From fdc4af36b7925ea99e0e85c17d73d9422e9e3aaf Mon Sep 17 00:00:00 2001 From: v-prasadboke Date: Wed, 12 Feb 2025 14:40:03 +0530 Subject: [PATCH 01/10] CCP connector added --- .../GCPFLoadBalancerLogs_DCR.json | 70 +++++++++ .../GCPFLoadBalancerLogs_Definition.json | 104 +++++++++++++ .../GCPFLoadBalancerLogs_PollingConfig.json | 29 ++++ .../GCPFLoadBalancerLogs_table.json | 144 ++++++++++++++++++ 4 files changed, 347 insertions(+) create mode 100644 Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_DCR.json create mode 100644 Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json create mode 100644 Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_PollingConfig.json create mode 100644 Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_table.json diff --git a/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_DCR.json b/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_DCR.json new file mode 100644 index 0000000000..6abe500aae --- /dev/null +++ b/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_DCR.json @@ -0,0 +1,70 @@ +[ + { + "name": "gcpLoadBalancerLogsDCR", + "apiVersion": "2021-09-01-preview", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "{{location}}", + "properties": { + "streamDeclarations": { + "Custom-GCPLoadBalancerStream": { + "columns": [ + { + "name": "insertId", + "type": "string" + }, + { + "name": "jsonPayload", + "type": "dynamic" + }, + { + "name": "logName", + "type": "string" + }, + { + "name": "receiveTimestamp", + "type": "Datetime" + }, + { + "name": "resource", + "type": "dynamic" + }, + { + "name": "timestamp", + "type": "Datetime" + }, + { + "name": "httpRequest", + "type": "dynamic" + }, + { + "name": "severity", + "type": "string" + } + ] + } + }, + "dataSources": {}, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "{{workspaceResourceId}}", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-GCPLoadBalancerStream" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | extend jsonPayload = parse_json(todynamic(jsonPayload)) | extend resourceLabel = todynamic(resource).labels | extend httpRequest = parse_json(httpRequest) | project TimeGenerated=todatetime(receiveTimestamp),Timestamp=todatetime(timestamp),LogName=tostring(logName),InsertId=tostring(insertId),BackendTargetProjectNumber=tostring(jsonPayload.backendTargetProjectNumber),CacheDecision=todynamic(jsonPayload.cacheDecision),EnforcedSecurityPolicy=todynamic(jsonPayload.enforcedSecurityPolicy),PreviewSecurityPolicy=todynamic(jsonPayload.previewSecurityPolicy),EnforcedEdgeSecurityPolicy=todynamic(jsonPayload.enforcedEdgeSecurityPolicy),PayloadRemoteIp=tostring(jsonPayload.remoteIp),SecurityPolicyRequestData=todynamic(jsonPayload.securityPolicyRequestData),PreviewEdgeSecurityPolicy=todynamic(jsonPayload.previewEdgeSecurityPolicy),StatusDetails=tostring(jsonPayload.statusDetails),Latency=tostring(httpRequest.latency),RemoteIp=tostring(httpRequest.remoteIp),RequestMethod=tostring(httpRequest.requestMethod),RequestSize=tostring(httpRequest.requestSize),RequestUrl=tostring(httpRequest.requestUrl),RequestStatus=tostring(httpRequest.status),UserAgent=tostring(httpRequest.userAgent),BackendServiceName=tostring(resourceLabel.backend_service_name),ForwardingRuleName=tostring(resourceLabel.forwarding_rule_name),ProjectId=tostring(resourceLabel.project_id),UrlMapName=tostring(resourceLabel.url_map_name),Zone=tostring(resourceLabel.zone),Severity=tostring(severity)", + "outputStream": "Custom-GCPLoadBalancerLogs_CL" + } + ], + "dataCollectionEndpointId": "{{dataCollectionEndpointId}}" + } + } +] \ No newline at end of file diff --git a/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json b/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json new file mode 100644 index 0000000000..fd64a2e343 --- /dev/null +++ b/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json @@ -0,0 +1,104 @@ +{ + "name": "GCPFLoadBalancerLogsCCPDefinition", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", + "location": "{{location}}", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "GCPFLoadBalancerLogsCCPDefinition", + "title": "GCP Pub/Sub LoadBalancer Logs Test", + "publisher": "Microsoft", + "descriptionMarkdown": "The Google Cloud Platform (GCP) LoadBalancer logs, enable you to capture network inbound and outbound activity to monitor access and detect potential threats across Google Cloud Platform (GCP) resources.", + "graphQueriesTableName": "GCPLoadBalancerLogs_CL", + "graphQueries": [ + { + "metricName": "Total events received", + "legend": "GCP Pub/Sub LoadBalancer Logs Test", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "Get Sample of GCP LoadBalancer Logs", + "query": "{{graphQueriesTableName}}\n | take 10" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true, + "action": false + } + } + ] + }, + "instructionSteps": [ + { + "instructions": [ + { + "type": "MarkdownControlEnvBased", + "parameters": { + "prodScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation).", + "govScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Gov Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov)." + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.", + "fillWith": [ + "TenantId" + ], + "name": "PoolId", + "disabled": true + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### 2. Enable LoadBalancer logs \nIn your GCP account, navigate to the LoadBalancer section. In here you can nevigate to [**Backend Service**] -> [**Edit**], once you are in the [**Backend Service**] on the [**Logging**] section **enable** the checkbox of [**Enable Logs**]. Once you open the rule, switch the toggle button under the **Logs** section to **On**, and save the changes.\n\nFor more information: [Link to documentation](https://cloud.google.com/load-balancing/docs/https/https-logging-monitoring)" + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### 3. Connect new collectors \n To enable GCP LoadBalancer Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect." + } + }, + { + "type": "GCPGrid", + "parameters": {} + }, + { + "type": "GCPContextPane", + "parameters": {} + } + ] + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_PollingConfig.json b/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_PollingConfig.json new file mode 100644 index 0000000000..7994ead62e --- /dev/null +++ b/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_PollingConfig.json @@ -0,0 +1,29 @@ +[ + { + "name": "GCPFirewallLogsTemplateConnections", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.SecurityInsights/dataConnectors", + "location": "{{location}}", + "kind": "GCP", + "properties": { + "connectorDefinitionName": "GCPFLoadBalancerLogsCCPDefinition", + "dcrConfig": { + "streamName": "Custom-GCPLoadBalancerStream", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "dataType": "GCPLoadBalancerLogs_CL", + "auth": { + "serviceAccountEmail": "{{GCPServiceAccountEmail}}", + "projectNumber": "{{GCPProjectNumber}}", + "workloadIdentityProviderId": "{{GCPWorkloadIdentityProviderId}}" + }, + "request": { + "projectId": "{{GCPProjectId}}", + "subscriptionNames": [ + "{{GCPSubscriptionName}}" + ] + } + } + } +] \ No newline at end of file diff --git a/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_table.json b/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_table.json new file mode 100644 index 0000000000..b2961ded14 --- /dev/null +++ b/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_table.json @@ -0,0 +1,144 @@ +[{ + "name": "GCPLoadBalancerLogs_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2021-03-01-privatepreview", + "tags": {}, + "properties": { + "schema": { + "name": "GCPLoadBalancerLogs_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "DateTime", + "description": "The time the log entry was received by logging." + }, + { + "name": "BackendTargetProjectNumber", + "type": "String", + "description": "The Backend Service Project Number." + }, + { + "name": "CacheDecision", + "type": "Dynamic", + "description": "Indicates whether a request was served from the cache or the backend." + }, + { + "name": "EnforcedSecurityPolicy", + "type": "Dynamic", + "description": "Indicates whether a security policy (such as a WAF or access control rules) was applied to a request." + }, + { + "name": "PreviewSecurityPolicy", + "type": "Dynamic", + "description": "Request matches a rule configured for preview (present only when a preview rule would have taken priority over the enforced rule)." + }, + { + "name": "EnforcedEdgeSecurityPolicy", + "type": "Dynamic", + "description": "the edge security policy rule that was enforced." + }, + { + "name": "PreviewEdgeSecurityPolicy", + "type": "Dynamic", + "description": "populated if a request matches an edge security policy rule configured for preview." + }, + { + "name": "PayloadRemoteIp", + "type": "String", + "description": "The remote ip address of the payload." + }, + { + "name": "SecurityPolicyRequestData", + "type": "Dynamic", + "description": "The security policy data of the request." + }, + { + "name": "StatusDetails", + "type": "String", + "description": "The status details of the request." + }, + { + "name": "Latency", + "type": "String", + "description": "The latency of the request." + }, + { + "name": "RemoteIp", + "type": "String", + "description": "The remote ip of the request." + }, + { + "name": "RequestMethod", + "type": "String", + "description": "The http method of the request." + }, + { + "name": "RequestSize", + "type": "String", + "description": "The size of the request." + }, + { + "name": "RequestUrl", + "type": "String", + "description": "The url of the request." + }, + { + "name": "RequestStatus", + "type": "String", + "description": "The status code of the request." + }, + { + "name": "UserAgent", + "type": "String", + "description": "The user agent of the request." + }, + { + "name": "BackendServiceName", + "type": "String", + "description": "The backend service name in Google Cloud Platform ." + }, + { + "name": "ForwardingRuleName", + "type": "String", + "description": "The forwarding rule resource of the load balancer in Google Cloud Platform." + }, + { + "name": "ProjectId", + "type": "String", + "description": "The Project id in Google Cloud Platform" + }, + { + "name": "UrlMapName", + "type": "String", + "description": "The url map resource name in Google Cloud Platform.", + "dataTypeHint": "URI" + }, + { + "name": "Zone", + "type": "String", + "description": "The Zone name of the Load Balancer." + }, + { + "name": "Severity", + "type": "String", + "description": "The severity of the incident." + }, + { + "name": "LogName", + "type": "String", + "description": "Information including a suffix identifying the log sub-type (e.g., admin activity, system access, data access) and where in the hierarchy the request was made." + }, + { + "name": "Timestamp", + "type": "DateTime", + "description": "The time the event described by the log entry occurred." + }, + { + "name": "InsertId", + "type": "String", + "description": "Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result." + } + ] + } + } +}] \ No newline at end of file From b62e1d9e5dd515c90c32904cf7a300df95073572 Mon Sep 17 00:00:00 2001 From: v-prasadboke Date: Wed, 12 Feb 2025 14:40:20 +0530 Subject: [PATCH 02/10] input file and solution metadata added --- .../Data/Solution_GCPWAF.json | 16 ++++++++++++++++ .../SolutionMetadata.json | 15 +++++++++++++++ 2 files changed, 31 insertions(+) create mode 100644 Solutions/Google Cloud Platform WAF/Data/Solution_GCPWAF.json create mode 100644 Solutions/Google Cloud Platform WAF/SolutionMetadata.json diff --git a/Solutions/Google Cloud Platform WAF/Data/Solution_GCPWAF.json b/Solutions/Google Cloud Platform WAF/Data/Solution_GCPWAF.json new file mode 100644 index 0000000000..1c005008d7 --- /dev/null +++ b/Solutions/Google Cloud Platform WAF/Data/Solution_GCPWAF.json @@ -0,0 +1,16 @@ +{ + "Name": "Google Cloud Platform WAF", + "Author": "Microsoft - support@microsoft.com", + "Logo": "", + "Description": "The GCP WAF data connector allows you to seamlessly ingest and monitor logs from Google Cloud Platform's Web Application Firewall into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP WAF logs, enabling proactive threat detection and response.", + "Data Connectors": [ + "Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json" + ], + "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Google Cloud Platform WAF\\", + "Version": "3.0.0", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "StaticDataConnectorIds": [ + "WAF" + ] +} \ No newline at end of file diff --git a/Solutions/Google Cloud Platform WAF/SolutionMetadata.json b/Solutions/Google Cloud Platform WAF/SolutionMetadata.json new file mode 100644 index 0000000000..fd9104ecb8 --- /dev/null +++ b/Solutions/Google Cloud Platform WAF/SolutionMetadata.json @@ -0,0 +1,15 @@ +{ + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-solution-gcploadbalancerlogs-api", + "firstPublishDate": "2025-02-12", + "providers": [ "Microsoft" ], + "categories": { + "domains": [ "Security - Network" ] + }, + "support": { + "tier": "Microsoft", + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "link": "https://support.microsoft.com/" + } +} \ No newline at end of file From 414290f8fdc3e0cd96cc09bc7677592cefb73e6e Mon Sep 17 00:00:00 2001 From: v-prasadboke Date: Wed, 12 Feb 2025 14:40:30 +0530 Subject: [PATCH 03/10] Solution packaged --- .../Package/3.0.0.zip | Bin 0 -> 7946 bytes .../Package/createUiDefinition.json | 85 ++ .../Package/mainTemplate.json | 768 ++++++++++++++++++ .../Package/testParameters.json | 38 + 4 files changed, 891 insertions(+) create mode 100644 Solutions/Google Cloud Platform WAF/Package/3.0.0.zip create mode 100644 Solutions/Google Cloud Platform WAF/Package/createUiDefinition.json create mode 100644 Solutions/Google Cloud Platform WAF/Package/mainTemplate.json create mode 100644 Solutions/Google Cloud Platform WAF/Package/testParameters.json diff --git a/Solutions/Google Cloud Platform WAF/Package/3.0.0.zip b/Solutions/Google Cloud Platform WAF/Package/3.0.0.zip new file mode 100644 index 0000000000000000000000000000000000000000..bed2183b883b032c0ded3b46a4ce013fc11507d2 GIT binary patch literal 7946 zcmZ{pMNk|7v#ker5AN<7+#$Hj;O_43?(P!Y2^Ju@`vAd%!{F{3oSS<$@4f%k?Ot?s zFS@IG^HrUrA`b=q1polR13cXobbm*e=qAAe04Ep#0Per3nX83~yM>00goUMzqm8?b zlOv0*o0DUU*1O|6H~ME#KX_-`;U_Uj4byl9y_Q(5atg6bFWC|$k{8eVgvqT~BB5-z z(;!4>lEgu|N#Jxy?cCfT1VYj_X6*HC^GfMTW=cl_#EPaqZfA!t9Ms=QlT11~teh@o+ zcU?IMDY)h<;Ei`*008th#KY~+U75{F@?X^&hZ)%)lV`Hx_?=NO7@Ul z9Q~;lx5n*!>D_=S0}%gvEuQs?N#0W{U1M7YpXZi35O}Pg1fT9k&{d zaTj8UvzOPIzU@KUUtaLbxY{R{>W`Lx!VMzcob#s1xG{R`GggoPNIx&`d;m{4ia%#E zocHymL>dx}BwE;=7=Nd-`@x>C9bnRjD%8^Bwf9avFu>V3ta`|9V9Gd{+u`P-*Jjm+ zkEs;7go=*KZVSpHCHO&nS-1J!+Kk(zwU3^sG!xPtDZvW?d?qrhL`hCJ)X_dm_0ay3 zBW|~t3oNrHMn5HA_=8I&|IqrAjX#WmYa0tnQ8yB&-WhdFve=x-U(8S@jFCfZO~!AX zXVzRe+^QUiDwB@X!3$o2Qk}SE3E<8+RCeoX!8CJ8^_-!*6YTffa+?xQ^-#@<)~G5DtjC#8fMgo*FMrf80K2Ez5iHiE_pcXRQcSMAU3=7G;hcU)y$Oz`s( z%<_oA-4Oyd2l@;+e-Zu?8;FuS3=V3@dtdwG%Rs=chh?Lw$ezwqQCJQWI@P5{jHg;NThumt%@akE|T?JxNELp z>LFCcd2;%q-^1RH_xTD81ihDXqFMVvwqHMgTU_sCx@@=0$!?MZ}F#caFsWz5S^xzr%wy>g|^r_4$_XdSXIFBI#uu~R^lU8pZK#z+-vH3 z+ZB(?^I;qZBvQ?oPoX5MLR=^2eyMQr2(oe?>Urf*`n{d;{fa3bE8M(r zao!Y+_oetQJH{bU%N4eMl>RZ>7X(oGe;BsEONSWn4_?3W0DylO12~x2I07vkobCUS z?0@KWA!O&aA?3QIp7F^xA|I>2BrNfq_ov!k!&)v=XDLj2zEX|~TL=l+%Vijn4VFxD z^2dbJxbh^c>|eoP2)3}1P$W6N7%kege!)&Z-%h_yKLXN^=R)|^XWUEX)!0ix3V}%` z`KQuV1>u}}YYANYkrI2kpc!@UhusX{F)K7uqBo1%?U^(!Hlr0m zM=tl3`Hk8Aaiz%M_k?o6Xv(}J;}^hZCAdLbDj=5}n)Dh%u*9b|UfuqM;(9)NEDJve zy?|CW&+@Zzeg>V4FFM;Yg3S5c11HJ{HZ4T~LV{&4T`+D>5(HAkI}+v#8M}6tG$j3K z5BuhyK1;<}{_j0@{aB+UBR3P$*KA#icuJ$qoY6Q0s1kJ11<>-(&~bPd_K)EUR$QiaoKRB^K6 ze6*YficRN;)&pN}&)m4i_wDhIibX=|(@0nLX>(r;kv9YLF>iBI$ae8dg%jnPs44rv z!zb9vRbw;+zm3MHIIc6Pwuh~3oKe&bD{kaCg92q@QA0bQ?o>Z05Kv?|qt2za_{n)_ zmI;kzvz?v(rZYol4NKgz?c}=LuQ_u-jGBS4L6Xshus9@9zlXLw$EcUjFHZkt24*Z^S$X5xhJEFt@FtiTcd5fV^5`Zm3#!Q%XCS*D`r;S-*Fpyk)_$F_MW8@+d zj0TV2H5(g=(PyXHLP;W+obh5Df;PN`d8DtxG-Z5R$I{q>gA(Qd1Axb~ONF1~723I! zDg9R=#pJj3HUzUiAcYt>4q^BM1qboJCDwl{@GP9P1UH!H);eZiEl^}g_Q;`#1< zSF_t*tAZU9?!_XAW&Bm%n|mxm+j(NXGr(Q>kr&B%t4%P9BwQ>zo2P+lOQF%r&d&IF zQ@ty&sM@^K*w?0)dZ{ren%GaqDVXT}Q`^#C^IV}>oePGW0> zV1a*Ez?VdxiEm>YxxN|&^{MBNi*HwK-;X0(Pr#Q^NtzJl@r!Akk8WrnOEuNVk4C+VJlk*S^{i^ii-WHwS6@*B61|MfMYkA5~4eHZFV!rYe(_sSkqwgvpVTTYN8 z($f#BRT-Iq+3DW$=sJ4aA9{VdN)Bz$D~CDmv?*e#P?66nmcNXmjNLs*<({ zNf&ovuy&xQ$^g! zI+a?N_IK?79d;=n=$rYUd3Oc_Vf; zWao12C%Pk@Zp1+8RGr+8$BJ=NOt29o;GIKzWnFBte+y(>o5lqiBoSDWpe~Gph{95~ z@E}S^2wOnPHGIBFAba5Br9Y2K77Dfl!oVjXm<>`;F?S@mx#M|rjvE_=HB%2|Kt_!V zPE!`DJO$-houaWh*N4ZN3*SgifAHwy^#z-xAA*-fG=(wVL%uKcFQ^xe;TwkVRV#{TeW&>yc=m@ zidPYb^ujjH3&+)YoGGVkDX{j!h==6r!4PTmd|Qms)D0}4E58^mfkCU*^7x$24E>%~ zvn`TBbIC`9?EIwe4k`tEC#2I#eY?K-nq1j;AU5G2C0;d9GrE-8aV_5Bc}RkXvH9ID zTB);EW-h9ve`Y?f1v#OBhf2IMQ~2pbfLk(xS)#$s?ANu~WSke_IXiMsSqEUB$xN2j z#5R6zzRx562TH91EoaXHuRnpoCxE|2(jyMss-4@#-mX6#emjKl2`#d3jF@O2ZBK3O zUM~LGc+4-e2al!zEpZhT%H9e&l*M$?f($eWHKOl@NQ$#IjCAQ|MXNXN2of~e3Vk?) zQXZDwPLLfbPMpIalJ6Nxh%+>E{#BX}d#H~&R{YShrf-TfJ%0v(#4x@NVb4zaPNt{H z&5Rd;B&sY1-6;i=t)N{IeZVKL&R{RX1wk7{I|h?I7R9>V$4N<|n{V$?