IPinfo Sentinel Solution

[AhmadMujahid2k]

Change(s):

• Added 3 data connectors that use logs ingestion API to ingest data into custom tables.
• Added ARM templates to create required Azure resources and function app.
• Added Logo.
• Added Sample Data.

Reason for Change(s):

• This is a new integration with IPinfo.

Version Updated:

• This is the first version.

Testing Completed:

• Yes with arm-ttk.
• Need help with KQL Validation.

Checked that the validations are passing and have addressed any issues that are present:

• Need Help to resolve this Fail test case of arm-ttk :
  [-] IDs Should Be Derived From ResourceIDs (125 ms)
  Property: "id" must use one of the following expressions for an resourceId property: extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid

[AhmadMujahid2k]

@microsoft-github-policy-service agree company="IPinfo"

[v-prasadboke]

Hello @AhmadMujahid2k, Please provide publisher and offer ID so that we can test the content of the Solution.

[AhmadMujahid2k]

Hi @v-prasadboke,
Offer ID: microsoft_sentinel_solution_ipinfo_ipintelligence
Offer type: Azure Application
Publisher ID: idbllc1687537942583

[v-prasadboke]

Please replace underscore '_' with hyphen '-' in offer id

https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/README.md

[AhmadMujahid2k]

Sure, we will update the offer ID shortly.

[v-prasadboke]

Thank you for the confirmation @AhmadMujahid2k

[AhmadMujahid2k]

@v-prasadboke apologies for delay.

Offer ID: microsoft-sentinel-solution-ipinfo-ipintelligence
Offer type: Azure Application
Publisher ID: idbllc1687537942583

[v-prasadboke]

Thanks for updating the offer id. I'll continue the investigation. Until then can you share the invocation logs of the function app

[AhmadMujahid2k]

These are the invocation logs for the "Company" function app. The other two function apps "IP-location" and "Privacy" share similar functionality and configurations but utilize different datasets:
6-12-2024.csv
6-13-2024.csv

[v-prasadboke]

Thanks @AhmadMujahid2k, the zip's folder structure is not correct. Also seems some files are missing. I'll take a look at it once and confirm on it. Thanks.

Until then can you please resolve validation failures

[v-prasadboke]

Hello @AhmadMujahid2k, if this is the main function app file
please rename it to main.py

you can refer this data connector for more clarification

[AhmadMujahid2k]

Hi @v-prasadboke
We use the V2 method, creating function_app.py as per documentation. We also see a similar in the "WithSecureElementsViaFunction" solution. We'll rename it to main.py if needed. No specific data connector was mentioned by you above was this an oversight?

[v-prasadboke]

Sorry @AhmadMujahid2k my Bad, missed on adding the hyperlink

[v-prasadboke]

https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Auth0/Data%20Connectors

[AhmadMujahid2k]

Hi @v-prasadboke could you please clarify if we need the function.json file to specify the time for running main.py, given that this is the v1 method? We are currently following the v2 method, in which the schedule is defined in function_app.py.

We are a bit confused and need clarification on whether you want us to follow the exact structure of the data connector you provided or if there is some flexibility.

Thank you.

[v-prasadboke]

Hello @AhmadMujahid2k, can we connect for the same to clarify the requirements.
We can get on a call. Please share your availability and time zone so that we can plan for the same.
Please do share you mail id too.

If needed you can ping me on teams too. My mail and teams id is [email protected]

[AhmadMujahid2k]

Hello @v-prasadboke Thank you for considering the meeting. We will be available from Monday to Friday, from 6:00 AM UTC to 1:00 PM UTC.
Our email addresses are:
[email protected]
[email protected]
Looking forward to connecting with you.

[v-prasadboke]

Hello @AhmadMujahid2k can we connect on 4 July, 2024 at 10:00 Am UTC

[AhmadMujahid2k]

@v-prasadboke that's perfect! We are available.
Looking forward to it!

[v-prasadboke]

Hello @AhmadMujahid2k as discussed in the call. Please proceed with the changes requested. Thanks.

[AhmadMujahid2k]

@v-prasadboke invocation logs for the "Company" & "Privacy" function app.
Company.csv
Privacy.csv