![](\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/filewall-logo.svg\"){kind=logo}
",
- "Description": "Filewall for Microsoft 365 solution installs a Codeless (CCF/CLv2) connector that ingests Filewall activity logs for Exchange, SharePoint, OneDrive and Teams into custom tables. It also installs parsers, analytics rules and a workbook for visibility.",
+ "Description": "Filewall for Microsoft 365 solution installs a Codeless (CCF/CLv2) connector that ingests Filewall activity logs for Exchange, SharePoint, OneDrive and Teams into custom tables. It also installs parsers, a workbook, analytics rules that alert on malicious and suspicious files by verdict, and rules and hunting queries that correlate Filewall file hashes with Microsoft Defender for Endpoint device file events.",
"WorkbookBladeDescription": "This solution installs workbooks to visualize Filewall activity.",
"AnalyticalRuleBladeDescription": "This solution installs analytic rule templates. After installing the solution, create and enable analytic rules in Manage solution view.",
"Data Connectors": [
@@ -13,14 +13,19 @@
],
"Parsers": [
"Parsers/FilewallM365ExchangeEvent.yaml",
- "Parsers/FilewallM365FileEvent.yaml"
+ "Parsers/FilewallM365FileEvent.yaml",
+ "Parsers/FilewallM365EmailAttachmentEvent.yaml"
],
"Analytic Rules": [
"Analytic Rules/BlockedEmails.yaml",
- "Analytic Rules/BlockedFiles.yaml"
+ "Analytic Rules/BlockedFiles.yaml",
+ "Analytic Rules/BlockedFileSeenOnDevice.yaml"
+ ],
+ "Hunting Queries": [
+ "Hunting Queries/SanitizedOriginalSeenOnDevice.yaml"
],
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Filewall for Microsoft 365",
- "Version": "3.0.0",
+ "Version": "3.2.2",
"Metadata": "SolutionMetadata.json",
"TemplateSpec": false,
"Is1PConnector": false
diff --git a/Solutions/Filewall for Microsoft 365/Hunting Queries/SanitizedOriginalSeenOnDevice.yaml b/Solutions/Filewall for Microsoft 365/Hunting Queries/SanitizedOriginalSeenOnDevice.yaml
new file mode 100644
index 00000000000..0eb5b69b4bc
--- /dev/null
+++ b/Solutions/Filewall for Microsoft 365/Hunting Queries/SanitizedOriginalSeenOnDevice.yaml
@@ -0,0 +1,71 @@
+id: 5eec737b-2efd-4aa4-b2a7-3be10b62ddc2
+name: Filewall - Original of a file Filewall sanitized seen on a device
+description: |
+ 'Finds devices holding the original, unsanitized copy of a file that Filewall for Microsoft 365 sanitized, in inbound email or in SharePoint, OneDrive and Teams.
+ Filewall removed active content from these files before delivering them, so a device with the original hash got the file another way: a direct download, a removable drive, another mail flow or a copy released from Filewall.
+ Sanitizing is a policy action, not a malware verdict, so this is a hunting query rather than an alert. The sanitized hash is shown next to the original, and the report link opens the item in the Filewall console. Requires the Microsoft Defender XDR connector to stream DeviceFileEvents into the workspace.'
