From 6efc40498d923bdc6345148addebac07d9852df6 Mon Sep 17 00:00:00 2001 From: Willup Sovis Date: Thu, 29 Oct 2026 12:17:22 +1100 Subject: [PATCH 1/2] MailGuard 365: migrate data connector to CCF Push (v3.0.1) - Replace the HTTP Data Collector API connector with a Codeless Connector Framework Push connector using the Azure Monitor Logs Ingestion API (connector definition, DCR, table, polling config) - Data now lands in MG365ThreatData_CL; the legacy MailGuard365_Threats_CL table is no longer written to - Update workbook and hunting queries to the new schema - Add Data/Solution_MailGuard365.json and regenerate Package (3.0.1) - Update WorkbooksMetadata.json: new data type dependency, workbook version 1.1.0 - Update ReleaseNotes.md and SolutionMetadata.json --- .../MailGuard365_ConnectorDefinition.json | 163 +++ .../MailGuard365_ccf/MailGuard365_DCR.json | 147 ++ .../MailGuard365_PollingConfig.json | 27 + .../MailGuard365_ccf/MailGuard365_Table.json | 124 ++ .../Data/Solution_MailGuard365.json | 22 + .../MailGuard365HighConfidenceThreats.yaml | 19 +- .../MailGuard365MalwareThreats.yaml | 17 +- .../MailGuard365PhishingThreats.yaml | 19 +- Solutions/MailGuard 365/Package/3.0.1.zip | Bin 0 -> 9672 bytes .../Package/createUiDefinition.json | 20 +- .../MailGuard 365/Package/mainTemplate.json | 1196 ++++++++++++----- .../MailGuard 365/Package/testParameters.json | 46 + Solutions/MailGuard 365/ReleaseNotes.md | 3 +- Solutions/MailGuard 365/SolutionMetadata.json | 4 +- .../Workbooks/MailGuard365Dashboard.json | 12 +- Workbooks/WorkbooksMetadata.json | 14 +- 16 files changed, 1438 insertions(+), 395 deletions(-) create mode 100644 Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_ConnectorDefinition.json create mode 100644 Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_DCR.json create mode 100644 Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_PollingConfig.json create mode 100644 Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_Table.json create mode 100644 Solutions/MailGuard 365/Data/Solution_MailGuard365.json create mode 100644 Solutions/MailGuard 365/Package/3.0.1.zip create mode 100644 Solutions/MailGuard 365/Package/testParameters.json diff --git a/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_ConnectorDefinition.json b/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_ConnectorDefinition.json new file mode 100644 index 00000000000..e5a4a61a3d7 --- /dev/null +++ b/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_ConnectorDefinition.json @@ -0,0 +1,163 @@ +{ + "name": "MailGuard365", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "MailGuard365", + "title": "MailGuard 365 Connector (Push)", + "publisher": "MailGuard365", + "descriptionMarkdown": "The MailGuard 365 connector provides the capability to push mail-security event data from MailGuard 365 directly into Microsoft Sentinel using the Codeless Connector Framework (CCF) Push pattern. This connector ingests message metadata, sender/recipient details, spam/virus scoring, and attachment information into a custom Log Analytics table for analysis, alerting, and visualization.", + "graphQueries": [ + { + "metricName": "MailGuard 365 Messages", + "legend": "MG365ThreatData_CL", + "baseQuery": "MG365ThreatData_CL" + } + ], + "sampleQueries": [ + { + "description": "Recent messages", + "query": "MG365ThreatData_CL\n | sort by TimeGenerated desc" + }, + { + "description": "Messages flagged as virus", + "query": "MG365ThreatData_CL\n | where Virus == true\n | sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "MG365ThreatData_CL", + "lastDataReceivedQuery": "MG365ThreatData_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "IsConnectedQuery", + "value": [ + "MG365ThreatData_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)" + ] + } + ], + "availability": { + "status": 1 + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "Microsoft Entra", + "description": "Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher." + }, + { + "name": "Microsoft Azure", + "description": "Permission to assign Monitoring Metrics Publisher role on data collection rule (DCR). Typically requires Azure RBAC Owner or User Access Administrator role." + } + ] + }, + "instructionSteps": [ + { + "title": "1. Create ARM Resources and Provide the Required Permissions", + "description": "This connector enables MailGuard 365 to push mail-security event data directly to Microsoft Sentinel via the Azure Monitor Ingestion API.", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "#### Automated Configuration and Secure Data Ingestion with Entra Application \nClicking \"Deploy\" will create a Log Analytics table and a Data Collection Rule (DCR), then create a dedicated Entra application, link the DCR to it, and generate a client secret. This lets MailGuard 365 push data securely to the DCR using an Entra token." + } + }, + { + "type": "DeployPushConnectorButton", + "parameters": { + "label": "Deploy MailGuard 365 Push connector resources", + "applicationDisplayName": "MailGuard 365 Push Connector Application" + } + } + ] + }, + { + "title": "2. Configure MailGuard 365", + "description": "Copy the following values into MailGuard 365 admin console → Settings → Integration so MailGuard 365 knows where to push data for this tenant.", + "instructions": [ + { + "type": "CopyableLabel", + "parameters": { + "label": "Tenant ID (Directory ID)", + "fillWith": [ + "TenantId" + ] + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Entra App Registration Application ID", + "fillWith": [ + "ApplicationId" + ], + "placeholder": "Deploy push connector to get the App Registration Application ID" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Entra App Registration Secret", + "fillWith": [ + "ApplicationSecret" + ], + "placeholder": "Deploy push connector to get the App Registration Secret" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Data Collection Endpoint Uri", + "fillWith": [ + "DataCollectionEndpoint" + ], + "placeholder": "Deploy push connector to get the Data Collection Endpoint Uri" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Data Collection Rule Immutable ID", + "fillWith": [ + "DataCollectionRuleId" + ], + "placeholder": "Deploy push connector to get the Data Collection Rule Immutable ID" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Stream Name", + "value": "Custom-MG365ThreatData_CL" + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### Configure MailGuard 365\nEnter the values above into your MailGuard 365 admin console under Settings → Integration, to enable message data push to Microsoft Sentinel." + } + } + ] + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_DCR.json b/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_DCR.json new file mode 100644 index 00000000000..3889a9f358b --- /dev/null +++ b/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_DCR.json @@ -0,0 +1,147 @@ +{ + "name": "MailGuard365DCR", + "apiVersion": "2021-09-01-preview", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "[parameters('workspace-location')]", + "properties": { + "streamDeclarations": { + "Custom-MG365ThreatData_CL": { + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "MessageId", + "type": "string" + }, + { + "name": "HeaderMessageId", + "type": "string" + }, + { + "name": "UserId", + "type": "string" + }, + { + "name": "CustomerTenantId", + "type": "string" + }, + { + "name": "Score", + "type": "real" + }, + { + "name": "Virus", + "type": "boolean" + }, + { + "name": "Category", + "type": "string" + }, + { + "name": "Attachments", + "type": "dynamic" + }, + { + "name": "Sender", + "type": "dynamic" + }, + { + "name": "Recipients", + "type": "dynamic" + }, + { + "name": "ReceivedHeaders", + "type": "dynamic" + }, + { + "name": "SenderHeader", + "type": "string" + }, + { + "name": "ToHeader", + "type": "string" + }, + { + "name": "CcHeader", + "type": "string" + }, + { + "name": "Subject", + "type": "string" + }, + { + "name": "OriginCountry", + "type": "string" + }, + { + "name": "MessageDate", + "type": "datetime" + }, + { + "name": "MessageSize", + "type": "real" + }, + { + "name": "Action", + "type": "string" + }, + { + "name": "ReceivedDateTime", + "type": "long" + }, + { + "name": "ForefrontAntiSpam", + "type": "string" + }, + { + "name": "MicrosoftAntiSpam", + "type": "string" + }, + { + "name": "IsInWhiteList", + "type": "boolean" + }, + { + "name": "IsInBlackList", + "type": "boolean" + }, + { + "name": "Email", + "type": "string" + }, + { + "name": "HasAttachment", + "type": "boolean" + }, + { + "name": "HasImage", + "type": "boolean" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "[variables('workspaceResourceId')]", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-MG365ThreatData_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source", + "outputStream": "Custom-MG365ThreatData_CL" + } + ], + "dataCollectionEndpointId": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]" + } +} \ No newline at end of file diff --git a/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_PollingConfig.json b/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_PollingConfig.json new file mode 100644 index 00000000000..8e562082270 --- /dev/null +++ b/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_PollingConfig.json @@ -0,0 +1,27 @@ +{ + "name": "MailGuard365ConnectorPolling", + "apiVersion": "2024-09-01", + "type": "Microsoft.SecurityInsights/dataConnectors", + "kind": "Push", + "properties": { + "connectorDefinitionName": "MailGuard365", + "dcrConfig": { + "streamName": "Custom-MG365ThreatData_CL", + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" + }, + "auth": { + "type": "Push", + "AppId": "[[parameters('auth').appId]", + "ServicePrincipalId": "[[parameters('auth').servicePrincipalId]" + }, + "request": { + "RetryCount": 1 + }, + "response": { + "eventsJsonPaths": [ + "$" + ] + } + } +} \ No