Added one new RubrikWorkloadAnalysis and update the RubrikWebhookEven…

.script/tests/KqlvalidationsTests/CustomTables/Rubrik_Events_Data_CL.json

@@ -0,0 +1,113 @@
+{
+    "Name":"Rubrik_Events_Data_CL",
+    "Properties":[
+    {
+      "Name": "TenantId",
+      "Type": "string"
+    },
+    {
+      "Name": "SourceSystem",
+      "Type": "string"
+    },
+    {
+      "Name": "MG",
+      "Type": "string"
+    },
+    {
+      "Name": "ManagementGroupName",
+      "Type": "string"
+    },
+    {
+      "Name": "TimeGenerated",
+      "Type": "datetime"
+    },
+    {
+      "Name": "Computer",
+      "Type": "string"
+    },
+    {
+      "Name": "RawData",
+      "Type": "string"
+    },
+    {
+      "Name": "custom_details_objectId_g",
+      "Type": "string"
+    },
+    {
+      "Name": "custom_details_seriesId_g",
+      "Type": "string"
+    },
+    {
+      "Name": "custom_details_id_g",
+      "Type": "string"
+    },
+    {
+      "Name": "custom_details_clusterId_g",
+      "Type": "string"
+    },
+    {
+      "Name": "summary_s",
+      "Type": "string"
+    },
+    {
+      "Name": "source_s",
+      "Type": "string"
+    },
+    {
+      "Name": "severity_s",
+      "Type": "string"
+    },
+    {
+      "Name": "timestamp_s",
+      "Type": "datetime"
+    },
+    {
+      "Name": "class_s",
+      "Type": "string"
+    },
+    {
+      "Name": "custom_details_type_s",
+      "Type": "string"
+    },
+    {
+      "Name": "custom_details_objectId_s",
+      "Type": "string"
+    },
+    {
+      "Name": "custom_details_objectName_s",
+      "Type": "string"
+    },
+    {
+      "Name": "custom_details_objectType_s",
+      "Type": "string"
+    },
+    {
+      "Name": "custom_details_status_s",
+      "Type": "string"
+    },
+    {
+      "Name": "custom_details_clusterName_s",
+      "Type": "string"
+    },
+    {
+      "Name": "custom_details_eventName_s",
+      "Type": "string"
+    },
+    {
+      "Name": "custom_details_auditUserName_s",
+      "Type": "string"
+    },
+    {
+      "Name": "custom_details_auditUserId_s",
+      "Type": "string"
+    },
+    {
+      "Name": "custom_details_location_s",
+      "Type": "string"
+    },
+    {
+      "Name": "_ResourceId",
+      "Type": "string"
+    }
+  ]
+  }

