 10"
+          "query": "CheckPointEmailSecAntiPhishingExceptions\n | take 10"
         },
         {
           "description": "Get sample of Check Point Spam Exceptions",
-          "query": "CheckPointEmailSecuritySpamExceptions_CL\n | take 10"
+          "query": "CheckPointEmailSecuritySpamExceptions\n | take 10"
         },
         {
           "description": "Get sample of Check Point Audit Logs",
@@ -56,12 +56,12 @@
           "lastDataReceivedQuery": "CheckPointEmailSecurityEvents_CL\n| where ingestion_time() > ago(12h)\n| summarize Time = max(ingestion_time())\n| where isnotempty(Time)"
         },
         {
-          "name": "CheckPointEmailSecAntiPhishingExceptions_CL",
-          "lastDataReceivedQuery": "CheckPointEmailSecAntiPhishingExceptions_CL\n| where ingestion_time() > ago(12h)\n| summarize Time = max(ingestion_time())\n| where isnotempty(Time)"
+          "name": "CheckPointEmailSecAntiPhishingExceptions",
+          "lastDataReceivedQuery": "CheckPointEmailSecAntiPhishingExceptions\n| where TimeGenerated > ago(2d)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
         },
         {
-          "name": "CheckPointEmailSecuritySpamExceptions_CL",
-          "lastDataReceivedQuery": "CheckPointEmailSecuritySpamExceptions_CL\n| where ingestion_time() > ago(12h)\n| summarize Time = max(ingestion_time())\n| where isnotempty(Time)"
+          "name": "CheckPointEmailSecuritySpamExceptions",
+          "lastDataReceivedQuery": "CheckPointEmailSecuritySpamExceptions\n| where TimeGenerated > ago(2d)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
         },
         {
           "name": "CheckPointEmailSecurityAuditLogs_CL",

Solutions/Checkpoint Email Security/Data Connectors/CheckPointEmailSecurity_CCF/CheckPointEmailSecurity_PollerConfig.json

@@ -51,7 +51,7 @@
         "pagingType": "NextPageToken",
         "nextPageTokenJsonPath": "$.responseEnvelope.scrollId",
         "NextPageParaName": "scrollId",
-        "pagingInfoPlacement": "QueryString"
+        "pagingInfoPlacement": "RequestBody"
       },
       "connectorDefinitionName": "CheckPointEmailSecConnector",
       "dataType": "CheckPointEmailSecurityEvents",
@@ -95,12 +95,11 @@
         "apiEndpoint": "[[concat(parameters('apiUrl'),'/app/hec-api/v1.0/exceptions/whitelist')]",
         "httpMethod": "GET",
         "rateLimitQPS": 1,
-        "queryWindowInMin": 5,
+        "queryWindowInMin": 1440,
         "retryCount": 3,
-        "timeoutInSeconds": 30,
+        "timeoutInSeconds": 60,
         "headers": {
           "Accept": "application/json",
-          "Content-Type": "application/json",
           "x-av-req-id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"
         }
       },
@@ -158,12 +157,11 @@
         "apiEndpoint": "[[concat(parameters('apiUrl'),'/app/hec-api/v1.0/exceptions/spam_whitelist')]",
         "httpMethod": "GET",
         "rateLimitQPS": 10,
-        "queryWindowInMin": 5,
+        "queryWindowInMin": 1440,
         "retryCount": 3,
-        "timeoutInSeconds": 30,
+        "timeoutInSeconds": 60,
         "headers": {
           "Accept": "application/json",
-          "Content-Type": "application/json",
           "x-av-req-id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"
         }
       },
@@ -224,10 +222,9 @@
         "queryWindowInMin": 5,
         "queryTimeFormat": "UnixTimestampInMills",
         "retryCount": 3,
-        "timeoutInSeconds": 30,
+        "timeoutInSeconds": 60,
         "headers": {
-          "Accept": "application/json",
-          "Content-Type": "application/json"
+          "Accept": "application/json"
         },
         "queryParameters": {
           "fromDate": "{_QueryWindowStartTime}",

Solutions/Checkpoint Email Security/Data/Solution_CheckPointEmailSecurity.json

@@ -6,13 +6,17 @@
   "Data Connectors": [
     "Data Connectors/CheckPointEmailSecurity_CCF/CheckPointEmailSecurity_ConnectorDefinition.json"
   ],
+  "Parsers": [
+    "Parsers/CheckPointEmailSecAntiPhishingExceptions.yaml",
+    "Parsers/CheckPointEmailSecuritySpamExceptions.yaml"
+  ],
   "Workbooks": [],
   "Analytic Rules": [],
   "Hunting Queries": [],
   "Watchlists": [],
   "Playbooks": [],
   "BasePath": "C:\\Sentinel\\Azure-Sentinel\\Solutions\\Checkpoint Email Security",
-  "Version": "3.0.1",
+  "Version": "3.0.2",
   "Metadata": "SolutionMetadata.json",
   "TemplateSpec": true,
   "Is1PConnector": false

Solutions/Checkpoint Email Security/Package/createUiDefinition.json

@@ -6,7 +6,7 @@
     "config": {
       "isWizard": false,
       "basics": {
-        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Checkpoint%20Email%20Security/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Check Point Email Security (Harmony Email & Collaboration)](https://www.checkpoint.com/harmony/email-security/) Solution for Microsoft Sentinel enables you to ingest security events, anti-phishing exceptions, spam exceptions, and audit logs from Check Point's Email Security platform into Microsoft Sentinel using the Codeless Connector Framework (CCF). This solution provides visibility into advanced email threats including zero-day threats, phishing, account takeover, data leakage, and shadow IT discovery.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:\n\na. [Codeless Connector Platform (CCP)](https://docs.microsoft.com/azure/sentinel/create-codeless-connector?tabs=deploy-via-arm-template%2Cconnect-via-the-azure-portal)\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Checkpoint%20Email%20Security/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Check Point Email Security (Harmony Email & Collaboration)](https://www.checkpoint.com/harmony/email-security/) Solution for Microsoft Sentinel enables you to ingest security events, anti-phishing exceptions, spam exceptions, and audit logs from Check Point's Email Security platform into Microsoft Sentinel using the Codeless Connector Framework (CCF). This solution provides visibility into advanced email threats including zero-day threats, phishing, account takeover, data leakage, and shadow IT discovery.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:\n\na. [Codeless Connector Platform (CCP)](https://docs.microsoft.com/azure/sentinel/create-codeless-connector?tabs=deploy-via-arm-template%2Cconnect-via-the-azure-portal)\n\n**Data Connectors:** 1, **Parsers:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
         "subscription": {
           "resourceProviders": [
             "Microsoft.OperationsManagement/solutions",