+requiredDataConnectors:
+ - connectorId: FilewallM365
+ dataTypes:
+ - FilewallExchange_CL
+ - FilewallFile_CL
+ - connectorId: MicrosoftThreatProtection
+ dataTypes:
+ - DeviceFileEvents
+tactics:
+ - Execution
+relevantTechniques:
+ - T1204.002
+query: |
+ let lookback = 14d;
+ // only files whose content Filewall changed: the original and the sanitized hash differ
+ let FilewallSanitized = union
+ (FilewallM365EmailAttachmentEvent()
+ | where TimeGenerated > ago(lookback)
+ | where ThreatVerdict == "Sanitized" and EmailDirection != "Outbound"
+ | where isnotempty(OriginalFileSha256) and isnotempty(SanitizedFileSha256) and OriginalFileSha256 != SanitizedFileSha256
+ | project FilewallTime = TimeGenerated, SHA256 = OriginalFileSha256, SanitizedSHA256 = SanitizedFileSha256, FilewallFileName = AttachmentName, FilewallUser = EmailRecipientTo, FilewallSource = "exchange", Sender = EmailSenderFrom, EventReportUrl),
+ (FilewallM365FileEvent()
+ | where TimeGenerated > ago(lookback)
+ | where ThreatVerdict == "Sanitized"
+ | where isnotempty(OriginalFileSha256) and isnotempty(SanitizedFileSha256) and OriginalFileSha256 != SanitizedFileSha256
+ | project FilewallTime = TimeGenerated, SHA256 = OriginalFileSha256, SanitizedSHA256 = SanitizedFileSha256, FilewallFileName = TargetFileName, FilewallUser = ActorUsername, FilewallSource = TargetFilePathType, Sender = "", EventReportUrl)
+ | summarize arg_min(FilewallTime, *) by SHA256;
+ DeviceFileEvents
+ | where TimeGenerated > ago(lookback)
+ | where isnotempty(SHA256)
+ | extend SHA256 = tolower(SHA256)
+ | join kind=inner FilewallSanitized on SHA256
+ | where TimeGenerated > FilewallTime
+ | summarize FirstSeenOnDevice = min(TimeGenerated), LastSeenOnDevice = max(TimeGenerated), DeviceActions = make_set(ActionType), arg_min(TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessAccountUpn, FilewallTime, FilewallFileName, FilewallUser, FilewallSource, Sender, SanitizedSHA256, EventReportUrl) by SHA256, DeviceId
+ | extend
+ DeviceAccountName = tostring(split(InitiatingProcessAccountUpn, "@")[0]),
+ DeviceAccountUPNSuffix = tostring(split(InitiatingProcessAccountUpn, "@")[1]),
+ FileDirectory = iff(FolderPath endswith FileName, substring(FolderPath, 0, strlen(FolderPath) - strlen(FileName) - 1), FolderPath),
+ Sha256Algorithm = "SHA256"
+ | project FirstSeenOnDevice, LastSeenOnDevice, DeviceId, DeviceName, DeviceActions, FileName, FileDirectory, SHA256, Sha256Algorithm, SanitizedSHA256, InitiatingProcessFileName, DeviceAccountName, DeviceAccountUPNSuffix, FilewallTime, FilewallFileName, FilewallUser, FilewallSource, Sender, EventReportUrl
+ | order by FirstSeenOnDevice desc
+entityMappings:
+ - entityType: Host
+ fieldMappings:
+ - identifier: FullName
+ columnName: DeviceName
+ - entityType: Account
+ fieldMappings:
+ - identifier: Name
+ columnName: DeviceAccountName
+ - identifier: UPNSuffix
+ columnName: DeviceAccountUPNSuffix
+ - entityType: File
+ fieldMappings:
+ - identifier: Name
+ columnName: FileName
+ - identifier: Directory
+ columnName: FileDirectory
+ - entityType: FileHash
+ fieldMappings:
+ - identifier: Algorithm
+ columnName: Sha256Algorithm
+ - identifier: Value
+ columnName: SHA256
+version: 1.0.0
diff --git a/Solutions/Filewall for Microsoft 365/Package/3.2.2.zip b/Solutions/Filewall for Microsoft 365/Package/3.2.2.zip
new file mode 100644
index 00000000000..4b31b06eef5
Binary files /dev/null and b/Solutions/Filewall for Microsoft 365/Package/3.2.2.zip differ
diff --git a/Solutions/Filewall for Microsoft 365/Package/createUiDefinition.json b/Solutions/Filewall for Microsoft 365/Package/createUiDefinition.json
index f89058d6a82..2c2b6930200 100644
--- a/Solutions/Filewall for Microsoft 365/Package/createUiDefinition.json
+++ b/Solutions/Filewall for Microsoft 365/Package/createUiDefinition.json
@@ -6,7 +6,7 @@
"config": {
"isWizard": false,
"basics": {
- "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Filewall%20for%20Microsoft%20365/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nFilewall for Microsoft 365 solution installs a Codeless (CCF/CLv2) connector that ingests Filewall activity logs for Exchange, SharePoint, OneDrive and Teams into custom tables. It also installs parsers, analytics rules and a workbook for visibility.\n\n**Data Connectors:** 1, **Parsers:** 2, **Workbooks:** 1, **Analytic Rules:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+ "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Filewall%20for%20Microsoft%20365/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nFilewall for Microsoft 365 solution installs a Codeless (CCF/CLv2) connector that ingests Filewall activity logs for Exchange, SharePoint, OneDrive and Teams into custom tables. It also installs parsers, a workbook, analytics rules that alert on malicious and suspicious files by verdict, and rules and hunting queries that correlate Filewall file hashes with Microsoft Defender for Endpoint device file events.\n\n**Data Connectors:** 1, **Parsers:** 3, **Workbooks:** 1, **Analytic Rules:** 3, **Hunting Queries:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
"subscription": {
"resourceProviders": [
"Microsoft.OperationsManagement/solutions",
@@ -51,6 +51,47 @@
}
],
"steps": [
+ {
+ "name": "contentSelection",
+ "label": "Content selection",
+ "elements": [
+ {
+ "name": "DeployAnalyticsRule",
+ "type": "Microsoft.Common.CheckBox",
+ "label": "DeployAnalyticsRule",
+ "defaultValue": true,
+ "toolTip": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)."
