Merge branch 'Azure:master' into master

.github/workflows/ScanSecrets.yaml

@@ -13,6 +13,5 @@ jobs:
         fetch-depth: 0
     - name: Secret Scanning
       uses: trufflesecurity/trufflehog@main
-      continue-on-error: true
       with:
         extra_args: --exclude-paths=.script/SecretScanning/Excludepathlist --only-verified

.github/workflows/codeql-analysis.yml

@@ -42,7 +42,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -54,7 +54,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@v3
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -68,4 +68,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3

.github/workflows/convertKqlFunctionYamlToArmTemplate.yaml

@@ -15,6 +15,7 @@ on:
        - 'Parsers/ASimRegistryEvent/Parsers/**'
        - 'Parsers/ASimUserManagement/Parsers/**'
        - 'Parsers/ASimDhcpEvent/Parsers/**'
+       - 'Parsers/ASimAlertEvent/Parsers/**'
 
 env:
   GITHUB_APPS_ID: "${{ secrets.APPLICATION_ID }}"

.github/workflows/runAsimSchemaAndDataTesters.yaml

@@ -17,6 +17,7 @@ on:
     - 'Parsers/ASimRegistryEvent/Parsers/**'
     - 'Parsers/ASimUserManagement/Parsers/**'
     - 'Parsers/ASimDhcpEvent/Parsers/**'
+    - 'Parsers/ASimAlertEvent/Parsers/**'
 
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
@@ -192,8 +193,6 @@ jobs:
             # Execute the script
             & $filePath
           azPSVersion: "latest"
-          errorActionPreference: continue
-          failOnStandardError: false
   Run-ASim-Parser-Filtering-Tests:
     needs: Run-ASim-Sample-Data-Ingest
     name: Run ASim Parser Filtering tests

.script/dataConnectorValidator.ts

@@ -26,7 +26,11 @@ export async function IsValidDataConnectorSchema(filePath: string): Promise<Exit
 
         /* Disabling temporarily till we get confirmation from PM*/
         // isValidFileName(filePath
-        isValidPermissions(jsonFile.permissions, connectorCategory);
+        /* Skip validation for Solution Microsoft Exchange Security - Exchange On-Premises Solution */
+        if (!filePath.includes('Microsoft Exchange Security - Exchange On-Premises')) 
+        {
+          isValidPermissions(jsonFile.permissions, connectorCategory);
+        }
       }
       else{
         console.warn(`Skipping File as it is of type Events : ${filePath}`)
@@ -173,4 +177,4 @@ let CheckOptions = {
   },
 };
 
-runCheckOverChangedFiles(CheckOptions, fileKinds, fileTypeSuffixes, filePathFolderPrefixes);
+runCheckOverChangedFiles(CheckOptions, fileKinds, fileTypeSuffixes, filePathFolderPrefixes);

.script/getModifiedASimSchemas.ps1

@@ -1,5 +1,5 @@
 function getModifiedAsimSchemas() {
-    $schemas = ("ASimDns", "ASimWebSession", "ASimNetworkSession", "ASimProcessEvent", "ASimAuditEvent", "ASimAuthentication", "ASimFileEvent", "ASimRegistryEvent","ASimUserManagement","ASimDhcpEvent")
+    $schemas = ("ASimDns", "ASimWebSession", "ASimNetworkSession", "ASimProcessEvent", "ASimAuditEvent", "ASimAuthentication", "ASimFileEvent", "ASimRegistryEvent","ASimUserManagement","ASimDhcpEvent","ASimAlertEvent")
     $modifiedSchemas = @()
     foreach ($schema in $schemas) {
         $filesThatWereChanged= Invoke-Expression "git diff origin/master  --name-only -- $($PSScriptRoot)/../Parsers/$($schema)/Parsers"

.script/tests/KqlvalidationsTests/CustomTables/Audit_CL.json

@@ -0,0 +1,89 @@
+{
+    "Name": "Audit_CL",
+    "Properties": [
+        {
+            "Name": "TenantId",
+            "Type": "string"
+        },
+        {
+            "Name": "SourceSystem",
+            "Type": "string"
+        },
+        {
+            "Name": "MG",
+            "Type": "string"
+        },
+        {
+            "Name": "ManagementGroupName",
+            "Type": "string"
+        },
+        {
+            "Name": "TimeGenerated",
+            "Type": "datetime"
+        },
+        {
+            "Name": "Computer",
+            "Type": "string"
+        },
+        {
+            "Name": "RawData",
+            "Type": "string"
+        },
+        {
+            "Name": "id_d",
+            "Type": "real"
+        },
+        {
+            "Name": "name_s",
+            "Type": "string"
+        },
+        {
+            "Name": "type_s",
+            "Type": "string"
+        },
+        {
+            "Name": "content_s",
+            "Type": "string"
+        },
+        {
+            "Name": "metadata_author_s",
+            "Type": "string"
+        },
+        {
+            "Name": "metadata_date_s",
+            "Type": "string"
+        },
+        {
+            "Name": "id_s",
+            "Type": "string"
+        },
+        {
+            "Name": "auditType_s",
+            "Type": "string"
+        },
+        {
+            "Name": "user_s",
+            "Type": "string"
+        },
+        {
+            "Name": "eventTime_t",
+            "Type": "datetime"
+        },
+        {
+            "Name": "eventInfo_s",
+            "Type": "string"
+        },
+        {
+            "Name": "Category",
+            "Type": "string"
+        },
+        {
+            "Name": "Type",
+            "Type": "string"
+        },
+        {
+            "Name": "_ResourceId",
+            "Type": "string"
+        }
+    ]
+}

