Added Silverfort Solution

[FrankGasparovic]

Change(s):

• Added SolutionMetadata.json to define metadata for the Silverfort solution in Microsoft Sentinel.
• Included SilverfortWorkbook.json to provide a detailed workbook template offering insights into Silverfort logs and events.
• Added Certrifried.yaml, Log4Shell.yaml, NoPac_Breach.yaml, and User_Brute_Force.yaml to create analytic rules for detecting specific incidents reported by Silverfort.
• Included SilverfortITDROnPrem.json to configure the Silverfort ITDR Admin Console data connector for Microsoft Sentinel.

Reason for Change(s):

• To integrate Silverfort’s identity threat detection and response capabilities within Microsoft Sentinel, providing enhanced security insights, analytics, and incident detection.
• This integration allows users to monitor, analyze, and respond to Silverfort-related events directly within their Sentinel workspace, leveraging advanced detection rules and a custom data connector.

Version Updated:

• Yes
• The version for Detections/Analytic Rule templates has been updated to 1.0.0 for the new rules: Certrifried, Log4Shell, NoPac_Breach, and User_Brute_Force.

Testing Completed:

• Yes
• All components were tested in a Microsoft Sentinel environment to ensure they work as expected. The analytic rules were validated to trigger correctly, the workbook displayed the intended data, and the data connector ingested logs without errors.

Checked that the validations are passing and have addressed any issues that are present:

• Yes
• All necessary validations were run locally, and any identified issues were resolved prior to submission.

[v-prasadboke]

Hello @FrankGasparovic, Please add input file which should be in Data folder. It is needed to package the solution.
You can refer to this Solution for more clarification - https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Agari

Also add workbook metadata to this file
https://github.com/Azure/Azure-Sentinel/blob/master/Workbooks/WorkbooksMetadata.json

Analytic rules are missing with entity mappings, techniques and tactics.

Please do share sample data to test the content of the solution.

[v-prasadboke]

Also I have one doubt.

Is this Solution Microsoft supported. We haven't received any instructions for the same.
If it is not please correct the support details in solution metadata and publisher id should be different

[FrankGasparovic]

@v-prasadboke The PR has been updated based on your feedback. Please let me know if there is anything else needed.

[v-prasadboke]

Please replace DATA_TYPE name with data type.
You can refer to this Connector for more clarification
https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OneIdentity/Data%20Connectors/OneIdentity.JSON

[FrankGasparovic]

Resolved

[v-prasadboke]

Logo size should be below 5kb

[FrankGasparovic]

Resolved

[v-prasadboke]

Please include sentinel keyword in offer id

[FrankGasparovic]

Resolved

[v-prasadboke]

Hello @FrankGasparovic, Thanks for committing the required changes. We will get back to you by 28 August, 2024.

[FrankGasparovic]

Hi @v-prasadboke,

I wanted to check on on the current status of the PR?

[v-prasadboke]

Hello @FrankGasparovic, Please update the branch from master. Also if possible can you please try to provide me write access to your branch. Need to push some required commits

[FrankGasparovic]

@v-prasadboke I have pulled in the latest upstream changes. I unfortunately can not give you write permissions on our forked repository. Can you please provide me the files you need to add or replace? Feel free to email me at [email protected] with the zip.

[v-prasadboke]

Hello @FrankGasparovic, We want you package the solution using V3 tool. Also add release notes to the solution.
V3 tool - https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.md

Release notes reference - https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IPinfo/ReleaseNotes.md
Release notes should be same as referred above

[FrankGasparovic]

@v-prasadboke The solution has been packaged with v3 and we have added release notes

[v-prasadboke]

Hello @FrankGasparovic, Can you please try to resolve failing validation errors

[FrankGasparovic]

@v-prasadboke All checks have been resolved