$7+y`_Sb$n|*AMd@h#;?au^K;d9gjNv# zM39zsYn1veuoH_Q5q9N#Ottzt{SogQ)hoZYF(#zFX^N?d=RQX|2lcE5k?5@a4up|p z?fHXc&?lVp#b6APu?i zc?fqRM^2(Tyfhjy`$EL^1UyE}S`bCpc<={u=S_|^(m34T=Agk#kXc(j&K&c3byzdTv%|1_TaazhQyi`69tui`h40MqQePW zVVv1sxG2JeY|gG>(5xuLJ3ATQy7)2{ryM6=M!S&in*#1|I zP}PFj&#H*TpIY&yzTK@>QbW1kqXWh_@f7sc()tj`+L0f^KG6%U1mLhCEw@C_^n@_s}H^@4|+Q51| z_m$@BF8X0&e-*R^T4`U|;zxutl@T285#Mc+Fu?~0NaQC$#t}EM$t$t+}m4AX{+V)?(Tz81m zJ$`@|VJDjpk9CU z%p*`F6ElU8gbkFPhbZ?ctsY6>0;4OP-|Q8o+Ii-kWtv47ych+$Wq~y{yKt+4np7DY z<_*+t%N9AIq(t4&cIHgyhr1>6q*#L)`%c03HuLq@4;(%_4?~19*nOpuUaC*h@R58j zo=50Kk2V@C7rv7NEcNl>YZRTd4z!tWZ%pMF(oVB8eX@31VDy);=)Eds{^yK4TFcZhm$Mo6CW4+Ms-p)Ydr z7mFD~*7|R@+>GJ-)^GZ!T;4VH1ay)-1f-1eMgHXuVRPDiK{GapHxpP0OOyUwRyM0^ zWV7y<_96tNs?IQB7GH`So_aF+)o1L#5{O7D7mWD_WQ)WMICz~MPu3<#n`PY1+aMo& zt41r{@jhi;k^0Fg01#}NqSq5EnRPLxHU9xl99_JOmA{VP&d%*x!%aVqk0^;miTRph ze-GXLO$>BF=iH3IM#g4ARiWm9QW2F;VVF3o_#=Bt?nf0ZD_-7FfRcn+|ta_Df4W3WLjM{>vX9OMACD_0$dt^InA2G z+a==Rd?@B4DOh_k!eM4*yDxdEnX-$Gu;rmHV}UGUPTqmR)(Y0IyW{NEo|8cNFmlnRn@x^GkPjvMgG>g2`I12M!!}wcfm1sHR#{qv#?bxgXzq_cGVg5Sus%}wk6<30!3V-5TKNh`EvMzEB{I~@LDCUrog%Z)f`974bAX*MdP1oerdflPv zb70pz9Ae?dw7VxKSzrY z?LO2=34^XhIiecAn1LewxQ+Y!cWAa3yqYn>IL3yk13HrKSdkBm zx=pjDJ08lIo?@IEJS1YgaRsb8f@?I8*_<%p-niCPWQE2hwKNCi86zu_jJ}=Lwm2fc z5|&Kn!J0F~%zA|H7#$(?<*X(;vTD?oZCr~F3-y=h zEm_3hBj?lsRkf(4kYv?L@IYgG+dHQq#b`<(nfmZx~>bDEr?mtI}C zGNyh%XD2&yr#Tdco}U|Q+fQHWD~gw(M`^#%;t^$3u-cR5{VA?)@29kl7DKFl=YM>} zaNxgy75{brEDP08m0yvm1}))U$3zPg`7=6W*@djTMVah6U&bMb5@&i2qMY(cb5hdY zVm*_Qa)j%$uwR~DR742O&o}#50G-^~I;Pvy%>5+9NT%rq-SWLt^mX%B1c9L$mgo;6 zLu!Kl-v(Lt^MpxzaxA^LhvJ99q_lnA$l$XY)wU;cA|Mr?+4jU zAyTZs$*-+yfd!3%YakIRiWZ~Ip{$rsc~Eg#bz3(VS32)fL)A>H@;K@V|N8AotSNy+ zYqq?Vz!aWA7PGxOIMcfQ7ahP&p(AvI*H zs`ZEkji(9ADQ(zWvHdH?PuE4^i=377Dpx&C$hUX~F9(%IyA?Tucck|gtwYkb?CLdi`#QnJ>fQ7Q$b(D< z1r(sp4=u^+#EdfTYOBSEb#>@1)Ad2igI#BgB3#d&0p+w~ErY@t`TW>$ zPrBnLNcH>oEujmzh6B}m4~3q^e~QJ`c~tLLHOx7K_EF9y<$(h^3sQla9_pt)>PFfpR**ehx^J_*0RUS#5Y19 z(VAm9d0XK$EgAPO}TV;f-tAYO01F2%cAw5#) zkrBvUech~TQ8>l;0-Uv}*t-4Eb(h}Z92#(s*7onMc8OfU5;+|Rs5^RL$y^v*q1?M|v-iF&g-`xvyM zhHzk7a8*SC5~r27VMTGJ-d0F-+>D4M4VoQvdSuw<0h}p#q<9XeVS(;xG?}FN4(u4~ z!UNi+#$yfme^suT0RgdB!r;xMVzyUZJ|DJE*sEqDy}GmwO?8jWoT;S)yJB-B)m|LA z56*~GLjDSaE>xP>ahAhuarB+YNb)tNmuz!;@h%TzH$lPf!mA5ZT?)Kom&&9w?s!n( z)|^9IWjsZqZ|0I~LZUfc<;X*Y_#kBZ=G-6fm_}bf9s80;iSF`r%d*GIp=C>9xVHPk zrf+ORv8hOH7vm;v%Yuhn`vm!#(5&KmbsOK0SLZIV2tSXl30d}tJgD&9^i!z`g%+_$ zr|NMFohV%^0aK%^>-(;uH1G~)(x&hFHFwe@dyrV0_a%wktkQ8{N;nwTGLPl_j2n^L z)c+l)0WR}5mKa#C`+sy1^=CCr|eRi$hifOyowSVJPG`?qj^JJ0ND7`iH z#|VHGCSd@&Z6AJXX@9&~;DhqM`Cy#scVED@;~E-d8{ccgK>q0ad>7dVW`1%ICSTF% z49;%#ZJwlQRb@e{A;RE)KI}k=$vidCP`@D#=jC&R!0wJ#GJal6n>~a_|GRO#hgf^G zi#ZqzhK$4^JHh7t^hxQgn%mLBDEli4$#+biE&e9CU&sqZ(`|)rqk=0%UY>-N07;bf zJ=~D%M1Z;f3vNOGO;pBlI*;sySpc7gf&H$r-+<-O4s$$Imtr8I=9VGm7UY+lGEL2m zgMF^=Y2RusY5!u*Me@hPmh$L0%LRhM(CzwSS{%6nqr=GF(;hhJ!K#Llko3^02I!T; zGWj;VKCbTk1MA|wgD?=OS?L}(4mw+ePF^m&R`7}8W%4=IWeln~Fg4Jd#uTc=disN0 zw&7Sh7C>{^k)L{+oIou%6XFpC<9>*yHmc#SJD?$SeZLTka5AWbnmdbBpXpGVk7{QG zX%T6Ju>Y0pA~V~{6$N}040p>BN9BDpE~W3iM?v@qJx=3TwUh7gyI2Ev9vxrb&AFMH z4VN)T#>p2LaA50f_DP!VV6ZMa+zYFg;ODi~36NzG?$G1BDiHQ2rKQ<0oL&{X6hAin_qcgOjkVE=!` p|KdOY=aT=F{Qu8};eTfK|7QTG$iw^_0|1c!GW=h4Ci(B~zW|mZAe8_B literal 0 HcmV?d00001 diff --git a/Solutions/Google Cloud Platform WAF/Package/createUiDefinition.json b/Solutions/Google Cloud Platform WAF/Package/createUiDefinition.json new file mode 100644 index 0000000000..01991538d8 --- /dev/null +++ b/Solutions/Google Cloud Platform WAF/Package/createUiDefinition.json @@ -0,0 +1,85 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#", + "handler": "Microsoft.Azure.CreateUIDef", + "version": "0.1.2-preview", + "parameters": { + "config": { + "isWizard": false, + "basics": { + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Google%20Cloud%20Platform%20WAF/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe GCP WAF data connector allows you to seamlessly ingest and monitor logs from Google Cloud Platform's Web Application Firewall into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP WAF logs, enabling proactive threat detection and response.\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "subscription": { + "resourceProviders": [ + "Microsoft.OperationsManagement/solutions", + "Microsoft.OperationalInsights/workspaces/providers/alertRules", + "Microsoft.Insights/workbooks", + "Microsoft.Logic/workflows" + ] + }, + "location": { + "metadata": { + "hidden": "Hiding location, we get it from the log analytics workspace" + }, + "visible": false + }, + "resourceGroup": { + "allowExisting": true + } + } + }, + "basics": [ + { + "name": "getLAWorkspace", + "type": "Microsoft.Solutions.ArmApiControl", + "toolTip": "This filters by workspaces that exist in the Resource Group selected", + "condition": "[greater(length(resourceGroup().name),0)]", + "request": { + "method": "GET", + "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]" + } + }, + { + "name": "workspace", + "type": "Microsoft.Common.DropDown", + "label": "Workspace", + "placeholder": "Select a workspace", + "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected", + "constraints": { + "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]", + "required": true + }, + "visible": true + } + ], + "steps": [ + { + "name": "dataconnectors", + "label": "Data Connectors", + "bladeTitle": "Data Connectors", + "elements": [ + { + "name": "dataconnectors1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Solution installs the data connector for Google Cloud Platform WAF. You can get Google Cloud Platform WAF data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + } + }, + { + "name": "dataconnectors-link1", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more about connecting data sources", + "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources" + } + } + } + ] + } + ], + "outputs": { + "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", + "location": "[location()]", + "workspace": "[basics('workspace')]" + } + } +} diff --git a/Solutions/Google Cloud Platform WAF/Package/mainTemplate.json b/Solutions/Google Cloud Platform WAF/Package/mainTemplate.json new file mode 100644 index 0000000000..1a3786ee75 --- /dev/null +++ b/Solutions/Google Cloud Platform WAF/Package/mainTemplate.json @@ -0,0 +1,768 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "author": "Microsoft - support@microsoft.com", + "comments": "Solution template for Google Cloud Platform WAF" + }, + "parameters": { + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } + } + }, + "variables": { + "email": "support@microsoft.com", + "_email": "[variables('email')]", + "_solutionName": "Google Cloud Platform WAF", + "_solutionVersion": "3.0.0", + "solutionId": "azuresentinel.azure-sentinel-solution-gcploadbalancerlogs-api", + "_solutionId": "[variables('solutionId')]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "dataConnectorCCPVersion": "1.0.0", + "_dataConnectorContentIdConnectorDefinition1": "GCPFLoadBalancerLogsCCPDefinition", + "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]", + "_dataConnectorContentIdConnections1": "GCPFLoadBalancerLogsCCPDefinitionConnections", + "dataConnectorTemplateNameConnections1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections1')))]", + "dataCollectionEndpointId1": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]", + "blanks": "[replace('b', 'b', '')]", + "TemplateEmptyObject": "[json('{}')]", + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition1'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", + "displayName": "GCP Pub/Sub LoadBalancer Logs Test", + "contentKind": "DataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "GCPFLoadBalancerLogsCCPDefinition", + "title": "GCP Pub/Sub LoadBalancer Logs Test", + "publisher": "Microsoft", + "descriptionMarkdown": "The Google Cloud Platform (GCP) LoadBalancer logs, enable you to capture network inbound and outbound activity to monitor access and detect potential threats across Google Cloud Platform (GCP) resources.", + "graphQueriesTableName": "GCPLoadBalancerLogs_CL", + "graphQueries": [ + { + "metricName": "Total events received", + "legend": "GCP Pub/Sub LoadBalancer Logs Test", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "Get Sample of GCP LoadBalancer Logs", + "query": "{{graphQueriesTableName}}\n | take 10" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true, + "action": false + } + } + ] + }, + "instructionSteps": [ + { + "instructions": [ + { + "type": "MarkdownControlEnvBased", + "parameters": { + "prodScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation).", + "govScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Gov Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov)." + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.", + "fillWith": [ + "TenantId" + ], + "name": "PoolId", + "disabled": true + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### 2. Enable LoadBalancer logs \nIn your GCP account, navigate to the LoadBalancer section. In here you can nevigate to [**Backend Service**] -> [**Edit**], once you are in the [**Backend Service**] on the [**Logging**] section **enable** the checkbox of [**Enable Logs**]. Once you open the rule, switch the toggle button under the **Logs** section to **On**, and save the changes.\n\nFor more information: [Link to documentation](https://cloud.google.com/load-balancing/docs/https/https-logging-monitoring)" + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### 3. Connect new collectors \n To enable GCP LoadBalancer Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect." + } + }, + { + "type": "GCPGrid", + "parameters": {} + }, + { + "type": "GCPContextPane", + "parameters": {} + } + ] + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "tier": "Microsoft", + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "link": "https://support.microsoft.com/" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "name": "gcpLoadBalancerLogsDCR", + "apiVersion": "2022-06-01", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "[parameters('workspace-location')]", + "kind": "[variables('blanks')]", + "properties": { + "streamDeclarations": { + "Custom-GCPLoadBalancerStream": { + "columns": [ + { + "name": "insertId", + "type": "string" + }, + { + "name": "jsonPayload", + "type": "dynamic" + }, + { + "name": "logName", + "type": "string" + }, + { + "name": "receiveTimestamp", + "type": "Datetime" + }, + { + "name": "resource", + "type": "dynamic" + }, + { + "name": "timestamp", + "type": "Datetime" + }, + { + "name": "httpRequest", + "type": "dynamic" + }, + { + "name": "severity", + "type": "string" + } + ] + } + }, + "dataSources": "[variables('TemplateEmptyObject')]", + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "[variables('workspaceResourceId')]", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-GCPLoadBalancerStream" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | extend jsonPayload = parse_json(todynamic(jsonPayload)) | extend resourceLabel = todynamic(resource).labels | extend httpRequest = parse_json(httpRequest) | project TimeGenerated=todatetime(receiveTimestamp),Timestamp=todatetime(timestamp),LogName=tostring(logName),InsertId=tostring(insertId),BackendTargetProjectNumber=tostring(jsonPayload.backendTargetProjectNumber),CacheDecision=todynamic(jsonPayload.cacheDecision),EnforcedSecurityPolicy=todynamic(jsonPayload.enforcedSecurityPolicy),PreviewSecurityPolicy=todynamic(jsonPayload.previewSecurityPolicy),EnforcedEdgeSecurityPolicy=todynamic(jsonPayload.enforcedEdgeSecurityPolicy),PayloadRemoteIp=tostring(jsonPayload.remoteIp),SecurityPolicyRequestData=todynamic(jsonPayload.securityPolicyRequestData),PreviewEdgeSecurityPolicy=todynamic(jsonPayload.previewEdgeSecurityPolicy),StatusDetails=tostring(jsonPayload.statusDetails),Latency=tostring(httpRequest.latency),RemoteIp=tostring(httpRequest.remoteIp),RequestMethod=tostring(httpRequest.requestMethod),RequestSize=tostring(httpRequest.requestSize),RequestUrl=tostring(httpRequest.requestUrl),RequestStatus=tostring(httpRequest.status),UserAgent=tostring(httpRequest.userAgent),BackendServiceName=tostring(resourceLabel.backend_service_name),ForwardingRuleName=tostring(resourceLabel.forwarding_rule_name),ProjectId=tostring(resourceLabel.project_id),UrlMapName=tostring(resourceLabel.url_map_name),Zone=tostring(resourceLabel.zone),Severity=tostring(severity)", + "outputStream": "Custom-GCPLoadBalancerLogs_CL" + } + ], + "dataCollectionEndpointId": "[variables('dataCollectionEndpointId1')]" + } + }, + { + "name": "GCPLoadBalancerLogs_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "schema": { + "name": "GCPLoadBalancerLogs_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "DateTime", + "description": "The time the log entry was received by logging." + }, + { + "name": "BackendTargetProjectNumber", + "type": "String", + "description": "The Backend Service Project Number." + }, + { + "name": "CacheDecision", + "type": "Dynamic", + "description": "Indicates whether a request was served from the cache or the backend." + }, + { + "name": "EnforcedSecurityPolicy", + "type": "Dynamic", + "description": "Indicates whether a security policy (such as a WAF or access control rules) was applied to a request." + }, + { + "name": "PreviewSecurityPolicy", + "type": "Dynamic", + "description": "Request matches a rule configured for preview (present only when a preview rule would have taken priority over the enforced rule)." + }, + { + "name": "EnforcedEdgeSecurityPolicy", + "type": "Dynamic", + "description": "the edge security policy rule that was enforced." + }, + { + "name": "PreviewEdgeSecurityPolicy", + "type": "Dynamic", + "description": "populated if a request matches an edge security policy rule configured for preview." + }, + { + "name": "PayloadRemoteIp", + "type": "String", + "description": "The remote ip address of the payload." + }, + { + "name": "SecurityPolicyRequestData", + "type": "Dynamic", + "description": "The security policy data of the request." + }, + { + "name": "StatusDetails", + "type": "String", + "description": "The status details of the request." + }, + { + "name": "Latency", + "type": "String", + "description": "The latency of the request." + }, + { + "name": "RemoteIp", + "type": "String", + "description": "The remote ip of the request." + }, + { + "name": "RequestMethod", + "type": "String", + "description": "The http method of the request." + }, + { + "name": "RequestSize", + "type": "String", + "description": "The size of the request." + }, + { + "name": "RequestUrl", + "type": "String", + "description": "The url of the request." + }, + { + "name": "RequestStatus", + "type": "String", + "description": "The status code of the request." + }, + { + "name": "UserAgent", + "type": "String", + "description": "The user agent of the request." + }, + { + "name": "BackendServiceName", + "type": "String", + "description": "The backend service name in Google Cloud Platform ." + }, + { + "name": "ForwardingRuleName", + "type": "String", + "description": "The forwarding rule resource of the load balancer in Google Cloud Platform." + }, + { + "name": "ProjectId", + "type": "String", + "description": "The Project id in Google Cloud Platform" + }, + { + "name": "UrlMapName", + "type": "String", + "description": "The url map resource name in Google Cloud Platform.", + "dataTypeHint": "URI" + }, + { + "name": "Zone", + "type": "String", + "description": "The Zone name of the Load Balancer." + }, + { + "name": "Severity", + "type": "String", + "description": "The severity of the incident." + }, + { + "name": "LogName", + "type": "String", + "description": "Information including a suffix identifying the log sub-type (e.g., admin activity, system access, data access) and where in the hierarchy the request was made." + }, + { + "name": "Timestamp", + "type": "DateTime", + "description": "The time the event described by the log entry occurred." + }, + { + "name": "InsertId", + "type": "String", + "description": "Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result." + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition1'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "GCPFLoadBalancerLogsCCPDefinition", + "title": "GCP Pub/Sub LoadBalancer Logs Test", + "publisher": "Microsoft", + "descriptionMarkdown": "The Google Cloud Platform (GCP) LoadBalancer logs, enable you to capture network inbound and outbound activity to monitor access and detect potential threats across Google Cloud Platform (GCP) resources.", + "graphQueriesTableName": "GCPLoadBalancerLogs_CL", + "graphQueries": [ + { + "metricName": "Total events received", + "legend": "GCP Pub/Sub LoadBalancer Logs Test", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "Get Sample of GCP LoadBalancer Logs", + "query": "{{graphQueriesTableName}}\n | take 10" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true, + "action": false + } + } + ] + }, + "instructionSteps": [ + { + "instructions": [ + { + "type": "MarkdownControlEnvBased", + "parameters": { + "prodScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation).", + "govScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Gov Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov)." + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.", + "fillWith": [ + "TenantId" + ], + "name": "PoolId", + "disabled": true + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### 2. Enable LoadBalancer logs \nIn your GCP account, navigate to the LoadBalancer section. In here you can nevigate to [**Backend Service**] -> [**Edit**], once you are in the [**Backend Service**] on the [**Logging**] section **enable** the checkbox of [**Enable Logs**]. Once you open the rule, switch the toggle button under the **Logs** section to **On**, and save the changes.