diff --git a/Solutions/CiscoUmbrella/Data Connectors/CiscoUmbrella_CCP/CiscoUmbrella_DataConnectorDefinition.json b/Solutions/CiscoUmbrella/Data Connectors/CiscoUmbrella_CCP/CiscoUmbrella_DataConnectorDefinition.json index a444194380b..566cc5602ac 100644 --- a/Solutions/CiscoUmbrella/Data Connectors/CiscoUmbrella_CCP/CiscoUmbrella_DataConnectorDefinition.json +++ b/Solutions/CiscoUmbrella/Data Connectors/CiscoUmbrella_CCP/CiscoUmbrella_DataConnectorDefinition.json @@ -200,6 +200,12 @@ "content": "> **NOTE:**\n> This connector supports both Cisco-managed and customer-managed Amazon S3 buckets." } }, + { + "type": "Markdown", + "parameters": { + "content": "> **NOTE:**\n> For Customer managed paths, you can leave the S3 Bucket Prefix empty if you want to use the root of the bucket. If you specify a prefix, make sure to include the trailing slash." + } + }, { "type": "Markdown", "parameters": { @@ -227,7 +233,7 @@ { "type": "Markdown", "parameters": { - "content": "For example, the Data Path provided by Cisco is `cisco-managed-us-west-1/2003477-12345`. For the AWS S3 Bucket Name, the input S3 Bucket Name will be `cisco-managed-us-west-1`. The S3 Bucket Region will be `us-west-1`. The S3 Bucket Prefix will be `2003477-12345`." + "content": "For example, the Data Path provided by Cisco is `cisco-managed-us-west-1/2003477-12345`. For the AWS S3 Bucket Name, the input S3 Bucket Name will be `cisco-managed-us-west-1`. The S3 Bucket Region will be `us-west-1`. The S3 Bucket Prefix will be `2003477-12345/`." } }, { @@ -376,7 +382,7 @@ "type": "text", "name": "s3BucketPrefix", "validations": { - "required": true + "required": false } } } @@ -390,4 +396,4 @@ ] } } -} \ No newline at end of file +} diff --git a/Solutions/CiscoUmbrella/Data Connectors/CiscoUmbrella_CCP/CiscoUmbrella_PollingConfig.json b/Solutions/CiscoUmbrella/Data Connectors/CiscoUmbrella_CCP/CiscoUmbrella_PollingConfig.json index 8562c84ad09..051db87bdd8 100644 --- a/Solutions/CiscoUmbrella/Data Connectors/CiscoUmbrella_CCP/CiscoUmbrella_PollingConfig.json +++ b/Solutions/CiscoUmbrella/Data Connectors/CiscoUmbrella_CCP/CiscoUmbrella_PollingConfig.json @@ -25,7 +25,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/auditlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'auditlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaAdminAudit_CL", @@ -66,7 +66,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/firewalllogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'firewalllogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaCloudFirewall_CL", @@ -107,7 +107,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/dlplogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'dlplogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaDLP_CL", @@ -148,7 +148,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/dnslogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'dnslogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaDNS_CL", @@ -189,7 +189,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/fileeventlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'fileeventlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaFileEvent_CL", @@ -230,7 +230,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/intrusionlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'intrusionlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaIPS_CL", @@ -271,7 +271,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/ravpnlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'ravpnlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaRemoteAccessVPN_CL", @@ -312,7 +312,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/proxylogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'proxylogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaWebTraffic_CL", @@ -353,7 +353,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/ztnalogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'ztnalogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaZeroTrustAccess_CL", @@ -394,7 +394,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/ztnaflowlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'ztnaflowlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaZeroTrustAccessFlow_CL", @@ -409,4 +409,4 @@ }, "condition": "[[equals(parameters('selectedDataType')[0], 'CiscoUmbrellaZeroTrustAccessFlow')]" } -] \ No newline at end of file +] diff --git a/Solutions/CiscoUmbrella/Data/Solution_CiscoUmbrella.json b/Solutions/CiscoUmbrella/Data/Solution_CiscoUmbrella.json index 08b3eabcb92..11102015451 100644 --- a/Solutions/CiscoUmbrella/Data/Solution_CiscoUmbrella.json +++ b/Solutions/CiscoUmbrella/Data/Solution_CiscoUmbrella.json @@ -46,7 +46,7 @@ "Playbooks/CiscoUmbrellaPlaybooks/CiscoUmbrella-GetDomainInfo/azuredeploy.