newline at end of file diff --git a/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_Table.json b/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_Table.json new file mode 100644 index 00000000000..703f90202ec --- /dev/null +++ b/Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_Table.json @@ -0,0 +1,124 @@ +{ + "name": "MG365ThreatData_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2025-07-01", + "properties": { + "schema": { + "name": "MG365ThreatData_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "MessageId", + "type": "string" + }, + { + "name": "HeaderMessageId", + "type": "string" + }, + { + "name": "UserId", + "type": "string" + }, + { + "name": "CustomerTenantId", + "type": "string" + }, + { + "name": "Score", + "type": "real" + }, + { + "name": "Virus", + "type": "boolean" + }, + { + "name": "Category", + "type": "string" + }, + { + "name": "Attachments", + "type": "dynamic" + }, + { + "name": "Sender", + "type": "dynamic" + }, + { + "name": "Recipients", + "type": "dynamic" + }, + { + "name": "ReceivedHeaders", + "type": "dynamic" + }, + { + "name": "SenderHeader", + "type": "string" + }, + { + "name": "ToHeader", + "type": "string" + }, + { + "name": "CcHeader", + "type": "string" + }, + { + "name": "Subject", + "type": "string" + }, + { + "name": "OriginCountry", + "type": "string" + }, + { + "name": "MessageDate", + "type": "datetime" + }, + { + "name": "MessageSize", + "type": "real" + }, + { + "name": "Action", + "type": "string" + }, + { + "name": "ReceivedDateTime", + "type": "long" + }, + { + "name": "ForefrontAntiSpam", + "type": "string" + }, + { + "name": "MicrosoftAntiSpam", + "type": "string" + }, + { + "name": "IsInWhiteList", + "type": "boolean" + }, + { + "name": "IsInBlackList", + "type": "boolean" + }, + { + "name": "Email", + "type": "string" + }, + { + "name": "HasAttachment", + "type": "boolean" + }, + { + "name": "HasImage", + "type": "boolean" + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/MailGuard 365/Data/Solution_MailGuard365.json b/Solutions/MailGuard 365/Data/Solution_MailGuard365.json new file mode 100644 index 00000000000..e4d8af6d078 --- /dev/null +++ b/Solutions/MailGuard 365/Data/Solution_MailGuard365.json @@ -0,0 +1,22 @@ +{ + "Name": "MailGuard 365", + "Author": "MailGuard 365 - support@mailguard365.com", + "Logo": "", + "Description": "Strengthen your Microsoft 365 email security against advanced zero-day phishing, ransomware & BEC attacks with MailGuard 365 enhanced email security. This Microsoft Sentinel Solution enables you to ingest threat data from MailGuard 365 via the Azure Monitor Logs Ingestion API, using a dedicated Entra application.", + "Data Connectors": [ + "Data Connectors/MailGuard365_ccf/MailGuard365_ConnectorDefinition.json" + ], + "Workbooks": [ + "Workbooks/MailGuard365Dashboard.json" + ], + "Hunting Queries": [ + "Hunting Queries/MailGuard365HighConfidenceThreats.yaml", + "Hunting Queries/MailGuard365MalwareThreats.yaml", + "Hunting Queries/MailGuard365PhishingThreats.yaml" + ], + "BasePath": "C:\\path\\to\\Azure-Sentinel\\Solutions\\MailGuard 365", + "Version": "3.0.1", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1PConnector": false +} diff --git a/Solutions/MailGuard 365/Hunting Queries/MailGuard365HighConfidenceThreats.yaml b/Solutions/MailGuard 365/Hunting Queries/MailGuard365HighConfidenceThreats.yaml index 35a311007c1..fef51d5abc9 100644 --- a/Solutions/MailGuard 365/Hunting Queries/MailGuard365HighConfidenceThreats.yaml +++ b/Solutions/MailGuard 365/Hunting Queries/MailGuard365HighConfidenceThreats.yaml @@ -1,25 +1,24 @@ id: 5e3aa1a5-5b69-421e-a3ac-32b04cb10353 name: MailGuard 365 - High Confidence Threats description: | - 'Query searches for high confidence threats stopped by MailGuard 365.' -severity: Medium + Query searches for high confidence threats stopped by MailGuard 365. requiredDataConnectors: - connectorId: MailGuard365 dataTypes: - - MailGuard365 + - MG365ThreatData_CL tactics: - Reconnaissance relevantTechniques: - T1598 query: | - MailGuard365_Threats_CL - | where Score_d > 20 - | extend MailMessage_0_NetworkMessageId = MessageId_s - | extend MailMessage_0_Recipient = Email_s + MG365ThreatData_CL + | where Score > 20 entityMappings: - - entityType: Mail message + - entityType: MailMessage fieldMappings: - identifier: NetworkMessageId - columnName: MessageId_s + columnName: MessageId - identifier: Recipient - columnName: Email_s \ No newline at end of file + columnName: Email +version: 1.0.0 +kind: Scheduled \ No newline at end of file diff --git a/Solutions/MailGuard 365/Hunting Queries/MailGuard365MalwareThreats.yaml b/Solutions/MailGuard 365/Hunting Queries/MailGuard365MalwareThreats.yaml index d94c0a1947e..5e1f8624a4c 100644 --- a/Solutions/MailGuard 365/Hunting Queries/MailGuard365MalwareThreats.yaml +++ b/Solutions/MailGuard 365/Hunting Queries/MailGuard365MalwareThreats.yaml @@ -1,12 +1,11 @@ id: daaae6ad-1fd0-4efa-b571-116689e67a20 name: MailGuard 365 - Malware Threats description: | - 'Query searches for malware threats stopped by MailGuard 365.' -severity: High + Query searches for malware threats stopped by MailGuard 365. requiredDataConnectors: - connectorId: MailGuard365 dataTypes: - - MailGuard365 + - MG365ThreatData_CL tactics: - InitialAccess - Reconnaissance @@ -18,14 +17,14 @@ relevantTechniques: - T1189 - T1190 query: | - MailGuard365_Threats_CL + MG365ThreatData_CL | where Category == "Malicious Attachment" - | extend MailMessage_0_NetworkMessageId = MessageId_s - | extend MailMessage_0_Recipient = Email_s entityMappings: - - entityType: Mail message + - entityType: MailMessage fieldMappings: - identifier: NetworkMessageId - columnName: MessageId_s + columnName: MessageId - identifier: Recipient - columnName: Email_s + columnName: Email +version: 1.0.0 +kind: Scheduled \ No newline at end of file diff --git a/Solutions/MailGuard 365/Hunting Queries/MailGuard365PhishingThreats.yaml b/Solutions/MailGuard 365/Hunting Queries/MailGuard365PhishingThreats.yaml index 90988e629ee..bf64a62060e 100644 --- a/Solutions/MailGuard 365/Hunting Queries/MailGuard365PhishingThreats.yaml +++ b/Solutions/MailGuard 365/Hunting Queries/MailGuard365PhishingThreats.yaml @@ -1,28 +1,27 @@ id: ee15ed10-d355-474e-b8ad-a8bbb76f6d38 name: MailGuard 365 - Phishing Threats description: | - 'Query searches for phishing threats stopped by MailGuard 365.' -severity: Medium + Query searches for phishing threats stopped by MailGuard 365. requiredDataConnectors: - connectorId: MailGuard365 dataTypes: - - MailGuard365 + - MG365ThreatData_CL tactics: - InitialAccess - Reconnaissance - - Credential Access + - CredentialAccess relevantTechniques: - T1598 - T1566 query: | - MailGuard365_Threats_CL + MG365ThreatData_CL | where Category == "Phishing" - | extend MailMessage_0_NetworkMessageId = MessageId_s - | extend MailMessage_0_Recipient = Email_s entityMappings: - - entityType: Mail message + - entityType: MailMessage fieldMappings: - identifier: NetworkMessageId - columnName: MessageId_s + columnName: MessageId - identifier: Recipient - columnName: Email_s \ No newline at end of file + columnName: Email +version: 1.0.0 +kind: Scheduled \ No newline at end of file diff --git a/Solutions/MailGuard 365/Package/3.0.1.zip b/Solutions/MailGuard 365/Package/3.0.1.zip new file mode 100644 index 0000000000000000000000000000000000000000..5449ba0f56e012529b772aeb74b91a3da399f505 GIT binary patch literal 9672 zcmZ{KV{jz^v*nGGNhY>!Clfolv2AN&CllK?ZfxDynAkQZo?v1d`@Q|MyRY_j|LE$j zuJg0&RG*_P2L+7@007_t5T*tO#7XunOK<={Jt+Wy^Pj1ii-n1sg~m?_3(KDlKiz&h zIxyR~IyxNcoH_jIMEfKmy<$~nF~sZAHQH@v%~pF}6GiWH*jiIi_KJf7^Ds1&Nr#nm zub05SGWsBiv`z;iPb)@XOl+Vva7W`c`2mykBd;{&shsl9xo{9Sq4y->}09kN`n9AH3; z?gu&UYmaJKyM(w;Zq%A}wG}hpZKobS{hl7DrZsRNce?5jgqL0@ZWbc`ERg^R)~?Qy zPDcSin(Ra+OkMAyTFUDZaxth`0{?h#3jeh>qj1r>c;`=|GFEu^U62^9|CI`#fxS3T z6xHH_NfsUVRPxT>DRLMp#ygYgZaq@YH}By)66&kNI{1`N^iJtsMB$So51EO0xp17a z%MJGuAp@X`rgWdaBB8b^YHj-}AR=~f9PE&=L_?aH3tZe)4b4hdoeh&Uj^?mO4Q-5< zkx{bVve8LYiV*4ie0d7!BOsZYA=mHeSLL?1sDo>nEbV%FJ3%tNI02T{9G=%bdOYS6 z#WEZkdZykaGD5H)vI9dB8(`$ozz(T-45%yE_84p5W7zpym(yFuSL8AV$o^UrVodNW zIHO_PxP~V_4W>U7V9DyuMh?5f?u6-~YBwQFW%j|= zDsUpkbEgACUJm!QyHr06TBr&Xd;_NDpDWgz!heoV&s-Q>`6P|6PM~Y7-RS2K(yXb^Wpe>)^30$}CeFeW?NzR*s+f9H`Udc~r%XeV6S?A; zZYyDm8NVA*?O-P-_!&%l;KT1_;g)@it)B(+%p%bi<{F6w{DR)A?F+3FOfD>q0_m_T z^GW0JF3vS+9J(Gm3%Z8iZpp9Z*)fuj`9ujr(SG3~dk&n%e+#)nY<3`$R#jN$_j=iHjF}>}Vt(Ks z(H)-pzA?@VPthNtS8MmY0R1XBIb3lnly`M;ei7^8&%d$0^{p<%y`2A#Tl5`^K%ZHz zg)Wdr@|eaO%(sxNppyLT&G|QZIMZf)a^!R%AEjOs-%bpIo9|fN=~zrQ(d|-q9Gg-% zvK}Qg)IA*G@cea1^fP@N^5>8C32h--2wvJnv-)L)z*^Q$sv9zO7czk_h>EwOQ+}sc z_1SrK+oat+)Ke?l8=P=)T=B(RiKAKQ-phFK)OJr#zEO9SZYx==@MRn>cEQ*)Mi;s zDQnc`o#v1>x2o65@ABOLa5~-d;v7ZtCqZ?TyGN^8>6Lg%*1cKk`*WFImA6ol0ApA2 z2y^DorUmLBmxH_A^*?d@jocvE)OvC4)0tXg3^~@_oD>>?PMogRmuK4%=KJ!LOOwF5HN24a{5_@U$kRN`9%^8fy5q(XCCAtQr}b zcpK=oS>9*ZvkBHxc20o^d?!nG-3PG=xdSOkw-?D_J6geS+fkYqpJ$i;9y*SD;=f88 z&Ua>MTSsYI*q{g&fQ-PbH#xj5OqmH!LQ-}2U!L1KR@kVvI_awUm4ZdjjDp&uvDM5r z7kA!6Lq@RM<% zwlb`3WAzcSVA&wR6v?M|(`r=CW&Xbtv%cv7m=={zZSM;UEM# z-2&O}g;{k6Vhz?Jm#HMlM~Ghn7^Sa0uWQ#Ij0VIaL@{6+CuQ*f&r(RKMh{94+*P&9 z?+AIfQ1}|EMkX)1bpfM8c4oze46eDF#luUq$XKcs9QBoYVu*->%>mI=P%J z)XNbwaJFuaT}TCN{IC(gmIK<{&l7aCY9PxDBYp&;{kLElz2AFMSr3nK9h@uYvGN~l zO^<~fw{`*72;ftakoYkd9tCz=k7}z6p)yaU{6B(zw=By44-t^U5Q2Rq1OQe)0RXiB z5CMCWpAPC4_D**Hp#%S$0{rJ3x@__!fAwm-A=6r3nHxnlQjX5#%c!2MabWBWVdP)r zzMz(}qaw&@r$9pmdZcElZH{>b_rltbrH2H@BwkFHBXWTv~ZxM_nUeGzfddiRYBh{F3G*rIJA_<4l4 zo@sDJgwB)b=sq(iVFL@%@CsR$2Am9s*n~wws71}DcrA~DLHad@_S?PFwRZjVBeMCUKQoD+3U!NUvBHT$b`b)J1mBBSLb$0u(D~G%ncotu*uP&MHoA=I*;gJuAKRpKg@}Y*`vzi~ zV^+kEY*G%hs{_qh=w-FSjf-2_cAQ|2t%R2xH!E}kx3ZDgS7nq!GtcT2<#`_*a{3GW z`*^5u8nqb@^y&dVgT&S#ndP4st)WXOGN_~x7~Wo9x?{Ns>&XpQPUqB0@pDwj^`w@{ zB?0Rr%}V4$n(8rmSl?dfFV?_jo}DUz!a!PL3_Utx?t+e{+#}hSh)ig^!jwwSmbV=B z<`w@5&BhM`AJ+C{@S0Dw7z&?tHOHl!=(~|2*)Xe?H(4doJ?w^ze42E&f$?t5nP&m%Vw1x-=rEV?