\n\nFor more information: [Link to documentation](https://cloud.google.com/load-balancing/docs/https/https-logging-monitoring)" + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### 3. Connect new collectors \n To enable GCP LoadBalancer Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect." + } + }, + { + "type": "GCPGrid", + "parameters": {} + }, + { + "type": "GCPContextPane", + "parameters": {} + } + ] + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "tier": "Microsoft", + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "link": "https://support.microsoft.com/" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections1'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "displayName": "GCP Pub/Sub LoadBalancer Logs Test", + "contentKind": "ResourcesDataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": { + "GCPServiceAccountEmail": { + "defaultValue": "Enter GCPServiceAccountEmail value", + "type": "string", + "minLength": 4 + }, + "GCPProjectNumber": { + "defaultValue": "Enter GCPProjectNumber value", + "type": "string", + "minLength": 1 + }, + "GCPWorkloadIdentityProviderId": { + "defaultValue": "Enter GCPWorkloadIdentityProviderId value", + "type": "string", + "minLength": 4 + }, + "GCPProjectId": { + "defaultValue": "Enter GCPProjectId value", + "type": "string", + "minLength": 4 + }, + "GCPSubscriptionName": { + "defaultValue": "Enter GCPSubscriptionName value", + "type": "string", + "minLength": 3 + }, + "connectorDefinitionName": { + "defaultValue": "GCP Pub/Sub LoadBalancer Logs Test", + "type": "string", + "minLength": 1 + }, + "workspace": { + "defaultValue": "[parameters('workspace')]", + "type": "string" + }, + "dcrConfig": { + "defaultValue": { + "dataCollectionEndpoint": "data collection Endpoint", + "dataCollectionRuleImmutableId": "data collection rule immutableId" + }, + "type": "object" + } + }, + "variables": { + "_dataConnectorContentIdConnections1": "[variables('_dataConnectorContentIdConnections1')]" + }, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections1')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections1'))]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "tier": "Microsoft", + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "link": "https://support.microsoft.com/" + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', 'GCPFirewallLogsTemplateConnections')]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GCP", + "properties": { + "connectorDefinitionName": "GCPFLoadBalancerLogsCCPDefinition", + "dcrConfig": { + "streamName": "Custom-GCPLoadBalancerStream", + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" + }, + "dataType": "GCPLoadBalancerLogs_CL", + "auth": { + "serviceAccountEmail": "[[parameters('GCPServiceAccountEmail')]", + "projectNumber": "[[parameters('GCPProjectNumber')]", + "workloadIdentityProviderId": "[[parameters('GCPWorkloadIdentityProviderId')]" + }, + "request": { + "projectId": "[[parameters('GCPProjectId')]", + "subscriptionNames": [ + "[[parameters('GCPSubscriptionName')]" + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections1'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", + "location": "[parameters('workspace-location')]", + "properties": { + "version": "3.0.0", + "kind": "Solution", + "contentSchemaVersion": "3.0.0", + "displayName": "Google Cloud Platform WAF", + "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The GCP WAF data connector allows you to seamlessly ingest and monitor logs from Google Cloud Platform's Web Application Firewall into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP WAF logs, enabling proactive threat detection and response.

\n

Data Connectors: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", + "contentId": "[variables('_solutionId')]", + "parentId": "[variables('_solutionId')]", + "source": { + "kind": "Solution", + "name": "Google Cloud Platform WAF", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com/" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "version": "[variables('dataConnectorCCPVersion')]" + } + ] + }, + "firstPublishDate": "2025-02-12", + "providers": [ + "Microsoft" + ], + "categories": { + "domains": [ + "Security - Network" + ] + } + }, + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" + } + ], + "outputs": {} +} diff --git a/Solutions/Google Cloud Platform WAF/Package/testParameters.json b/Solutions/Google Cloud Platform WAF/Package/testParameters.json new file mode 100644 index 0000000000..554801e41b --- /dev/null +++ b/Solutions/Google Cloud Platform WAF/Package/testParameters.json @@ -0,0 +1,38 @@ +{ + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } + } +} From d0f4b29a23e3403135d76dd657cb0a07064e4aef Mon Sep 17 00:00:00 2001 From: v-prasadboke Date: Fri, 14 Feb 2025 13:18:18 +0530 Subject: [PATCH 04/10] column type format corrected --- .../GCPFLoadBalancerLogs_DCR.json | 4 ++-- .../GCPFLoadBalancerLogs_table.json | 2 +- .../Package/3.0.0.zip | Bin 7946 -> 7949 bytes .../Package/mainTemplate.json | 6 +++--- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_DCR.json b/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_DCR.json index 6abe500aae..ae189dbd7a 100644 --- a/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_DCR.json +++ b/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_DCR.json @@ -22,7 +22,7 @@ }, { "name": "receiveTimestamp", - "type": "Datetime" + "type": "datetime" }, { "name": "resource", @@ -30,7 +30,7 @@ }, { "name": "timestamp", - "type": "Datetime" + "type": "datetime" }, { "name": "httpRequest", diff --git a/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_table.json b/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_table.json index b2961ded14..0c183a33d8 100644 --- a/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_table.json +++ b/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_table.json @@ -9,7 +9,7 @@ "columns": [ { "name": "TimeGenerated", - "type": "DateTime", + "type": "datetime", "description": "The time the log entry was received by logging." }, { diff --git a/Solutions/Google Cloud Platform WAF/Package/3.0.0.zip b/Solutions/Google Cloud Platform WAF/Package/3.0.0.zip index bed2183b883b032c0ded3b46a4ce013fc11507d2..23954c67bd257b22db0d5b5dc5f9c9ee5c0624f3 100644 GIT binary patch delta 3169 zcmV-n44(6fK8-#NP)h>@6aWAK2mm~4PO%Na1`<4KPFf+W>5PCE006X{000pHli?l{ zv-1X$3xAC^aNy6N$6zoid*IWrQ}#L01r_2c96wu=5$=sN9MUY%^xX;%ZxYq&s`x>+ zpA|`E71?Xa+;v%|;0FgU!5SG0yScdN(#M2wCHWg5Tbi^he7#Iwc>VAOQpNA6;awE| z5rSb(oZUGDsC`Jvlv zK#m7k5S(3zEb%N>dvwoeG8&aVwI~#!1n66K&~HXl5f$KNA45!3XER>l6kuf_=aXuJ z%J(pZ5@UOHDPtlX-F<&3%PhxP}-8%X*Yva*a z<-BwnL-|nZLufdj`U|!ZEX@u8k8E?wR*)!koY)DOs<)$YwY%aHJR>-!=C1YyB|2lF zs9{6mOe7mU0q;-{ayts#Yyu1jOc{x(RDWB8>0zgcm!ol$DrU2iD(cA#2IqO-)!1lK z^f-f@uGaS0plJO|8n!lu_vOd}Uwd;&i_!QO*jR^<*_hdz<@$B8^HkKOx^*kENAI}{ zm344|`eihRIL8f5eQ1t{r?&o=Mav5ey{P_b^O|Cz+D!?mivVZ~WOzZv6(CpZJbw)@ zRy0wA|5qG2TmBC3kn5!lQ?}Ap&B&!%cOdx|LaD_8%Au%q)@w%##->`FSFP->2FsN! zo0q8f(Y$L~ukC1l@Sy9_e2vRElNShvJEKQ=81^}k>w6mQ9>0xJqt_n6*XO!cG<%D& z*f_w9yJiq$o;&ss@h?#J5P{3mTYqvx%lvCHza=VA>56~3P9p0ubej$x(3Mx`Hbb@+ zs3vMoA}8HGf)#tF15QuWp|3Mi$B`d+BBcjXi(wTZxl9B((R{>ZM1gOXUJ%9;QE5R+ zD{LQayG?dq_-pG167g_avd44C62MFvyhBdPTNa+oR}|R0jd9*kA)2iqi0ax}9cKjP95 zBn9_GEwr%n)Bpsj9*qW46o2v*L4t%(--lhnF*OO9AyFrnt>fi9!ws>}h+=&e(Gb;G z4kr03XTpKjP9CK2{v1v+I7;f!IuJ7I)H^s9_qLygN5nYN4}=Y#$H_{}a9{YK%VDVf zf>+q?2@UW941@)E5AJO(8TPFwleg`514lR*aY>X~F@C!*c9>T0&7ihnm zwot=sYywD?!>dFCn18wJl3se_aa_s8_rhGr9Ps1hmzTkNeKqP9A8J1(&*u}Ij_k4N zVmgLH+6u2esk`T6!f$!TR?5#amPZ@;$4I31t9$q|@qY<9lr;60x2A>?$NClZ+4d>f zAzi0D*@5|g-ruJyifItpVlJJzRabB9!68sw3*R=DI%GTm!+*RIztM1tvKo@mCA&0l z(&_7uCAt)^|8l%gf(~u;^5MY*yjgw@em`_1iiQv>kQZ{XH%DPnM9BsF=-@YU5b!As z1tL@w)Ib57hwkmSt(;8rPouxNTsw)Z)b(>c58BekQ97zwI_{mV_sb2Fw0HW~(IZ76 zJ>TnHNUxGT+kdR4w@C(mquQRkJlx1myiF40HQ~-gz{*wov}alrWL$I~-RHuql)(ezdsxUQBWvN~jr8-uU+N6Ti+R9PuD@Jvw6t%WO)H=KVT?_B7 zul&^H+x3;69M=l_RCelA9N=pur!TmY)7J`4Uw8$lj@N(Mg;IwKP2EJ%XIGJ_QzfQ# z6_}hCU4Ob&TjhhHR0My zMjhs@KYG{EVSis<*I_FUZBTJ&yOoCAe$p?jvd|!3QCV9_=x+5>9F>E5RSfD;DX6VN zP$iINuL!iR5>WRFK$XcH6@S)M`q`wy&qkGfHh-_^Q$eS#f=^53o~A2f3zd4dU!iBS z$~^s*z?b+DE=BdPAK&^MKfYz#65IXgmSabKAz$CBMF)VCDzo)aR{VXcB)BakR{g~6 zQ-Dqs3$_dZOoXkPV$Jmd+miIgSFHbBlXCR{4a{A=+qn_gm9E!= z8F#{KPj9i?MXjZy8gTet>i()+9S&O*)LujZ0T8L5$`67rj^dpypxCS^c)VKWqHKXw zkoD0-VtinM+!M6bPDZcx7cRz;0>}%!Z!TcM% z&vIxNwV4%mHKCas^BKv(ux80sHia6?7TFW&$lA)Xy*P99n3s81PQ-6CO zSN-<2##q;hYF#_mUf1cHo7H|2V$n@^>nXm5iv6(eu5_Q&PS?%hDu-zIKsRlt-sY(8 z!|etY?$v!OC&d(U4iJh{sv9XY)dm^9r6!kU9crEJh<&}o)9(&XdWTCqcI$1!+dSIG z`~}_OxqB!yv36CxgcH=~a$u%3%c2rGIE7+Qd&SK$2TMe3qPhhIgI-UA8b zpod@z@fVSQ;tZJZoM$CN-ekck`5_NN zto4QIRDT!){s8P=8&`g>@7&fdL1| z-jWdS&Qp02xB~aM_&_3yme^c=aIu&l<&cCIFH|oSZvgLuv|D1H$u)SN10KlBERx{G zCmV6$jf-s96C|6sp@w(1F^5)NNJC_B&B4utoqiH0+dr0RoWPi6dSwL)uKS;MBi|ysdo^AL-43yirEgsk=z^fODZA!S_u&$Ej zoymS(p@9&_!D>Nx>KSB7>CIG1My!OR2678Ypedg%8TGjqm2l38`AmLO@&dRfp7QI( z+nt-h&z3OHzki#&f4f7L43&2A_v4OvL2d)3k~`I{izAh%O@I9wo`_ERw0maI=bXng zSf0+h1fc=*c%(oSq}@4u`J^5o-yqAU9r*Slxr#?5>l|Sm5%pne@Mdbu1Q;7HwH6KgOg9%MrM!KS?I!rMydBLC~76G-!U1 zJ*!1bF0oa`+!b|7F1-0aP)h*<6aW+e000O8JZespe;z^!JZer_A*<<(fRoA|ItFtd H00000GFuxd delta 3153 zcmV-X46gHyK8ijKP)h>@6aWAK2mp3;OtB5Y1_^d_Oj_jPC<=YE*9NW&e+eRx9V~+$ zgTbWiflt3q+2=$TREVc={A^7|xHr;pNV7oGcPl)+NmQ$=;s@D&RwR{GWUnQ2*JYW4 z9~`^{Yh*0!=HjAD9}~irF0PD(+9J9qZ6}sNR+)t{NysHyR%+OQ3wEZG+KRIe*V-3h~Ml3D(Pee>G=m+1en`bna|F z8Xr+`1%qW2pl$fQmB3TaY%>}^MNgi`e0`WdiNS4m>*&j@jYngZ^U`SyyV@6&=!}J;h7E}`k!`w2{0fqWhACje{Bt>hn*r`j>b)@n9WM6s3$KNoacR4W1~sY;|y}TTH9lTqV+Fn z*xDH0mm>>&?ad`EM&n;#V;w?fV`gub>(|B3Q&E@d)~(1Mz2`1e*1-kpm(dvF95*!e zp*bF&+WKD>EiW+iqWY`NYl?+xHzlMl0-!CB;RO{}fLyKfe>A*U(L@dYUvcDY`8&Kr zu9r4U*-BeABbRF3f#h2Vr4|P$hoaJ1uN^HIn`&`hwX(Y!ELXB@UZUPd^R8*VwxjvM zgRV#OH7?^!ULY9mj2`7-*ylj5?`gDq{5DFBUV8*zpX*xD>@CKkd4Rz_Elq0~#F*!f z`d`GqK-ohCe=bXJ$qg;@ugUzDs6eGF{^dG}tjEx8I&?r+UY*+v*;=5Qs5yz8bo&Ta z?3pf0s1ALdkvfk2z!NDwkXj6@2+3t4$cg47E+Yzjv-E;6o`^~dQd(jAXxnYF`@&ya zH;{;j(~>=&LzVz$(%>C(Qr@!gWWJ)vCg3AMFPbD_e;~_a6olM9eXQo@5aiJ(35ayV zx+4V;S0lwygw>S|NA}vM zNcCtme~_Y(rw9@xg!(@03XZ8s$P9@(xojOT=NWE@g+>(XtB8iE#&R&pS2+_7w080! zh4<%hlEG0@ht`3RQK#O)vADPWG&~~4k$xa-@H|ddVut&|2VD+B?H9blc28)47hoVP zz$Y#^M}p{cmQBWj323aR}%_Vy8N zI_(BRwDkE&1Fxu^rj}9!M0BkzCk2MEh?UoIAiT9tAn=_?ZGR&c&d~v-BluR!MQml; zmMbI0HSV9lODRAEJw(DyqKA#iAkykcW?>49HJvhfgR{klN=-L!=oUSktLsvKS= ze;UBdU6=II8;|2kF1{D$Lgs)UC%?Q5-s`JTxA;)|DS1Ah;B;hJ^-0}5 z9}|AdGqzHGp0PaI$UjCRwO`%Cmx=#N$f2aEx4bnqlsML}sL!@f$qwl{+w$p(Vj4uY zm`i7F)zuq&a0nFF!ncj34jB)?Ft5aKe>9w;tcE0X$u7;Cbo%;Zi7v(KzZ@@=phFwI ze0VScZz(CZtrAun zIxQ8i+?g61RJi(oSJ|qKSnU<8f83R;+ACJoDphu?P}N+Vt`(`;5NxeH)v4l?^#bLV zDohPjS*lk>sg9MTHmM-BwsO?^icuXZMXjw6wa%`8*TTE&D?c^)c73HM$F;&fm7O{j z2l!ga=?kvp^tFQ17hb`sEHubhRMu7!x?BAeN9CYi6@z+I3TmqmR0*WnD*~;n1k}9(P-QYl z#h-PRem1G_vr%QA%`5s;f6!^G;L}pMr|HVrLZzPVSLoTSGEaXc@FjkPOHuvn$G1Mm zk8jzw#CAWr<=9bQ$k(@O(E%W(%4|K96@Q;932qCCRX;KN6rdBuf-M686Je{SSaW^A zwj{mr73)9Oq+C5f19MmJc5VcArR#P8K3ESh1|BfM^;i|}*I^m4e@`}m-aXEJ(|%LP zi*EM@=$YXYt$!(cJ-qea+X4HVHDG&9E4nl2y<+ZLWpwLz#+~rm(_8FzQETa_1{}VZ zy1yz{hr<>HwHHx907UAi@`Ip@qj+ZvC^jn!9VtlClO~oQ zooz7@+djcqqhQCce;M~s@GSs+itj$&-H)L#`&v19F#iVcvm9HkliXHQb={fG*5zxV zWD8Ng7E1m!g_0XOrd_)ZCW^@}=9oed;f97G+AR8*WNbpabzpNmJiMRp?G9QZ80c}Q zkLxy!$bR3^ZMUb4B93~N)^d%GWGJV_^`=6?0+ij+)ZWKcf4_aLG1hgWTG!6C*LC{l zX0@M$Saj3fdWx^1Vn3|AE8Qox({*#W$|2f4&`sN^w>hf&aJxZ;dv)K+Nil_-1BBv~ z>PE^;wLyk&smWzohgxSlVqfp@^t;28-r*9D-Fn;bHjnl(e?hl+?jB0ePUwD-gx(is zoG$F^HVQUke|-HGqVC$Z-UxYp_+ynf^u?H3^0O^@V{O>ZyzB5&wi0UNyX5hApvmKC z@%Uw&u}9y{)L#G-gG61(^0>tOwYc{2(>Vip@%}5%z;x3WYc<2dFv;V$5e)vn|NTGY zRF?lT8<6iPS;ElYzuoDRSE!c)QVInb|MlSmK}h(oekmFSc=N$q2OIaOV3;$VBhX6NB8j03w(ehOCK zUJ~B|e-xRdR#x2Qe_Y%>DI*bORH(78>e#nCmYrl!LZZ-hM#0+@ObrukS zQC@}uDFl*T5U0dQooP6Ea&$Vu+d{s=1p$(mly&iKS>GFPcX2pp2#$oLOPQ&pDp3{% zs|4L(B2gV%T*5VKgcDh1RAfoTuv=C%R9AChe;vh4V88*gwsXR=>cXdr}fuv!qFdInii zdNY-h5i8-Sf!sn8Xv$|xMt!bDC7d&2K9k>+ya29=r~G>HcIPJWvn9;)@82fx-|mnl zL#18({kUUZklR41 Date: Fri, 14 Feb 2025 13:19:00 +0530 Subject: [PATCH 05/10] Create ReleaseNotes.md --- Solutions/Google Cloud Platform WAF/ReleaseNotes.md | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 Solutions/Google Cloud Platform WAF/ReleaseNotes.md diff --git a/Solutions/Google Cloud Platform WAF/ReleaseNotes.md b/Solutions/Google Cloud Platform WAF/ReleaseNotes.md new file mode 100644 index 0000000000..d7dfbe4706 --- /dev/null +++ b/Solutions/Google Cloud Platform WAF/ReleaseNotes.md @@ -0,0 +1,3 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|------------------------------------------------| +| 3.0.0 | 14-02-2025 | Initial Solution Release | \ No newline at end of file From ad396b2636012614843db8090c74689f40bed70c Mon Sep 17 00:00:00 2001 From: v-prasadboke Date: Fri, 14 Feb 2025 13:29:38 +0530 Subject: [PATCH 06/10] Solution folder renamed --- .../Google Cloud Platform WAF/Package/3.0.0.zip | Bin 7949 -> 0 bytes .../GCPFLoadBalancerLogs_DCR.json | 0 .../GCPFLoadBalancerLogs_Definition.json | 0 .../GCPFLoadBalancerLogs_PollingConfig.json | 0 .../GCPFLoadBalancerLogs_table.json | 0 .../Data/Solution_GCPWAF.json | 4 ++-- .../Package/3.0.0.zip | Bin 0 -> 7982 bytes .../Package/createUiDefinition.json | 4 ++-- .../Package/mainTemplate.json | 10 +++++----- .../Package/testParameters.json | 0 .../ReleaseNotes.md | 0 .../SolutionMetadata.json | 0 12 files changed, 9 insertions(+), 9 deletions(-) delete mode 100644 Solutions/Google Cloud Platform WAF/Package/3.0.0.zip rename Solutions/{Google Cloud Platform WAF => Google Cloud Platform Web Application Firewall}/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_DCR.json (100%) rename Solutions/{Google Cloud Platform WAF => Google Cloud Platform Web Application Firewall}/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json (100%) rename Solutions/{Google Cloud Platform WAF => Google Cloud Platform Web Application Firewall}/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_PollingConfig.json (100%) rename Solutions/{Google Cloud Platform WAF => Google Cloud Platform Web Application Firewall}/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_table.json (100%) rename Solutions/{Google Cloud Platform WAF => Google Cloud Platform Web Application Firewall}/Data/Solution_GCPWAF.json (91%) create mode 100644 Solutions/Google Cloud Platform Web Application Firewall/Package/3.0.0.zip rename Solutions/{Google Cloud Platform WAF => Google Cloud Platform Web Application Firewall}/Package/createUiDefinition.json (72%) rename Solutions/{Google Cloud Platform WAF => Google Cloud Platform Web Application Firewall}/Package/mainTemplate.json (96%) rename Solutions/{Google Cloud Platform WAF => Google Cloud Platform Web Application Firewall}/Package/testParameters.json (100%) rename Solutions/{Google Cloud Platform WAF => Google Cloud Platform Web Application Firewall}/ReleaseNotes.md (100%) rename Solutions/{Google Cloud Platform WAF => Google Cloud Platform Web Application Firewall}/SolutionMetadata.json (100%) diff --git a/Solutions/Google Cloud Platform WAF/Package/3.0.0.zip b/Solutions/Google Cloud Platform WAF/Package/3.0.0.zip deleted file mode 100644 index 23954c67bd257b22db0d5b5dc5f9c9ee5c0624f3..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 7949 zcmZ{pRZtuNldT7W5AGH$xC99h+}+(>g1ZEFcZcBa41wV8g9I5|2M_MSZL|Aw@BMFW z_d{3rLw8lbd{yVD$bW#t1poj@00CPiz28yAdWi@Cz!4SzK=5yB?rLf3ZmDS_VfoF* z(Z=1z$?>zTo0DU+_N(I>H|Bd_A9Q=m;pfLuHEfe*%-WA?6_Y5X`bpo=B6tX`kC@$x zB;reVIt+saC&(O>8~Kk1)lMx8gJC3XqruNF8y89!!tbaimu2ypS<(Gis2Njucl0sU zUrlLUlg%R9fy14%CWI%oLcbsZUYKM`D52l6wITC`&JQ;eI0mBzd{sA>npL@eso}l4 zd4cRmU3F!nIN=cv-6;(aEmi}sQ;+YQ^8??lnHkKs^BbPpFr_RGWumB|H%vZ6Cw`Q3 zlRzJuvvfZ?1u<3vFwIaFt}+X_lL)4&|{ORLPs|b6)IMxsursTjPV4+?mp+CX>qv7H{MJx z4X>>LGU(^Z>Rw+i;`HFCR zx7}(q$6P+boIE{G_ihc)HGM}~BG5VdrhfNrKFl!u#W{D1f*Y#`l)iE}Fa5Z%{ibom zQS?5Y?!0FpC0w6iEYZyF#PmCb-523>bsw7{M4^^}u&rnEmJ!j$VZ}ps9b3l1!j2#t zvo;eH239F_2@x5S-4c)m#{0tHuG#!<`9;vEy@#2rG#%U(A;ANq@knZ3ftHkJq^on1 z;-Q24L(Fa=TcgzaBjz#X+&lrb{B6rmHoj0st}UDoih2?FAZK*2WRV54pQw>cC=-Y1 zs*La2*BJ|;Fsm{RbeS|@I}1QPPbIsqj68lKUXW0+;$XLMe1eurA3vOXYGCZInV5fw z>_;H~o<+n~+$f9PrP3;Zt+lMGkT&;z$RzGM0i+jqG+I~Fl}vfOAxERqnVhIusPubG zKBNIg5iJWDzBki)(Ll_JAu&0`FjQ;@Az5prBLJ}np<#54WG9>OamD`BZdT(Fc*9l7 z#f&s7!6J_m)D_Nevv0tNe~)}moIT)n%cF6f=7cX5yL`pcYVlU=Ov*dZ?>vdN8e(4r zo`yn^r8hJBTuI0;$8L#GQgOtP+|5ApttAoqh4*pm6oIILeJvR+K=R)87RBOS7fBEo z!Ky2iW)NL*mXe|H_mG$4-#i6I;+}Ikk<7h7+b{3cd5o%d?RK|Cv0~k&uvj#!)