Skip to content

Commit

Permalink
Solution packaged
Browse files Browse the repository at this point in the history
  • Loading branch information
@v-prasadboke
v-prasadboke committed Nov 28, 2024
1 parent 6497561 commit 19636aa
Show file tree
Hide file tree
Showing 3 changed files with 30 additions and 30 deletions.
Binary file added Solutions/Cortex XDR/Package/3.0.1.zip
View file
Binary file not shown.
2 changes: 1 addition & 1 deletion Solutions/Cortex XDR/Package/createUiDefinition.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
"config": {
"isWizard": false,
"basics": {
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/CortexXDR_Logo.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cortex%20XDR/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Palo Alto Networks](https://www.paloaltonetworks.com/) Cortex XDR Sentinel Solution pulls log directly from the Cortex XDR platform via API. The solution is configured to pull the Incidents from the Cortex XDR platform every 5 minutes and ingest them into Sentinel. The solution is dependent on the Cortex XDR API Key and API Key ID. The API Key ID is used as the polling key path and the API Key is used as the header for the API request. The solution also includes 3 analytics rules to detect the creation of incidents based on the severities (High, Medium, Low).\n\n**Data Connectors:** 1, **Parsers:** 1, **Analytic Rules:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/CortexXDR_Logo.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cortex%20XDR/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Palo Alto Networks](https://www.paloaltonetworks.com/) Cortex XDR Microsoft Sentinel Solution pulls log directly from the Cortex XDR platform via API. The solution is configured to pull the Incidents from the Cortex XDR platform every 5 minutes and ingest them into Microsoft Sentinel. The solution is dependent on the Cortex XDR API Key and API Key ID. The API Key ID is used as the polling key path and the API Key is used as the header for the API request. The solution also includes 3 analytics rules to detect the creation of incidents based on the severities (High, Medium, Low).\n\n**Data Connectors:** 1, **Parsers:** 1, **Analytic Rules:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
"subscription": {
"resourceProviders": [
"Microsoft.OperationsManagement/solutions",
Expand Down
58 changes: 29 additions & 29 deletions Solutions/Cortex XDR/Package/mainTemplate.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@
"parserContentId1": "CortexXDR_Incidents_CL-Parser"
},
"workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
"dataConnectorCCPVersion": "1.0.1",
"dataConnectorCCPVersion": "1.0.0",
"_dataConnectorContentIdConnectorDefinition1": "CortexXDRDataConnector",
"dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]",
"_dataConnectorContentIdConnections1": "CortexXDRDataConnectorConnections",
Expand Down Expand Up @@ -133,26 +133,26 @@
{
"fieldMappings": [
{
"identifier": "Name",
"columnName": "users_s"
"columnName": "users_s",
"identifier": "Name"
}
],
"entityType": "Account"
},
{
"fieldMappings": [
{
"identifier": "Url",
"columnName": "xdr_url_s"
"columnName": "xdr_url_s",
"identifier": "Url"
}
],
"entityType": "URL"
},
{
"fieldMappings": [
{
"identifier": "HostName",
"columnName": "hosts_s"
"columnName": "hosts_s",
"identifier": "HostName"
}
],
"entityType": "Host"
Expand All @@ -163,10 +163,10 @@
},
"incidentConfiguration": {
"groupingConfiguration": {
"reopenClosedIncident": false,
"enabled": true,
"matchingMethod": "AllEntities",
"lookbackDuration": "5h"
"reopenClosedIncident": false,
"lookbackDuration": "5h",
"enabled": true
},
"createIncident": true
}
Expand Down Expand Up @@ -260,26 +260,26 @@
{
"fieldMappings": [
{
"identifier": "Name",
"columnName": "users_s"
"columnName": "users_s",
"identifier": "Name"
}
],
"entityType": "Account"
},
{
