created new rule for NRT Authentication Methods Changed for VIP Users by samikroy · Pull Request #4679 · Azure/Azure-Sentinel

samikroy · 2022-04-19T16:52:35Z

created new rule for NRT Authentication Methods Changed for VIP Users

samikroy · 2022-04-20T14:14:00Z

@vmanojreddy & @aprakash13 - Able to create rule in Sentinel.
Not sure if a column in watchlist is not getting recognized in build validation.
Request your help !

samikroy · 2022-05-06T04:44:33Z

@vmanojreddy & @aprakash13 - Could you please here !

Detections/AuditLogs/NRT_AuthenticationMethodsChangedforVIPUsers.yaml

aprakash13

Overall, the query looks good. Made a small suggestion that probably needs to be addressed.
Looking at the validation errors and will update.

v-marimanda · 2022-06-23T07:46:22Z

@aprakash13 Please take a look and provide your approve.

aprakash13

Thanks @samikroy. Sorry for the delay here. I will look into the validation errors and get that addressed before we can merge this.

samikroy · 2022-06-28T05:21:30Z

Thanks @samikroy. Sorry for the delay here. I will look into the validation errors and get that addressed before we can merge this.

Thank you for the update @aprakash13 . Please let me know for any changes needed.
My observation is that it is failing as the watch list is referred and assuming the same to be available as a built schema.

v-spadarthi · 2022-07-28T00:57:22Z

@aprakash13 :Please have a look for validation errors.

v-spadarthi · 2022-08-03T08:19:44Z

@aprakash13 :Please have a look for validation errors.

v-spadarthi · 2022-08-08T14:15:59Z

@aprakash13 :Please have a look for validation errors.

v-marimanda · 2022-09-01T08:55:47Z

@aprakash13 :Please have a look for validation errors.

v-marimanda · 2022-09-07T07:29:18Z

@hi @samikroy We wanted to check on the status of PR #4679. PR is pending from more long time. Let us know if any assistance is required for this PR. As Per our standard operating procedures if no response is received in the next 7 business days we will close this PR. Thank you for your cooperation.

samikroy · 2022-09-07T07:37:25Z

@hi @samikroy We wanted to check on the status of PR #4679. PR is pending from more long time. Let us know if any assistance is required for this PR. As Per our standard operating procedures if no response is received in the next 7 business days we will close this PR. Thank you for your cooperation.

Thank you for your response @v-marimanda.
Seems this need a revisit to the validation rules in the pipiline.
As have used watchlists in NRT rules which is supported.
https://docs.microsoft.com/en-us/azure/sentinel/near-real-time-rules#:~:text=%2C%20refer%20to%20multiple%20watchlists%20and%20to%20threat%20intelligence%20feeds.

v-mchatla · 2022-09-27T14:18:28Z

Hi @samikroy
Please address the suggestions provided by @oshezaf. If you have already addressed the comments, please request @oshezaf for re review your changes.
Thanks

samikroy · 2022-09-27T14:27:19Z

@oshezaf - Thank you for your suggestion & apologies for the delay in response.
Have update the query .
Request you to have a look
Thank you.

oshezaf

Approved at least as far as my comment goes.

samikroy · 2022-09-28T14:43:46Z

Approved at least as far as my comment goes.

Thank you @oshezaf .
@v-mchatla - Could you please help merge this rule.

v-mchatla · 2022-09-28T14:56:03Z

Hi @samikroy
All the checks need to be passed to merge the PR. Can you please fix the validation failures.

samikroy · 2022-09-28T16:15:08Z

Hi @samikroy All the checks need to be passed to merge the PR. Can you please fix the validation failures.

@v-mchatla - Please have a look at the history of this PR.
Have mentioned in the beginning about watchlist being scanned for schema.

Seems line #132 from this file causing the failure as schema validation is done in the first place before discounting it as a watchlist.
https://github.com/Azure/Azure-Sentinel/blob/master/.script/tests/KqlvalidationsTests/KqlValidationTests.cs

@aprakash13 have mentioned about addressing this earlier.

Do not see the source code for _queryValidator.ValidateSyntax to fix this further.
Please let me know for more inputs.
Thank you.

private void ValidateKql(string id, string queryStr)
        {
            var validationResult = _queryValidator.ValidateSyntax(queryStr);
            var firstErrorLocation = (Line: 0, Col: 0);
            if (!validationResult.IsValid)
            {
                firstErrorLocation = GetLocationInQuery(queryStr, validationResult.Diagnostics.First(d => d.Severity == "Error").Start);
            }

            var listOfDiagnostics = validationResult.Diagnostics;

            bool isQueryValid = !(from p in listOfDiagnostics
                               where !p.Message.Contains("_GetWatchlist") //We do not validate the getWatchList, since the result schema is not known
                               select p).Any();

v-mchatla · 2022-09-30T05:26:33Z

Hi @samikroy
We will look into it.
Thanks

v-mchatla · 2022-10-04T19:06:47Z

Hi @samikroy,
Can you please share the watchlist being used in the query.
Thanks

v-mchatla · 2022-10-07T05:07:33Z

Hi @samikroy,
Can you please share the watchlist being used in the query to resolve validation failures.
Thanks

v-spadarthi · 2022-10-11T06:13:49Z

Hi @samikroy,
Can you please share the watchlist being used in the query to resolve validation failures.
Thanks

samikroy · 2022-10-11T15:47:40Z

Hi @samikroy, Can you please share the watchlist being used in the query to resolve validation failures. Thanks

@v-mchatla & @v-spadarthi - Please refer this
https://learn.microsoft.com/en-us/azure/sentinel/watchlist-schemas?WT.mc_id=Portal-Microsoft_Azure_SentinelUS#vip-users

v-mchatla · 2022-10-14T06:00:02Z

Hi @samikroy,
Thanks for sharing the details. I have occupied with other work. I will work on it today and provide you the update.
Thanks

Applied small tweaks to run validations

v-mchatla · 2022-10-18T21:17:18Z

Hi @samikroy,
I have verified the watchlist and everything is working fine. Checking with my internal team on how to handle this KQL Validations
Thanks

v-mchatla · 2022-10-21T05:39:20Z

Hi @samikroy,
I'm already working with my internal team, will keep you posted.
Thanks

This reverts commit 7724501.

