Skip to content
Merged
Show file tree
Hide file tree
Changes from 46 commits
Commits
Show all changes
47 commits
Select commit Hold shift + click to select a range
b654b8d
Adding resource definition for IoTSecuritySolutionsAnalytics
hagba May 16, 2019
919e914
Fix reference error
May 30, 2019
5465f41
Add reference to iotSecuritySolutionsAnalytics.json
hagba Jun 3, 2019
3a82701
Fix Autorest and swagger errors
hagba Jun 3, 2019
b5861c5
Remove paging from short responses
hagba Jun 3, 2019
fcef8ed
Fix spelling
hagba Jun 3, 2019
5946694
Fix wording of description
hagba Jun 3, 2019
98e881d
Fix paging error
hagba Jun 3, 2019
e7901ca
refix paging
hagba Jun 3, 2019
3adf92a
add Lists support
hagba Jun 3, 2019
1b4c667
Fix example syntax
hagba Jun 3, 2019
9d22d12
fix schema warnings
hagba Jun 4, 2019
c1638fe
fix schema
hagba Jun 4, 2019
9dc526d
fix schema
hagba Jun 4, 2019
907418e
fix alert required properties error
hagba Jun 5, 2019
6fd8c07
add properties level for assitional properties
hagba Jun 6, 2019
d89b8cf
Fix additional proprties issues
hagba Jun 10, 2019
945d474
fix additional properties issues
hagba Jun 10, 2019
795458e
remove required tag
hagba Jun 10, 2019
247ad5a
Fix according to ARM comments
hagba Jun 23, 2019
f23f808
fix errors
hagba Jun 23, 2019
2c17cd5
fix recommendation type example
hagba Jun 23, 2019
6d5d42e
fix dismiss example
hagba Jun 23, 2019
816aa64
required property cannot be readonly
hagba Jun 23, 2019
d54c1a9
remove tags from examples
hagba Jun 23, 2019
7310f4e
fix lists errors
hagba Jun 23, 2019
5e160ee
remove location property
hagba Jun 23, 2019
e510abb
Merge branch 'master' into dev-security-Microsoft.Security-2017-08-01…
Jun 24, 2019
b7c2265
Fixed securitySolution patch swagger
Jun 24, 2019
8ed3334
fix according to ARMs comment
hagba Jun 25, 2019
9527a30
Merge branch 'dev-security-Microsoft.Security-2017-08-01-preview' of …
hagba Jun 25, 2019
da26439
fix unhealthyDeviceCount property name
hagba Jun 25, 2019
6c3fe0a
Fix syntax error
hagba Jun 25, 2019
e22f344
Update specification/security/resource-manager/Microsoft.Security/pre…
hagba Jun 25, 2019
36efcdf
Move remediation steps from alerts to recommendations
hagba Jul 10, 2019
6cfe39a
Move remediation steps from alerts to recommendations
hagba Jul 10, 2019
4debc1e
Merge branch 'dev-security-Microsoft.Security-2017-08-01-preview' of …
hagba Jul 10, 2019
9e1389d
rename mostPrevalentDevices to mostPrevalentDeviceAlerts
hagba Jul 10, 2019
bb462b6
rename mostPrevalentDevices to mostPrevalentDeviceAlerts
hagba Jul 10, 2019
b17efd7
add mostPrevalentDeviceRecommendations
hagba Jul 10, 2019
9bf2206
fix example
hagba Jul 10, 2019
9988c68
fix dismiss
hagba Jul 10, 2019
d1a6204
add severity to prevalent lists
hagba Jul 10, 2019
a240dbd
fix syntax
hagba Jul 10, 2019
d5967c0
fix errors
hagba Jul 11, 2019
cffdbb2
fix enum
hagba Jul 11, 2019
49d63b7
remove dependency
hagba Jul 11, 2019
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -50,5 +50,8 @@
"oav": "oav",
"tsc": "tsc",
"multiapi": "ts-node ./scripts/multiapi.ts"
},
"dependencies": {
Comment thread
hagba marked this conversation as resolved.
Outdated
"autorest": "^2.0.4283"
Comment thread
sergey-shandar marked this conversation as resolved.
Outdated
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -8,12 +8,14 @@
"tags": {
"foo": "bar"
},
"userDefinedResources": {
"query": "where type != \"microsoft.devices/iothubs\" | where name contains \"v2\"",
"querySubscriptions": [
"075423e9-7d33-4166-8bdf-3920b04e3735"
]
}
"properties":{
"userDefinedResources": {
"query": "where type != \"microsoft.devices/iothubs\" | where name contains \"v2\"",
"querySubscriptions": [
"075423e9-7d33-4166-8bdf-3920b04e3735"
]
}
}
}
},
"responses": {
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
{
"parameters": {
"api-version": "2017-08-01-preview",
"subscriptionId": "20ff7fc3-e762-44dd-bd96-b71116dcdc23",
"resourceGroupName": "MyGroup",
"solutionName": "default"
},
"responses": {
"200": {
"body": {
"value": [
{
"id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Fail/2019-02-02",
"name": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Fail/2019-02-02",
"type": "Microsoft.Security/IoTSecurityAggregatedAlert",
"properties": {
"alertType": "IoT_Bruteforce_Fail",
"alertDisplayName": "Failed Bruteforce",
"aggregatedDateUtc": "2019-02-02",
"vendorName": "Microsoft",
"reportedSeverity": "Low",
"remediationSteps": "",
"description": "Multiple unsuccsseful login attempts identified. A Bruteforce attack on the device failed.",
"count": 50,
"effectedResourceType": "IoT Device",
"systemSource": "Devices",
"actionTaken": "Detected",
"logAnalyticsQuery": "SecurityAlert | where tolower(ResourceId) == tolower('/subscriptions/b77ec8a9-04ed-48d2-a87a-e5887b978ba6/resourceGroups/IoT-Solution-DemoEnv/providers/Microsoft.Devices/IotHubs/rtogm-hub') and tolower(AlertName) == tolower('Custom Alert - number of device to cloud messages in MQTT protocol is not in the allowed range') | extend DeviceId=parse_json(ExtendedProperties)['DeviceId'] | project DeviceId, TimeGenerated, DisplayName, AlertSeverity, Description, RemediationSteps, ExtendedProperties"
}
},
{
"id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Success/2019-02-02",
"name": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Success/2019-02-02",
"type": "Microsoft.Security/IoTSecurityAggregatedAlert",
"properties": {
"alertType": "IoT_Bruteforce_Success",
"alertDisplayName": "Successful Bruteforce",
"aggregatedDateUtc": "2019-02-02",
"vendorName": "Microsoft",
"reportedSeverity": "Low",
"remediationSteps": "",
"description": "Multiple unsuccsseful login attempts identified followed by a succssful login. A Bruteforce attack on the device was Successfule",
"count": 600000,
"effectedResourceType": "IoT Device",
"systemSource": "Devices",
"actionTaken": "Detected",
"logAnalyticsQuery": "SecurityAlert | where tolower(ResourceId) == tolower('/subscriptions/b77ec8a9-04ed-48d2-a87a-e5887b978ba6/resourceGroups/IoT-Solution-DemoEnv/providers/Microsoft.Devices/IotHubs/rtogm-hub') and tolower(AlertName) == tolower('Custom Alert - number of device to cloud messages in MQTT protocol is not in the allowed range') | extend DeviceId=parse_json(ExtendedProperties)['DeviceId'] | project DeviceId, TimeGenerated, DisplayName, AlertSeverity, Description, RemediationSteps, ExtendedProperties"
}
}
]
}
}
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
{
"parameters": {
"api-version": "2017-08-01-preview",
"subscriptionId": "20ff7fc3-e762-44dd-bd96-b71116dcdc23",
"resourceGroupName": "MyGroup",
"solutionName": "default",
"aggregatedAlertName": "IoT_Bruteforce_Fail/2019-02-02"
},
"responses": {
"200": {
"body": {
"id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Fail/2019-02-02",
"name": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Fail/2019-02-02",
"type": "Microsoft.Security/IoTSecurityAggregatedAlert",
"properties": {
"alertType": "IoT_Bruteforce_Fail",
"alertDisplayName": "Failed Bruteforce",
"aggregatedDateUtc": "2019-02-02",
"vendorName": "Microsoft",
"reportedSeverity": "Low",
"remediationSteps": "",
"description": "Multiple unsuccsseful login attempts identified. A Bruteforce attack on the device failed.",
"count": 50,
"effectedResourceType": "IoT Device",
"systemSource": "Devices",
"actionTaken": "Detected",
"logAnalyticsQuery": "SecurityAlert | where tolower(ResourceId) == tolower('/subscriptions/b77ec8a9-04ed-48d2-a87a-e5887b978ba6/resourceGroups/IoT-Solution-DemoEnv/providers/Microsoft.Devices/IotHubs/rtogm-hub') and tolower(AlertName) == tolower('Custom Alert - number of device to cloud messages in MQTT protocol is not in the allowed range') | extend DeviceId=parse_json(ExtendedProperties)['DeviceId'] | project DeviceId, TimeGenerated, DisplayName, AlertSeverity, Description, RemediationSteps, ExtendedProperties"
}
}
}
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,95 @@
{
"parameters": {
"api-version": "2017-08-01-preview",
"subscriptionId": "20ff7fc3-e762-44dd-bd96-b71116dcdc23",
"resourceGroupName": "MyGroup",
"solutionName": "default"
},
"responses": {
"200": {
"body": {
"value": [
{
"id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default",
"name": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default",
"type": "Microsoft.Security/IoTSecuritySolutionAnalyticsModelList",
"properties": {
"metrics": {
"high": 5,
"medium": 200,
"low": 102
},
"unhealthyDeviceCount": 1200,
"devicesMetrics": [
{
"date": "2019-02-01T00:00:00Z",
"devicesMetrics": {
"high": 3,
"medium": 15,
"low": 70
}
},
{
"date": "2019-02-02T00:00:00Z",
"devicesMetrics": {
"high": 3,
"medium": 45,
"low": 65
}
}
],
"topAlertedDevices": [
{
"deviceId": "id1",
"alertsCount": 200
},
{
"deviceId": "id2",
"alertsCount": 170
},
{
"deviceId": "id3",
"alertsCount": 150
}
],
"mostPrevalentDeviceAlerts": [
{
"alertDisplayName": "Custom Alert - number of device to cloud messages in AMQP protocol is not in the allowed range",
"reportedSeverity": "Low",
"devicesCount": 200
},
{
"alertDisplayName": "Custom Alert - execution of a process that is not allowed",
"reportedSeverity": "Medium",
"devicesCount": 170
},
{
"alertDisplayName": "Successful Bruteforce",
"reportedSeverity": "Low",
"devicesCount": 150
}
],
"mostPrevalentDeviceRecommendations": [
{
"recommendationDisplayName": "Install the Azure Security of Things Agent",
"reportedSeverity": "Low",
"devicesCount": 200
},
{
"recommendationDisplayName": "High level permissions configured in Edge model twin for Edge module",
"reportedSeverity": "Low",
"devicesCount": 170
},
{
"recommendationDisplayName": "Same Authentication Credentials used by multiple devices",
"reportedSeverity": "Medium",
"devicesCount": 150
}
]
}
}
]
}
}
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,91 @@
{
"parameters": {
"api-version": "2017-08-01-preview",
"subscriptionId": "20ff7fc3-e762-44dd-bd96-b71116dcdc23",
"resourceGroupName": "MyGroup",
"solutionName": "default"
},
"responses": {
"200": {
"body": {
"id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default",
"name": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default",
"type": "Microsoft.Security/IoTSecuritySolutionAnalyticsModel",
"properties": {
"metrics": {
"high": 5,
"medium": 200,
"low": 102
},
"unhealthyDeviceCount": 1200,
"devicesMetrics": [
{
"date": "2019-02-01T00:00:00Z",
"devicesMetrics": {
"high": 3,
"medium": 15,
"low": 70
}
},
{
"date": "2019-02-02T00:00:00Z",
"devicesMetrics": {
"high": 3,
"medium": 45,
"low": 65
}
}
],
"topAlertedDevices": [
{
"deviceId": "id1",
"alertsCount": 200
},
{
"deviceId": "id2",
"alertsCount": 170
},
{
"deviceId": "id3",
"alertsCount": 150
}
],
"mostPrevalentDeviceAlerts": [
{
"alertDisplayName": "Custom Alert - number of device to cloud messages in AMQP protocol is not in the allowed range",
"reportedSeverity": "Low",
"alertsCount": 200
},
{
"alertDisplayName": "Custom Alert - execution of a process that is not allowed",
"reportedSeverity": "Medium",
"alertsCount": 170
},
{
"alertDisplayName": "Successful Bruteforce",
"reportedSeverity": "Low",
"alertsCount": 150
}
],
"mostPrevalentDeviceRecommendations": [
{
"recommendationDisplayName": "Install the Azure Security of Things Agent",
"reportedSeverity": "Low",
"devicesCount": 200
},
{
"recommendationDisplayName": "High level permissions configured in Edge model twin for Edge module",
"reportedSeverity": "Low",
"devicesCount": 170
},
{
"recommendationDisplayName": "Same Authentication Credentials used by multiple devices",
"reportedSeverity": "Medium",
"devicesCount": 150
}
]
}
}
}
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
{
"parameters": {
"api-version": "2017-08-01-preview",
"subscriptionId": "075423e9-7d33-4166-8bdf-3920b04e3735",
"resourceGroupName": "IoTEdgeResources",
"solutionName": "default"
},
"responses": {
"200": {
"body": {
"value": [
{
"id": "/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/OpenPortsOnDevice",
"name": "/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/OpenPortsOnDevice",
"type": "Microsoft.Security/IoTSecurityAggregatedRecommendation",
"properties": {
"recommendationName": "OpenPortsOnDevice",
"recommendationDisplayName": "Permissive firewall policy in one of the chains was found",
"description": "An allowed firewall policy was found in main firewall Chains (INPUT/OUTPUT). The policy should Deny all traffic by default define rules to allow necessary communication to/from the device",
"recommendationTypeId": "{20ff7fc3-e762-44dd-bd96-b71116dcdc23}",
"detectedBy": "Microsoft",
"reportedSeverity": "Low",
"remediationSteps": "",
"healthyDevices": 10000,
"unhealthyDeviceCount": 200,
"logAnalyticsQuery": "SecurityRecommendation | where tolower(AssessedResourceId) == tolower('/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Devices/IotHubs/t-ofdadu-hub') and tolower(RecommendationName) == tolower('OpenPortsOnDevice')"
}
},
{
"id": "/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/TooLargeIPRange",
"name": "/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_InstallAgent",
"type": "Microsoft.Security/IoTSecurityAggregatedRecommendation",
"properties": {
"recommendationName": "TooLargeIPRange",
"recommendationDisplayName": "Permissive firewall policy in one of the chains was found",
"description": "An allow IP filter rule source IP range is too large. Overly permissive rules can expose your IoT hub to malicious actors.",
"recommendationTypeId": "{20ff7fc3-e762-44dd-bd96-b71116dcdc23}",
"detectedBy": "Microsoft",
"reportedSeverity": "High",
"remediationSteps": "",
"healthyDevices": 130000,
"unhealthyDeviceCount": 1,
"logAnalyticsQuery": "SecurityRecommendation | where tolower(AssessedResourceId) == tolower('/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Devices/IotHubs/t-ofdadu-hub') and tolower(RecommendationName) == tolower('TooLargeIPRange')"
}
}
]
}
}
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
{
"parameters": {
"api-version": "2017-08-01-preview",
"subscriptionId": "075423e9-7d33-4166-8bdf-3920b04e3735",
"resourceGroupName": "IoTEdgeResources",
"solutionName": "default",
"aggregatedRecommendationName": "OpenPortsOnDevice"
},
"responses": {
"200": {
"body": {
"id": "/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/OpenPortsOnDevice",
"name": "/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/OpenPortsOnDevice",
"type": "Microsoft.Security/IoTSecurityAggregatedRecommendation",
"properties": {
"recommendationName": "OpenPortsOnDevice",
"recommendationDisplayName": "Permissive firewall policy in one of the chains was found",
"description": "An allowed firewall policy was found in main firewall Chains (INPUT/OUTPUT). The policy should Deny all traffic by default define rules to allow necessary communication to/from the device",
"recommendationTypeId": "{20ff7fc3-e762-44dd-bd96-b71116dcdc23}",
"detectedBy": "Microsoft",
"reportedSeverity": "Low",
"remediationSteps": "",
"healthyDevices": 10000,
"unhealthyDeviceCount": 200,
"logAnalyticsQuery": "SecurityRecommendation | where tolower(AssessedResourceId) == tolower('/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Devices/IotHubs/t-ofdadu-hub') and tolower(RecommendationName) == tolower('OpenPortsOnDevice')"
}
}
}
}
}
Loading