forked from Azure/Azure-Sentinel
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request Azure#11324 from javiersoriano/boxccp
Adding new Box CCP connector and updated parser
- Loading branch information
Showing
14 changed files
with
2,152 additions
and
616 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -242,4 +242,4 @@ | |
| "Type": "Boolean" | ||
| } | ||
| ] | ||
| } | ||
| } | ||
157 changes: 157 additions & 0 deletions
157
.script/tests/KqlvalidationsTests/CustomTables/BoxEventsV2_CL.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,157 @@ | ||
| { | ||
| "Name": "BoxEventsV2_CL", | ||
| "Properties": [ | ||
| { | ||
| "name": "additional_details", | ||
| "type": "dynamic" | ||
| }, | ||
| { | ||
| "name": "created_at", | ||
| "type": "datetime" | ||
| }, | ||
| { | ||
| "name": "event_id", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "EventEndTime", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "event_type", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "ip_address", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "session_id", | ||
| "type": "dynamic" | ||
| }, | ||
| { | ||
| "name": "TimeGenerated", | ||
| "type": "datetime" | ||
| }, | ||
| { | ||
| "name": "event_category", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_user_email", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_file_id", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_file_name", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_parent_name", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_item_type", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_item_id", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_item_name", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_parent_type", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_parent_id", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_owned_by_type", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_owned_by_id", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_owned_by_name", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_owned_by_login", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "created_by_type", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "created_by_id", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "created_by_name", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "created_by_login", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_type", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_id", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_name", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_login", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_folder_id", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_folder_name", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_user_id", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source_user_name", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "accessible_by_type", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "accessible_by_id", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "accessible_by_name", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "accessible_by_login", | ||
| "type": "string" | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
82 changes: 82 additions & 0 deletions
82
Solutions/Box/Data Connectors/BoxEvents_ccp/BoxEvents_DCR.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| [ | ||
| { | ||
| "name": "BoxEventsDCR", | ||
| "apiVersion": "2021-09-01-preview", | ||
| "type": "Microsoft.Insights/dataCollectionRules", | ||
| "location": "{{location}}", | ||
| "properties": { | ||
| "dataCollectionEndpointId": "{{dataCollectionEndpointId}}", | ||
| "streamDeclarations": { | ||
| "Custom-Box_CL": { | ||
| "columns": [ | ||
| { | ||
| "name": "type", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "event_id", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "created_by", | ||
| "type": "dynamic" | ||
| }, | ||
| { | ||
| "name": "created_at", | ||
| "type": "datetime" | ||
| }, | ||
| { | ||
| "name": "recorded_at", | ||
| "type": "datetime" | ||
| }, | ||
| { | ||
| "name": "event_type", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "session_id", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "source", | ||
| "type": "dynamic" | ||
| }, | ||
| { | ||
| "name": "ip_address", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "accessible_by", | ||
| "type": "dynamic" | ||
| }, | ||
| { | ||
| "name": "additional_details", | ||
| "type": "dynamic" | ||
| } | ||
| ] | ||
| } | ||
| }, | ||
| "dataSources": {}, | ||
| "destinations": { | ||
| "logAnalytics": [ | ||
| { | ||
| "workspaceResourceId": "[variables('workspaceResourceId')]", | ||
| "name": "4b0f6f0e10104aa5838b3c0b18702683" | ||
| } | ||
| ] | ||
| }, | ||
| "dataFlows": [ | ||
| { | ||
| "streams": [ | ||
| "Custom-Box_CL" | ||
| ], | ||
| "destinations": [ | ||
| "4b0f6f0e10104aa5838b3c0b18702683" | ||
| ], | ||
