Skip to content

MailGuard 365: migrate data connector to CCF Push (v3.0.1) #15486

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
willsovismailguard wants to merge 2 commits into
base: master
Choose a base branch
from
+1,471 −395
Open

MailGuard 365: migrate data connector to CCF Push (v3.0.1) #15486

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6efc404
MailGuard 365: migrate data connector to CCF Push (v3.0.1)
willsovismailguard Oct 29, 2026
2df2360
Add MG365ThreatData_CL schema for KQL validation
willsovismailguard Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions .script/tests/KqlvalidationsTests/CustomTables/MG365ThreatData_CL.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
{
"Name": "MG365ThreatData_CL",
"Properties": [
{ "Name": "TimeGenerated", "Type": "DateTime" },
{ "Name": "MessageId", "Type": "String" },
{ "Name": "HeaderMessageId", "Type": "String" },
{ "Name": "UserId", "Type": "String" },
{ "Name": "CustomerTenantId", "Type": "String" },
{ "Name": "Score", "Type": "Real" },
{ "Name": "Virus", "Type": "Bool" },
{ "Name": "Category", "Type": "String" },
{ "Name": "Attachments", "Type": "Dynamic" },
{ "Name": "Sender", "Type": "Dynamic" },
{ "Name": "Recipients", "Type": "Dynamic" },
{ "Name": "ReceivedHeaders", "Type": "Dynamic" },
{ "Name": "SenderHeader", "Type": "String" },
{ "Name": "ToHeader", "Type": "String" },
{ "Name": "CcHeader", "Type": "String" },
{ "Name": "Subject", "Type": "String" },
{ "Name": "OriginCountry", "Type": "String" },
{ "Name": "MessageDate", "Type": "DateTime" },
{ "Name": "MessageSize", "Type": "Real" },
{ "Name": "Action", "Type": "String" },
{ "Name": "ReceivedDateTime", "Type": "Long" },
{ "Name": "ForefrontAntiSpam", "Type": "String" },
{ "Name": "MicrosoftAntiSpam", "Type": "String" },
{ "Name": "IsInWhiteList", "Type": "Bool" },
{ "Name": "IsInBlackList", "Type": "Bool" },
{ "Name": "Email", "Type": "String" },
{ "Name": "HasAttachment", "Type": "Bool" },
{ "Name": "HasImage", "Type": "Bool" }
]
}
163 changes: 163 additions & 0 deletions ...ions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_ConnectorDefinition.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,163 @@
{
"name": "MailGuard365",
"apiVersion": "2022-09-01-preview",
"type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
"location": "[parameters('workspace-location')]",
"kind": "Customizable",
"properties": {
"connectorUiConfig": {
"id": "MailGuard365",
"title": "MailGuard 365 Connector (Push)",
"publisher": "MailGuard365",
"descriptionMarkdown": "The MailGuard 365 connector provides the capability to push mail-security event data from MailGuard 365 directly into Microsoft Sentinel using the Codeless Connector Framework (CCF) Push pattern. This connector ingests message metadata, sender/recipient details, spam/virus scoring, and attachment information into a custom Log Analytics table for analysis, alerting, and visualization.",
"graphQueries": [
{
"metricName": "MailGuard 365 Messages",
"legend": "MG365ThreatData_CL",
"baseQuery": "MG365ThreatData_CL"
}
],
"sampleQueries": [
{
"description": "Recent messages",
"query": "MG365ThreatData_CL\n | sort by TimeGenerated desc"
},
{
"description": "Messages flagged as virus",
"query": "MG365ThreatData_CL\n | where Virus == true\n | sort by TimeGenerated desc"
}
],
"dataTypes": [
{
"name": "MG365ThreatData_CL",
"lastDataReceivedQuery": "MG365ThreatData_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
}
],
"connectivityCriteria": [
{
"type": "IsConnectedQuery",
"value": [
"MG365ThreatData_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)"
]
}
],
"availability": {
"status": 1
},
"permissions": {
"resourceProvider": [
{
"provider": "Microsoft.OperationalInsights/workspaces",
"permissionsDisplayText": "Read and write permissions are required.",
"providerDisplayName": "Workspace",
"scope": "Workspace",
"requiredPermissions": {
"write": true,
"read": true,
"delete": true
}
}
],
"customs": [
{
"name": "Microsoft Entra",
"description": "Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher."
},
{
"name": "Microsoft Azure",
"description": "Permission to assign Monitoring Metrics Publisher role on data collection rule (DCR). Typically requires Azure RBAC Owner or User Access Administrator role."
}
]
},
"instructionSteps": [
{
"title": "1. Create ARM Resources and Provide the Required Permissions",
"description": "This connector enables MailGuard 365 to push mail-security event data directly to Microsoft Sentinel via the Azure Monitor Ingestion API.",
"instructions": [
{
"type": "Markdown",
"parameters": {
