Skip to content

Commit 4e7048f

Browse files
ajcollins0ajcollins0
authored
Merge pull request #6 from tanium/validation-fixes
removed the data folder, rebuilt solution including playbook for addC…
2 parents 25d0c65 + c48c566 commit 4e7048f

5 files changed

Lines changed: 368 additions & 171 deletions

File tree

‎Solutions/Tanium/Package/1.0.1.zip‎

626 Bytes
Binary file not shown.

‎Solutions/Tanium/Package/createUiDefinition.json‎

Lines changed: 68 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"config": {
77
"isWizard": false,
88
"basics": {
9-
"description": "<img src=\"https://www.tanium.com/wp-content/themes/main/lib/images/header-logo.svg\">\n\n**Important:** _This Microsoft Sentinel Solution is currently in public preview. This feature is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/)._\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nWIP Sentinel bundle for Tanium\n\nMicrosoft Sentinel Solutions provide a consolidated way to acquire Microsoft Sentinel content like data connectors, workbooks, analytics, and automations in your workspace with a single deployment step.\n\n**Workbooks:** 1, **Analytic Rules:** 1, **Playbooks:** 5\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
9+
"description": "<img src=\"https://www.tanium.com/wp-content/themes/main/lib/images/header-logo.svg\">\n\n**Important:** _This Microsoft Sentinel Solution is currently in public preview. This feature is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/)._\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nWIP Sentinel bundle for Tanium\n\nMicrosoft Sentinel Solutions provide a consolidated way to acquire Microsoft Sentinel content like data connectors, workbooks, analytics, and automations in your workspace with a single deployment step.\n\n**Workbooks:** 1, **Analytic Rules:** 1, **Playbooks:** 6\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
1010
"subscription": {
1111
"resourceProviders": [
1212
"Microsoft.OperationsManagement/solutions",
@@ -148,7 +148,7 @@
148148
"name": "analytic1-text",
149149
"type": "Microsoft.Common.TextBlock",
150150
"options": {
151-
"text": "Alerts from Tanium Thread Response (THR) that can be acted upon by Tanium Sentinel Playbook"
151+
"text": "Alerts from Tanium Threat Response (THR) that can be acted upon by Tanium Sentinel Playbook"
152152
}
153153
}
154154
]
@@ -240,19 +240,57 @@
240240
{
241241
"name": "playbook2",
242242
"type": "Microsoft.Common.Section",
243-
"label": "CollectComplyFindingsTanium",
243+
"label": "AddCommentTanium",
244244
"elements": [
245245
{
246246
"name": "playbook2-text",
247247
"type": "Microsoft.Common.TextBlock",
248248
"options": {
249-
"text": "This playbook uses your Tanium Server to gather Comply failures related to hosts associated with Sentinel Incidents"
249+
"text": "This playbook will add a comment to a Microsoft Sentinel incident."
250250
}
251251
},
252252
{
253253
"name": "playbook2-PlaybookName",
254254
"type": "Microsoft.Common.TextBox",
255255
"label": "Playbook Name",
256+
"defaultValue": "AddCommentTanium",
257+
"toolTip": "Resource name for the logic app playbook. No spaces are allowed",
258+
"constraints": {
259+
"required": true,
260+
"regex": "[a-z0-9A-Z]{1,256}$",
261+
"validationMessage": "Please enter a playbook resource name"
262+
}
263+
},
264+
{
265+
"name": "playbook2-ConnectionName",
266+
"type": "Microsoft.Common.TextBox",
267+
"label": "Connection Name",
268+
"defaultValue": "taniumsentinel",
269+
"toolTip": "Please enter Connection Name",
270+
"constraints": {
271+
"required": true,
272+
"regex": "[a-z0-9A-Z]{1,256}$",
273+
"validationMessage": "Please enter the Connection Name"
274+
}
275+
}
276+
]
277+
},
278+
{
279+
"name": "playbook3",
280+
"type": "Microsoft.Common.Section",
281+
"label": "CollectComplyFindingsTanium",
282+
