diff --git a/.script/tests/KqlvalidationsTests/CustomTables/MG365ThreatData_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/MG365ThreatData_CL.json new file mode 100644 index 00000000000..7cc47033b55 --- /dev/null +++ b/.script/tests/KqlvalidationsTests/CustomTables/MG365ThreatData_CL.json @@ -0,0 +1,33 @@ +{ + "Name": "MG365ThreatData_CL", + "Properties": [ + { "Name": "TimeGenerated", "Type": "DateTime" }, + { "Name": "MessageId", "Type": "String" }, + { "Name": "HeaderMessageId", "Type": "String" }, + { "Name": "UserId", "Type": "String" }, + { "Name": "CustomerTenantId", "Type": "String" }, + { "Name": "Score", "Type": "Real" }, + { "Name": "Virus", "Type": "Bool" }, + { "Name": "Category", "Type": "String" }, + { "Name": "Attachments", "Type": "Dynamic" }, + { "Name": "Sender", "Type": "Dynamic" }, + { "Name": "Recipients", "Type": "Dynamic" }, + { "Name": "ReceivedHeaders", "Type": "Dynamic" }, + { "Name": "SenderHeader", "Type": "String" }, + { "Name": "ToHeader", "Type": "String" }, + { "Name": "CcHeader", "Type": "String" }, + { "Name": "Subject", "Type": "String" }, + { "Name": "OriginCountry", "Type": "String" }, + { "Name": "MessageDate", "Type": "DateTime" }, + { "Name": "MessageSize", "Type": "Real" }, + { "Name": "Action", "Type": "String" }, + { "Name": "ReceivedDateTime", "Type": "Long" }, + { "Name": "ForefrontAntiSpam", "Type": "String" }, + { "Name": "MicrosoftAntiSpam", "Type": "String" }, + { "Name": "IsInWhiteList", "Type": "Bool" }, + { "Name": "IsInBlackList", "Type": "Bool" }, + { "Name": "Email", "Type": "String" }, + { "Name": "HasAttachment", "Type": "Bool" }, + { "Name": "HasImage", "Type": "Bool" } + ] +} \ No newline at end of file diff --git a/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_ConnectorDefinition.json b/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_ConnectorDefinition.json new file mode 100644 index 00000000000..e5a4a61a3d7 --- /dev/null +++ b/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_ConnectorDefinition.json @@ -0,0 +1,163 @@ +{ + "name": "MailGuard365", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "MailGuard365", + "title": "MailGuard 365 Connector (Push)", + "publisher": "MailGuard365", + "descriptionMarkdown": "The MailGuard 365 connector provides the capability to push mail-security event data from MailGuard 365 directly into Microsoft Sentinel using the Codeless Connector Framework (CCF) Push pattern. This connector ingests message metadata, sender/recipient details, spam/virus scoring, and attachment information into a custom Log Analytics table for analysis, alerting, and visualization.", + "graphQueries": [ + { + "metricName": "MailGuard 365 Messages", + "legend": "MG365ThreatData_CL", + "baseQuery": "MG365ThreatData_CL" + } + ], + "sampleQueries": [ + { + "description": "Recent messages", + "query": "MG365ThreatData_CL\n | sort by TimeGenerated desc" + }, + { + "description": "Messages flagged as virus", + "query": "MG365ThreatData_CL\n | where Virus == true\n | sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "MG365ThreatData_CL", + "lastDataReceivedQuery": "MG365ThreatData_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "IsConnectedQuery", + "value": [ + "MG365ThreatData_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)" + ] + } + ], + "availability": { + "status": 1 + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "Microsoft Entra", + "description": "Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher." + }, + { + "name": "Microsoft Azure", + "description": "Permission to assign Monitoring Metrics Publisher role on data collection rule (DCR). Typically requires Azure RBAC Owner or User Access Administrator role." + } + ] + }, + "instructionSteps": [ + { + "title": "1. Create ARM Resources and Provide the Required Permissions", + "description": "This connector enables MailGuard 365 to push mail-security event data directly to Microsoft Sentinel via the Azure Monitor Ingestion API.", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "#### Automated Configuration and Secure Data Ingestion with Entra Application \nClicking \"Deploy\" will create a Log Analytics table and a Data Collection Rule (DCR), then create a dedicated Entra application, link the DCR to it, and generate a client secret. This lets MailGuard 365 push data securely to the DCR using an Entra token." + } + }, + { + "type": "DeployPushConnectorButton", + "parameters": { + "label": "Deploy MailGuard 365 Push connector resources", + "applicationDisplayName": "MailGuard 365 Push Connector Application" + } + } + ] + }, + { + "title": "2. Configure MailGuard 365", + "description": "Copy the following values into MailGuard 365 admin console → Settings → Integration so MailGuard 365 knows where to push data for this tenant.", + "instructions": [ + { + "type": "CopyableLabel", + "parameters": { + "label": "Tenant ID (Directory ID)", + "fillWith": [ + "TenantId" + ] + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Entra App Registration Application ID", + "fillWith": [ + "ApplicationId" + ], + "placeholder": "Deploy push connector to get the App Registration Application ID" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Entra App Registration Secret", + "fillWith": [ + "ApplicationSecret" + ], + "placeholder": "Deploy push connector to get the App Registration Secret" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Data Collection Endpoint Uri", + "fillWith": [ + "DataCollectionEndpoint" + ], + "placeholder": "Deploy push connector to get the Data Collection Endpoint Uri" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Data Collection Rule Immutable ID", + "fillWith": [ + "DataCollectionRuleId" + ], + "placeholder": "Deploy push connector to get the Data Collection Rule Immutable ID" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Stream Name", + "value": "Custom-MG365ThreatData_CL" + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### Configure MailGuard 365\nEnter the values above into your MailGuard 365 admin console under Settings → Integration, to enable message data push to Microsoft Sentinel." + } + } + ] + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_DCR.json b/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_DCR.json new file mode 100644 index 00000000000..3889a9f358b --- /dev/null +++ b/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_DCR.json @@ -0,0 +1,147 @@ +{ + "name": "MailGuard365DCR", + "apiVersion": "2021-09-01-preview", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "[parameters('workspace-location')]", + "properties": { + "streamDeclarations": { + "Custom-MG365ThreatData_CL": { + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "MessageId", + "type": "string" + }, + { + "name": "HeaderMessageId", + "type": "string" + }, + { + "name": "UserId", + "type": "string" + }, + { + "name": "CustomerTenantId", + "type": "string" + }, + { + "name": "Score", + "type": "real" + }, + { + "name": "Virus", + "type": "boolean" + }, + { + "name": "Category", + "type": "string" + }, + { + "name": "Attachments", + "type": "dynamic" + }, + { + "name": "Sender", + "type": "dynamic" + }, + { + "name": "Recipients", + "type": "dynamic" + }, + { + "name": "ReceivedHeaders", + "type": "dynamic" + }, + { + "name": "SenderHeader", + "type": "string" + }, + { + "name": "ToHeader", + "type": "string" + }, + { + "name": "CcHeader", + "type": "string" + }, + { + "name": "Subject", + "type": "string" + }, + { + "name": "OriginCountry", + "type": "string" + }, + { + "name": "MessageDate", + "type": "datetime" + }, + { + "name": "MessageSize", + "type": "real" + }, + { + "name": "Action", + "type": "string" + }, + { + "name": "ReceivedDateTime", + "type": "long" + }, + { + "name": "ForefrontAntiSpam", + "type": "string" + }, + { + "name": "MicrosoftAntiSpam", + "type": "string" + }, + { + "name": "IsInWhiteList", + "type": "boolean" + }, + { + "name": "IsInBlackList", + "type": "boolean" + }, + { + "name": "Email", + "type": "string" + }, + { + "name": "HasAttachment", + "type": "boolean" + }, + { + "name": "HasImage", + "type": "boolean" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "[variables('workspaceResourceId')]", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-MG365ThreatData_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source", + "outputStream": "Custom-MG365ThreatData_CL" + } + ], + "dataCollectionEndpointId": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]" + } +} \ No newline at end of file diff --git a/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_PollingConfig.json b/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_PollingConfig.json new file mode 100644 