(}maOwu?BtL| zi9m6HWm(xpL?yB~%*42G=};V~gcv9sp+zgMy+P~#^jbud>u_xOC+T-!yZEtlggQ}J z{-jdN$-%cOFVr^ElaiHQ!kn_C`hk?MXw=*uf-ekS-^47Y#jB=opc)rbhf+lPcsk9C zLIZd>r`c_SE8!**6u7bQuDJ%!h=WfvD}j@%%ZoA_SuHo3Xzq_xt!~9!=Ak39;|Rt^ zPwnAt6TioaBIZ!k3-MKA{Z79(w$9K;udDGsVx-5Xd?E2SrQLd?l%7F;Q^#E9CG#r> zEFaIaCM|5Bb$!Gi(H#%Zr^oYAC1MJncg#*MUq0f5{Bxtrt}Z3pM$f1CHNA2~$w%rH zT1QAdZIPpv)OItJK?RnU6F_G0Sn`(DK|0M_MCje z1GB679m7$wPnb;cC1UW?iCZ%JJh8|&)mrXXE@eT9UMwYg%MXVOa=gH4;WBO%Kp3N6T@r>Q!HQ4~3GM zRml#O7bV#jIa6$vY6El}jVpXFdvZ_xF<1*@d~f?`VR@75V^vS|N;8c;<2rX+EpzNgka)l$w1hnnS-9>ymoBEuxnwCdIdM%7dHxll3M^D!ZQoCz?Pu1%*Wtb zeF2ffGFTwW(QMYcV8yTo?@X~>@{oH!=^_j*r*LylU9vmkKb@hY6yBqd_APuq%a4$x)+)r+0;ffp1L#DR&7v9 z3Yc`tqJKJ)9XO6laC9XGkWrcLA*=ok%0M*w4e2D-n%54Dh1ngvC5%`_^|2XY$UY0> z-A|Mfvxh5#JVJ8_i+s&Q@T~6J8uLmkpKzv65iJ}t+mQ?~+SFrMiC}z@x4p9YW)S)kOhxkeGhatU!l;P)4!Va&39NIZfHU*->J>sI$WSPok&_NAsPU;|0$2 zB_`VlhuYwQJ(*KR=ATPD$vBqF*hdn4%r&)=RM_0k2fZjfVWprM1q0V`M9&4ZbSMa1 z0B(3-5rU<_ieeyCqAe^T$wS{T;}G(Fca|o7dN(wj$%zS8zf&kUiN@DQBq{<>XdF$W zCgBs-T5PT9Fp&(^P;WnrK8BkIy&DRhDHnkWl1_*ZQoDGmW`=24yg*fgu?67&g0~|g z%CjfHqoRYdszX8U@5%wF^rr=|O7sUE!2f>hdvHdT3ml3|b*dJ*!`Bu^ixj7jdEu2Z zVIU#Zk^Anw%c@xx(u7f9LQWl*%wFP>|M33{_|+MlEi!3Apl6s&LNfm4zU~s?~pCy@o&1bJ*3~bWBWO{zRUV2zuYc z6H0)d7aC%5)|1#F#k|p>L`9x)=&1h~3u#aY3!Y2$7e?eVu-QqjBuOMmVz>9_Wvt;J zG%A2!_PLOc5B@RYDH)I@85>5#=+9HSV10K|6vy%6X-`HM;1j@L9}zJ8Qb?Vp&`iwJ zk6{0+JhUvkA}&xTtC~(l~H;4G* z+XvOCy9)3~Zg;m3{-zXSCCPX71*bwHgi_s3c94X_9z9FQKIq={RI+T^+fzjJn0p=e z<-cNICx&uV24)Q1jm0U8bSN8t+Z}g8j79*Cg+w8o8GYUT-X(MnieP;ib?%#&h;vK- zdZZ`i=JQa}Tf#L@PEyN+h=;_z-sB7`x*O2%PLpj%uI)|qL!X&iNdi&9=LQ`VL$b1J z3{pLI8#N$FGyE%~Cv0;$Pd~LQgxwCN(-AICse}TR_RQStyZAQig3C|AmVO$O>>Jjy z0xi92E38u+!is&+H)~lHC;!@LPF;DQzzRcEuU*)#-`OuayzUe?pMnU`37xJ{qO};d zy!h3*OEx>~(J~&N2$GxJW)l2_qXnNe^v-JPfo5%v&DCA+H0e*g z(h%l{b$I(`BM=z++Q_$EnfZy7<)a1YeqyGV6`AA9s5i;_9_^LTzp*cve89@I&nzZ= zY@*^x{HcN2(HI+ubgQEzuqGxiZ=$WGdh6X0Nv|QtSTGQnH8l<@a^f?a{^xAdYLS0QQdU~>ILs!M8l>Qcfu$I9amI^mk zpy+ONS!cztwKmf>hD)zYoj_U7D7`wb+wZ#EV_7>ho+stu zB z^hXEacU~hWW4?3^i|SH#kj@>%z=zM$>XAcHo|)IRx`)_EmrBT&BR2kva@Jy7knD;! zZ+ACQ0%8Z+r`$J;!a35$)wk01{cz@Z1nOVUPETla3kErQuOm~mKqHs8KPjexD*AOu z;K3d0D?!1K_xDy_N}{HN-Br4y6DCVvC;>*%Sz8o7EdsIGC-n0USGJxYyUQDUfZn!< z$N3*$OuV1nwc5CW`6P9?DKK_40j;3;qaTBFG=%_9(87<_yut3WA+)^l^7em;{0(%WvX%!(Nb<%ZuXcL3ub@Vb6$_0#~}RSQSr z=}o|M4R=f%O(EBAhl5yE;Ea2l5y`GTHx*W&Wp1h7+Xw?-Ivc!*Zdw7&zB>J>3$Rqs zwnLz*05GpAiV*ePaz$3asc$C>RQ0vHpIQE3?eO5xL68P-31~tjolzH113DboZ6Ffb zjs{bq;?HuMsscyc<%)#*wBZcxl%$}Hoi8SINR;)t>3#$awfJ!TfEa37RDmD_`}M1! zuWLZ<}&WqmOMJ)^DBCw;2XqGK|O3Ha%sFj#7>1$?Tl0Kl7sQu&LP)3$sc;l~U}WEH(%m zg|wQ}SMPVZcpDm4iXbtGfvHJNZI_W)??65f0Ui280bv5%?+4y@8Wi=1Bft_+V^7V5 ztbb}yqUxU;FNOwH%VBEwxX%fZ?Y?3_q$3nk?(HPMQFvyq)zu6>pg%J`_V^F@rAqXUI+IXIs~41`8f!HDggN>8X+TXd>L(P|w&Vv)1vc7+M5(R}Fb- zoE5%vx#{flr<4#-c5c2yd&Zpo@it(VH}|Z=SUdbtIuxx=Q^B!z@jzM9B^7mIV{X8n z6Xy+gWJ{D9AkFGIiEv~iS)Yd3YXaHfon5~X>U<`PX|->ZhN96SZJqXfAw=z~xAAvr z%yL0_Gn?9_It^4t@4U(0U)nZZP>No^e4v>dY8#f6+LmN|;U85dV4`c5lxj(>m#;0G zy`}8jEaRl9gdc~VT`Nx+hmpC3(Xpf`y&}m|iZHf9o$ZY<%B3#!13j`ufv`21xXvus zwGJbw#W|QmWdA*(uC2wVV|&QpJGw_Lmx|Vn{{eS;rY#c=rzZ8jF7t!3=zgsxLYpq- z2EAN;8iF(%%~DlLYn4A_t$YX!LQ{5&HjAj{FVmV8ga-C4I=MiNSdaC zoAkA+4~c80?VIZMPp7sk>g@|#eDvzB#WrJ3KZ=Yu%ee3#QT1;zx{#T{jLar~oelcD zzl21%g(cUv*f**vpEbz;ji9c*llKpZ2A=pHw_szzJep`wM(M0eM}lK9L4{*#HX9b9 zCKci0WdudjGagF4AIgdHnDe%bkLS+2yQtn&%Z%6`bI;9}0$_*B(aL@;rlK;Ox9r1a z?WxiKdUllf!eZU;*rlp=AT#v}b;R#yqF7fi(q#$${hRB2?2V>Ae|9)J2 z#CFl{Bk|^ShTV|+UQ2eWVVv0NV+KEFQju>!7*Do*=+23C94~FCnhVAIV8g4uRS&)~ z+%`@|k#TQJhiL(X*_BOoOn=IwS@|y6Ik4{+A1pE@_M73%o5szp)#u1Ddf`T^)7+h4 z!cUh!&VN3brr67JeS#eB#|kG*ejZCpMdhX_nsAi%jUa?o8q+@7_GH>qoeh2K$61>jpMnq^jaEJ9DCA)1ry4yssmn z`v0nC#VJv2Epm?@kFgG>;U1aCkk5rV@^XaT(t7718~H$N+J5X5qGyR{kVCygwyTsq6WFoTxBET4JuX3gW{Q zt0W%EvAapFtX@i=M%M%t&l0W~(-N=RpbdR;Cg!E`&{f_gWij}JYQ4CPoU?I+{chuV zZ!t8-I6$}4MHDEK>lFUUpp5wE09$_XbXuvyadX!2r7W=tiwmTHdCaJ0VV6)}P4x~H zyGEr@%5b0AaKD#34Gbz|&-j|-k4sv-_0##W+Y}YKqjVA$U4I#gqngHdfg$PnOp|iE z*0h3sbNOT{XEExg0*_V73VL1(7odHku`lifH=&O-T-2~c16{{2g^HMyF>ika!Ek6n zA*7~Zfqg=_3<=G$R|ZoL;KSD6i$eKry2(u5lqxlily1IEdD`qLI-!L3cAHLH2BFVgP4sHns6biU=T)z7|N2E&Bv3|)ZDx1UizQonsm}! zs4sWn+B8DE@~3y%5qF`HaG{Q28p7e#k~O~n2Pv(?({eEVc^l|(tR<3uxQHu-T%dyj z7>Qx&yA*ZSS_BBd{_Sf%Miw+FzAB1%9^WcTg!6iBy;e zh#bKun1*0E2-Oh`f4Z6beasQ*WTZZO|8gSStmV|Uj}dR(2uNkBbeFMfSQ;=7e&NKQ zbeG=GzbZlYUE9!VbJwu5I#0TZN5PX)XEH>WGGtbhTvb4G zK0mv_uQZ%KS%x6nqFyNCtVEJ}8u2}LpinfopoicKa!HlnPeV~ZxMWUhsY=wTjAM?G zq#YlcwvU~F$e8Ii;)zLmwDE2i`9*8m^5)OO0`8NC-%z))R%Hx3R0V^0x1^)1(z|t8 znIgU+Ed3KXM;J!mAl)h_Ro~}7f%pX{v?zCOWp0ik- zqP#9SqX|6@1JYYfZ%R{o(ukkOQVs7a->y|${vH?;y&0#S@w!0(F;gB$ zjzr2Ep;)<4ZIF+=!OHZS9VJS(y`<+Yohq^+pI-GntVwxSq)We*^5l^?(*JHJ?I3Y1iMnUc@*wbI?mq0nrg8Zi7)f~rDd5J}sEs%UgkK7{t>P82Gji`gi5RXcjbUI!G3Ot^q41v@g;mV`31KX z(=Q@~CvcWS=hJ7*g%^T{{pv8NH)tI08Q!1z;Qte;tmJlcz}UtcvT6ekiP~fs3id9r z|Bs)#q)$#GJyO}wziy*7IfR4DACC*2Mgh9#7HyC|>wbNPn(;j#MYf!M<6G2;#sYuY zjz!(4+7OnmClufLZ~m(%F=YorjrUESjXhENn$0d0X+RS)I1{u5>blXWwX*NwYI#E>S9S-%?Y zKN<6hECX6BxaE|Y-RMybdB4|G0)o^~M8g5V400^E@vUWk$&7vd;C51+3H_eio|Tzn z7LNg~;$7hLsnOR*z^?o^YBfN2pt0=yp`2MZ+%Gn-_usX39-DiZWVs8XO_>*zxgTvN z0iFSl$4D}bKqKv0PpK7#2k0>=7LVO(Bzqi}pwmG-TnZ?a>u-;~t;HCe*0)*h>O6h1 zKyvXBh8LX3FH9ytp&%+;GE=Z?CWL|uPH0T*1J293+!*H5_vlGH(a$eIO4XuQOeta6(zdh@NKkbi-%?gtJ?l?Hir?)SGv6RWBfC?SBkKG468#V zv6>lE$)HTos#w$29jA0AFLB{n6z4=th8peejF3H#PCD!F9%roz#o4kR^iO~< znLiIT8n=@={W3{`VOmsj=MbAlK2qL`F|8}i#FWmBik5;zuW?)oxJB6A6yp{04Wq9j z#S}4&yJsy=0!c+frQxTF<{?v7Vk%Ik{0diR7q-jy)x}(J9Z@)ekrinAD*NfLaTn{- z@THadujp?|@Z0kQhvZUc8rV5JG6M10;S92OVd{Gv__(^8*~MP#xjB~|5KT%{;T_6N+DWY literal 0 HcmV?d00001 diff --git a/Solutions/MailGuard 365/Package/createUiDefinition.json b/Solutions/MailGuard 365/Package/createUiDefinition.json index 6a147860162..4598b79978b 100644 --- a/Solutions/MailGuard 365/Package/createUiDefinition.json +++ b/Solutions/MailGuard 365/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nStrengthen your Microsoft 365 email security against advanced zero-day phishing, ransomware & BEC attacks with MailGuard 365 enhanced email security. This Microsoft Sentinel Solution enables you to ingest threat data from MailGuard 365.\n\n**Data Connectors:** 1, **Workbooks:** 1, **Hunting Queries:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/MailGuard%20365/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nStrengthen your Microsoft 365 email security against advanced zero-day phishing, ransomware & BEC attacks with MailGuard 365 enhanced email security. This Microsoft Sentinel Solution enables you to ingest threat data from MailGuard 365 via the Azure Monitor Logs Ingestion API, using a dedicated Entra application.\n\n**Data Connectors:** 1, **Workbooks:** 1, **Hunting Queries:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -60,11 +60,11 @@ "name": "dataconnectors1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This Solution installs the data connector for MailGuard 365. You can get MailGuard 365 custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + "text": "This Solution installs the data connector for MailGuard 365 Connector (Push). You can get MailGuard 365 Connector (Push) data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { - "name": "dataconnectors-link2", + "name": "dataconnectors-link1", "type": "Microsoft.Common.TextBlock", "options": { "link": { @@ -88,7 +88,7 @@ "name": "workbooks-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This Microsoft Sentinel Solution installs workbooks. Workbooks provide a flexible canvas for data monitoring, analysis, and the creation of rich visual reports within the Azure portal. They allow you to tap into one or many data sources from Microsoft Sentinel and combine them into unified interactive experiences." + "text": "This solution installs workbook(s) to help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view." } }, { @@ -126,7 +126,7 @@ "name": "huntingqueries-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in Manage solution view." + "text": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in Manage solution view. " } }, { @@ -148,7 +148,7 @@ "name": "huntingquery1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for high confidence threats stopped by MailGuard 365. This hunting query depends on MailGuard365 data connector (MailGuard365 Parser or Table)" + "text": "Query searches for high confidence threats stopped by MailGuard 365. This hunting query depends on MailGuard365 data connector (MG365ThreatData_CL Parser or Table)" } } ] @@ -156,13 +156,13 @@ { "name": "huntingquery2", "type": "Microsoft.Common.Section", - "label": "MailGuard 365 - Phishing Threats", + "label": "MailGuard 365 - Malware Threats", "elements": [ { "name": "huntingquery2-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for phishing threats stopped by MailGuard 365. This hunting query depends on MailGuard365 data connector (MailGuard365 Parser or Table)" + "text": "Query searches for malware threats stopped by MailGuard 365. This hunting query depends on MailGuard365 data connector (MG365ThreatData_CL Parser or Table)" } } ] @@ -170,13 +170,13 @@ { "name": "huntingquery3", "type": "Microsoft.Common.Section", - "label": "MailGuard 365 - Malware Threats", + "label": "MailGuard 365 - Phishing Threats", "elements": [ { "name": "huntingquery3-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for malware threats stopped by MailGuard 365. This hunting query depends on MailGuard365 data connector (MailGuard365 Parser or Table)" + "text": "Query searches for phishing threats stopped by MailGuard 365. This hunting query depends on MailGuard365 data connector (MG365ThreatData_CL Parser or Table)" } } ] diff --git a/Solutions/MailGuard 365/Package/mainTemplate.json b/Solutions/MailGuard 365/Package/mainTemplate.json index 18882df9e55..3ef42a5cec4 100644 --- a/Solutions/MailGuard 365/Package/mainTemplate.json +++ b/Solutions/MailGuard 365/Package/mainTemplate.json @@ -2,7 +2,7 @@ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { - "author": "MailGuard - support@mailguard365.com", + "author": "MailGuard 