@74* zED~|tjKn9&h5b99<-}$_t@<$j(c2WFRS;k?XKmklBXfs$;>IBFU{LQkUafP7RAQsP zKO+j@S*8>ga0`!ynJ&;Hn}jD7e>h?s-vUt~VYh|p@e>=(louZuF45$dqS}N{!uj>x zmKRn?We#V&=kMnCrmuqpO!62yW3mfw6Q!=cjkL@hqOaxB@_-fD^FJCl7rA%4o(#m= zkIxS932?8tP*#=XLaGDh?K~KGWBO^n422-2hzuC^!YB`GjIy)ixwx_(lLjfnVnr4k z4VPBrEYn^wq1*K;y+X~TP;TZ~q`RpTMku9u(C@%s1@RD~muuJHQ_B7*S~@?yG$tyn zeqW!}r+$V@RBh!QOHv3itsoI<3GN{X&z;X%OdWh3d>wmhO??fe(EI$Fk1?|-TIvy^;B&YnM8R&%x}<7I;Z(v~GCbfc zUt9YqvHXsNEdL?-Px!_LPgWOJjNCaeE80v0##N&kY`yFhw9V6Heg&{?XBY4uS5F`y z;&*+DELYtk7WNtuQNeAw{DdZ7YCJ(8>UWnR zST+O-$%*Q5r!nOTR@r-jAQ-mL;Siu4Z?raDYM(%duTO_>hc7Yt+hYOJ$|J!!%Sz0- z02TiPv;0HJih|G&khKJX{cy3pT;Q}i_w7!)57-KWob<)=dTTlr5%Eg_jj3Pk+0+Un zvdu_&;DO8EioAxbzSt5}=xcnLK-8z)1CuAfdj+&!N6J5&5{~>5MxfZcB~IP`iRyAT z3!F*x12dmaHuu|m!|XIB1#eW=w{QyQQxE(|Z-mrj1sI9XyJ-TkyON`$s)PqZyusj0 zXGtUSx3*AmzqA=@&a!{+vFpPbAsfCLm%e1{R3uay`NbK9PmC@>AC>>hI+*4*O;0e*(&^dp zeP;=z^R`V}#j*eQq(h!cK;6M7EC6H6;Ek6k`X^%Ow_va-i|)8g`^JTToy;1kew-J2_YQ zIaaQd{VBQcBDje18e~H}<2|YnjmRN{w6EYGc3*6LUruQ0q%E+{0$FXJd6sJcC+OpT z?I85o%~7-4TCGF?3-#a-$1pXO^<*Ck({&tKZ1;0lyyZr4Uh5E#0ELQVXL2>sZK*VS z*x8xxuBvwU7gT?3H}tmZr<`jJh$Qq;a0(=N{nYv9r**2(!%tgI$`HZLYk}y!OP@fM zB;exX?yja?L&La`p@vNUJe*2*$`J(%_eZ356f%}L9n2|AKO5w}#pbs%jvl=D(DoBl z)ZFGl@fDi)0JZp@E8XwJn@VCkP4R*d1t?Ph*_|Psd4K&KkDeE;5+_7|ZI;0}+vs1( zIX5?|yaVvn2wKVe0UI`5jq=+s5_5_%r5)Nq`6ii39bf-}4fs%tDK{6gf5x_m*mCnu zihmSSBZ#1JzYIMm^-OpHuV?#c=7UmB?-pJz*m4ddT8^OSk%?L`WpN9soOf;*qunAzb*|Mq=#I=Fs!Ups2H}|qWms`;LBGpO5^sYnYKBhq<#-5gx_d>p8QUDu z%{Aw!Bk-Y`dPPR2e`czuEUJ#dcJSMVw|RIQn;n`GPPKq(^0cw!zFyRU)3R?N&6LJ* zilBO;yI}#oAgq3Acv$vh)pvMAVN&pLNQC7xXbANI7BB%jmx9SU-=|pCk!=4pD#`-2 zud=u`T++o|OzHaZl(_&$J-g(`#29bXqMQ>vWLlKk#K$Z|)ds0tq4cpLWK;jOfBV!ZjA&=O@p8s zQ7Lud^_fX4eT-sN%VvJh4z-H7atm8eO1t&wQu4qj}(o zrp`q`tL*PYp(R~}sY97?HZy(Q@MoKg#V_1cftZ|jWBs8lg^6Ytq@~|j=bIOu>y?28 zL5c914^?JWy`F;xK8jPJc)lZ4xMy1fehPC4VWis3P;v_0OZ zGD31vYqo@wY0r5{QJo*u-A7BHUh!#kQsS3aUy>?%_eID3BE>5EYep7R+AqbLJ^zpq zVr}HuMJaXE%0MEE`=)1en^EKQzfy};WC%SR@pDUtvq;ptnKxaUPsDyFIb}!fE^Pn%c%eW_vy2s?ll{=s3IQc>IVB-vNBhk{+?p7M<))_BMm5u=f_cF2fhC@D?T_g+zIEjnE5cU?>!A$0(W>gKs5MzcOn8a9XqX?HiRt%6yd!T^n zX2|WI56VNbTk*2PMF|irQu*$|_*f%z=cbZ8gg*w@;G*01RRc5pso4_%ESAY-Fnd;V z4u!rJHw$4nP()c2u0skwOF^eRYM)nLozY&H3x+O|4h)|Kj%3~H<@`jZmw1Uyo^eO% zeIpP>@j^hdJ9_olDd=x+2ylKh$W_C*>SBD)JLDN)mM6;TU%|t7(@J0dQg~BK=w0rA zP5=)efMxEpoM-$2hr_&cQZK+pk0B6SFU&=5(8u_JwW%RQy{Dt}5ADDyy^>FGuOuc%Zg*OQia>Mh6aY0>bhsSheah?T%2K`k7D11RK`gEZNM|bB`m9gJwpPRAfee z8^&0&_Vo5!;5(x8*+4Y$eD#dt^Yg{%9(#}1F(T0m7wuMKYB!`*@U6Soh^E0UQT9uU=~Ao}dK z5;rB_G?+Vq<41xzk~GFg_POxOaU`th)j+Dyv7k59j;kNm%kNo*)+f{~n<}XEG33!r zll~dE6~dqCL5w7c&*JPH8l4e=c|}ggPTJE&$zM>!x3UfjD|r?J|t()RCmrXm(hhm6-gk z3?Z2-n5d}qnQ;Bx?ugnqTAqCycTIA0wj{d08Z%-wTOXzlib*L08_D?nT-{eygE*DhWTv z9)*~p_$xAGp>4OHXu0fE4#E*c-vFVL%)=W6HrZ(NO#k#H~LT)*X zCw28&xRE&X_}3Cgq;U=UO^D#FNdlZ`F6Y0j#f>OKQV-aT$^R&uIj?Q-J#pCWLUi`K z+=;~>RgT52dGeotEm+Kx=zv6fw{fi`diUIA^yqEf-q9$`iM6N8Im^!W#R!$;Lt+2$ppslUA};a`vA*8g4Y^%Q`%m8l^AVf$1L3 z!B3W)5j(W)YHRV=_7XyGL~j7On;B7nxK#i<(l zu1(6T|Au~%bW(<<-ZHB-Ia;Roo#GK+tZEo$yr|NB(M}pTQm&V)U3UsXm`G>N$*jDG zblK_EpIHZ77M?)-;wN}g36LWAOQgLC?|73=e2LG6ibvV50LKgQ8?uxLcFHiq9Klhw5tU=ICwJ&n z^fZ33J3+v{a@K1EyNzP^DG+ywD~;>p=l|BmU4iqXK9o$QMz!#c3rSk5NL*Ma4H0;v zhDmnR`Cbaxu`T6^`PtF9JxcZx@;e=`BYl!ypIWpQM zENU3M7sj~*%N|RIXc<9EhZ=ml)hiuhl$^C&4(V=dWQ_xgHv_pG&I1=SLhD6Y1$5r$c-SK%|00XGzw!kNYfm36$j~8>lrVub&TH4yb~^2+R51Wa2ml7VuzMlSF^$A2Gc=u?PP0cRi8LL!_3y4- zDk10&f3LUu;ktAK&;x|ssbeBA8IuTH8@@`Ls!EK(KOb&=b;Z17K!vB$z?~O?$%#Ba zYpu&wxKS?YZ8zYLuARSi6U11Z9Z}`0*5y0TtGk~-OKtl8v;_GiNh!E_VklFeBDhvt z-YSa_P_mleDX>1O)TM~M%e6fv(KoL7++=0;t7P0k7y0r_^?I}DFvyh2i!|wq8fGMq{N;Ow-M!L#xzQ{AcsEMn#PJ zA}~$AnvF}vvdRdrj87|NwKQaYbzJp?Ny?)Vx4A`Zp0D%G5O@Kqf0^G~yG_q0T|#-* z@I2Na-Lj*pU~Nm8TS8GX_JXfSSPEPXSBpeZ+>n4+X(v~y)0BJQW#tkWc4!(LtJ&Bv zO)ML^l&_%#)aCwdc2$$#FP+X%ey3!jbO>LqOHWwT#y;lSUX_#j_@_?TX9;2&Xl%4( z%7o#d;$q#I9uWDZRCX)!Lc`ZX@_n%HU*3$@nk(5ZTm5-zX>6`&ASmu)tA z3$vE;cSO7P-5}NV7J&BKuzRf?YdIaX2J>Jd*hlEq2e)Ld*<~DQIV7|K@VV!?SA15a zWbN1>DYS}EZh9*_yuDoXbwWIKS`0elsym!2ypL&jN{7^K5`7=AQ+8@tldLN%A$EQ+ zI)1A*_=v8LJ8vWb1A|#rFpd%OIbkP{rEs~H-m6P*zt}!lBk2|*VdiJjRE6;bQOwo} zaBmrwuz!X#j}Q6S`)yskzZLM8q37A_yKuz7sonlw{|iaiw5xrylB>Srf`=8ierA1m z3X8;}9{uASuAJjxmggB?7CmiemN|-O7zuHN^{+$olm_Ip#o)=S%gcbCR(|VflR|Kw z5NM5!>e*kqbt9i6hUZvUZ-R?2r6?DFDF+1^sNyND?n|!yde=OnvlMM>$iHN?bd-~` z5P)q4QT%?w&=V2!`tuy*UNEn;G`Yr_RZ4HDp>gdb!+&!Uf{!=qH*m4DsYfGaZ`%z;r;FYJxN{n zZNgrpr^EtTJn-GKLfNRu2t|eg*WzU<5(AEMyEi-Sk_pqza~zI1ilhMa(#oH>fJ61~ zMoA*m&-_?~4rbSRjdxBZce=2*YIeF4n2d<$%|}dLqFwyWYF>VmGuLv zSfuFbx@4v<*(;$pWaq8ROOPD15ywF-`WYT6F~n+LX%{%M{rKSM-&1$86&mD;Z{q3r>>3R?OaM8?3B-zH+cOXOUWoUDJCj* zTTc*1_l}%wnQT26#+->t1^AP{QD)q!EMB)BzVUhKY=o|!f>I}Swyqm~{Ot|(V8&0v zchF@J9w|khz-p@$mZjY*>ykGVoyi7qS_dQv)<`ORZqOWF_mKPC^(d?&4+Dz}_}@+E uf13UO75|F`{hv$zQ}zEp8;1V*+5evhpdt_dZwvsy{>!j`)s5`GyZ-{kmn`Q1 diff --git a/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_DCR.json b/Solutions/Google Cloud Platform Web Application Firewall/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_DCR.json similarity index 100% rename from Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_DCR.json rename to Solutions/Google Cloud Platform Web Application Firewall/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_DCR.json diff --git a/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json b/Solutions/Google Cloud Platform Web Application Firewall/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json similarity index 100% rename from Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json rename to Solutions/Google Cloud Platform Web Application Firewall/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json diff --git a/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_PollingConfig.json b/Solutions/Google Cloud Platform Web Application Firewall/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_PollingConfig.json similarity index 100% rename from Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_PollingConfig.json rename to Solutions/Google Cloud Platform Web Application Firewall/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_PollingConfig.json diff --git a/Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_table.json b/Solutions/Google Cloud Platform Web Application Firewall/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_table.json similarity index 100% rename from Solutions/Google Cloud Platform WAF/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_table.json rename to Solutions/Google Cloud Platform Web Application Firewall/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_table.json diff --git a/Solutions/Google Cloud Platform WAF/Data/Solution_GCPWAF.json b/Solutions/Google Cloud Platform Web Application Firewall/Data/Solution_GCPWAF.json similarity index 91% rename from Solutions/Google Cloud Platform WAF/Data/Solution_GCPWAF.json rename to Solutions/Google Cloud Platform Web Application Firewall/Data/Solution_GCPWAF.json index 1c005008d7..2b83c26bd5 100644 --- a/Solutions/Google Cloud Platform WAF/Data/Solution_GCPWAF.json +++ b/Solutions/Google Cloud Platform Web Application Firewall/Data/Solution_GCPWAF.json @@ -1,12 +1,12 @@ { - "Name": "Google Cloud Platform WAF", + "Name": "Google Cloud Platform Web Application Firewall", "Author": "Microsoft - support@microsoft.com", "Logo": "", "Description": "The GCP WAF data connector allows you to seamlessly ingest and monitor logs from Google Cloud Platform's Web Application Firewall into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP WAF logs, enabling proactive threat detection and response.", "Data Connectors": [ "Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json" ], - "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Google Cloud Platform WAF\\", + "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Google Cloud Platform Web Application Firewall\\", "Version": "3.0.0", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, diff --git a/Solutions/Google Cloud Platform Web Application Firewall/Package/3.0.0.zip b/Solutions/Google Cloud Platform Web Application Firewall/Package/3.0.0.zip new file mode 100644 index 0000000000000000000000000000000000000000..95024dc6ce1bd58cc59f9e95fe0d63444d73b9bd GIT binary patch literal 7982 zcmZ{}MNk|J(5^cS?(XjH1PK}#+}%AmgS!M7AXo@N0>Pc&3~qx4cXt?^Kp=Q<&Uen{ z-uvG=-HWb%7rlL|`q5HFL?QwJ0BC?>7Y&n?T}|g7C;$K#0RTYyUux@RXYFIB?*y{5 zcXD&`adLO#arSn1Yc_gu+XLaf(Z>0cA#0^@K-X2!^gKTYu^Vcfd|2c(EG(0y47TAl z51u^lXy5Q8nC>sWWSXd!wh?h^7e_}=UlAA2?|GQK-wJ&t?}e*UmS)EF;bZ9>VFVM! zEN0UYwkz=sY#{G~o%mvX4Dwe!q(#wi%A@b0)VgZ)_Mx%^Ef!-Vj#U{vqIVtQ6wW*1Lf?s?9@9plW@wB8K1?8jzxTwjM4#@o z(L-cd%AHC#F-uv7Y9W`#T55E?z{$oPuWi$}Z_!oUVXTcv)p2wn0g7zDrPytGY( zKF)f^h>A$1ocz5ZhNX#B&cNql*yC4X(nPLAB zjsQVgnRo$Z^QUK@yy7$zxd$i@X^S47l+sN#P&VTYvz0x`{;A#~oSQ992t z(=`Un!@fw>r};gvF_`%?Tl8j@R;AhMtJ&Iwe#BP;p6?+mp!-S#`vG0r1H;cxf~Dh` zuVJ-Oj7I{GfzgXuN;jNu{Wtzv#YdqPu_B% zI)PVj^*0EDz>Y54Su52UwNb-b1)h;JW2-wzDwtok3E5h%v%%%>tm;PSMRRip7B9VH zqX}h_NBF(g0Ls79qnmk*Kg)k(Z!)M+mXBOQXh!^)MG^B69gXC>f`irpR>)An=<*Ek z0Q3E7B#U9mm!?*1WOZd=fPuEX96z=zugXdOIaLY0_?fXwPgdAfTt&k8-s_aZ{bOuahYtF} z=Y3n^pM;oKDHmWFT?c#FK3e9icNsILV~izM%LU0wa!l#a+HFEhh|>N(_BXAlXIJ67 zcTSbh(SsBz6eLl;yE$nkgICCSshTTM5~HFh zS#A3V(`4?O`_*;vo#S-^qw~LrQteW5)?Tt`5gJ@Rzx@_GFmLiIDfhqbXs#^HwH)nb zthdDZ3e_65vM8JKba1WiXufAcPWyp2{iQqAb8vdu9R0ZAZ5n)N*|Nvt%I#kx<)i(R zRF7^~g|fD(y*WB|CPv;?l1RvNLtYsz2xO``D0{j-92M7Vx6hohu??w(Paf`sirA?b zns=u2WLZbK{Jx6V{TS{(*d0kU!=JJ!%kBY?sf+41kKII-7#kqTBWYbA? zYg!!^?Y=wm!gfy9)KuAj+L9NvryLi1N}D^@uKad zzBs+C5wUXGbv7IG>aK)Oo1dF4Sw9u>Ge!sQ&S~?;6?^vLC$T>5W#?f)K(0$?K;_E7 zX!4v_k5xq$ZdsmNl2NHX+Xb+O0Mp)R{X919n#^{Bti~zvpV6JyomZc?_1~|3$y8hV zo1?b+W}#LH4)2Sd$a2Wcb7l(8l{uj@gS(xxT5Lh7&hq>XGn|&Rc)7v>SjhawiGkmY zlqt&NPiws?=FiS>82%{A_RqRPo_$lrvtweFojY5FU z8)SJB2kgTMiPU1D3KZ(03h74=<~{3iJ^bj2B?A+umjnKK#g6xG76&0xqFJ~xghdn+ z&o$^+N08AFxa4Z+<0qxc;E`IWI;CpYB>rY1n5}|S5Am$b8h1?~;f)E`e$fxHzH`>c z{pK!;MCDfid+xtOZDkJ0>6#j4|NI&MU_UPDA`(}&A0MXEm%^=i?Dwy+d!ZMQ|jgTcgwLhNc-#)KEbKGR91@4(5H7yw3X%`ueE>WD}QiL@f-Oo6(ikruIu%3 z2Y;&-r(E@&Ig6~phWe$<@9G+O4lil!H_xDKz6>Lpko<z8I{2`V!rI#qN?P zob{LU)03#Qiphi37_Xm%O@VT?W( z0Kor`W?*Y4H$6MBhwFb#`#&5zlXUUkQ1IH;O@HGXRE;-Vk^(*CEL6DaJF0v)UVvrr-WRW`N&TpG1d+N97P+c~P3sEZ?xqI~JK)k%J=rE~?BAes(|B}Zv6=SKbRK_vNj?Xnq<&LF0P*alNhIva zkBn%O9Z88r3}1N2TQrJ^sip8;{5-z0O>Us1h!Gb(S46jw)y1#^qM#&Oa|Ne;gXfKhuy=F#OFbL&*I+krqIA57C-hV2R_6 z_j8ZezVjO#*d(aQ#e~%n1^;nn%ctBUqd3gg>48U9pbSfO6LutWnkY>Q&xUFE%#Zd% zV45#t*iQRUp+wRU+0+8DDyoHFO(C{Lrmp9@gNc>Jhm*Ep?yV(9RZ$Th5g!}_s4lIb z6Zh3CwITj$YCAeu;D$*YfeCFYdAg+Co8#k>+Hh69O77AQsk;PL%@sR5WVDG0qq5>u z+I&Q(Pg*4i-}@9RM;pQ3-(H1Ss>=D@HMOj0RqScdX^aM* zd5TasPOkyHQC3GC^Ly)n5$(#85e1Etks)~ zz5)0BKAV)1KkuzX6m%Cha_{2%)Ep+p=jl4R;Z-Rg8R?Pb#Gk%1w3NZH<@}Dm5byRc zy%SYG{ud=L6-J!yLZ8=T{Ws#fsBVSootosFZ>Y%)n(H?b0_Vf>En+HsPbyMOio^3x z0zo(?fD2RYTDD6IQ6&9Dp<$DbA%!2Hny^J;KQxOjHhR?97^0!(l+?n@dPHZ!2_ptc zqkaqj9fz(^O1~oV?J%Fi;Gf4>EyTt3r-(UOi!5{~?w{?g-JozatZ@YQMYnK7xYgU8 zupp+{oI)~3;yyv2g4q0=j)W8bz1MS`D|Aqazc<}xr#Q#qlH;CQ+1}}JEt@4lIUo!j za5HXY?T*Tg7{&;JYAn%V2LCZ4Ob?+!p-TFYzUV0=tf9;67<4c!61i{$Z?Df+y93l} z6VpksB%&uIH|+~g%_hKSnINIqG?`e27+q}FqF+N~ciuenDx`aR+fizVaH_~gfDWD~ z2zB9AC>Brk3l<6~WUFEY^!K_t3W5P~qL&7M1Zpu~x^5+>hG!R?bBdv9d@nhjrRB5T zX8n*Xu6){|cKjaBoO%Tg#{=$TS zzwjL|B7o}TbMwkdX3NPJGMZvB ze!R$hpT0|Z(H47X=Zczh3&;5WG)#EMZR9R>0m?zz%GB%nLnhD%T@c@BJAQ}qSA5OM zYKqyD$|S#PlG%QT3x-4Y9sz}x3_{+H-e6}pAF162xFG@+xacj6M%l$135s{Eey`QasGK*sbS`z_vd)zx+! z4$nkG8k9W8+?wA(KTZb zv7s$nQ{`((VD?|~M|ga~i}U4NR#fF6XOcq)symt!)NUJQd?4$N**fcxdG~z=(pU>C z-F$8^x?!c`wr=vB>?{0SRn+{(YWuZcy$Ow1Q8Fi`d@gs!L#WqYI!PtEylI%M ze|@#vW0-3y8G9z`f_Nv8xk#dXf%zA=OwYFo*VJze$A-9L0BZsGx&G$o_b%G?ZZgC;6Sd1sg=;Zij}i;C zB)Oi8n=1a$+&!rrEtqHFnp*5K7(avKxwe$1lk-@qqJ_dSY2X)!35F+_CM za%NBDDo$|Wb5wt+^2O*=sswe}Z9A3zt>%0bpp1+_I7p#u%Q%NSZ;j!!t>+mynSdEx z43@m0CnVbsW@(K3noG8yHIp>NPs+m(Ulx>k#Rvv9c9i%W(KgMre>m8?_ZS>ST&K@2 z5*|ips%;(qGq8SA=4K0KL2*R43`fqXTMO+3Yh%Ll;H)U1HQb|HB**g8;1E(JzSD!K zt=+gvLcUk-8?3H~f(S@zi%sSdFnaX?WcU=kn(z1LLagE}i0nM6KUQWxVIDVdXObaBll1}2# zoIMBjFQP$^Pp|4GomXo!v>+p6}15KHhjcZ*kmBQYxVWTlUlj7cyPF4 z>2+`Yglhc^%_1F;h8H##y9+=LTtx3&m2%=f7PG>sF=X8oBeK=Q5hBr86}Xd^7Yj>o4UT~kg`|s?U<+L? zy-s#|Uwi;K0*m)&8*tw_w|r+Xp2hj%EuPU~e0zu53)W;kX0TRC-mZ6w!?Z2S)+{O` zMwC7kbmrK%qL*-8nZCJb)t+K^O>irf<*$C)Og)K9<0F|>=Sl8x1?=;1xM9N`kV5qe z)hyoJYt?qXS!29^G+U0hcjqUeM9uVE#i56Ux?Uob+TbUvIJZNO)Bq~tSi>rO#Afyj(dOOt8gNEb(tbmawFr+U(LXj z5l6?G^|dXL?P4+rt3QB&gImcd`m7k-I(m*72HuompwUph3&1f3W-7~B(7q~-nUds9 z7!s`_g)kkWi<}=aFVV@=u$(Vg1Qp7hf6sB5*Sn>&C+HBD) zMKCj&&g_;R2S7??_1-fhZ$-3z;Busf91^RQPMXYG3sJehKP$K*wIJvVSQj*$eM0no&fS!1I1allbLPgwrh+&&tHh<}oNG^Jy!h_>@`6hj+K`<}YH& z6dxn%`>sWeHOYTlr))kw6H&LR^&K z>J&D2<<83YA3`GMzex(4s||Z7neHsI`u+=1yXT%>QF#a)x^iTEBa2)3o*$dRbfQ$S_2lG>q$pCn%g*|c&gVo_ zt4zaP5ef}$137|@j~R#R??Ydppp4yH%Op~jnZhp?QWBZrBIDC`&B`~H2tvo2zcAZZ zvWx54iuNNzeJ&`)(C&$1fcP93&IRFi(HtIz# z>VH#9PX{r|YvM1b$KQ&Q^ZwrQlo*cYfeq%@nGk!l!PDk6ZXa2nCj6N@I?bua?M9t^V=PIuqRw%bAdwGPwhns@2V zS)Q*J=}qTGAF3=5sw+<_ZD3`x283r|ycjwu_o`>NL}@m;_ep4ziyjk8$f~Qv7VttBcp6=2Qmjd~gOI{JbSD zeyAlM` z@Nt+49^7ahJ6`(wReYzpymjTQXlYIxTQr2%H%z}4=QB5kGjCBiAa+6X0QCc@;^h>H zma74gghh>)c8d(h$fF|zzZBov0_w{#i#nI|`*j~&@JioN9^)?&iiUQ>3`A(&k=zAQURQWV0S_UwegEaIcq=|`nyH-eXaWRWMW%=3Tm#+b*VeOnVfW%Mu#4kb>0$L$_;)p@;B_zbS^(V^hlR$ z3NFZQ(RKIM`?uo_F=R@0W(ICNS}&?KlfnyH#nzP){V2NWNMQkq6&ws=XkG3yf?u}t=);k7}cy&TF!Zm{!Dax#Hg7j-NwRj$Vi~EY0 z2Q9g4u3FW1+!-D~nmAAas^=(i9P47yZ*5?6XFf(Dj5Ar=9jn#W&Kb!nVJPQ_0XG#D zc8p-2ve^T@ag$-p^jl5kS8E=~=bo2h@+92Q_GbxOerXkMbY6=d3%0Frb%X}bIAiu@ zcoj|nU0t_QBq?pcuV|54n6+jyWLJuE>tZO;)Hf9STi-j>axSJUNlbqQ)1lx4 z@)#yOD`2dS)ZO0=C~ev=@%9S7dOgE27SOvK-2N(VkKaD|L#0f=l_%*}zOWtmp8L^d z`+QVB-Epev~s{M`RWgd z;+qjQh&~rHTL~0{q{t^nb7X|5yEA9QFS^@;_z3|8rsL cKjHoVQv+J6$p6Iv0Pw$#`fsMu{O|350b?yP-v9sr literal 0 HcmV?d00001 diff --git a/Solutions/Google Cloud Platform WAF/Package/createUiDefinition.json b/Solutions/Google Cloud Platform Web Application Firewall/Package/createUiDefinition.json similarity index 72% rename from Solutions/Google Cloud Platform WAF/Package/createUiDefinition.json rename to Solutions/Google Cloud Platform Web Application Firewall/Package/createUiDefinition.json index 01991538d8..185a1011e5 100644 --- a/Solutions/Google Cloud Platform WAF/Package/createUiDefinition.json +++ b/Solutions/Google Cloud Platform Web Application Firewall/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Google%20Cloud%20Platform%20WAF/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe GCP WAF data connector allows you to seamlessly ingest and monitor logs from Google Cloud Platform's Web Application Firewall into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP WAF logs, enabling proactive threat detection and response.\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Google%20Cloud%20Platform%20Web%20Application%20Firewall/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe GCP WAF data connector allows you to seamlessly ingest and monitor logs from Google Cloud Platform's Web Application Firewall into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP WAF logs, enabling proactive threat detection and response.\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -60,7 +60,7 @@ "name": "dataconnectors1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This Solution installs the data connector for Google Cloud Platform WAF. You can get Google Cloud Platform WAF data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + "text": "This Solution installs the data connector for Google Cloud Platform Web Application Firewall. You can get Google Cloud Platform Web Application Firewall data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { diff --git a/Solutions/Google Cloud Platform WAF/Package/mainTemplate.json b/Solutions/Google Cloud Platform Web Application Firewall/Package/mainTemplate.json similarity index 96% rename from Solutions/Google Cloud Platform WAF/Package/mainTemplate.json rename to Solutions/Google Cloud Platform Web Application Firewall/Package/mainTemplate.json index 57e427ae4a..bb26f87a63 100644 --- a/Solutions/Google Cloud Platform WAF/Package/mainTemplate.json +++ b/Solutions/Google Cloud Platform Web Application Firewall/Package/mainTemplate.json @@ -3,7 +3,7 @@ "contentVersion": "1.0.0.0", "metadata": { "author": "Microsoft - support@microsoft.com", - "comments": "Solution template for Google Cloud Platform WAF" + "comments": "Solution template for Google Cloud Platform Web Application Firewall" }, "parameters": { "location": { @@ -46,7 +46,7 @@ "variables": { "email": "support@microsoft.com", "_email": "[variables('email')]", - "_solutionName": "Google Cloud Platform WAF", + "_solutionName": "Google Cloud Platform Web Application Firewall", "_solutionVersion": "3.0.0", "solutionId": "azuresentinel.azure-sentinel-solution-gcploadbalancerlogs-api", "_solutionId": "[variables('solutionId')]", @@ -717,9 +717,9 @@ "version": "3.0.0", "kind": "Solution", "contentSchemaVersion": "3.0.0", - "displayName": "Google Cloud Platform WAF", + "displayName": "Google Cloud Platform Web Application Firewall", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The GCP WAF data connector allows you to seamlessly ingest and monitor logs from Google Cloud Platform's Web Application Firewall into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP WAF logs, enabling proactive threat detection and response.

\n

