diff --git a/.script/tests/KqlvalidationsTests/CustomTables/DefendAuditData_v4.json b/.script/tests/KqlvalidationsTests/CustomTables/DefendAuditData_v4.json new file mode 100644 index 00000000000..473d6ae30c2 --- /dev/null +++ b/.script/tests/KqlvalidationsTests/CustomTables/DefendAuditData_v4.json @@ -0,0 +1,65 @@ +{ + "Name": "DefendAuditData_v4", + "Properties": [ + { + "Name": "TimeGenerated", + "Type": "DateTime" + }, + { + "Name": "Event", + "Type": "String" + }, + { + "Name": "Recipients", + "Type": "String" + }, + { + "Name": "From", + "Type": "String" + }, + { + "Name": "Subject", + "Type": "String" + }, + { + "Name": "Attachments", + "Type": "String" + }, + { + "Name": "MessageId", + "Type": "String" + }, + { + "Name": "ThreatLevel", + "Type": "String" + }, + { + "Name": "TrustLevel", + "Type": "String" + }, + { + "Name": "FirstTimeSender", + "Type": "Bool" + }, + { + "Name": "PayLoad", + "Type": "String" + }, + { + "Name": "LinksClicked", + "Type": "Double" + }, + { + "Name": "SenderIP", + "Type": "String" + }, + { + "Name": "Url", + "Type": "String" + }, + { + "Name": "PhishType", + "Type": "String" + } + ] + } diff --git a/.script/tests/KqlvalidationsTests/CustomTables/EgressDefend_v4_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/EgressDefend_v4_CL.json new file mode 100644 index 00000000000..4a3b617dc80 --- /dev/null +++ b/.script/tests/KqlvalidationsTests/CustomTables/EgressDefend_v4_CL.json @@ -0,0 +1,69 @@ +{ + "Name": "EgressDefend_v4_CL", + "Properties": [ + { + "Name": "TimeGenerated", + "Type": "DateTime" + }, + { + "Name": "time_t", + "Type": "DateTime" + }, + { + "Name": "event_s", + "Type": "String" + }, + { + "Name": "linkClicked_s", + "Type": "String" + }, + { + "Name": "email_rcptTo_s", + "Type": "String" + }, + { + "Name": "email_mailFrom_s", + "Type": "String" + }, + { + "Name": "email_subject_s", + "Type": "String" + }, + { + "Name": "email_attachments_s", + "Type": "String" + }, + { + "Name": "email_messageId_s", + "Type": "String" + }, + { + "Name": "email_threat_s", + "Type": "String" + }, + { + "Name": "email_trust_s", + "Type": "String" + }, + { + "Name": "email_firstTimeSender_b", + "Type": "Bool" + }, + { + "Name": "email_payload_Type_s", + "Type": "String" + }, + { + "Name": "email_linksClicked_d", + "Type": "Double" + }, + { + "Name": "email_senderIp_s", + "Type": "String" + }, + { + "Name": "email_phishType_s", + "Type": "String" + } + ] + } diff --git a/Solutions/Egress Defend/Analytic Rules/DangerousAttachmentReceived.yaml b/Solutions/Egress Defend/Analytic Rules/DangerousAttachmentReceived.yaml index 6b2937ec3d5..db8b64f9261 100644 --- a/Solutions/Egress Defend/Analytic Rules/DangerousAttachmentReceived.yaml +++ b/Solutions/Egress Defend/Analytic Rules/DangerousAttachmentReceived.yaml @@ -8,6 +8,7 @@ requiredDataConnectors: - connectorId: EgressDefend dataTypes: - EgressDefend_CL + - EgressDefend_v4_CL queryFrequency: 30m queryPeriod: 30m triggerOperator: gt @@ -27,7 +28,7 @@ relevantTechniques: tags: - Defend query: | - DefendAuditData + DefendAuditData_v4 | where ThreatLevel == "suspicious" or ThreatLevel == "dangerous" | mv-expand todynamic(Attachments) | where Attachments.name matches regex @"(?i)^.*\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)" @@ -51,5 +52,5 @@ entityMappings: columnName: SenderIP alertDetailsOverride: alertDisplayNameFormat: Alert - {{Account_0_FullName}} has suspicious attachment. -version: 1.0.0 +version: 1.1.0 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Egress Defend/Analytic Rules/DangerousLinksClicked.yaml b/Solutions/Egress Defend/Analytic Rules/DangerousLinksClicked.yaml index 41c74c61e2b..57cb80641de 100644 --- a/Solutions/Egress Defend/Analytic Rules/DangerousLinksClicked.yaml +++ b/Solutions/Egress Defend/Analytic Rules/DangerousLinksClicked.yaml @@ -8,6 +8,7 @@ requiredDataConnectors: - connectorId: EgressDefend dataTypes: - EgressDefend_CL + - EgressDefend_v4_CL queryFrequency: 30m queryPeriod: 30m triggerOperator: gt @@ -20,7 +21,7 @@ relevantTechniques: tags: - Defend query: | - DefendAuditData + DefendAuditData_v4 | where LinksClicked > 0 | where ThreatLevel == "dangerous" or ThreatLevel == "suspicious" | extend Account_0_FullName = trim(@"[^@.\w]+",Recipients) @@ -47,5 +48,5 @@ customDetails: timesClicked: LinksClicked alertDetailsOverride: alertDisplayNameFormat: Alert - {{Account_0_FullName}} as clicked a suspicious link. -version: 1.0.0 +version: 1.1.0 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Egress Defend/Data Connectors/EgressDefendAuditLogs_ccp/EgressDefendAudit_ConnectorDefinition.json b/Solutions/Egress Defend/Data Connectors/EgressDefendAuditLogs_ccp/EgressDefendAudit_ConnectorDefinition.json new file mode 100644 index 00000000000..5f7dd3d944e --- /dev/null +++ b/Solutions/Egress Defend/Data Connectors/EgressDefendAuditLogs_ccp/EgressDefendAudit_ConnectorDefinition.json @@ -0,0 +1,112 @@ +{ + "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", + "apiVersion": "2022-09-01-preview", + "name": "EgressDefendAudit", + "location": "{{location}}", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "EgressDefendAudit", + "title": "Egress Defend v2", + "publisher": "Egress Software Technologies", + "descriptionMarkdown": "The Egress Defend audit connector ingests Egress Defend audit data into Microsoft Sentinel via the Logs Ingestion API (DCR-based). It pulls from the Egress Defend `V1/events` API and lands events in the `EgressDefend_v4_CL` table.", + "graphQueriesTableName": "EgressDefend_v4_CL", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "Egress Defend Events", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "All logs", + "query": "DefendAuditData_v4" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions on the Log Analytics workspace are required to enable the data connector.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true, + "action": false + } + } + ], + "customs": [ + { + "name": "Egress Defend API access", + "description": "An Egress Defend API URL, customer domain and API key are required to ingest audit records into Microsoft Sentinel." + } + ] + }, + "instructionSteps": [ + { + "title": "Connect Egress Defend to Microsoft Sentinel", + "description": "Enter your Egress Defend API URL, Egress domain and API key, then click Connect.", + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "API URL", + "type": "text", + "name": "apiUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Domain name", + "type": "text", + "name": "domain", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "API Key", + "type": "password", + "name": "apiKey", + "validations": { + "required": true + } + } + }, + { + "type": "ConnectionToggleButton", + "parameters": { + "name": "connect" + } + } + ] + } + ] + } + } +} diff --git a/Solutions/Egress Defend/Data Connectors/EgressDefendAuditLogs_ccp/EgressDefendAudit_DCR.json b/Solutions/Egress Defend/Data Connectors/EgressDefendAuditLogs_ccp/EgressDefendAudit_DCR.json new file mode 100644 index 00000000000..fb30bbc278d --- /dev/null +++ b/Solutions/Egress Defend/Data Connectors/EgressDefendAuditLogs_ccp/EgressDefendAudit_DCR.json @@ -0,0 +1,41 @@ +[ + { + "name": "EgressDefendV4", + "apiVersion": "2021-09-01-preview", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "{{location}}", + "properties": { + "dataCollectionEndpointId": "{{dataCollectionEndpointId}}", + "streamDeclarations": { + "Custom-EgressDefend_v4_CL": { + "columns": [ + { "name": "time", "type": "datetime" }, + { "name": "event", "type": "string" }, + { "name": "linkClicked", "type": "string" }, + { "name": "email", "type": "dynamic" } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "{{workspaceResourceId}}", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-EgressDefend_v4_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | project TimeGenerated = todatetime(['time']), time_t = todatetime(['time']), event_s = tostring(['event']), linkClicked_s = tostring(linkClicked), email_rcptTo_s = tostring(email.rcptTo), email_mailFrom_s = tostring(email.mailFrom), email_subject_s = tostring(email.subject), email_attachments_s = tostring(email.attachments), email_messageId_s = tostring(email.messageId), email_threat_s = tostring(email.threat), email_trust_s = tostring(email.trust), email_firstTimeSender_b = tobool(email.firstTimeSender), email_payload_Type_s = tostring(email.payloadType), email_linksClicked_d = toreal(email.linksClicked), email_senderIp_s = tostring(email.senderIp), email_phishType_s = tostring(email.phishType)", + "outputStream": "Custom-EgressDefend_v4_CL" + } + ] + } + } +] diff --git a/Solutions/Egress Defend/Data Connectors/EgressDefendAuditLogs_ccp/EgressDefendAudit_PollerConfig.json b/Solutions/Egress Defend/Data Connectors/EgressDefendAuditLogs_ccp/EgressDefendAudit_PollerConfig.json new file mode 100644 index 00000000000..75e4aeb24a4 --- /dev/null +++ b/Solutions/Egress Defend/Data Connectors/EgressDefendAuditLogs_ccp/EgressDefendAudit_PollerConfig.json @@ -0,0 +1,46 @@ +[ + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2022-10-01-preview", + "name": "EgressDefendAudit", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "EgressDefendAudit", + "dataType": "EgressDefend_v4_CL", + "dcrConfig": { + "streamName": "Custom-EgressDefend_v4_CL" + }, + "auth": { + "type": "APIKey", + "ApiKey": "{{apiKey}}", + "ApiKeyName": "X-Api-Key", + "IsApiKeyInPostPayload": false + }, + "request": { + "apiEndpoint": "https://{{apiUrl}}/V1/events/?pagingMode=offset&domain={{domain}}", + "httpMethod": "Get", + "startTimeAttributeName": "startTime", + "endTimeAttributeName": "endTime", + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ss.fffZ", + "queryWindowInMin": 5, + "retryCount": 2, + "timeoutInSeconds": 120, + "headers": { + "Accept": "application/json" + } + }, + "paging": { + "pagingType": "Offset", + "offsetParaName": "offset", + "pageSizeParaName": "limit", + "pageSize": 100 + }, + "response": { + "eventsJsonPaths": [ + "$..items" + ], + "format": "json" + } + } + } +] diff --git a/Solutions/Egress Defend/Data Connectors/EgressDefendAuditLogs_ccp/EgressDefendAudit_Table.json b/Solutions/Egress Defend/Data Connectors/EgressDefendAuditLogs_ccp/EgressDefendAudit_Table.json new file mode 100644 index 00000000000..8ad97626de7 --- /dev/null +++ b/Solutions/Egress Defend/Data Connectors/EgressDefendAuditLogs_ccp/EgressDefendAudit_Table.json @@ -0,0 +1,30 @@ +[ + { + "name": "EgressDefend_v4_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2021-03-01-privatepreview", + "properties": { + "schema": { + "name": "EgressDefend_v4_CL", + "columns": [ + { "name": "TimeGenerated", "type": "datetime", "isDefaultDisplay": true, "description": "The time the event was generated." }, + { "name": "time_t", "type": "datetime", "description": "Event time reported by Egress Defend." }, + { "name": "event_s", "type": "string", "description": "Event type." }, + { "name": "linkClicked_s", "type": "string", "description": "The link that was clicked, if any." }, + { "name": "email_rcptTo_s", "type": "string", "description": "Recipients." }, + { "name": "email_mailFrom_s", "type": "string", "description": "Sender address." }, + { "name": "email_subject_s", "type": "string", "description": "Email subject." }, + { "name": "email_attachments_s", "type": "string", "description": "Serialized list of attachments." }, + { "name": "email_messageId_s", "type": "string", "description": "Message identifier." }, + { "name": "email_threat_s", "type": "string", "description": "Threat level." }, + { "name": "email_trust_s", "type": "string", "description": "Trust level." }, + { "name": "email_firstTimeSender_b", "type": "boolean", "description": "Whether this is a first-time sender." }, + { "name": "email_payload_Type_s", "type": "string", "description": "Payload type." }, + { "name": "email_linksClicked_d", "type": "real", "description": "Number of links clicked." }, + { "name": "email_senderIp_s", "type": "string", "description": "Sender IP address." }, + { "name": "email_phishType_s", "type": "string", "description": "Serialized list of phishing types." } + ] + } + } + } +] diff --git a/Solutions/Egress Defend/Data/Solution_EgressDefend.json b/Solutions/Egress Defend/Data/Solution_EgressDefend.json index 3da9491b0da..d0e5589e45d 100644 --- a/Solutions/Egress Defend/Data/Solution_EgressDefend.json +++ b/Solutions/Egress Defend/Data/Solution_EgressDefend.json @@ -4,20 +4,26 @@ "Logo": "", "Description": "Egress Defend for Microsoft Sentinel provides details of processed emails, including the type of phishing attack, payload type and information to show if the user interacted with the email in a positive (clicking on banners or submitting the phish sample) or negative (clicking on an unsafe URL) manner.", "WorkbookDescription": "Egress Defend Workbooks provides insight into Egress Defend audit logs", - "Workbooks": [ - "Workbooks/DefendMetrics.json" + "Workbooks": [ + "Workbooks/DefendMetrics.json" ], - "Analytic Rules": [ + "Analytic Rules": [ "Analytic Rules/DangerousAttachmentReceived.yaml", "Analytic Rules/DangerousLinksClicked.yaml" ], - "Parsers": [ "Parsers/DefendAuditData.txt"], + "Parsers": [ + "Parsers/DefendAuditData.txt", + "Parsers/DefendAuditData_v4.yaml" + ], "Hunting Queries": [ "Hunting Queries/DangerousLinksClicked.yaml" ], - "Data Connectors": ["Data Connectors/DefendAPIConnector.json"], + "Data Connectors": [ + "Data Connectors/DefendAPIConnector.json", + "Data Connectors/EgressDefendAuditLogs_ccp/EgressDefendAudit_ConnectorDefinition.json" + ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Egress Defend", - "Version": "3.0.0", + "Version": "3.1.0", "Metadata": "SolutionMetadata.json", "TemplateSpec": true } diff --git a/Solutions/Egress Defend/Hunting Queries/DangerousLinksClicked.yaml b/Solutions/Egress Defend/Hunting Queries/DangerousLinksClicked.yaml index 6fc7513b329..dab46c0bbcf 100644 --- a/Solutions/Egress Defend/Hunting Queries/DangerousLinksClicked.yaml +++ b/Solutions/Egress Defend/Hunting Queries/DangerousLinksClicked.yaml @@ -6,6 +6,7 @@ requiredDataConnectors: - connectorId: EgressDefend dataTypes: - EgressDefend_CL + - EgressDefend_v4_CL tactics: - Collection @@ -14,6 +15,6 @@ relevantTechniques: - T1039 query: | - EgressDefend_CL - | where event_s == "linkClick" - | where email_threat_s == "dangerous" + DefendAuditData_v4 + | where Event == "linkClick" + | where ThreatLevel == "dangerous" diff --git a/Solutions/Egress Defend/Package/3.1.0.zip b/Solutions/Egress Defend/Package/3.1.0.zip new file mode 100644 index 00000000000..cb2cdec2ee0 Binary files /dev/null and b/Solutions/Egress Defend/Package/3.1.0.zip differ diff --git a/Solutions/Egress Defend/Package/createUiDefinition.json b/Solutions/Egress Defend/Package/createUiDefinition.json index f29db2bb6cc..fab794c746a 100644 --- a/Solutions/Egress Defend/Package/createUiDefinition.json +++ b/Solutions/Egress Defend/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Egress%20Defend/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nEgress Defend for Microsoft Sentinel provides details of processed emails, including the type of phishing attack, payload type and information to show if the user interacted with the email in a positive (clicking on banners or submitting the phish sample) or negative (clicking on an unsafe URL) manner. \n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 2, **Hunting Queries:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Egress%20Defend/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nEgress Defend for Microsoft Sentinel provides details of processed emails, including the type of phishing attack, payload type and information to show if the user interacted with the email in a positive (clicking on banners or submitting the phish sample) or negative (clicking on an unsafe URL) manner.