365 - support@mailguard365.com", "comments": "Solution template for MailGuard 365" }, "parameters": { @@ -28,6 +28,20 @@ "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" } }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } + }, "workbook1-name": { "type": "string", "defaultValue": "MailGuard365", @@ -41,118 +55,109 @@ "email": "support@mailguard365.com", "_email": "[variables('email')]", "_solutionName": "MailGuard 365", - "_solutionVersion": "3.0.0", + "_solutionVersion": "3.0.1", "solutionId": "mailguardptylimited.microsoft-sentinel-solution-mailguard365", "_solutionId": "[variables('solutionId')]", - "uiConfigId1": "MailGuard365", - "_uiConfigId1": "[variables('uiConfigId1')]", - "dataConnectorContentId1": "MailGuard365", - "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", - "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", - "dataConnectorVersion1": "1.0.0", - "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", - "huntingQueryVersion1": "1.0.0", - "huntingQuerycontentId1": "5e3aa1a5-5b69-421e-a3ac-32b04cb10353", - "_huntingQuerycontentId1": "[variables('huntingQuerycontentId1')]", - "huntingQueryId1": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId1'))]", - "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId1'))))]", - "_huntingQuerycontentProductId1": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId1'),'-', variables('huntingQueryVersion1'))))]", - "huntingQueryVersion2": "1.0.0", - "huntingQuerycontentId2": "ee15ed10-d355-474e-b8ad-a8bbb76f6d38", - "_huntingQuerycontentId2": "[variables('huntingQuerycontentId2')]", - "huntingQueryId2": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId2'))]", - "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId2'))))]", - "_huntingQuerycontentProductId2": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId2'),'-', variables('huntingQueryVersion2'))))]", - "huntingQueryVersion3": "1.0.0", - "huntingQuerycontentId3": "daaae6ad-1fd0-4efa-b571-116689e67a20", - "_huntingQuerycontentId3": "[variables('huntingQuerycontentId3')]", - "huntingQueryId3": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId3'))]", - "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId3'))))]", - "_huntingQuerycontentProductId3": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId3'),'-', variables('huntingQueryVersion3'))))]", - "workbookVersion1": "1.0.0", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "dataConnectorCCPVersion": "3.0.1", + "_dataConnectorContentIdConnectorDefinition1": "MailGuard365", + "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]", + "_dataConnectorContentIdConnections1": "MailGuard365Connections", + "dataConnectorTemplateNameConnections1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections1')))]", + "blanks": "[replace('b', 'b', '')]", + "workbookVersion1": "1.1.0", "workbookContentId1": "MailGuard365Workbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", "_workbookContentId1": "[variables('workbookContentId1')]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", + "huntingQueryObject1": { + "huntingQueryVersion1": "1.0.0", + "_huntingQuerycontentId1": "5e3aa1a5-5b69-421e-a3ac-32b04cb10353", + "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('5e3aa1a5-5b69-421e-a3ac-32b04cb10353')))]" + }, + "huntingQueryObject2": { + "huntingQueryVersion2": "1.0.0", + "_huntingQuerycontentId2": "daaae6ad-1fd0-4efa-b571-116689e67a20", + "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('daaae6ad-1fd0-4efa-b571-116689e67a20')))]" + }, + "huntingQueryObject3": { + "huntingQueryVersion3": "1.0.0", + "_huntingQuerycontentId3": "ee15ed10-d355-474e-b8ad-a8bbb76f6d38", + "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ee15ed10-d355-474e-b8ad-a8bbb76f6d38')))]" + }, "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName1')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition1'), variables('dataConnectorCCPVersion'))]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MailGuard 365 data connector with template version 3.0.0", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", + "displayName": "MailGuard 365 Connector (Push)", + "contentKind": "DataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion1')]", + "contentVersion": "[variables('dataConnectorCCPVersion')]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", + "kind": "Customizable", "properties": { "connectorUiConfig": { - "id": "[variables('_uiConfigId1')]", - "title": "MailGuard 365", + "id": "MailGuard365", + "title": "MailGuard 365 Connector (Push)", "publisher": "MailGuard365", - "descriptionMarkdown": "MailGuard 365 Enhanced Email Security for Microsoft 365. Exclusive to the Microsoft marketplace, MailGuard 365 is integrated with Microsoft 365 security (incl. Defender) for enhanced protection against advanced email threats like phishing, ransomware and sophisticated BEC attacks.", + "descriptionMarkdown": "The MailGuard 365 connector provides the capability to push mail-security event data from MailGuard 365 directly into Microsoft Sentinel using the Codeless Connector Framework (CCF) Push pattern. This connector ingests message metadata, sender/recipient details, spam/virus scoring, and attachment information into a custom Log Analytics table for analysis, alerting, and visualization.", "graphQueries": [ { - "metricName": "Total data received", - "legend": "MailGuard365_Threats_CL", - "baseQuery": "MailGuard365_Threats_CL" + "metricName": "MailGuard 365 Messages", + "legend": "MG365ThreatData_CL", + "baseQuery": "MG365ThreatData_CL" } ], "sampleQueries": [ { - "description": "All phishing threats stopped by MailGuard 365", - "query": "MailGuard365_Threats_CL \n | where Category == \"Phishing\"" - }, - { - "description": "All threats summarized by sender email address", - "query": "MailGuard365_Threats_CL \n | summarize count() by Sender_Email_s" + "description": "Recent messages", + "query": "MG365ThreatData_CL\n | sort by TimeGenerated desc" }, { - "description": "All threats summarized by category", - "query": "MailGuard365_Threats_CL \n | summarize count() by Category" + "description": "Messages flagged as virus", + "query": "MG365ThreatData_CL\n | where Virus == true\n | sort by TimeGenerated desc" } ], "dataTypes": [ { - "name": "MailGuard365_Threats_CL", - "lastDataReceivedQuery": "MailGuard365_Threats_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "name": "MG365ThreatData_CL", + "lastDataReceivedQuery": "MG365ThreatData_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" } ], - "connectivityCriterias": [ + "connectivityCriteria": [ { "type": "IsConnectedQuery", "value": [ - "MailGuard365_Threats_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + "MG365ThreatData_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)" ] } ], "availability": { - "status": 1, - "isPreview": false + "status": 1 }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", + "permissionsDisplayText": "Read and write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { @@ -160,76 +165,127 @@ "read": true, "delete": true } + } + ], + "customs": [ + { + "name": "Microsoft Entra", + "description": "Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher." }, { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } + "name": "Microsoft Azure", + "description": "Permission to assign Monitoring Metrics Publisher role on data collection rule (DCR). Typically requires Azure RBAC Owner or User Access Administrator role." } ] }, "instructionSteps": [ { - "description": "1. In the MailGuard 365 Console, click **Settings** on the navigation bar.\n2. Click the **Integrations** tab.\n3. Click the **Enable Microsoft Sentinel**.\n4. Enter your workspace id and primary key from the fields below, click **Finish**.\n5. For additional instructions, please contact MailGuard 365 support.", + "title": "1. Create ARM Resources and Provide the Required Permissions", + "description": "This connector enables MailGuard 365 to push mail-security event data directly to Microsoft Sentinel via the Azure Monitor Ingestion API.", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "#### Automated Configuration and Secure Data Ingestion with Entra Application \nClicking \"Deploy\" will create a Log Analytics table and a Data Collection Rule (DCR), then create a dedicated Entra application, link the DCR to it, and generate a client secret. This lets MailGuard 365 push data securely to the DCR using an Entra token." + } + }, + { + "type": "DeployPushConnectorButton", + "parameters": { + "label": "Deploy MailGuard 365 Push connector resources", + "applicationDisplayName": "MailGuard 365 Push Connector Application" + } + } + ] + }, + { + "title": "2. Configure MailGuard 365", + "description": "Copy the following values into MailGuard 365 admin console → Settings → Integration so MailGuard 365 knows where to push data for this tenant.", "instructions": [ { + "type": "CopyableLabel", + "parameters": { + "label": "Tenant ID (Directory ID)", + "fillWith": [ + "TenantId" + ] + } + }, + { + "type": "CopyableLabel", "parameters": { + "label": "Entra App Registration Application ID", "fillWith": [ - "WorkspaceId" + "ApplicationId" ], - "label": "Workspace ID" - }, - "type": "CopyableLabel" + "placeholder": "Deploy push connector to get the App Registration Application ID" + } }, { + "type": "CopyableLabel", "parameters": { + "label": "Entra App Registration Secret", "fillWith": [ - "PrimaryKey" + "ApplicationSecret" ], - "label": "Primary Key" - }, - "type": "CopyableLabel" + "placeholder": "Deploy push connector to get the App Registration Secret" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Data Collection Endpoint Uri", + "fillWith": [ + "DataCollectionEndpoint" + ], + "placeholder": "Deploy push connector to get the Data Collection Endpoint Uri" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Data Collection Rule Immutable