forked from Azure/Azure-Sentinel
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add Samsung Solution Custom Table to KqlValidation
Add Samsung Knox's Sentinel Solution Custom tables to Azure Sentinel's KqlvalidationsTests Custom Tables list to help pass validation.
- Loading branch information
1 parent
830e380
commit e7e97f7
Showing
6 changed files
with
776 additions
and
0 deletions.
There are no files selected for viewing
76 changes: 76 additions & 0 deletions
76
.script/tests/KqlvalidationsTests/CustomTables/Samsung_Knox_Application_CL.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,76 @@ | ||
| { | ||
| "properties": { | ||
| "schema": { | ||
| "name": "Samsung_Knox_Application_CL", | ||
| "columns": [ | ||
| { | ||
| "name": "TimeGenerated", | ||
| "type": "DateTime", | ||
| "isDefaultDisplay": true, | ||
| "description": "The timestamp (UTC) reflecting the time in which the event was generated." | ||
| }, | ||
| { | ||
| "name": "PrimaryImei", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "DeviceImei1", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "DeviceImei2", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "DeviceSerialNumber", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "DeviceWifimac", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "DeviceModel", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "EventGuid", | ||
| "type": "long" | ||
| }, | ||
| { | ||
| "name": "Name", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "Version", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "Severity", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "MitreTtp", | ||
| "type": "dynamic" | ||
| }, | ||
| { | ||
| "name": "Profile", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "PkgName", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "AccessibilityApi", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "RestrictedPerms", | ||
| "type": "dynamic" | ||
| } | ||
| ] | ||
| }, | ||
| "plan": "Analytics" | ||
| } | ||
| } |
92 changes: 92 additions & 0 deletions
92
.script/tests/KqlvalidationsTests/CustomTables/Samsung_Knox_Audit_CL.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,92 @@ | ||
| { | ||
| "properties": { | ||
| "schema": { | ||
| "name": "Samsung_Knox_Audit_CL", | ||
| "columns": [ | ||
| { | ||
| "name": "TimeGenerated", | ||
| "type": "DateTime", | ||
| "isDefaultDisplay": true, | ||
| "description": "The timestamp (UTC) reflecting the time in which the event was generated." | ||
| }, | ||
| { | ||
| "name": "PrimaryImei", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "DeviceImei1", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "DeviceImei2", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "DeviceSerialNumber", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "DeviceWifimac", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "DeviceModel", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "EventGuid", | ||
| "type": "long" | ||
| }, | ||
| { | ||
| "name": "Name", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "Version", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "Severity", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "MitreTtp", | ||
| "type": "dynamic" | ||
| }, | ||
| { | ||
| "name": "Profile", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "UserId", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "AdmUserId", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "AdmPkgName", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "FailureReason", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "Action", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "KeyMask", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "PkgName", | ||
| "type": "string" | ||
| } | ||
| ] | ||
| }, | ||
| "plan": "Analytics" | ||
| } | ||
| } |
140 changes: 140 additions & 0 deletions
140
.script/tests/KqlvalidationsTests/CustomTables/Samsung_Knox_Network_CL.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,140 @@ | ||
| { | ||
| "properties": { | ||
| "schema": { | ||
| "name": "Samsung_Knox_Network_CL", | ||
| "columns": [ | ||
| { | ||
| "name": "TimeGenerated", | ||
| "type": "DateTime", | ||
| "isDefaultDisplay": true, | ||
| "description": "The timestamp (UTC) reflecting the time in which the event was generated." | ||
| }, | ||
| { | ||
| "name": "PrimaryImei", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "DeviceImei1", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "DeviceImei2", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "DeviceSerialNumber", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "DeviceWifimac", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "DeviceModel", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "EventGuid", | ||
| "type": "long" | ||
| }, | ||
| { | ||
| "name": "Name", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "Version", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "Severity", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "MitreTtp", | ||
| "type": "dynamic" | ||
| }, | ||
| { | ||
| "name": "Profile", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "Protocol", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "SourcePort", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "RemotePort", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "SourceAddr", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "RemoteAddr", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "EventDetectedTime", | ||
| "type": "DateTime" | ||
| }, | ||
| { | ||
| "name": "Family", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "PkgName", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "InterfaceName", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "Tid", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "Pid", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "Ppid", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "Uid", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "Gid", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "ExitCode", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "Syscall", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "Path", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "Ja3Fingerprint", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "SocketType", | ||
| "type": "int" | ||
| } | ||
| ] | ||
| }, | ||
| "plan": "Analytics" | ||
| } | ||
| } |
Oops, something went wrong.