This reverts commit f0db6ea.

v-mchatla · 2022-10-25T10:33:23Z

Hi @samikroy,
To fix the validation error you need to add below details in .script\tests\KqlvalidationsTests\SkipValidationsTemplates.json
{ "id": "29e99017-e28d-47be-8b9a-c8c711f8a903", "templateName": "NRT_AuthenticationMethodsChangedforVIPUsers.yaml", "validationFailReason": "The name 'User Principal Name' does not refer to any known column, table, variable or function" }
Let me know if you need any details.
Thanks

v-mchatla · 2022-10-26T05:59:37Z

Hi @samikroy,
Please resolve the conflict and also accept license.
Thanks

v-mchatla · 2022-10-28T06:01:18Z

Hi @samikroy,
Please resolve the conflict and also accept license.
Thanks

v-mchatla

All the checks are passed now. Approving the PR.

created new rule for NRT Authentication Methods Changed for VIP Users

cb9e303

created new rule for NRT Authentication Methods Changed for VIP Users

samikroy requested review from aprakash13, ashwin-patil, juliango2100, oshezaf, petebryan, shainw, thmcelro and timbMSFT as code owners April 19, 2022 16:52

v-marimanda assigned aprakash13 Apr 20, 2022

v-marimanda added the Detection Detection specialty review needed label Apr 20, 2022

aprakash13 reviewed May 11, 2022

View reviewed changes

Detections/AuditLogs/NRT_AuthenticationMethodsChangedforVIPUsers.yaml Outdated Show resolved Hide resolved

aprakash13 suggested changes May 11, 2022

View reviewed changes

Update NRT_AuthenticationMethodsChangedforVIPUsers.yaml

f496a8a

aprakash13 previously approved these changes Jun 28, 2022

View reviewed changes

Update NRT_AuthenticationMethodsChangedforVIPUsers.yaml

c01315e

aprakash13 dismissed their stale review via c01315e July 12, 2022 13:33

aprakash13 requested review from a team as code owners July 12, 2022 13:33

Update NRT_AuthenticationMethodsChangedforVIPUsers.yaml

dea7c99

oshezaf previously approved these changes Sep 28, 2022

View reviewed changes

v-mchatla self-assigned this Sep 30, 2022

Applied small tweaks to run validations

5bd4d75

Applied small tweaks to run validations

v-mchatla dismissed oshezaf’s stale review via 5bd4d75 October 17, 2022 09:48

v-rucdu added 4 commits October 21, 2022 16:32

Fixed validation failure

f0db6ea

Resolved conflicts

7724501

Revert "Resolved conflicts"

9b3e41b

This reverts commit 7724501.

Revert "Fixed validation failure"

a6c9838

This reverts commit f0db6ea.

Update SkipValidationsTemplates.json

0d81416

Merge branch 'master' into patch-24

e91da45

v-mchatla approved these changes Nov 2, 2022

View reviewed changes

v-dvedak approved these changes Nov 2, 2022

View reviewed changes

v-dvedak merged commit bdf6ccd into Azure:master Nov 2, 2022

Conversation

samikroy commented Apr 19, 2022

Uh oh!

samikroy commented Apr 20, 2022

Uh oh!

samikroy commented May 6, 2022

Uh oh!

Uh oh!

aprakash13 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

v-marimanda commented Jun 23, 2022

Uh oh!

aprakash13 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

samikroy commented Jun 28, 2022

Uh oh!

v-spadarthi commented Jul 28, 2022

Uh oh!

v-spadarthi commented Aug 3, 2022

Uh oh!

v-spadarthi commented Aug 8, 2022

Uh oh!

v-marimanda commented Sep 1, 2022

Uh oh!

v-marimanda commented Sep 7, 2022

Uh oh!

samikroy commented Sep 7, 2022

Uh oh!

v-mchatla commented Sep 27, 2022

Uh oh!

samikroy commented Sep 27, 2022

Uh oh!

oshezaf left a comment

Choose a reason for hiding this comment

Uh oh!

samikroy commented Sep 28, 2022

Uh oh!

v-mchatla commented Sep 28, 2022

Uh oh!

samikroy commented Sep 28, 2022

Uh oh!

v-mchatla commented Sep 30, 2022

Uh oh!

v-mchatla commented Oct 4, 2022

Uh oh!

v-mchatla commented Oct 7, 2022

Uh oh!

v-spadarthi commented Oct 11, 2022

Uh oh!

samikroy commented Oct 11, 2022

Uh oh!

v-mchatla commented Oct 14, 2022

Uh oh!

v-mchatla commented Oct 18, 2022

Uh oh!

v-mchatla commented Oct 21, 2022

Uh oh!

v-mchatla commented Oct 25, 2022

Uh oh!

v-mchatla commented Oct 26, 2022

Uh oh!

v-mchatla commented Oct 28, 2022

Uh oh!

v-mchatla left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

aprakash13 left a comment •

edited

Loading

aprakash13 left a comment •

edited

Loading