ID", + "fillWith": [ + "DataCollectionRuleId" + ], + "placeholder": "Deploy push connector to get the Data Collection Rule Immutable ID" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Stream Name", + "value": "Custom-MG365ThreatData_CL" + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### Configure MailGuard 365\nEnter the values above into your MailGuard 365 admin console under Settings → Integration, to enable message data push to Microsoft Sentinel." + } } - ], - "title": "Configure and connect MailGuard 365" - } - ], - "metadata": { - "id": "310bcb08-38be-4257-b4d5-035e1ae3f256", - "version": "1.0.0", - "kind": "dataConnector", - "author": { - "name": "MailGuard 365" - }, - "support": { - "name": "MailGuard 365", - "link": "https://www.mailguard365.com/support", - "tier": "developer" + ] } - } + ] } } }, { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", + "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", + "version": "[variables('dataConnectorCCPVersion')]", "source": { - "kind": "Solution", - "name": "MailGuard 365", - "sourceId": "[variables('_solutionId')]" + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" }, "author": { - "name": "MailGuard", + "name": "MailGuard 365", "email": "[variables('_email')]" }, "support": { @@ -237,6 +293,289 @@ "email": "support@mailguard365.com", "tier": "Partner", "link": "https://www.mailguard365.com/support/" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "name": "MailGuard365DCR", + "apiVersion": "2022-06-01", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "[parameters('workspace-location')]", + "kind": "[variables('blanks')]", + "properties": { + "streamDeclarations": { + "Custom-MG365ThreatData_CL": { + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "MessageId", + "type": "string" + }, + { + "name": "HeaderMessageId", + "type": "string" + }, + { + "name": "UserId", + "type": "string" + }, + { + "name": "CustomerTenantId", + "type": "string" + }, + { + "name": "Score", + "type": "real" + }, + { + "name": "Virus", + "type": "boolean" + }, + { + "name": "Category", + "type": "string" + }, + { + "name": "Attachments", + "type": "dynamic" + }, + { + "name": "Sender", + "type": "dynamic" + }, + { + "name": "Recipients", + "type": "dynamic" + }, + { + "name": "ReceivedHeaders", + "type": "dynamic" + }, + { + "name": "SenderHeader", + "type": "string" + }, + { + "name": "ToHeader", + "type": "string" + }, + { + "name": "CcHeader", + "type": "string" + }, + { + "name": "Subject", + "type": "string" + }, + { + "name": "OriginCountry", + "type": "string" + }, + { + "name": "MessageDate", + "type": "datetime" + }, + { + "name": "MessageSize", + "type": "real" + }, + { + "name": "Action", + "type": "string" + }, + { + "name": "ReceivedDateTime", + "type": "long" + }, + { + "name": "ForefrontAntiSpam", + "type": "string" + }, + { + "name": "MicrosoftAntiSpam", + "type": "string" + }, + { + "name": "IsInWhiteList", + "type": "boolean" + }, + { + "name": "IsInBlackList", + "type": "boolean" + }, + { + "name": "Email", + "type": "string" + }, + { + "name": "HasAttachment", + "type": "boolean" + }, + { + "name": "HasImage", + "type": "boolean" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "[variables('workspaceResourceId')]", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-MG365ThreatData_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source", + "outputStream": "Custom-MG365ThreatData_CL" + } + ], + "dataCollectionEndpointId": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]" + } + }, + { + "name": "MG365ThreatData_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "schema": { + "name": "MG365ThreatData_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "MessageId", + "type": "string" + }, + { + "name": "HeaderMessageId", + "type": "string" + }, + { + "name": "UserId", + "type": "string" + }, + { + "name": "CustomerTenantId", + "type": "string" + }, + { + "name": "Score", + "type": "real" + }, + { + "name": "Virus", + "type": "boolean" + }, + { + "name": "Category", + "type": "string" + }, + { + "name": "Attachments", + "type": "dynamic" + }, + { + "name": "Sender", + "type": "dynamic" + }, + { + "name": "Recipients", + "type": "dynamic" + }, + { + "name": "ReceivedHeaders", + "type": "dynamic" + }, + { + "name": "SenderHeader", + "type": "string" + }, + { + "name": "ToHeader", + "type": "string" + }, + { + "name": "CcHeader", + "type": "string" + }, + { + "name": "Subject", + "type": "string" + }, + { + "name": "OriginCountry", + "type": "string" + }, + { + "name": "MessageDate", + "type": "datetime" + }, + { + "name": "MessageSize", + "type": "real" + }, + { + "name": "Action", + "type": "string" + }, + { + "name": "ReceivedDateTime", + "type": "long" + }, + { + "name": "ForefrontAntiSpam", + "type": "string" + }, + { + "name": "MicrosoftAntiSpam", + "type": "string" + }, + { + "name": "IsInWhiteList", + "type": "boolean" + }, + { + "name": "IsInBlackList", + "type": "boolean" + }, + { + "name": "Email", + "type": "string" + }, + { + "name": "HasAttachment", + "type": "boolean" + }, + { + "name": "HasImage", + "type": "boolean" + } + ] } } } @@ -245,36 +584,191 @@ "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition1'),'-', variables('dataConnectorCCPVersion'))))]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId1')]", - "contentKind": "DataConnector", - "displayName": "MailGuard 365", - "contentProductId": "[variables('_dataConnectorcontentProductId1')]", - "id": "[variables('_dataConnectorcontentProductId1')]", - "version": "[variables('dataConnectorVersion1')]" + "version": "[variables('dataConnectorCCPVersion')]" } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", - "dependsOn": [ - "[variables('_dataConnectorId1')]" - ], + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "MailGuard365", + "title": "MailGuard 365 Connector (Push)", + "publisher": "MailGuard365", + "descriptionMarkdown": "The MailGuard 365 connector provides the capability to push mail-security event data from MailGuard 365 directly into Microsoft Sentinel using the Codeless Connector Framework (CCF) Push pattern. This connector ingests message metadata, sender/recipient details, spam/virus scoring, and attachment information into a custom Log Analytics table for analysis, alerting, and visualization.", + "graphQueries": [ + { + "metricName": "MailGuard 365 Messages", + "legend": "MG365ThreatData_CL", + "baseQuery": "MG365ThreatData_CL" + } + ], + "sampleQueries": [ + { + "description": "Recent messages", + "query": "MG365ThreatData_CL\n | sort by TimeGenerated desc" + }, + { + "description": "Messages flagged as virus", + "query": "MG365ThreatData_CL\n | where Virus == true\n | sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "MG365ThreatData_CL", + "lastDataReceivedQuery": "MG365ThreatData_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "IsConnectedQuery", + "value": [ + "MG365ThreatData_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)" + ] + } + ], + "availability": { + "status": 1 + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "Microsoft Entra", + "description": "Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher." + }, + { + "name": "Microsoft Azure", + "description": "Permission to assign Monitoring Metrics Publisher role on data collection rule (DCR). Typically requires Azure RBAC Owner or User Access Administrator role." + } + ] + }, + "instructionSteps": [ + { + "title": "1. Create ARM Resources and Provide the Required Permissions", + "description": "This connector enables MailGuard 365 to push mail-security event data directly to Microsoft Sentinel via the Azure Monitor Ingestion API.", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "#### Automated Configuration and Secure Data Ingestion with Entra Application \nClicking \"Deploy\" will create a Log Analytics table and a Data Collection Rule (DCR), then create a dedicated Entra application, link the DCR to it, and generate a client secret. This lets MailGuard 365 push data securely to the DCR using an Entra token." + } + }, + { + "type": "DeployPushConnectorButton", + "parameters": { + "label": "Deploy MailGuard 365 Push connector resources", + "applicationDisplayName": "MailGuard 365 Push Connector Application" + } + } + ] + }, + { + "title": "2. Configure MailGuard 365", + "description": "Copy the following values into MailGuard 365 admin console → Settings → Integration so MailGuard 365 knows where to push data for this tenant.", + "instructions": [ + { + "type": "CopyableLabel", + "parameters": { + "label": "Tenant ID (Directory ID)", + "fillWith": [ + "TenantId" + ] + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Entra App Registration Application ID", + "fillWith": [ + "ApplicationId" + ], + "placeholder": "Deploy push connector to get the App Registration Application ID" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Entra App Registration Secret", + "fillWith": [ + "ApplicationSecret" + ], + "placeholder": "Deploy push connector to get the App Registration Secret" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Data Collection Endpoint Uri", + "fillWith": [ + "DataCollectionEndpoint" + ], + "placeholder": "Deploy push connector to get the Data Collection Endpoint Uri" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Data Collection Rule Immutable ID", + "fillWith": [ + "DataCollectionRuleId" + ], + "placeholder": "Deploy push connector to get the Data Collection Rule Immutable ID" + } + }, + { + "type": "CopyableLabel", + "parameters": { + "label": "Stream Name", + "value": "Custom-MG365ThreatData_CL" + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### Configure MailGuard 365\nEnter the values above into your MailGuard 365 admin console under Settings → Integration, to enable message data push to Microsoft Sentinel." + } + } + ] + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", + "version": "[variables('dataConnectorCCPVersion')]", "source": { - "kind": "Solution", - "name": "MailGuard 