Git Product home page Git Product logo

sentinelascode's Introduction

Build Status

Azure Sentinel as Code

This reposiroty is no longer maintained. The new way to distribute content as code is Microsoft Sentinel Repositories.

The purpose of this project is to provide tools to enable automatic deployment of Azure Sentinel environments through Azure DevOps.

A blog post explaining more about this project is available at Deploying and Managing Azure Sentinel as code

The project has several folders for each of the different Sentinel components that can be configured (Onboard, Connectors, Workbooks, Analytics Rules, Hunting Rules, Playbooks) plus folders for script helpers and Az DevOps YAML pipelines. In this README we explain some of the basics for each of them but we encourage you to visit each of the folders for more details on how to use the tools.

Scripts

Scripts that are used inside the Azure DevOps pipelines to automate the deployment of the different Sentinel components

Pipelines

YAML files that define the CI/CD pipelines that can be used to automated the deployment of Sentinel components

Onboard

Automating the installation of Azure Sentinel on one or more workspaces as defined in config file under Onboard

Connectors

Automatically connect data sources to start sending data into Sentinel. This can only be done for Microsoft first party services that don't require additional configuration on the data source side

Workbooks

Collection of custom workbooks in JSON format that can be leveraged to add additional visibility into environments

Analytics Rules

Definition files containing all the analytics rule alerts to be created in an environment

Hunting Rules

Definition files containing all the hunting rules to be created in an environment

Playbooks

Collection of custom playbooks to be added to your Sentinel environment

sentinelascode's People

Contributors

illuvtar avatar javiersoriano avatar zenocolo avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Forkers

techiechap 0-1-2-3-4 zenocolo tiberiumsec cobb-info-tech sentinel-lab sdeloison 0xffca digitalarche tuomoan techabib abhiramvijayan tarbajaj sindhusuresh17 keymonster90 andrewgoodson cloudnation-nl tracywhodoesnot psmaan1 stijsseling jmservera bapic bcalhoun-az illuvtar iwafula025 biste5 manuelhauch v-stamatms datagarbage rakeshch10 tillo eliebouissa bigbeardata itsec365 lanicolas skiddybargins sadewalebkt sumitkute kay07949 yanivfeinberg chencol yaniv-shasha djbb7 adeafmute spuk2020 markusleh happy-jo matthewpottinger k3aczyk ujjwalk kasperlarssen sauratripathy samprotripathy cb900rr2000 antoniosql benjisec fcanestrelli-gistsec git-cssouza intishah charlesmure sachacyberdevops cloudguardai vinodoct mamtajha-ts raghumaran sedelrio p0rkpie matteomalagnino austendurkin bin-ini mariavaladas gohawks3 scottnorton-io nttdata-ken pwbennett99 gareth1507 gfengster whalito angelopvtac ko-sharon pratyashapattanayak tanvir31795 jaked-5q olchar geeraertherber digitalkhaos nikhilchopade8891 martgeluk rohitalaraddi rashabiharip 5q-socaas itsdrinkingthewater maryannselander cyberguardtim mayukharanjan magellis78 zaied54 nhspscybersecurity jahinsyed mlaraibkhan

sentinelascode's Issues

Parameter Confusion

sentinelascode/Scripts/CreateWorkbooks.ps1

Line 5 in 201b7f1

[Parameter(Mandatory=$true)]$Workspace

This parameter should be labelled from Workspace to WorkspaceName or similar.
I spent more hours than i care to confirm trying to troubleshoot why this wasn't working, when I even got a Succeeded msg.
I was using the workspace ID and not the Name.
If you use the workspaceId vs the name, it goes 'somewhere' in the subscription (but i couldn't figure out where) :)
Please rename for clarification in the future, thanks.

Unable to pass new entityMappings

We've been unsuccessful passing entityMappings through the DevOps pipeline. We've tried a couple of different JSON payloads, even one based on the JSON structure of an existing rule with manually-applied entityMappings (see attached screenshot). This could be a syntax issue, but we wanted to double-check also if new entities aren't supported for passing through the pipeline to begin with?

entity_json

Extend &convert to bicep

Please convert the code of this project to Azure Bicep and extend the deployment to detailed. Also include in enterprise scale if possible. For more information I would happy to setup a quick Teams meeting.

Connector pipeline failing due to access denied

Hello,

I was able to get the pipeline for the rules to finish successfully, however, when I used the pipeline to enable the connectors, I am failing. Below is the error (redacted TenantID).

##[error]Write-Error: D:\a\_temp\a5a06053-b604-46ef-9bd6-*************.ps1:3
Line |

   3 |  . 'd:\a\1\Scripts\Scripts\EnableConnectorsAPI.ps1' -TenantId ********** …

     |  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

     | Unable to invoke webrequest with error message: Access denied

This is the connector pipeline file. It is the same as the one in the pipelines directory except with the subscription value changed to my service connection (redacted).

name: build and deploy Connectors
resources:
 pipelines:
   - pipeline: Scripts
     source: 'scriptsCI'
trigger:
 paths:
   include:
     - Connectors/*

stages:
- stage: build_connectors

  jobs:
    - job: AgentJob
      pool:
       name: Azure Pipelines
       vmImage: 'vs2017-win2016'
      steps:
       - task: CopyFiles@2
         displayName: 'Copy Connectors'
         inputs:
          SourceFolder: Connectors
          TargetFolder: '$(Pipeline.Workspace)'

       - task: PublishBuildArtifacts@1
         displayName: 'Publish Artifact: ConnectorsFile'
         inputs:
          PathtoPublish: '$(Pipeline.Workspace)'
          ArtifactName: ConnectorsFile

- stage: deploy_connectors
  jobs:
    - job: AgentJob
      pool:
       name: Azure Pipelines
       vmImage: 'windows-2019'
      variables: 
      - group: Az connection settings
      steps:
      - download: current
        artifact: ConnectorsFile
      - download: Scripts
        patterns: '*.ps1'
      - task: AzurePowerShell@4
        displayName: 'Create and Update Connectors'
        inputs:
         azureSubscription: '************************'
         ScriptPath: '$(Pipeline.Workspace)/Scripts/Scripts/EnableConnectorsAPI.ps1'
         ScriptArguments: '-TenantId $(TenantId) -ClientId $(ClientId) -ClientSecret $(ClientSecret) -SubscriptionId $(SubscriptionId) -ResourceGroup $(ResourceGroup) -Workspace $(Workspace) -ConnectorsFile connectors.json'
         azurePowerShellVersion: LatestVersion
         pwsh: true

I am not sure why it is failing (inadequate permissions for the service connection?). Please advise.

Cheers.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.