[Egress Defend] Add KnowBe4 Defend Logs Ingestion API (DCR) connector…

.script/tests/KqlvalidationsTests/CustomTables/DefendAuditData_v4.json

@@ -0,0 +1,65 @@
+{
+    "Name": "DefendAuditData_v4",
+    "Properties": [
+      {
+        "Name": "TimeGenerated",
+        "Type": "DateTime"
+      },
+      {
+        "Name": "Event",
+        "Type": "String"
+      },
+      {
+        "Name": "Recipients",
+        "Type": "String"
+      },
+      {
+        "Name": "From",
+        "Type": "String"
+      },
+      {
+        "Name": "Subject",
+        "Type": "String"
+      },
+      {
+        "Name": "Attachments",
+        "Type": "String"
+      },
+      {
+        "Name": "MessageId",
+        "Type": "String"
+      },
+      {
+        "Name": "ThreatLevel",
+        "Type": "String"
+      },
+      {
+        "Name": "TrustLevel",
+        "Type": "String"
+      },
+      {
+        "Name": "FirstTimeSender",
+        "Type": "Bool"
+      },
+      {
+        "Name": "PayLoad",
+        "Type": "String"
+      },
+      {
+        "Name": "LinksClicked",
+        "Type": "Double"
+      },
+      {
+        "Name": "SenderIP",
+        "Type": "String"
+      },
+      {
+        "Name": "Url",
+        "Type": "String"
+      },
+      {
+        "Name": "PhishType",
+        "Type": "String"
+      }
+    ]
+  }

.script/tests/KqlvalidationsTests/CustomTables/EgressDefend_v4_CL.json

@@ -0,0 +1,69 @@
+{
+    "Name": "EgressDefend_v4_CL",
+    "Properties": [
+      {
+        "Name": "TimeGenerated",
+        "Type": "DateTime"
+      },
+      {
+        "Name": "time_t",
+        "Type": "DateTime"
+      },
+      {
+        "Name": "event_s",
+        "Type": "String"
+      },
+      {
+        "Name": "linkClicked_s",
+        "Type": "String"
+      },
+      {
+        "Name": "email_rcptTo_s",
+        "Type": "String"
+      },
+      {
+        "Name": "email_mailFrom_s",
+        "Type": "String"
+      },
+      {
+        "Name": "email_subject_s",
+        "Type": "String"
+      },
+      {
+        "Name": "email_attachments_s",
+        "Type": "String"
+      },
+      {
+        "Name": "email_messageId_s",
+        "Type": "String"
+      },
+      {
+        "Name": "email_threat_s",
+        "Type": "String"
+      },
+      {
+        "Name": "email_trust_s",
+        "Type": "String"
+      },
+      {
+        "Name": "email_firstTimeSender_b",
+        "Type": "Bool"
+      },
+      {
+        "Name": "email_payload_Type_s",
+        "Type": "String"
+      },
+      {
+        "Name": "email_linksClicked_d",
+        "Type": "Double"
+      },
+      {
+        "Name": "email_senderIp_s",
+        "Type": "String"
+      },
+      {
+        "Name": "email_phishType_s",
+        "Type": "String"
+      }
+    ]
+  }

Solutions/Egress Defend/Analytic Rules/DangerousAttachmentReceived.yaml

@@ -8,6 +8,7 @@ requiredDataConnectors:
   - connectorId: EgressDefend
     dataTypes:
       - EgressDefend_CL
+      - EgressDefend_v4_CL
 queryFrequency: 30m
 queryPeriod: 30m
 triggerOperator: gt
@@ -27,7 +28,7 @@ relevantTechniques:
 tags:
   - Defend
 query: |
-  DefendAuditData
+  DefendAuditData_v4
   | where ThreatLevel == "suspicious" or ThreatLevel == "dangerous"
   | mv-expand todynamic(Attachments)
   | where Attachments.name matches regex @"(?i)^.*\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)"
@@ -51,5 +52,5 @@ entityMappings:
         columnName: SenderIP
 alertDetailsOverride:
   alertDisplayNameFormat: Alert - {{Account_0_FullName}} has suspicious attachment.
-version: 1.0.0
+version: 1.1.0
 kind: Scheduled

