diff --git a/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_ConnectorDefinition.json b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_ConnectorDefinition.json new file mode 100644 index 00000000000..1c0afc43795 --- /dev/null +++ b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_ConnectorDefinition.json @@ -0,0 +1,258 @@ +{ + "name": "MimecastHumanRiskCCFDefinition", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "MimecastHumanRiskCCF", + "title": "Mimecast Human Risk (via Codeless Connector Framework)", + "publisher": "Mimecast", + "logo": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Mimecast.svg", + "descriptionMarkdown": "The data connector for [Mimecast Human Risk](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with visibility into the human risk posture of their organization within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view risk trends, understand which behaviors and attacks drive risk, and identify the individuals, departments and locations with the highest human risk. \nThe Mimecast Human Risk data included within the connector are: \n- Organization risk trends \n- Behaviors \n- Attacks \n- Individuals\n", + "graphQueriesTableName": "MimecastHumanRisk_Organization_CL", + "graphQueries": [ + { + "metricName": "Total organization risk records", + "legend": "Organization", + "baseQuery": "MimecastHumanRisk_Organization_CL" + }, + { + "metricName": "Total behavior records", + "legend": "Behaviors", + "baseQuery": "MimecastHumanRisk_Behaviors_CL" + }, + { + "metricName": "Total attack records", + "legend": "Attacks", + "baseQuery": "MimecastHumanRisk_Attacks_CL" + }, + { + "metricName": "Total individual risk records", + "legend": "Individuals", + "baseQuery": "MimecastHumanRisk_Individuals_CL" + } + ], + "sampleQueries": [ + { + "description": "Organization risk score by month (latest snapshot per month)", + "query": "MimecastHumanRisk_Organization_CL\n| summarize arg_max(TimeGenerated, *) by Month\n| project Month, HumanRiskScore, HumanRiskFactor, HumanRiskScoreTrend, AttackScore, AttackFactor\n| sort by Month desc" + }, + { + "description": "Latest behavior scores", + "query": "MimecastHumanRisk_Behaviors_CL\n| summarize arg_max(TimeGenerated, *) by BehaviorType\n| project BehaviorType, Score, Factor, EventCount, Trend, Events" + }, + { + "description": "Latest attack summary by type", + "query": "MimecastHumanRisk_Attacks_CL\n| summarize arg_max(TimeGenerated, *)\n| mv-expand AttackTypes\n| project AttackType = tostring(AttackTypes.type), AttackScore = toint(AttackTypes.attackScore), AttackTotal = toint(AttackTypes.attackTotal), Events = AttackTypes.events" + }, + { + "description": "Highest-risk individuals (latest snapshot)", + "query": "MimecastHumanRisk_Individuals_CL\n| summarize arg_max(TimeGenerated, *) by IndividualId\n| project DisplayName, EmailAddress, Department, Location, HumanRiskScore, HumanRiskFactor, AttackScore\n| top 50 by HumanRiskScore desc" + }, + { + "description": "Human risk score trend per individual", + "query": "MimecastHumanRisk_Individuals_CL\n| summarize Score = max(HumanRiskScore) by IndividualId, bin(TimeGenerated, 1d)\n| render timechart" + } + ], + "dataTypes": [ + { + "name": "MimecastHumanRisk_Organization_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Organization_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "MimecastHumanRisk_Behaviors_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Behaviors_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "MimecastHumanRisk_Attacks_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Attacks_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "MimecastHumanRisk_Individuals_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Individuals_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "status": 1, + "isPreview": true + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "Mimecast API 2.0 application", + "description": "A Mimecast API 2.0 application (Client ID and Client Secret) with the Human Risk READ permission." + } + ] + }, + "instructionSteps": [ + { + "title": "1. Create a Mimecast API 2.0 application", + "description": "1. Sign in to the Mimecast Administration Console.\n2. Go to **Integrations** > **API and Platform Integrations** and create (or open) an API 2.0 application.\n3. Grant the application the **Human Risk - Read** permission.\n4. Copy the **Client ID** and **Client Secret**.