\n\n**Data Connectors:** 2, **Parsers:** 2, **Workbooks:** 1, **Analytic Rules:** 2, **Hunting Queries:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -64,10 +64,10 @@ } }, { - "name": "dataconnectors-parser-text", + "name": "dataconnectors2-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "The Solution installs a parser that transforms the ingested data into Microsoft Sentinel normalized format. The normalized format enables better correlation of different types of data from different data sources to drive end-to-end outcomes seamlessly in security monitoring, hunting, incident investigation and response scenarios in Microsoft Sentinel." + "text": "This Solution installs the data connector for Egress Defend v2. You can get Egress Defend v2 data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { @@ -117,7 +117,7 @@ "name": "workbook1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "A workbook providing insights into the data ingested from Egress Defend." + "text": "A workbook providing insights into Egress Defend." } } ] @@ -211,7 +211,7 @@ "name": "huntingquery1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This will check for emails that Defend has identified as dangerous and a user has clicked a link. This hunting query depends on EgressDefend data connector (EgressDefend_CL Parser or Table)" + "text": "This will check for emails that Defend has identified as dangerous and a user has clicked a link. This hunting query depends on EgressDefend data connector (EgressDefend_CL EgressDefend_v4_CL Parser or Table)" } } ] diff --git a/Solutions/Egress Defend/Package/mainTemplate.json b/Solutions/Egress Defend/Package/mainTemplate.json index 0fddb3616b4..225dfe184df 100644 --- a/Solutions/Egress Defend/Package/mainTemplate.json +++ b/Solutions/Egress Defend/Package/mainTemplate.json @@ -35,49 +35,69 @@ "metadata": { "description": "Name for the workbook" } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } } }, "variables": { "email": "support@egress.com", "_email": "[variables('email')]", "_solutionName": "Egress Defend", - "_solutionVersion": "3.0.0", - "solutionId": "egress1589289169584.egress-sentinel-defend", + "_solutionVersion": "3.1.0", + "solutionId": "egress1589289169584.azure-sentinel-solution-egress-defend", "_solutionId": "[variables('solutionId')]", - "workbookVersion1": "1.0.0", + "workbookVersion1": "1.1.0", "workbookContentId1": "EgressDefendMetricWorkbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", "_workbookContentId1": "[variables('workbookContentId1')]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", - "analyticRuleVersion1": "1.0.0", - "analyticRulecontentId1": "a0e55dd4-8454-4396-91e6-f28fec3d2cab", - "_analyticRulecontentId1": "[variables('analyticRulecontentId1')]", - "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId1'))]", - "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1'))))]", - "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId1'),'-', variables('analyticRuleVersion1'))))]", - "analyticRuleVersion2": "1.0.0", - "analyticRulecontentId2": "a896123e-03a5-4a4d-a7e3-fd814846dfb2", - "_analyticRulecontentId2": "[variables('analyticRulecontentId2')]", - "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId2'))]", - "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId2'))))]", - "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId2'),'-', variables('analyticRuleVersion2'))))]", - "parserName1": "DefendAuditData", - "_parserName1": "[concat(parameters('workspace'),'/',variables('parserName1'))]", - "parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "_parserId1": "[variables('parserId1')]", - "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1'))))]", - "parserVersion1": "1.0.0", - "parserContentId1": "DefendAuditData-Parser", - "_parserContentId1": "[variables('parserContentId1')]", - "_parsercontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('_parserContentId1'),'-', variables('parserVersion1'))))]", - "huntingQueryVersion1": "1.0.0", - "huntingQuerycontentId1": "57ada8d5-7a26-4440-97fd-32c5c3fd0421", - "_huntingQuerycontentId1": "[variables('huntingQuerycontentId1')]", - "huntingQueryId1": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId1'))]", - "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId1'))))]", - "_huntingQuerycontentProductId1": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId1'),'-', variables('huntingQueryVersion1'))))]", + "analyticRuleObject1": { + "analyticRuleVersion1": "1.1.0", + "_analyticRulecontentId1": "a0e55dd4-8454-4396-91e6-f28fec3d2cab", + "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a0e55dd4-8454-4396-91e6-f28fec3d2cab')]", + "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a0e55dd4-8454-4396-91e6-f28fec3d2cab')))]", + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a0e55dd4-8454-4396-91e6-f28fec3d2cab','-', '1.1.0')))]" + }, + "analyticRuleObject2": { + "analyticRuleVersion2": "1.1.0", + "_analyticRulecontentId2": "a896123e-03a5-4a4d-a7e3-fd814846dfb2", + "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a896123e-03a5-4a4d-a7e3-fd814846dfb2')]", + "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a896123e-03a5-4a4d-a7e3-fd814846dfb2')))]", + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a896123e-03a5-4a4d-a7e3-fd814846dfb2','-', '1.1.0')))]" + }, + "parserObject1": { + "_parserName1": "[concat(parameters('workspace'),'/','DefendAuditData')]", + "_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'DefendAuditData')]", + "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('DefendAuditData-Parser')))]", + "parserVersion1": "1.0.0", + "parserContentId1": "DefendAuditData-Parser" + }, + "parserObject2": { + "_parserName2": "[concat(parameters('workspace'),'/','DefendAuditData_v4')]", + "_parserId2": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'DefendAuditData_v4')]", + "parserTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('DefendAuditData_v4-Parser')))]", + "parserVersion2": "1.0.0", + "parserContentId2": "DefendAuditData_v4-Parser" + }, + "huntingQueryObject1": { + "huntingQueryVersion1": "1.0.0", + "_huntingQuerycontentId1": "57ada8d5-7a26-4440-97fd-32c5c3fd0421", + "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('57ada8d5-7a26-4440-97fd-32c5c3fd0421')))]" + }, "uiConfigId1": "EgressDefendPolling", "_uiConfigId1": "[variables('uiConfigId1')]", "dataConnectorContentId1": "EgressDefendPolling", @@ -87,6 +107,13 @@ "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", + "dataConnectorCCPVersion": "3.1.0", + "_dataConnectorContentIdConnectorDefinition2": "EgressDefendAudit", + "dataConnectorTemplateNameConnectorDefinition2": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition2')))]", + "_dataConnectorContentIdConnections2": "EgressDefendAuditConnections", + "dataConnectorTemplateNameConnections2": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections2')))]", + "dataCollectionEndpointId2": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]", + "blanks": "[replace('b', 'b', '')]", "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ @@ -99,7 +126,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DefendMetricsWorkbook Workbook with template version 3.0.0", + "description": "DefendMetrics Workbook with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -117,7 +144,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Phishing Insights\"},\"name\":\"text - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DefendAuditData\\r\\n| where isnotempty(PhishType)\\r\\n| mv-expand todynamic(PhishType)\\r\\n| summarize EmailCount=count() by tostring(PhishType), LinksClicked\\r\\n| render columnchart\",\"size\":0,\"title\":\"Number of Detected Phish Types in 48 hours\",\"timeContext\":{\"durationMs\":172800000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\",\"chartSettings\":{\"xAxis\":\"PhishType\",\"seriesLabelSettings\":[{\"seriesName\":\"LinksClicked\",\"color\":\"redDark\"},{\"seriesName\":\"EmailCount\",\"color\":\"blue\"}]}},\"name\":\"query-2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DefendAuditData\\r\\n| where ThreatLevel == \\\"suspicious\\\" or ThreatLevel == \\\"dangerous\\\"\\r\\n| mv-expand todynamic(Attachments)\\r\\n| where Attachments.name matches regex @\\\"(?i)^.*\\\\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)\\\"\\r\\n| extend path_parts = parse_path(tostring(Attachments.name))\\r\\n| where isnotempty(path_parts.Extension)\\r\\n| summarize attachmentCount=count() by tostring(path_parts.Extension)\\r\\n| render piechart\",\"size\":0,\"title\":\"Number of suspicious files detected in 48 hours\",\"timeContext\":{\"durationMs\":172800000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"yAxis\":[\"attachmentCount\"]}},\"name\":\"query - 1\"}],\"fromTemplateId\":\"sentinel-EgressDefendMetricWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Phishing Insights\"},\"name\":\"text - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DefendAuditData_v4\\r\\n| where isnotempty(PhishType)\\r\\n| mv-expand todynamic(PhishType)\\r\\n| summarize EmailCount=count() by tostring(PhishType), LinksClicked\\r\\n| render columnchart\",\"size\":0,\"title\":\"Number of Detected Phish Types in 48 hours\",\"timeContext\":{\"durationMs\":172800000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\",\"chartSettings\":{\"xAxis\":\"PhishType\",\"seriesLabelSettings\":[{\"seriesName\":\"LinksClicked\",\"color\":\"redDark\"},{\"seriesName\":\"EmailCount\",\"color\":\"blue\"}]}},\"name\":\"query-2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DefendAuditData_v4\\r\\n| where ThreatLevel == \\\"suspicious\\\" or ThreatLevel == \\\"dangerous\\\"\\r\\n| mv-expand todynamic(Attachments)\\r\\n| where Attachments.name matches regex @\\\"(?i)^.