Sample Data/Custom/Rubrik_Events_Data_CL.csv

@@ -0,0 +1,10 @@
+TimeGenerated [UTC],custom_details_objectId_g,custom_details_seriesId_g,custom_details_id_g,custom_details_clusterId_g,summary_s,source_s,severity_s,timestamp_s,class_s,custom_details_type_s,custom_details_objectId_s,custom_details_objectName_s,custom_details_objectType_s,custom_details_status_s,custom_details_clusterName_s,custom_details_eventName_s,custom_details_auditUserName_s,custom_details_auditUserId_s,custom_details_location_s
+"11/8/2024, 5:30:42.136 AM",047ed0bc-6b72-4ea8-b9a0-c7fb89aa5811,01930a3b-e0cf-7b83-b02c-2db1087d3b0d,6617cef8-c37c-41db-988e-d8372bbe90f3,00000000-0000-0000-0000-000000000000,Waiting for 1 snapshot(s) to be available for file recovery.,Rubrik Security Cloud,info,2024-11-08T05:30:40.64979627Z,Index,Event,,use-test,AzureNativeVm,Running,Polaris,CloudNativeIndexSnapshotsWaitForSnappableIndexTaskStarted,,,
+"11/8/2024, 5:30:50.314 AM",047ed0bc-6b72-4ea8-b9a0-c7fb89aa5811,01930a3f-f5ce-7900-8443-8a368f5baa2b,688bc4b0-f17d-4784-a96f-9a8cd387e43d,00000000-0000-0000-0000-000000000000,Successfully replicated snapshot taken at 08 Nov 24 5:00 AM UTC for the use-test Azure virtual machine in the use-test_group resource group in the TM-Lab-EA subscription to the region westus of TM-Lab-EA Azure subscription.,Rubrik Security Cloud,info,2024-11-08T05:29:57.30752593Z,Replication,Event,,use-test,AzureNativeVm,Success,Polaris,CloudNativeReplicateSnapshotsReplicateTaskSucceeded,,,
+"11/8/2024, 5:25:31.234 AM",047ed0bc-6b72-4ea8-b9a0-c7fb89aa5811,01930a3b-e0cf-7b83-b02c-2db1087d3b0d,9cb57a51-4064-4c45-a10b-4693f8b5aaa7,00000000-0000-0000-0000-000000000000,Started indexing of the snapshots of the use-test Azure virtual machine in the use-test_group resource group in the TM-Lab-EA subscription.,Rubrik Security Cloud,info,2024-11-08T05:25:17.200115471Z,Index,Event,,use-test,AzureNativeVm,TaskSuccess,Polaris,CloudNativeIndexSnapshotsJobStarted,,,
+"11/8/2024, 5:17:19.245 AM",,3787cdc1-a7ba-41ed-9c6e-cc5d8d4a2a27,88ece1ed-1a95-43b9-ae38-302cf05c19d8,00000000-0000-0000-0000-000000000000,[email protected] successfully created the webhook Rubrik-other-events.,Rubrik Security Cloud,info,2024-11-08T05:17:18.370059549Z,Configuration,Audit,auth0|65b91cdc85d3150aa4a1b3d0,[email protected],User,Success,Polaris,WebhookCreated,[email protected],auth0|65b91cdc85d3150aa4a1b3d0,
+"11/8/2024, 5:18:40.088 AM",,496f42ec-e684-4a04-b191-e6a3a122d49f,efb7669b-8891-4a76-a613-d104f661b856,00000000-0000-0000-0000-000000000000,[email protected] successfully created the webhook Rubrik-AnomalyOrchestrator.,Rubrik Security Cloud,info,2024-11-08T05:18:39.20837609Z,Configuration,Audit,auth0|65b91cdc85d3150aa4a1b3d0,[email protected],User,Success,Polaris,WebhookCreated,[email protected],auth0|65b91cdc85d3150aa4a1b3d0,
+"11/8/2024, 5:16:28.396 AM",,,,,Rubrik Polaris webhook test event,Rubrik Security Cloud,info,2024-11-08T05:16:14.067423864Z,Configuration,Event,,,,Succeeded,Rubrik Security Cloud,,,,test-location
+"11/7/2024, 1:25:23.986 PM",,,,,Rubrik Polaris webhook test event,Rubrik Security Cloud,info,2024-11-07T13:25:01.215428023Z,Configuration,Event,,,,Succeeded,Rubrik Security Cloud,,,,test-location
+"11/8/2024, 5:29:22.352 AM",047ed0bc-6b72-4ea8-b9a0-c7fb89aa5811,01930a3b-e0cf-7b83-b02c-2db1087d3b0d,e17bfee9-bed2-4691-b58d-0885322600c0,00000000-0000-0000-0000-000000000000,Started indexing of snapshot taken at 08 Nov 24 5:00 AM UTC.,Rubrik Security Cloud,info,2024-11-08T05:29:20.550468555Z,Index,Event,,use-test,AzureNativeVm,Running,Polaris,CloudNativeIndexSnapshotBegin,,,
+"11/8/2024, 5:21:33.309 AM",,28b3ccfd-6679-4f88-b416-5658d859dc6c,f690f13a-12f9-4b80-a268-48ba26a6e917,00000000-0000-0000-0000-000000000000,[email protected] successfully created the webhook Rubrik-ThreathuntOrchestrator.,Rubrik Security Cloud,info,2024-11-08T05:21:31.535526647Z,Configuration,Audit,auth0|65b91cdc85d3150aa4a1b3d0,[email protected],User,Success,Polaris,WebhookCreated,[email protected],auth0|65b91cdc85d3150aa4a1b3d0,

Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikAnomalyOrchestrator/__init__.py

@@ -13,12 +13,12 @@ def orchestrator_function(context: df.DurableOrchestrationContext):
     Returns:
         str: result of Activity function
     """
-    applogger.debug("{} AnomalyOrchestrator function called!".format(LOGS_STARTS_WITH))
+    applogger.info("{} AnomalyOrchestrator function called!".format(LOGS_STARTS_WITH))
     json_data = context.get_input()
     result1 = yield context.call_activity(
         "RubrikActivity", {"data": json_data, "log_type": ANOMALY_LOG_TYPE}
     )
-    applogger.debug(
+    applogger.info(
         "{} AnomalyOrchestrator function completed!".format(LOGS_STARTS_WITH)
     )
     return result1

Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikEventsOrchestrator/__init__.py

@@ -0,0 +1,28 @@
+"""This __init__ file will be called by Http Starter function to pass the Other Events data to activity function."""
+import azure.durable_functions as df
+from shared_code.consts import EVENTS_LOG_TYPE, LOGS_STARTS_WITH
+from shared_code.logger import applogger
+
+
+def orchestrator_function(context: df.DurableOrchestrationContext):
+    """Get General data from durable orchestration context and schedule an activity for execution.
+
+    Args:
+        context (df.DurableOrchestrationContext): Context of the durable orchestration execution.
+
+    Returns:
+        str: result of Activity function
+    """
+    applogger.info("{} RubrikEventOrchestrator function called!".format(LOGS_STARTS_WITH))
+    json_data = context.get_input()
+
+    result1 = yield context.call_activity(
+        "RubrikActivity", {"data": json_data, "log_type": EVENTS_LOG_TYPE}
+    )
+    applogger.info(
+        "{} RubrikEventOrchestrator function completed!".format(LOGS_STARTS_WITH)
+    )
+    return result1
+
+
+main = df.Orchestrator.create(orchestrator_function)

Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikEventsOrchestrator/function.json

@@ -0,0 +1,10 @@
+{
+  "scriptFile": "__init__.py",
+  "bindings": [
+    {
+      "name": "context",
+      "type": "orchestrationTrigger",
+      "direction": "in"
+    }
+  ]
+}

Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikHttpStarter/__init__.py

@@ -23,9 +23,7 @@ def get_data_from_request_body(request):
         json_data = json.dumps(data)
         return json_data
     except ValueError as value_error:
-        applogger.error(
-            "{}(method={}) {}".format(LOGS_STARTS_WITH, __method_name, value_error)
-        )
+        applogger.error("{}(method={}) {}".format(LOGS_STARTS_WITH, __method_name, value_error))
         raise RubrikException(value_error)
     except Exception as err:
         applogger.error("{}(method={}) {}".format(LOGS_STARTS_WITH, __method_name, err))
@@ -63,11 +61,7 @@ async def main(req: func.HttpRequest, starter: str) -> func.HttpResponse:
                 headers={"Content-Length": str(len(body))},
             )
         else:
-            applogger.info(
-                "{}(method={})No required data found.".format(
-                    LOGS_STARTS_WITH, __method_name
-                )
-            )
+            applogger.info("{}(method={})No required data found.".format(LOGS_STARTS_WITH, __method_name))
             body = "No required data found."
             return func.HttpResponse(
                 body=body,

Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikRansomwareOrchestrator/__init__.py

@@ -13,14 +13,14 @@ def orchestrator_function(context: df.DurableOrchestrationContext):
     Returns:
         str: result of Activity function
     """
-    applogger.debug(
+    applogger.info(
         "{} RansomwareOrchestrator function called!".format(LOGS_STARTS_WITH)
     )
     json_data = context.get_input()
     result1 = yield context.call_activity(
         "RubrikActivity", {"data": json_data, "log_type": RANSOMWARE_LOG_TYPE}
     )
-    applogger.debug(
+    applogger.info(
         "{} RansomwareOrchestrator function completed!".format(LOGS_STARTS_WITH)
     )
     return result1

Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikThreathuntOrchestrator/__init__.py

@@ -13,14 +13,14 @@ def orchestrator_function(context: df.DurableOrchestrationContext):
     Returns:
         str: result of Activity function
     """
-    applogger.debug(
+    applogger.info(
         "{} ThreatHuntOrchestrator function called!".format(LOGS_STARTS_WITH)
     )
     json_data = context.get_input()
     result1 = yield context.call_activity(
         "RubrikActivity", {"data": json_data, "log_type": THREATHUNT_LOG_TYPE}
     )
-    applogger.debug(
+    applogger.info(
         "{} ThreatHuntOrchestrator function completed!".format(LOGS_STARTS_WITH)
     )
     return result1

Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikWebhookEvents_FunctionApp.json

@@ -18,6 +18,11 @@
             "metricName": "Total ThreatHunt Event data received",
             "legend": "Rubrik_ThreatHunt_Data_CL",
             "baseQuery": "Rubrik_ThreatHunt_Data_CL"
+        },
+        {
+            "metricName": "Total Other Events data received",
+            "legend": "Rubrik_Events_Data_CL",
+            "baseQuery": "Rubrik_Events_Data_CL"
         }
     ],
     "sampleQueries": [
@@ -32,6 +37,10 @@
         {
             "description": "Rubrik ThreatHunt Events - Threat Hunt Events for all severity types.",
             "query": "Rubrik_ThreatHunt_Data_CL\n | sort by TimeGenerated desc"
+        },
+        {
+            "description": "Rubrik Other Events - Other Events for all severity types.",
+            "query": "Rubrik_Events_Data_CL\n | sort by TimeGenerated desc"
         }
     ],
     "dataTypes": [
@@ -46,6 +55,10 @@
         {
             "name": "Rubrik_ThreatHunt_Data_CL",
             "lastDataReceivedQuery": "Rubrik_ThreatHunt_Data_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+        },
+        {
+            "name": "Rubrik_Events_Data_CL",
+            "lastDataReceivedQuery": "Rubrik_Events_Data_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
         }
     ],
     "connectivityCriterias": [
@@ -66,6 +79,12 @@
             "value": [
                 "Rubrik_ThreatHunt_Data_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
             ]
+        },
+        {
+            "type": "IsConnectedQuery",
+            "value": [
+                "Rubrik_Events_Data_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
+            ]
         }
     ],
     "availability": {
@@ -137,7 +156,7 @@
         },
         {
             "title": "Option 1 - Azure Resource Manager (ARM) Template",
-            "description": "Use this method for automated deployment of the Rubrik connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-RubrikWebhookEvents-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the below information : \n\t\tFunction Name \n\t\tWorkspace ID \n\t\tWorkspace Key \n\t\tAnomalies_table_name \n\t\tRansomwareAnalysis_table_name \n\t\tThreatHunts_table_name\n\t\tLogLevel \n \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy."
+            "description": "Use this method for automated deployment of the Rubrik connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-RubrikWebhookEvents-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the below information : \n\t\tFunction Name \n\t\tWorkspace ID \n\t\tWorkspace Key \n\t\tAnomaliesTableName \n\t\tRansomwareAnalysisTableName \n\t\tThreatHuntsTableName \n\t\tEventsTableName \n\t\tLogLevel \n \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy."
         },
         {
             "title": "Option 2 - Manual Deployment of Azure Functions",
@@ -149,7 +168,7 @@
         },
         {
             "title": "",
-            "description": "**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select **+ New application setting**.\n3. Add each of the following application settings individually, with their respective values (case-sensitive): \n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tAnomalies_table_name\n\t\tRansomwareAnalysis_table_name\n\t\tThreatHunts_table_name\n\t\tLogLevel\n\t\tlogAnalyticsUri (optional)\n - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: https://<CustomerId>.ods.opinsights.azure.us. \n4. Once all application settings have been entered, click **Save**."