index 00000000000..8e562082270 --- /dev/null +++ b/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_PollingConfig.json @@ -0,0 +1,27 @@ +{ + "name": "MailGuard365ConnectorPolling", + "apiVersion": "2024-09-01", + "type": "Microsoft.SecurityInsights/dataConnectors", + "kind": "Push", + "properties": { + "connectorDefinitionName": "MailGuard365", + "dcrConfig": { + "streamName": "Custom-MG365ThreatData_CL", + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" + }, + "auth": { + "type": "Push", + "AppId": "[[parameters('auth').appId]", + "ServicePrincipalId": "[[parameters('auth').servicePrincipalId]" + }, + "request": { + "RetryCount": 1 + }, + "response": { + "eventsJsonPaths": [ + "$" + ] + } + } +} \ No newline at end of file diff --git a/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_Table.json b/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_Table.json new file mode 100644 index 00000000000..703f90202ec --- /dev/null +++ b/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_Table.json @@ -0,0 +1,124 @@ +{ + "name": "MG365ThreatData_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2025-07-01", + "properties": { + "schema": { + "name": "MG365ThreatData_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "MessageId", + "type": "string" + }, + { + "name": "HeaderMessageId", + "type": "string" + }, + { + "name": "UserId", + "type": "string" + }, + { + "name": "CustomerTenantId", + "type": "string" + }, + { + "name": "Score", + "type": "real" + }, + { + "name": "Virus", + "type": "boolean" + }, + { + "name": "Category", + "type": "string" + }, + { + "name": "Attachments", + "type": "dynamic" + }, + { + "name": "Sender", + "type": "dynamic" + }, + { + "name": "Recipients", + "type": "dynamic" + }, + { + "name": "ReceivedHeaders", + "type": "dynamic" + }, + { + "name": "SenderHeader", + "type": "string" + }, + { + "name": "ToHeader", + "type": "string" + }, + { + "name": "CcHeader", + "type": "string" + }, + { + "name": "Subject", + "type": "string" + }, + { + "name": "OriginCountry", + "type": "string" + }, + { + "name": "MessageDate", + "type": "datetime" + }, + { + "name": "MessageSize", + "type": "real" + }, + { + "name": "Action", + "type": "string" + }, + { + "name": "ReceivedDateTime", + "type": "long" + }, + { + "name": "ForefrontAntiSpam", + "type": "string" + }, + { + "name": "MicrosoftAntiSpam", + "type": "string" + }, + { + "name": "IsInWhiteList", + "type": "boolean" + }, + { + "name": "IsInBlackList", + "type": "boolean" + }, + { + "name": "Email", + "type": "string" + }, + { + "name": "HasAttachment", + "type": "boolean" + }, + { + "name": "HasImage", + "type": "boolean" + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/MailGuard 365/Data/Solution_MailGuard365.json b/Solutions/MailGuard 365/Data/Solution_MailGuard365.json new file mode 100644 index 00000000000..e4d8af6d078 --- /dev/null +++ b/Solutions/MailGuard 365/Data/Solution_MailGuard365.json @@ -0,0 +1,22 @@ +{ + "Name": "MailGuard 365", + "Author": "MailGuard 365 - support@mailguard365.com", + "Logo": "", + "Description": "Strengthen your Microsoft 365 email security against advanced zero-day phishing, ransomware & BEC attacks with MailGuard 365 enhanced email security. This Microsoft Sentinel Solution enables you to ingest threat data from MailGuard 365 via the Azure Monitor Logs Ingestion API, using a dedicated Entra application.", + "Data Connectors": [ + "Data Connectors/MailGuard365_ccf/MailGuard365_ConnectorDefinition.json" + ], + "Workbooks": [ + "Workbooks/MailGuard365Dashboard.json" + ], + "Hunting Queries": [ + "Hunting Queries/MailGuard365HighConfidenceThreats.yaml", + "Hunting Queries/MailGuard365MalwareThreats.yaml", + "Hunting Queries/MailGuard365PhishingThreats.yaml" + ], + "BasePath": "C:\\path\\to\\Azure-Sentinel\\Solutions\\MailGuard 365", + "Version": "3.0.1", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1PConnector": false +} diff --git a/Solutions/MailGuard 365/Hunting Queries/MailGuard365HighConfidenceThreats.yaml b/Solutions/MailGuard 365/Hunting Queries/MailGuard365HighConfidenceThreats.yaml index 35a311007c1..fef51d5abc9 100644 --- a/Solutions/MailGuard 365/Hunting Queries/MailGuard365HighConfidenceThreats.yaml +++ b/Solutions/MailGuard 365/Hunting Queries/MailGuard365HighConfidenceThreats.yaml @@ -1,25 +1,24 @@ id: 5e3aa1a5-5b69-421e-a3ac-32b04cb10353 name: MailGuard 365 - High Confidence Threats description: | - 'Query searches for high confidence threats stopped by MailGuard 365.' -severity: Medium + Query searches for high confidence threats stopped by MailGuard 365. requiredDataConnectors: - connectorId: MailGuard365 dataTypes: - - MailGuard365 + - MG365ThreatData_CL tactics: - Reconnaissance relevantTechniques: - T1598 query: | - MailGuard365_Threats_CL - | where Score_d > 20 - | extend MailMessage_0_NetworkMessageId = MessageId_s - | extend MailMessage_0_Recipient = Email_s + MG365ThreatData_CL + | where Score > 20 entityMappings: - - entityType: Mail message + - entityType: MailMessage fieldMappings: - identifier: NetworkMessageId - columnName: MessageId_s + columnName: MessageId - identifier: Recipient - columnName: Email_s \ No newline at end of file + columnName: Email +version: 1.0.0 +kind: Scheduled \ No newline at end of file diff --git a/Solutions/MailGuard 365/Hunting Queries/MailGuard365MalwareThreats.yaml b/Solutions/MailGuard 365/Hunting Queries/MailGuard365MalwareThreats.yaml index d94c0a1947e..5e1f8624a4c 100644 --- a/Solutions/MailGuard 365/Hunting Queries/MailGuard365MalwareThreats.yaml +++ b/Solutions/MailGuard 365/Hunting Queries/MailGuard365MalwareThreats.yaml @@ -1,12 +1,11 @@ id: daaae6ad-1fd0-4efa-b571-116689e67a20 name: MailGuard 365 - Malware Threats description: | - 'Query searches for malware threats stopped by MailGuard 365.' -severity: High + Query searches for malware threats stopped by MailGuard 365. requiredDataConnectors: - connectorId: MailGuard365 dataTypes: - - MailGuard365 + - MG365ThreatData_CL tactics: - InitialAccess - Reconnaissance @@ -18,14 +17,14 @@ relevantTechniques: - T1189 - T1190 query: | - MailGuard365_Threats_CL + MG365ThreatData_CL | where Category == "Malicious Attachment" - | extend MailMessage_0_NetworkMessageId = MessageId_s - | extend MailMessage_0_Recipient = Email_s entityMappings: - - entityType: Mail message + - entityType: MailMessage fieldMappings: - identifier: NetworkMessageId - columnName: MessageId_s + columnName: MessageId - identifier: Recipient - columnName: Email_s + columnName: Email +version: 1.0.0 +kind: Scheduled \ No newline at end of file diff --git a/Solutions/MailGuard 365/Hunting Queries/MailGuard365PhishingThreats.yaml b/Solutions/MailGuard 365/Hunting Queries/MailGuard365PhishingThreats.yaml index 90988e629ee..bf64a62060e 100644 --- a/Solutions/MailGuard 365/Hunting Queries/MailGuard365PhishingThreats.yaml +++ b/Solutions/MailGuard 365/Hunting Queries/MailGuard365PhishingThreats.yaml @@ -1,28 +1,27 @@ id: ee15ed10-d355-474e-b8ad-a8bbb76f6d38 name: MailGuard 365 - Phishing Threats description: | - 'Query searches for phishing threats stopped by MailGuard 365.' -severity: Medium + Query searches for phishing threats stopped by MailGuard 365. requiredDataConnectors: - connectorId: MailGuard365 dataTypes: - - MailGuard365 + - MG365ThreatData_CL tactics: - InitialAccess - Reconnaissance - - Credential Access + - CredentialAccess relevantTechniques: - T1598 - T1566 query: | - MailGuard365_Threats_CL + MG365ThreatData_CL | where Category == "Phishing" - | extend MailMessage_0_NetworkMessageId = MessageId_s - | extend MailMessage_0_Recipient = Email_s entityMappings: - - entityType: Mail message + - entityType: MailMessage fieldMappings: - identifier: NetworkMessageId - columnName: MessageId_s + columnName: MessageId - identifier: Recipient - columnName: Email_s \ No newline at end of file + columnName: Email +version: 1.0.0 +kind: Scheduled \ No newline at end of file diff --git a/Solutions/MailGuard 365/Package/3.0.1.zip b/Solutions/MailGuard 365/Package/3.0.1.zip new file mode 100644 index 00000000000..5449ba0f56e Binary files /dev/null and b/Solutions/MailGuard 365/Package/3.0.1.zip differ diff --git a/Solutions/MailGuard 365/Package/createUiDefinition.json b/Solutions/MailGuard 365/Package/createUiDefinition.json index 6a147860162..4598b79978b 100644 --- a/Solutions/MailGuard 365/Package/createUiDefinition.json +++ b/Solutions/MailGuard 365/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nStrengthen your Microsoft 365 email security against advanced zero-day phishing, ransomware & BEC attacks with MailGuard 365 enhanced email security. This Microsoft Sentinel Solution enables you to ingest threat data from MailGuard 365.