Add log analytics API support to azure sentinel connector #1214

mdazam1942 · 2022-11-25T20:43:07Z

No description provided.

codecov · 2022-12-01T21:51:02Z

Codecov Report

Base: 85.35% // Head: 85.33% // Decreases project coverage by -0.01% ⚠️

Coverage data is based on head (38cb77e) compared to base (88a2af6).
Patch coverage: 84.30% of modified lines in pull request are covered.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #1214      +/-   ##
===========================================
- Coverage    85.35%   85.33%   -0.02%     
===========================================
  Files          558      568      +10     
  Lines        41753    42454     +701     
===========================================
+ Hits         35637    36228     +591     
- Misses        6116     6226     +110

Impacted Files	Coverage Δ
...zure_log_analytics/stix_transmission/api_client.py	`31.03% <31.03%> (ø)`
...og_analytics/stix_translation/query_constructor.py	`63.73% <63.73%> (ø)`
...azure_log_analytics/stix_transmission/connector.py	`72.13% <72.13%> (ø)`
...re_log_analytics/stix_transmission/error_mapper.py	`81.81% <81.81%> (ø)`
...test_azure_sentinel_log_analytics_stix_to_query.py	`98.24% <98.24%> (ø)`
..._transmission/test_azure_sentinel_log_analytics.py	`99.11% <99.11%> (ø)`
...shifter_modules/azure_log_analytics/entry_point.py	`100.00% <100.00%> (ø)`
...log_analytics/stix_translation/query_translator.py	`100.00% <100.00%> (ø)`
...g_analytics/stix_translation/results_translator.py	`100.00% <100.00%> (ø)`
.../test_azure_sentinel_log_analytics_json_to_stix.py	`100.00% <100.00%> (ø)`

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

stix_shifter_modules/azure_log_analytics/configuration/lang_en.json

delliott90 · 2023-01-10T17:56:57Z

stix_shifter_modules/azure_log_analytics/stix_translation/json/SecurityEvent_from_stix_map.json

+            "path": [
+                "FilePath"
+            ],
+            "hashes": [


I don't think there would every be a search for just hashes, would that even be a valid property or wold it always be hashes.'SHA-1' hashes.'MD5' and so on?

ohh didn't notice they put this under hashes. the property is simply called FileHash so all types of hashes will basically be translated into FileHash filed in the query.

And we need to do some processing before results translation to correctly map the hash type in the bundle

stix_shifter_modules/azure_log_analytics/stix_translation/json/SecurityEvent_from_stix_map.json

delliott90 · 2023-01-10T18:04:10Z

stix_shifter_modules/azure_log_analytics/stix_translation/json/SecurityEvent_from_stix_map.json

+                "DeviceDescription"
+            ],
+            "device_name": [
+                "DeviceId"


the device id and computer seem like it could fit in x-oca-asset? https://github.com/opencybersecurityalliance/stix-extensions/blob/main/2.0/x-oca-asset.md

delliott90 · 2023-01-11T15:46:12Z

...hifter_modules/azure_log_analytics/stix_translation/json/SecurityIncident_from_stix_map.json

+            "incident_name": [
+                "IncidentName"
+            ],
+            "severity": [


Severity should go under x-ibm-finding provided it's on a scale of 1-100.

delliott90 · 2023-01-11T15:47:02Z

...hifter_modules/azure_log_analytics/stix_translation/json/SecurityIncident_from_stix_map.json

+            "additional_data": [
+                "AdditionalData"
+            ],
+            "alertids": [


Should go under x-ibm-finding:alert_id

delliott90 · 2023-01-11T15:47:33Z

...hifter_modules/azure_log_analytics/stix_translation/json/SecurityIncident_from_stix_map.json

+            "comments": [
+                "Comments"
+            ],
+            "description": [


Should go under x-ibm-finding:description

delliott90 · 2023-01-11T15:48:22Z

..._modules/azure_log_analytics/stix_translation/json/stix_2_1/SecurityAlert_from_stix_map.json

+            "resourceId": [
+                "_ResourceId"
+            ],
+            "alert_severity": [


Should go under x-ibm-finding

delliott90 · 2023-01-11T15:48:38Z

..._modules/azure_log_analytics/stix_translation/json/stix_2_1/SecurityAlert_from_stix_map.json

+            "alert_severity": [
+                "AlertSeverity"
+            ],
+            "description": [


Should go under x-ibm-finding

delliott90 · 2023-01-11T15:49:32Z

...hifter_modules/azure_log_analytics/stix_translation/json/SecurityIncident_from_stix_map.json

+            ]
+        }
+    },
+    "x-azure-security-incident": {


Anything that doesn't fit directly into a finding property should be a custom extension of the finding object.

delliott90 · 2023-01-11T15:50:05Z

..._modules/azure_log_analytics/stix_translation/json/stix_2_1/SecurityAlert_from_stix_map.json

+            ]
+        }
+    },
+    "x-msazure-sentinel-alert": {


Anything that doesn't fit with a finding property should go under a custom extension to the finding object.

delliott90 · 2023-01-11T15:51:54Z

...dules/azure_log_analytics/stix_translation/json/stix_2_1/SecurityIncident_from_stix_map.json