Data Connectors: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The GCP WAF data connector allows you to seamlessly ingest and monitor logs from Google Cloud Platform's Web Application Firewall into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP WAF logs, enabling proactive threat detection and response.

\n

Data Connectors: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -728,7 +728,7 @@ "parentId": "[variables('_solutionId')]", "source": { "kind": "Solution", - "name": "Google Cloud Platform WAF", + "name": "Google Cloud Platform Web Application Firewall", "sourceId": "[variables('_solutionId')]" }, "author": { diff --git a/Solutions/Google Cloud Platform WAF/Package/testParameters.json b/Solutions/Google Cloud Platform Web Application Firewall/Package/testParameters.json similarity index 100% rename from Solutions/Google Cloud Platform WAF/Package/testParameters.json rename to Solutions/Google Cloud Platform Web Application Firewall/Package/testParameters.json diff --git a/Solutions/Google Cloud Platform WAF/ReleaseNotes.md b/Solutions/Google Cloud Platform Web Application Firewall/ReleaseNotes.md similarity index 100% rename from Solutions/Google Cloud Platform WAF/ReleaseNotes.md rename to Solutions/Google Cloud Platform Web Application Firewall/ReleaseNotes.md diff --git a/Solutions/Google Cloud Platform WAF/SolutionMetadata.json b/Solutions/Google Cloud Platform Web Application Firewall/SolutionMetadata.json similarity index 100% rename from Solutions/Google Cloud Platform WAF/SolutionMetadata.json rename to Solutions/Google Cloud Platform Web Application Firewall/SolutionMetadata.json From 476d89318f937a0d8a66e69d353b8f0a2fb141fb Mon Sep 17 00:00:00 2001 From: v-prasadboke Date: Thu, 20 Feb 2025 15:47:19 +0530 Subject: [PATCH 07/10] Solution name changes --- .../GCPFLoadBalancerLogs_DCR.json | 0 .../GCPFLoadBalancerLogs_Definition.json | 6 +++--- .../GCPFLoadBalancerLogs_PollingConfig.json | 0 .../GCPFLoadBalancerLogs_table.json | 0 .../Data/Solution_GCPWAF.json | 16 ++++++++++++++++ .../Package/3.0.0.zip | Bin .../Package/createUiDefinition.json | 0 .../Package/mainTemplate.json | 0 .../Package/testParameters.json | 0 .../ReleaseNotes.md | 0 .../SolutionMetadata.json | 0 .../Data/Solution_GCPWAF.json | 16 ---------------- 12 files changed, 19 insertions(+), 19 deletions(-) rename Solutions/{Google Cloud Platform Web Application Firewall => Google Cloud Platform Load Balancer Logs}/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_DCR.json (100%) rename Solutions/{Google Cloud Platform Web Application Firewall => Google Cloud Platform Load Balancer Logs}/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json (90%) rename Solutions/{Google Cloud Platform Web Application Firewall => Google Cloud Platform Load Balancer Logs}/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_PollingConfig.json (100%) rename Solutions/{Google Cloud Platform Web Application Firewall => Google Cloud Platform Load Balancer Logs}/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_table.json (100%) create mode 100644 Solutions/Google Cloud Platform Load Balancer Logs/Data/Solution_GCPWAF.json rename Solutions/{Google Cloud Platform Web Application Firewall => Google Cloud Platform Load Balancer Logs}/Package/3.0.0.zip (100%) rename Solutions/{Google Cloud Platform Web Application Firewall => Google Cloud Platform Load Balancer Logs}/Package/createUiDefinition.json (100%) rename Solutions/{Google Cloud Platform Web Application Firewall => Google Cloud Platform Load Balancer Logs}/Package/mainTemplate.json (100%) rename Solutions/{Google Cloud Platform Web Application Firewall => Google Cloud Platform Load Balancer Logs}/Package/testParameters.json (100%) rename Solutions/{Google Cloud Platform Web Application Firewall => Google Cloud Platform Load Balancer Logs}/ReleaseNotes.md (100%) rename Solutions/{Google Cloud Platform Web Application Firewall => Google Cloud Platform Load Balancer Logs}/SolutionMetadata.json (100%) delete mode 100644 Solutions/Google Cloud Platform Web Application Firewall/Data/Solution_GCPWAF.json diff --git a/Solutions/Google Cloud Platform Web Application Firewall/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_DCR.json b/Solutions/Google Cloud Platform Load Balancer Logs/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_DCR.json similarity index 100% rename from Solutions/Google Cloud Platform Web Application Firewall/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_DCR.json rename to Solutions/Google Cloud Platform Load Balancer Logs/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_DCR.json diff --git a/Solutions/Google Cloud Platform Web Application Firewall/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json b/Solutions/Google Cloud Platform Load Balancer Logs/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json similarity index 90% rename from Solutions/Google Cloud Platform Web Application Firewall/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json rename to Solutions/Google Cloud Platform Load Balancer Logs/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json index fd64a2e343..0b2c826df4 100644 --- a/Solutions/Google Cloud Platform Web Application Firewall/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json +++ b/Solutions/Google Cloud Platform Load Balancer Logs/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json @@ -7,14 +7,14 @@ "properties": { "connectorUiConfig": { "id": "GCPFLoadBalancerLogsCCPDefinition", - "title": "GCP Pub/Sub LoadBalancer Logs Test", + "title": "GCP Pub/Sub LoadBalancer Logs (Preview)", "publisher": "Microsoft", - "descriptionMarkdown": "The Google Cloud Platform (GCP) LoadBalancer logs, enable you to capture network inbound and outbound activity to monitor access and detect potential threats across Google Cloud Platform (GCP) resources.", + "descriptionMarkdown": "Google Cloud Platform (GCP) Load Balancer logs provide detailed insights into network traffic, capturing both inbound and outbound activities. These logs are used for monitoring access patterns and identifying potential security threats across GCP resources. Additionally, these logs also include GCP Web Application Firewall (WAF) logs, enhancing the ability to detect and mitigate risks effectively.", "graphQueriesTableName": "GCPLoadBalancerLogs_CL", "graphQueries": [ { "metricName": "Total events received", - "legend": "GCP Pub/Sub LoadBalancer Logs Test", + "legend": "GCP Pub/Sub LoadBalancer Logs", "baseQuery": "{{graphQueriesTableName}}" } ], diff --git a/Solutions/Google Cloud Platform Web Application Firewall/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_PollingConfig.json b/Solutions/Google Cloud Platform Load Balancer Logs/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_PollingConfig.json similarity index 100% rename from Solutions/Google Cloud Platform Web Application Firewall/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_PollingConfig.json rename to Solutions/Google Cloud Platform Load Balancer Logs/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_PollingConfig.json diff --git a/Solutions/Google Cloud Platform Web Application Firewall/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_table.json b/Solutions/Google Cloud Platform Load Balancer Logs/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_table.json similarity index 100% rename from Solutions/Google Cloud Platform Web Application Firewall/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_table.json rename to Solutions/Google Cloud Platform Load Balancer Logs/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_table.json diff --git a/Solutions/Google Cloud Platform Load Balancer Logs/Data/Solution_GCPWAF.json b/Solutions/Google Cloud Platform Load Balancer Logs/Data/Solution_GCPWAF.json new file mode 100644 index 0000000000..0924c2b141 --- /dev/null +++ b/Solutions/Google Cloud Platform Load Balancer Logs/Data/Solution_GCPWAF.json @@ -0,0 +1,16 @@ +{ + "Name": "Google Cloud Platform Load Balancer Logs", + "Author": "Microsoft - support@microsoft.com", + "Logo": "", + "Description": "The Google Cloud Platform Load Balancer data connector allows you to seamlessly ingest and monitor logs from Google Cloud Platform's Web Application Firewall into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP WAF logs, enabling proactive threat detection and response.", + "Data Connectors": [ + "Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json" + ], + "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Google Cloud Platform Load Balancer Logs\\", + "Version": "3.0.0", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "StaticDataConnectorIds": [ + "WAF" + ] +} \ No newline at end of file diff --git a/Solutions/Google Cloud Platform Web Application Firewall/Package/3.0.0.zip b/Solutions/Google Cloud Platform Load Balancer Logs/Package/3.0.0.zip similarity index 100% rename from Solutions/Google Cloud Platform Web Application Firewall/Package/3.0.0.zip rename to Solutions/Google Cloud Platform Load Balancer Logs/Package/3.0.0.zip diff --git a/Solutions/Google Cloud Platform Web Application Firewall/Package/createUiDefinition.json b/Solutions/Google Cloud Platform Load Balancer Logs/Package/createUiDefinition.json similarity index 100% rename from Solutions/Google Cloud Platform Web Application Firewall/Package/createUiDefinition.json rename to Solutions/Google Cloud Platform Load Balancer Logs/Package/createUiDefinition.json diff --git a/Solutions/Google Cloud Platform Web Application Firewall/Package/mainTemplate.json b/Solutions/Google Cloud Platform Load Balancer Logs/Package/mainTemplate.json similarity index 100% rename from Solutions/Google Cloud Platform Web Application Firewall/Package/mainTemplate.json rename to Solutions/Google Cloud Platform Load Balancer Logs/Package/mainTemplate.json diff --git a/Solutions/Google Cloud Platform Web Application Firewall/Package/testParameters.json b/Solutions/Google Cloud Platform Load Balancer Logs/Package/testParameters.json similarity index 100% rename from Solutions/Google Cloud Platform Web Application Firewall/Package/testParameters.json rename to Solutions/Google Cloud Platform Load Balancer Logs/Package/testParameters.json diff --git a/Solutions/Google Cloud Platform Web Application Firewall/ReleaseNotes.md b/Solutions/Google Cloud Platform Load Balancer Logs/ReleaseNotes.md similarity index 100% rename from Solutions/Google Cloud Platform Web Application Firewall/ReleaseNotes.md rename to Solutions/Google Cloud Platform Load Balancer Logs/ReleaseNotes.md diff --git a/Solutions/Google Cloud Platform Web Application Firewall/SolutionMetadata.json b/Solutions/Google Cloud Platform Load Balancer Logs/SolutionMetadata.json similarity index 100% rename from Solutions/Google Cloud Platform Web Application Firewall/SolutionMetadata.json rename to Solutions/Google Cloud Platform Load Balancer Logs/SolutionMetadata.json diff --git a/Solutions/Google Cloud Platform Web Application Firewall/Data/Solution_GCPWAF.json b/Solutions/Google Cloud Platform Web Application Firewall/Data/Solution_GCPWAF.json deleted file mode 100644 index 2b83c26bd5..0000000000 --- a/Solutions/Google Cloud Platform Web Application Firewall/Data/Solution_GCPWAF.json +++ /dev/null @@ -1,16 +0,0 @@ -{ - "Name": "Google Cloud Platform Web Application Firewall", - "Author": "Microsoft - support@microsoft.com", - "Logo": "", - "Description": "The GCP WAF data connector allows you to seamlessly ingest and monitor logs from Google Cloud Platform's Web Application Firewall into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP WAF logs, enabling proactive threat detection and response.", - "Data Connectors": [ - "Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json" - ], - "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Google Cloud Platform Web Application Firewall\\", - "Version": "3.0.0", - "Metadata": "SolutionMetadata.json", - "TemplateSpec": true, - "StaticDataConnectorIds": [ - "WAF" - ] -} \ No newline at end of file From 4fcc9b925869701ee61b5fe5ced81c462c532822 Mon Sep 17 00:00:00 2001 From: v-prasadboke Date: Thu, 20 Feb 2025 15:48:08 +0530 Subject: [PATCH 08/10] Solution packaged --- .../Package/3.0.0.zip | Bin 7982 -> 8084 bytes .../Package/createUiDefinition.json | 4 +-- .../Package/mainTemplate.json | 28 +++++++++--------- 3 files changed, 16 insertions(+), 16 deletions(-) diff --git a/Solutions/Google Cloud Platform Load Balancer Logs/Package/3.0.0.zip b/Solutions/Google Cloud Platform Load Balancer Logs/Package/3.0.0.zip index 95024dc6ce1bd58cc59f9e95fe0d63444d73b9bd..1cf5b09d885d14e94bec79a0da14cb34035673be 100644 GIT binary patch literal 8084 zcmZ{pRag`Nx2^#x>28n|qy(j#0qO2;kj|mIL%JJjsTn$k7&?YVx{;Cr0qJJD_su!y zKhIw4Vm<4-_-@~eS55H^G7$m-0y@HJpq7E^is3{NDgpu@0RjT)ztqy*+8k)DZ6|GQ zW9MuKv~zLhwD)jvZqa*oUgN`i4es6C*> zD3(qr`vox$6&Qf(B54``fN>4zeIaZn$5eA+luc|O1YiV*(MscTRPE77bT2&$J= z*D8p}8T}GRe!xj|rWkHs+w@S7a5E5o?y5o7mC+toff_kbWLmflIGB?!hz2X{@8z*S zO~RkPNp3rFd?{q%aXik5PiXbq>9+)TmKKxre6f_r$GnYS0Ard*3PL8!&vJ*NqNxl0p0?XkFQ4W%v_p)@FSPr%y>_mO5s^9yV5`D@D$-Tj(RHC> zqM~#E8tpMRYQ*D*$7$$xKXdaf0f@7HZnEO!`p4T&jQbaX0!c^u0AseM*{Y9j9I!66F9K7INn+ZK>7LBr2*BMZ1#rclzk?Kq`mzPZg-a-K+x9sLg(ZwU4wE||Sq%vwkeN3y%_l*_h4qVLeOr}*$! z8d;j%NK`6F3GLaG;Cjn+%%73JN;~U^d(WYUbZ{s~D(!SJqgtl70T(Qk!0QkgC3%Ss zSPRLM`CbnNKA7LdI8Qk<56)3L_m8!i+`rCbxg|QGAR@?!Y5uf$Equ-!^F?J7k9TNv z+Q!l}tpaA64W_H3lcJVTYA!<Bi9H;l`ylace%-GuN-F4d5^)`z8;KOoyb;Xj6>P)j zXpRncc{e-bPKr!IG`dDcnw1=f#-}Istlf+#={aQ62|XF|L#w*RZ+}lk6s=A`?W5J^ z4NeWZ&q~xjR!Izg=QFVLu*AeKO^6%zW3T;tWd%LA=aVv?N3I9R&4vPrtzC8Tk>45t>Zm7$ zY&B;uLB|BRCQ;4(HfEc65w zyeZnPAe&CyYAptKyC3&|bA-+H3yJWpxY1RW=Fe6KD>`_75RB_%`aBqho+{CA3`JBO z(i-LFCU$fG2&W2BMZ%9RF&QeW%v*l{mlEFrs_>j^DT8r2&mr5*m^e%)D}Zw|vLs53 z8oOM(hLT!-Fl6KU@YI;3WRSEzXUO=7oTT0+IF_swW?o52vnH|i4WI%aIvLw}*?F;g zT^oDpOQzb?-qdGV=`j&nZl(H{3b%5XGrv8mPy!U#%{oNmpXi z03-nf&QK0=#TH{%SKY3pVi}8B@(M|$gm%= zxu~Ms*l8p<_@kIrePMr7EoD`TQe-rtrLfB<(6rYt7bPTyBd$xor*rBB7K)&3ZNVb! zM4NDP39axPC~>bVAG*z(v$4~*chO~#=o5;y<_5+!s@ciqs8k4mcLqdx^L?Y~PWQr0 z$B7@IlTz7R#zoZ@BpsGD=j%d~UN(2RzM2d4ejC{K6^$_ZY<;n-qfMMs{((FpEU%8O zi~8^UIt5d0q7zSu%a6ttkDQD1(;L|1qGhJZ=DyTjxk4{iZM^_k?V$y3-qDfg*?^J$RQ;8osqWpjG0DcV@H{p)f7&0jRl<-9`b{?2b} zBa40j&=%FxR*MZorwK3x+Csdj;%*QCW9?a94eugZ&Fy?mkieu5>}~0}%qrbtTmv`# z&=E7AOq01Z9(wmq;pSlHK}_d6OI+i0bKc75BS*9Fnn<3-1hEv?x8_P|MG6o^e7ZWr zN$ly|g!@Hfn;9Bm|0pMm-wh7lZB$0QxTS@oHaLwFI1ZC~w}R!+-_zo1{}0osVyp0O z|G^AWh=73qk7-WkcFtPXPOgss$o4-p`(u3Mye^me0`2XQ0yJS(MF_FqUU62;I@KD8 z8Q8v~kpDaka{8e^q!r6RGG>#STC;(Apno%aBY*Qv#E1EtHY=>KftRdJ`T!rFoLpB1 zRs87~%GG-5V&OGJIyL3(c*rVG|98Wxq%fXTWqaa23~g-ro+IJjhlKM=nA`Vmdt0>> zEtpDFAiG`UVt}bd`0(4PH-Xqo9(uU=3D!Px6PMiiDOiNWglt9xZ5QoI{5hzPaKw`! zZ2OI9F9WkOs6RWm=iJ7PrGGpkAzQALB|h!dAp0wFGKI8C6D=O{wGierPoEY0EJDLL zm(6s)>#2v=UUb#C$~hS>>51>}_7m9=?=bSDze`3ZGcoUoT~i2!5%B6sdoKraqy`R? z&bjnu@()PlPf$GGkn9|yO#5=Fg3fPfgHJ9LnXl8JLP4yL-LW0$KYfOahRiAcU=Q15 zdJi?&H_utd>Ysd}s3^!X@7L(tpv$Xxiz(pUF`kbbU42IU;QL z!}nyv3^p!cGShSS0 zd;1DL@_>{U|Fne0Hnw-C2eyBVvIEOkEGwI=KnZFytXq3Rk(mno0$xW2^QHhzNxP<$ zdk?GJ#DmW#ej^3&4}lW`?(|@>8j9u^%a@86+txZ&UP^dk6kF0p_eOpym>#DgOp@wV z0B`e&6+g|fG;V{AEiS|HH~qi~UJX^GB!VQ-u&gYzc6nZ@hI5tHRYRVr@5IOMUIsIq zJtXP^k@9`68p&^=JC{0>cx3(|iz|H1DLo{6QJoCle5=$Ip|=jOg_l(}ydZ38i7I-+ zRxfG)S?o(d^py0d%o(w-pdz{5!sb#OTz*@oSXNY__e3S`LRty-PouJMUz*h`#jL#ln?K zwz3z)xTnkQz=(`*x$;Vy0PrXIs7{%|FQd!3RiZEb=WA%q*_{K%J7@nuZ}9VTONAen zgZIjUUWO_~6Nn0ejsZ*!Tx)>9{;jeZlOygKRpX3(_G{{z0`AHjyyN$Wby*GIP z`T89wDrvc*ze3qeQ0@&z4_)s3XHsooo?|BJNkHQw645Y@IRIebY3hW+nJ&T7vM;Ro zk#htq0I`<bDKiFjj0OjghmuGP4vMpXe13GG{&lx@W4C>#H}iE^o$KKqT$Z zu@|RJXc7I5BFg9S4wTKZf5fkfwl8VBVs^rnNkJSbbqD7`>`?Zcs0?pxz~EClOXH+y zcLTLrA4H!~luGnYvs4ZSS(oI??41lH#BOqARcu5A@nXI!r+-Vj=_1`2Wz&jnV8xAc zW-1aAbTpZ_R$P7vvgXwpgEPHUthL6d3SEmL>i%e!&KyQbf=3dXcJ4Tt-74K6EPwx1 zl-$;P^*|q#+oVwi6b!8*P=TU;JL_M*>ql72?w!)mEeWLGm zfM+(i7YBma(N5NM$>zgt&x%GvgW_9u*@G@QqlU9L(Q6wrDBsJ7xN43bf^2%|E`L^< z>=ku*caFRe1&DcnfMW)Xkq*OOXxb35i3YKej{kk$Pwp2aNA5vKyqHi8<@WTOtUTcg zbE#pVSMAQ;DxqBS54;1?3S*Pwf+V=YBIu>2<}aDhi9Fo#fqe^!F!LH_!WuU$S#4TQi%ISM!{L{32=Du zp>N7r5#zs7Nn!}T$Nb3ju`c`u%%&bhS-(ZD|NCUSk7R~a>c(8^V~}^_1LZPh=|Ji zl+7)QFHx9`%an)PDq(bpTB13Qk{3otqLj}_T%PS$9?9GsCQ+)0&bB!ZavajqrhdD* zj~~G}3U_Q=9tPZv;WNF_p#HR;pr*EnshZqpp}yRhk+R3UdR1>Z8y4M&qx3p;lUR^8 zzAdh^_#hZSMe&lJNFj&Y^&Zv)kgB@2cyYj({AB=?L@^O<#fRxj)U`Ba_YuK2*Cl{+ z)?XUMaK;`OReZ;1h@=_mf%ZqgkV`BzKe3kmZgGw$33BxP>zp7e6RqIJiYTb))11P^ z5kETz^^9+10y~Mj)Bc(XCRl$$FIX*Uu|BKN1o&G@Cry=Il)ilpdFRC?6GQXW3*XQJ ztnfS%PWch%jr${+^jUE92gBZguewtSLSdcKG3;GT!qrybzW6ZD$%U63c{b{va?C<> zhDHHJSrjXwIlTvJCnJmy2Y-AUeWIwKU61aLJ@&8>ewsu*Gv9tQ<>fjw&DM51^YzKl z!YFiz%)0_&b8^DWLy;(JC6d-ciTZ)GU95@S0n$5gT0QwnjgLGoW+puE&;(&uh&{e^ znDp!>{!$dp^+@YsHG0ppCRp|$!YXwzUv)dwlAGB&Rur*-d1aK)BfvEU(UqS^1_m1++|)gg&)>bFb!Ws)*`nrs|3ev?`%l5zQ)u$Pz;Wc0ed?#+|4*BBPw ze7hgoRe3kJTMe@eet(hsu%39W&_${@tu*X|98Y5^4mhZ01+_Ru7n19r13B^6x3UuO zpasUN1Gjr4b3oMl4v9)`e`}k_z$%#p%_1p|@ck5#()7Ri02R3nc`gxp33moJr81c@ z8`O%&M{wBlbFs$2@TY9L-Y|scJEwC#AJ%Xw0;$!n?*4&UnDYGjl9Xt%3Oulg-S~dv z-H!M`d3^cR;IgTq&==&5L1{jnSNa#0qffA1H9pnzq6jdQ{Bs?CuWuWk=|va8s$_LN z9zYS~Z^pZ_xVB*@sSKr| zs1Jm!Ov!ut@ptD!-+uB-T(obCCblB=@U}aGH|uuqmfkI{YSU;P&91F{lP6&zmt815 z#7_IHlMkc1@?uRZH*|6pLJ~Tt%r1IrUi9h#W}(>Y6$K@_I56uj4lLE~Pi{VzmACg7SKLC7AmW|f`Lm$J_+J$EZQv};nv-w~*Kw=>H=dpMRE_@n z;>_(iXR_MqRBRJtQZ*shDS>FWzUoY`TN*P%Q9k=aKt2w>TVq=cWEK@CIE<#duk25# zDpY0cP?}UDrqWd$arUbOMJN{Lr@*%Uf#ZC8Pwl7VKVS9jjpT3m80ps7H3$3fne^x^ z8}gdiMDnunS|2e`k|}eW*#erBKEEF9)CsiLM762keZU#067ZSUGAxX}DFACOP1VJ9JgwsxcjAKC11ZnDNk)g?N&*XpH{x&HdGfTeZ zDN&0n0ty%l}PX7&!O}Y-(#fEVNHj}zVlH@7P8C~ z+14H01Z0}&I49HrW}>k?wx?Zk zGyCln%mI9{RhlyDk#)WvS+>1mNDi zn--b-U_cl@O_lrITMOP$U+6lgqUjYXt0OCgVRu=6`-i~*clA2LmgZ6u)kKF_hptSc!@4+~!Usul(M=&i zmYX#~I$PVwE}LBq$vClz2W_-J-akqFe8Ll=wFDsw^Wiz2tVh!B=OT^Z z9CCVAm3!4Z@xuuM=mBxXv;b>KY=ZhKm#v^R*ckhZ{%=zwP=OpV^deG}(KCu3>iD_-ixv9Ts!z4UrqajGI5@K$89QiD@h}mga zP)~f_2mgRcx$tJK3uoEp8VbW`k3WwSGWCpaQ(roEzV2F`v8!6Mp61stRap`@3Iy?4 zv@Gp3E^XO^JGHAQR_ms80^J~s3-(g=EkQb!5dDNDi8d|fn#u<~%7r1g9mGE^yIZs%bPzTrU&Tt|UM+Jys9wyZ+I$Sp3j`tmfG@ zIM10bG@k>1A1Brc(I|k+*HtrEcY}V`IcsJ4sT=AK-#`R6bj}@~E5X-A25|Af)_@09 z{b@V4dFQ&NW(duk3?Zm?WZrxeUg}MqM19KUweIp<#tVP%)Mk<@y80NoAPe7b;$u6e z+o;2cFMpYp@l4|T;XSW&_yb6_Y_w#nEn0f&8LyD04=1Us)@@cPC~1Kc)|qDgh)^-4 zF3Eh5x>g$|fnz&Cr)K=FBl&cZOn>Rl@+?4uu>W{GQ5gKp{Jq0wo9T2N8GuvgE{)&^ zXWWp|?z)R5*;PKY*gr!MM+7#Wx(y&~GumrsIkkeZ4$D3U*gqu^tLuuE_pR?cR6B$k z!y(imxH@l?Dsj_m{A;07W>YqMHu`V;9tCcdA3f=&Asdw6zee`jUVCiT?9|s=C;N2il{I38Yh*0UT9rU`Z8fQ{N(*?3A81^^H7wtlPhg-32if|)(cVIu zsl1~&++d)fXaZ+^_x}crQO>li@hn=i9|T=&=0XBEp4KJO!I4Gc$~%X-iFQk%?pTXf zMZqSaf>bQhT{dDq^Cr(3qA(vHaZ}0DmObv@Zk4JuOYCElJE>`x%vjS2{;CjA=x?RYBH5-!+_8x!F-m0CLa|K_0Qo8frQoS-oNMQ&kJ$jdwzD%Oi z^G9eOp$K#vhn$(;fns?_Iv}02iAwhL`tkxj(bDE;<1^b5KEaTBJ@@*W79rL2X_Plz z>-jbsm(lpIsg(YcLi12Cmgjz2M|Qq@EO{~8Fy`%_DTe2WG1)EEd|9UR>HWya$R^}D zY**nW0R}w%+|oWZBQ!Y_K%*cJaYb@4_cimR#Ms}rIE+`s`emBaJ1OIidwjDj>f_^+m@4r6chuj18vSA&Ia?SlAQs z{%v7kZz{&8TsDW0bUy$m?AsGCyujVmpCUd)^C@I(;g$cvCMdik1J)i1Lao+;+*8b!g7{j%V{2Js`($(cX zRhy5VIfmwNXfoT%8g^=|*w|fP+I_OjqT>Q4Qk*vGHJs(_$gp34I{9e{%Zi1`)~0}Z zZp`YX=F$Tza>0&%9bE{2PLI#!tC}Jr5)s1x?!N!2g8ys&7Zd)UCI2ZK{!hdFKdt`% XsRuPhlz%Y-0@A;Y_;(*@{`>ncP?x*- delta 7916 zcmV@6aWAK2mqsNPFj-UPimP4001nJ7b1V-L=gWUiFX(UP?9RK z+e!#jaff;-S5E3d)hkz_ra~KgVlQ2L&F;Fn+;I}m!lUsd%&b3RH)**$2?>?hJ3F7h z`OWy=ef}B1;7c2&n2Es=3{vL`dlZJ%n;;XpNHD|P1>$XKFo<+kpV@FfI0z1>g~2s&UlJ-iz6(**aOQ9@I+LMK_GV0v+FJrWk zk%g-*ehFK_6}^->s?gxlhAE2JhLkt* zH$2mcwqc@mqVP9G4}rZ)=7W`tT}pPo`MP*BA3%ySNnQK=be_-iy}h5b!=t@DI9Dhv z0x3rWPJ>GkmRc#jl6e9PTxx?LbL)gs{D#l1Rwc)E1gz_yzy5{`pU~bRTwh?Nn@!o9 zQ4@9*^22{|I)m6m_^MWB!&4vSSBLvErOTN9f3Ach=Q8?vg$w$7Tog)1g2n0Sxiq*U zpTpVbUg|#kOheeSov{tQ2 zMS|7=wF6|D8ir&E2o{z`XHew~e8!;3*U$px3p&|?CRe15w6_ffO-TZHR!Zf7M7hG- z0x;7trP*5g(YV~$gVAhuKAu#0*+gW^qR_@!IGJ5csev%AV_}D!%n+Orxn&LBNjm|| zZE1fh3<~ExF&Lq|qpKDpI&$kOZ)Av?x>5<$hvZ`ws1pnFlJIRnQ)gyE!5<}>HJ8v^ z$|Iy;*PxI{LnM{4uHO@1gGl7$4UtfU{A@P%HEF8+g~b|@8Wx0g;+&KMAaCJLTDg#l z#eKrPhNkdbJr0#T<(q}kB657orA%xTjw63ZI2f+EL0gb5^!VA^JK^Zt5?Jo<13tMv zLt%142!T#4bm?}~a0~RFsvG2w;ZNAs(zfU0m)o|9bu_M6w^RGl`fiLg5iJvfXAhbWAtO_M;SA$ z8YL50AtdNPx{5Nms|bPwE}_T%eWocm@9GmR8kknDm zXw|=^wYroX#o&?|Vo3x^AmOgxfTvIJp;f4!|dYh(l4YV%*bBY!mz4hqYfP zexWfVg?ZxAQ7?(3aljFdC;Q`@o(h9RY}V}pNve5;8Jzxb*+(WVLN4_d$v%I#lPe)9vjJBJ4*(!qPyb zd0}@q4#uyAqLTXpW}+BXfE<5S?J*km8(=sN?pS;RwcHq+!>PRHJD4ZeHblJ~)~Wh7+P1%>1nh4CjN%eBeFVefoY#s(Z+; zu}vFGyv-5ajBO~XD^vsRreP1-GK>Et4`$VN1F*Z%bZ_+bgceG~cqxCK_vTSaDm~Aw ztx0#E(06-wFm?FGZOxkp`{R&ue@*V z+(jSUL<9J>UbA>Oecau82h6LzYR9tLHe&$COTzau)}ql2XQgH6$OZU1WdrQN*7~L2r_F$nQReKeX;sa{cz;|E@b5*>%wEf~^g)c9PTL zQ&w@u)=uQL&<5T8#{*gx>4UBHoxd0TR@r`yg|+f2Yo0cm?<;=)Sh6<{HxDrcMNyP} z*4@mZX=fW7TrZ`uZuE)dO9*4i{8R#-5Gm5?)!gt5+L&+MWi~qPF|}vgCWaodwRNix_cTQ{`sE>+4&dlE!m3hJR&>GEKB&K*-So} zu4qITY{jB%N`KE&Hud6_ddFuEAAcPDW%A(9lLrSgpCw^@i|x+YDhX-Erhn&g^rxM% zn81sp4Bq{Xr96luoabQr0RN}nuUJNXnjr)q@BuucdA5vGZ2BVb(wN7W8JQ5CCrO-U z|FP1~5Fj~-m}Z3_aO`y!hj|8*kxT(ZF5{Fui{nMe$Wa*QJ~@HM@Nh+5vwt}`Op-A0 zsOa)zkg^*ZhC4X!M+ss=Qwm@L1_qE}EPIrX;9+)~Fob|-X%HOqhT)ky-695^VDO{(l}4{MpHe@J9DfC#nf2bOM^tgwDU5~NY0r*Ci6Ta z5o12{NfwiYa!zQvnq=7(5Pyhg z)W=atwq)ejn>fAV3H8`SgZV4DSq9#c1f2LR4X$Cz%QRkz=FbmF(Lqobe?H1zB%uL` z=8)a!TPNhks(z>N&K0$B_3(|^FijK~LX)65 zs~ptCw0vWtTWs!A#f++>=FMY&Z?~l9tAv4Yfk9|^9PwbW%zyZ-*sgqcOibZY3~jQ_ z4l>M997Q0G;`Hd~q^^KVRH`kdx<2-cCr{XA5CsU#fmo)alOLZ0X?{?o0g=IB__CE9 z0&N@MYP*KkGT4FKcz5D^lihJ11;6D??y^0D@EafklrmYdwIj6W-7q&gbS6SE`k=^* zS*l3O_MuW&Pk$pni399W0cLk*N)w4>kP7qy^G`8mNIKk z(%8>EAe%|Gj9#(I+L$6?{Oto=%-!)W4|l~cM6T(XTz^wFhO@iqsx4eOKx9UbM=oVmY|6xQbkw)W!ZlYd;AL+4S(i!*ArlVv?lnI$$?O zQ`Fp@_KLwwXUxmfAiFK#tCD0RAq7J_`<5cMro9bAcIS;1;=jb#Og++deOmMgY>^fcYUZcj6&w+992W~3=I*-^GvEsVEDKEYLcCA| zH+1Pd`?VhjC#Wt+Hvwz4B{ZpaHHn($c6QG8*T^c={Jot-M z8WmmcAQmg&mcVh#EPcgDF~F5#;iH^q@hbQoNoHy0+M6beNqBz=0QAdXVQ&X51Ailf zu};ah|C^z`(f%uEq|l7{~%=aq0oDfU5>x`>@nr zMv@rWIiMlwDb4pk>w zY594gl(rj-7CfY0)%`nL3T{rWf`9)+nz-k1Fu>tY(Mykd<26#A7!ASk&p@93mV+0~ zcPNA!ylQMMnF}veYiI6(5z)Q5hUlcriWGe)3j8e1Sif<{*=^dF0^gEWrtz(hdw{wEk?D=>V?l3vT`)g}0q z;v4X|h~{N%2b}fb3YPoF6ZS1wZ$9uuoCMyORJ`mMGQqLbJKVVFH3siH+G$|UC2<^D zpR3I!X5lQo4j?)K1|JxM8GpG6vSnq{f>F2t^b|y(YgE+9gk_3Yp0hNi!uC@WaB_HZ zT!49e_yYb*GvcB32ruzrX&;g|&w~hJg0V4<9G}12)5q2Y0GH3jDfJM~tMcE84lc~H zl(89{U12e2Rf#H;zJ}iIxKs4e@7;d@x@a= z$l$Lr0hgWZjV7hyM|($Ts^7vvbO9 zPE+zq&kFXX95u~D25K2t9`a74GG3rF1hQT-7#_SUVk0q_NRCp>44Cfkzl!$v$5IVz z%fMUG2)x?Ux6#|^M-ZET)2AAvAyG;)M&4-P4wFh;241X52&=K~Eaa51j_RMHl6VEsp zES^zhD)opf03FNF-zN`ox*{`oSs=^$3={Kg#C)7#%cAA=-6Do+6uCgofKVm#$rUoT zj%@BbTSu8s;_9l&pwlKS(%U8n%S7Z4tq`pXEm;%dWSShp+z}X+b?1ZzwpOP=R|9HL zYAK8?qkoHQFlbHvt91&&NUB7tWYTn8YxZ9pqX{2BBZ3?^j{eEN0DJ}0`M zLOg}zXKOOTy^)4PngyD^TjAkNqFP-QKgjm8BB`t*do7u}F3S}B;NT@#BV%DV7q?&f zn12wiB!2^BOOtkmub0USuOHq(s`wo>yoxzbV(1>o@c;{gvkQ?Wp2cd9?io!+qq3(Kg(8#y zeajB|&1fp30=(>Fh>7ZK#tWPRtPJFQQh!ZQ`5vZFVr;Lj97f~fSF>3mBuC@tQm?^V zb=5#Ay3zPpSpwxNZ5xcn%K3XvQ;1idNU&b!t2s-{)&_y5b7%X}_=til7%ZazZNu-a z1fF_ko6-0wdh$Hx>%;s>3~swyM_*=bJQ}N#F_c2``2X9UO8+||CIL}x4%HEc+niDaWE;2jD=ZbyNeO@IM`DI+nJ zYHKh(>=f~GG;UJGY*tc5J$b?4Jny?28%>HHXOPp?+8!Get$#_w*2eI@99iINZ!T#u z8vgku*&{ZhuAg=skC#vJNg#zl_EZ=eVJ%56$uL)Ykv9XnBF5 z7u8>FUQ;YoyD1@c5ddw03@@m-0_19)r{TqlCTj5iiX&&s-{Bo{y|iJ8 zB;P_PwKzaI6qU|;?P$T+REzVfmEF}~xsqk`67@cscTMZH9nB9ObUm7{aeoCJbH^Sc{sqb&B5+xHOKxbH ze@*7MLp^6K1X$kqbYM9oR$q}xZZV$XEI>4`e@bw=tq^6`>1 zr1U^)F{~mamx&-Jnvb}QD1Y$HdJMvNA}TFNX@%{hZMVtp3x93hKq4MaOZIpUSpt|z zLtY>LNXlClp3GMi*#vwf=tc3?xvZH{5OVwUv6`DhkVl^+Akq!%jub##jTA=_R#!G0 z*@Is&GYewgAxMEGBwNtprRaErr9xCXB?aDrw?Qmu9fRf-Or_0Q(SKny9B(x(&LIdW zFoKyHOeM%6Qniq6G}42y%Kc!Q#7T~3HsnWK8iJ(Yo~VTucAgr5Al0MMK#D@1B1n)B z>ie)OIHo2cGbHNdvUR+iXSg928d0pTA{wF^%fTdHmW& z8f=5(Q@EOjS`!$bP@G_JRGPl9fpAiXrs4vRC@cmkr1tCB+eftNv>OP~(&r})yrQ6* zT1pWR(Y3Oi6d1xHR$j+}@YX(oz;`0G{f$^SM+cOS;9D&hv453qTds^0*SLQIFQowe z^myy!K;Q2`gutOC@`{bor3Zc?$;LyN_3HxdcheSXc#TZ}sd9LgXaF;JUD8W$JdP{5 z_+FR`nFD^D{PHq*udhbk;zRAHqCVR`B|D_+lqWkd|IhpTbVV@@B3sO*Gq>vM zjXgL7ifiH9#!`oj2Vj_2;x`&jQC33|x@4E;O*(!3u|${R^^ zC*CHB@tSaFB4FjJecCgz*-`qotOWQORqooLV%M;hy80LTYp=}JS}m`=5?8+pT>UF= zb*i}a#eY@Wx?6>7e!g?%bJbt(?Kc1*b2(f>X!qKkY)PLxrYpqUf`$$keG4)4B>w&WkSHDlT=Yw6v9FY_B-eZ3Vwp zPWoCosikt#XUnJmkd=_OLhaT{N9!vI^_p;PC8G}W)*rp==&-*puj{athc>7ni7yGa!=Ehv4u)K+po~GS!JI7O5jWU2$!Pz*N<;~jvwE$ZHeuE zbjz`$zL2kP)uIDHN|o7qC@cOxRTA755`U|HclIejCyE7I1^_0)R!y0KI#h`=XywWqh(?V{GwQ4KhJFLi%au73`P zEedKcqJRL1)KBFHK^I5y&K6K?Runv5t#VPeKq|=kXd*E_Fxu1y{pco5EI&HiVj{ME zg0V)yj$bqGq2OBp`V`-Nyt^MmVfM9h@?icA-e)&Ldh1Qd@Ypx zX$mDbbWFQ;9ZVFHUCc3sAi@m|Lw~ec^fAfUgm&w|=6HB`Ki}IOv_vq_<4zyfZ5WaL zzN6c2PZ>oV^(?LB8Xd_{PK)bJg@gqtyQ8VSkE?$BT4Sv1M76G+Yp?6{&CO~*39;y= zyY&=bL&bhrcUQVkYNzYwaFs)}d!U=PQ*U!r_u+Pf3is;1m6Ku$IR^;EDSy?Cl$mOS z4Bt|d%d!r&&UVDU-r?zYhbO(mB_6x=w&86a?PLCeZt>hbl%So^{UQmyFU&Yy*w<|o zY{dBbEkxb5ZM_lln$5`}77&x*6Kxw+8AjihsbxglGCJ1A^2`emKV>VSOTJ4Ue+TM4 zjuww!#u62`z*9YCoSy<6qK-~g8y@F5yFA^O!p8P6;WPcz?HwUc+Q;5Ha z{1a!u^!NBmi=vaf8Eka|KpS!cPk@#q}s~6Jp&u<$F@QUSDNZ*Pu99Y9JbT zcnjme-jpAX)pwo5mjgxKsg-eexs!EaG#I_fn^W>b9)wsaPB1~U0dOql%X6-Ch5(H6 z>J-Q<&;x=vB}VE5#DB??qtglAE%FsE2#~zetV?yvYT$SmjKir!uqvcz%Dg63x3Va2 zCFlkdiCWs?%C1pSoXDD_BBv^bZM34Hy2uObC}sk450JejA>Op7^4f3(?s4%sMHVfw zx%@n1F+WNz2`^s1UMSvxO#!lTiCHPv;HwUJAg{hif)^in#D9f1uDxMTkb~kr8{Y87 zj9Ybm4Uxe$2d7*DbFq?%v@}3PS*`{*1j9ku*0l{pq)hJx;QQx{rjh(gBAv&O3)^G? zu^s*(-G(f-mmhn!;S2dtZsWG-VVk(GUOTp_?0Unx0+%-|`*no|LP`g#1>vb@kR_!z zQzMlfWo`H^`fK0r$wi-YD$ro5KI?Lf222H#Qc{q1=kVo| zdW?O8M4^tKzZ)PKsK2$YsMV#a!)1{2>_i%oSRF(e++N?J2kqctbz^GFy-qe`fy>9{ zy@4Gpg|UFlYRgLbG3H%ZPSHgPOEMuZ<#p@|g4T?uK~s$Ei7{ewiLI&!ud{mL&Hn*V zO928D02BZK00;o1Yff5{;!kRs1^@solM^2}AERqdT8b42WtSHK03n?K01*HH00000 W000000002alWHF%29zEE0001jhcY+- diff --git a/Solutions/Google Cloud Platform Load Balancer Logs/Package/createUiDefinition.json b/Solutions/Google Cloud Platform Load Balancer Logs/Package/createUiDefinition.json index 185a1011e5..afcd5e797e 100644 --- a/Solutions/Google Cloud Platform Load Balancer Logs/Package/createUiDefinition.json +++ b/Solutions/Google Cloud Platform Load Balancer Logs/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Google%20Cloud%20Platform%20Web%20Application%20Firewall/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe GCP WAF data connector allows you to seamlessly ingest and monitor logs from Google Cloud Platform's Web Application Firewall into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP WAF logs, enabling proactive threat detection and response.\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Google%20Cloud%20Platform%20Load%20Balancer%20Logs/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Google Cloud Platform Load Balancer data connector allows you to seamlessly ingest and monitor logs from Google Cloud Platform's Web Application Firewall into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP WAF logs, enabling proactive threat detection and response.\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -60,7 +60,7 @@ "name": "dataconnectors1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This Solution installs the data connector for Google Cloud Platform Web Application Firewall. You can get Google Cloud Platform Web Application Firewall data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + "text": "This Solution installs the data connector for Google Cloud Platform Load Balancer Logs. You can get Google Cloud Platform Load Balancer Logs data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { diff --git a/Solutions/Google Cloud Platform Load Balancer Logs/Package/mainTemplate.json b/Solutions/Google Cloud Platform Load Balancer Logs/Package/mainTemplate.json index bb26f87a63..bc313877c2 100644 --- a/Solutions/Google Cloud Platform Load Balancer Logs/Package/mainTemplate.json +++ b/Solutions/Google Cloud Platform Load Balancer Logs/Package/mainTemplate.json @@ -3,7 +3,7 @@ "contentVersion": "1.0.0.0", "metadata": { "author": "Microsoft - support@microsoft.com", - "comments": "Solution template for Google Cloud Platform Web Application Firewall" + "comments": "Solution template for Google Cloud Platform Load Balancer Logs" }, "parameters": { "location": { @@ -46,7 +46,7 @@ "variables": { "email": "support@microsoft.com", "_email": "[variables('email')]", - "_solutionName": "Google Cloud Platform Web Application Firewall", + "_solutionName": "Google Cloud Platform Load Balancer Logs", "_solutionVersion": "3.0.0", "solutionId": "azuresentinel.azure-sentinel-solution-gcploadbalancerlogs-api", "_solutionId": "[variables('solutionId')]", @@ -72,7 +72,7 @@ ], "properties": { "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", - "displayName": "GCP Pub/Sub LoadBalancer Logs Test", + "displayName": "GCP Pub/Sub LoadBalancer Logs (Preview)", "contentKind": "DataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", @@ -89,14 +89,14 @@ "properties": { "connectorUiConfig": { "id": "GCPFLoadBalancerLogsCCPDefinition", - "title": "GCP Pub/Sub LoadBalancer Logs Test", + "title": "GCP Pub/Sub LoadBalancer Logs (Preview)", "publisher": "Microsoft", - "descriptionMarkdown": "The Google Cloud Platform (GCP) LoadBalancer logs, enable you to capture network inbound and outbound activity to monitor access and detect potential threats across Google Cloud Platform (GCP) resources.", + "descriptionMarkdown": "Google Cloud Platform (GCP) Load Balancer logs provide detailed insights into network traffic, capturing both inbound and outbound activities. These logs are used for monitoring access patterns and identifying potential security threats across GCP resources. Additionally, these logs also include GCP Web Application Firewall (WAF) logs, enhancing the ability to detect and mitigate risks effectively.", "graphQueriesTableName": "GCPLoadBalancerLogs_CL", "graphQueries": [ { "metricName": "Total events received", - "legend": "GCP Pub/Sub LoadBalancer Logs Test", + "legend": "GCP Pub/Sub LoadBalancer Logs", "baseQuery": "{{graphQueriesTableName}}" } ], @@ -453,14 +453,14 @@ "properties": { "connectorUiConfig": { "id": "GCPFLoadBalancerLogsCCPDefinition", - "title": "GCP Pub/Sub LoadBalancer Logs Test", + "title": "GCP Pub/Sub LoadBalancer Logs (Preview)", "publisher": "Microsoft", - "descriptionMarkdown": "The Google Cloud Platform (GCP) LoadBalancer logs, enable you to capture network inbound and outbound activity to monitor access and detect potential threats across Google Cloud Platform (GCP) resources.", + "descriptionMarkdown": "Google Cloud Platform (GCP) Load Balancer logs provide detailed insights into network traffic, capturing both inbound and outbound activities. These logs are used for monitoring access patterns and identifying potential security threats across GCP resources. Additionally, these logs also include GCP Web Application Firewall (WAF) logs, enhancing the ability to detect and mitigate risks effectively.", "graphQueriesTableName": "GCPLoadBalancerLogs_CL", "graphQueries": [ { "metricName": "Total events received", - "legend": "GCP Pub/Sub LoadBalancer Logs Test", + "legend": "GCP Pub/Sub LoadBalancer Logs", "baseQuery": "{{graphQueriesTableName}}" } ], @@ -593,7 +593,7 @@ ], "properties": { "contentId": "[variables('_dataConnectorContentIdConnections1')]", - "displayName": "GCP Pub/Sub LoadBalancer Logs Test", + "displayName": "GCP Pub/Sub LoadBalancer Logs (Preview)", "contentKind": "ResourcesDataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", @@ -625,7 +625,7 @@ "minLength": 3 }, "connectorDefinitionName": { - "defaultValue": "GCP Pub/Sub LoadBalancer Logs Test", + "defaultValue": "GCP Pub/Sub LoadBalancer Logs (Preview)", "type": "string", "minLength": 1 }, @@ -717,9 +717,9 @@ "version": "3.0.0", "kind": "Solution", "contentSchemaVersion": "3.0.0", - "displayName": "Google Cloud Platform Web Application Firewall", + "displayName": "Google Cloud Platform Load Balancer Logs", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The GCP WAF data connector allows you to seamlessly ingest and monitor logs from Google Cloud Platform's Web Application Firewall into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP WAF logs, enabling proactive threat detection and response.

\n

Data Connectors: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Google Cloud Platform Load Balancer data connector allows you to seamlessly ingest and monitor logs from Google Cloud Platform's Web Application Firewall into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP WAF logs, enabling proactive threat detection and response.

\n