| "transformKql": "source\n| extend TimeGenerated = created_at, event_category = type\n| extend\n source_user_email=tostring(source.user_email),\n source_file_id=tostring(source.file_id),\n source_file_name=tostring(source.file_name),\n source_parent_name=tostring(source.parent.name),\n source_item_type=tostring(source.item_type),\n source_item_id=tostring(source.item_id),\n source_item_name=tostring(source.item_name),\n source_parent_type=tostring(source.parent.type),\n source_parent_id=tostring(source.parent.id),\n source_owned_by_type=tostring(source.owned_by.type),\n source_owned_by_id=tostring(source.owned_by.type),\n source_owned_by_name=tostring(source.owned_by.name),\n source_owned_by_login=tostring(source.owned_by.login),\n created_by_type=tostring(created_by.type),\n created_by_id=tostring(created_by.id),\n created_by_name=tostring(created_by.name),\n created_by_login=tostring(created_by.login),\n source_type=tostring(source.type),\n source_id=tostring(source.id),\n source_name=tostring(source.name),\n source_login=tostring(source.login),\n source_folder_id=tostring(source.folder_id),\n source_folder_name=tostring(source.folder_name),\n source_user_id=tostring(source.user_id),\n source_user_name=tostring(source.user_name),\n accessible_by_type=tostring(accessible_by.type),\n accessible_by_id=tostring(accessible_by.id),\n accessible_by_name=tostring(accessible_by.name),\n accessible_by_login=tostring(accessible_by.login)\n| project-away type, accessible_by, created_by, source \n\n", | ||
| "outputStream": "Custom-BoxEventsV2_CL" | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| ] |
107 changes: 107 additions & 0 deletions
107
Solutions/Box/Data Connectors/BoxEvents_ccp/BoxEvents_DataConnectorDefinition.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,107 @@ | ||
| { | ||
| "name": "BoxEventsCCPDefinition", | ||
| "apiVersion": "2022-09-01-preview", | ||
| "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", | ||
| "location": "{{location}}", | ||
| "kind": "Customizable", | ||
| "id": "BoxEventsCCPDefinition", | ||
| "properties": { | ||
| "connectorUiConfig": { | ||
| "id": "BoxEventsCCPDefinition", | ||
| "title": "Box Events (CCP) (Preview)", | ||
| "publisher": "Microsoft", | ||
| "descriptionMarkdown": "The Box data connector provides the capability to ingest [Box enterprise's events](https://developer.box.com/guides/events/#admin-events) into Microsoft Sentinel using the Box REST API. Refer to [Box documentation](https://developer.box.com/guides/events/enterprise-events/for-enterprise/) for more information.", | ||
| "graphQueriesTableName": "BoxEventsV2_CL", | ||
| "graphQueries": [ | ||
| { | ||
| "metricName": "Events received", | ||
| "legend": "Box events received", | ||
| "baseQuery": "{{graphQueriesTableName}}" | ||
| } | ||
| ], | ||
| "sampleQueries": [ | ||
| { | ||
| "description": "All Box events", | ||
| "query": "BoxEvents\n| sort by TimeGenerated desc" | ||
| } | ||
| ], | ||
| "dataTypes": [ | ||
| { | ||
| "name": "{{graphQueriesTableName}}", | ||
| "lastDataReceivedQuery": "{{graphQueriesTableName}}\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" | ||
| } | ||
| ], | ||
| "connectivityCriteria": [ | ||
| { | ||
| "type": "HasDataConnectors" | ||
| } | ||
| ], | ||
| "permissions": { | ||
| "resourceProvider": [ | ||
| { | ||
| "provider": "Microsoft.OperationalInsights/workspaces", | ||
| "permissionsDisplayText": "Read and Write permissions are required.", | ||
| "providerDisplayName": "Workspace", | ||
| "scope": "Workspace", | ||
| "requiredPermissions": { | ||
| "write": true, | ||
| "read": true, | ||
| "delete": true | ||
| } | ||
| } | ||
| ], | ||
| "customs": [ | ||
| { | ||
| "name": "Box API credentials", | ||
| "description": "Box API requires a Box App client ID and client secret to authenticate. [See the documentation to learn more about Client Credentials grant](https://developer.box.com/guides/authentication/client-credentials/client-credentials-setup/)" | ||
| }, | ||
| { | ||
| "name": "Box Enterprise ID", | ||
| "description": "Box Enterprise ID is required to make the connection. See documentation to [find Enterprise ID](https://developer.box.com/platform/appendix/locating-values/)" | ||
| } | ||
| ] | ||
| }, | ||
| "instructionSteps": [ | ||
| { | ||
| "description": ">**NOTE:** This connector uses Codeless Connecor Platform (CCP) to connect to the Box REST API to pull logs into Microsoft Sentinel." | ||
| }, | ||
| { | ||
| "description": ">**NOTE:** This connector depends on a parser based on Kusto Function to work as expected [**BoxEvents**](https://aka.ms/sentinel-BoxDataConnector-parser) which is deployed with the Microsoft Sentinel Solution." | ||
| }, | ||
| { | ||
| "description": "**STEP 1 - Create Box Custom Application**\n\nSee documentation to [setup client credentials authentication](https://developer.box.com/guides/authentication/client-credentials/client-credentials-setup/)\n" | ||
| }, | ||
| { | ||
| "description": "**STEP 2 - Grab Client ID and Client Secret values**\n\nYou might need to setup 2FA to fetch the secret.\n" | ||
| }, | ||
| { | ||
| "description": "**STEP 3 - Grab Box Enterprise ID from Box Admin Console**\n\nSee documentation to [find Enterprise ID](https://developer.box.com/platform/appendix/locating-values/)\n" | ||
| }, | ||
| { | ||
| "description": "Provide the required values below:\n", | ||
| "instructions": [ | ||
| { | ||
| "type": "Textbox", | ||
| "parameters": { | ||
| "label": "Box Enterprise ID", | ||
| "placeholder": "123456", | ||
| "type": "text", | ||
| "name": "boxEnterpriseId" | ||
| } | ||
| }, | ||
| { | ||
| "type": "OAuthForm", | ||
| "parameters": { | ||
| "clientIdLabel": "Client ID", | ||
| "clientSecretLabel": "Client Secret", | ||
| "connectButtonLabel": "Connect", | ||
| "disconnectButtonLabel": "Disconnect" | ||
| } | ||
| } | ||
| ], | ||
| "title": "Connect to Box to start collecting event logs to Microsoft Sentinel" | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.