+ },
+ {
+ "name": "DeployWorkbook",
+ "type": "Microsoft.Common.CheckBox",
+ "label": "DeployWorkbook",
+ "defaultValue": true,
+ "toolTip": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)."
+ },
+ {
+ "name": "DeployDataConnector",
+ "type": "Microsoft.Common.CheckBox",
+ "label": "DeployDataConnector",
+ "defaultValue": true,
+ "toolTip": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)."
+ },
+ {
+ "name": "DeployHuntingQuery",
+ "type": "Microsoft.Common.CheckBox",
+ "label": "DeployHuntingQuery",
+ "defaultValue": true,
+ "toolTip": "Deploy the Microsoft Sentinel hunting queries carried by this solution."
+ },
+ {
+ "name": "DeployParser",
+ "type": "Microsoft.Common.CheckBox",
+ "label": "DeployParser",
+ "defaultValue": true,
+ "toolTip": "Deploy the parsers and their registrations carried by this solution."
+ }
+ ]
+ },
{
"name": "dataconnectors",
"label": "Data Connectors",
@@ -146,13 +187,13 @@
{
"name": "analytic1",
"type": "Microsoft.Common.Section",
- "label": "Filewall - Blocked emails",
+ "label": "Filewall - Malicious or suspicious email attachment blocked",
"elements": [
{
"name": "analytic1-text",
"type": "Microsoft.Common.TextBlock",
"options": {
- "text": "Identifies emails blocked by Filewall for Microsoft 365 (Exchange)."
+ "text": "Identifies attachments in inbound email that Filewall for Microsoft 365 blocked because an antivirus engine found malware (High severity), or because static analysis flagged the file or its content does not match its file type (Medium severity).\nAttachments blocked only by a policy rule (file type, size or encryption) and attachments sanitized by CDR are not malware verdicts and do not raise this alert; they stay available in the FilewallM365EmailAttachmentEvent parser.\nThe alert maps the recipient, the message and the original file hashes, so Microsoft Defender XDR can correlate it with other evidence for the same file or user, and it links to the message in the Filewall console."
}
}
]
@@ -160,13 +201,65 @@
{
"name": "analytic2",
"type": "Microsoft.Common.Section",
- "label": "Filewall - Blocked files",
+ "label": "Filewall - Malicious or suspicious file blocked in SharePoint, OneDrive or Teams",
"elements": [
{
"name": "analytic2-text",
"type": "Microsoft.Common.TextBlock",
"options": {
- "text": "Identifies files blocked by Filewall for Microsoft 365 (SharePoint/OneDrive/Teams)."
+ "text": "Identifies SharePoint, OneDrive and Teams files that Filewall for Microsoft 365 blocked because an antivirus engine found malware (High severity), or because static analysis flagged the file or its content does not match its file type (Medium severity).\nFiles blocked only by a policy rule (file type, size or encryption) and files sanitized by CDR are not malware verdicts and do not raise this alert; they stay available in the FilewallM365FileEvent parser.\nThe alert maps the file owner, the file and its original hashes, so Microsoft Defender XDR can correlate it with other evidence for the same file or user, and it links to the file in the Filewall console."
+ }
+ }
+ ]
+ },
+ {
+ "name": "analytic3",
+ "type": "Microsoft.Common.Section",
+ "label": "Filewall - File Filewall blocked as malicious or suspicious seen on a device",
+ "elements": [
+ {
+ "name": "analytic3-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "Correlates files that Filewall for Microsoft 365 blocked as malicious or suspicious, in email attachments or in SharePoint, OneDrive and Teams, with Microsoft Defender for Endpoint file events.\nA match means the original file reached a device by another path after Filewall blocked it, for example a direct download, a removable drive, another mail flow or a copy released from quarantine.\nThe match is on the original file hash Filewall recorded; the sanitized hash is kept in the custom details. Requires the Microsoft Defender XDR connector to stream DeviceFileEvents into the workspace."