*\\\\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)\\\"\\r\\n| extend path_parts = parse_path(tostring(Attachments.name))\\r\\n| where isnotempty(path_parts.Extension)\\r\\n| summarize attachmentCount=count() by tostring(path_parts.Extension)\\r\\n| render piechart\",\"size\":0,\"title\":\"Number of suspicious files detected in 48 hours\",\"timeContext\":{\"durationMs\":172800000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"yAxis\":[\"attachmentCount\"]}},\"name\":\"query - 1\"}],\"fromTemplateId\":\"sentinel-EgressDefendMetricWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -128,7 +155,7 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", "properties": { - "description": "@{workbookKey=EgressDefendMetricWorkbook; logoFileName=; description=A workbook providing insights into Egress Defend.; dataTypesDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Egress Defend Insights; templateRelativePath=DefendMetrics.json; subtitle=Defend Metrics; provider=Egress Software Technologies}.description", + "description": "@{workbookKey=EgressDefendMetricWorkbook; logoFileName=Egress-logo.svg; description=A workbook providing insights into Egress Defend.; dataTypesDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.1.0; title=Egress Defend Insights; templateRelativePath=DefendMetrics.json; subtitle=Defend Metrics; provider=Egress Software Technologies}.description", "parentId": "[variables('workbookId1')]", "contentId": "[variables('_workbookContentId1')]", "kind": "Workbook", @@ -143,7 +170,7 @@ "email": "[variables('_email')]" }, "support": { - "name": "Egress", + "name": "egress1589289169584", "email": "support@egress.com", "tier": "Partner", "link": "https://support.egress.com/s/" @@ -154,6 +181,10 @@ { "contentId": "EgressDefend_CL", "kind": "DataType" + }, + { + "contentId": "EgressDefend_v4_CL", + "kind": "DataType" } ] } @@ -178,30 +209,30 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName1')]", + "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DangerousAttachmentReceived_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "DangerousAttachmentReceived_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion1')]", + "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId1')]", - "apiVersion": "2022-04-01-preview", + "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "apiVersion": "2023-02-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { "description": "Defend has detected a user has a suspicious file type from a suspicious sender in their mailbox.", "displayName": "Egress Defend - Dangerous Attachment Detected", "enabled": false, - "query": "DefendAuditData\n| where ThreatLevel == \"suspicious\" or ThreatLevel == \"dangerous\"\n| mv-expand todynamic(Attachments)\n| where Attachments.name matches regex @\"(?i)^.*\\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)\"\n| summarize attachmentCount=count() by TimeGenerated, tostring(Attachments.name), Subject, From, Account_0_FullName = trim(@\"[^@.\\w]+\",Recipients), timesClicked = LinksClicked, SenderIP\n", + "query": "DefendAuditData_v4\n| where ThreatLevel == \"suspicious\" or ThreatLevel == \"dangerous\"\n| mv-expand todynamic(Attachments)\n| where Attachments.name matches regex @\"(?i)^.*\\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)\"\n| summarize attachmentCount=count() by TimeGenerated, tostring(Attachments.name), Subject, From, Account_0_FullName = trim(@\"[^@.\\w]+\",Recipients), timesClicked = LinksClicked, SenderIP\n", "queryFrequency": "PT30M", "queryPeriod": "PT30M", "severity": "Medium", @@ -212,10 +243,11 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "EgressDefend", "dataTypes": [ - "EgressDefend_CL" - ] + "EgressDefend_CL", + "EgressDefend_v4_CL" + ], + "connectorId": "EgressDefend" } ], "tactics": [ @@ -229,15 +261,14 @@ "T0853", "T0863", "T1566", - "T1546", "T1546" ], "entityMappings": [ { "fieldMappings": [ { - "columnName": "Account_0_FullName", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "Account_0_FullName" } ], "entityType": "Account" @@ -245,8 +276,8 @@ { "fieldMappings": [ { - "columnName": "Attachments_name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Attachments_name" } ], "entityType": "File" @@ -254,8 +285,8 @@ { "fieldMappings": [ { - "columnName": "Account_0_FullName", - "identifier": "MailboxPrimaryAddress" + "identifier": "MailboxPrimaryAddress", + "columnName": "Account_0_FullName" } ], "entityType": "Mailbox" @@ -263,8 +294,8 @@ { "fieldMappings": [ { - "columnName": "SenderIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "SenderIP" } ], "entityType": "IP" @@ -278,13 +309,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]", "properties": { "description": "Egress Defend Analytics Rule 1", - "parentId": "[variables('analyticRuleId1')]", - "contentId": "[variables('_analyticRulecontentId1')]", + "parentId": "[variables('analyticRuleObject1').analyticRuleId1]", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion1')]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]", "source": { "kind": "Solution", "name": "Egress Defend", @@ -295,7 +326,7 @@ "email": "[variables('_email')]" }, "support": { - "name": "Egress", + "name": "egress1589289169584", "email": "support@egress.com", "tier": "Partner", "link": "https://support.egress.com/s/" @@ -309,41 +340,41 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId1')]", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", "contentKind": "AnalyticsRule", "displayName": "Egress Defend - Dangerous Attachment Detected", - "contentProductId": "[variables('_analyticRulecontentProductId1')]", - "id": "[variables('_analyticRulecontentProductId1')]", - "version": "[variables('analyticRuleVersion1')]" + "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName2')]", + "name": "[variables('analyticRuleObject2').analyticRuleTemplateSpecName2]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DangerousLinksClicked_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "DangerousLinksClicked_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion2')]", + "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId2')]", - "apiVersion": "2022-04-01-preview", + "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "apiVersion": "2023-02-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { "description": "Defend has detected a user has clicked a dangerous link in their mailbox.", "displayName": "Egress Defend - Dangerous Link Click", "enabled": false, - "query": "DefendAuditData\n| where LinksClicked > 0\n| where ThreatLevel == \"dangerous\" or ThreatLevel == \"suspicious\"\n| extend Account_0_FullName = trim(@\"[^@.\\w]+\",Recipients)\n", + "query": "DefendAuditData_v4\n| where LinksClicked > 0\n| where ThreatLevel == \"dangerous\" or ThreatLevel == \"suspicious\"\n| extend Account_0_FullName = trim(@\"[^@.