Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[EntityQueries] - Adding EntityQueryKind to EntityQueries and changing Properties to Expansion properties #11776

Merged
merged 16 commits into from
Dec 1, 2020
Merged

[EntityQueries] - Adding EntityQueryKind to EntityQueries and changing Properties to Expansion properties #11776

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
6871b0f
update swagger - aading LogicAppResourceId to Action put and response
ori-licht Dec 4, 2019
605322b
update swagger - changing to logicAppResourceId style
ori-licht Dec 4, 2019
2ff5c6a
adding LogicAppResourceId to Actions Request & Response
ori-licht Jan 13, 2020
82f7546
adding LogicAppResourceId to Actions Request & Response
ori-licht Jan 13, 2020
e8cc415
Merge remote-tracking branch 'upstream/master'
ori-licht Jan 14, 2020
0667a60
adding Action property base
ori-licht Jan 14, 2020
1cdaece
editing examples and adding reauired to logicAppResourceId
ori-licht Jan 14, 2020
f116d97
from LogicAppResourceId to logicAppResourceId
ori-licht Jan 14, 2020
68e91a3
running prettier
ori-licht Jan 14, 2020
487ed36
running prettier
ori-licht Jan 14, 2020
157d2c7
removing required for LogicAppRexourceId
ori-licht Jan 22, 2020
c1fb9fb
changing logicApp propery doc
ori-licht Jan 26, 2020
d0e4501
changing logicApp propery description
ori-licht Jan 26, 2020
48290e5
merge from upstream
ori-licht Nov 19, 2020
f79939b
adding kind to entity queries and changing entityQueriesProperties to…
ori-licht Nov 22, 2020
6544fc4
changin return for entityQueryById
ori-licht Nov 22, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 49 additions & 7 deletions ...ource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2736,7 +2736,7 @@
"get": {
"x-ms-examples": {
"Get an entity query.": {
"$ref": "./examples/entityQueries/GetEntityQueryById.json"
"$ref": "./examples/entityQueries/GetExpansionEntityQueryById.json"
}
},
"tags": [
Expand Down Expand Up @@ -6383,21 +6383,63 @@
"value"
]
},
"EntityQueryKind": {
"description": "Describes an Entity query resource with kind.",
"properties": {
"kind": {
"description": "The kind of the entity query",
"enum": [
"Expansion"
],
"type": "string",
"x-ms-enum": {
"modelAsString": true,
"name": "EntityQueryKind",
"values": [
{
"value": "Expansion"
}
]
}
}
},
"required": [
"kind"
],
"type": "object"
},
"EntityQuery": {
"allOf": [
{
"$ref": "#/definitions/Resource"
"$ref": "#/definitions/ResourceWithEtag"
},
{
"$ref": "#/definitions/EntityQueryKind"
}
],
"description": "Specific entity query.",
"discriminator": "kind",
"type": "object",
"required": [
"kind"
]
},
"ExpansionEntityQuery": {
"description": "Represents Expansion entity query.",
"allOf": [
{
"$ref": "#/definitions/EntityQuery"
}
],
"properties": {
"properties": {
"$ref": "#/definitions/EntityQueryProperties",
"description": "Entity query properties",
"$ref": "#/definitions/ExpansionEntityQueriesProperties",
"description": "Expansion entity query properties",
"x-ms-client-flatten": true
}
},
"type": "object"
"type": "object",
"x-ms-discriminator-value": "Expansion"
},
"EntityTimelineKind": {
"description": "The entity query kind",
Expand Down Expand Up @@ -6446,8 +6488,8 @@
"value"
]
},
"EntityQueryProperties": {
"description": "Describes entity query properties",
"ExpansionEntityQueriesProperties": {
"description": "Describes expansion entity query properties",
"properties": {
"dataSources": {
"description": "List of the data sources that are required to run the query",
Expand Down
4 changes: 4 additions & 0 deletions ....SecurityInsights/preview/2019-01-01-preview/examples/entityQueries/GetEntityQueries.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,8 @@
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entityQueries/37ca3555-c135-4a73-a65e-9c1d00323f5d",
"name": "37ca3555-c135-4a73-a65e-9c1d00323f5d",
"type": "Microsoft.SecurityInsights/entityQueries",
"etag": null,
"kind": "Expansion",
"properties": {