+ }
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "name": "huntingqueries",
+ "label": "Hunting Queries",
+ "bladeTitle": "Hunting Queries",
+ "elements": [
+ {
+ "name": "huntingqueries-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in Manage solution view. "
+ }
+ },
+ {
+ "name": "huntingqueries-link",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "link": {
+ "label": "Learn more",
+ "uri": "https://docs.microsoft.com/azure/sentinel/hunting"
+ }
+ }
+ },
+ {
+ "name": "huntingquery1",
+ "type": "Microsoft.Common.Section",
+ "label": "Filewall - Original of a file Filewall sanitized seen on a device",
+ "elements": [
+ {
+ "name": "huntingquery1-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "Finds devices holding the original, unsanitized copy of a file that Filewall for Microsoft 365 sanitized, in inbound email or in SharePoint, OneDrive and Teams.\nFilewall removed active content from these files before delivering them, so a device with the original hash got the file another way: a direct download, a removable drive, another mail flow or a copy released from Filewall.\nSanitizing is a policy action, not a malware verdict, so this is a hunting query rather than an alert. The sanitized hash is shown next to the original, and the report link opens the item in the Filewall console. Requires the Microsoft Defender XDR connector to stream DeviceFileEvents into the workspace. This hunting query depends on FilewallM365 MicrosoftThreatProtection data connector (FilewallExchange_CL FilewallFile_CL DeviceFileEvents Parser or Table)"
}
}
]
@@ -177,7 +270,12 @@
"outputs": {
"workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
"location": "[location()]",
- "workspace": "[basics('workspace')]"
+ "workspace": "[basics('workspace')]",
+ "DeployAnalyticsRule": "[steps('contentSelection').DeployAnalyticsRule]",
+ "DeployWorkbook": "[steps('contentSelection').DeployWorkbook]",
+ "DeployDataConnector": "[steps('contentSelection').DeployDataConnector]",
+ "DeployHuntingQuery": "[steps('contentSelection').DeployHuntingQuery]",
+ "DeployParser": "[steps('contentSelection').DeployParser]"
}
}
}
diff --git a/Solutions/Filewall for Microsoft 365/Package/mainTemplate.json b/Solutions/Filewall for Microsoft 365/Package/mainTemplate.json
index 0d876b34003..411110f57ab 100644
--- a/Solutions/Filewall for Microsoft 365/Package/mainTemplate.json
+++ b/Solutions/Filewall for Microsoft 365/Package/mainTemplate.json
@@ -49,17 +49,52 @@
"metadata": {
"description": "Name for the workbook"
}
+ },
+ "DeployAnalyticsRule": {
+ "type": "bool",
+ "defaultValue": true,
+ "metadata": {
+ "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)."
+ }
+ },
+ "DeployWorkbook": {
+ "type": "bool",
+ "defaultValue": true,
+ "metadata": {
+ "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)."
+ }
+ },
+ "DeployDataConnector": {
+ "type": "bool",
+ "defaultValue": true,
+ "metadata": {
+ "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)."
+ }
+ },
+ "DeployHuntingQuery": {
+ "type": "bool",
+ "defaultValue": true,
+ "metadata": {
+ "description": "Deploy the Microsoft Sentinel hunting queries carried by this solution."
+ }
+ },
+ "DeployParser": {
+ "type": "bool",
+ "defaultValue": true,
+ "metadata": {
+ "description": "Deploy the parsers and their registrations carried by this solution."