\n5. Identify your regional API base URL: `https://api.services.mimecast.com` (global), `https://uk-api.services.mimecast.com` (UK) or `https://us-api.services.mimecast.com` (US)." + }, + { + "title": "2. Connect", + "description": "Enter the details below and click Connect.", + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "Mimecast API Base URL", + "placeholder": "https://api.services.mimecast.com", + "type": "text", + "name": "mimecastBaseUrl", + "validations": { + "required": true + } + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Include https:// and do not add a trailing slash.", + "visible": true, + "inline": false + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Client ID", + "placeholder": "Mimecast API 2.0 Client ID", + "type": "text", + "name": "clientId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Client Secret", + "placeholder": "Mimecast API 2.0 Client Secret", + "type": "password", + "name": "clientSecret", + "validations": { + "required": true + } + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Use the Client ID and Client Secret from step 1.", + "visible": true, + "inline": false + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Months of data to request", + "placeholder": "3", + "type": "number", + "name": "monthsBack", + "defaultValue": "3", + "validations": { + "required": true + }, + "toolTip": "Minimum value is 1 (maximum accepted by the Mimecast API is 12)." + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Whole number of months, minimum 1 (the Mimecast API accepts 1 to 12; default 3), sent as monthsBack to the organization, behaviors and attacks endpoints. For behaviors and attacks it counts calendar months from the 1st of the starting month through today (1 = month-to-date). It does not apply to the individuals search.", + "visible": true, + "inline": false + } + }, + { + "type": "Dropdown", + "parameters": { + "label": "Polling interval", + "name": "pollingInterval", + "options": [ + { + "key": "60", + "text": "1 hour" + }, + { + "key": "240", + "text": "4 hours" + }, + { + "key": "480", + "text": "8 hours" + }, + { + "key": "720", + "text": "12 hours" + }, + { + "key": "1440", + "text": "24 hours" + }, + { + "key": "2880", + "text": "48 hours" + }, + { + "key": "10080", + "text": "7 days" + } + ], + "placeholder": "Select polling interval (recommended: 12 hours)", + "isMultiSelect": false, + "defaultAllSelected": false, + "required": true, + "validations": { + "required": true + } + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Select how often Sentinel queries the Mimecast Human Risk API (12 hours is recommended). Each poll writes a new snapshot, so shorter intervals increase ingestion volume. The Mimecast rate limits are far above what this connector uses.", + "visible": true, + "inline": false + } + }, + { + "type": "ConnectionToggleButton", + "parameters": { + "connectLabel": "Connect", + "disconnectLabel": "Disconnect", + "name": "toggle" + } + } + ] + }, + { + "title": "3. Verify the connection (post deployment)", + "description": "After you click **Connect**, verify that the connector is working:\n1. The connector status changes to **Connected** and **Data received** shows the last received time. The first data can take up to 30 minutes to appear.\n2. In **Logs**, run the below query to confirm that data is arriving in all four tables:\n```\nunion withsource=TableName MimecastHumanRisk_Organization_CL, MimecastHumanRisk_Behaviors_CL, MimecastHumanRisk_Attacks_CL, MimecastHumanRisk_Individuals_CL\n| summarize Records = count(), LastReceived = max(TimeGenerated) by TableName\n```\n3. Confirm that the parsers return data, for example `MimecastHumanRiskIndividuals | take 10`.\n4. If a table stays empty, check the **Mimecast API Base URL**, the **Client ID**, the **Client Secret** and that the application has the **Human Risk - Read** permission, then disconnect and connect again.\n5. Each poll adds a new snapshot at the selected polling interval. Open the **Mimecast Human Risk Workbook** to view the latest data." + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_DCR.json b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_DCR.json new file mode 100644 index 00000000000..8f6f56cd606 --- /dev/null +++ b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_DCR.json @@ -0,0 +1,241 @@ +{ + "name": "MimecastHumanRiskDCR", + "apiVersion": "2021-09-01-preview", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "{{location}}", + "properties": { + "dataCollectionEndpointId": "{{dataCollectionEndpointId}}", + "streamDeclarations": { + "Custom-MimecastHumanRisk_Organization_CL": { + "columns": [ + { + "name": "month", + "type": "string" + }, + { + "name": "humanRiskScore", + "type": "int" + }, + { + "name": "humanRiskFactor", + "type": "string" + }, + { + "name": "humanRiskScoreTrend", + "type": "int" + }, + { + "name": "attackScore", + "type": "int" + }, + { + "name": "attackFactor", + "type": "string" + }, + { + "name": "attackTrend", + "type": "int" + }, + { + "name": "attackTotal", + "type": "int" + }, + { + "name": "riskResponses", + "type": "int" + }, + { + "name": "totalActions", + "type": "int" + }, + { + "name": "notifications", + "type": "int" + }, + { + "name": "outboundActions", + "type": "int" + }, + { + "name": "groupChanges", + "type": "int" + } + ] + }, + "Custom-MimecastHumanRisk_Behaviors_CL": { + "columns": [ + { + "name": "type", + "type": "string" + }, + { + "name": "score", + "type": "int" + }, + { + "name": "factor", + "type": "string" + }, + { + "name": "eventCount", + "type": "int" + }, + { + "name": "trend", + "type": "int" + }, + { + "name": "events", + "type": "dynamic" + } + ] + }, + "Custom-MimecastHumanRisk_Attacks_CL": { + "columns": [ + { + "name": "attackScore", + "type": "int" + }, + { + "name": "attackFactor", + "type": "string" + }, + { + "name": "attackTypes", + "type": "dynamic" + } + ] + }, + "Custom-MimecastHumanRisk_Individuals_CL": { + "columns": [ + { + "name": "id", + "type": "string" + }, + { + "name": "displayName", + "type": "string" + }, + { + "name": "emailAddress", + "type": "string" + }, + { + "name": "firstName", + "type": "string" + }, + { + "name": "lastName", + "type": "string" + }, + { + "name": "managerName", + "type": "string" + }, + { + "name": "managerId", + "type": "string" + }, + { + "name": "department", + "type": "string" + }, + { + "name": "location", + "type": "string" + }, + { + "name": "jobTitle", + "type": "string" + }, + { + "name": "tenureMonths", + "type": "int" + }, + { + "name": "tenureStatus", + "type": "string" + }, + { + "name": "startDateTime", + "type": "string" + }, + { + "name": "humanRiskScore", + "type": "int" + }, + { + "name": "humanRiskFactor", + "type": "string" + }, + { + "name": "attackScore", + "type": "int" + }, + { + "name": "attackFactor", + "type": "string" + }, + { + "name": "behaviors", + "type": "dynamic" + }, + { + "name": "attacks", + "type": "dynamic" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "{{workspaceResourceId}}", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-MimecastHumanRisk_Organization_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | project TimeGenerated = now(), Month = month, HumanRiskScore = humanRiskScore, HumanRiskFactor = humanRiskFactor, HumanRiskScoreTrend = humanRiskScoreTrend, AttackScore = attackScore, AttackFactor = attackFactor, AttackTrend = attackTrend, AttackTotal = attackTotal, RiskResponses = riskResponses, TotalActions = totalActions, Notifications = notifications, OutboundActions = outboundActions, GroupChanges = groupChanges", + "outputStream": "Custom-MimecastHumanRisk_Organization_CL" + }, + { + "streams": [ + "Custom-MimecastHumanRisk_Behaviors_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | project TimeGenerated = now(), BehaviorType = type, Score = score, Factor = factor, EventCount = eventCount, Trend = trend, Events = events", + "outputStream": "Custom-MimecastHumanRisk_Behaviors_CL" + }, + { + "streams": [ + "Custom-MimecastHumanRisk_Attacks_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | project TimeGenerated = now(), AttackScore = attackScore, AttackFactor = attackFactor, AttackTypes = attackTypes", + "outputStream": "Custom-MimecastHumanRisk_Attacks_CL" + }, + { + "streams": [ + "Custom-MimecastHumanRisk_Individuals_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | project TimeGenerated = now(), IndividualId = id, DisplayName = displayName, EmailAddress = emailAddress, FirstName = firstName, LastName = lastName, ManagerName = managerName, ManagerId = managerId, Department = department, Location = location, JobTitle = jobTitle, TenureMonths = tenureMonths, TenureStatus = tenureStatus, StartDateTime = todatetime(startDateTime), HumanRiskScore = humanRiskScore, HumanRiskFactor = humanRiskFactor, AttackScore = attackScore, AttackFactor = attackFactor, Behaviors = behaviors, Attacks = attacks", + "outputStream": "Custom-MimecastHumanRisk_Individuals_CL" + } + ] + } +} \ No newline at end of file diff --git a/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_PollerConfig.json b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_PollerConfig.json new file mode 100644 index 00000000000..ca6710a4a5c --- /dev/null +++ b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_PollerConfig.json @@ -0,0 +1,203 @@ +[ + { + "name": "MimecastHumanRiskOrganizationPoller", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.SecurityInsights/dataConnectors", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "MimecastHumanRiskCCF", + "dataType": "MimecastHumanRisk_Organization_CL", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-MimecastHumanRisk_Organization_CL" + }, + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/oauth/token')]", + "TokenEndpointHeaders": { + "Content-Type": "application/x-www-form-urlencoded", + "Accept": "application/json" + } + }, + "request": { + "apiEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/human-risk/v1/organization')]", + "httpMethod": "GET", + "queryParameters": { + "monthsBack": "[[if(equals(parameters('monthsBack'), 'monthsBack'), '3', string(parameters('monthsBack')))]", + "fields": "attackTotal,riskResponses,totals.totalActions,totals.notifications,totals.outboundActions,totals.groupChanges" + }, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-MimecastHumanRisk-CCF" + }, + "rateLimitQPS": 1, + "queryWindowInMin": "[[int(first(parameters('pollingInterval')))]", + "retryCount": 3, + "timeoutInSeconds": 120 + }, + "response": { + "eventsJsonPaths": [ + "$.trends[*]", + "$.totals" + ], + "format": "json" + }, + "isActive": true + } + }, + { + "name": "MimecastHumanRiskBehaviorsPoller", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.SecurityInsights/dataConnectors", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "MimecastHumanRiskCCF", + "dataType": "MimecastHumanRisk_Behaviors_CL", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-MimecastHumanRisk_Behaviors_CL" + }, + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/oauth/token')]", + "TokenEndpointHeaders": { + "Content-Type": "application/x-www-form-urlencoded", + "Accept": "application/json" + } + }, + "request": { + "apiEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/human-risk/v1/organization/behaviors')]", + "httpMethod": "GET", + "queryParameters": { + "monthsBack": "[[if(equals(parameters('monthsBack'), 'monthsBack'), '3', string(parameters('monthsBack')))]", + "fields": "events" + }, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-MimecastHumanRisk-CCF" + }, + "rateLimitQPS": 1, + "queryWindowInMin": "[[int(first(parameters('pollingInterval')))]", + "retryCount": 3, + "timeoutInSeconds": 120 + }, + "response": { + "eventsJsonPaths": [ + "$.behaviors[*]" + ], + "format": "json" + }, + "isActive": true + } + }, + { + "name": "MimecastHumanRiskAttacksPoller", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.SecurityInsights/dataConnectors", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "MimecastHumanRiskCCF", + "dataType": "MimecastHumanRisk_Attacks_CL", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-MimecastHumanRisk_Attacks_CL" + }, + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/oauth/token')]", + "TokenEndpointHeaders": { + "Content-Type": "application/x-www-form-urlencoded", + "Accept": "application/json" + } + }, + "request": { + "apiEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/human-risk/v1/organization/attacks')]", + "httpMethod": "GET", + "queryParameters": { + "monthsBack": "[[if(equals(parameters('monthsBack'), 'monthsBack'), '3', string(parameters('monthsBack')))]", + "fields": "attackTypes" + }, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-MimecastHumanRisk-CCF" + }, + "rateLimitQPS": 1, + "queryWindowInMin": "[[int(first(parameters('pollingInterval')))]", + "retryCount": 3, + "timeoutInSeconds": 120 + }, + "response": { + "eventsJsonPaths": [ + "$" + ], + "format": "json" + }, + "isActive": true + } + }, + { + "name": "MimecastHumanRiskIndividualsPoller", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.SecurityInsights/dataConnectors", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "MimecastHumanRiskCCF", + "dataType": "MimecastHumanRisk_Individuals_CL", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-MimecastHumanRisk_Individuals_CL" + }, + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/oauth/token')]", + "TokenEndpointHeaders": { + "Content-Type": "application/x-www-form-urlencoded", + "Accept": "application/json" + } + }, + "request": { + "apiEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/human-risk/v1/individuals/search?pageSize=1000&fields=firstName,lastName,tenureMonths,tenureStatus,startDateTime,behaviors.eventCount,behaviors.events,attacks.eventCount,attacks.events')]", + "httpMethod": "POST", + "isPostPayloadJson": true, + "queryParametersTemplate": "{}", + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-MimecastHumanRisk-CCF" + }, + "rateLimitQPS": 