"content": "#### Automated Configuration and Secure Data Ingestion with Entra Application \nClicking \"Deploy\" will create a Log Analytics table and a Data Collection Rule (DCR), then create a dedicated Entra application, link the DCR to it, and generate a client secret. This lets MailGuard 365 push data securely to the DCR using an Entra token."
}
},
{
"type": "DeployPushConnectorButton",
"parameters": {
"label": "Deploy MailGuard 365 Push connector resources",
"applicationDisplayName": "MailGuard 365 Push Connector Application"
}
}
]
},
{
"title": "2. Configure MailGuard 365",
"description": "Copy the following values into MailGuard 365 admin console → Settings → Integration so MailGuard 365 knows where to push data for this tenant.",
"instructions": [
{
"type": "CopyableLabel",
"parameters": {
"label": "Tenant ID (Directory ID)",
"fillWith": [
"TenantId"
]
}
},
{
"type": "CopyableLabel",
"parameters": {
"label": "Entra App Registration Application ID",
"fillWith": [
"ApplicationId"
],
"placeholder": "Deploy push connector to get the App Registration Application ID"
}
},
{
"type": "CopyableLabel",
"parameters": {
"label": "Entra App Registration Secret",
"fillWith": [
"ApplicationSecret"
],
"placeholder": "Deploy push connector to get the App Registration Secret"
}
},
{
"type": "CopyableLabel",
"parameters": {
"label": "Data Collection Endpoint Uri",
"fillWith": [
"DataCollectionEndpoint"
],
"placeholder": "Deploy push connector to get the Data Collection Endpoint Uri"
}
},
{
"type": "CopyableLabel",
"parameters": {
"label": "Data Collection Rule Immutable ID",
"fillWith": [
"DataCollectionRuleId"
],
"placeholder": "Deploy push connector to get the Data Collection Rule Immutable ID"
}
},
{
"type": "CopyableLabel",
"parameters": {
"label": "Stream Name",
"value": "Custom-MG365ThreatData_CL"
}
},
{
"type": "Markdown",
"parameters": {
"content": "#### Configure MailGuard 365\nEnter the values above into your MailGuard 365 admin console under Settings → Integration, to enable message data push to Microsoft Sentinel."
}
}
]
}
]
}
}
}
147 changes: 147 additions & 0 deletions Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_DCR.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,147 @@
{
"name": "MailGuard365DCR",
"apiVersion": "2021-09-01-preview",
"type": "Microsoft.Insights/dataCollectionRules",
"location": "[parameters('workspace-location')]",
"properties": {
"streamDeclarations": {
"Custom-MG365ThreatData_CL": {
"columns": [
{
"name": "TimeGenerated",
"type": "datetime"
},
{
"name": "MessageId",
"type": "string"
},
{
"name": "HeaderMessageId",
"type": "string"
},
{
"name": "UserId",
"type": "string"
},
{
"name": "CustomerTenantId",
"type": "string"
},
{
"name": "Score",
"type": "real"
},
{
"name": "Virus",
"type": "boolean"
},
{
"name": "Category",
"type": "string"
},
{
"name": "Attachments",
"type": "dynamic"
},
{
"name": "Sender",
"type": "dynamic"
},
{
"name": "Recipients",
"type": "dynamic"
},
{
"name": "ReceivedHeaders",
"type": "dynamic"
},
{
"name": "SenderHeader",
"type": "string"
},
{
"name": "ToHeader",
"type": "string"
},
{
"name": "CcHeader",
"type": "string"
},
{
"name": "Subject",
"type": "string"
},
{
"name": "OriginCountry",
"type": "string"
},
{
"name": "MessageDate",
"type": "datetime"
},
{
"name": "MessageSize",
"type": "real"
},
{
"name": "Action",
"type": "string"
},
{
"name": "ReceivedDateTime",
"type": "long"
},
{
"name": "ForefrontAntiSpam",
"type": "string"
},
{
"name": "MicrosoftAntiSpam",
"type": "string"
},
{
"name": "IsInWhiteList",
"type": "boolean"
},
{
"name": "IsInBlackList",
"type": "boolean"
},
{
"name": "Email",
"type": "string"
},
{
"name": "HasAttachment",
"type": "boolean"
},
{
"name": "HasImage",
"type": "boolean"
}
]
}
},
"destinations": {
"logAnalytics": [
{
"workspaceResourceId": "[variables('workspaceResourceId')]",
"name": "clv2ws1"
}
]
},
"dataFlows": [
{
"streams": [
"Custom-MG365ThreatData_CL"
],
"destinations": [
"clv2ws1"
],
"transformKql": "source",
"outputStream": "Custom-MG365ThreatData_CL"
}
],
"dataCollectionEndpointId": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]"
}
}
27 changes: 27 additions & 0 deletions Solutions/MailGuard 365/Data Connectors/MailGuard365_ccf/MailGuard365_PollingConfig.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
{
"name": "MailGuard365ConnectorPolling",
"apiVersion": "2024-09-01",
"type": "Microsoft.SecurityInsights/dataConnectors",
"kind": "Push",
"properties": {
"connectorDefinitionName": "MailGuard365",
"dcrConfig": {
"streamName": "Custom-MG365ThreatData_CL",
"dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]",
"dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]"
},
"auth": {
"type": "Push",
"AppId": "[[parameters('auth').appId]",
"ServicePrincipalId": "[[parameters('auth').servicePrincipalId]"
},
"request": {
"RetryCount": 1
},
"response": {
"eventsJsonPaths": [
"$"
]
}
}
}
Loading
Loading