+ }
}
},
"variables": {
"email": "support@filewall.com",
"_email": "[variables('email')]",
"_solutionName": "Filewall for Microsoft 365",
- "_solutionVersion": "3.0.0",
+ "_solutionVersion": "3.2.2",
"solutionId": "odix.azure-sentinel-solution-filewallm365",
"_solutionId": "[variables('solutionId')]",
"workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
- "dataConnectorCCPVersion": "3.0.0",
+ "dataConnectorCCPVersion": "3.2.2",
"_dataConnectorContentIdConnectorDefinition1": "FilewallM365",
"dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]",
"_dataConnectorContentIdConnections1": "FilewallM365Connections",
@@ -76,29 +111,48 @@
"_parserName1": "[concat(parameters('workspace'),'/','FilewallM365ExchangeEvent')]",
"_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'FilewallM365ExchangeEvent')]",
"parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('FilewallM365ExchangeEvent-Parser')))]",
- "parserVersion1": "1.0.0",
+ "parserVersion1": "1.1.0",
"parserContentId1": "FilewallM365ExchangeEvent-Parser"
},
"parserObject2": {
"_parserName2": "[concat(parameters('workspace'),'/','FilewallM365FileEvent')]",
"_parserId2": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'FilewallM365FileEvent')]",
"parserTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('FilewallM365FileEvent-Parser')))]",
- "parserVersion2": "1.0.0",
+ "parserVersion2": "1.1.0",
"parserContentId2": "FilewallM365FileEvent-Parser"
},
+ "parserObject3": {
+ "_parserName3": "[concat(parameters('workspace'),'/','FilewallM365EmailAttachmentEvent')]",
+ "_parserId3": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'FilewallM365EmailAttachmentEvent')]",
+ "parserTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('FilewallM365EmailAttachmentEvent-Parser')))]",
+ "parserVersion3": "1.0.0",
+ "parserContentId3": "FilewallM365EmailAttachmentEvent-Parser"
+ },
"analyticRuleObject1": {
- "analyticRuleVersion1": "1.0.0",
+ "analyticRuleVersion1": "1.1.0",
"_analyticRulecontentId1": "9b784b65-2d16-4c9f-9f59-2a5d4c659f42",
"analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '9b784b65-2d16-4c9f-9f59-2a5d4c659f42')]",
"analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('9b784b65-2d16-4c9f-9f59-2a5d4c659f42')))]",
- "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','9b784b65-2d16-4c9f-9f59-2a5d4c659f42','-', '1.0.0')))]"
+ "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','9b784b65-2d16-4c9f-9f59-2a5d4c659f42','-', '1.1.0')))]"
},
"analyticRuleObject2": {
- "analyticRuleVersion2": "1.0.0",
+ "analyticRuleVersion2": "1.1.0",
"_analyticRulecontentId2": "86e7f6fd-5c29-4a3a-bced-3eca3fb0c621",
"analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '86e7f6fd-5c29-4a3a-bced-3eca3fb0c621')]",
"analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('86e7f6fd-5c29-4a3a-bced-3eca3fb0c621')))]",
- "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','86e7f6fd-5c29-4a3a-bced-3eca3fb0c621','-', '1.0.0')))]"
+ "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','86e7f6fd-5c29-4a3a-bced-3eca3fb0c621','-', '1.1.0')))]"
+ },
+ "analyticRuleObject3": {
+ "analyticRuleVersion3": "1.0.0",
+ "_analyticRulecontentId3": "c75ef60d-c480-42ce-9dcf-5806bbec8e4a",
+ "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c75ef60d-c480-42ce-9dcf-5806bbec8e4a')]",
+ "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c75ef60d-c480-42ce-9dcf-5806bbec8e4a')))]",
+ "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c75ef60d-c480-42ce-9dcf-5806bbec8e4a','-', '1.0.0')))]"
+ },
+ "huntingQueryObject1": {
+ "huntingQueryVersion1": "1.0.0",
+ "_huntingQuerycontentId1": "5eec737b-2efd-4aa4-b2a7-3be10b62ddc2",
+ "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('5eec737b-2efd-4aa4-b2a7-3be10b62ddc2')))]"
},
"_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
},
@@ -262,7 +316,8 @@
}
]
}
- }
+ },
+ "condition": "[parameters('DeployDataConnector')]"
},
{
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]",
@@ -380,6 +435,22 @@
{
"name": "attachments",
"type": "dynamic"
+ },
+ {
+ "name": "direction",
+ "type": "string"
+ },
+ {
+ "name": "source_folder",
+ "type": "string"
+ },
+ {
+ "name": "internet_message_id",
+ "type": "string"
+ },
+ {
+ "name": "report_url",
+ "type": "string"
}
]
},
@@ -488,6 +559,10 @@
{
"name": "site_name",
"type": "string"
+ },
+ {
+ "name": "report_url",
+ "type": "string"
}
]
}
@@ -644,6 +719,30 @@
"type": "dynamic",
"isDefaultDisplay": false,
"isHidden": false
+ },
+ {
+ "name": "direction",
+ "type": "string",
+ "isDefaultDisplay": false,
+ "isHidden": false
+ },
+ {
+ "name": "source_folder",
+ "type": "string",
+ "isDefaultDisplay": false,
+ "isHidden": false
+ },
+ {
+ "name": "internet_message_id",
+ "type": "string",
+ "isDefaultDisplay": false,
+ "isHidden": false
+ },
+ {
+ "name": "report_url",
+ "type": "string",
+ "isDefaultDisplay": false,
+ "isHidden": false
}
]
}
@@ -816,6 +915,12 @@
"type": "string",
"isDefaultDisplay": false,
"isHidden": false
+ },
+ {
+ "name": "report_url",
+ "type": "string",
+ "isDefaultDisplay": false,
+ "isHidden": false
}
]
}
@@ -830,7 +935,8 @@
"packageId": "[variables('_solutionId')]",
"contentSchemaVersion": "3.0.0",
"version": "[variables('dataConnectorCCPVersion')]"
- }
+ },
+ "condition": "[parameters('DeployDataConnector')]"
},
{
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]",
@@ -973,7 +1079,8 @@
}
]
}
- }
+ },
+ "condition": "[parameters('DeployDataConnector')]"
},
{
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]",
@@ -1008,7 +1115,8 @@
}
]
}
- }
+ },
+ "condition": "[parameters('DeployDataConnector')]"
},
{
"type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
@@ -1312,7 +1420,8 @@
"packageId": "[variables('_solutionId')]",
"contentSchemaVersion": "3.0.0",
"version": "[variables('dataConnectorCCPVersion')]"
- }
+ },
+ "condition": "[parameters('DeployDataConnector')]"
},
{
"type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
@@ -1323,7 +1432,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
- "description": "FilewallM365Overview Workbook with template version 3.0.0",
+ "description": "FilewallM365Overview Workbook with template version 3.2.2",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('workbookVersion1')]",
@@ -1404,7 +1513,8 @@
"contentProductId": "[variables('_workbookcontentProductId1')]",
"id": "[variables('_workbookcontentProductId1')]",
"version": "[variables('workbookVersion1')]"
- }
+ },
+ "condition": "[parameters('DeployWorkbook')]"
},
{
"type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
@@ -1415,7 +1525,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
- "description": "FilewallM365ExchangeEvent Data Parser with template version 3.0.0",
+ "description": "FilewallM365ExchangeEvent Data Parser with template version 3.2.2",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('parserObject1').parserVersion1]",
@@ -1432,7 +1542,7 @@
"displayName": "Parser for Exchange events",
"category": "Microsoft Sentinel Parser",
"functionAlias": "FilewallM365ExchangeEvent",
- "query": "FilewallExchange_CL\n| extend \n EventStartTime = TimeGenerated, \n EventEndTime = TimeGenerated,\n EventOriginalType = tostring(event_type),\n EventType = case(status =~ \"blocked\" or status =~ \"failed\", \"ThreatInfo\", status =~ \"succeed\", \"Informational\", \"Informational\"),\n EventResult = case(status =~ \"blocked\", 'Blocked', status =~ \"failed\", \"Failure\", status =~ \"succeed\", \"Success\", \"NA\"),\n EventOriginalResultDetails = coalesce(state, summary),\n EventSeverity = case(status =~ \"blocked\", \"High\", status =~ \"failed\", \"Medium\", \"Informational\"),\n EventVendor = \"ODI-X\",\n EventProduct = \"Filewall for Microsoft 365\",\n EventUid = tostring(event_id),\n EmailSubject = subject,\n EmailSenderFrom = sender,\n EmailRecipientTo = recipient,\n EmailNetworkMessageId = mail_id,\n AlertPolicyId = policy_id,\n AlertPolicyName = policy_name,\n User = recipient,\n ActorUsername = sender,\n Dvc = application,\n DvcHostname = application,\n EventSchema = \"Alert\",\n EventSchemaVersion = \"0.1.0\",\n EventCount = int(1),\n timestamp = todatetime(timestamp),\n release_timestamp = todatetime(release_timestamp),\n release_by_admin = tobool(release_by_admin)\n| project TimeGenerated, EventStartTime, EventEndTime, EventUid, EventType, EventOriginalType, EventResult, EventOriginalResultDetails, EventSeverity, EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventCount, Dvc, DvcHostname, User, ActorUsername, EmailSubject, EmailSenderFrom, EmailRecipientTo, EmailNetworkMessageId, AlertPolicyId, AlertPolicyName, application, event_id, timestamp, status, state, summary, attachments, release_timestamp, release_by_admin, release_reason\n",
+ "query": "// One row per email Filewall processed.\n// ThreatVerdict separates what a Filewall engine found from what policy did, so severity follows\n// the verdict and not the block alone:\n// Malicious - an antivirus engine found malware (High)\n// Suspicious - static analysis flagged the file, or its content does not match its type (Medium)\n// ProcessingFailed / NotSanitized - the file was not processed or not sanitized (Low)\n// Unsanitizable - CDR could not rebuild the file, so it was blocked (Low)\n// PolicyBlocked - blocked by a file type, size or encryption rule, not a malware verdict (Informational)\n// Sanitized - CDR rebuilt the file and it was delivered (Informational)\n// A message takes the most severe verdict of its attachments. EmailAttachments carries each\n// attachment with its own verdict and severity; FilewallM365EmailAttachmentEvent expands it.\n// FilewallMessageId is Filewall's id for the message: the Graph item id for mailbox mail, and\n// \"Note: Please refer to the following before installing the solution:
\n• Review the solution Release Notes
\n• There may be known issues pertaining to this Solution, please refer to them before installing.
