Skip to content

Commit 3bf2fd7

Browse files
v-dvedakv-dvedak
authored
Merge pull request Azure#13600 from versasec/master
Required analysis rule added to Versasec CMS Solution
2 parents 2a37685 + 3db5b4b commit 3bf2fd7

19 files changed

Lines changed: 793 additions & 33 deletions

‎.script/tests/KqlvalidationsTests/CustomTables/VersasecCmsErrorLogs.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"Name": "VersasecCmsErrorLogs",
3+
"Properties": [
4+
{
5+
"name": "TimeGenerated",
6+
"type": "datetime"
7+
},
8+
{
9+
"name": "EventVendor",
10+
"type": "string"
11+
},
12+
{
13+
"name": "EventProduct",
14+
"type": "string"
15+
},
16+
{
17+
"name": "CmsErrorID",
18+
"type": "real"
19+
},
20+
{
21+
"name": "ErrorCode",
22+
"type": "string"
23+
},
24+
{
25+
"name": "CmsErrorIDStrg",
26+
"type": "string"
27+
},
28+
{
29+
"name": "ErrorId",
30+
"type": "real"
31+
},
32+
{
33+
"name": "ComputerName",
34+
"type": "string"
35+
},
36+
{
37+
"name": "ClientId",
38+
"type": "string"
39+
},
40+
{
41+
"name": "ErrorMessage",
42+
"type": "string"
43+
},
44+
{
45+
"name": "TargetUsername",
46+
"type": "real"
47+
},
48+
{
49+
"name": "SupportTicket",
50+
"type": "string"
51+
},
52+
{
53+
"name": "TicketReference",
54+
"type": "string"
55+
}
56+
]
57+
}

‎.script/tests/KqlvalidationsTests/CustomTables/VersasecCmsErrorLogs_CL.json‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"Name": "VersasecCmsErrorLogs_CL",
3+
"Properties": [
4+
{
5+
"name": "TimeGenerated",
6+
"type": "datetime"
7+
}, {
8+
"name": "CmsErrorID",
9+
"type": "real"
10+
}, {
11+
"name": "CmsErrorIDCode",
12+
"type": "string"
13+
}, {
14+
"name": "CmsErrorIDStrg",
15+
"type": "string"
16+
}, {
17+
"name": "ID",
18+
"type": "real"
19+
}, {
20+
"name": "ComputerName",
21+
"type": "string"
22+
}, {
23+
"name": "CLID",
24+
"type": "string"
25+
}, {
26+
"name": "ErrorStrg",
27+
"type": "string"
28+
}, {
29+
"name": "UserID",
30+
"type": "real"
31+
}, {
32+
"name": "SupportTicket",
33+
"type": "string"
34+
}, {
35+
"name": "TicketRef",
36+
"type": "string"
37+
}
38+
]
39+
}

‎.script/tests/KqlvalidationsTests/CustomTables/VersasecCmsSysLogs.json‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{
2+
"Name": "VersasecCmsSysLogs",
3+
"Properties": [
4+
{
5+
"name": "TimeGenerated",
6+
"type": "datetime"
7+
},
8+
{
9+
"name": "EventVendor",
10+
"type": "string"
11+
},
12+
{
13+
"name": "EventProduct",
14+
"type": "string"
15+
},
16+
{
17+
"name": "EventId",
18+
"type": "real"
19+
},
20+
{
21+
"name": "EventResult",
22+
"type": "string"
23+
},
24+
{
25+
"name": "ActivitySummary",
26+
"type": "string"
27+
},
28+
{
29+
"name": "SyslogID",
30+
"type": "real"
31+
},
32+
{
33+
"name": "ComputerName",
34+
"type": "string"
35+
},
36+
{
37+
"name": "TargetUsername",
38+
"type": "string"
39+
},
40+
{
41+
"name": "Parameter",
42+
"type": "string"
43+
},
44+
{
45+
"name": "UserID",
46+
"type": "real"
47+
},
48+
{
49+
"name": "TicketReference",
50+
"type": "string"
51+
}
52+
]
53+
}

‎.script/tests/KqlvalidationsTests/CustomTables/VersasecCmsSysLogs_CL.json‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"Name": "VersasecCmsSysLogs_CL",
3+
"Properties": [
4+
{
5+
"name": "TimeGenerated",
6+
"type": "datetime"
7+
},
8+
{
9+
"name": "SyslogID",
10+
"type": "real"
11+
},
12+
{
13+
"name": "SyslogIDCode",
14+
"type": "string"
15+
},
16+
{
17+
"name": "SyslogIDStrg",
18+
"type": "string"
19+
},
20+
{
21+
"name": "ID",
22+
"type": "real"
23+
},
24+
{
25+
"name": "ComputerName",
26+
"type": "string"
27+
},
28+
{
29+
"name": "CLID",
30+
"type": "string"
31+
},
32+
{
33+
"name": "Param1",
34+
"type": "string"
35+
},
36+
{
37+
"name": "UserID",
38+
"type": "real"
39+
},
40+
{
41+
"name": "TicketRef",
42+
"type": "string"
43+
}
44+
]
45+
}

