Skip to content

Commit a86ebb3

Browse files
javiersorianojaviersoriano
committed
changes
1 parent 3f90d27 commit a86ebb3

File tree

3 files changed

+125
-96
lines changed

3 files changed

+125
-96
lines changed

‎Pipelines/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ This folder contains all the different Azure DevOps pipelines in YAML format so
44

55
These pipelines are written using the new Pipeline artifacts feature (see: https://docs.microsoft.com/es-es/azure/devops/pipelines/artifacts/pipeline-artifacts?view=azure-devops&tabs=yaml) and they contain build and deploy stages in a single pipeline.
66

7+
## buildScripts.yml
8+
79
## alertRulesCICD.yml
810

911
## huntingRulesCICD.yml
10-

‎Workbooks/multi-tenant-incidents.json

+97-95
Original file line numberDiff line numberDiff line change
@@ -1,101 +1,103 @@
11
{
2-
"version": "Notebook/1.0",
3-
"items": [
4-
{
5-
"type": 1,
6-
"content": {
7-
"json": "# Security Alerts multitenant dashboard"
8-
},
9-
"name": "text - 0"
2+
"version": "Notebook/1.0",
3+
"items": [
4+
{
5+
"type": 1,
6+
"content": {
7+
"json": "# Security Alerts multitenant dashboard"
108
},
11-
{
12-
"type": 9,
13-
"content": {
14-
"version": "KqlParameterItem/1.0",
15-
"crossComponentResources": [
16-
"value::all"
17-
],
18-
"parameters": [
19-
{
20-
"id": "92e95a8e-625d-46a5-99b0-377de489ac98",
21-
"version": "KqlParameterItem/1.0",
22-
"name": "Tenant",
23-
"type": 2,
24-
"isRequired": true,
25-
"query": "Resources \r\n| distinct tenantId",
26-
"crossComponentResources": [
27-
"value::all"
28-
],
29-
"value": "72f988bf-86f1-41af-91ab-2d7cd011db47",
30-
"typeSettings": {
31-
"additionalResourceOptions": [
32-
"value::1"
33-
]
34-
},
35-
"queryType": 1,
36-
"resourceType": "microsoft.resourcegraph/resources"
9+
"name": "text - 0"
10+
},
11+
{
12+
"type": 9,
13+
"content": {
14+
"version": "KqlParameterItem/1.0",
15+
"crossComponentResources": [
16+
"{Subscription}"
17+
],
18+
"parameters": [
19+
{
20+
"id": "92e95a8e-625d-46a5-99b0-377de489ac98",
21+
"version": "KqlParameterItem/1.0",
22+
"name": "Tenant",
23+
"type": 2,
24+
"isRequired": true,
25+
"query": "Resources \r\n| distinct tenantId",
26+
"crossComponentResources": [
27+
"value::all"
28+
],
29+
"value": "4b2462a4-bbee-495a-a0e1-f23ae524cc9c",
30+
"typeSettings": {
31+
"additionalResourceOptions": [
32+
"value::1"
33+
]
3734
},
38-
{
39-
"id": "dd3214bb-bcb8-4350-9628-b7aafb1055ee",
40-
"version": "KqlParameterItem/1.0",
41-
"name": "Subscription",
42-
"type": 6,
43-
"isRequired": true,
44-
"query": "resourcecontainers | where type == \"microsoft.resources/subscriptions\" and tenantId == \"{Tenant}\" | project id",
45-
"crossComponentResources": [
46-
"value::all"
47-
],
48-
"value": null,
49-
"typeSettings": {
50-
"additionalResourceOptions": []
51-
},
52-
"queryType": 1,
53-
"resourceType": "microsoft.resourcegraph/resources"
35+
"queryType": 1,
36+
"resourceType": "microsoft.resourcegraph/resources"
37+
},
38+
{
39+
"id": "dd3214bb-bcb8-4350-9628-b7aafb1055ee",
40+
"version": "KqlParameterItem/1.0",
41+
"name": "Subscription",
42+
"type": 6,
43+
"isRequired": true,
44+
"query": "resourcecontainers | where type == \"microsoft.resources/subscriptions\" and tenantId == \"{Tenant}\" | project id",
45+
"crossComponentResources": [
46+
"value::all"
47+
],
48+
"value": "/subscriptions/44e4eff8-1fcb-4a22-a7d6-992ac7286382",
49+
"typeSettings": {
50+
"additionalResourceOptions": []
5451
},
55-
{
56-
"id": "4a8a5f96-02a8-427e-af4b-5370a362c8d9",
57-
"version": "KqlParameterItem/1.0",
58-
"name": "Workspace",
59-
"type": 5,
60-
"isRequired": true,
61-
"multiSelect": true,
62-
"quote": "'",
63-
"delimiter": ",",
64-
"query": "resources | where type =~ 'Microsoft.OperationalInsights/workspaces' | project name",
65-
"crossComponentResources": [
66-
"{Subscription}"
67-
],
68-
"value": [],
69-
"typeSettings": {
70-
"additionalResourceOptions": []
71-
},
72-
"queryType": 1,
73-
"resourceType": "microsoft.resourcegraph/resources"
74-
}
75-
],
76-
"style": "pills",
77-
"queryType": 1,
78-
"resourceType": "microsoft.resourcegraph/resources"
79-
},
80-
"name": "parameters - 1"
81-
},
82-
{
83-
"type": 3,
84-
"content": {
85-
"version": "KqlItem/1.0",
86-
"query": "SecurityAlert | project TimeGenerated, AlertName, AlertSeverity, Description, TenantId",
87-
"size": 0,
88-
"timeContext": {
89-
"durationMs": 86400000
52+
"queryType": 1,
53+
"resourceType": "microsoft.resourcegraph/resources"
9054
},
91-
"queryType": 0,
92-
"resourceType": "microsoft.operationalinsights/workspaces",
93-
"crossComponentResources": [
94-
"/subscriptions/44e4eff8-1fcb-4a22-a7d6-992ac7286382/resourceGroups/SOC/providers/Microsoft.OperationalInsights/workspaces/CyberSecurityDemo"
95-
]
55+
{
56+
"id": "4a8a5f96-02a8-427e-af4b-5370a362c8d9",
57+
"version": "KqlParameterItem/1.0",
58+
"name": "Workspace",
59+
"type": 5,
60+
"isRequired": true,
61+
"multiSelect": true,
62+
"quote": "'",
63+
"delimiter": ",",
64+
"query": "resources | where type =~ 'Microsoft.OperationalInsights/workspaces' | project id",
65+
"crossComponentResources": [
66+
"{Subscription}"
67+
],
68+
"value": [
69+
"/subscriptions/44e4eff8-1fcb-4a22-a7d6-992ac7286382/resourceGroups/SOC/providers/Microsoft.OperationalInsights/workspaces/CyberSecurityDemo"
70+
],
71+
"typeSettings": {
72+
"additionalResourceOptions": []
73+
},
74+
"queryType": 1,
75+
"resourceType": "microsoft.resourcegraph/resources"
76+
}
77+
],
78+
"style": "pills",
79+
"queryType": 1,
80+
"resourceType": "microsoft.resourcegraph/resources"
81+
},
82+
"name": "parameters - 1"
83+
},
84+
{
85+
"type": 3,
86+
"content": {
87+
"version": "KqlItem/1.0",
88+
"query": "SecurityAlert | project TimeGenerated, AlertName, AlertSeverity, Description, TenantId",
89+
"size": 0,
90+
"timeContext": {
91+
"durationMs": 86400000
9692
},
97-
"name": "query - 2"
98-
}
99-
],
100-
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
101-
}
93+
"queryType": 0,
94+
"resourceType": "microsoft.operationalinsights/workspaces",
95+
"crossComponentResources": [
96+
"{Workspace}"
97+
]
98+
},
99+
"name": "query - 2"
100+
}
101+
],
102+
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
103+
}

