diff --git a/Solutions/Microsoft 365/Package/3.0.1.zip b/Solutions/Microsoft 365/Package/3.0.1.zip index ba665e32b7c..f17905ef359 100644 Binary files a/Solutions/Microsoft 365/Package/3.0.1.zip and b/Solutions/Microsoft 365/Package/3.0.1.zip differ diff --git a/Solutions/Microsoft 365/Package/createUiDefinition.json b/Solutions/Microsoft 365/Package/createUiDefinition.json index 7bc6a7687f4..e5e0c32328a 100644 --- a/Solutions/Microsoft 365/Package/createUiDefinition.json +++ b/Solutions/Microsoft 365/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft 365/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution.\n\nThe Microsoft 365 solution for Microsoft Sentinel enables you to ingest operational logs from Microsoft 365 (formerly, Office 365) to gain insights into user and admin activity across your collaboration platforms such as Teams, SharePoint and Exchange.\r\n \r\n **Underlying Microsoft Technologies used:**\r\n\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\n**Data Connectors:** 1, **Workbooks:** 3, **Analytic Rules:** 14, **Hunting Queries:** 21\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20365/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution.\n\nThe Microsoft 365 solution for Microsoft Sentinel enables you to ingest operational logs from Microsoft 365 (formerly, Office 365) to gain insights into user and admin activity across your collaboration platforms such as Teams, SharePoint and Exchange.\r\n \r\n **Underlying Microsoft Technologies used:**\r\n\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\n**Data Connectors:** 1, **Workbooks:** 3, **Analytic Rules:** 14, **Hunting Queries:** 21\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", diff --git a/Solutions/Network Threat Protection Essentials/Package/3.0.0.zip b/Solutions/Network Threat Protection Essentials/Package/3.0.0.zip index c9c08596890..4ffa40052c2 100644 Binary files a/Solutions/Network Threat Protection Essentials/Package/3.0.0.zip and b/Solutions/Network Threat Protection Essentials/Package/3.0.0.zip differ diff --git a/Solutions/Network Threat Protection Essentials/Package/createUiDefinition.json b/Solutions/Network Threat Protection Essentials/Package/createUiDefinition.json index a523f0fbeef..485224e9fc1 100644 --- a/Solutions/Network Threat Protection Essentials/Package/createUiDefinition.json +++ b/Solutions/Network Threat Protection Essentials/Package/createUiDefinition.json @@ -138,7 +138,7 @@ "name": "huntingquery1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "There are several exploit and pen test frameworks that are being used by pen testers as well as attackers to \ncompromise an environment and achieve their objective. The query tries to detect suspicious user agent strings \nused by these frameworks in some of the data sources that contain UserAgent field. \nThis is based out of sigma rules described in references.\nReferences: https://github.com/Neo23x0/sigma/blob/master/rules/proxy/proxy_ua_frameworks.yml This hunting query depends on Office365 AWS AzureMonitor(IIS) data connector (OfficeActivity AWSCloudTrail W3CIISLog Parser or Table)" + "text": "There are several exploit and pen test frameworks that are being used by pen testers as well as attackers to \ncompromise an environment and achieve their objective. The query tries to detect suspicious user agent strings \nused by these frameworks in some of the data sources that contain UserAgent field. \nThis is based out of sigma rules described in references.\nReferences: https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_frameworks.yml This hunting query depends on Office365 AWS AzureMonitor(IIS) data connector (OfficeActivity AWSCloudTrail W3CIISLog Parser or Table)" } } ] diff --git a/Solutions/Network Threat Protection Essentials/Package/mainTemplate.json b/Solutions/Network Threat Protection Essentials/Package/mainTemplate.json index eb18c9ffe9c..ce4701490b3 100644 --- a/Solutions/Network Threat Protection Essentials/Package/mainTemplate.json +++ b/Solutions/Network Threat Protection Essentials/Package/mainTemplate.json @@ -98,7 +98,7 @@ "tags": [ { "name": "description", - "value": "There are several exploit and pen test frameworks that are being used by pen testers as well as attackers to \ncompromise an environment and achieve their objective. The query tries to detect suspicious user agent strings \nused by these frameworks in some of the data sources that contain UserAgent field. \nThis is based out of sigma rules described in references.\nReferences: https://github.com/Neo23x0/sigma/blob/master/rules/proxy/proxy_ua_frameworks.yml" + "value": "There are several exploit and pen test frameworks that are being used by pen testers as well as attackers to \ncompromise an environment and achieve their objective. The query tries to detect suspicious user agent strings \nused by these frameworks in some of the data sources that contain UserAgent field. \nThis is based out of sigma rules described in references.\nReferences: https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_frameworks.yml" }, { "name": "tactics", diff --git a/Solutions/Tanium/Package/3.0.0.zip b/Solutions/Tanium/Package/3.0.0.zip index 50e8980e39c..0b1f98e4f03 100644 Binary files a/Solutions/Tanium/Package/3.0.0.zip and b/Solutions/Tanium/Package/3.0.0.zip differ diff --git a/Solutions/Tanium/Package/createUiDefinition.json b/Solutions/Tanium/Package/createUiDefinition.json index 33f7f494a66..15cff38b9d8 100644 --- a/Solutions/Tanium/Package/createUiDefinition.json +++ b/Solutions/Tanium/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Tanium](https://www.tanium.com/) solution for Microsoft Sentinel enables you to ingest Tanium Threat Response alerts as Microsoft Sentinel incidents as well as incorporate Tanium's real-time endpoint data.\n\n**Workbooks:** 1, **Playbooks:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tanium/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution.\n\nThe [Tanium](https://www.tanium.com/) solution for Microsoft Sentinel enables you to ingest Tanium Threat Response alerts as Microsoft Sentinel incidents as well as incorporate Tanium's real-time endpoint data.\n\n**Workbooks:** 1, **Playbooks:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", diff --git a/Solutions/Tanium/ReleaseNotes.md b/Solutions/Tanium/ReleaseNotes.md new file mode 100644 index 00000000000..f9423d1bb9d --- /dev/null +++ b/Solutions/Tanium/ReleaseNotes.md @@ -0,0 +1,3 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|---------------------------------------------| +| 3.0.0 | 04-01-2024 | Fixed **Playbooks** as server response was breaking expected Schema|