"queryTemplate": "let AccountActivity_byIP = (v_IP_Address:string){\r\n AzureActivity\r\n | where Caller != '' and CallerIpAddress == v_IP_Address\r\n | summarize Account_Aux_StartTime = min(TimeGenerated), Account_Aux_EndTime = max(TimeGenerated), Count = count() by Caller, TenantId\r\n | top 10 by Count asc nulls last \r\n | extend UPN = iff(Caller contains '@', Caller, ''), Account_AadUserId = iff(Caller !contains '@', Caller,'')\r\n | extend Account_Name = split(UPN,'@')[0] , Account_UPNSuffix = split(UPN,'@')[1]\r\n | project Account_Name, Account_UPNSuffix, Account_AadUserId, Account_AadTenantId=TenantId, Account_Aux_StartTime , Account_Aux_EndTime};\r\n AccountActivity_byIP('<address>')",
"inputFields": [
Expand All @@ -33,6 +35,8 @@
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entityQueries/97a1d515-abf2-4231-9a35-985f9de0bb91",
"name": "97a1d515-abf2-4231-9a35-985f9de0bb91",
"type": "Microsoft.SecurityInsights/entityQueries",
"etag": null,
"kind": "Expansion",
"properties": {
"queryTemplate": "let AccountActivity_byIP = (v_IP_Address:string){\r\n AzureActivity\r\n | where Caller != '' and CallerIpAddress == v_IP_Address\r\n | summarize Account_Aux_StartTime = min(TimeGenerated), Account_Aux_EndTime = max(TimeGenerated), Count = count() by Caller, TenantId\r\n | top 10 by Count desc nulls last \r\n | extend UPN = iff(Caller contains '@', Caller, ''), Account_AadUserId = iff(Caller !contains '@', Caller,'')\r\n | extend Account_Name = split(UPN,'@')[0] , Account_UPNSuffix = split(UPN,'@')[1]\r\n | project Account_Name, Account_UPNSuffix, Account_AadUserId, Account_AadTenantId=TenantId, Account_Aux_StartTime , Account_Aux_EndTime};\r\n AccountActivity_byIP('<address>')",
"inputFields": [
Expand Down
2 changes: 2 additions & 0 deletions ...les/entityQueries/GetEntityQueryById.json → ...yQueries/GetExpansionEntityQueryById.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,8 @@
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entityQueries/07da3cc8-c8ad-4710-a44e-334cdcb7882b",
"name": "07da3cc8-c8ad-4710-a44e-334cdcb7882b",
"type": "Microsoft.SecurityInsights/entityQueries",
"etag": null,
"kind": "Expansion",
"properties": {
"queryTemplate": "let GetParentProcessesOnHost = (v_Host_HostName:string){\r\n SecurityEvent \r\n | where EventID == 4688 \r\n | where isnotempty(ParentProcessName)\r\n | where NewProcessName !contains ':\\\\Windows\\\\System32\\\\conhost.exe' and ParentProcessName !contains ':\\\\Windows\\\\System32\\\\conhost.exe'\r\n and NewProcessName !contains ':\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v2.0.50727\\\\csc.exe' and ParentProcessName !contains ':\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v2.0.50727\\\\csc.exe'\r\n and NewProcessName !contains ':\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v2.0.50727\\\\cvtres.exe' and ParentProcessName !contains ':\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v2.0.50727\\\\cvtres.exe'\r\n and NewProcessName!contains ':\\\\Program Files\\\\Microsoft Monitoring Agent\\\\Agent\\\\MonitoringHost.exe' and ParentProcessName !contains ':\\\\Program Files\\\\Microsoft Monitoring Agent\\\\Agent\\\\MonitoringHost.exe'\r\n and ParentProcessName !contains ':\\\\Windows\\\\CCM\\\\CcmExec.exe'\r\n | where(ParentProcessName !contains ':\\\\Windows\\\\System32\\\\svchost.exe' and (NewProcessName !contains ':\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe' or NewProcessName !contains ':\\\\Windows\\\\SysWOW64\\\\wbem\\\\WmiPrvSE.exe'))\r\n | where(ParentProcessName !contains ':\\\\Windows\\\\System32\\\\services.exe' and NewProcessName !contains ':\\\\Windows\\\\servicing\\\\TrustedInstaller.exe')\r\n | where toupper(Computer) contains v_Host_HostName or toupper(WorkstationName) contains v_Host_HostName\r\n | summarize min(TimeGenerated), max(TimeGenerated) by Account, Computer, ParentProcessName, NewProcessName, CommandLine, ProcessId\r\n | project min_TimeGenerated, max_TimeGenerated, Account, Computer, ParentProcessName, NewProcessName, CommandLine, ProcessId\r\n | project-rename Process_Host_UnstructuredName=Computer, Process_Account_UnstructuredName=Account, Process_CommandLine=CommandLine, Process_ProcessId=ProcessId, Process_ImageFile_FullPath=NewProcessName, Process_ParentProcess_ImageFile_FullPath=ParentProcessName\r\n | top 10 by min_TimeGenerated asc};\r\n GetParentProcessesOnHost(toupper('<hostName>'))",
"inputFields": [
Expand Down