Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Contrast adr solution #11864

Open
wants to merge 6 commits into
base: master
Choose a base branch
from

Conversation

PavanContrast
Copy link

Change(s):

  • Added Contrast ADR Integration Solution for MS Sentinel

Reason for Change(s):

  • Adding Contrast ADR Integration for MS Sentinel

Version Updated:

  • Yes

Testing Completed:

  • Yes

Checked that the validations are passing and have addressed any issues that are present:

  • Yes

@PavanContrast PavanContrast requested review from a team as code owners February 27, 2025 13:33
@PavanContrast
Copy link
Author

@microsoft-github-policy-service agree company="Contrast Security"

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typo: ContrastADR_Command_Injestion.yaml -> ContrastADR_Command_Injection.yaml

Copy link

@curena-contrast curena-contrast Feb 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typo: Contrast_ADR_SQL_ingestion.yaml -> Contrast_ADR_SQL_Injection.yaml

id: 223db5c1-1bf8-47d8-8806-bed401b356a4
name: SQL Injection
description: |
'Critical Sevierty Level.'

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
'Critical Sevierty Level.'
'Critical Severity Level.'

id: 223db5c1-1bf8-47d8-8806-bed401b356a4
name: SQL Injection
description: |
'High Sevierty Level.'

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
'High Sevierty Level.'
'High Severity Level.'

id: 223db5c1-1bf8-47d8-8806-bed401b356a4
name: SQL Injection
description: |
'Low Sevierty Level.'

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
'Low Sevierty Level.'
'Low Severity Level.'

id: 223db5c1-1bf8-47d8-8806-bed401b356a4
name: SQL Injection
description: |
'Medium Sevierty Level.'

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
'Medium Sevierty Level.'
'Medium Severity Level.'

@v-prasadboke
Copy link
Contributor

Hello @PavanContrast, By any chance did you raised a duplicate PR #11863 ?

@v-prasadboke v-prasadboke self-assigned this Feb 28, 2025
@v-prasadboke v-prasadboke added New Solution For new Solutions which are new to Microsoft Sentinel Connector Connector specialty review needed Parser Parser specialty review needed labels Feb 28, 2025
"""A decorator to retry a function/method upon failure."""

def decorator(func):
def wrapper(*args, **kwargs):

Check notice

Code scanning / CodeQL

Explicit returns mixed with implicit (fall through) returns

Mixing implicit and explicit returns may indicate an error as implicit returns always return None.
except Exception as e:
# Fallback to using webhook data
logging.error(f"Enrichment API call failed: {e}")
response_data = self.req_body

Check notice

Code scanning / CodeQL

Unused local variable

Variable response_data is not used.
@PavanContrast
Copy link
Author

Hello @PavanContrast, By any chance did you raised a duplicate PR #11863 ?

Yes it was a duplicate PR, closed PR #11863

@v-prasadboke
Copy link
Contributor

For all the workbooks please add meta data to workbooksmetadata file.
https://github.com/Azure/Azure-Sentinel/blob/master/Workbooks/WorkbooksMetadata.json

Also please add images of workbook with black and white backgrounds.
https://github.com/Azure/Azure-Sentinel/tree/master/Workbooks/Images/Preview

- connectorId: ContrastADR
dataTypes:
- ContrastADR_CL
queryFrequency: 5M
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Time identifier needs to be corrected to 5m in all the analytic rules

@v-prasadboke
Copy link
Contributor

Please provide me branch access so that I can commit some required changes

@PavanContrast PavanContrast force-pushed the Contrast-ADR-Solution branch from af911dc to ff4b010 Compare March 3, 2025 12:55
@pranav-sacumen
Copy link
Contributor

Please provide me branch access so that I can commit some required changes
Hi @v-prasadboke Can you fork the repo and make the changes?

@PavanContrast PavanContrast requested a review from a team as a code owner March 7, 2025 10:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Connector Connector specialty review needed New Solution For new Solutions which are new to Microsoft Sentinel Parser Parser specialty review needed
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants