Skip to content

Fix correctness S360: Support tip and taxii lookback #13156

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
erich-wang merged 2 commits into from
Feb 25, 2021
Merged

Fix correctness S360: Support tip and taxii lookback #13156

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b1414a6
Support tip and taxii lookback
hunngu-ms Feb 25, 2021
94e6dbb
Prettier
hunngu-ms Feb 25, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 51 additions & 6 deletions ...ource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1788,6 +1788,12 @@
"Creates or updates an Office365 data connector.": {
"$ref": "./examples/dataConnectors/CreateOfficeDataConnetor.json"
},
"Creates or updates a Threat Intelligence Taxii data connector.": {
"$ref": "./examples/dataConnectors/CreateThreatIntelligenceTaxiiDataConnector.json"
},
"Creates or updates an Threat Intelligence Platform data connector.": {
"$ref": "./examples/dataConnectors/CreateThreatIntelligenceDataConnector.json"
},
"Creates or updates a Dynamics365 data connector.": {
"$ref": "./examples/dataConnectors/CreateDynamics365DataConnetor.json"
}
Expand Down Expand Up @@ -11173,13 +11179,18 @@
"type": "object"
},
"TIDataConnectorProperties": {
"allOf": [
{
"$ref": "#/definitions/DataConnectorTenantId"
}
],
"description": "Threat Intelligence Platforms data connector properties.",
"description": "TI (Threat Intelligence) data connector properties.",
"properties": {
"tenantId": {
"description": "The tenant id to connect to, and get the data from.",
"type": "string"
},
"tipLookbackPeriod": {
"description": "The lookback period for the feed to be imported.",
"format": "date-time",
"type": "string",
"x-nullable": true
},
"dataTypes": {
"$ref": "#/definitions/TIDataConnectorDataTypes",
"description": "The available data types for the connector."
Expand Down Expand Up @@ -11278,6 +11289,40 @@
"description": "The password for the TAXII server.",
"type": "string"
},
"taxiiLookbackPeriod": {
"description": "The lookback period for the TAXII server.",
"format": "date-time",
"type": "string",
"x-nullable": true
},
"pollingFrequency": {
"description": "The polling frequency for the TAXII server.",
"type": "string",
"x-nullable": true,
"enum": [
"OnceAMinute",
"OnceAnHour",
"OnceADay"
],
"x-ms-enum": {
"modelAsString": true,
"name": "PollingFrequency",
"values": [
{
"description": "Once a minute",
"value": "OnceAMinute"
},
{
"description": "Once an hour",
"value": "OnceAnHour"
},
{
"description": "Once a day",
"value": "OnceADay"
}
]
}
},
"dataTypes": {
"$ref": "#/definitions/TiTaxiiDataConnectorDataTypes",
"description": "The available data types for Threat Intelligence TAXII data connector."
Expand Down
60 changes: 60 additions & 0 deletions ...iew/2019-01-01-preview/examples/dataConnectors/CreateThreatIntelligenceDataConnector.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,60 @@
{
"parameters": {
"api-version": "2019-01-01-preview",
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
"resourceGroupName": "myRg",
"workspaceName": "myWorkspace",
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
"dataConnectorId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"dataConnector": {
"kind": "ThreatIntelligence",
"properties": {
"tenantId": "06b3ccb8-1384-4bcc-aec7-852f6d57161b",
"tipLookbackPeriod": "2020-01-01T13:00:30.123Z",
"dataTypes": {
"indicators": {
"state": "Enabled"
}
}
}
}
},
"responses": {
"200": {
"body": {
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"type": "Microsoft.SecurityInsights/dataConnectors",
"kind": "ThreatIntelligence",
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
"properties": {
"tenantId": "06b3ccb8-1384-4bcc-aec7-852f6d57161b",
"tipLookbackPeriod": "2020-01-01T13:00:30.123Z",
"dataTypes": {
"indicators": {
"state": "Enabled"
}
}
}
}
},
"201": {
"body": {
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"type": "Microsoft.SecurityInsights/dataConnectors",
"kind": "ThreatIntelligence",
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
"properties": {
"tenantId": "06b3ccb8-1384-4bcc-aec7-852f6d57161b",
"tipLookbackPeriod": "2020-01-01T13:00:30.123Z",
"dataTypes": {
"indicators": {
"state": "Enabled"
}
}
}
}
}
}
}
82 changes: 82 additions & 0 deletions ...019-01-01-preview/examples/dataConnectors/CreateThreatIntelligenceTaxiiDataConnector.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,82 @@
{
"parameters": {
"api-version": "2019-01-01-preview",
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
"resourceGroupName": "myRg",
"workspaceName": "myWorkspace",
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
"dataConnectorId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"dataConnector": {
"etag": "d12423f6-a60b-4ca5-88c0-feb1a182d0f0",
"kind": "ThreatIntelligenceTaxii",
"properties": {
"tenantId": "06b3ccb8-1384-4bcc-aec7-852f6d57161b",
"taxiiServer": "https://limo.anomali.com/api/v1/taxii2/feeds",
"collectionId": "135",
"workspaceId": "dd124572-4962-4495-9bd2-9dade12314b4",
"friendlyName": "testTaxii",