\\w]+\",Recipients)\n", "queryFrequency": "PT30M", "queryPeriod": "PT30M", "severity": "Medium", @@ -354,10 +385,11 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "EgressDefend", "dataTypes": [ - "EgressDefend_CL" - ] + "EgressDefend_CL", + "EgressDefend_v4_CL" + ], + "connectorId": "EgressDefend" } ], "tactics": [ @@ -371,8 +403,8 @@ { "fieldMappings": [ { - "columnName": "Account_0_FullName", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "Account_0_FullName" } ], "entityType": "Account" @@ -380,8 +412,8 @@ { "fieldMappings": [ { - "columnName": "SenderIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "SenderIP" } ], "entityType": "IP" @@ -389,8 +421,8 @@ { "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } ], "entityType": "URL" @@ -398,17 +430,17 @@ { "fieldMappings": [ { - "columnName": "Account_0_FullName", - "identifier": "MailboxPrimaryAddress" + "identifier": "MailboxPrimaryAddress", + "columnName": "Account_0_FullName" } ], "entityType": "Mailbox" } ], "customDetails": { + "timesClicked": "LinksClicked", "DefendSender": "From", - "DefendSenderIP": "SenderIP", - "timesClicked": "LinksClicked" + "DefendSenderIP": "SenderIP" }, "alertDetailsOverride": { "alertDisplayNameFormat": "Alert - {{Account_0_FullName}} as clicked a suspicious link." @@ -418,13 +450,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId2'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject2').analyticRuleId2,'/'))))]", "properties": { "description": "Egress Defend Analytics Rule 2", - "parentId": "[variables('analyticRuleId2')]", - "contentId": "[variables('_analyticRulecontentId2')]", + "parentId": "[variables('analyticRuleObject2').analyticRuleId2]", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion2')]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]", "source": { "kind": "Solution", "name": "Egress Defend", @@ -435,7 +467,7 @@ "email": "[variables('_email')]" }, "support": { - "name": "Egress", + "name": "egress1589289169584", "email": "support@egress.com", "tier": "Partner", "link": "https://support.egress.com/s/" @@ -449,33 +481,33 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId2')]", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "contentKind": "AnalyticsRule", "displayName": "Egress Defend - Dangerous Link Click", - "contentProductId": "[variables('_analyticRulecontentProductId2')]", - "id": "[variables('_analyticRulecontentProductId2')]", - "version": "[variables('analyticRuleVersion2')]" + "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('parserTemplateSpecName1')]", + "name": "[variables('parserObject1').parserTemplateSpecName1]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DefendAuditData Data Parser with template version 3.0.0", + "description": "DefendAuditData Data Parser with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('parserVersion1')]", + "contentVersion": "[variables('parserObject1').parserVersion1]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[variables('_parserName1')]", - "apiVersion": "2022-10-01", + "name": "[variables('parserObject1')._parserName1]", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { @@ -483,7 +515,7 @@ "displayName": "DefendAuditData", "category": "Samples", "functionAlias": "DefendAuditData", - "query": "\nEgressDefend_CL\r\n| project \r\n TimeGenerated=time_t,\r\n Event=event_s,\r\n Recipients=email_rcptTo_s,\r\n From=email_mailFrom_s,\r\n Subject=columnifexists('email_subject_s', \"\"),\r\n Attachments=email_attachments_s,\r\n MessageId=email_messageId_s,\r\n ThreatLevel=email_threat_s,\r\n TrustLevel=email_trust_s,\r\n FirstTimeSender=email_firstTimeSender_b,\r\n PayLoad=columnifexists('email_payload_Type_s', \"\"),\r\n LinksClicked=email_linksClicked_d,\r\n SenderIP=email_senderIp_s,\r\n Url=linkClicked_s,\r\n PhishType=email_phishType_s\r\n ", + "query": "\nEgressDefend_CL\n| project \n TimeGenerated=time_t,\n Event=event_s,\n Recipients=email_rcptTo_s,\n From=email_mailFrom_s,\n Subject=columnifexists('email_subject_s', \"\"),\n Attachments=email_attachments_s,\n MessageId=email_messageId_s,\n ThreatLevel=email_threat_s,\n TrustLevel=email_trust_s,\n FirstTimeSender=email_firstTimeSender_b,\n PayLoad=columnifexists('email_payload_Type_s', \"\"),\n LinksClicked=email_linksClicked_d,\n SenderIP=email_senderIp_s,\n Url=linkClicked_s,\n PhishType=email_phishType_s\n ", "functionParameters": "", "version": 1, "tags": [ @@ -497,15 +529,15 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]", "dependsOn": [ - "[variables('_parserName1')]" + "[variables('parserObject1')._parserId1]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "contentId": "[variables('_parserContentId1')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'DefendAuditData')]", + "contentId": "[variables('parserObject1').parserContentId1]", "kind": "Parser", - "version": "[variables('parserVersion1')]", + "version": "[variables('parserObject1').parserVersion1]", "source": { "name": "Egress Defend", "kind": "Solution", @@ -516,7 +548,7 @@ "email": "[variables('_email')]" }, "support": { - "name": "Egress", + "name": "egress1589289169584", "email": "support@egress.com", "tier": "Partner", "link": "https://support.egress.com/s/" @@ -530,25 +562,25 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_parserContentId1')]", + "contentId": "[variables('parserObject1').parserContentId1]", "contentKind": "Parser", "displayName": "DefendAuditData", - "contentProductId": "[variables('_parsercontentProductId1')]", - "id": "[variables('_parsercontentProductId1')]", - "version": "[variables('parserVersion1')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", + "version": "[variables('parserObject1').parserVersion1]" } }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", - "name": "[variables('_parserName1')]", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject1')._parserName1]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "DefendAuditData", "category": "Samples", "functionAlias": "DefendAuditData", - "query": "\nEgressDefend_CL\r\n| project \r\n TimeGenerated=time_t,\r\n Event=event_s,\r\n Recipients=email_rcptTo_s,\r\n From=email_mailFrom_s,\r\n Subject=columnifexists('email_subject_s', \"\"),\r\n Attachments=email_attachments_s,\r\n MessageId=email_messageId_s,\r\n ThreatLevel=email_threat_s,\r\n TrustLevel=email_trust_s,\r\n FirstTimeSender=email_firstTimeSender_b,\r\n PayLoad=columnifexists('email_payload_Type_s', \"\"),\r\n LinksClicked=email_linksClicked_d,\r\n SenderIP=email_senderIp_s,\r\n Url=linkClicked_s,\r\n PhishType=email_phishType_s\r\n ", + "query": "\nEgressDefend_CL\n| project \n TimeGenerated=time_t,\n Event=event_s,\n Recipients=email_rcptTo_s,\n From=email_mailFrom_s,\n Subject=columnifexists('email_subject_s', \"\"),\n Attachments=email_attachments_s,\n MessageId=email_messageId_s,\n ThreatLevel=email_threat_s,\n TrustLevel=email_trust_s,\n FirstTimeSender=email_firstTimeSender_b,\n PayLoad=columnifexists('email_payload_Type_s', \"\"),\n LinksClicked=email_linksClicked_d,\n SenderIP=email_senderIp_s,\n Url=linkClicked_s,\n PhishType=email_phishType_s\n ", "functionParameters": "", "version": 1, "tags": [ @@ -563,15 +595,15 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "location": "[parameters('workspace-location')]", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]", "dependsOn": [ - "[variables('_parserId1')]" + "[variables('parserObject1')._parserId1]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "contentId": "[variables('_parserContentId1')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'DefendAuditData')]", + "contentId": "[variables('parserObject1').parserContentId1]", "kind": "Parser", - "version": "[variables('parserVersion1')]", + "version": "[variables('parserObject1').parserVersion1]", "source": { "kind": "Solution", "name": "Egress Defend", @@ -582,7 +614,139 @@ "email": "[variables('_email')]" }, "support": { + "name": "egress1589289169584", + "email": "support@egress.com", + "tier": "Partner", + "link": "https://support.egress.com/s/" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserObject2').parserTemplateSpecName2]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "DefendAuditData_v4 Data Parser with template version 3.1.