365", - "sourceId": "[variables('_solutionId')]" + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" }, "author": { - "name": "MailGuard", + "name": "MailGuard 365", "email": "[variables('_email')]" }, "support": { @@ -282,173 +776,185 @@ "email": "support@mailguard365.com", "tier": "Partner", "link": "https://www.mailguard365.com/support/" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector" + } + ] } } }, { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections1'), variables('dataConnectorCCPVersion'))]", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "connectorUiConfig": { - "title": "MailGuard 365", - "publisher": "MailGuard365", - "descriptionMarkdown": "MailGuard 365 Enhanced Email Security for Microsoft 365. Exclusive to the Microsoft marketplace, MailGuard 365 is integrated with Microsoft 365 security (incl. Defender) for enhanced protection against advanced email threats like phishing, ransomware and sophisticated BEC attacks.", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "MailGuard365_Threats_CL", - "baseQuery": "MailGuard365_Threats_CL" - } - ], - "dataTypes": [ - { - "name": "MailGuard365_Threats_CL", - "lastDataReceivedQuery": "MailGuard365_Threats_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "MailGuard365_Threats_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "sampleQueries": [ - { - "description": "All phishing threats stopped by MailGuard 365", - "query": "MailGuard365_Threats_CL \n | where Category == \"Phishing\"" + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "displayName": "MailGuard 365 Connector (Push)", + "contentKind": "ResourcesDataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": { + "guidValue": { + "defaultValue": "[[newGuid()]", + "type": "securestring" }, - { - "description": "All threats summarized by sender email address", - "query": "MailGuard365_Threats_CL \n | summarize count() by Sender_Email_s" + "innerWorkspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" }, - { - "description": "All threats summarized by category", - "query": "MailGuard365_Threats_CL \n | summarize count() by Category" + "auth": { + "type": "object", + "defaultValue": { + "appId": "[[parameters('auth').appId]]", + "servicePrincipalId": "[[parameters('auth').servicePrincipalId]]" + } + }, + "connectorDefinitionName": { + "defaultValue": "MailGuard 365 Connector (Push)", + "type": "securestring", + "minLength": 1 + }, + "workspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "dcrConfig": { + "defaultValue": { + "dataCollectionEndpoint": "data collection Endpoint", + "dataCollectionRuleImmutableId": "data collection rule immutableId" + }, + "type": "object" } - ], - "availability": { - "status": 1, - "isPreview": false }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true + "variables": { + "_dataConnectorContentIdConnections1": "[variables('_dataConnectorContentIdConnections1')]" + }, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections1')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections1'))]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "MailGuard 365", + "email": "[variables('_email')]" + }, + "support": { + "name": "MailGuard 365", + "email": "support@mailguard365.com", + "tier": "Partner", + "link": "https://www.mailguard365.com/support/" } } - ] - }, - "instructionSteps": [ + }, { - "description": "1. In the MailGuard 365 Console, click **Settings** on the navigation bar.\n2. Click the **Integrations** tab.\n3. Click the **Enable Microsoft Sentinel**.\n4. Enter your workspace id and primary key from the fields below, click **Finish**.\n5. For additional instructions, please contact MailGuard 365 support.", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId" - ], - "label": "Workspace ID" - }, - "type": "CopyableLabel" + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'MailGuard365ConnectorPolling', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "Push", + "properties": { + "connectorDefinitionName": "MailGuard365", + "dcrConfig": { + "streamName": "Custom-MG365ThreatData_CL", + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" }, - { - "parameters": { - "fillWith": [ - "PrimaryKey" - ], - "label": "Primary Key" - }, - "type": "CopyableLabel" + "auth": { + "type": "Push", + "AppId": "[[parameters('auth').appId]", + "ServicePrincipalId": "[[parameters('auth').servicePrincipalId]" + }, + "request": { + "RetryCount": 1 + }, + "response": { + "eventsJsonPaths": [ + "$" + ] } - ], - "title": "Configure and connect MailGuard 365" + } } - ], - "id": "[variables('_uiConfigId1')]" - } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections1'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName1')]", + "name": "[variables('workbookTemplateSpecName1')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MailGuard365HighConfidenceThreats_HuntingQueries Hunting Query with template version 3.0.0", + "description": "MailGuard365Dashboard Workbook with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion1')]", + "contentVersion": "[variables('workbookVersion1')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", - "name": "MailGuard_365_Hunting_Query_1", + "type": "Microsoft.Insights/workbooks", + "name": "[variables('workbookContentId1')]", "location": "[parameters('workspace-location')]", + "kind": "shared", + "apiVersion": "2021-08-01", + "metadata": { + "description": "MailGuard 365 Workbook" + }, "properties": { - "eTag": "*", - "displayName": "MailGuard 365 - High Confidence Threats", - "category": "Hunting Queries", - "query": "MailGuard365_Threats_CL\n| where Score_d > 20\n| extend MailMessage_0_NetworkMessageId = MessageId_s\n| extend MailMessage_0_Recipient = Email_s\n", - "version": 2, - "tags": [ - { - "name": "description", - "value": "Query searches for high confidence threats stopped by MailGuard 365." - }, - { - "name": "tactics", - "value": "Reconnaissance" - }, - { - "name": "techniques", - "value": "T1598" - } - ] + "displayName": "[parameters('workbook1-name')]", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## MailGuard 365\\n---\\n\\nMailGuard 365 Dashboard\"},\"name\":\"text - 2\"},{\"type\":1,\"content\":{\"json\":\"# Threat Count by Category\"},\"name\":\"text - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MG365ThreatData_CL \\n| summarize Count=count() by Category\\n| render barchart\",\"size\":3,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"name\":\"query - 2\"},{\"type\":1,\"content\":{\"json\":\"# Threat Origin by Country\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MG365ThreatData_CL\\n| summarize Count=count() by OriginCountry\",\"size\":3,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"map\",\"tileSettings\":{\"showBorder\":false},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"OriginCountry\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"Count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"greenRed\"}},\"textSettings\":{\"style\":\"bignumber\"}},\"name\":\"query - 2\"},{\"type\":1,\"content\":{\"json\":\"# Top targetted recipients\"},\"name\":\"text - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MG365ThreatData_CL\\n| summarize Count=count() by Email\",\"size\":0,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":2}]},\"name\":\"query - 6\"},{\"type\":1,\"content\":{\"json\":\"# Threat Count over time\"},\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MG365ThreatData_CL\\n| summarize Count=count() by format_datetime(unixtime_seconds_todatetime(ReceivedDateTime), \\\"yyyy-MM-dd\\\")\\n| sort by Column1 asc\\n\",\"size\":0,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"name\":\"query - 8\"}],\"fromTemplateId\":\"mailguard365-UserWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "version": "1.0", + "sourceId": "[variables('workspaceResourceId')]", + "category": "sentinel" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", "properties": { - "description": "MailGuard 365 Hunting Query 1", - "parentId": "[variables('huntingQueryId1')]", - "contentId": "[variables('_huntingQuerycontentId1')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion1')]", + "description": "@{workbookKey=MailGuard365Workbook; logoFileName=MailGuard365_logo.svg; description=MailGuard 365 Workbook; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.1.0; title=MailGuard365; templateRelativePath=MailGuard365Dashboard.json; subtitle=; provider=MailGuard 365}.description", + "parentId": "[variables('workbookId1')]", + "contentId": "[variables('_workbookContentId1')]", + "kind": "Workbook", + "version": "[variables('workbookVersion1')]", "source": { "kind": "Solution", "name": "MailGuard 365", "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "MailGuard", + "name": "MailGuard 365", "email": "[variables('_email')]" }, "support": { @@ -456,6 +962,19 @@ "email": "support@mailguard365.com", "tier": "Partner", "link": "https://www.mailguard365.com/support/" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "MG365ThreatData_CL", + "kind": "DataType" + }, + { + "contentId": "MailGuard365", + "kind": "DataConnector" + } + ] } } } @@ -466,53 +985,53 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId1')]", - "contentKind": "HuntingQuery", - "displayName": "MailGuard 365 - High Confidence Threats", - "contentProductId": "[variables('_huntingQuerycontentProductId1')]", - "id": "[variables('_huntingQuerycontentProductId1')]", - "version": "[variables('huntingQueryVersion1')]" + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName2')]", + "name": "[variables('huntingQueryObject1').huntingQueryTemplateSpecName1]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MailGuard365PhishingThreats_HuntingQueries Hunting Query with template version 