\n\n**Data Connectors:** 1, **Workbooks:** 1, **Hunting Queries:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/MailGuard%20365/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nStrengthen your Microsoft 365 email security against advanced zero-day phishing, ransomware & BEC attacks with MailGuard 365 enhanced email security. This Microsoft Sentinel Solution enables you to ingest threat data from MailGuard 365 via the Azure Monitor Logs Ingestion API, using a dedicated Entra application.\n\n**Data Connectors:** 1, **Workbooks:** 1, **Hunting Queries:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -60,11 +60,11 @@ "name": "dataconnectors1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This Solution installs the data connector for MailGuard 365. You can get MailGuard 365 custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + "text": "This Solution installs the data connector for MailGuard 365 Connector (Push). You can get MailGuard 365 Connector (Push) data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { - "name": "dataconnectors-link2", + "name": "dataconnectors-link1", "type": "Microsoft.Common.TextBlock", "options": { "link": { @@ -88,7 +88,7 @@ "name": "workbooks-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This Microsoft Sentinel Solution installs workbooks. Workbooks provide a flexible canvas for data monitoring, analysis, and the creation of rich visual reports within the Azure portal. They allow you to tap into one or many data sources from Microsoft Sentinel and combine them into unified interactive experiences." + "text": "This solution installs workbook(s) to help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view." } }, { @@ -126,7 +126,7 @@ "name": "huntingqueries-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in Manage solution view." + "text": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in Manage solution view. " } }, { @@ -148,7 +148,7 @@ "name": "huntingquery1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for high confidence threats stopped by MailGuard 365. This hunting query depends on MailGuard365 data connector (MailGuard365 Parser or Table)" + "text": "Query searches for high confidence threats stopped by MailGuard 365. This hunting query depends on MailGuard365 data connector (MG365ThreatData_CL Parser or Table)" } } ] @@ -156,13 +156,13 @@ { "name": "huntingquery2", "type": "Microsoft.Common.Section", - "label": "MailGuard 365 - Phishing Threats", + "label": "MailGuard 365 - Malware Threats", "elements": [ { "name": "huntingquery2-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for phishing threats stopped by MailGuard 365. This hunting query depends on MailGuard365 data connector (MailGuard365 Parser or Table)" + "text": "Query searches for malware threats stopped by MailGuard 365. This hunting query depends on MailGuard365 data connector (MG365ThreatData_CL Parser or Table)" } } ] @@ -170,13 +170,13 @@ { "name": "huntingquery3", "type": "Microsoft.Common.Section", - "label": "MailGuard 365 - Malware Threats", + "label": "MailGuard 365 - Phishing Threats", "elements": [ { "name": "huntingquery3-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for malware threats stopped by MailGuard 365. This hunting query depends on MailGuard365 data connector (MailGuard365 Parser or Table)" + "text": "Query searches for phishing threats stopped by MailGuard 365. This hunting query depends on MailGuard365 data connector (MG365ThreatData_CL Parser or Table)" } } ] diff --git a/Solutions/MailGuard 365/Package/mainTemplate.json b/Solutions/MailGuard 365/Package/mainTemplate.json index 18882df9e55..3ef42a5cec4 100644 --- a/Solutions/MailGuard 365/Package/mainTemplate.json +++ b/Solutions/MailGuard 365/Package/mainTemplate.json @@ -2,7 +2,7 @@ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { - "author": "MailGuard - support@mailguard365.com", + "author": "MailGuard 365 - support@mailguard365.com", "comments": "Solution template for MailGuard 365" }, "parameters": { @@ -28,6 +28,20 @@ "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" } }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } + }, "workbook1-name": { "type": "string", "defaultValue": "MailGuard365", @@ -41,118 +55,109 @@ "email": "support@mailguard365.com", "_email": "[variables('email')]", "_solutionName": "MailGuard 365", - "_solutionVersion": "3.0.0", + "_solutionVersion": "3.0.1", "solutionId": "mailguardptylimited.microsoft-sentinel-solution-mailguard365", "_solutionId": "[variables('solutionId')]", - "uiConfigId1": "MailGuard365", - "_uiConfigId1": "[variables('uiConfigId1')]", - "dataConnectorContentId1": "MailGuard365", - "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", - "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", - "dataConnectorVersion1": "1.0.0", - "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", - "huntingQueryVersion1": "1.0.0", - "huntingQuerycontentId1": "5e3aa1a5-5b69-421e-a3ac-32b04cb10353", - "_huntingQuerycontentId1": "[variables('huntingQuerycontentId1')]", - "huntingQueryId1": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId1'))]", - "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId1'))))]", - "_huntingQuerycontentProductId1": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId1'),'-', variables('huntingQueryVersion1'))))]", - "huntingQueryVersion2": "1.0.0", - "huntingQuerycontentId2": "ee15ed10-d355-474e-b8ad-a8bbb76f6d38", - "_huntingQuerycontentId2": "[variables('huntingQuerycontentId2')]", - "huntingQueryId2": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId2'))]", - "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId2'))))]", - "_huntingQuerycontentProductId2": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId2'),'-', variables('huntingQueryVersion2'))))]", - "huntingQueryVersion3": "1.0.0", - "huntingQuerycontentId3": "daaae6ad-1fd0-4efa-b571-116689e67a20", - "_huntingQuerycontentId3": "[variables('huntingQuerycontentId3')]", - "huntingQueryId3": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId3'))]", - "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId3'))))]", - "_huntingQuerycontentProductId3": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId3'),'-', variables('huntingQueryVersion3'))))]", - "workbookVersion1": "1.0.0", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "dataConnectorCCPVersion": "3.0.1", + "_dataConnectorContentIdConnectorDefinition1": "MailGuard365", + "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]", + "_dataConnectorContentIdConnections1": "MailGuard365Connections", + "dataConnectorTemplateNameConnections1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections1')))]", + "blanks": "[replace('b', 'b', '')]", + "workbookVersion1": "1.1.0", "workbookContentId1": "MailGuard365Workbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", "_workbookContentId1": "[variables('workbookContentId1')]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", + "huntingQueryObject1": { + "huntingQueryVersion1": "1.0.0", + "_huntingQuerycontentId1": "5e3aa1a5-5b69-421e-a3ac-32b04cb10353", + "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('5e3aa1a5-5b69-421e-a3ac-32b04cb10353')))]" + }, + "huntingQueryObject2": { + "huntingQueryVersion2": "1.0.0", + "_huntingQuerycontentId2": "daaae6ad-1fd0-4efa-b571-116689e67a20", + "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('daaae6ad-1fd0-4efa-b571-116689e67a20')))]" + }, + "huntingQueryObject3": { + "huntingQueryVersion3": "1.0.0", + "_huntingQuerycontentId3": "ee15ed10-d355-474e-b8ad-a8bbb76f6d38", + "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ee15ed10-d355-474e-b8ad-a8bbb76f6d38')))]" + }, "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName1')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition1'), variables('dataConnectorCCPVersion'))]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MailGuard 365 data connector with template version 3.0.0", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", + "displayName": "MailGuard 365 Connector (Push)", + "contentKind": "DataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion1')]", + "contentVersion": "[variables('dataConnectorCCPVersion')]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", + "kind": "Customizable", "properties": { "connectorUiConfig": { - "id": "[variables('_uiConfigId1')]", - "title": "MailGuard 365", + "id": "MailGuard365", + "title": "MailGuard 365 Connector (Push)", "publisher": "MailGuard365", - "descriptionMarkdown": "MailGuard 365 Enhanced Email Security for Microsoft 365. Exclusive to the Microsoft marketplace, MailGuard 365 is integrated with Microsoft 365 security (incl. Defender) for enhanced protection against advanced email threats like phishing, ransomware and sophisticated BEC attacks.", + "descriptionMarkdown": "The MailGuard 365 connector provides the capability to push mail-security event data from MailGuard 365 directly into Microsoft Sentinel using the Codeless Connector Framework (CCF) Push pattern. This connector ingests message metadata, sender/recipient details, spam/virus scoring, and attachment information into a custom Log Analytics table for analysis, alerting, and visualization.", "graphQueries": [ { - "metricName": "Total data received", - "legend": "MailGuard365_Threats_CL", - "baseQuery": "MailGuard365_Threats_CL" + "metricName": "MailGuard 365 Messages", + "legend": "MG365ThreatData_CL", + "baseQuery": "MG365ThreatData_CL" } ], "sampleQueries": [ { - "description": "All phishing threats stopped by MailGuard 365", - "query": "MailGuard365_Threats_CL \n | where Category == \"Phishing\"" - }, - { - "description": "All threats summarized by sender email address", - "query": "MailGuard365_Threats_CL \n | summarize count() by Sender_Email_s" + "description": "Recent messages", + "query": "MG365ThreatData_CL\n | sort by TimeGenerated desc" }, { - "description": "All threats summarized by category", - "query": "MailGuard365_Threats_CL \n | summarize count() by Category" + "description": "Messages flagged as virus", + "query": "MG365ThreatData_CL\n | where Virus == true\n | sort by TimeGenerated desc" } ], "dataTypes": [ { - "name": "MailGuard365_Threats_CL", - "lastDataReceivedQuery": "MailGuard365_Threats_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "name": "MG365ThreatData_CL", + "lastDataReceivedQuery": "MG365ThreatData_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" } ], - "connectivityCriterias": [ + "connectivityCriteria": [ { "type": "IsConnectedQuery", "value": [ - "MailGuard365_Threats_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + "MG365ThreatData_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)" ] } ], "availability": { - "status": 1, - "isPreview": false + "status": 1 }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", + "permissionsDisplayText": "Read and write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { @@ -160,76 +165,127 @@ "read": true, "delete": true } + } + ], + "customs": [ + { + "name": "Microsoft Entra", + "description": "Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher." }, { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } + "name": "Microsoft Azure", + "description": "Permission to assign Monitoring Metrics Publisher role on data collection rule (DCR). Typically requires Azure RBAC Owner or User Access Administrator role." } ] }, "instructionSteps": [ { - "description": "1. In the MailGuard 365 Console, click **Settings** on the navigation bar.\n2. Click the **Integrations** tab.\n3. Click the **Enable Microsoft Sentinel**.\n4. Enter your workspace id and primary key from the fields below, click **Finish**.\n5. For additional instructions, please contact MailGuard 365 support.", + "title": "1. Create ARM Resources and Provide the Required Permissions", + "description": "This connector enables MailGuard 365 to push mail-security event data directly to Microsoft Sentinel via the Azure Monitor Ingestion API.", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "#### Automated Configuration and Secure Data Ingestion with Entra Application \nClicking \"Deploy\" will create a Log Analytics table and a Data Collection Rule (DCR), then create a dedicated Entra application, link the DCR to it, and generate a client secret. This lets MailGuard 365 push data securely to the DCR using an Entra token." + } + }, + { + "type": "DeployPushConnectorButton", + "parameters": { + "label": "Deploy MailGuard 365 Push connector resources", + "applicationDisplayName": "MailGuard 365 Push Connector Application" + } + } + ] + }, + { + "title": "2. Configure MailGuard 365", + "description": "Copy the following values into MailGuard 365 admin console → Settings → Integration so MailGuard 365 knows where to push data for this tenant.", "instructions": [ { + "type": "CopyableLabel", + "parameters": { + "label": "Tenant ID (Directory ID)", + "fillWith": [ + "TenantId" + ] + } + }, + { + "type": "CopyableLabel", "parameters": { + "label": "Entra App Registration Application ID", "fillWith": [ - "WorkspaceId" + "ApplicationId" ], - "label": "Workspace ID" - }, - "type": "CopyableLabel" + "placeholder": "Deploy push connector to get the App Registration Application ID" + } }, { + "type": "CopyableLabel", "parameters": { + "label": "Entra App Registration Secret", "fillWith": [ - "PrimaryKey" + "ApplicationSecret" ], - "label": "Primary Key" - }, - "type": "CopyableLabel" + "placeholder": "Deploy push connector to get the App Registration Secret" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Data Collection Endpoint Uri", + "fillWith": [ + "DataCollectionEndpoint" + ], + "placeholder": "Deploy push connector to get the Data Collection Endpoint Uri" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Data Collection Rule Immutable ID", + "fillWith": [ + "DataCollectionRuleId" + ], + "placeholder": "Deploy push connector to get the Data Collection Rule Immutable ID" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Stream Name", + "value": "Custom-MG365ThreatData_CL" + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### Configure MailGuard 365\nEnter the values above into your MailGuard 365 admin console under Settings → Integration, to enable message data push to Microsoft Sentinel." + } } - ], - "title": "Configure and connect MailGuard 365" - } - ], - "metadata": { - "id": "310bcb08-38be-4257-b4d5-035e1ae3f256", - "version": "1.0.0", - "kind": "dataConnector", - "author": { - "name": "MailGuard 365" - }, - "support": { - "name": "MailGuard 365", - "link": "https://www.mailguard365.com/support", - "tier": "developer" + ] } - } + ] } } }, { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", + "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", + "version": "[variables('dataConnectorCCPVersion')]", "source": { - "kind": "Solution", - "name": "MailGuard 365", - "sourceId": "[variables('_solutionId')]" + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" }, "author": { - "name": "MailGuard", + "name": "MailGuard 365", "email": "[variables('_email')]" }, "support": { @@ -237,6 +293,289 @@ "email": "support@mailguard365.com", "tier": "Partner", "link": "https://www.mailguard365.com/support/" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "name": "MailGuard365DCR", + "apiVersion": "2022-06-01", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "[parameters('workspace-location')]", + "kind": "[variables('blanks')]", + "properties": { + "streamDeclarations": { + "Custom-MG365ThreatData_CL": { + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "MessageId", + "type": "string" + }, + { + "name": "HeaderMessageId", + "type": "string" + }, + { + "name": "UserId", + "type": "string" + }, + { + "name": "CustomerTenantId", + "type": "string" + }, + { + "name": "Score", + "type": "real" + }, + { + "name": "Virus", + "type": "boolean" + }, + { + "name": "Category", + "type": "string" + }, + { + "name": "Attachments", + "type": "dynamic" + }, + { + "name": "Sender", + "type": "dynamic" + }, + { + "name": "Recipients", + "type": "dynamic" + }, + { + "name": "ReceivedHeaders", + "type": "dynamic" + }, + { + "name": "SenderHeader", + "type": "string" + }, + { + "name": "ToHeader", + "type": "string" + }, + { + "name": "CcHeader", + "type": "string" + }, + { + "name": "Subject", + "type": "string" + }, + { + "name": "OriginCountry", + "type": "string" + }, + { + "name": "MessageDate", + "type": "datetime" + }, + { + "name": "MessageSize", + "type": "real" + }, + { + "name": "Action", + "type": "string" + }, + { + "name": "ReceivedDateTime", + "type": "long" + }, + { + "name": "ForefrontAntiSpam", + "type": "string" + }, + { + "name": "MicrosoftAntiSpam", + "type": "string" + }, + { + "name": "IsInWhiteList", + "type": "boolean" + }, + { + "name": "IsInBlackList", + "type": "boolean" + }, + { + "name": "Email", + "type": "string" + }, + { + "name": "HasAttachment", + "type": "boolean" + }, + { + "name": "HasImage", + "type": "boolean" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "[variables('workspaceResourceId')]", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-MG365ThreatData_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source", + "outputStream": "Custom-MG365ThreatData_CL" + } + ], + "dataCollectionEndpointId": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]" + } + }, + { + "name": "MG365ThreatData_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "schema": { + "name": "MG365ThreatData_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "MessageId", + "type": "string" + }, + { + "name": "HeaderMessageId", + "type": "string" + }, + { + "name": "UserId", + "type": "string" + }, + { + "name": "CustomerTenantId", + "type": "string" + }, + { + "name": "Score", + "type": "real" + }, + { + "name": "Virus", + "type": "boolean" + }, + { + "name": "Category", + "type": "string" + }, + { + "name": "Attachments", + "type": "dynamic" + }, + { + "name": "Sender", + "type": "dynamic" + }, + { + "name": "Recipients", + "type": "dynamic" + }, + { + "name": "ReceivedHeaders", + "type": "dynamic" + }, + { + "name": "SenderHeader", + "type": "string" + }, + { + "name": "ToHeader", + "type": "string" + }, + { + "name": "CcHeader", + "type": "string" + }, + { + "name": "Subject", + "type": "string" + }, + { + "name": "OriginCountry", + "type": "string" + }, + { + "name": "MessageDate", + "type": "datetime" + }, + { + "name": "MessageSize", + "type": "real" + }, + { + "name": "Action", + "type": "string" + }, + { + "name": "ReceivedDateTime", + "type": "long" + }, + { + "name": "ForefrontAntiSpam", + "type": "string" + }, + { + "name": "MicrosoftAntiSpam", + "type": "string" + }, + { + "name": "IsInWhiteList", + "type": "boolean" + }, + { + "name": "IsInBlackList", + "type": "boolean" + }, + { + "name": "Email", + "type": "string" + }, + { + "name": "HasAttachment", + "type": "boolean" + }, + { + "name": "HasImage", + "type": "boolean" + } + ] } } } @@ -245,36 +584,191 @@ "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition1'),'-', variables('dataConnectorCCPVersion'))))]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId1')]", - "contentKind": "DataConnector", - "displayName": "MailGuard 365", - "contentProductId": "[variables('_dataConnectorcontentProductId1')]", - "id": "[variables('_dataConnectorcontentProductId1')]", - "version": "[variables('dataConnectorVersion1')]" + "version": "[variables('dataConnectorCCPVersion')]" } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", - "dependsOn": [ - "[variables('_dataConnectorId1')]" - ], + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "MailGuard365", + "title": "MailGuard 365 Connector (Push)", + "publisher": "MailGuard365", + "descriptionMarkdown": "The MailGuard 365 connector provides the capability to push mail-security event data from MailGuard 365 directly into Microsoft Sentinel using the Codeless Connector Framework (CCF) Push pattern. This connector ingests message metadata, sender/recipient details, spam/virus scoring, and attachment information into a custom Log Analytics table for analysis, alerting, and visualization.", + "graphQueries": [ + { + "metricName": "MailGuard 365 Messages", + "legend": "MG365ThreatData_CL", + "baseQuery": "MG365ThreatData_CL" + } + ], + "sampleQueries": [ + { + "description": "Recent messages", + "query": "MG365ThreatData_CL\n | sort by TimeGenerated desc" + }, + { + "description": "Messages flagged as virus", + "query": "MG365ThreatData_CL\n | where Virus == true\n | sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "MG365ThreatData_CL", + "lastDataReceivedQuery": "MG365ThreatData_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "IsConnectedQuery", + "value": [ + "MG365ThreatData_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)" + ] + } + ], + "availability": { + "status": 1 + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "Microsoft Entra", + "description": "Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher." + }, + { + "name": "Microsoft Azure", + "description": "Permission to assign Monitoring Metrics Publisher role on data collection rule (DCR). Typically requires Azure RBAC Owner or User Access Administrator role." + } + ] + }, + "instructionSteps": [ + { + "title": "1. Create ARM Resources and Provide the Required Permissions", + "description": "This connector enables MailGuard 365 to push mail-security event data directly to Microsoft Sentinel via the Azure Monitor Ingestion API.", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "#### Automated Configuration and Secure Data Ingestion with Entra Application \nClicking \"Deploy\" will create a Log Analytics table and a Data Collection Rule (DCR), then create a dedicated Entra application, link the DCR to it, and generate a client secret. This lets MailGuard 365 push data securely to the DCR using an Entra token." + } + }, + { + "type": "DeployPushConnectorButton", + "parameters": { + "label": "Deploy MailGuard 365 Push connector resources", + "applicationDisplayName": "MailGuard 365 Push Connector Application" + } + } + ] + }, + { + "title": "2. Configure MailGuard 365", + "description": "Copy the following values into MailGuard 365 admin console → Settings → Integration so MailGuard 365 knows where to push data for this tenant.", + "instructions": [ + { + "type": "CopyableLabel", + "parameters": { + "label": "Tenant ID (Directory ID)", + "fillWith": [ + "TenantId" + ] + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Entra App Registration Application ID", + "fillWith": [ + "ApplicationId" + ], + "placeholder": "Deploy push connector to get the App Registration Application ID" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Entra App Registration Secret", + "fillWith": [ + "ApplicationSecret" + ], + "placeholder": "Deploy push connector to get the App Registration Secret" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Data Collection Endpoint Uri", + "fillWith": [ + "DataCollectionEndpoint" + ], + "placeholder": "Deploy push connector to get the Data Collection Endpoint Uri" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Data Collection Rule Immutable ID", + "fillWith": [ + "DataCollectionRuleId" + ], + "placeholder": "Deploy push connector to get the Data Collection Rule Immutable ID" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Stream Name", + "value": "Custom-MG365ThreatData_CL" + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### Configure MailGuard 365\nEnter the values above into your MailGuard 365 admin console under Settings → Integration, to enable message data push to Microsoft Sentinel." + } + } + ] + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", + "version": "[variables('dataConnectorCCPVersion')]", "source": { - "kind": "Solution", - "name": "MailGuard 365", - "sourceId": "[variables('_solutionId')]" + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" }, "author": { - "name": "MailGuard", + "name": "MailGuard 365", "email": "[variables('_email')]" }, "support": { @@ -282,173 +776,185 @@ "email": "support@mailguard365.com", "tier": "Partner", "link": "https://www.mailguard365.com/support/" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector" + } + ] } } }, { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections1'), variables('dataConnectorCCPVersion'))]", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "connectorUiConfig": { - "title": "MailGuard 365", - "publisher": "MailGuard365", - "descriptionMarkdown": "MailGuard 365 Enhanced Email Security for Microsoft 365. Exclusive to the Microsoft marketplace, MailGuard 365 is integrated with Microsoft 365 security (incl. Defender) for enhanced protection against advanced email threats like phishing, ransomware and sophisticated BEC attacks.", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "MailGuard365_Threats_CL", - "baseQuery": "MailGuard365_Threats_CL" - } - ], - "dataTypes": [ - { - "name": "MailGuard365_Threats_CL", - "lastDataReceivedQuery": "MailGuard365_Threats_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "MailGuard365_Threats_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "sampleQueries": [ - { - "description": "All phishing threats stopped by MailGuard 365", - "query": "MailGuard365_Threats_CL \n | where Category == \"Phishing\"" + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "displayName": "MailGuard 365 Connector (Push)", + "contentKind": "ResourcesDataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": { + "guidValue": { + "defaultValue": "[[newGuid()]", + "type": "securestring" }, - { - "description": "All threats summarized by sender email address", - "query": "MailGuard365_Threats_CL \n | summarize count() by Sender_Email_s" + "innerWorkspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" }, - { - "description": "All threats summarized by category", - "query": "MailGuard365_Threats_CL \n | summarize count() by Category" + "auth": { + "type": "object", + "defaultValue": { + "appId": "[[parameters('auth').appId]]", + "servicePrincipalId": "[[parameters('auth').servicePrincipalId]]" + } + }, + "connectorDefinitionName": { + "defaultValue": "MailGuard 365 Connector (Push)", + "type": "securestring", + "minLength": 1 + }, + "workspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "dcrConfig": { + "defaultValue": { + "dataCollectionEndpoint": "data collection Endpoint", + "dataCollectionRuleImmutableId": "data collection rule immutableId" + }, + "type": "object" } - ], - "availability": { - "status": 1, - "isPreview": false }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true + "variables": { + "_dataConnectorContentIdConnections1": "[variables('_dataConnectorContentIdConnections1')]" + }, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections1')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections1'))]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "MailGuard 365", + "email": "[variables('_email')]" + }, + "support": { + "name": "MailGuard 365", + "email": "support@mailguard365.com", + "tier": "Partner", + "link": "https://www.mailguard365.com/support/" } } - ] - }, - "instructionSteps": [ + }, { - "description": "1. In the MailGuard 365 Console, click **Settings** on the navigation bar.