\nFilewall for Microsoft 365 solution installs a Codeless (CCF/CLv2) connector that ingests Filewall activity logs for Exchange, SharePoint, OneDrive and Teams into custom tables. It also installs parsers, analytics rules and a workbook for visibility.
\nData Connectors: 1, Parsers: 2, Workbooks: 1, Analytic Rules: 2
\nLearn more about Microsoft Sentinel | Learn more about Solutions
\n", + "descriptionHtml": "Note: Please refer to the following before installing the solution:
\n• Review the solution Release Notes
\n• There may be known issues pertaining to this Solution, please refer to them before installing.
\nFilewall for Microsoft 365 solution installs a Codeless (CCF/CLv2) connector that ingests Filewall activity logs for Exchange, SharePoint, OneDrive and Teams into custom tables. It also installs parsers, a workbook, analytics rules that alert on malicious and suspicious files by verdict, and rules and hunting queries that correlate Filewall file hashes with Microsoft Defender for Endpoint device file events.
\nData Connectors: 1, Parsers: 3, Workbooks: 1, Analytic Rules: 3, Hunting Queries: 1
\nLearn more about Microsoft Sentinel | Learn more about Solutions
\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -1987,6 +2665,11 @@ "contentId": "[variables('parserObject2').parserContentId2]", "version": "[variables('parserObject2').parserVersion2]" }, + { + "kind": "Parser", + "contentId": "[variables('parserObject3').parserContentId3]", + "version": "[variables('parserObject3').parserVersion3]" + }, { "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", @@ -1996,11 +2679,21 @@ "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" + }, + { + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]" } ] }, "firstPublishDate": "2026-01-06", - "lastPublishDate": "2026-01-06", + "lastPublishDate": "2026-10-26", "providers": [ "Filewall" ], @@ -2011,6 +2704,19 @@ } }, "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "pid-c8004b1b-c813-4de4-8a40-55327766dd90-partnercenter", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [] + } + } } ], "outputs": {} diff --git a/Solutions/Filewall for Microsoft 365/Package/testParameters.json b/Solutions/Filewall for Microsoft 365/Package/testParameters.json index de66003a3bd..43a94b64315 100644 --- a/Solutions/Filewall for Microsoft 365/Package/testParameters.json +++ b/Solutions/Filewall for Microsoft 365/Package/testParameters.json @@ -42,5 +42,40 @@ "metadata": { "description": "Name for the workbook" } + }, + "DeployAnalyticsRule": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + } + }, + "DeployWorkbook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + } + }, + "DeployDataConnector": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + } + }, + "DeployHuntingQuery": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel hunting queries carried by this solution." + } + }, + "DeployParser": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the parsers and their registrations carried by this solution." + } } } diff --git a/Solutions/Filewall for Microsoft 365/Parsers/FilewallM365EmailAttachmentEvent.yaml b/Solutions/Filewall for Microsoft 365/Parsers/FilewallM365EmailAttachmentEvent.yaml new file mode 100644 index 00000000000..2980529b5cc --- /dev/null +++ b/Solutions/Filewall for Microsoft 365/Parsers/FilewallM365EmailAttachmentEvent.yaml @@ -0,0 +1,33 @@ +id: 51c781c1-ba93-401e-a1c1-e34d4e407e54 +Function: + Title: Parser for Exchange email attachment events + Version: '1.0.0' + LastUpdated: '2026-10-26' +Category: Microsoft Sentinel Parser +FunctionName: FilewallM365EmailAttachmentEvent +FunctionAlias: FilewallM365EmailAttachmentEvent +FunctionQuery: | + // One