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserObject2').parserVersion2]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[variables('parserObject2')._parserName2]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for DefendAuditData_v4", + "category": "Microsoft Sentinel Parser", + "functionAlias": "DefendAuditData_v4", + "query": "union isfuzzy=true EgressDefend_CL, EgressDefend_v4_CL\n| summarize arg_max(TimeGenerated, *) by email_messageId_s, time_t\n| project\n TimeGenerated=time_t,\n Event=event_s,\n Recipients=email_rcptTo_s,\n From=email_mailFrom_s,\n Subject=columnifexists('email_subject_s', \"\"),\n Attachments=email_attachments_s,\n MessageId=email_messageId_s,\n ThreatLevel=email_threat_s,\n TrustLevel=email_trust_s,\n FirstTimeSender=email_firstTimeSender_b,\n PayLoad=columnifexists('email_payload_Type_s', \"\"),\n LinksClicked=email_linksClicked_d,\n SenderIP=email_senderIp_s,\n Url=linkClicked_s,\n PhishType=email_phishType_s\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject2')._parserId2,'/'))))]", + "dependsOn": [ + "[variables('parserObject2')._parserId2]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'DefendAuditData_v4')]", + "contentId": "[variables('parserObject2').parserContentId2]", + "kind": "Parser", + "version": "[variables('parserObject2').parserVersion2]", + "source": { + "name": "Egress Defend", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Egress", + "email": "[variables('_email')]" + }, + "support": { + "name": "egress1589289169584", + "email": "support@egress.com", + "tier": "Partner", + "link": "https://support.egress.com/s/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject2').parserContentId2]", + "contentKind": "Parser", + "displayName": "Parser for DefendAuditData_v4", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject2').parserContentId2,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject2').parserContentId2,'-', '1.0.0')))]", + "version": "[variables('parserObject2').parserVersion2]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject2')._parserName2]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for DefendAuditData_v4", + "category": "Microsoft Sentinel Parser", + "functionAlias": "DefendAuditData_v4", + "query": "union isfuzzy=true EgressDefend_CL, EgressDefend_v4_CL\n| summarize arg_max(TimeGenerated, *) by email_messageId_s, time_t\n| project\n TimeGenerated=time_t,\n Event=event_s,\n Recipients=email_rcptTo_s,\n From=email_mailFrom_s,\n Subject=columnifexists('email_subject_s', \"\"),\n Attachments=email_attachments_s,\n MessageId=email_messageId_s,\n ThreatLevel=email_threat_s,\n TrustLevel=email_trust_s,\n FirstTimeSender=email_firstTimeSender_b,\n PayLoad=columnifexists('email_payload_Type_s', \"\"),\n LinksClicked=email_linksClicked_d,\n SenderIP=email_senderIp_s,\n Url=linkClicked_s,\n PhishType=email_phishType_s\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject2')._parserId2,'/'))))]", + "dependsOn": [ + "[variables('parserObject2')._parserId2]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'DefendAuditData_v4')]", + "contentId": "[variables('parserObject2').parserContentId2]", + "kind": "Parser", + "version": "[variables('parserObject2').parserVersion2]", + "source": { + "kind": "Solution", + "name": "Egress Defend", + "sourceId": "[variables('_solutionId')]" + }, + "author": { "name": "Egress", + "email": "[variables('_email')]" + }, + "support": { + "name": "egress1589289169584", "email": "support@egress.com", "tier": "Partner", "link": "https://support.egress.com/s/" @@ -592,29 +756,29 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName1')]", + "name": "[variables('huntingQueryObject1').huntingQueryTemplateSpecName1]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DangerousLinksClicked_HuntingQueries Hunting Query with template version 3.0.0", + "description": "DangerousLinksClicked_HuntingQueries Hunting Query with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion1')]", + "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Egress_Defend_Hunting_Query_1", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "Dangerous emails with links clicked", "category": "Hunting Queries", - "query": "EgressDefend_CL \n| where event_s == \"linkClick\" \n| where email_threat_s == \"dangerous\"\n", + "query": "DefendAuditData_v4\n| where Event == \"linkClick\"\n| where ThreatLevel == \"dangerous\"\n", "version": 2, "tags": [ { @@ -635,13 +799,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1),'/'))))]", "properties": { "description": "Egress Defend Hunting Query 1", - "parentId": "[variables('huntingQueryId1')]", - "contentId": "[variables('_huntingQuerycontentId1')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1)]", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion1')]", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]", "source": { "kind": "Solution", "name": "Egress Defend", @@ -652,7 +816,7 @@ "email": "[variables('_email')]" }, "support": { - "name": "Egress", + "name": "egress1589289169584", "email": "support@egress.com", "tier": "Partner", "link": "https://support.egress.com/s/" @@ -666,12 +830,12 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId1')]", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", "contentKind": "HuntingQuery", "displayName": "Dangerous emails with links clicked", - "contentProductId": "[variables('_huntingQuerycontentProductId1')]", - "id": "[variables('_huntingQuerycontentProductId1')]", - "version": "[variables('huntingQueryVersion1')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", + "version": "1.0.0" } }, { @@ -683,7 +847,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Egress Defend data connector with template version 3.0.0", + "description": "Egress Defend data connector with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -732,7 +896,7 @@ ], "availability": { "status": 1, - "isPreview": true + "isPreview": false }, "permissions": { "resourceProvider": [ @@ -835,7 +999,7 @@ "email": "[variables('_email')]" }, "support": { - "name": "Egress", + "name": "egress1589289169584", "email": "support@egress.com", "tier": "Partner", "link": "https://support.egress.com/s/" @@ -880,7 +1044,7 @@ "email": "[variables('_email')]" }, "support": { - "name": "Egress", + "name": "egress1589289169584", "email": "support@egress.com", "tier": "Partner", "link": "https://support.egress.com/s/" @@ -929,7 +1093,7 @@ ], "availability": { "status": 1, - "isPreview": true + "isPreview": false }, "permissions": { "resourceProvider": [ @@ -1013,17 +1177,631 @@ } } }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition2'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition2')]", + "displayName": "Egress Defend v2", + "contentKind": "DataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition2'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "EgressDefendAudit", + "title": "Egress Defend v2", + "publisher": "Egress Software Technologies", + "descriptionMarkdown": "The Egress Defend audit connector ingests Egress Defend audit data into Microsoft Sentinel via the Logs Ingestion API (DCR-based). It pulls from the Egress Defend `V1/events` API and lands events in the `EgressDefend_v4_CL` table.", + "graphQueriesTableName": "EgressDefend_v4_CL", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "Egress Defend Events", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "All logs", + "query": "DefendAuditData_v4" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions on the Log Analytics workspace are required to enable the data connector.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true, + "action": false + } + } + ], + "customs": [ + { + "name": "Egress Defend API access", + "description": "An Egress Defend API URL, customer domain and API key are required to ingest audit records into Microsoft Sentinel." + } + ] + }, + "instructionSteps": [ + { + "title": "Connect Egress Defend to Microsoft Sentinel", + "description": "Enter your Egress Defend API URL, Egress domain and API key, then click Connect.", + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "API URL", + "type": "text", + "name": "apiUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Domain name", + "type": "text", + "name": "domain", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "API Key", + "type": "password", + "name": "apiKey", + "validations": { + "required": true + } + } + }, + { + "type": "ConnectionToggleButton", + "parameters": { + "name": "connect" + } + } + ] + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition2')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition2'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "Egress", + "email": "[variables('_email')]" + }, + "support": { + "name": "egress1589289169584", + "email": "support@egress.com", + "tier": "Partner", + "link": "https://support.egress.com/s/" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections2')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "name": "EgressDefendV4", + "apiVersion": "2022-06-01", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "[parameters('workspace-location')]", + "kind": "[variables('blanks')]", + "properties": { + "dataCollectionEndpointId": "[variables('dataCollectionEndpointId2')]", + "streamDeclarations": { + "Custom-EgressDefend_v4_CL": { + "columns": [ + { + "name": "time", + "type": "datetime" + }, + { + "name": "event", + "type": "string" + }, + { + "name": "linkClicked", + "type": "string" + }, + { + "name": "email", + "type": "dynamic" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "[variables('workspaceResourceId')]", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-EgressDefend_v4_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | project TimeGenerated = todatetime(['time']), time_t = todatetime(['time']), event_s = tostring(['event']), linkClicked_s = tostring(linkClicked), email_rcptTo_s = tostring(email.rcptTo), email_mailFrom_s = tostring(email.mailFrom), email_subject_s = tostring(email.subject), email_attachments_s = tostring(email.attachments), email_messageId_s = tostring(email.messageId), email_threat_s = tostring(email.threat), email_trust_s = tostring(email.trust), email_firstTimeSender_b = tobool(email.firstTimeSender), email_payload_Type_s = tostring(email.payloadType), email_linksClicked_d = toreal(email.linksClicked), email_senderIp_s = tostring(email.senderIp), email_phishType_s = tostring(email.phishType)", + "outputStream": "Custom-EgressDefend_v4_CL" + } + ] + } + }, + { + "name": "EgressDefend_v4_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "schema": { + "name": "EgressDefend_v4_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true, + "description": "The time the event was generated." + }, + { + "name": "time_t", + "type": "datetime", + "description": "Event time reported by Egress Defend." + }, + { + "name": "event_s", + "type": "string", + "description": "Event type." + }, + { + "name": "linkClicked_s", + "type": "string", + "description": "The link that was clicked, if any." + }, + { + "name": "email_rcptTo_s", + "type": "string", + "description": "Recipients." + }, + { + "name": "email_mailFrom_s", + "type": "string", + "description": "Sender address." + }, + { + "name": "email_subject_s", + "type": "string", + "description": "Email subject." + }, + { + "name": "email_attachments_s", + "type": "string", + "description": "Serialized list of attachments." + }, + { + "name": "email_messageId_s", + "type": "string", + "description": "Message identifier." + }, + { + "name": "email_threat_s", + "type": "string", + "description": "Threat level." + }, + { + "name": "email_trust_s", + "type": "string", + "description": "Trust level." + }, + { + "name": "email_firstTimeSender_b", + "type": "boolean", + "description": "Whether this is a first-time sender." + }, + { + "name": "email_payload_Type_s", + "type": "string", + "description": "Payload type." + }, + { + "name": "email_linksClicked_d", + "type": "real", + "description": "Number of links clicked." + }, + { + "name": "email_senderIp_s", + "type": "string", + "description": "Sender IP address." + }, + { + "name": "email_phishType_s", + "type": "string", + "description": "Serialized list of phishing types." + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition2'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition2'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "EgressDefendAudit", + "title": "Egress Defend v2", + "publisher": "Egress Software Technologies", + "descriptionMarkdown": "The Egress Defend audit connector ingests Egress Defend audit data into Microsoft Sentinel via the Logs Ingestion API (DCR-based). It pulls from the Egress Defend `V1/events` API and lands events in the `EgressDefend_v4_CL` table.", + "graphQueriesTableName": "EgressDefend_v4_CL", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "Egress Defend Events", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "All logs", + "query": "DefendAuditData_v4" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions on the Log Analytics workspace are required to enable the data connector.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true, + "action": false + } + } + ], + "customs": [ + { + "name": "Egress Defend API access", + "description": "An Egress Defend API URL, customer domain and API key are required to ingest audit records into Microsoft Sentinel." + } + ] + }, + "instructionSteps": [ + { + "title": "Connect Egress Defend to Microsoft Sentinel", + "description": "Enter your Egress Defend API URL, Egress domain and API key, then click Connect.", + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "API URL", + "type": "text", + "name": "apiUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Domain name", + "type": "text", + "name": "domain", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "API Key", + "type": "password", + "name": "apiKey", + "validations": { + "required": true + } + } + }, + { + "type": "ConnectionToggleButton", + "parameters": { + "name": "connect" + } + } + ] + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition2')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition2'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "Egress", + "email": "[variables('_email')]" + }, + "support": { + "name": "egress1589289169584", + "email": "support@egress.com", + "tier": "Partner", + "link": "https://support.egress.com/s/" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections2')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections2'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnections2')]", + "displayName": "Egress Defend v2", + "contentKind": "ResourcesDataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": { + "guidValue": { + "defaultValue": "[[newGuid()]", + "type": "securestring" + }, + "innerWorkspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "connectorDefinitionName": { + "defaultValue": "Egress Defend v2", + "type": "securestring", + "minLength": 1 + }, + "workspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "dcrConfig": { + "defaultValue": { + "dataCollectionEndpoint": "data collection Endpoint", + "dataCollectionRuleImmutableId": "data collection rule immutableId" + }, + "type": "object" + }, + "apiUrl": { + "defaultValue": "apiUrl", + "type": "securestring", + "minLength": 1 + }, + "domain": { + "defaultValue": "domain", + "type": "securestring", + "minLength": 1 + }, + "apiKey": { + "defaultValue": "apiKey", + "type": "securestring", + "minLength": 1 + } + }, + "variables": { + "_dataConnectorContentIdConnections2": "[variables('_dataConnectorContentIdConnections2')]" + }, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections2')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections2'))]", + "contentId": "[variables('_dataConnectorContentIdConnections2')]", + "kind": "ResourcesDataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "Egress", + "email": "[variables('_email')]" + }, + "support": { + "name": "egress1589289169584", + "email": "support@egress.com", + "tier": "Partner", + "link": "https://support.egress.com/s/" + } + } + }, + { + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'EgressDefendAudit', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "EgressDefendAudit", + "dataType": "EgressDefend_v4_CL", + "dcrConfig": { + "streamName": "Custom-EgressDefend_v4_CL", + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" + }, + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('apiKey')]", + "ApiKeyName": "X-Api-Key", + "IsApiKeyInPostPayload": false + }, + "request": { + "apiEndpoint": "[[concat('https://',parameters('apiUrl'),'/V1/events/?pagingMode=offset&domain=',parameters('domain'))]", + "httpMethod": "Get", + "startTimeAttributeName": "startTime", + "endTimeAttributeName": "endTime", + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ss.fffZ", + "queryWindowInMin": 5, + "retryCount": 2, + "timeoutInSeconds": 120, + "headers": { + "Accept": "application/json" + } + }, + "paging": { + "pagingType": "Offset", + "offsetParaName": "offset", + "pageSizeParaName": "limit", + "pageSize": 100 + }, + "response": { + "eventsJsonPaths": [ + "$..items" + ], + "format": "json" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections2'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.0", + "version": "3.1.0", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Egress Defend", "publisherDisplayName": "egress1589289169584", - "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Egress Defend for Microsoft Sentinel provides details of processed emails, including the type of phishing attack, payload type and information to show if the user interacted with the email in a positive (clicking on banners or submitting the phish sample) or negative (clicking on an unsafe URL) manner.