\n2. Click the **Integrations** tab.\n3. Click the **Enable Microsoft Sentinel**.\n4. Enter your workspace id and primary key from the fields below, click **Finish**.\n5. For additional instructions, please contact MailGuard 365 support.", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId" - ], - "label": "Workspace ID" - }, - "type": "CopyableLabel" + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'MailGuard365ConnectorPolling', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "Push", + "properties": { + "connectorDefinitionName": "MailGuard365", + "dcrConfig": { + "streamName": "Custom-MG365ThreatData_CL", + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" }, - { - "parameters": { - "fillWith": [ - "PrimaryKey" - ], - "label": "Primary Key" - }, - "type": "CopyableLabel" + "auth": { + "type": "Push", + "AppId": "[[parameters('auth').appId]", + "ServicePrincipalId": "[[parameters('auth').servicePrincipalId]" + }, + "request": { + "RetryCount": 1 + }, + "response": { + "eventsJsonPaths": [ + "$" + ] } - ], - "title": "Configure and connect MailGuard 365" + } } - ], - "id": "[variables('_uiConfigId1')]" - } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections1'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName1')]", + "name": "[variables('workbookTemplateSpecName1')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MailGuard365HighConfidenceThreats_HuntingQueries Hunting Query with template version 3.0.0", + "description": "MailGuard365Dashboard Workbook with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion1')]", + "contentVersion": "[variables('workbookVersion1')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", - "name": "MailGuard_365_Hunting_Query_1", + "type": "Microsoft.Insights/workbooks", + "name": "[variables('workbookContentId1')]", "location": "[parameters('workspace-location')]", + "kind": "shared", + "apiVersion": "2021-08-01", + "metadata": { + "description": "MailGuard 365 Workbook" + }, "properties": { - "eTag": "*", - "displayName": "MailGuard 365 - High Confidence Threats", - "category": "Hunting Queries", - "query": "MailGuard365_Threats_CL\n| where Score_d > 20\n| extend MailMessage_0_NetworkMessageId = MessageId_s\n| extend MailMessage_0_Recipient = Email_s\n", - "version": 2, - "tags": [ - { - "name": "description", - "value": "Query searches for high confidence threats stopped by MailGuard 365." - }, - { - "name": "tactics", - "value": "Reconnaissance" - }, - { - "name": "techniques", - "value": "T1598" - } - ] + "displayName": "[parameters('workbook1-name')]", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## MailGuard 365\\n---\\n\\nMailGuard 365 Dashboard\"},\"name\":\"text - 2\"},{\"type\":1,\"content\":{\"json\":\"# Threat Count by Category\"},\"name\":\"text - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MG365ThreatData_CL \\n| summarize Count=count() by Category\\n| render barchart\",\"size\":3,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"name\":\"query - 2\"},{\"type\":1,\"content\":{\"json\":\"# Threat Origin by Country\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MG365ThreatData_CL\\n| summarize Count=count() by OriginCountry\",\"size\":3,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"map\",\"tileSettings\":{\"showBorder\":false},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"OriginCountry\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"Count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"greenRed\"}},\"textSettings\":{\"style\":\"bignumber\"}},\"name\":\"query - 2\"},{\"type\":1,\"content\":{\"json\":\"# Top targetted recipients\"},\"name\":\"text - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MG365ThreatData_CL\\n| summarize Count=count() by Email\",\"size\":0,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":2}]},\"name\":\"query - 6\"},{\"type\":1,\"content\":{\"json\":\"# Threat Count over time\"},\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MG365ThreatData_CL\\n| summarize Count=count() by format_datetime(unixtime_seconds_todatetime(ReceivedDateTime), \\\"yyyy-MM-dd\\\")\\n| sort by Column1 asc\\n\",\"size\":0,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"name\":\"query - 8\"}],\"fromTemplateId\":\"mailguard365-UserWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "version": "1.0", + "sourceId": "[variables('workspaceResourceId')]", + "category": "sentinel" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", "properties": { - "description": "MailGuard 365 Hunting Query 1", - "parentId": "[variables('huntingQueryId1')]", - "contentId": "[variables('_huntingQuerycontentId1')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion1')]", + "description": "@{workbookKey=MailGuard365Workbook; logoFileName=MailGuard365_logo.svg; description=MailGuard 365 Workbook; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.1.0; title=MailGuard365; templateRelativePath=MailGuard365Dashboard.json; subtitle=; provider=MailGuard 365}.description", + "parentId": "[variables('workbookId1')]", + "contentId": "[variables('_workbookContentId1')]", + "kind": "Workbook", + "version": "[variables('workbookVersion1')]", "source": { "kind": "Solution", "name": "MailGuard 365", "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "MailGuard", + "name": "MailGuard 365", "email": "[variables('_email')]" }, "support": { @@ -456,6 +962,19 @@ "email": "support@mailguard365.com", "tier": "Partner", "link": "https://www.mailguard365.com/support/" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "MG365ThreatData_CL", + "kind": "DataType" + }, + { + "contentId": "MailGuard365", + "kind": "DataConnector" + } + ] } } } @@ -466,53 +985,53 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId1')]", - "contentKind": "HuntingQuery", - "displayName": "MailGuard 365 - High Confidence Threats", - "contentProductId": "[variables('_huntingQuerycontentProductId1')]", - "id": "[variables('_huntingQuerycontentProductId1')]", - "version": "[variables('huntingQueryVersion1')]" + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName2')]", + "name": "[variables('huntingQueryObject1').huntingQueryTemplateSpecName1]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MailGuard365PhishingThreats_HuntingQueries Hunting Query with template version 3.0.0", + "description": "MailGuard365HighConfidenceThreats_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion2')]", + "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", - "name": "MailGuard_365_Hunting_Query_2", + "apiVersion": "2025-07-01", + "name": "MailGuard_365_Hunting_Query_1", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "MailGuard 365 - Phishing Threats", + "displayName": "MailGuard 365 - High Confidence Threats", "category": "Hunting Queries", - "query": "MailGuard365_Threats_CL\n| where Category == \"Phishing\"\n| extend MailMessage_0_NetworkMessageId = MessageId_s\n| extend MailMessage_0_Recipient = Email_s\n", + "query": "MG365ThreatData_CL\n| where Score > 20\n", "version": 2, "tags": [ { "name": "description", - "value": "Query searches for phishing threats stopped by MailGuard 365." + "value": "Query searches for high confidence threats stopped by MailGuard 365." }, { "name": "tactics", - "value": "InitialAccess,Reconnaissance,CredentialAccess" + "value": "Reconnaissance" }, { "name": "techniques", - "value": "T1598,T1566" + "value": "T1598" } ] } @@ -520,20 +1039,20 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId2'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1),'/'))))]", "properties": { - "description": "MailGuard 