Solutions/Egress Defend/Analytic Rules/DangerousLinksClicked.yaml

@@ -8,6 +8,7 @@ requiredDataConnectors:
   - connectorId: EgressDefend
     dataTypes:
       - EgressDefend_CL
+      - EgressDefend_v4_CL
 queryFrequency: 30m
 queryPeriod: 30m
 triggerOperator: gt
@@ -20,7 +21,7 @@ relevantTechniques:
 tags:
   - Defend
 query: |
-  DefendAuditData
+  DefendAuditData_v4
   | where LinksClicked > 0
   | where ThreatLevel == "dangerous" or ThreatLevel == "suspicious"
   | extend Account_0_FullName = trim(@"[^@.\w]+",Recipients)
@@ -47,5 +48,5 @@ customDetails:
   timesClicked: LinksClicked
 alertDetailsOverride:
   alertDisplayNameFormat: Alert - {{Account_0_FullName}} as clicked a suspicious link.
-version: 1.0.0
+version: 1.1.0
 kind: Scheduled

Solutions/Egress Defend/Data Connectors/EgressDefendAuditLogs_ccp/EgressDefendAudit_ConnectorDefinition.json

@@ -0,0 +1,112 @@
+{
+  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
+  "apiVersion": "2022-09-01-preview",
+  "name": "EgressDefendAudit",
+  "location": "{{location}}",
+  "kind": "Customizable",
+  "properties": {
+    "connectorUiConfig": {
+      "id": "EgressDefendAudit",
+      "title": "Egress Defend v2",
+      "publisher": "Egress Software Technologies",
+      "descriptionMarkdown": "The Egress Defend audit connector ingests Egress Defend audit data into Microsoft Sentinel via the Logs Ingestion API (DCR-based). It pulls from the Egress Defend `V1/events` API and lands events in the `EgressDefend_v4_CL` table.",
+      "graphQueriesTableName": "EgressDefend_v4_CL",
+      "graphQueries": [
+        {
+          "metricName": "Total data received",
+          "legend": "Egress Defend Events",
+          "baseQuery": "{{graphQueriesTableName}}"
+        }
+      ],
+      "sampleQueries": [
+        {
+          "description": "All logs",
+          "query": "DefendAuditData_v4"
+        }
+      ],
+      "dataTypes": [
+        {
+          "name": "{{graphQueriesTableName}}",
+          "lastDataReceivedQuery": "{{graphQueriesTableName}}\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
+        }
+      ],
+      "connectivityCriteria": [
+        {
+          "type": "HasDataConnectors"
+        }
+      ],
+      "availability": {
+        "isPreview": false
+      },
+      "permissions": {
+        "resourceProvider": [
+          {
+            "provider": "Microsoft.OperationalInsights/workspaces",
+            "permissionsDisplayText": "Read and Write permissions on the Log Analytics workspace are required to enable the data connector.",
+            "providerDisplayName": "Workspace",
+            "scope": "Workspace",
+            "requiredPermissions": {
+              "read": true,
+              "write": true,
+              "delete": true,
+              "action": false
+            }
+          }
+        ],
+        "customs": [
+          {
+            "name": "Egress Defend API access",
+            "description": "An Egress Defend API URL, customer domain and API key are required to ingest audit records into Microsoft Sentinel."
+          }
+        ]
+      },
+      "instructionSteps": [
+        {
+          "title": "Connect Egress Defend to Microsoft Sentinel",
+          "description": "Enter your Egress Defend API URL, Egress domain and API key, then click Connect.",
+          "instructions": [
+            {
+              "type": "Textbox",
+              "parameters": {
+                "label": "API URL",
+                "type": "text",
+                "name": "apiUrl",
+                "validations": {
+                  "required": true
+                }
+              }
+            },
+            {
+              "type": "Textbox",
+              "parameters": {
+                "label": "Domain name",
+                "type": "text",
+                "name": "domain",
+                "validations": {
+                  "required": true
+                }
+              }
+            },
+            {
+              "type": "Textbox",
+              "parameters": {
+                "label": "API Key",
+                "type": "password",
+                "name": "apiKey",
+                "validations": {
+                  "required": true
+                }
+              }
+            },
+            {
+              "type": "ConnectionToggleButton",
+              "parameters": {
+                "name": "connect"
+              }
+            }
+          ]
+        }
+      ]
+    }
+  }
+}