\n

Data Connectors: 1, Parsers: 1, Workbooks: 1, Analytic Rules: 2, Hunting Queries: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Egress Defend for Microsoft Sentinel provides details of processed emails, including the type of phishing attack, payload type and information to show if the user interacted with the email in a positive (clicking on banners or submitting the phish sample) or negative (clicking on an unsafe URL) manner.

\n

Data Connectors: 2, Parsers: 2, Workbooks: 1, Analytic Rules: 2, Hunting Queries: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -1040,7 +1818,7 @@ "email": "[variables('_email')]" }, "support": { - "name": "Egress", + "name": "egress1589289169584", "email": "support@egress.com", "tier": "Partner", "link": "https://support.egress.com/s/" @@ -1055,28 +1833,38 @@ }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId1')]", - "version": "[variables('analyticRuleVersion1')]" + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId2')]", - "version": "[variables('analyticRuleVersion2')]" + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject1').parserContentId1]", + "version": "[variables('parserObject1').parserVersion1]" }, { "kind": "Parser", - "contentId": "[variables('_parserContentId1')]", - "version": "[variables('parserVersion1')]" + "contentId": "[variables('parserObject2').parserContentId2]", + "version": "[variables('parserObject2').parserVersion2]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId1')]", - "version": "[variables('huntingQueryVersion1')]" + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]" }, { "kind": "DataConnector", "contentId": "[variables('_dataConnectorContentId1')]", "version": "[variables('dataConnectorVersion1')]" + }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentIdConnections2')]", + "version": "[variables('dataConnectorCCPVersion')]" } ] }, diff --git a/Solutions/Egress Defend/Package/testParameters.json b/Solutions/Egress Defend/Package/testParameters.json new file mode 100644 index 00000000000..adb43070cd7 --- /dev/null +++ b/Solutions/Egress Defend/Package/testParameters.json @@ -0,0 +1,46 @@ +{ + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + }, + "workbook1-name": { + "type": "string", + "defaultValue": "Egress Defend Insights", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } + } +} diff --git a/Solutions/Egress Defend/Parsers/DefendAuditData_v4.yaml b/Solutions/Egress Defend/Parsers/DefendAuditData_v4.yaml new file mode 100644 index 00000000000..2463196b48f --- /dev/null +++ b/Solutions/Egress Defend/Parsers/DefendAuditData_v4.yaml @@ -0,0 +1,27 @@ +id: 0d23aae5-6f59-47d8-902e-ba136b64a095 +Function: + Title: Parser for DefendAuditData_v4 + Version: '1.0.0' + LastUpdated: '2026-08-19' +Category: Microsoft Sentinel Parser +FunctionName: DefendAuditData_v4 +FunctionAlias: DefendAuditData_v4 +FunctionQuery: | + union isfuzzy=true EgressDefend_CL, EgressDefend_v4_CL + | summarize arg_max(TimeGenerated, *) by email_messageId_s, time_t + | project + TimeGenerated=time_t, + Event=event_s, + Recipients=email_rcptTo_s, + From=email_mailFrom_s, + Subject=columnifexists('email_subject_s', ""), + Attachments=email_attachments_s, + MessageId=email_messageId_s, + ThreatLevel=email_threat_s, + TrustLevel=email_trust_s, + FirstTimeSender=email_firstTimeSender_b, + PayLoad=columnifexists('email_payload_Type_s', ""), + LinksClicked=email_linksClicked_d, + SenderIP=email_senderIp_s, + Url=linkClicked_s, + PhishType=email_phishType_s diff --git a/Solutions/Egress Defend/ReleaseNotes.md b/Solutions/Egress Defend/ReleaseNotes.md index df6cdfdfc02..e18b2d31fbd 100644 --- a/Solutions/Egress Defend/ReleaseNotes.md +++ b/Solutions/Egress Defend/ReleaseNotes.md @@ -1,3 +1,4 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------| +| 3.1.0 | 01-09-2026 | Added a new **Data Connector** using the Logs Ingestion API (CCF RestApiPoller with DCR/DCE), replacing the retiring HTTP Data Collector API. Added a new **Parser** `DefendAuditData_v4`. Updated **Analytic Rules**, **Workbook** and **Hunting Query** to read from `DefendAuditData_v4`. The original connector, table and parser are unchanged, so existing installations keep working until the new connector is enabled. | | 3.0.0 | 02-08-2023 | Initial Solution Release. | diff --git a/Solutions/Egress Defend/Workbooks/DefendMetrics.json b/Solutions/Egress Defend/Workbooks/DefendMetrics.json index 6be5abcf5f4..1c5c0b2faee 100644 --- a/Solutions/Egress Defend/Workbooks/DefendMetrics.json +++ b/Solutions/Egress Defend/Workbooks/DefendMetrics.json @@ -12,7 +12,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "DefendAuditData\r\n| where isnotempty(PhishType)\r\n| mv-expand todynamic(PhishType)\r\n| summarize EmailCount=count() by tostring(PhishType), LinksClicked\r\n| render columnchart", + "query": "DefendAuditData_v4\r\n| where isnotempty(PhishType)\r\n| mv-expand todynamic(PhishType)\r\n| summarize EmailCount=count() by tostring(PhishType), LinksClicked\r\n| render columnchart", "size": 0, "title": "Number of Detected Phish Types in 48 hours", "timeContext": { @@ -41,7 +41,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "DefendAuditData\r\n| where ThreatLevel == \"suspicious\" or ThreatLevel == \"dangerous\"\r\n| mv-expand todynamic(Attachments)\r\n| where Attachments.name matches regex @\"(?i)^.*\\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)\"\r\n| extend path_parts = parse_path(tostring(Attachments.name))\r\n| where isnotempty(path_parts.Extension)\r\n| summarize attachmentCount=count() by tostring(path_parts.Extension)\r\n| render piechart", + "query": "DefendAuditData_v4\r\n| where ThreatLevel == \"suspicious\" or ThreatLevel == \"dangerous\"\r\n| mv-expand todynamic(Attachments)\r\n| where Attachments.name matches regex @\"(?i)^.*\\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)\"\r\n| extend path_parts = parse_path(tostring(Attachments.name))\r\n| where isnotempty(path_parts.Extension)\r\n| summarize attachmentCount=count() by tostring(path_parts.Extension)\r\n| render piechart", "size": 0, "title": "Number of suspicious files detected in 48 hours", "timeContext": { diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json index f9c2d9dd247..dcc968618a6 100644 --- a/Workbooks/WorkbooksMetadata.json +++ b/Workbooks/WorkbooksMetadata.json @@ -7980,13 +7980,14 @@ "logoFileName": "Egress-logo.svg", "description": "A workbook providing insights into Egress Defend.", "dataTypesDependencies": [ - "EgressDefend_CL" + "EgressDefend_CL", + "EgressDefend_v4_CL" ], "previewImagesFileNames": [ "EgressDefendMetricWorkbookBlack01.png", "EgressDefendMetricWorkbookWhite01.png" ], - "version": "1.0.0", + "version": "1.1.0", "title": "Egress Defend Insights", "templateRelativePath": "DefendMetrics.json", "subtitle": "Defend Metrics",