365 Hunting Query 2", - "parentId": "[variables('huntingQueryId2')]", - "contentId": "[variables('_huntingQuerycontentId2')]", + "description": "MailGuard 365 Hunting Query 1", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1)]", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion2')]", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]", "source": { "kind": "Solution", "name": "MailGuard 365", "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "MailGuard", + "name": "MailGuard 365", "email": "[variables('_email')]" }, "support": { @@ -551,40 +1070,40 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId2')]", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", "contentKind": "HuntingQuery", - "displayName": "MailGuard 365 - Phishing Threats", - "contentProductId": "[variables('_huntingQuerycontentProductId2')]", - "id": "[variables('_huntingQuerycontentProductId2')]", - "version": "[variables('huntingQueryVersion2')]" + "displayName": "MailGuard 365 - High Confidence Threats", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName3')]", + "name": "[variables('huntingQueryObject2').huntingQueryTemplateSpecName2]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MailGuard365MalwareThreats_HuntingQueries Hunting Query with template version 3.0.0", + "description": "MailGuard365MalwareThreats_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion3')]", + "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", - "name": "MailGuard_365_Hunting_Query_3", + "apiVersion": "2025-07-01", + "name": "MailGuard_365_Hunting_Query_2", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "MailGuard 365 - Malware Threats", "category": "Hunting Queries", - "query": "MailGuard365_Threats_CL\n| where Category == \"Malicious Attachment\"\n| extend MailMessage_0_NetworkMessageId = MessageId_s\n| extend MailMessage_0_Recipient = Email_s\n", + "query": "MG365ThreatData_CL\n| where Category == \"Malicious Attachment\"\n", "version": 2, "tags": [ { @@ -605,20 +1124,20 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId3'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2),'/'))))]", "properties": { - "description": "MailGuard 365 Hunting Query 3", - "parentId": "[variables('huntingQueryId3')]", - "contentId": "[variables('_huntingQuerycontentId3')]", + "description": "MailGuard 365 Hunting Query 2", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2)]", + "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion3')]", + "version": "[variables('huntingQueryObject2').huntingQueryVersion2]", "source": { "kind": "Solution", "name": "MailGuard 365", "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "MailGuard", + "name": "MailGuard 365", "email": "[variables('_email')]" }, "support": { @@ -636,64 +1155,74 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId3')]", + "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]", "contentKind": "HuntingQuery", "displayName": "MailGuard 365 - Malware Threats", - "contentProductId": "[variables('_huntingQuerycontentProductId3')]", - "id": "[variables('_huntingQuerycontentProductId3')]", - "version": "[variables('huntingQueryVersion3')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('workbookTemplateSpecName1')]", + "name": "[variables('huntingQueryObject3').huntingQueryTemplateSpecName3]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MailGuard365DashboardWorkbook Workbook with template version 3.0.0", + "description": "MailGuard365PhishingThreats_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('workbookVersion1')]", + "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.Insights/workbooks", - "name": "[variables('workbookContentId1')]", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2025-07-01", + "name": "MailGuard_365_Hunting_Query_3", "location": "[parameters('workspace-location')]", - "kind": "shared", - "apiVersion": "2021-08-01", - "metadata": { - "description": "MailGuard 365 Workbook" - }, "properties": { - "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## MailGuard 365\\n---\\n\\nMailGuard 365 Dashboard\"},\"name\":\"text - 2\"},{\"type\":1,\"content\":{\"json\":\"# Threat Count by Category\"},\"name\":\"text - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MailGuard365_Threats_CL \\n| summarize Count=count() by Category\\n| render barchart\",\"size\":3,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"name\":\"query - 2\"},{\"type\":1,\"content\":{\"json\":\"# Threat Origin by Country\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MailGuard365_Threats_CL\\n| summarize Count=count() by OriginCountry_s\",\"size\":3,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"map\",\"tileSettings\":{\"showBorder\":false},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"OriginCountry_s\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"Count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"greenRed\"}},\"textSettings\":{\"style\":\"bignumber\"}},\"name\":\"query - 2\"},{\"type\":1,\"content\":{\"json\":\"# Top targetted recipients\"},\"name\":\"text - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MailGuard365_Threats_CL\\n| summarize Count=count() by Email_s\",\"size\":0,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":2}]},\"name\":\"query - 6\"},{\"type\":1,\"content\":{\"json\":\"# Threat Count over time\"},\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MailGuard365_Threats_CL\\n| summarize Count=count() by format_datetime(unixtime_seconds_todatetime(ReceivedDateTime_d), \\\"yyyy-MM-dd\\\")\\n| sort by Column1 asc\\n\",\"size\":0,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"name\":\"query - 8\"}],\"fromTemplateId\":\"mailguard365-UserWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", - "version": "1.0", - "sourceId": "[variables('workspaceResourceId')]", - "category": "sentinel" + "eTag": "*", + "displayName": "MailGuard 365 - Phishing Threats", + "category": "Hunting Queries", + "query": "MG365ThreatData_CL\n| where Category == \"Phishing\"\n", + "version": 2, + "tags": [ + { + "name": "description", + "value": "Query searches for phishing threats stopped by MailGuard 365." + }, + { + "name": "tactics", + "value": "InitialAccess,Reconnaissance,CredentialAccess" + }, + { + "name": "techniques", + "value": "T1598,T1566" + } + ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3),'/'))))]", "properties": { - "description": "@{workbookKey=MailGuard365Workbook; logoFileName=MailGuard365_logo.svg; description=MailGuard 365 Workbook; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=MailGuard365; templateRelativePath=MailGuard365Dashboard.json; subtitle=; provider=MailGuard 365}.description", - "parentId": "[variables('workbookId1')]", - "contentId": "[variables('_workbookContentId1')]", - "kind": "Workbook", - "version": "[variables('workbookVersion1')]", + "description": "MailGuard 365 Hunting Query 3", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3)]", + "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryObject3').huntingQueryVersion3]", "source": { "kind": "Solution", "name": "MailGuard 365", "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "MailGuard", + "name": "MailGuard 365", "email": "[variables('_email')]" }, "support": { @@ -701,19 +1230,6 @@ "email": "support@mailguard365.com", "tier": "Partner", "link": "https://www.mailguard365.com/support/" - }, - "dependencies": { - "operator": "AND", - "criteria": [ - { - "contentId": "MailGuard365_Threats_CL", - "kind": "DataType" - }, - { - "contentId": "MailGuard365", - "kind": "DataConnector" - } - ] } } } @@ -724,12 +1240,12 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_workbookContentId1')]", - "contentKind": "Workbook", - "displayName": "[parameters('workbook1-name')]", - "contentProductId": "[variables('_workbookcontentProductId1')]", - "id": "[variables('_workbookcontentProductId1')]", - "version": "[variables('workbookVersion1')]" + "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]", + "contentKind": "HuntingQuery", + "displayName": "MailGuard 365 - Phishing Threats", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", + "version": "1.0.0" } }, { @@ -737,12 +1253,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.0", + "version": "3.0.1", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "MailGuard 365", "publisherDisplayName": "MailGuard 365", - "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Strengthen your Microsoft 365 email security against advanced zero-day phishing, ransomware & BEC attacks with MailGuard 365 enhanced email security. This Microsoft Sentinel Solution enables you to ingest threat data from MailGuard 365.