row per email attachment Filewall processed, with its message's columns and its own + // ThreatVerdict and EventSeverity (see FilewallM365ExchangeEvent for the verdicts). + // The original and sanitized hashes are kept apart: OriginalFile* is the file the sender sent, + // the one to look for elsewhere; SanitizedFile* is the copy Filewall delivered in its place, + // empty when nothing was delivered. + FilewallM365ExchangeEvent() + | mv-expand Attachment = EmailAttachments + | extend + AttachmentName = tostring(Attachment.name), + AttachmentFileType = tostring(Attachment.type), + AttachmentSize = tostring(Attachment.size), + AttachmentStatus = tostring(Attachment.status), + AttachmentBlockReason = tostring(Attachment.block_reason), + AttachmentSummary = tostring(Attachment.summary), + ThreatVerdict = tostring(Attachment.verdict), + EventSeverity = tostring(Attachment.severity), + OriginalFileSha256 = tolower(tostring(Attachment.original_sha256)), + OriginalFileSha1 = tolower(tostring(Attachment.original_sha1)), + SanitizedFileSha256 = tolower(tostring(Attachment.new_sha256)), + SanitizedFileSha1 = tolower(tostring(Attachment.new_sha1)) + | extend + EventType = iff(ThreatVerdict in ("Malicious", "Suspicious"), "ThreatInfo", "Informational"), + EventResult = case(AttachmentStatus =~ "blocked", "Blocked", AttachmentStatus =~ "failed", "Failure", AttachmentStatus in~ ("succeed", "sanitized"), "Success", "NA") + | project TimeGenerated, IngestionTime, EventStartTime, EventEndTime, EventUid, EventType, EventOriginalType, EventResult, EventSeverity, ThreatVerdict, EventVendor, EventProduct, User, ActorUsername, EmailSubject, EmailSenderFrom, EmailRecipientTo, EmailDirection, EmailInternetMessageId, FilewallMessageId, EventReportUrl, AlertPolicyId, AlertPolicyName, AttachmentName, AttachmentFileType, AttachmentSize, AttachmentStatus, AttachmentBlockReason, AttachmentSummary, OriginalFileSha256, OriginalFileSha1, SanitizedFileSha256, SanitizedFileSha1, application, event_id, timestamp diff --git a/Solutions/Filewall for Microsoft 365/Parsers/FilewallM365ExchangeEvent.yaml b/Solutions/Filewall for Microsoft 365/Parsers/FilewallM365ExchangeEvent.yaml index d8a45aac0b3..2cc28a783c4 100644 --- a/Solutions/Filewall for Microsoft 365/Parsers/FilewallM365ExchangeEvent.yaml +++ b/Solutions/Filewall for Microsoft 365/Parsers/FilewallM365ExchangeEvent.yaml @@ -1,28 +1,68 @@ id: 378781a9-aef0-446a-9822-a8beb70835e7 Function: Title: Parser for Exchange events - Version: '1.0.0' - LastUpdated: '2026-01-01' + Version: '1.1.0' + LastUpdated: '2026-10-26' Category: Microsoft Sentinel Parser FunctionName: FilewallM365ExchangeEvent FunctionAlias: FilewallM365ExchangeEvent FunctionQuery: | + // One row per email Filewall processed. + // ThreatVerdict separates what a Filewall engine found from what policy did, so severity follows + // the verdict and not the block alone: + // Malicious - an antivirus engine found malware (High) + // Suspicious - static analysis flagged the file, or its content does not match its type (Medium) + // ProcessingFailed / NotSanitized - the file was not processed or not sanitized (Low) + // Unsanitizable - CDR could not rebuild the file, so it was blocked (Low) + // PolicyBlocked - blocked by a file type, size or encryption rule, not a malware verdict (Informational) + // Sanitized - CDR rebuilt the file and it was delivered (Informational) + // A message takes the most severe verdict of its attachments. EmailAttachments carries each + // attachment with its own verdict and severity; FilewallM365EmailAttachmentEvent expands it. + // FilewallMessageId is Filewall's id for the message: the Graph item id for mailbox mail, and + // "