+            ]
+        }
+    },
+    "x-msazure-sentinel-incident": {


Anything that won't fit in a finding property should go in an extension of the finding.

delliott90 · 2023-01-11T17:30:01Z

stix_shifter_modules/azure_log_analytics/stix_translation/json/stix_2_1/to_stix_map.json

+            "object": "event"
+        },
+        {
+            "key": "url.name",


should be url.value

delliott90 · 2023-01-11T17:30:33Z

stix_shifter_modules/azure_log_analytics/stix_translation/json/stix_2_1/to_stix_map.json

+    ],
+    "ProcessName": [
+        {
+            "key": "process.name",


The name property on the process was removed in 2.1, need to change to x_name

delliott90 · 2023-01-11T17:31:54Z

stix_shifter_modules/azure_log_analytics/stix_translation/json/stix_2_1/to_stix_map.json

+    ],
+    "FileHash": [
+        {
+            "key": "file.hashes",


Needs to be mapped to specific hash type ie. file.hashes.'MD5'

it needs some post processing on the datasource fields. basically needs to check the hash type and create new datasource fields based on the hash value. The newly created datasource fields can be mapped in to_stix.

mdazam1942 added 3 commits November 25, 2022 16:42

Add log analytics API support to azure sentinel connector

d4be431

fix unittests

1385a30

fix unittest assert error

034e182

mdazam1942 force-pushed the azure_log_analytics branch from 4b77d8f to 034e182 Compare December 1, 2022 21:36

mdazam1942 added 2 commits December 1, 2022 17:39

Merge branch 'develop' into azure_log_analytics

bcd4d5e

fix update of unittest assert error

1ef2909

mdazam1942 added 6 commits December 6, 2022 11:28

rename module and more transmission fixes

e495242

fix unittest

d793fb9

upgrade six dependency

9108db2

Merge branch 'develop' into azure_log_analytics

0494ce5

mapping and readme update

0be7cdf

fix unittests

c391b15

mdazam1942 marked this pull request as ready for review December 7, 2022 14:52

mdazam1942 requested review from baulus and delliott90 December 7, 2022 14:52

error handling update

06c03d2

mdazam1942 force-pushed the azure_log_analytics branch from dbf49d7 to 06c03d2 Compare December 7, 2022 20:58

mdazam1942 added 3 commits December 7, 2022 16:58

Merge branch 'develop' into azure_log_analytics

54c3647

error handling update and unittest fixes

283f9dd

Merge branch 'develop' into azure_log_analytics

dd4af50

delliott90 reviewed Jan 10, 2023

View reviewed changes

stix_shifter_modules/azure_log_analytics/configuration/lang_en.json Outdated Show resolved Hide resolved

delliott90 reviewed Jan 10, 2023

View reviewed changes

stix_shifter_modules/azure_log_analytics/configuration/lang_en.json Outdated Show resolved Hide resolved

delliott90 reviewed Jan 10, 2023

View reviewed changes

stix_shifter_modules/azure_log_analytics/stix_translation/json/SecurityEvent_from_stix_map.json Outdated Show resolved Hide resolved

delliott90 reviewed Jan 10, 2023

View reviewed changes

Merge branch 'develop' into azure_log_analytics

4b2708d

delliott90 reviewed Jan 11, 2023

View reviewed changes

fix few cr comments

cd7cd66

mdazam1942 force-pushed the azure_log_analytics branch from dbbb0f8 to cd7cd66 Compare January 11, 2023 18:46

mdazam1942 added 3 commits January 11, 2023 14:49

Merge branch 'develop' into azure_log_analytics

3fe411e

update unittest

de1593c

doc update

38cb77e

delliott90 approved these changes Jan 12, 2023

View reviewed changes

delliott90 merged commit 98650c3 into develop Jan 12, 2023

delliott90 deleted the azure_log_analytics branch January 12, 2023 15:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add log analytics API support to azure sentinel connector #1214

Add log analytics API support to azure sentinel connector #1214

mdazam1942 commented Nov 25, 2022

codecov bot commented Dec 1, 2022 •

edited

Loading

delliott90 Jan 10, 2023

mdazam1942 Jan 10, 2023

mdazam1942 Jan 10, 2023 •

edited

Loading

delliott90 Jan 10, 2023

delliott90 Jan 11, 2023

delliott90 Jan 11, 2023

delliott90 Jan 11, 2023

delliott90 Jan 11, 2023

delliott90 Jan 11, 2023

delliott90 Jan 11, 2023

delliott90 Jan 11, 2023

delliott90 Jan 11, 2023

delliott90 Jan 11, 2023

delliott90 Jan 11, 2023

delliott90 Jan 11, 2023

mdazam1942 Jan 11, 2023

Add log analytics API support to azure sentinel connector #1214

Add log analytics API support to azure sentinel connector #1214

Conversation

mdazam1942 commented Nov 25, 2022

codecov bot commented Dec 1, 2022 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mdazam1942 Jan 10, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov bot commented Dec 1, 2022 •

edited

Loading

mdazam1942 Jan 10, 2023 •

edited

Loading