\n

Data Connectors: 1, Workbooks: 1, Hunting Queries: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Strengthen your Microsoft 365 email security against advanced zero-day phishing, ransomware & BEC attacks with MailGuard 365 enhanced email security. This Microsoft Sentinel Solution enables you to ingest threat data from MailGuard 365 via the Azure Monitor Logs Ingestion API, using a dedicated Entra application.

\n

Data Connectors: 1, Workbooks: 1, Hunting Queries: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -755,7 +1271,7 @@ "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "MailGuard", + "name": "MailGuard 365", "email": "[variables('_email')]" }, "support": { @@ -769,33 +1285,33 @@ "criteria": [ { "kind": "DataConnector", - "contentId": "[variables('_dataConnectorContentId1')]", - "version": "[variables('dataConnectorVersion1')]" + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "version": "[variables('dataConnectorCCPVersion')]" }, { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId1')]", - "version": "[variables('huntingQueryVersion1')]" + "kind": "Workbook", + "contentId": "[variables('_workbookContentId1')]", + "version": "[variables('workbookVersion1')]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId2')]", - "version": "[variables('huntingQueryVersion2')]" + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId3')]", - "version": "[variables('huntingQueryVersion3')]" + "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]", + "version": "[variables('huntingQueryObject2').huntingQueryVersion2]" }, { - "kind": "Workbook", - "contentId": "[variables('_workbookContentId1')]", - "version": "[variables('workbookVersion1')]" + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]", + "version": "[variables('huntingQueryObject3').huntingQueryVersion3]" } ] }, "firstPublishDate": "2023-05-09", - "lastPublishDate": "2023-06-08", + "lastPublishDate": "2026-09-14", "providers": [ "MailGuard" ], diff --git a/Solutions/MailGuard 365/Package/testParameters.json b/Solutions/MailGuard 365/Package/testParameters.json new file mode 100644 index 00000000000..e34a454c057 --- /dev/null +++ b/Solutions/MailGuard 365/Package/testParameters.json @@ -0,0 +1,46 @@ +{ + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } + }, + "workbook1-name": { + "type": "string", + "defaultValue": "MailGuard365", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + } +} diff --git a/Solutions/MailGuard 365/ReleaseNotes.md b/Solutions/MailGuard 365/ReleaseNotes.md index a05f69abc74..994d4954186 100644 --- a/Solutions/MailGuard 365/ReleaseNotes.md +++ b/Solutions/MailGuard 365/ReleaseNotes.md @@ -1,3 +1,4 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------| -| 3.0.0 | 31-08-2023 | Initial Solution Release | \ No newline at end of file +| 3.0.1 | 14-09-2026 | Migrated data connector from the deprecated HTTP Data Collector API to the Azure Monitor Logs Ingestion API (Codeless Connector Framework Push pattern). Data now lands in the `MG365ThreatData_CL` table via a Data Collection Rule; the legacy `MailGuard365_Threats_CL` table is no longer written to. Updated workbook and hunting queries to the new schema. | +| 3.0.0 | 31-08-2023 | Initial Solution Release | diff --git a/Solutions/MailGuard 365/SolutionMetadata.json b/Solutions/MailGuard 365/SolutionMetadata.json index cb9c843521e..a0cb089cdc5 100644 --- a/Solutions/MailGuard 365/SolutionMetadata.json +++ b/Solutions/MailGuard 365/SolutionMetadata.json @@ -2,7 +2,7 @@ "publisherId": "mailguardptylimited", "offerId": "microsoft-sentinel-solution-mailguard365", "firstPublishDate": "2023-05-09", - "lastPublishDate": "2023-06-08", + "lastPublishDate": "2026-09-14", "providers": ["MailGuard"], "categories": { "domains" : ["Security - Threat Protection"], @@ -14,4 +14,4 @@ "tier": "Partner", "link": "https://www.mailguard365.com/support/" } -} \ No newline at end of file +} diff --git a/Solutions/MailGuard 365/Workbooks/MailGuard365Dashboard.json b/Solutions/MailGuard 365/Workbooks/MailGuard365Dashboard.json index f335f27f92f..d4b9e50193f 100644 --- a/Solutions/MailGuard 365/Workbooks/MailGuard365Dashboard.json +++ b/Solutions/MailGuard 365/Workbooks/MailGuard365Dashboard.json @@ -19,7 +19,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "MailGuard365_Threats_CL \n| summarize Count=count() by Category\n| render barchart", + "query": "MG365ThreatData_CL \n| summarize Count=count() by Category\n| render barchart", "size": 3, "timeContext": { "durationMs": 2592000000 @@ -41,7 +41,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "MailGuard365_Threats_CL\n| summarize Count=count() by OriginCountry_s", + "query": "MG365ThreatData_CL\n| summarize Count=count() by OriginCountry", "size": 3, "timeContext": { "durationMs": 2592000000 @@ -54,7 +54,7 @@ }, "mapSettings": { "locInfo": "CountryRegion", - "locInfoColumn": "OriginCountry_s", + "locInfoColumn": "OriginCountry", "sizeSettings": "Count", "sizeAggregation": "Sum", "legendMetric": "Count", @@ -83,7 +83,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "MailGuard365_Threats_CL\n| summarize Count=count() by Email_s", + "query": "MG365ThreatData_CL\n| summarize Count=count() by Email", "size": 0, "timeContext": { "durationMs": 2592000000 @@ -119,7 +119,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "MailGuard365_Threats_CL\n| summarize Count=count() by format_datetime(unixtime_seconds_todatetime(ReceivedDateTime_d), \"yyyy-MM-dd\")\n| sort by Column1 asc\n", + "query": "MG365ThreatData_CL\n| summarize Count=count() by format_datetime(unixtime_seconds_todatetime(ReceivedDateTime), \"yyyy-MM-dd\")\n| sort by Column1 asc\n", "size": 0, "timeContext": { "durationMs": 2592000000 @@ -133,4 +133,4 @@ ], "fromTemplateId": "mailguard365-UserWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" -} \ No newline at end of file +} diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json index 35d2aa0831e..d03e98ec911 100644 --- a/Workbooks/WorkbooksMetadata.json +++ b/Workbooks/WorkbooksMetadata.json @@ -8118,18 +8118,18 @@ "logoFileName": "MailGuard365_logo.svg", "description": "MailGuard 365 Workbook", "dataTypesDependencies": [ - "MailGuard365_Threats_CL" + "MG365ThreatData_CL" ], "dataConnectorsDependencies": [ - "MailGuard365" + "MailGuard365" ], "previewImagesFileNames": [ - "MailGuard365WorkbookWhite1.png", - "MailGuard365WorkbookWhite2.png", - "MailGuard365WorkbookBlack1.png", - "MailGuard365WorkbookBlack2.png" + "MailGuard365WorkbookWhite1.png", + "MailGuard365WorkbookWhite2.png", + "MailGuard365WorkbookBlack1.png", + "MailGuard365WorkbookBlack2.png" ], - "version": "1.0.0", + "version": "1.1.0", "title": "MailGuard365", "templateRelativePath": "MailGuard365Dashboard.json", "subtitle": "",