"userName": "--",
"password": "--",
"taxiiLookbackPeriod": "2020-01-01T13:00:30.123Z",
"pollingFrequency": "OnceADay",
"dataTypes": {
"taxiiClient": {
"state": "Enabled"
}
}
}
}
},
"responses": {
"200": {
"body": {
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"type": "Microsoft.SecurityInsights/dataConnectors",
"etag": "d12423f6-a60b-4ca5-88c0-feb1a182d0f0",
"kind": "ThreatIntelligenceTaxii",
"properties": {
"tenantId": "06b3ccb8-1384-4bcc-aec7-852f6d57161b",
"taxiiServer": "https://limo.anomali.com/api/v1/taxii2/feeds",
"collectionId": "135",
"workspaceId": "28e5f051-34cb-4208-9037-693e5342a871",
"friendlyName": "testTaxii",
"userName": null,
"password": null,
"taxiiLookbackPeriod": "2020-01-01T13:00:30.123Z",
"pollingFrequency": "OnceADay",
"dataTypes": {
"taxiiClient": {
"state": "Enabled"
}
}
}
}
},
"201": {
"body": {
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"type": "Microsoft.SecurityInsights/dataConnectors",
"etag": "d12423f6-a60b-4ca5-88c0-feb1a182d0f0",
"kind": "ThreatIntelligenceTaxii",
"properties": {
"tenantId": "06b3ccb8-1384-4bcc-aec7-852f6d57161b",
"taxiiServer": "https://limo.anomali.com/api/v1/taxii2/feeds",
"collectionId": "135",
"workspaceId": "28e5f051-34cb-4208-9037-693e5342a871",
"friendlyName": "testTaxii",
"userName": null,
"password": null,
"taxiiLookbackPeriod": "2020-01-01T13:00:30.123Z",
"pollingFrequency": "OnceADay",
"dataTypes": {
"taxiiClient": {
"state": "Enabled"
}
}
}
}
}
}
}
1 change: 1 addition & 0 deletions ...nsights/preview/2019-01-01-preview/examples/dataConnectors/GetThreatIntelligenceById.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
"properties": {
"tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
"tipLookbackPeriod": "2020-01-01T13:00:30.123Z",
"dataTypes": {
"indicators": {
"state": "Enabled"
Expand Down
2 changes: 2 additions & 0 deletions ...ts/preview/2019-01-01-preview/examples/dataConnectors/GetThreatIntelligenceTaxiiById.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,8 @@
"collectionId": "e0b1f32d-1188-48f7-a7a3-de71924e4b5e",
"userName": "",
"password": "",
"taxiiLookbackPeriod": "2020-01-01T13:00:30.123Z",
"pollingFrequency": "OnceADay",
"dataTypes": {
"taxiiClient": {
"state": "Enabled"
Expand Down
9 changes: 9 additions & 0 deletions ...ights/resource-manager/Microsoft.SecurityInsights/stable/2020-01-01/SecurityInsights.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -848,6 +848,9 @@
"x-ms-examples": {
"Creates or updates an Office365 data connector.": {
"$ref": "./examples/dataConnectors/CreateOfficeDataConnetor.json"
},
"Creates or updates an Threat Intelligence Platform data connector.": {
"$ref": "./examples/dataConnectors/CreateThreatIntelligenceDataConnector.json"
}
},
"tags": [
Expand Down Expand Up @@ -3338,6 +3341,12 @@
"description": "The tenant id to connect to, and get the data from.",
"type": "string"
},
"tipLookbackPeriod": {
"description": "The lookback period for the feed to be imported.",
"format": "date-time",
"type": "string",
"x-nullable": true
},
"dataTypes": {
"$ref": "#/definitions/TIDataConnectorDataTypes",
"description": "The available data types for the connector."
Expand Down
60 changes: 60 additions & 0 deletions ...ghts/stable/2020-01-01/examples/dataConnectors/CreateThreatIntelligenceDataConnector.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,60 @@
{
"parameters": {
"api-version": "2020-01-01",
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
"resourceGroupName": "myRg",
"workspaceName": "myWorkspace",
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
"dataConnectorId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"dataConnector": {
"kind": "ThreatIntelligence",
"properties": {
"tenantId": "06b3ccb8-1384-4bcc-aec7-852f6d57161b",
"tipLookbackPeriod": "2020-01-01T13:00:30.123Z",
"dataTypes": {
"indicators": {
"state": "Enabled"
}
}
}
}
},
"responses": {
"200": {
"body": {
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"type": "Microsoft.SecurityInsights/dataConnectors",
"kind": "ThreatIntelligence",
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
"properties": {
"tenantId": "06b3ccb8-1384-4bcc-aec7-852f6d57161b",
"tipLookbackPeriod": "2020-01-01T13:00:30.123Z",
"dataTypes": {
"indicators": {
"state": "Enabled"
}
}
}
}
},
"201": {
"body": {
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"type": "Microsoft.SecurityInsights/dataConnectors",
"kind": "ThreatIntelligence",
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
"properties": {
"tenantId": "06b3ccb8-1384-4bcc-aec7-852f6d57161b",
"tipLookbackPeriod": "2020-01-01T13:00:30.123Z",
"dataTypes": {
"indicators": {
"state": "Enabled"
}
}
}
}
}
}
}
1 change: 1 addition & 0 deletions ...SecurityInsights/stable/2020-01-01/examples/dataConnectors/GetThreatIntelligenceById.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
"properties": {
"tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
"tipLookbackPeriod": "2020-01-01T13:00:30.123Z",
"dataTypes": {
"indicators": {
"state": "Enabled"
Expand Down