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\CiscoUmbrella", - "Version": "3.3.1", + "Version": "3.3.2", "Metadata": "SolutionMetadata.json", "TemplateSpec": true } diff --git a/Solutions/CiscoUmbrella/Package/mainTemplate.json b/Solutions/CiscoUmbrella/Package/mainTemplate.json index 426ad0be98d..cb45d2c6466 100644 --- a/Solutions/CiscoUmbrella/Package/mainTemplate.json +++ b/Solutions/CiscoUmbrella/Package/mainTemplate.json @@ -55,7 +55,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "CiscoUmbrella", - "_solutionVersion": "3.3.1", + "_solutionVersion": "3.3.2", "solutionId": "azuresentinel.azure-sentinel-solution-ciscoumbrella", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "CiscoUmbrellaDataConnector", @@ -77,7 +77,7 @@ "dataConnectorVersion2": "1.0.0", "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "dataConnectorCCPVersion": "3.3.1", + "dataConnectorCCPVersion": "3.3.2", "_dataConnectorContentIdConnectorDefinition3": "CiscoUmbrellaConnector", "dataConnectorTemplateNameConnectorDefinition3": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition3')))]", "_dataConnectorContentIdConnections3": "CiscoUmbrellaConnectorConnections", @@ -1928,6 +1928,12 @@ "content": "> **NOTE:**\n> This connector supports both Cisco-managed and customer-managed Amazon S3 buckets." } }, + { + "type": "Markdown", + "parameters": { + "content": "> **NOTE:**\n> For Customer managed paths, you can leave the S3 Bucket Prefix empty if you want to use the root of the bucket. If you specify a prefix, make sure to include the trailing slash." + } + }, { "type": "Markdown", "parameters": { @@ -1955,7 +1961,7 @@ { "type": "Markdown", "parameters": { - "content": "For example, the Data Path provided by Cisco is `cisco-managed-us-west-1/2003477-12345`. For the AWS S3 Bucket Name, the input S3 Bucket Name will be `cisco-managed-us-west-1`. The S3 Bucket Region will be `us-west-1`. The S3 Bucket Prefix will be `2003477-12345`." + "content": "For example, the Data Path provided by Cisco is `cisco-managed-us-west-1/2003477-12345`. For the AWS S3 Bucket Name, the input S3 Bucket Name will be `cisco-managed-us-west-1`. The S3 Bucket Region will be `us-west-1`. The S3 Bucket Prefix will be `2003477-12345/`." } }, { @@ -2100,11 +2106,11 @@ "type": "Textbox", "parameters": { "label": "AWS S3 Bucket Prefix", - "placeholder": "S3 Bucket Prefix", + "placeholder": "S3 Bucket Prefix (include trailing slash if not empty)", "type": "text", "name": "s3BucketPrefix", "validations": { - "required": true + "required": false } } } @@ -5583,6 +5589,12 @@ "content": "> **NOTE:**\n> This connector supports both Cisco-managed and customer-managed Amazon S3 buckets." } }, + { + "type": "Markdown", + "parameters": { + "content": "> **NOTE:**\n> For Customer managed paths, you can leave the S3 Bucket Prefix empty if you want to use the root of the bucket. If you specify a prefix, make sure to include the trailing slash." + } + }, { "type": "Markdown", "parameters": { @@ -5610,7 +5622,7 @@ { "type": "Markdown", "parameters": { - "content": "For example, the Data Path provided by Cisco is `cisco-managed-us-west-1/2003477-12345`. For the AWS S3 Bucket Name, the input S3 Bucket Name will be `cisco-managed-us-west-1`. The S3 Bucket Region will be `us-west-1`. The S3 Bucket Prefix will be `2003477-12345`." + "content": "For example, the Data Path provided by Cisco is `cisco-managed-us-west-1/2003477-12345`. For the AWS S3 Bucket Name, the input S3 Bucket Name will be `cisco-managed-us-west-1`. The S3 Bucket Region