‎repo-structure.txt

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
.
2+
|
3+
|- contoso/ ________________________ # Root folder for customer
4+
| |- AnalyticsRules/ ______________________ # Subfolder for Analytics Rules
5+
| |- analytics-rules.json _________________ # Analytics Rules definition file (JSON)
6+
|
7+
| |- Connectors/ ______________________ # Subfolder for Connectors
8+
| |- connectors.json _________________ # Connectors definition file (JSON)
9+
|
10+
| |- HuntingRules/ _____________________ #
11+
| |- hunting-rules.json _______________ # Hunting Rules definition file (JSON)
12+
|
13+
| |- Onboard/ ______________________ # Subfolder for Onboarding
14+
| |- onboarding.json _________________ # Onboarding definition file (JSON)
15+
|
16+
| |- Pipelines/ _____________________ # Subfolder for Pipelines
17+
| |- pipeline.yml _______________ # Pipeline definition files (YAML)
18+
|
19+
| |- Playbooks/ ______________________ # Subfolder for Playbooks
20+
| |- playbook.json _________________ # Playbooks definition files (ARM)
21+
|
22+
| |- Scripts/ _____________________ # Subfolder for script helpers
23+
| |- CreateAnalyticsRules.ps1 _______________ # Script files
24+
|
25+
| |- Workbooks/ ______________________ # Subfolder for Workbooks
26+
| |- workbook-sample.json _________________ # Workbook definiton files (JSON)

0 commit comments

Comments
 (0)