"elements": [
283+
{
284+
"name": "playbook3-text",
285+
"type": "Microsoft.Common.TextBlock",
286+
"options": {
287+
"text": "This playbook uses your Tanium Server to gather Comply failures related to hosts associated with Sentinel Incidents"
288+
}
289+
},
290+
{
291+
"name": "playbook3-PlaybookName",
292+
"type": "Microsoft.Common.TextBox",
293+
"label": "Playbook Name",
256294
"defaultValue": "CollectComplyFindingsTanium",
257295
"toolTip": "Resource name for the logic app playbook. No spaces are allowed",
258296
"constraints": {
@@ -262,7 +300,7 @@
262300
}
263301
},
264302
{
265-
"name": "playbook2-TaniumServerHost",
303+
"name": "playbook3-TaniumServerHost",
266304
"type": "Microsoft.Common.TextBox",
267305
"label": "Tanium Server Host",
268306
"defaultValue": "[basics('taniumforwarderhostname').value]",
@@ -274,7 +312,7 @@
274312
}
275313
},
276314
{
277-
"name": "playbook2-ForwarderAPIToken",
315+
"name": "playbook3-ForwarderAPIToken",
278316
"type": "Microsoft.Common.TextBox",
279317
"label": "Forwarder API Token",
280318
"defaultValue": "[basics('taniumforwarderapikey').value]",
@@ -286,7 +324,7 @@
286324
}
287325
},
288326
{
289-
"name": "playbook2-ConnectionName",
327+
"name": "playbook3-ConnectionName",
290328
"type": "Microsoft.Common.TextBox",
291329
"label": "Connection Name",
292330
"defaultValue": "taniumsentinel",
@@ -300,19 +338,19 @@
300338
]
301339
},
302340
{
303-
"name": "playbook3",
341+
"name": "playbook4",
304342
"type": "Microsoft.Common.Section",
305343
"label": "CollectDefenderStatusTanium",
306344
"elements": [
307345
{
308-
"name": "playbook3-text",
346+
"name": "playbook4-text",
309347
"type": "Microsoft.Common.TextBlock",
310348
"options": {
311349
"text": "This playbook uses your Tanium Server to gather Defender statuses related to hosts associated with Sentinel Incidents"
312350
}
313351
},
314352
{
315-
"name": "playbook3-PlaybookName",
353+
"name": "playbook4-PlaybookName",
316354
"type": "Microsoft.Common.TextBox",
317355
"label": "Playbook Name",
318356
"defaultValue": "CollectDefenderStatusTanium",
@@ -324,7 +362,7 @@
324362
}
325363
},
326364
{
327-
"name": "playbook3-TaniumServerHost",
365+
"name": "playbook4-TaniumServerHost",
328366
"type": "Microsoft.Common.TextBox",
329367
"label": "Tanium Server Host",
330368
"defaultValue": "[basics('taniumforwarderhostname').value]",
@@ -336,7 +374,7 @@
336374
}
337375
},
338376
{
339-
"name": "playbook3-ForwarderAPIToken",
377+
"name": "playbook4-ForwarderAPIToken",
340378
"type": "Microsoft.Common.TextBox",
341379
"label": "Forwarder API Token",
342380
"defaultValue": "[basics('taniumforwarderapikey').value]",
@@ -348,7 +386,7 @@
348386
}
349387
},
350388
{
351-
"name": "playbook3-ConnectionName",
389+
"name": "playbook4-ConnectionName",
352390
"type": "Microsoft.Common.TextBox",
353391
"label": "Connection Name",
354392
"defaultValue": "taniumsentinel",
@@ -362,19 +400,19 @@
362400
]
363401
},
364402
{
365-
"name": "playbook4",
403+
"name": "playbook5",
366404
"type": "Microsoft.Common.Section",
367405
"label": "CollectSCCMClientStatusTanium",
368406
"elements": [
369407
{
370-
"name": "playbook4-text",
408+
"name": "playbook5-text",
371409
"type": "Microsoft.Common.TextBlock",
372410
"options": {
373411
"text": "This playbook uses your Tanium Server to gather SCCM client statuses related to hosts associated with Sentinel Incidents"
374412
}
375413
},
376414
{
377-
"name": "playbook4-PlaybookName",
415+
"name": "playbook5-PlaybookName",
378416
"type": "Microsoft.Common.TextBox",
379417
"label": "Playbook Name",
380418
"defaultValue": "CollectSCCMClientStatusTanium",
@@ -386,7 +424,7 @@
386424
}
387425
},
388426
{
389-
"name": "playbook4-TaniumServerHost",
427+
"name": "playbook5-TaniumServerHost",
390428
"type": "Microsoft.Common.TextBox",
391429
"label": "Tanium Server Host",