‎.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -285,5 +285,6 @@
285285
"TacitRedThreatIntel",
286286
"CyrenThreatIntel",
287287
"CybleVisionAlerts",
288+
"VersasecCms",
288289
"VisaThreatIntelligence"
289290
]

‎Solutions/VersasecCMS/Analytic Rules/VersasecCmsOperatorLoginFailed.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
id: B1DB8B7E-9D74-48C3-9683-74483CBEFF4E
2+
name: Versasec CMS - Multiple Failed Login Attempts
3+
description: |
4+
Detects when Operator login failed to often.
5+
severity: High
6+
status: Available
7+
requiredDataConnectors:
8+
- connectorId: VersasecCms
9+
dataTypes:
10+
- VersasecCmsSysLogs
11+
queryFrequency: 5m
12+
queryPeriod: 1h
13+
triggerOperator: gt
14+
triggerThreshold: 5
15+
tactics:
16+
- CredentialAccess
17+
relevantTechniques:
18+
- T1110 # Brute Force
19+
query: |
20+
let threshold = 5;
21+
VersasecCmsSysLogs
22+
| where EventId == 2
23+
| sort by ComputerName asc, TimeGenerated asc
24+
| extend TimeDiff = datetime_diff('minute', TimeGenerated, prev(TimeGenerated))
25+
| where TimeDiff <= threshold and ComputerName == prev(ComputerName)
26+
entityMappings:
27+
- entityType: Host
28+
fieldMappings:
29+
- identifier: FullName
30+
columnName: ComputerName
31+
eventGroupingSettings:
32+
aggregationKind: SingleAlert
33+
incidentConfiguration:
34+
createIncident: true
35+
groupingConfiguration:
36+
enabled: false
37+
reopenClosedIncident: false
38+
lookbackDuration: 5m
39+
matchingMethod: AllEntities
40+
version: 1.0.1
41+
kind: Scheduled

Solutions/VersasecCMS/Data Connectors/VersasecCMS_CCF/VersasecCMS_Table_ErrorLogs.json renamed to Solutions/VersasecCMS/Data Connectors/VersasecCMS_CCF/VersasecCMSErrorLogs_Table.json

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
{
22
"name": "VersasecCmsErrorLogs_CL",
33
"type": "Microsoft.OperationalInsights/workspaces/tables",
4-
"apiVersion": "2022-10-01",
5-
"tags": {},
4+
"apiVersion": "2021-03-01-privatepreview",
5+
"location": "{{location}}",
6+
"kind": null,
67
"properties": {
78
"schema": {
89
"name": "VersasecCmsErrorLogs_CL",

Solutions/VersasecCMS/Data Connectors/VersasecCMS_CCF/VersasecCMS_Table_SysLogs.json renamed to Solutions/VersasecCMS/Data Connectors/VersasecCMS_CCF/VersasecCMSSysLogs_Table.json

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
{
22
"name": "VersasecCmsSysLogs_CL",
33
"type": "Microsoft.OperationalInsights/workspaces/tables",
4-
"apiVersion": "2022-10-01",
5-
"tags": {},
4+
"apiVersion": "2021-03-01-privatepreview",
5+
"location": "{{location}}",
6+
"kind": null,
67
"properties": {
78
"schema": {
89
"name": "VersasecCmsSysLogs_CL",

‎Solutions/VersasecCMS/Data Connectors/VersasecCMS_CCF/VersasecCMS_ConnectorDefinition.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
44
"apiVersion": "2022-09-01-preview",
55
"kind": "Customizable",
6+
"location": "{{location}}",
67
"properties": {
78
"connectorUiConfig": {
89
"id": "VersasecCmsCCPDefinition",

‎Solutions/VersasecCMS/Data Connectors/VersasecCMS_CCF/VersasecCMS_DCR.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"type": "Microsoft.Insights/dataCollectionRules",
3-
"apiVersion": "2022-06-01",
3+
"apiVersion": "2023-03-11",
44
"name": "VersasecCms-DCR",
55
"location": "{{location}}",
66
"dependsOn": [

0 commit comments

Comments
 (0)