3.0.0", + "description": "MailGuard365HighConfidenceThreats_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion2')]", + "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", - "name": "MailGuard_365_Hunting_Query_2", + "apiVersion": "2025-07-01", + "name": "MailGuard_365_Hunting_Query_1", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "MailGuard 365 - Phishing Threats", + "displayName": "MailGuard 365 - High Confidence Threats", "category": "Hunting Queries", - "query": "MailGuard365_Threats_CL\n| where Category == \"Phishing\"\n| extend MailMessage_0_NetworkMessageId = MessageId_s\n| extend MailMessage_0_Recipient = Email_s\n", + "query": "MG365ThreatData_CL\n| where Score > 20\n", "version": 2, "tags": [ { "name": "description", - "value": "Query searches for phishing threats stopped by MailGuard 365." + "value": "Query searches for high confidence threats stopped by MailGuard 365." }, { "name": "tactics", - "value": "InitialAccess,Reconnaissance,CredentialAccess" + "value": "Reconnaissance" }, { "name": "techniques", - "value": "T1598,T1566" + "value": "T1598" } ] } @@ -520,20 +1039,20 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId2'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1),'/'))))]", "properties": { - "description": "MailGuard 365 Hunting Query 2", - "parentId": "[variables('huntingQueryId2')]", - "contentId": "[variables('_huntingQuerycontentId2')]", + "description": "MailGuard 365 Hunting Query 1", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1)]", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion2')]", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]", "source": { "kind": "Solution", "name": "MailGuard 365", "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "MailGuard", + "name": "MailGuard 365", "email": "[variables('_email')]" }, "support": { @@ -551,40 +1070,40 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId2')]", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", "contentKind": "HuntingQuery", - "displayName": "MailGuard 365 - Phishing Threats", - "contentProductId": "[variables('_huntingQuerycontentProductId2')]", - "id": "[variables('_huntingQuerycontentProductId2')]", - "version": "[variables('huntingQueryVersion2')]" + "displayName": "MailGuard 365 - High Confidence Threats", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName3')]", + "name": "[variables('huntingQueryObject2').huntingQueryTemplateSpecName2]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MailGuard365MalwareThreats_HuntingQueries Hunting Query with template version 3.0.0", + "description": "MailGuard365MalwareThreats_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion3')]", + "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", - "name": "MailGuard_365_Hunting_Query_3", + "apiVersion": "2025-07-01", + "name": "MailGuard_365_Hunting_Query_2", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "MailGuard 365 - Malware Threats", "category": "Hunting Queries", - "query": "MailGuard365_Threats_CL\n| where Category == \"Malicious Attachment\"\n| extend MailMessage_0_NetworkMessageId = MessageId_s\n| extend MailMessage_0_Recipient = Email_s\n", + "query": "MG365ThreatData_CL\n| where Category == \"Malicious Attachment\"\n", "version": 2, "tags": [ { @@ -605,20 +1124,20 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId3'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2),'/'))))]", "properties": { - "description": "MailGuard 365 Hunting Query 3", - "parentId": "[variables('huntingQueryId3')]", - "contentId": "[variables('_huntingQuerycontentId3')]", + "description": "MailGuard 365 Hunting Query 2", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2)]", + "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion3')]", + "version": "[variables('huntingQueryObject2').huntingQueryVersion2]", "source": { "kind": "Solution", "name": "MailGuard 365", "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "MailGuard", + "name": "MailGuard 365", "email": "[variables('_email')]" }, "support": { @@ -636,64 +1155,74 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId3')]", + "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]", "contentKind": "HuntingQuery", "displayName": "MailGuard 365 - Malware Threats", - "contentProductId": "[variables('_huntingQuerycontentProductId3')]", - "id": "[variables('_huntingQuerycontentProductId3')]", - "version": "[variables('huntingQueryVersion3')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('workbookTemplateSpecName1')]", + "name": "[variables('huntingQueryObject3').huntingQueryTemplateSpecName3]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MailGuard365DashboardWorkbook Workbook with template version 3.0.0", + "description": "MailGuard365PhishingThreats_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('workbookVersion1')]", + "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.Insights/workbooks", - "name": "[variables('workbookContentId1')]", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2025-07-01", + "name": "MailGuard_365_Hunting_Query_3", "location": "[parameters('workspace-location')]", - "kind": "shared", - "apiVersion": "2021-08-01", - "metadata": { - "description": "MailGuard 365 Workbook" - }, "properties": { - "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## MailGuard 365\\n---\\n\\nMailGuard 365 Dashboard\"},\"name\":\"text - 2\"},{\"type\":1,\"content\":{\"json\":\"# Threat Count by Category\"},\"name\":\"text - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MailGuard365_Threats_CL \\n| summarize Count=count() by Category\\n| render barchart\",\"size\":3,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"name\":\"query - 2\"},{\"type\":1,\"content\":{\"json\":\"# Threat Origin by Country\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MailGuard365_Threats_CL\\n| summarize Count=count() by OriginCountry_s\",\"size\":3,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"map\",\"tileSettings\":{\"showBorder\":false},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"OriginCountry_s\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"Count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"Count\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"greenRed\"}},\"textSettings\":{\"style\":\"bignumber\"}},\"name\":\"query - 2\"},{\"type\":1,\"content\":{\"json\":\"# Top targetted recipients\"},\"name\":\"text - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MailGuard365_Threats_CL\\n| summarize Count=count() by Email_s\",\"size\":0,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":2}]},\"name\":\"query - 6\"},{\"type\":1,\"content\":{\"json\":\"# Threat Count over time\"},\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MailGuard365_Threats_CL\\n| summarize Count=count() by format_datetime(unixtime_seconds_todatetime(ReceivedDateTime_d), \\\"yyyy-MM-dd\\\")\\n| sort by Column1 asc\\n\",\"size\":0,\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"name\":\"query - 8\"}],\"fromTemplateId\":\"mailguard365-UserWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", - "version": "1.0", - "sourceId": "[variables('workspaceResourceId')]", - "category": "sentinel" + "eTag": "*", + "displayName": "MailGuard 365 - Phishing Threats", + "category": "Hunting Queries", + "query": "MG365ThreatData_CL\n| where Category == \"Phishing\"\n", + "version": 2, + "tags": [ + { + "name": "description", + "value": "Query searches for phishing threats stopped by MailGuard 365." + }, + { + "name": "tactics", + "value": "InitialAccess,Reconnaissance,CredentialAccess" + }, + { + "name": "techniques", + "value": "T1598,T1566" + } + ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3),'/'))))]", "properties": { - "description": "@{workbookKey=MailGuard365Workbook; logoFileName=MailGuard365_logo.svg; description=MailGuard 365 Workbook; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=MailGuard365; templateRelativePath=MailGuard365Dashboard.json; subtitle=; provider=MailGuard 365}.description", - "parentId": "[variables('workbookId1')]", - "contentId": "[variables('_workbookContentId1')]", - "kind": "Workbook", - "version": "[variables('workbookVersion1')]", + "description": "MailGuard 365 Hunting Query 3", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3)]", + "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryObject3').huntingQueryVersion3]", "source": { "kind": "Solution", "name": "MailGuard 365", "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "MailGuard", + "name": "MailGuard 365", "email": "[variables('_email')]" }, "support": { @@ -701,19 +1230,6 @@ "email": "support@mailguard365.com", "tier": "Partner", "link": "https://www.mailguard365.com/support/" - }, - "dependencies": { - "operator": "AND", - "criteria": [ - { - "contentId": "MailGuard365_Threats_CL", - "kind": "DataType" - }, - { - "contentId": "MailGuard365", - "kind": "DataConnector" - } - ] } } } @@ -724,12 +1240,12 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_workbookContentId1')]", - "contentKind": "Workbook", - "displayName": "[parameters('workbook1-name')]", - "contentProductId": "[variables('_workbookcontentProductId1')]", - "id": "[variables('_workbookcontentProductId1')]", - "version": "[variables('workbookVersion1')]" + "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]", + "contentKind": "HuntingQuery", + "displayName": "MailGuard 365 - Phishing Threats", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", + "version": "1.0.0" } }, { @@ -737,12 +1253,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.0", + "version": "3.0.1", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "MailGuard 365", "publisherDisplayName": "MailGuard 365", - "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Strengthen your Microsoft 365 email security against advanced zero-day phishing, ransomware & BEC attacks with MailGuard 365 enhanced email security. This Microsoft Sentinel Solution enables you to ingest threat data from MailGuard 365.