Solutions/Egress Defend/Data Connectors/EgressDefendAuditLogs_ccp/EgressDefendAudit_DCR.json

@@ -0,0 +1,41 @@
+[
+  {
+    "name": "EgressDefendV4",
+    "apiVersion": "2021-09-01-preview",
+    "type": "Microsoft.Insights/dataCollectionRules",
+    "location": "{{location}}",
+    "properties": {
+      "dataCollectionEndpointId": "{{dataCollectionEndpointId}}",
+      "streamDeclarations": {
+        "Custom-EgressDefend_v4_CL": {
+          "columns": [
+            { "name": "time", "type": "datetime" },
+            { "name": "event", "type": "string" },
+            { "name": "linkClicked", "type": "string" },
+            { "name": "email", "type": "dynamic" }
+          ]
+        }
+      },
+      "destinations": {
+        "logAnalytics": [
+          {
+            "workspaceResourceId": "{{workspaceResourceId}}",
+            "name": "clv2ws1"
+          }
+        ]
+      },
+      "dataFlows": [
+        {
+          "streams": [
+            "Custom-EgressDefend_v4_CL"
+          ],
+          "destinations": [
+            "clv2ws1"
+          ],
+          "transformKql": "source | project TimeGenerated = todatetime(['time']), time_t = todatetime(['time']), event_s = tostring(['event']), linkClicked_s = tostring(linkClicked), email_rcptTo_s = tostring(email.rcptTo), email_mailFrom_s = tostring(email.mailFrom), email_subject_s = tostring(email.subject), email_attachments_s = tostring(email.attachments), email_messageId_s = tostring(email.messageId), email_threat_s = tostring(email.threat), email_trust_s = tostring(email.trust), email_firstTimeSender_b = tobool(email.firstTimeSender), email_payload_Type_s = tostring(email.payloadType), email_linksClicked_d = toreal(email.linksClicked), email_senderIp_s = tostring(email.senderIp), email_phishType_s = tostring(email.phishType)",
+          "outputStream": "Custom-EgressDefend_v4_CL"
+        }
+      ]
+    }
+  }
+]

Solutions/Egress Defend/Data Connectors/EgressDefendAuditLogs_ccp/EgressDefendAudit_PollerConfig.json

@@ -0,0 +1,46 @@
+[
+  {
+    "type": "Microsoft.SecurityInsights/dataConnectors",
+    "apiVersion": "2022-10-01-preview",
+    "name": "EgressDefendAudit",
+    "kind": "RestApiPoller",
+    "properties": {
+      "connectorDefinitionName": "EgressDefendAudit",
+      "dataType": "EgressDefend_v4_CL",
+      "dcrConfig": {
+        "streamName": "Custom-EgressDefend_v4_CL"
+      },
+      "auth": {
+        "type": "APIKey",
+        "ApiKey": "{{apiKey}}",
+        "ApiKeyName": "X-Api-Key",
+        "IsApiKeyInPostPayload": false
+      },
+      "request": {
+        "apiEndpoint": "https://{{apiUrl}}/V1/events/?pagingMode=offset&domain={{domain}}",
+        "httpMethod": "Get",
+        "startTimeAttributeName": "startTime",
+        "endTimeAttributeName": "endTime",
+        "queryTimeFormat": "yyyy-MM-ddTHH:mm:ss.fffZ",
+        "queryWindowInMin": 5,
+        "retryCount": 2,
+        "timeoutInSeconds": 120,
+        "headers": {
+          "Accept": "application/json"
+        }
+      },
+      "paging": {
+        "pagingType": "Offset",
+        "offsetParaName": "offset",
+        "pageSizeParaName": "limit",
+        "pageSize": 100
+      },
+      "response": {
+        "eventsJsonPaths": [
+          "$..items"
+        ],
+        "format": "json"
+      }
+    }
+  }
+]