.script/tests/KqlvalidationsTests/CustomTables/AwarenessPerformanceDetails.json

@@ -0,0 +1,41 @@
+{
+    "Name": "AwarenessPerformanceDetails",
+    "Properties": [
+        {
+            "Name": "Email",
+            "Type": "string"
+        },
+        {
+            "Name": "Name",
+            "Type": "string"
+        },
+        {
+            "Name": "Num of Correct",
+            "Type": "real"
+        },
+        {
+            "Name": "Num of Incorrect",
+            "Type": "real"
+        },
+        {
+            "Name": "Num of Not Watched",
+            "Type": "real"
+        },
+        {
+            "Name": "User Details",
+            "Type": "string"
+        },
+        {
+            "Name": "User State",
+            "Type": "string"
+        },
+        {
+            "Name": "Department",
+            "Type": "string"
+        },
+        {
+            "Name": "Time Generated",
+            "Type": "datetime"
+        }
+    ]
+}

.script/tests/KqlvalidationsTests/CustomTables/AwarenessSafeScore.json

@@ -0,0 +1,45 @@
+{
+    "Name": "AwarenessSafeScoreDetails",
+    "Properties": [
+        {
+            "Name": "Email Address",
+            "Type": "string"
+        },
+        {
+            "Name": "Name",
+            "Type": "string"
+        },
+        {
+            "Name": "Risk",
+            "Type": "string"
+        },
+        {
+            "Name": "Human Error",
+            "Type": "string"
+        },
+        {
+            "Name": "Sentiment",
+            "Type": "string"
+        },
+        {
+            "Name": "Engagement",
+            "Type": "string"
+        },
+        {
+            "Name": "Knowledge",
+            "Type": "string"
+        },
+        {
+            "Name": "User State",
+            "Type": "string"
+        },
+        {
+            "Name": "Department",
+            "Type": "string"
+        },
+        {
+            "Name": "Time Generated",
+            "Type": "datetime"
+        }
+    ]
+}

.script/tests/KqlvalidationsTests/CustomTables/AwarenessUserData.json

@@ -0,0 +1,77 @@
+{
+    "Name": "AwarenessUserData",
+    "Properties": [
+        {
+            "Name": "Time Generated",
+            "Type": "datetime"
+        },
+        {
+            "Name": "Time Reported",
+            "Type": "datetime"
+        },
+        {
+            "Name": "Name",
+            "Type": "string"
+        },
+        {
+            "Name": "Email",
+            "Type": "string"
+        },
+        {
+            "Name": "Template Name",
+            "Type": "string"
+        },
+        {
+            "Name": "Status",
+            "Type": "string"
+        },
+        {
+            "Name": "Num of Campaigns Clicked",
+            "Type": "real"
+        },
+        {
+            "Name": "Num of Campaigns Sent",
+            "Type": "real"
+        },
+        {
+            "Name": "Num of Correct Answers",
+            "Type": "real"
+        },
+        {
+            "Name": "Num of Training Modules Assigned",
+            "Type": "real"
+        },
+        {
+            "Name": "Num of Incorrect Answers",
+            "Type": "real"
+        },
+        {
+            "Name": "User State",
+            "Type": "string"
+        },
+        {
+            "Name": "Clicked IP",
+            "Type": "string"
+        },
+        {
+            "Name": "Reaction Time",
+            "Type": "real"
+        },
+        {
+            "Name": "Time Opened",
+            "Type": "datetime"
+        },
+        {
+            "Name": "Department",
+            "Type": "string"
+        },
+        {
+            "Name": "Time Scheduled",
+            "Type": "datetime"
+        },
+        {
+            "Name": "Time Clicked",
+            "Type": "datetime"
+        }
+    ]
+}

.script/tests/KqlvalidationsTests/CustomTables/AwarenessWatchlist.json

@@ -0,0 +1,29 @@
+{
+    "Name": "AwarenessWatchlist",
+    "Properties": [
+        {
+            "Name": "Email",
+            "Type": "string"
+        },
+        {
+            "Name": "Name",
+            "Type": "string"
+        },
+        {
+            "Name": "Watchlist Count",
+            "Type": "real"
+        },
+        {
+            "Name": "User State",
+            "Type": "string"
+        },
+        {
+            "Name": "Department",
+            "Type": "string"
+        },
+        {
+            "Name": "Time Generated",
+            "Type": "datetime"
+        }
+    ]
+}