"fieldMappings": [
{
"identifier": "Url",
"columnName": "xdr_url_s"
"columnName": "xdr_url_s",
"identifier": "Url"
}
],
"entityType": "URL"
},
{
"fieldMappings": [
{
"identifier": "HostName",
"columnName": "hosts_s"
"columnName": "hosts_s",
"identifier": "HostName"
}
],
"entityType": "Host"
Expand All @@ -290,10 +290,10 @@
},
"incidentConfiguration": {
"groupingConfiguration": {
"reopenClosedIncident": false,
"enabled": true,
"matchingMethod": "AllEntities",
"lookbackDuration": "5h"
"reopenClosedIncident": false,
"lookbackDuration": "5h",
"enabled": true
},
"createIncident": true
}
Expand Down Expand Up @@ -387,26 +387,26 @@
{
"fieldMappings": [
{
"identifier": "Name",
"columnName": "users_s"
"columnName": "users_s",
"identifier": "Name"
}
],
"entityType": "Account"
},
{
"fieldMappings": [
{
"identifier": "Url",
"columnName": "xdr_url_s"
"columnName": "xdr_url_s",
"identifier": "Url"
}
],
"entityType": "URL"
},
{
"fieldMappings": [
{
"identifier": "HostName",
"columnName": "hosts_s"
"columnName": "hosts_s",
"identifier": "HostName"
}
],
"entityType": "Host"
Expand All @@ -417,10 +417,10 @@
},
"incidentConfiguration": {
"groupingConfiguration": {
"reopenClosedIncident": false,
"enabled": true,
"matchingMethod": "AllEntities",
"lookbackDuration": "5h"
"reopenClosedIncident": false,
"lookbackDuration": "5h",
"enabled": true
},
"createIncident": true
}
Expand Down Expand Up @@ -3399,7 +3399,7 @@
"contentSchemaVersion": "3.0.0",
"displayName": "Cortex XDR",
"publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation",
"descriptionHtml": "<p><strong>Note:</strong> Please refer to the following before installing the solution:</p>\n<p>• Review the solution <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cortex%20XDR/ReleaseNotes.md\">Release Notes</a></p>\n<p>• There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</p>\n<p>The <a href=\"https://www.paloaltonetworks.com/\">Palo Alto Networks</a> Cortex XDR Sentinel Solution pulls log directly from the Cortex XDR platform via API. The solution is configured to pull the Incidents from the Cortex XDR platform every 5 minutes and ingest them into Sentinel. The solution is dependent on the Cortex XDR API Key and API Key ID. The API Key ID is used as the polling key path and the API Key is used as the header for the API request. The solution also includes 3 analytics rules to detect the creation of incidents based on the severities (High, Medium, Low).</p>\n<p><strong>Data Connectors:</strong> 1, <strong>Parsers:</strong> 1, <strong>Analytic Rules:</strong> 3</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n",
"descriptionHtml": "<p><strong>Note:</strong> Please refer to the following before installing the solution:</p>\n<p>• Review the solution <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cortex%20XDR/ReleaseNotes.md\">Release Notes</a></p>\n<p>• There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</p>\n<p>The <a href=\"https://www.paloaltonetworks.com/\">Palo Alto Networks</a> Cortex XDR Microsoft Sentinel Solution pulls log directly from the Cortex XDR platform via API. The solution is configured to pull the Incidents from the Cortex XDR platform every 5 minutes and ingest them into Microsoft Sentinel. The solution is dependent on the Cortex XDR API Key and API Key ID. The API Key ID is used as the polling key path and the API Key is used as the header for the API request. The solution also includes 3 analytics rules to detect the creation of incidents based on the severities (High, Medium, Low).</p>\n<p><strong>Data Connectors:</strong> 1, <strong>Parsers:</strong> 1, <strong>Analytic Rules:</strong> 3</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n",
"contentKind": "Solution",
"contentProductId": "[variables('_solutioncontentProductId')]",
"id": "[variables('_solutioncontentProductId')]",
Expand Down

0 comments on commit 19636aa

Please sign in to comment.