Data Connectors: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -728,7 +728,7 @@ "parentId": "[variables('_solutionId')]", "source": { "kind": "Solution", - "name": "Google Cloud Platform Web Application Firewall", + "name": "Google Cloud Platform Load Balancer Logs", "sourceId": "[variables('_solutionId')]" }, "author": { From 6171dc222f64475f2a298fadb2d4bcc7cbb0bd37 Mon Sep 17 00:00:00 2001 From: v-prasadboke Date: Fri, 21 Feb 2025 16:18:04 +0530 Subject: [PATCH 09/10] Typo error corrected --- .../GCPFLoadBalancerLogs_Definition.json | 10 +++---- .../Package/3.0.0.zip | Bin 8084 -> 8077 bytes .../Package/mainTemplate.json | 26 +++++++++--------- 3 files changed, 18 insertions(+), 18 deletions(-) diff --git a/Solutions/Google Cloud Platform Load Balancer Logs/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json b/Solutions/Google Cloud Platform Load Balancer Logs/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json index 0b2c826df4..690bf20996 100644 --- a/Solutions/Google Cloud Platform Load Balancer Logs/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json +++ b/Solutions/Google Cloud Platform Load Balancer Logs/Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json @@ -7,20 +7,20 @@ "properties": { "connectorUiConfig": { "id": "GCPFLoadBalancerLogsCCPDefinition", - "title": "GCP Pub/Sub LoadBalancer Logs (Preview)", + "title": "GCP Pub/Sub Load Balancer Logs (Preview)", "publisher": "Microsoft", "descriptionMarkdown": "Google Cloud Platform (GCP) Load Balancer logs provide detailed insights into network traffic, capturing both inbound and outbound activities. These logs are used for monitoring access patterns and identifying potential security threats across GCP resources. Additionally, these logs also include GCP Web Application Firewall (WAF) logs, enhancing the ability to detect and mitigate risks effectively.", "graphQueriesTableName": "GCPLoadBalancerLogs_CL", "graphQueries": [ { "metricName": "Total events received", - "legend": "GCP Pub/Sub LoadBalancer Logs", + "legend": "GCP Pub/Sub Load Balancer Logs", "baseQuery": "{{graphQueriesTableName}}" } ], "sampleQueries": [ { - "description": "Get Sample of GCP LoadBalancer Logs", + "description": "Get Sample of GCP Load Balancer Logs", "query": "{{graphQueriesTableName}}\n | take 10" } ], @@ -79,13 +79,13 @@ { "type": "Markdown", "parameters": { - "content": "#### 2. Enable LoadBalancer logs \nIn your GCP account, navigate to the LoadBalancer section. In here you can nevigate to [**Backend Service**] -> [**Edit**], once you are in the [**Backend Service**] on the [**Logging**] section **enable** the checkbox of [**Enable Logs**]. Once you open the rule, switch the toggle button under the **Logs** section to **On**, and save the changes.\n\nFor more information: [Link to documentation](https://cloud.google.com/load-balancing/docs/https/https-logging-monitoring)" + "content": "#### 2. Enable Load Balancer logs \nIn your GCP account, navigate to the Load Balancer section. In here you can nevigate to [**Backend Service**] -> [**Edit**], once you are in the [**Backend Service**] on the [**Logging**] section **enable** the checkbox of [**Enable Logs**]. Once you open the rule, switch the toggle button under the **Logs** section to **On**, and save the changes.\n\nFor more information: [Link to documentation](https://cloud.google.com/load-balancing/docs/https/https-logging-monitoring)" } }, { "type": "Markdown", "parameters": { - "content": "#### 3. Connect new collectors \n To enable GCP LoadBalancer Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect." + "content": "#### 3. Connect new collectors \n To enable GCP Load Balancer Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect." } }, { diff --git a/Solutions/Google Cloud Platform Load Balancer Logs/Package/3.0.0.zip b/Solutions/Google Cloud Platform Load Balancer Logs/Package/3.0.0.zip index 1cf5b09d885d14e94bec79a0da14cb34035673be..96b18e193f92de1f792b5ff5b23c56ee5dc42aeb 100644 GIT binary patch delta 6222 zcmV-U7_sM+KaD>PP)h>@6aWAK2mmaCRk01x1`RBNRa%C(Yp?JZ007C8>jpo6WU9mw zi)1rN$<=NH^DO&l`y~5C9=wXlVwH-rXKW3|Es=RdL`KGyk--oD`Y(*_{F`vE_}tm~ zj_q8fX)L~*Ow^O{+zFi-pYt#sJHKTKAG^_9zY~*(4-Wn`dho~5gM*33;~-j4yK_E| z11II9y`Hf zJe;%Vk>jx+oxllQp5U*U*r5?WD&S%#aR4A-FM$_Cu0z8YkMJ;E#GK}T7HQ&#GXoak z=ZDXEI7_ea_Mmv|@k=KQ(!V-ECi}ffxQMdE<m$ z?UylQuQ~HWk#f)pqq6jWinCvCqvTq|j>|^|%wO2;mG53LUoej+{tc$QOrp7L{``>T z9VB(>=cD>X5gJG=57~{rbwaL9t~cONOt`mu%4d>kBBofH3ByNbZ3G*E4>@rKF%{uw zfW_m0yY$=cu;7}#UGsi-FnG5b_X^4_nAy3l6Uwj6d@KZ@a(94#^VwnO1dG&n1=f-$ zoE5w83|q?&c|gl6c$&plR4Q!z5~FXnic8yp09}78m{Hh_hEdpVj+@A)<q)Fo+Wzhr*v-rDBqARIxi` zWwDYEU1pdaVwIyP3?Yc3VQWXU7u_%~b?8il zeDq$Cm$OunR_z0=sGfvg9Qo9v0?h8DEKkIws?W;r2*OE4P}f^8X#?3MPNEwhR)U!1 zGHRT&d^3!H^?{rDe~LxA7J83?>Mq~gonq&xf680atjd#loGxBX|AyIQH?my!c0YV< zlvmo6JxL-jb3wK;)l%o0SJtL15{BPCpvBxB?uuYn{=(Fno~bp}V_3V(uEwfW1GKhf zO>ea@Adb+ch?e-dbpw3fD4ds7+ly8?l`n@VEv_bimmzh&Kghz5{gP~Y_~79;%9$9& z3BU3AZK)~g>`r^7#7t-0%@RLdrV--Y$}Mr4)a)@2 zJ@G0m)-x0l5p0nb5*p@r+-tanG>(l0ONQ>d0yFRh089O{ zVIg0C=z*7&>RPhBL_{K^4;#x_)@8Q)tfGCTcO*M$NRDRvSJ(7-Ze-O^HZV7HaGRghCmJLW|{PG z^x#j8GAZwJ2jN%&w*XEw%(AI4$p^UBEPRxIi8Pw~zY)nAn%Q<}nZ*>mfAInOr9W$K zhnBv#mf2V*tDgoN@7pp$*);G4oT17ZSsIsosuxaj?M1ht-8b0-WP=(=@;LNyaK@p5{eBuQ$LV@AW+mL1$Rk!=a_ItF_y#^*MjlOOEL#3`BUL_r%=L5iM@IvyKZOdfOe7rWB7O&dQq^J@ z&p6@~a!eLoN@iLM?_XEq{5E92GqTdz!GkT}PxAX5;(sIDjry}MPz#eFf<(5+sph9Y zcf(x8gwFjrf5t=7Q4k!Dm@|v^4jx_&&_HDKIn?QIsuBBv&7JpqmG%P+RQfSv`XYox zAwNnsA8diR&JBd8mJBu>Lp+#&I%y^j{+&%8J11Acf2=I_ zbND$l{3#tbkS2IdlxL-eQtu`F*9^MFvuJ}Fyn1XSmh+%mYiHrY8tUGE+(2~FWkvEn z4oUko$#~1q6i6f@bZY706ry8OGApF)wQh_Ser$R1ZjC)g2TMsN0Xa)~ypb?1jnUG- zb&RSpudP4wA(AL~65jj>rP`vmW$&hwLVIIGkj|v`qY3|jA9gTCm>%bLF-F!4R09-be?)D)$-s<0xIVG8-3Fi|y;aJQ`Rbo#-=Se>D#2g`9ZrDHH+@Kd2f0u+ysu=D6$=D;0bZn6`bRaU z#Y^6X$6=xIwE7t0p#Dbr|JcPcgQU_EaSJ6Y&{w)37yyxfln~*SqT8GO{T~slhC>a- zDz(%8{yR2$L@%Bopn<=J4ADo`n~X}$kBn!wx8YM6Ad(o;PLmt#yFyHQkqdnsrYhYi7mqH5yv8#b z|B^zI^#4emjsyJ(x`~Nwto}t1QqpBq#G-7z;6Djxe=}xUCxG*AA;9FRCG>+-ViCla zT=(W+hE!+EIT{EFB7Al&*ARiX>cE;GhKyvKR(r~S?IQAVbK$B+)qQvX0PTv5@LxcA?;R^ZI;Ih4Xw~p_>{BWsV?LnO$y`8|AoPmmcR6l{< zFh^s>*~~$2XES-$)dpuIpkr~E`NE{%8>HNxi1e>?Kx!dWd9z`vX z^>C|ylFMZ~1aBO{1S6}H(iIrArZLt!1+bDTr}wJwxYBph6@8W8!C^t!Bna)LJ4Bne zvIFk6r*-04+sKBMja;lo#&X`q|-s_? zGUuAxuhe;nzj9~(n7aWb#)dQr|y&;@bRmU!3ilHbeFmfvNV6c*cPl)+&cRk!#ShtjmM6$nWN$+*vduC@C>&9O z6*3mPIlsxXi3wr5won4Op-H>KH_PM(HxF;c!Cf`HjlxfH9%jYao<>00r&YPM>n#hr z*pd=zi)f#;omkfKkz5uEiU$4stFm@~)fK4UnRG`zR?cvJHP|B=FcRw;2qdP$bXgo^j?+B82T0mcG2P@nERaUOJ7TV<`0@3>;6q8D9&Q z|B?i)jq$!1 zS>oH=T+w1M{0lbLAu=1&=4P3Bo$ow->{8vj71?9<+=Wg&xFG#97~-Jg)=4}xC+DfH z|7G6tg3exaf4zCjVxihi3#khqv;`SnIPy}Ht#y_J7jq}pga1zyT3h~qhIhpE%7!Ug z8LP&U;S6DqEMc6c<_?raQJJjQjuuRlYO!7(YYsIuTrz8l5^e07cTMYUa?KAObal;F zgp5;l8KOTQJV2c_OPZw3`kc&{dZK*F&~;QqA<7Oij9d1S|GT2b>;j zr>`?o$Dv2J2awf+>|(4U^2_8QCz+45j3n^OwI!tS#B^qm)(YE4yV)kYFZ}a+8nK*~ z?THL&0+dX{ULQUsRl2I<~d<$kb@qc|fo8~G8JB|(yNPuN0>W}fPSAXV3> zCq<#W2-u6@fh?HFVp0FW*oXzD7_k|CI9QxWXbc^kt&_EQRCoB*>xVN=X z7wLMHUQ|!6cYN|tQ(tR>@tH#t^p47MEUYJ-w9}N|;gLmu(vU*heDi(#h%N{1dP1~_ z`6&Z0FAk@dQXYty>R(n0^kEU}sAErfo0x#_S&`cQM$ChwJxWK!R*OY!W!sipBl%74 zpAe;#pr0OZog5VV?THXHv_f99aV6Ef53_#NLHpgbg&y8u<0Dm$ZWHxj=B`S5*%*)G zN-jQ?$B=b@Ihe>UFa7tGVjLz;DYEH^rek}2JR1+;q|NE}lfHgFWMUywKG$)cp>l21 z9|M`%udm{(#Q!VgP&$cwwJ2*S>DJF3k8hun9ny6Q&kpAQ`Q|ZQSxkee7E=|>t%iCd z7fztO8NO{S&5>~r4D(9<<^*Gs)ks2D?6Q2B&fI{1EYNl62C$$DB^1!6C?7c{h-P`2 zD#JqYD?mf>M7onpy#)!2{FGePhtaqZ2Z2v96hx@3sX+oZ3+&r(TREBKKTG|~%e51$ z+G9W0^Pn5rSju267sGqk)cfU{N!mM`R|aHxX+Y22xHMoTdv>`#;5r%jOZ5Zo1@8vU z#9JqSG2RgFOdeR-s=02M*la1|ThuoEjH-~WQGKl6s$-j%E^Mzd)>{9sy{gz|)x_>v zMXXcxu&-6a{voS|-K|>KiYj5tISU(A1-nBvu+6G~RaI~m;}zAumQmhHb+5Zs^=iYX zrFxe=g&4tyQ!-RnKa?3A&|f zSv^(B+Ne5K$EsNCRKr?X1#5Nns}5DKR#v-O<)FN4;oa3$td{w9b=4}%{m4zKRCOwI z@U<${7hILm)~Zdbt0HYQ;mWE^9p(0 zqk7VIt0viFzF%0Cq+Y&pv$87E-D<&DsvvDt{b+-#M{U)PDu;s2)s0qFHR@i?s4|(Q zdeN$?Me9^6TB}OY`qhal=(JTMYNeUYLe-(|R~uTd%FyOY;7j~Onx^{KPosT~ zpGIri5`BCU&9bk)kZ+^ajtM|eovVAOsu(}fa=htqtol{pCxA{CKyDZStVFGrg`4f0 z!v*O}A0Gc>P1e;8w(447SGsNo;Dglw(+LEn>>lec5}5NDxm(tN-agKMebatj z$n$RZ2IyHSI9mU>_iA|Sy|)AQH!Hw)mu>0Jpl|*Gy6v)i;|JocP&cRTG}}n6C9#&^ z@Z7}y<-a-{O^2e*#UTg)nbN9bA{6e(-!+{tE>}uCp3gH`jzKBQ`e-uY-!HYP5Bkwg znn-;fxW!y-`%Gqyf*rp*y@9fSZvp62e4F#`F%6B`*NV`+#X7_$%dyq^&uz70SNU&E zUA`88ZXn9n0??nP0Q8cMY1gj3iDI@(xwAT}k_;E)ER{B4vvtrEgm`#A-$d@U^fBmh zrw<@6nUb4*>$u&XDixwB$xvEv`2e66T=n4#v%WY<1~Z8e?65C#rSrTvOg; zbFNp@N{U50-5Y)R8Y;~$yS;*cT=TJ)hpV{K_JMBOeBb3!?Jn*bmHYKQGAqS2auyJB zU)7FOIrD}XzNOY!!#dPDHzW4-ZqjCVlaf1JPHMK^*1V-;;>};s?WDUOE0}=vW~T}p zUj(v-vv1lcxOCpP*+SHR!`zKU4B9Ur6gPirsnJb&9V<`t%2y$NO6O9Gd>=ph9*R8* zXOCV+DgW;KiT(>9a-{Jh0pyah+oIZMUZ))3(=}g_!jdzWVGRFbnE27#5QG2U-~X4L zsw!vY2JCx>U18`S-tKIYb!b)w35SxZ|NiiSq$~bwD2rc-w)l^Kp{{%~6O&UeF(Y)v zc<#O3d8D5(`RMzJ^QZ#;xxBS7cNRdp0dD6ShXf+ebu<`?>k!#M$T)|l!W8l^rv9WE zC__HQiG;o?iyT0~3|4TcmuWv=CiyrAlP)HA;V&JF(o(=&*`@FQVG;q$4WdE>3(SGN zs&6u>Pw1%&Q!*`owQ-_dVZS^DgDq;vL>jXnGe4k;c#<`i8-R}~on8o&PXsV>#P%S= zpcf?J3XHTzB-rDl(-GZ0@-!|4kh;2UN|LLp=X9M*z)O(~j0{ed^Q7x@=4HGj-7t}? z87{9Tmnx?-ReM$DTSeGhb0^Rjma)ciCeR+pE?7Vn1srvMJ-Pz-F#m3(x?Co|$(R)L zlN3|%(lzs$<{NAk$jU3qSh+z2+ZVpRizW%4f69^yGn$)gfRuVdF3Jo2bd#MDa`n|U zLWb5HLAn@o@q)pOj3C8XtcECwi-V%AZHvhBGqX>yC!TXB3DxHyooR$r*<}`xTjh7w zZODAg`11Y=x`HYFgEs-U0ZpTWH zQhgvjkX@#Nrebo%9Zwj^3JDpBiTc#$1-K>}i<{Zoom<~auQ1PlejC4kyTh(Hsr>x! zM;$Ya?B-1+3#(ffOHxpq@-D?OHqpl2Q;t681fkx45`b1^9`%?Yq~xO{?atxL$MrM! zHPVMVe&DZ%6rs)Sc1^7=bt^9YM5HImsHFNQ+VuXGVrd5tt6S38@O8447Pxp^zEH43 z#Xe?8xNcY}FQPn*27fv)(#b~bB~Qt+uOQf%2i0rhQFFSCoLph6E8d%2U%dH$P)h*< s6aW+m0000804#!4lL;R}4J?9HT86i4ukaTD0LhbBA2tT_9smFU0BQdz_y7O^ delta 6229 zcmV-b7^>%uKa@WWP)h>@6aWAK2mtPVRIv@w1`Y0gR9YN~sSx)U006p^>jpo6#Z-wS z7RhFklB?YY=2`a9_DS}OJa{LIRVvD!u{9XCMCK6@85vhb20#4kzc9A*Z(?@E7tYRi zZ09OTBJtg1qMnQwPTf(Oai`7Mq4cor`7J283q;NVZA2Y(zrIGDIR^1~&yJLikY zcM?ASn+StH>yOgI{*-{7r^twnM1?pkMJ;AMx5q<7D?;{a|0IP z=LOGsFi)=V_8@=k@=GW6lfOECD*L^Oxd_vE#-GJu8to0nW|nuwv1+u^V~JVpMH;4^ zmtn$E!QCO7rU?r;ce%@wkVTFV%!wDHB)JA@M8bY~t|u9tU4^Odj?i`VBOm?b#O^Fa zw_nDLz2?jdM8ZKQjLMRKE6#qo4dZJOIWs;oVE)2xue{k6^8|Bw?A>6>%Q#%f=FbmV z)tb0PiFxh@7#2j{jT3v$)aONs2a)gjYNj?Be37+#lZ~>s zDeWlrdW2duZu8mO8D&OQfg_cS;ICkls)L%kVL20v*`Ez8Nj^;D$ddHpW zDSga1aw4xjs~WV3WB#UyXtu3SH5=-VhAWTVz1^IWuObeyf$G%#z#jdRi&GwQf{eK^s$>gdCV_=y}%=24&(wIojj%GFsng} zf#LI3%@7!SfY#YIw2{6Rit0(=MxjSNO2F(+it1 zlTqW0<(pxDtPb4F|5Gf|wa|MERG;y^-6?jC`lq-x&8j?EM9K2i^lz9=b|cGmZ}-E; zMtP-8*^@YQ(;3KCq*~%!^U~TBMZ)mg2eg>G!(HL;%3qjT(=)ZEdJJoK+0|IJYJk?Z ztm&;52E-BC6wwktvu=RT8-;USwY_MSQ`vHe!s2Rwav4%*`-3d}$ScUEhYucpqnwFR z6!RO8-xivZ&hE5V3e0rIXKCyu%M89UN!Ail7~0x57qJz+T`*yH-ZVm-S-AyHlbSu^ zfh%4G`C7>5Z}@xAl4id)A&p~W!GfXtF2@Xf0l*Tk zXjsU97kc2jQe8{77l=q?^k8E-%gn$yI$H-2^ZdPM6!lvwhdZjF$M2mJb-@b z&70eyrRT0?HCD;$CH|({wunzU^*sSssI)|u#s!b+g%e-9;cZ~|O!ffSpyHp9x4`uJ zB7Ts-=RpX>(@cP05LO6yLTkp7*txv)Wu9B zPraDmq8rJCK3*RG!ef8 zr78i8XBXm_OB~ZejBjg8CmG;;K3HqC*ge#*}oC$M)%p*r-eljJt9No zRCCjxyJ4>4LFe9rKjQ%@D2RLi!4&G=+(2~F zWks?+4$1l?PI=4F6htHqY3|jA9gTCh#qHl5nE!f zO8v)!8!rw6a{CxW?|+AXDO!x#9kldu`tt9VI&4-1y+o9A8t<2o#i zqsABS_KfpA2XN_B`r3!&b*q0z=7eOD#GFsyfnzZzWr;ljohRAI6LWlUkpXZa!2&LW zR>>rpU>@Fl<$+##;8}R{srldns|;RfV+E^xwMor&gxOITEy)sm?o7GAO%dkH0m;ST zfrA}?{P;U|s3Y2c#@X~B9ppmc%u)KO4*8<+7bD~(c!6BEe0_|hQjQ}@5HxYBl5q9D zy7YYiHF~$}0^L|akGNxd%VzVd!J%ri{h?CB#xj^8z=8n%_-*hucq)TK5<}W&a(jK33rRPeK^q5&N;JxZ zau!r2BLw8oL$Q$M9i%`u4adSAtM2&b)ND$iYsgQSVH?gK@c$D z%IuOOqk#tc6DlQ;cl9qvs8iGgh3+9Q1Z7lcig2a5@4y=BJpS{Iu3~zI2xbYFM9sj&ExxSJuPVtmVz! z&OP;iC~ASM$6BQ%F5BsMQlLX z1an7Vbn2iL8f>jjCv`Qbq10lGtj-$_^WRbmH+0cDdQ zw3qG>YTn8YxZ9rA8E0)H8&)=Qu^blP`COELBT_-D$A*uOPCM$S|A2n#q?ar?Z>Mkx zdQAi&5DQi!K;KLOEaKpKGz3o?DT!o%yFYIRloknLw#YFtV7HY6e2 zEK|h65hYk5W3ijFD?FQ+5VrdY1&|w>v@3kGOf&!H;jK8htA@8x_$dyWnmXvMnYu~?US|>%Q`;t$^t=u(V(AyRo1S$`}8}L?x@QOx(7KPupk7#kO}We zsQ2hzp~+y7_cWqV9wne}-od;XjOD3-$omw;M0vKt3z`B}25~+sC#d{@DYO{dt15@V zF#EOGEEAH0;d7s<}gP{)oo;xwlD^CicP?PV9G#FrP~&m9y>*Uz8nneR4F#gsiL2};PB^NTjN5Ltj8I0x?0;)gRJ#m zV!yR9-sdAre4CpqS`3DN!Nxj7Qe)EGEH$sQou^M-%3HT2d(57@&{+o;q+bR@oO9ed zv5V&9Jhk<|%vxU1(Tnb{H*Zlal)Gsmb>V@wAj1ns-e$73PGkRK;Y50W@c#(|Ys=s8 zj<{agFnKFu)mW07A?%SLjHA@dfwCwnlknQnf@xAM)>~uEp@xRrWld3{ja~Du8NE%e z`N4y(uK9|PaiXq4^yi}osqb&%kek~k?GeAVvZ7bI;Hz_8OPamKSgbiP!>$>`=X7#P zxvO;k1!a#DxFlY(TPII{y=K!T(+8Ed^DmnxvKm9X>CgdPbqjDkWGe^NOwY;Gq}xZZ zWY2WK>9KbDIwN%)xO8y4;PLK;s@rv+)Puzj?fZL<5q zKf9t4$!Xc1NRcH#nKbP6;Zs6hU-y`)d_|c}AO@0N4&B61g+DTXLT;Zvjpk+_xGimAvCXK zDr45l4uk%9t8Q`jK|qNSW~wojB!^7ZBDOI|_r@ysgKZQ>DVf>GkGL!dl8k$T7Fsm( zR1X9xyGA`J3gtzAFfU?`>ta_3N=+hWh_vUjb-b)TTptTfC{|aI3{it+Z<4R%6ZW)r z%8}C72}SQHX{WU(WVF}YI~Mo0pZZ6n;L`Vm4f*42A!oQRd?@75*M6ZZZ1;o)q5wT% zf#|`#t%bTp*Q@lRLUO(1lZBf4S`&=V9GakaRO+#?o^aBCPE&S)M^;Be3TgAD_w6HE z58CyFXdd%Z23}SbPA{cA5HV%HtQ6?OBGysIp71s?0nfD}wf&8l1xI_7j)<-1i`dGx zEmuaeYurB}N-04EJwDE8YEA!ulYyk_H4L5e=i`c((*cheSnc!Q0HR5`jz)PtG3 zD(PioJdR6$x%gBWLzd)VBE7uy-k0idm^h_Krz4t%?)i|3rAYWf z$9aazwNZZzWNN>@hp!U z$T2}Q%S}}U7K&d18j2^60oUn-+tT5$t?a^ z=wDo}ok$fO`?;D2-O$ET0IOaF?_E>xmun_z?`&QYkYzOi-Py)90ZZAl^}>MbWZ>5d z2ihxt-3^+Fw@zZbA>5ffu(FkL-7vA)QolDZYWNw|A6ujDSikkgHm_OOUSF)W@Lzj9 zvCZm;-LZaHr@CQZ>xKP8)(g8^ov;=4!Rjds8`T5bybjoA^}osrxQy_MI$w2+w^7&Y zZuPv{&}pgLWzRQRqfXa9Tz#%KVzt-dve(~#YOlLhsT$g?&Q^VKy4KZdL$I}eR;RjI zjn_c8R41#a`dAy)#p+lOYn?h+E9+mau6xy?-qp%FSF5~}cP+fTx_(uiZ&%l=vRsbb zq&`)r5(i)FQGLPnsJ_;r`oil_b-cvXE|fadnd&BrKD)Y7o$5)gsv~8+uG6hZ5lZj~(tS zcHD3Mq&4a$ZMR;MJ=*())ko^(voFMCjHUk3Ms<%isCU#>=csfX*j(3WRXwBb zb&N`rS?U(8s#mm5ouaks6RlsDsDw^`TOFd7`a|_l#un-gZNJXYdi8}iR{~$+SJ5=p zzkUtvbNm`w)0XJrD`=K&^@V&6t#U*Fdg>(ILsh)^i5BBc=VImW06zhAvhH!i0N^BQ zRhMnHuMFp;FMMkJj}=i@J*C0iIfnDml9e@v315Bq6l&gEJze8ZoX5?mnSp$0e zIQLEabs^8X-5a21g}`X_bKa}rt@hpy*x#%Gdsa84JA=OQH|Ms??TufAw*uXquG4HG zwU)xF!Qswg`?vn8a5SBVHW!5;0Awnwj)+jOBYW3$v{8r}!G@-6I+rv#*t)dy904O_pP;b)Va6 z#IEw*n!0=~{Mon*DT4+zHZ!ZPZf$%nps-QPg>HVtQOas5(zUd4Q0!qafAlg;_;=q=^j`pxBZC*|AD5Ka7FNFPI^_VLuJ?)rmYlf-WB3=tM33GE z82tbK{=e*0RW~a(VBb6J3PbL$fl-HI!8S_lFN8UGZOkLs|Svw8ei6b>)+} zn4EHn8KEo23-|5LBmIQQN8eAJM#- z1TZqh_8`Nc7bM|wjI>82*yE$q5#2g+H7*2@y0UFbk*jLwbdO8GOOXtWqNtE}2i21RQlOx&-$y`&^{D zRVF{h80Yho6jSih_42vq8*CNG$}7rOxj_Ki6P~_=CJCN>z>*3wnk#F7lzKug%8UGT zgPn45^_?|BhSnTGx(IXeoWYEYAjO%lhA4=OgS@S6i^$_Mvrn)mo^vM-)K?&#X^1S@ zIt$3H@;mE)He|N-+;G-3d?q#WE#7vd*e3qV*Q%RTc(q|wp{pCDn{`D4DZ9PJoQZf= zAWQ7rj+G##xM=b?$wx`r zox_)pt4Ho@BoB4`uwM@eLYv#|np$1zRa|HRIm(heS$x1_P*t7I!I zaQ?V>mtcpAe9Vz;-LO(_NNE@i{&ZHHla1I*o{(i [**Edit**], once you are in the [**Backend Service**] on the [**Logging**] section **enable** the checkbox of [**Enable Logs**]. Once you open the rule, switch the toggle button under the **Logs** section to **On**, and save the changes.\n\nFor more information: [Link to documentation](https://cloud.google.com/load-balancing/docs/https/https-logging-monitoring)" + "content": "#### 2. Enable Load Balancer logs \nIn your GCP account, navigate to the Load Balancer section. In here you can nevigate to [**Backend Service**] -> [**Edit**], once you are in the [**Backend Service**] on the [**Logging**] section **enable** the checkbox of [**Enable Logs**]. Once you open the rule, switch the toggle button under the **Logs** section to **On**, and save the changes.\n\nFor more information: [Link to documentation](https://cloud.google.com/load-balancing/docs/https/https-logging-monitoring)" } }, { "type": "Markdown", "parameters": { - "content": "#### 3. Connect new collectors \n To enable GCP LoadBalancer Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect." + "content": "#### 3. Connect new collectors \n To enable GCP Load Balancer Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect." } }, { @@ -453,20 +453,20 @@ "properties": { "connectorUiConfig": { "id": "GCPFLoadBalancerLogsCCPDefinition", - "title": "GCP Pub/Sub LoadBalancer Logs (Preview)", + "title": "GCP Pub/Sub Load Balancer Logs (Preview)", "publisher": "Microsoft", "descriptionMarkdown": "Google Cloud Platform (GCP) Load Balancer logs provide detailed insights into network traffic, capturing both inbound and outbound activities. These logs are used for monitoring access patterns and identifying potential security threats across GCP resources. Additionally, these logs also include GCP Web Application Firewall (WAF) logs, enhancing the ability to detect and mitigate risks effectively.", "graphQueriesTableName": "GCPLoadBalancerLogs_CL", "graphQueries": [ { "metricName": "Total events received", - "legend": "GCP Pub/Sub LoadBalancer Logs", + "legend": "GCP Pub/Sub Load Balancer Logs", "baseQuery": "{{graphQueriesTableName}}" } ], "sampleQueries": [ { - "description": "Get Sample of GCP LoadBalancer Logs", + "description": "Get Sample of GCP Load Balancer Logs", "query": "{{graphQueriesTableName}}\n | take 10" } ], @@ -525,13 +525,13 @@ { "type": "Markdown", "parameters": { - "content": "#### 2. Enable LoadBalancer logs \nIn your GCP account, navigate to the LoadBalancer section. In here you can nevigate to [**Backend Service**] -> [**Edit**], once you are in the [**Backend Service**] on the [**Logging**] section **enable** the checkbox of [**Enable Logs**]. Once you open the rule, switch the toggle button under the **Logs** section to **On**, and save the changes.\n\nFor more information: [Link to documentation](https://cloud.google.com/load-balancing/docs/https/https-logging-monitoring)" + "content": "#### 2. Enable Load Balancer logs \nIn your GCP account, navigate to the Load Balancer section. In here you can nevigate to [**Backend Service**] -> [**Edit**], once you are in the [**Backend Service**] on the [**Logging**] section **enable** the checkbox of [**Enable Logs**]. Once you open the rule, switch the toggle button under the **Logs** section to **On**, and save the changes.\n\nFor more information: [Link to documentation](https://cloud.google.com/load-balancing/docs/https/https-logging-monitoring)" } }, { "type": "Markdown", "parameters": { - "content": "#### 3. Connect new collectors \n To enable GCP LoadBalancer Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect." + "content": "#### 3. Connect new collectors \n To enable GCP Load Balancer Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect." } }, { @@ -593,7 +593,7 @@ ], "properties": { "contentId": "[variables('_dataConnectorContentIdConnections1')]", - "displayName": "GCP Pub/Sub LoadBalancer Logs (Preview)", + "displayName": "GCP Pub/Sub Load Balancer Logs (Preview)", "contentKind": "ResourcesDataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", @@ -625,7 +625,7 @@ "minLength": 3 }, "connectorDefinitionName": { - "defaultValue": "GCP Pub/Sub LoadBalancer Logs (Preview)", + "defaultValue": "GCP Pub/Sub Load Balancer Logs (Preview)", "type": "string", "minLength": 1 }, From 4b5e3e4caae66486b6d3f586863e2027e4d5c557 Mon Sep 17 00:00:00 2001 From: v-prasadboke Date: Mon, 24 Feb 2025 12:06:41 +0530 Subject: [PATCH 10/10] Naming convention --- .../Data/Solution_GCPWAF.json | 2 +- .../Package/3.0.0.zip | Bin 8077 -> 8068 bytes .../Package/createUiDefinition.json | 2 +- .../Package/mainTemplate.json | 2 +- 4 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Solutions/Google Cloud Platform Load Balancer Logs/Data/Solution_GCPWAF.json b/Solutions/Google Cloud Platform Load Balancer Logs/Data/Solution_GCPWAF.json index 0924c2b141..c890ae352a 100644 --- a/Solutions/Google Cloud Platform Load Balancer Logs/Data/Solution_GCPWAF.json +++ b/Solutions/Google Cloud Platform Load Balancer Logs/Data/Solution_GCPWAF.json @@ -2,7 +2,7 @@ "Name": "Google Cloud Platform Load Balancer Logs", "Author": "Microsoft - support@microsoft.com", "Logo": "", - "Description": "The Google Cloud Platform Load Balancer data connector allows you to seamlessly ingest and monitor logs from Google Cloud Platform's Web Application Firewall into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP WAF logs, enabling proactive threat detection and response.", + "Description": "The Google Cloud Platform Load Balancer data connector allows you to seamlessly ingest and monitor logs from GCP's Pub/Sub Load Balancer logs into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP Load Balancer logs, enabling proactive threat detection and response.", "Data Connectors": [ "Data Connectors/GCPFLoadBalancerLogs_GCP_CCP/GCPFLoadBalancerLogs_Definition.json" ], diff --git a/Solutions/Google Cloud Platform Load Balancer Logs/Package/3.0.0.zip b/Solutions/Google Cloud Platform Load Balancer Logs/Package/3.0.0.zip index 96b18e193f92de1f792b5ff5b23c56ee5dc42aeb..c955098a6b941787bd0dd63f98f38f20cb3aee0f 100644 GIT binary patch delta 7861 zcmV;m9!lYjKZHLUP)h>@6aWAK2mq^KSXwN(Q>vB*001x&000-09v>Q!H5vxU3Zz?