+            "description": "**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select **+ New application setting**.\n3. Add each of the following application settings individually, with their respective values (case-sensitive): \n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tAnomaliesTableName\n\t\tRansomwareAnalysisTableName\n\t\tThreatHuntsTableName\n\t\tEventsTableName\n\t\tLogLevel\n\t\tlogAnalyticsUri (optional)\n - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: https://<CustomerId>.ods.opinsights.azure.us. \n4. Once all application settings have been entered, click **Save**."
         },
         {
             "title": "",
@@ -161,11 +180,11 @@
         },
         {
             "title": "2) Add a webhook in RubrikSecurityCloud to send data to Microsoft Sentinel.",
-            "description": "Follow the Rubrik User Guide instructions to [Add a Webhook](https://docs.rubrik.com/en-us/saas/saas/common/adding_webhook.html) to begin receiving event information related to Ransomware Anomalies \n 1. Select the Generic as the webhook Provider(This will use CEF formatted event information)\n 2. Enter the URL part from copied Function-url as the webhook URL endpoint and replace **{functionname}**  with **\"RubrikAnomalyOrchestrator\"**, for the Rubrik Microsoft Sentinel Solution \n 3. Select the Advanced or Custom Authentication option \n 4. Enter x-functions-key as the HTTP header \n 5. Enter the Function access key(value of code parameter from copied function-url) as the HTTP value(Note: if you change this function access key in Microsoft Sentinel in the future you will need to update this webhook configuration) \n 6. Select the EventType as Anomaly \n 7. Select the following severity levels: Critical, Warning, Informational \n 8. Repeat the same steps to add webhooks for Ransomware Investigation Analysis and Threat Hunt. \n\n NOTE: while adding webhooks for Ransomware Investigation Analysis and Threat Hunt, replace **{functionname}**  with **\"RubrikRansomwareOrchestrator\"** and **\"RubrikThreatHuntOrchestrator\"** respectively in copied function-url."
+            "description": "Follow the Rubrik User Guide instructions to [Add a Webhook](https://docs.rubrik.com/en-us/saas/saas/common/adding_webhook.html) to begin receiving event information  \n 1. Select the Microsoft Sentinel as the webhook Provider \n 2. Enter the desired Webhook name \n 3. Enter the URL part from copied Function-url as the webhook URL endpoint and replace **{functionname}**  with **\"RubrikAnomalyOrchestrator\"**, for the Rubrik Microsoft Sentinel Solution \n 4. Select the EventType as Anomaly \n 5. Select the following severity levels: Critical, Warning, Informational \n 6. Choose multiple log types, if desired, when running **\"RubrikEventsOrchestrator\"** \n 7. Repeat the same steps to add webhooks for Anomaly Detection Analysis, Threat Hunt and Other Events.\n   \n\n NOTE: while adding webhooks for Anomaly Detection Analysis, Threat Hunt and Other Events, replace **{functionname}**  with **\"RubrikRansomwareOrchestrator\"**, **\"RubrikThreatHuntOrchestrator\"** and **\"RubrikEventsOrchestrator\"** respectively in copied function-url."
         },
         {
             "title": "",
-            "description": "*Now we are done with the rubrik Webhook configuration. Once the webhook events triggered , you should be able to see the Anomaly, Ransomware Investigation Analysis, Threat Hunt events from the Rubrik into respective LogAnalytics workspace table called \"Rubrik_Anomaly_Data_CL\", \"Rubrik_Ransomware_Data_CL\", \"Rubrik_ThreatHunt_Data_CL\".*\n\n"
+            "description": "*Now we are done with the rubrik Webhook configuration. Once the webhook events triggered , you should be able to see the Anomaly, Anomaly Detection Analysis, Threat Hunt events and Other Events from the Rubrik into respective LogAnalytics workspace table called \"Rubrik_Anomaly_Data_CL\", \"Rubrik_Ransomware_Data_CL\", \"Rubrik_ThreatHunt_Data_CL\", and \"Rubrik_Events_Data_CL\".*\n\n"
         }
     ]
-}
+}