Required items, please complete

Change(s):

• Adding data connector for Azure DevOps

Reason for Change(s):

• Didn't exist yet

Version Updated:

• Required only for Detections/Analytic Rule templates
• See guidance below

Testing Completed:

• Tested and validated see screenshots reamd.md for proof

Checked that the validations are passing and have addressed any issues that are present:

• See guidance below

Change(s):

• Initial PR
• Added solution by Digital Shadows for Azure Sentinel
• Contains Analytic rule yaml file, Connector Azure function, Playbook JSON file, and Workbook JSON file.

Reason for Change(s):

• Initial PR

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes

Required items, please complete

Change(s):

• Cybersixgill Actionable alerts Solution

Reason for Change(s):

• New solution

Version Updated:

• N/A

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes

Change(s):

• First PR of new solution "ESI - On-Premises Exchange Security Configuration" without package

Reason for Change(s):

• Adding new REST API Connector with its parser and the first Workbook

Version Updated:

• First version 1.0.0

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• No

Change(s):

• Initial version of solution Forescout Host Property Monitor

Reason for Change(s):

• New Solution development for Forescout Host Property Monitor

Version Updated:

• No

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes

Required items, please complete

Change(s):

• Initial commit for adding Mandiant Advantage Threat Intelligence solution

Reason for Change(s):

• Adding Mandiant Advantage Threat Intelligence solution

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Need Help

Required items, please complete

Change(s):

• CriticalCmdletsUsageDetection.yaml
• ServerOrientedWithUserOrientedAdministration.yaml
• Data Connectors/ESI-ExchangeAdminAuditLogEvents.json
• Data Connectors/ESI-ExchangeOnPremisesCollector.json
• Data Connectors/ESI-ExchangeOnlineCollector.json
• Data Connectors/azuredeploy_ESI_ExchangeOnlineCollector_Automation.json
• Parser/ExchangeAdminAuditLogs.txt
• Parser/ExchangeConfiguration.txt
• Sample-Data/ESI-ExchangeAdminAuditLogs-SampleData.json
• SolutionMetadata.json
• Watchlists/ExchangeVIPs.json
• Workbooks/Microsoft Exchange Least Privilege with RBAC - Online.json
• Workbooks/Microsoft Exchange Least Privilege with RBAC.json
• Workbooks/Microsoft Exchange Search AdminAuditLog.json
• Workbooks/Microsoft Exchange Security Monitoring.json
• Workbooks/Microsoft Exchange Security Review - Online.json
• Workbooks/Microsoft Exchange Security Review.json

Reason for Change(s):

• Finalizing the solution before packaging it

Version Updated:

• No

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes

Required items, please complete

Change(s):

• Add WithSecure Elements via Connector data connector

Reason for Change(s):

• Add new data connector for WithSecure Elements solution

Version Updated:

• No

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes

Required items, please complete

Change(s):

• Fix Atlassian Confluence API parameter

Reason for Change(s):

• The audit API of confluence takes startDate and endData as a parameter. These two paramters should be in utc timestampe format but the current implementation passed a datetime string. And thus the function app is not retrieving any log from the API. See: https://developer.atlassian.com/cloud/confluence/rest/api-group-audit/#api-wiki-rest-api-audit-get

Version Updated:

• N/A

Testing Completed:

• Only tested in my personal environment

Checked that the validations are passing and have addressed any issues that are present:

• N/A

Before submitting this PR please ensure that you have read the following sections and then completed the template below:

Thank you for your contribution to the Microsoft Sentinel Github repo.

The code should have been tested in a Microsoft Sentinel environment that does not have any custom parsers, functions or tables, so that you validate no incorrect syntax and execution functions properly.

Details of the code changes in your submitted PR. Providing descriptions for pull requests ensures, there is context to changes being made and greatly enhances the code review process. Providing associated Issues that this resolves also easily connects the reason.

Change(s):

• Updated syntax for XYZ.yaml

Reason for Change(s):

• New schema used for XYZ.yaml
• Resolves ISSUE #1234

After the submission has been made, please look at the Validation Checks:

Check that the validations are passing and address any issues that are present. Let us know if you have tried fixing and need help.

References:

• Guidance for Detection checks
• General contribution guidance
• PR validation troubleshooting

PR Template

Description for the PR:

• Remove custom table, TrendMicro_XDR_CL.
• Add new custom table: TrendMicro_XDR_WORKBENCH_CL, TrendMicro_XDR_RCA_Task_CL, TrendMicro_XDR_RCA_Result_CL and TrendMicro_XDR_OAT_CL.
• Add new azure function with time and queue trigger for new custom table.

Testing Completed: Yes/ No : Yes

Fixes #

Proposed Changes

• Added Playbook
• Changed wizard and instructions in Data Connector as well as Solution deployment (Zip)
• The changes to the zip are already published in microsoft marketplace listing

Describe the bug

We are currently using the native NRT MFA Rejected by User analytics rule, which should only trigger on the last minute. However last night someone denied a MFA request, but this rule kept triggering every 5 minutes.

I'm not sure where else to report since we only have Basic support which does not include Sentinel..

To Reproduce Steps to reproduce the behavior:

1. Setup NRT MFA Rejected by User AAD analytics rule in Sentinel.
2. Have someone deny a MFA prompt
3. See 50 incidents popup

Expected behavior

Only the two, same events in all incidents:

Screenshots If applicable, add screenshots to help explain your problem.

Change(s):

• add Playbooks/Enrich-MalwareBazaar - https://bazaar.abuse.ch/api/

Reason for Change(s):

• Data Enrichment

Version Updated:

• N/A

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes

Change(s):

• add Playbooks/Enrich-CIRCL-Intezer-Analyze - https://www.intezer.com/blog/malware-analysis/intezer-analyze-free-community-edition /

Reason for Change(s):

• Data Enrichment

Version Updated:

• N/A

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes

Change(s):

• add playbook Enrich-CIRCL-hashlookup using https://circl.lu/services/hashlookup/

Reason for Change(s):

• Data enrichment

Version Updated:

• N/A

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes