Skip to content

Add aggregated alert top devices information #7409

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
erich-wang merged 8 commits into from
Oct 9, 2019
Merged

Add aggregated alert top devices information #7409

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
7e2e750
Add alert top 10 devices information
hagba Oct 7, 2019
e5e6d48
fix errors
hagba Oct 7, 2019
a5ad299
fix errors
hagba Oct 7, 2019
7a79105
fix errors
hagba Oct 7, 2019
0774d20
fix errors
hagba Oct 7, 2019
7a7e794
fix array error
hagba Oct 7, 2019
235fdb6
fix time field
hagba Oct 7, 2019
83f1e75
fix time field
hagba Oct 7, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion ...xamples/IoTSecuritySolutionsAnalytics/GetIoTSecuritySolutionsSecurityAggregatedAlert.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,19 @@
"effectedResourceType": "IoT Device",
"systemSource": "Devices",
"actionTaken": "Detected",
"logAnalyticsQuery": "SecurityAlert | where tolower(ResourceId) == tolower('/subscriptions/b77ec8a9-04ed-48d2-a87a-e5887b978ba6/resourceGroups/IoT-Solution-DemoEnv/providers/Microsoft.Devices/IotHubs/rtogm-hub') and tolower(AlertName) == tolower('Custom Alert - number of device to cloud messages in MQTT protocol is not in the allowed range') | extend DeviceId=parse_json(ExtendedProperties)['DeviceId'] | project DeviceId, TimeGenerated, DisplayName, AlertSeverity, Description, RemediationSteps, ExtendedProperties"
"logAnalyticsQuery": "SecurityAlert | where tolower(ResourceId) == tolower('/subscriptions/b77ec8a9-04ed-48d2-a87a-e5887b978ba6/resourceGroups/IoT-Solution-DemoEnv/providers/Microsoft.Devices/IotHubs/rtogm-hub') and tolower(AlertName) == tolower('Custom Alert - number of device to cloud messages in MQTT protocol is not in the allowed range') | extend DeviceId=parse_json(ExtendedProperties)['DeviceId'] | project DeviceId, TimeGenerated, DisplayName, AlertSeverity, Description, RemediationSteps, ExtendedProperties",
"topDevicesList": [
{
"deviceId": "testDevice1",
"alertsCount": 100,
"lastOccurrence": "10:42"
},
{
"deviceId": "testDevice2",
"alertsCount": 80,
"lastOccurrence": "15:42"
}
]
}
}
}
Expand Down
28 changes: 26 additions & 2 deletions ...les/IoTSecuritySolutionsAnalytics/GetIoTSecuritySolutionsSecurityAggregatedAlertList.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,19 @@
"effectedResourceType": "IoT Device",
"systemSource": "Devices",
"actionTaken": "Detected",
"logAnalyticsQuery": "SecurityAlert | where tolower(ResourceId) == tolower('/subscriptions/b77ec8a9-04ed-48d2-a87a-e5887b978ba6/resourceGroups/IoT-Solution-DemoEnv/providers/Microsoft.Devices/IotHubs/rtogm-hub') and tolower(AlertName) == tolower('Custom Alert - number of device to cloud messages in MQTT protocol is not in the allowed range') | extend DeviceId=parse_json(ExtendedProperties)['DeviceId'] | project DeviceId, TimeGenerated, DisplayName, AlertSeverity, Description, RemediationSteps, ExtendedProperties"
"logAnalyticsQuery": "SecurityAlert | where tolower(ResourceId) == tolower('/subscriptions/b77ec8a9-04ed-48d2-a87a-e5887b978ba6/resourceGroups/IoT-Solution-DemoEnv/providers/Microsoft.Devices/IotHubs/rtogm-hub') and tolower(AlertName) == tolower('Custom Alert - number of device to cloud messages in MQTT protocol is not in the allowed range') | extend DeviceId=parse_json(ExtendedProperties)['DeviceId'] | project DeviceId, TimeGenerated, DisplayName, AlertSeverity, Description, RemediationSteps, ExtendedProperties",
"topDevicesList": [
{
"deviceId": "testDevice1",
"alertsCount": 45,
"lastOccurrence": "10:42"
},
{
"deviceId": "testDevice2",
"alertsCount": 30,
"lastOccurrence": "15:42"
}
]
}
},
{
Expand All @@ -44,7 +56,19 @@
"effectedResourceType": "IoT Device",
"systemSource": "Devices",
"actionTaken": "Detected",
"logAnalyticsQuery": "SecurityAlert | where tolower(ResourceId) == tolower('/subscriptions/b77ec8a9-04ed-48d2-a87a-e5887b978ba6/resourceGroups/IoT-Solution-DemoEnv/providers/Microsoft.Devices/IotHubs/rtogm-hub') and tolower(AlertName) == tolower('Custom Alert - number of device to cloud messages in MQTT protocol is not in the allowed range') | extend DeviceId=parse_json(ExtendedProperties)['DeviceId'] | project DeviceId, TimeGenerated, DisplayName, AlertSeverity, Description, RemediationSteps, ExtendedProperties"
"logAnalyticsQuery": "SecurityAlert | where tolower(ResourceId) == tolower('/subscriptions/b77ec8a9-04ed-48d2-a87a-e5887b978ba6/resourceGroups/IoT-Solution-DemoEnv/providers/Microsoft.Devices/IotHubs/rtogm-hub') and tolower(AlertName) == tolower('Custom Alert - number of device to cloud messages in MQTT protocol is not in the allowed range') | extend DeviceId=parse_json(ExtendedProperties)['DeviceId'] | project DeviceId, TimeGenerated, DisplayName, AlertSeverity, Description, RemediationSteps, ExtendedProperties",
"topDevicesList": [
{
"deviceId": "testDevice1",
"alertsCount": 12321,
"lastOccurrence": "10:42"
},
{
"deviceId": "testDevice2",
"alertsCount": 455,
"lastOccurrence": "15:42"
}
]
}
}
]
Expand Down
24 changes: 24 additions & 0 deletions ...y/resource-manager/Microsoft.Security/stable/2019-08-01/iotSecuritySolutionAnalytics.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -628,6 +628,30 @@
"readOnly": true,
"type": "string",
"description": "Log analytics query for getting the list of affected devices/alerts."
},
"topDevicesList": {
"description": "10 devices with the highest number of occurrences of this alert type, on this day.",
"type": "array",
"readOnly": true,
"items": {
"properties": {
"deviceId": {
"readOnly": true,
"type": "string",
"description": "Name of the device."
},
"alertsCount": {
"readOnly": true,
"type": "integer",
"description": "Number of alerts raised for this device."
},
"lastOccurrence": {
"readOnly": true,
"type": "string",
"description": "Most recent time this alert was raised for this device, on this day."
}
}
}
}
}
},
Expand Down