will be `us-west-1`. The S3 Bucket Prefix will be `2003477-12345/`." } }, { @@ -5755,11 +5767,11 @@ "type": "Textbox", "parameters": { "label": "AWS S3 Bucket Prefix", - "placeholder": "S3 Bucket Prefix", + "placeholder": "S3 Bucket Prefix (include trailing slash if not empty)", "type": "text", "name": "s3BucketPrefix", "validations": { - "required": true + "required": false } } } @@ -5875,8 +5887,8 @@ }, "s3BucketPrefix": { "defaultValue": "s3BucketPrefix", - "type": "securestring", - "minLength": 1 + "type": "securestring" + } }, "variables": { @@ -5935,7 +5947,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/auditlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'auditlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaAdminAudit_CL", @@ -5976,7 +5988,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/firewalllogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'firewalllogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaCloudFirewall_CL", @@ -6017,7 +6029,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/dlplogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'dlplogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaDLP_CL", @@ -6058,7 +6070,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/dnslogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'dnslogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaDNS_CL", @@ -6099,7 +6111,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/fileeventlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'fileeventlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaFileEvent_CL", @@ -6140,7 +6152,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/intrusionlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'intrusionlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaIPS_CL", @@ -6181,7 +6193,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/ravpnlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'ravpnlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaRemoteAccessVPN_CL", @@ -6222,7 +6234,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/proxylogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'proxylogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaWebTraffic_CL", @@ -6263,7 +6275,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/ztnalogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'ztnalogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaZeroTrustAccess_CL", @@ -6304,7 +6316,7 @@ "awsSecretKey": "[[parameters('awsSecretKey')]", "s3BucketName": "[[parameters('s3BucketName')]", "s3BucketRegion": "[[parameters('s3BucketRegion')]", - "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'/ztnaflowlogs/')]", + "s3BucketPrefix": "[[concat(parameters('s3BucketPrefix'),'ztnaflowlogs/')]", "queryWindowDelayInMin": 10, "connectorDefinitionName": "CiscoUmbrellaConnector", "dataType": "Custom-CiscoUmbrellaZeroTrustAccessFlow_CL", diff --git a/Solutions/CiscoUmbrella/ReleaseNotes.md b/Solutions/CiscoUmbrella/ReleaseNotes.md index 55fc0d46992..638c5f194b8 100644 --- a/Solutions/CiscoUmbrella/ReleaseNotes.md +++ b/Solutions/CiscoUmbrella/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|-------------------------------------------------------------| +| 3.3.2 | 27-08-2026 | Updated the Cisco Umbrella template to allow the S3 bucket prefix to be null or provided with a trailing slash, allowing customer root directories to work | | 3.3.1 | 26-08-2026 | Fixed Cisco Umbrella CCF connection resource naming to include the S3 bucket, region, and prefix, preventing connections for different account prefixes from overwriting each other. | | 3.3.0 | 14-08-2026 | Updated **CCF Data Connector** for Cisco Cloud Security log schema version 16: enabled Gzip decompression for all log streams, added **DestinationSgtOriginId** and **FwBlockReason** columns to CiscoUmbrellaCloudFirewall, added **IsolationProfileId** column to CiscoUmbrellaWebTraffic, and added connector instruction notes for optional headers and Cisco-managed/customer-managed Amazon S3 buckets. | | 3.2.2 | 04-08-2026 | Fixed broken **Deploy to Azure Gov** button link in **Data Connectors** and **Playbooks**. |