\n

Data Connectors: 1, Workbooks: 1, Hunting Queries: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Strengthen your Microsoft 365 email security against advanced zero-day phishing, ransomware & BEC attacks with MailGuard 365 enhanced email security. This Microsoft Sentinel Solution enables you to ingest threat data from MailGuard 365 via the Azure Monitor Logs Ingestion API, using a dedicated Entra application.

\n

Data Connectors: 1, Workbooks: 1, Hunting Queries: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -755,7 +1271,7 @@ "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "MailGuard", + "name": "MailGuard 365", "email": "[variables('_email')]" }, "support": { @@ -769,33 +1285,33 @@ "criteria": [ { "kind": "DataConnector", - "contentId": "[variables('_dataConnectorContentId1')]", - "version": "[variables('dataConnectorVersion1')]" + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "version": "[variables('dataConnectorCCPVersion')]" }, { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId1')]", - "version": "[variables('huntingQueryVersion1')]" + "kind": "Workbook", + "contentId": "[variables('_workbookContentId1')]", + "version": "[variables('workbookVersion1')]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId2')]", - "version": "[variables('huntingQueryVersion2')]" + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId3')]", - "version": "[variables('huntingQueryVersion3')]" + "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]", + "version": "[variables('huntingQueryObject2').huntingQueryVersion2]" }, { - "kind": "Workbook", - "contentId": "[variables('_workbookContentId1')]", - "version": "[variables('workbookVersion1')]" + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]", + "version": "[variables('huntingQueryObject3').huntingQueryVersion3]" } ] }, "firstPublishDate": "2023-05-09", - "lastPublishDate": "2023-06-08", + "lastPublishDate": "2026-09-14", "providers": [ "MailGuard" ], diff --git a/Solutions/MailGuard 365/Package/testParameters.json b/Solutions/MailGuard 365/Package/testParameters.json new file mode 100644 index 00000000000..e34a454c057 --- /dev/null +++ b/Solutions/MailGuard 365/Package/testParameters.json @@ -0,0 +1,46 @@ +{ + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } + }, + "workbook1-name": { + "type": "string", + "defaultValue": "MailGuard365", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + } +} diff --git a/Solutions/MailGuard 365/ReleaseNotes.md b/Solutions/MailGuard 365/ReleaseNotes.md index a05f69abc74..994d4954186 100644 --- a/Solutions/MailGuard 365/ReleaseNotes.md +++ b/Solutions/MailGuard 365/ReleaseNotes.md @@ -1,3 +1,4 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------| -| 3.0.0 | 31-08-2023 | Initial Solution Release | \ No newline at end of file +| 3.0.1 | 14-09-2026 | Migrated data connector from the deprecated HTTP Data Collector API to the Azure Monitor Logs Ingestion API (Codeless Connector Framework Push pattern). Data now lands in the `MG365ThreatData_CL` table via a Data Collection Rule; the legacy `MailGuard365_Threats_CL` table is no longer written to. Updated workbook and hunting queries to the new schema. | +| 3.0.0 | 31-08-2023 | Initial Solution Release | diff --git a/Solutions/MailGuard 365/SolutionMetadata.json b/Solutions/MailGuard 365/SolutionMetadata.json index cb9c843521e..a0cb089cdc5 100644 --- a/Solutions/MailGuard 365/SolutionMetadata.json +++ b/Solutions/MailGuard 365/SolutionMetadata.json @@ -2,7 +2,7 @@ "publisherId": "mailguardptylimited", "offerId": "microsoft-sentinel-solution-mailguard365", "firstPublishDate": "2023-05-09", - "lastPublishDate": "2023-06-08", + "lastPublishDate": "2026-09-14", "providers": ["MailGuard"], "categories": { "domains" : ["Security - Threat Protection"], @@ -14,4 +14,4 @@ "tier": "Partner", "link": "https://www.mailguard365.com/support/" } -} \ No newline at end of file +} diff --git a/Solutions/MailGuard 365/Workbooks/MailGuard365Dashboard.json b/Solutions/MailGuard 365/Workbooks/MailGuard365Dashboard.json index f335f27f92f..d4b9e50193f 100644 --- a/Solutions/MailGuard 365/Workbooks/MailGuard365Dashboard.json +++ b/Solutions/MailGuard 365/Workbooks/MailGuard365Dashboard.json @@ -19,7 +19,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "MailGuard365_Threats_CL \n| summarize Count=count() by Category\n| render barchart", + "query": "MG365ThreatData_CL \n| summarize Count=count() by Category\n| render barchart", "size": 3, "timeContext": { "durationMs": 2592000000 @@ -41,7 +41,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "MailGuard365_Threats_CL\n| summarize Count=count() by OriginCountry_s", + "query": "MG365ThreatData_CL\n| summarize Count=count() by OriginCountry", "size": 3, "timeContext": { "durationMs": 2592000000 @@ -54,7 +54,7 @@ }, "mapSettings": { "locInfo": "CountryRegion", - "locInfoColumn": "OriginCountry_s", + "locInfoColumn": "OriginCountry", "sizeSettings": "Count", "sizeAggregation": "Sum", "legendMetric": "Count", @@ -83,7 +83,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "MailGuard365_Threats_CL\n| summarize Count=count() by Email_s", + "query": "MG365ThreatData_CL\n| summarize Count=count() by Email", "size": 0, "timeContext": { "durationMs": 2592000000 @@ -119,7 +119,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "MailGuard365_Threats_CL\n| summarize Count=count() by format_datetime(unixtime_seconds_todatetime(ReceivedDateTime_d), \"yyyy-MM-dd\")\n| sort by Column1 asc\n", + "query": "MG365ThreatData_CL\n| summarize Count=count() by format_datetime(unixtime_seconds_todatetime(ReceivedDateTime), \"yyyy-MM-dd\")\n| sort by Column1 asc\n", "size": 0, "timeContext": { "durationMs": 2592000000 @@ -133,4 +133,4 @@ ], "fromTemplateId": "mailguard365-UserWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" -} \ No newline at end of file +} diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json index 35d2aa0831e..d03e98ec911 100644 --- a/Workbooks/WorkbooksMetadata.json +++ b/Workbooks/WorkbooksMetadata.json @@ -8118,18 +8118,18 @@ "logoFileName": "MailGuard365_logo.svg", "description": "MailGuard 365 Workbook", "dataTypesDependencies": [ - "MailGuard365_Threats_CL" + "MG365ThreatData_CL" ], "dataConnectorsDependencies": [ - "MailGuard365" + "MailGuard365" ], "previewImagesFileNames": [ - "MailGuard365WorkbookWhite1.png", - "MailGuard365WorkbookWhite2.png", - "MailGuard365WorkbookBlack1.png", - "MailGuard365WorkbookBlack2.png" + "MailGuard365WorkbookWhite1.png", + "MailGuard365WorkbookWhite2.png", + "MailGuard365WorkbookBlack1.png", + "MailGuard365WorkbookBlack2.png" ], - "version": "1.0.0", + "version": "1.1.0", "title": "MailGuard365", "templateRelativePath": "MailGuard365Dashboard.json", "subtitle": "", From 2df2360a6de010e1bb8b73c7197f15a7a704d253 Mon Sep 17 00:00:00 2001 From: Willup Sovis Date: Thu, 29 Oct 2026 16:37:27 +1100 Subject: [PATCH 2/2] Add MG365ThreatData_CL schema for KQL validation --- .../CustomTables/MG365ThreatData_CL.json | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 .script/tests/KqlvalidationsTests/CustomTables/MG365ThreatData_CL.json diff --git a/.script/tests/KqlvalidationsTests/CustomTables/MG365ThreatData_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/MG365ThreatData_CL.json new file mode 100644 index 00000000000..7cc47033b55 --- /dev/null +++ b/.script/tests/KqlvalidationsTests/CustomTables/MG365ThreatData_CL.json @@ -0,0 +1,33 @@ +{ + "Name": "MG365ThreatData_CL", + "Properties": [ + { "Name": "TimeGenerated", "Type": "DateTime" }, + { "Name": "MessageId", "Type": "String" }, + { "Name": "HeaderMessageId", "Type": "String" }, + { "Name": "UserId", "Type": "String" }, + { "Name": "CustomerTenantId", "Type": "String" }, + { "Name": "Score", "Type": "Real" }, + { "Name": "Virus", "Type": "Bool" }, + { "Name": "Category", "Type": "String" }, + { "Name": "Attachments", "Type": "Dynamic" }, + { "Name": "Sender", "Type": "Dynamic" }, + { "Name": "Recipients", "Type": "Dynamic" }, + { "Name": "ReceivedHeaders", "Type": "Dynamic" }, + { "Name": "SenderHeader", "Type": "String" }, + { "Name": "ToHeader", "Type": "String" }, + { "Name": "CcHeader", "Type": "String" }, + { "Name": "Subject", "Type": "String" }, + { "Name": "OriginCountry", "Type": "String" }, + { "Name": "MessageDate", "Type": "DateTime" }, + { "Name": "MessageSize", "Type": "Real" }, + { "Name": "Action", "Type": "String" }, + { "Name": "ReceivedDateTime", "Type": "Long" }, + { "Name": "ForefrontAntiSpam", "Type": "String" }, + { "Name": "MicrosoftAntiSpam", "Type": "String" }, + { "Name": "IsInWhiteList", "Type": "Bool" }, + { "Name": "IsInBlackList", "Type": "Bool" }, + { "Name": "Email", "Type": "String" }, + { "Name": "HasAttachment", "Type": "Bool" }, + { "Name": "HasImage", "Type": "Bool" } + ] +} \ No newline at end of file