* zWRX=N0+FYYcq@O-M*HDGcsMBx-bq|VQ-i|c&#z8!A#>@Z&coNGa`H_U{$_Rl#USvu zmLg9S8n*RX#ztGcaN)7n-O*4B-=VRjh=qH`>gz%nk)b0YlK8+!bQtS=A=AwP9ZCCE zz85B;!-Y^5gZ5@Ftc*Kv`@;lnY-HhT%iqZ?1#9AGvo?P_My$eAx@9>pEgG`uI76Hp zA4&E1Y~zWKU%Hygkb zWx90j^Yd9g%lGzv)DDmK_TXHhun43a4LA*MiLlU0>6Oe=nBzhl1eseWl;RVp#m5DXQ2iLc`UgaRIExTTdTf(i4 zZ0%JOmG#n<@E8g-P7qExFPu7Qq479?Vmq_hc0zwc_KF;WDnRhzK@%KsXwU=(iEsi4 zC^^PX8z2pOWnryL)^AZ{3awRZQlFxAKurRfrZys3f`^5L(HWdh&xaPy%XxHJ&hHuU zQZgrPZCgQ8m=Io+QaPZ~a-FvYV5$>JxwZ78aj^|#G@YK0gDOXx2y9st+Bgd*(~AkU z5hj1N?+hR(GX!TuZdrry=??&NTbc@q!g)^&#whRTRf{oQxpkE%GDNLisRZgq^3m%6 zC+6fOq1=F`{>+4e-%B)WE~mFdsi0ujppd9Tq?NI*-+|A0EOPROs3=B$HXHkzG*$k> zd<|(05kfpM&yoTlZ{bc_IhTsXeZsv4s?C3nig3{6GwUdf7O~^^-I9rp0(0aNhsD)4 zXbZB69#wmLC!B}27?%6}fN!qPP?(&sK~NNPUAi6B+-e0+-AzA?;Sbo>(zfg4FSpH< z=y+VQa7~)FoOfBX!>4pf3MfZ0o*R89lZvmeyAsfy20yhmc-@YlsI}a+`p}C)y`q0o z5qH{XrOmA^M2t2n8taju3FIzH!qOw!dMf5x-##Wxv?XINx!}$obOmoV4`d8J)cmY}G>SLFxP?Y{D(5unIc|#a?D%aP zO4lp5F1*O5EG?|VW0M^hk~+#6t@>|it*#_TF}Px`SP)ebNVxwu;HfwZIVL70PVPmW z1Mo>83Q^RnnDlfL?<9T~V(r(dUvSJwVV=6>sF%diIOGV&!T$KBr@|mnoOOS@K(f@l z(hN>tUiFbli;-J;i)5eRG3qua8Inmb>~zCZ8|Zsc$Vt7DJv-b#+@I`!JJ~-NlEb^I z8$4FU)e{Ri)fvsf@WkligvNJIT8TL-7T=AALea@mD~geYE`5DKblTuC6eMIZ;q_uA zl>)_e*EtR7_U#TL?0IkHz;GPiv3LNr z+!&rc=XuBLjU73CMjB0hN0sMEUZ3s6-Q(%mQY-JTsx9KLf~^X9?+xFYEnGzxCFUg157r{>lu zVRdYy0enN1&4$aAhxhkZ-n^c&?(!BN!Y}oz#bfEIZ`B)MUTsx7R@JrvLpWX#rXTvm z384BCr0vBoSbh=XuH}E`?ngyTzxi-VOPTn^kbJ22kIjb>e=3E&>DeK?`?!5-ttaIA z?ZN+DYc{g$qKo{kt*~~I)8bQB@x|62wU=lzpb%%$`YS0~=f~q_J-FiG)iCW136+RMHKI2x;AF-tes1 zm~Y)>2JNx4XV@l&9=mpT%fWT?FzShH<{-=Lu-1%qpHupa{`><_O9KQH000080IOhF zT51S_NAMQ_0K=2(20wqrREZ-N$!3z0tKA0XS@zNPN%o68cqfZhD$1U*H5j)<<`EGY z8COOIKm6;zFt+n=Vs^zB&dzsi=PF4e@!e#io{Sex;LQ1g2g%s^Esgnj7B2KVF?sml z;7_9me;hqHn7BOh!zHyl=Zna95#AcY+y@@z-4J(1;%uaFG)`01&Vj!1KeI zL&N8f@Gx0MoaTQPN$dr40~X=u1VZu_u-65N%2@5!PxyzD}MUD{6i5H_Jxdv%O!hU(K zCmEexg{kk3&~@}9AN}OS?kq&NU&f5R=FAI3!a*mD%94L8&VIQK<7*K)Gd?n4{=#mr zyxA4=1ao=p-C)YgI9$l)&ktGFK~k4~KB`|7p@Bqw$Zqtl5^`;Fy#a?}!oA&7K9@`r zGR4wN7(Oy1 z8HLSh7=`WTxQTRH9DNhCd`BdEBJw@_TNn)pdf2bK6Uip)Vp$xCdF}=n7DV2S6MN3o z=S7JJk?;9xrZyRTk+pl1jk32ZAMWO8?Od3BrP+UDr?X_PjZn}k-{d-lmP$7`cIlne zUqVwsX|s{}b7Y#1<}>Vi$DQgaeatv=BCkHH8nlRG{-%g%wyjS!8|sdRE05j1-JFuI zA`Y>FK^*@$5Z?SM5tD4AirpbAij{2WBE#$us~m+v06`SSM@J`BrJJKtZmCrCv70@4 z%rAevz$0J|hPxwoHrgGgf%j|5)&ANm z5Pl6rK&c`Vwsu5&(GBxLht5REM(-7QIZGL7)!x^N>Pg^6p+`MR!0b+n@8%z9#1YyQ(GowiZh+4lg>zlCy=awF*>Z@&;%a|# z8B%BagDm{WE6ApY4<3G_oQY8s^Ba%f7MhaI?zC45%yhnmyuyD_#ZpTFB>b_`f-TZQLc{#d z>>6$%jbmfMf}#5^#|(S{z!I-$Sjc}Ddf>WJT}!qXh)87gU}HJU%)mH0VJGQya+XdT z%nG)5qPT8Q8bibNvlmFn9v6WrHH3W=7%nQ~b`Sn_72LwMdeen%OLVJwydTRiOSWO< zU4s-cKP8H6b5n0@2vo3cmPrps5B}6Bld>*%5RN5qbKpe7ESn0GY=CRc!bg9pNWz8p z8@;LNxB|fl5{eBuQ_p{wAW+mL0e4Aw z7npEPF_zd9*MjlOOEL#Myh=LnCa*8 zkB$bEe{vOGnn*a%Mf`sbq^iU)o^iw}<2sPJRP^h5xOLVlENKG*_rof`;GEg5V&hIoH4agtP&;_8(ap3o`+ zjV>XscvHKwAyd_MBzl)e5R)LQv&mu`BjG1Ulx#?K&~P_GL0>OCK{ks;XUkSbmY-KN`4VY2X+EUA*k z215!4Hdp&+CJlACmo9iBjL7CJ9T$-CNMq@Dv~ej2t}R9wW>FaWjnDPwlCuaN-*`A? zf$a&CHDR|NjM?I*g?TpzdKx0=8hw0Lgk?-vp7R*CG1=I90>KVXjx#Wi4`1NFPQqqn zvEn5?EZBdlZ=QPr%24pA$b4Tf^I^>PQV~miO;01Es z^7S#2O1X|CLD0mhO2XCq>eBQ5*XZ4@3v^=zJz|gTEt}1+28;d#(h{SsYL56Mt%}k9 zpNu`SNXHgALkA)=&GvB2o&o`&zqm8Izn`g4I!WA@6-3JX(>8mB&oVg}PAg+{64 zIfb2&z>{EjM1ka1;+RN{lFbZE_xE1~`}-|JrHGAfFhh_9Vfyjg;BD|!28bkvwA17U z`z{xgZa9NJ4ic4al!?a~g}ladlR*&}f0W0fY`)+>31@#ZW?CnJ^KK!)jyOwK+z*~7>%@0FHGES>K<#rU8)-bXJ_kDs$V8E5-B}YaB z4fQ9~OQ6ZK7*XPNR;O=(QAxtT>xF=Ldcp{?zd=`IV@us;2q;?~ZutVgg}%bUBMe(F)w z0$C5YO1WINL-59ti~Fvrqsox6bv0x#i69NqyGah_>C_)uAzF1n)|lLIJ<(#eOFR64y^eaEG~ldkBi{0_;B&)P;dtZd|BIWoTUxhO|ugjUZEA0M4|)KC8b{nSY>SyJCl;S=-RVQHFC3&$0x$lI(5BMYdU{2!$g` zutLUSH)l6_HZdV=*A@yOe>XH~SNLX`X8z5?TXAq#4R53HQ=Ercaki%skoIX+F70~D z!Y;O?gvuh?Cv7K|b$le31%jeMKmV$%U3CTOcP8CYmlbpm(mY^62!0{+-jh)8(Y->G z!65HxM4>!QK;OKBc{3Qxg8`BEDTs;kY=svz1*{C>d{)j;`2kaCe=)XKRStt;_G__O zCL{;L=Sr{Pt-d^=72RNXtSy23m9Y&5LmmA+cVZk_o+z+hri&?$^VS6dji=W3gW-{b zSTHOjk8Hyq8VNj}726DkPbiW%%YW)Yh%36 zN0#_DH&?V64F7_Sb%@Nyq`6sYUS~T`AG?&dZb|l-J$IoKe-AE5zYK;r=(u%a7tP6e zYU_WQwY;FS7u{cP-lAA2chf@Z!UJtVh8K>!)MRU&#{R{^iS*$A69(3nzu_Hmy|Q8Q zR>rEaWH>|EBTE>kshI<1QB)@DwW9^oq*|<($C^V84VTQCqC^|J=3Uczn_TmQ2VGtB z6(Qq9U54n-e@72e-`~U`H+N3jBYtb8Mz3_iSEsv{G<%D&SaV>8U9*VK>FAWwSLyr< z${t5>NxWpYPM&|wrc0(zDsAUqHcw44K? z?euj<>Ns%e_5iYakX?*bM1Gk(a)S$()Z7Mf73t|A$t2Fu<*7Cl7j}|3 z=BEt2tT>!rN_ik+s()E2(1%5=qmDh{ZDInRYej1N8!-!x_9z_@Tg?}-m2F#Yjbt~u ze}6)hQi6VZymfL=?6)UE(9jBb&Bmov^FGY_RR`^N(-wMogN=t&Il4{MgPFT3>1AU) zj!U`tR31atB?dnOtqM*U~W0o z8_wVa%A4Wa#?l-a_rNf(MclEWT)h+K8(hVI0$@-p&&wKO$`#Tsc+wY+ser-{#oc>e_XDe zNYx(uxta&v(8f{*t6mK6T~qIuYbI&$Y+f0VWu*b#*~X;-OWCva`he?X;MeL0+6&$d znu)hgV!R>TnLMzvRdd}ivDs3_H?M8@8C4-$qxx9CRmV0jUD#e_thN4MdsVT`s)^mT zidd)WVPC6;{Xn>qRRz04HL%U9fR$Bn8RHezzUnA%rMlPMs(Q8I z(^9?5o^rBAwXT1-DqU^FYOls+ufo+{eXCMFv|F{U`r>r0uGNNMYZa|d)w3FJf^Ml= zR!>#3HmZ)*u`1R&)v#7p!CGDYszcSQmDR3RIVkU1cz1Obt2*DVu3BZee;>I?m8wo< z4!%~U`hu%ceXU0Ig;%5Mc#o-FD0Qed)lC$AcGaaiRh3#*P0D&>r(5-?E>)wpvW)Gu zbGohI*D6q7t3b6@f%Zhn+*bs--zrLL zR8QJ&)g*h&_Y13%)XO(+e^ypSx?3$6OBJMzsvm7o^{B1dQRz^yxw_G+sz%+b8I>lp zR4-apwP>AcMQc?lTE99`37xiTL@iZ_>d}lXR2|xWwW0N@3~jCizQj+YX{vwyG}`C* zX|$#-(Z?szEc@yU`8HbRm;eOTxw?m{it!UI$D0nv%3lS30_bD`f8>S%z)IArF5GP2 z9L`B!`0)52E3&S7QiHk6w^i2yyVP|%03WOdm`)%lW%pQrk-(hK$lbCA^!9P?oA&EM zo^`u7K+g)n(dx&&SHoNFy&bT>SpoK}ZcBFtee(~{ZI|5}KM-$)x;bs9*+yzDiB*Hc zoyGPq|5f2=Iuva#e-1$a$dpzc6QOWN_O9uCv0f?hc(F)jIR>RHtE0(;f3MJ{I_O6` zX+rgR;1+YS?K7Db3U>VN^ajel1)xvyZO*&LG&E*kD?;}c>kykP$5!hyXLVL387{_IDr~}Lf9s$r2=VZKzKPsx>0{92 zP9H$7nUb4*>$u&XDio(Qv$U3>wB$xvEv`2u5@w+64#v%WY<1~Z8e?52s&wsKQ{H5A zu2<7aibXr!8-4i-D$Opty@G#K@v-Z}m0W52K(}qaZ+%p|i@QeUetnP3N->R`1%%93 zwIfx`ydj2ff2lRrunv{Z&4_)yo3z>8r1%b(lbWr!HE$`Ic=H!@JL&Gn3ML@E*{Q^xUgsvDb z+_yWA^b;l@eLry?mB2rjw-y%85=b||?OfxKKxDa&219WjAR7o7=g?G`LjJ|npELty z$R{|Ff6!NDkpn20!3qv_o%V}5$;TO(bTPRLf9Y71mICI=E`9$GlL%OD5Ea5-Vh-$8 zeUnLjLQh?ol4+?>al672iiJXwPqIS20r-~E=Y=r&Lzp&0WDhb6 zdO#8?$3S~Pf;~Pu9noDQSHn&`rmkw666C7Ne>q*>67WhS!y;o-kbrA(YagevQZ4P;IW_Ad6!*lM$f%*`nGYyd>TW1EjNq%SD zhRimd8_t@B&*VkEx!XIu@a$F z8AuOgm!_bpm|Stk6-K5)HilxNKC*cMf369~;%5GK=hkzRE6nqs-$w7>?yxIP%0B!1 zQODdOyJ1txzv|Y-k`C0SwhIxAP4sa0WTVeHHK@1LpH(?WJ*EaJNhwLYbNKRc^|XDB z#G#I#_Uj=zXmg8QQ>#nGic2pR$%!&2sq%?7y1%6;+QGx}mNeFTm28Ct&L0=AOcLx+ znU6VAts7R#4JiYo!IRF)bFvY8$rG~aO9(b*K=qn()SM_ICs)|&TK6W)7jOO_P)h*< z6aW+e000O8t6*4KEV)yvmIeR-Fp~@)I3KHESXycbf=BQd006_D000pH0000000000 T00000%adatBnIjp00000-LWP$ delta 7882 zcmV;*9yQ^FKaD>ZP)h>@6aWAK2mmaCRa#HkTg;yZ001_T7dQsZ3Zz?*W|37P0#V12 zcq@OMjrPNX@NiNXyp_0$rUr$>pI@HfLgvy*orkYV<>Z?z{LSk8i$UOREk&LvG;HgY zjE%N>;lg9DyQ85NzC~k65exT>)vpU-M23!pNa6z@(P6Cfg-kaGbR_Lt`CgcW4i`dM z4B9tyVP)L8?GF>Qv5|$VEq^Do6s(D#%-VnK7_kad>6YcZv}nkp;|y_bd?eN1lh<@8 zb5xPRg^iXd5*tz8$lvHpr`krT)~Ui@6+MLZHk}PtGI2|?^Uc@AyV(GiDAT2DpP$b1 zS-!XTqjq?-w+H76g+(CcXuxT3ON511O0Q&|!W|rwD%IOF0j(grtI~o3A+mU{y3dMY$AMJE3?t5kMgU-{i)JrLjRsC;mEm+ex7N; zC(ncud5p%Nq&BMUd-GwIjM-UWZ!ecfL1ki1@xj$iu2(roYs;>e;)ZZ*BU^jbL}k5n zB|L@#jT3}Z&I_kbT4+2DpxDlAww-^_ki8;@pb8Ltc+dm~92zu%K_Z+00!ogt(*{U` zURhY{lJ#2@nL=yTn$)Lg9Z-`%rm2lcmf&GwVRW|J(9ptLoWpTZC>aZ1zZcTricF9; z(%!ZiG=&P`St*qR66LyY3&2z-R03=1N8@rE*l0RE9|u*=HWAsfD70}FPNshs6KX3= z>R8wzCo=?RL~dDwchUxcxh+kFOyRsI24j@Bbk$-^uiU!I8yTWjuT%ncC;3cpJ9 zB-9(w)UTOP@Oz17&E@r$DEAcX8Wa+hh_o`+^*iu2h(%7`5H-cf&t_v^lcvgFn6DwN zAwwNNOtho`$XmFTR?ekjai4#1uik;zX4ChRLC(g6>)Me z>KuSi0uhIzUd5!Ro7g7t8xd>2O8uH+Mhf%PEl0g1j>aKJI1YdI$Jad-28r0L+Xa%P z=EY`k`uwtwOj?iJ(px0^1dma-ImwVrf?=l{9@{|Qi$YH7#q7!9{^9;)|J%v_!H^u@ zRo&pBDy|+`z^Tq?8iprE7bi5td(ukGQL*@LG!%+XmReDaEcDvf2Sle09zsDv7871F zR+7f4;=1dc#&mysyMqY(A0c6BAkw_ByBi0SH$qX#eE~C3j4D8ms`eNS`wcK0hqo*q zKrJ_hCr^3G@seXlPM?uRQ@^9i^Zc&QcH(bL0wd`#^LqU79n~lrewbA`pAC*?gJD2a zgPFe-z;HGQW&`iZ?zbO@q`HUf8r!t7B-1<$wtA$iF){Q=qa0y{dlb=eu0TCgsTg?s6 znvMC^U1rc8J9~z0V(77Jcefl|H4men$Yu_*%nobKSob-lzv$0DP)h>@6aWAK2mmaC zRa%C(Yp?JZ007C8;s!r|WU9mwi)1rN$<=NH^DO&l`y~5C9=wXlVwH-rXKW3|Es=Rd zL`KGyk--oD`Y(*_{F`vE_}tm~j_q8fX)L~*Ow^O{+zFi-pYt#sJHKTKAG^_9zY~*( z4-Wn`dho~5gM*33;~-j4yK_E|11II9y`HfJe;%Vk>jx+oxllQp5U*U*r5?WD&S%#aR4A-FM$_C zu0z8YkMJ;E#GK}T7HQ&#GXoak=ZDXEI7_ea_Mmv|@k=KQ(!V-ECi}ffxQMdE<m$?UylQuQ~HWk#f)pqq6jWinCvCqvTq|j>|^|%wO2; zmG53LUoej+{tc$QOrp7L{``>T9VB(>=cD>X5gJG=57~{rbwaL9t~cONOt`mu%4d>k zBBofH3ByNbZ3G*E4>@rKF%{uwfW_m0yY$=cu;7}#UGsi-FnG5b_X^4_nAy3l6Uwj6 zd@KZ@a(94#^VwnO1dG&n1=f-$oE5w83|q?&c|gl6c$&plR4Q!z5~FXnic8yp09}78 zm{Hh_hEdpVj+@A)<q)Fo+Wzhr*v-rDBqARIxi`WwDYEU1pdaVwIyP3?Yc3VQWXU7u_%~b?8ileDq$Cm$OunR_z0=sGfvg9Qo9v0?h8DEKkIws?W;r z2*OE4P}f^8X#?3MPNEwhR)U!1GHRT&d^3!H^?{rDe~LxA7J83?>Mq~gonq&xf680a ztjd#loGxBX|AyIQH?my!c0YVea@Adb+ch?e-dbpw3fD4ds7+ly8?l`n@VEv_bi zmmzh&Kghz5{gP~Y_~79;%9$9&3BU3AZK)~g>`r^7#7t-0%@RLdrV--Y$}Mr4)a)@2J@G0m)-x0l5p0nb5*p@r z+-tanG>(l0ONQ>d0yFRh089O{VIg0C=z*7&>RPhBL_{K^4;#x_)@8Q)tfGCTcO*M$NRDRvSJ(7 z-Ze-O^HZV7HaGRghCmJLW|{PG^x#j8GAZwJ2jN%&w*XEw%(AI4$p^UBEPRxIi8Pw~ zzY)nAn%Q<}nZ*>mfAInOr9W$KhnBv#mf2V*tDgoN@7pp$*);G4oT17ZSsIsosuxaj z?M1ht-8b0-WP=(=@;LNyaK@p5{eBuQ$LV@AW+mL1$Rk! z=a_ItF_y#^*MjlOOEL#3`BUL_r%=L5i zM@IvyKZOdfOe7rWB7O&dQq^J@&p6@~a!eLoN@iLM?_XEq{5E92GqTdz!GkT}PxAX5 z;(sIDjry}MPz#eFf<(5+sph9Ycf(x8gwFjrf5t=7Q4k!Dm@|v^4jx_&&_HDKIn?QI zsuBBv&7JpqmG%P+RQfSv`XYoxAwNnsA8diR&JBd8mJBu>Lp+#&I%y^j{+&%8J11Acf2=I_bND$l{3#tbkS2IdlxL-eQtu`F*9^MFvuJ}Fyn1XS zmh+%mYiHrY8tUGE+(2~FWkvEn4oUko$#~1q6i6f@bZY706ry8OGApF)wQh_Ser$R1 zZjC)g2TMsN0Xa)~ypb?1jnUG-b&RSpudP4wA(AL~65jj>rP`vmW$&hwLVIIGkj|v` zqY3|jA9gTCm>%bLF-F!4R09-be?)D)$-s<0xIVG8-3Fi|y;aJQ`Rbo#- z=Se>D#2g`9ZrDHH+@Kd2f0u+ysu=D6 z$=D;0bZn6`bRaU#Y^6X$6=xIwE7t0p#Dbr|JcPcgQU_EaSJ6Y&{w)3 z7yyxfln~*SqT8GO{T~slhC>a-Dz(%8{yR2$L@%Bopn<=J4ADo`n~X}$kBn!wx8YM6Ad(o;PLmt# zyFyHQkqdnsrYhYi7mqH5yv8#b|B^zI^#4emjsyJ(x`~Nwto}t1QqpBq#G-7z;6Djx ze=}xUCxG*AA;9FRCG>+-ViClaT=(W+hE!+EIT{EFB7Al&*ARiX>cE;GhKyvKR(r~S z?IQAVbK$B+)qQvX0PTv5@LxcA?;R^ZI;Ih4Xw~p_> z{BWsV?LnO$y`8|AoPmmcR6l{*~~$2XES-$)dpuIpkr~E`NE{%8>HNxi1e>?Kx!dWd9z`vX^>C|ylFMZ~1aBO{1S6}H(iIrArZLt!1+bDTr}wJw zxYBph6@8W8!C^t!Bna)LJ4BnevIFk6r*-04+sKBMja;lo#&X`q|-s_?GUuAxuhe;nzj9~(n7aWb#)dQr|y&;@bRmU!3ilHbeFmfvNV6c*cPl)+&cRk! z#ShtjmM6$nWN$+*vduC@C>&9O6*3mPIlsxXi3wr5won4Op-H>KH_PM(HxF;c!Cf`H zjlxfH9%jYao<>00r&YPM>n#hr*pd=zi)f#;omkfKkz5uEiU$4stFm@~)fK4UnRG`z zR?cvJHP|B=FcRw;2qdP$bXgo^j?+B82T0mcG2P z@nERaUOJ7TV<`0@3>;6q8D9&Q|B?i)jq$!1S>oH=T+w1M{0lbLAu=1&=4P3Bo$ow->{8vj71?9< z+=Wg&xFG#97~-Jg)=4}xC+DfH|7G6tg3exaf4zCjVxihi3#khqv;`SnIPy}Ht#y_J z7jq}pga1zyT3h~qhIhpE%7!Ug8LP&U;S6DqEMc6c<_?raQJJjQjuuRlYO!7(YYsIu zTrz8l5^e07cTMYUa?KAObal;Fgp5;l8KOTQJV2c_OPZw3`kc&{dZK z*F&~;QqA<7Oij9d1S|GT2b>;jr>`?o$Dv2J2awf+>|(4U^2_8QCz+45j3n^OwI!tS z#B^qm)(YE4yV)kYFZ}a+8nK*~?THL&0+dX{ULQUsRl2I<~d<$kb@qc|fo z8~G8JB|(yNPuN0>W}fPSAXV3>Cq<#W2-u6@fh?HFVp0FW*oXzD7_k|CI z9QxWXbc^kt&_EQRCoB*>xVN=X7wLMHUQ|!6cYN|tQ(tR>@tH#t^p47MEUYJ-w9}N| z;gLmu(vU*heDi(#h%N{1dP1~_`6&Z0FAk@dQXYty>R(n0^kEU}sAErfo0x#_S&`cQ zM$ChwJxWK!R*OY!W!sipBl%74pAe;#pr0OZog5VV?THXHv_f99aV6Ef53_#NLHpgb zg&y8u<0Dm$ZWHxj=B`S5*%*)GN-jQ?$B=b@Ihe>UFa7tGVjLz;DYEH^rek}2JR1+; zq|NE}lfHgFWMUywKG$)cp>l219|M`%udm{(#Q!VgP&$cwwJ2*S>DJF3k8hun9ny6Q z&kpAQ`Q|ZQSxkee7E=|>t%iCd7fztO8NO{S&5>~r4D(9<<^*Gs)ks2D?6Q2B&fI{1 zEYNl62C$$DB^1!6C?7c{h-P`2D#JqYD?mf>M7onpy#)!2{FGePhtaqZ2Z2v96hx@3 zsX+oZ3+&r(TREBKKTG|~%e51$+G9W0^Pn5rSju267sGqk)cfU{N!mM`R|aHxX+Y22 zxHMoTdv>`#;5r%jOZ5Zo1@8vU#9JqSG2RgFOdeR-s=02M*la1|ThuoEjH-~WQGKl6 zs$-j%E^Mzd)>{9sy{gz|)x_>vMXXcxu&-6a{voS|-K|>KiYj5tISU(A1-nBvu+6G~ zRaI~m;}zAumQmhHb+5Zs^=iYXrFxe=g&4tyQ!-RnKa?3A&|fSv^(B+Ne5K$EsNCRKr?X1#5Nns}5DKR#v-O<)FN4 z;oa3$td{w9b=4}%{m4zKRCOwI@U<${7hILm)~Zdbt0HYQ z;mWE^9p(0qk7VIt0viFzF%0Cq+Y&pv$87E-D<&DsvvDt{b+-# zM{U)PDu;s2)s0qFHR@i?s4|(QdeN$?Me9^6TB}OY`qhal=(JTMYNeUYLe-(| zR~uTd%FyOY;7j~Onx^{KPosT~pGIri5`BCU&9bk)kZ+^ajtM|eovVAOsu(}fa=htq ztol{pCxA{CKyDZStVFGrg`4f0!v*O}A0Gc>P1e;8w(447SGsNo;Dglw(+LEn z>>lec5}5NDxm(tN-agKMebatj$n$RZ2IyHSI9mU>_iA|Sy|)AQH!Hw)mu>0Jpl|*G zy6v)i;|JocP&cRTG}}n6C9#&^@Z7}y<-a-{O^2e*#UTg)nbN9bA{6e(-!+{tE>}uC zp3gH`jzKBQ`e-uY-!HYP5Bkwgnn-;fxW!y-`%Gqyf*rp*y@9fSZvp62e4F#`F%6B` z*NV`+#X7_$%dyq^&uz70SNU&EUA`88ZXn9n0??nP0Q8cMY1gj3iDI@(xwAT}k_;E) zER{B4vvtrEgm`#A-$d@U^fBmhrw<@6nUb4*>$u&XDixwB$xvEv`2e66T=n z4#v%WY<1~Z8e?65C#rSrTvOg;bFNp@N{U50-5Y)R8Y;~$yS;*cT=TJ)hpV{K_JMBO zeBb3!?Jn*bmHYKQGAqS2auyJBU)7FOIrD}XzNOY!!#dPDHzW4-ZqjCVlaf1JPHMK^ z*1V-;;>};s?WDUOE0}=vW~T}pUj(v-vv1lcxOCpP*+SHR!`zKU4B9Ur6gPirsnJb& z9V<`t%2y$NO6O9Gd>=ph9*R8*XOCV+DgW;KiT(>9a-{Jh0pyah+oIZMUZ))3(=}g_ z!jdzWVGRFbnE27#5QG2U-~X4Lsw!vY2JCx>U18`S-tKIYb!b)w35SxZ|NiiSq$~bw zD2rc-w)l^Kp{{%~6O&UeF(Y)vc<#O3d8D5(`RMzJ^QZ#;xxBS7cNRdp0dD6ShXf+e zbu<`?>k!#M$T)|l!W8l^rv9WEC__HQiG;o?iyT0~3|4TcmuWv=CiyrAlP)HA;V&JF z(o(=&*`@FQVG;q$4WdE>3(SGNs&6u>Pw1%&Q!*`owQ-_dVZS^DgDq;vL>jXnGe4k; zc#<`i8-R}~on8o&PXsV>#P%S=pcf?J3XHTzB-rDl(-GZ0@-!|4kh;2UN|LLp=X9M* zz)O(~j0{ed^Q7x@=4HGj-7t}?87{9Tmnx?-ReM$DTSeGhb0^Rjma)ciCeR+pE?7Vn z1srvMJ-Pz-F#m3(x?Co|$(R)LlN3|%(lzs$<{NAk$jU3qSh+z2+ZVpRizW%4f69^y zGn$)gfRuVdF3Jo2bd#MDa`n|ULWb5HLAn@o@q)pOj3C8XtcECwi-V%AZHvhBGqX>y zC!TXB3DxHyooR$r*<}`xTjh7wZODAg`11Y=x`HYFgEs-U0ZpTWHQhgvjkX@#Nrebo%9Zwj^3JDpBiTc#$1-K>}i<{Zo zom<~auQ1PlejC4kyTh(Hsr>x!M;$Ya?B-1+3#(ffOHxpq@-D?OHqpl2Q;t681fkx4 z5`b1^9`%?Yq~xO{?atxL$MrM!HPVMVe&DZ%6rs)Sc1^7=bt^9YM5HImsHFNQ+VuXG zVrd5tt6S38@O8447Pxp^zEH43#Xe?8xNcY}FQPn*27fv)(#b~bB~Qt+uOQf%2i0rh zQFFSCoLph6E8d%2U%dH$P)h*<6aW+w0000804#!4T2I+q%%27T05+2YA2=T@f>m0E ow`;HP7XSdso&W$50000000000000000MwIOA0!6z9smFU02eM~9RL6T diff --git a/Solutions/Google Cloud Platform Load Balancer Logs/Package/createUiDefinition.json b/Solutions/Google Cloud Platform Load Balancer Logs/Package/createUiDefinition.json index afcd5e797e..d2372b1b60 100644 --- a/Solutions/Google Cloud Platform Load Balancer Logs/Package/createUiDefinition.json +++ b/Solutions/Google Cloud Platform Load Balancer Logs/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Google%20Cloud%20Platform%20Load%20Balancer%20Logs/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Google Cloud Platform Load Balancer data connector allows you to seamlessly ingest and monitor logs from Google Cloud Platform's Web Application Firewall into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP WAF logs, enabling proactive threat detection and response.\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Google%20Cloud%20Platform%20Load%20Balancer%20Logs/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Google Cloud Platform Load Balancer data connector allows you to seamlessly ingest and monitor logs from GCP's Pub/Sub Load Balancer logs into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP Load Balancer logs, enabling proactive threat detection and response.\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", diff --git a/Solutions/Google Cloud Platform Load Balancer Logs/Package/mainTemplate.json b/Solutions/Google Cloud Platform Load Balancer Logs/Package/mainTemplate.json index c52c3dd76f..d431790290 100644 --- a/Solutions/Google Cloud Platform Load Balancer Logs/Package/mainTemplate.json +++ b/Solutions/Google Cloud Platform Load Balancer Logs/Package/mainTemplate.json @@ -719,7 +719,7 @@ "contentSchemaVersion": "3.0.0", "displayName": "Google Cloud Platform Load Balancer Logs", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Google Cloud Platform Load Balancer data connector allows you to seamlessly ingest and monitor logs from Google Cloud Platform's Web Application Firewall into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP WAF logs, enabling proactive threat detection and response.

\n

Data Connectors: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Google Cloud Platform Load Balancer data connector allows you to seamlessly ingest and monitor logs from GCP's Pub/Sub Load Balancer logs into Microsoft Sentinel. Built on the Microsoft Sentinel Codeless Connector Platform (CCP), this connector supports DCR-based ingestion time transformations, ensuring that the received security data is parsed in destination tables for optimal query performance. By leveraging this connector, you can enhance your security operations by gaining comprehensive visibility into your GCP Load Balancer logs, enabling proactive threat detection and response.

\n

Data Connectors: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]",