392430
"defaultValue": "[basics('taniumforwarderhostname').value]",
@@ -398,7 +436,7 @@
398436
}
399437
},
400438
{
401-
"name": "playbook4-ForwarderAPIToken",
439+
"name": "playbook5-ForwarderAPIToken",
402440
"type": "Microsoft.Common.TextBox",
403441
"label": "Forwarder API Token",
404442
"defaultValue": "[basics('taniumforwarderapikey').value]",
@@ -410,7 +448,7 @@
410448
}
411449
},
412450
{
413-
"name": "playbook4-ConnectionName",
451+
"name": "playbook5-ConnectionName",
414452
"type": "Microsoft.Common.TextBox",
415453
"label": "Connection Name",
416454
"defaultValue": "taniumsentinel",
@@ -424,19 +462,19 @@
424462
]
425463
},
426464
{
427-
"name": "playbook5",
465+
"name": "playbook6",
428466
"type": "Microsoft.Common.Section",
429467
"label": "QuarantineHostsTanium",
430468
"elements": [
431469
{
432-
"name": "playbook5-text",
470+
"name": "playbook6-text",
433471
"type": "Microsoft.Common.TextBlock",
434472
"options": {
435473
"text": "This playbook uses your Tanium Server to quarantine hosts associated with Sentinel Incidents"
436474
}
437475
},
438476
{
439-
"name": "playbook5-PlaybookName",
477+
"name": "playbook6-PlaybookName",
440478
"type": "Microsoft.Common.TextBox",
441479
"label": "Playbook Name",
442480
"defaultValue": "QuarantineHostsTanium",
@@ -448,7 +486,7 @@
448486
}
449487
},
450488
{
451-
"name": "playbook5-TaniumServerHost",
489+
"name": "playbook6-TaniumServerHost",
452490
"type": "Microsoft.Common.TextBox",
453491
"label": "Tanium Server Host",
454492
"defaultValue": "[basics('taniumforwarderhostname').value]",
@@ -460,7 +498,7 @@
460498
}
461499
},
462500
{
463-
"name": "playbook5-ForwarderAPIToken",
501+
"name": "playbook6-ForwarderAPIToken",
464502
"type": "Microsoft.Common.TextBox",
465503
"label": "Forwarder API Token",
466504
"defaultValue": "[basics('taniumforwarderapikey').value]",
@@ -472,7 +510,7 @@
472510
}
473511
},
474512
{
475-
"name": "playbook5-ConnectionName",
513+
"name": "playbook6-ConnectionName",
476514
"type": "Microsoft.Common.TextBox",
477515
"label": "Connection Name",
478516
"defaultValue": "taniumsentinel",
@@ -498,8 +536,6 @@
498536
"playbook1-ForwarderAPIToken": "[steps('playbooks').playbook1.playbook1-ForwarderAPIToken]",
499537
"playbook1-ConnectionName": "[steps('playbooks').playbook1.playbook1-ConnectionName]",
500538
"playbook2-PlaybookName": "[steps('playbooks').playbook2.playbook2-PlaybookName]",
501-
"playbook2-TaniumServerHost": "[steps('playbooks').playbook2.playbook2-TaniumServerHost]",
502-
"playbook2-ForwarderAPIToken": "[steps('playbooks').playbook2.playbook2-ForwarderAPIToken]",
503539
"playbook2-ConnectionName": "[steps('playbooks').playbook2.playbook2-ConnectionName]",
504540
"playbook3-PlaybookName": "[steps('playbooks').playbook3.playbook3-PlaybookName]",
505541
"playbook3-TaniumServerHost": "[steps('playbooks').playbook3.playbook3-TaniumServerHost]",
@@ -512,7 +548,11 @@
512548
"playbook5-PlaybookName": "[steps('playbooks').playbook5.playbook5-PlaybookName]",
513549
"playbook5-TaniumServerHost": "[steps('playbooks').playbook5.playbook5-TaniumServerHost]",
514550
"playbook5-ForwarderAPIToken": "[steps('playbooks').playbook5.playbook5-ForwarderAPIToken]",
515-
"playbook5-ConnectionName": "[steps('playbooks').playbook5.playbook5-ConnectionName]"
551+
"playbook5-ConnectionName": "[steps('playbooks').playbook5.playbook5-ConnectionName]",
552+
"playbook6-PlaybookName": "[steps('playbooks').playbook6.playbook6-PlaybookName]",
553+
"playbook6-TaniumServerHost": "[steps('playbooks').playbook6.playbook6-TaniumServerHost]",
554+
"playbook6-ForwarderAPIToken": "[steps('playbooks').playbook6.playbook6-ForwarderAPIToken]",
555+
"playbook6-ConnectionName": "[steps('playbooks').playbook6.playbook6-ConnectionName]"
516556
}
517557
}
518558
}

0 commit comments

Comments
 (0)