1, + "queryWindowInMin": "[[int(first(parameters('pollingInterval')))]", + "retryCount": 3, + "timeoutInSeconds": 120 + }, + "response": { + "eventsJsonPaths": [ + "$.individuals[*]" + ], + "format": "json" + }, + "paging": { + "pagingType": "NextPageToken", + "nextPageTokenJsonPath": "$.meta.nextPage", + "nextPageParaName": "pageToken", + "pagingInfoPlacement": "QueryString" + }, + "isActive": true + } + } +] \ No newline at end of file diff --git a/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_Table.json b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_Table.json new file mode 100644 index 00000000000..539bbf0f73c --- /dev/null +++ b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_Table.json @@ -0,0 +1,275 @@ +[ + { + "name": "MimecastHumanRisk_Organization_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "properties": { + "schema": { + "name": "MimecastHumanRisk_Organization_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time the record was ingested" + }, + { + "name": "Month", + "type": "string", + "description": "Reporting month (YYYY-MM)" + }, + { + "name": "HumanRiskScore", + "type": "int", + "description": "Organization human risk score (0-100)" + }, + { + "name": "HumanRiskFactor", + "type": "string", + "description": "Human risk factor (veryLow..veryHigh)" + }, + { + "name": "HumanRiskScoreTrend", + "type": "int", + "description": "Human risk score change from prior month" + }, + { + "name": "AttackScore", + "type": "int", + "description": "Organization attack score (0-100)" + }, + { + "name": "AttackFactor", + "type": "string", + "description": "Attack factor (veryLow..veryHigh, notScored)" + }, + { + "name": "AttackTrend", + "type": "int", + "description": "Attack score change from prior month" + }, + { + "name": "AttackTotal", + "type": "int", + "description": "Total attack events for the month" + }, + { + "name": "RiskResponses", + "type": "int", + "description": "Risk response events for the month" + }, + { + "name": "TotalActions", + "type": "int", + "description": "Total risk response actions" + }, + { + "name": "Notifications", + "type": "int", + "description": "Total notifications sent" + }, + { + "name": "OutboundActions", + "type": "int", + "description": "Total outbound actions" + }, + { + "name": "GroupChanges", + "type": "int", + "description": "Total group membership changes" + } + ] + } + } + }, + { + "name": "MimecastHumanRisk_Behaviors_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "properties": { + "schema": { + "name": "MimecastHumanRisk_Behaviors_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time the record was ingested" + }, + { + "name": "BehaviorType", + "type": "string", + "description": "Behavior type (training, simulatedPhishing, actualPhishing, malware, sensitiveDataHandling)" + }, + { + "name": "Score", + "type": "int", + "description": "Behavior score (0-100)" + }, + { + "name": "Factor", + "type": "string", + "description": "Behavior risk factor" + }, + { + "name": "EventCount", + "type": "int", + "description": "Total events for the behavior in the period" + }, + { + "name": "Trend", + "type": "int", + "description": "Score change from prior period" + }, + { + "name": "Events", + "type": "dynamic", + "description": "Behavior-specific event counts" + } + ] + } + } + }, + { + "name": "MimecastHumanRisk_Attacks_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "properties": { + "schema": { + "name": "MimecastHumanRisk_Attacks_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time the record was ingested" + }, + { + "name": "AttackScore", + "type": "int", + "description": "Organization attack score (0-100)" + }, + { + "name": "AttackFactor", + "type": "string", + "description": "Organization attack factor" + }, + { + "name": "AttackTypes", + "type": "dynamic", + "description": "Per attack type (actualPhishing, malware, identity) scores and event counts" + } + ] + } + } + }, + { + "name": "MimecastHumanRisk_Individuals_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "properties": { + "schema": { + "name": "MimecastHumanRisk_Individuals_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time the record was ingested" + }, + { + "name": "IndividualId", + "type": "string", + "description": "Unique individual identifier" + }, + { + "name": "DisplayName", + "type": "string", + "description": "Display name" + }, + { + "name": "EmailAddress", + "type": "string", + "description": "Email address" + }, + { + "name": "FirstName", + "type": "string", + "description": "First name" + }, + { + "name": "LastName", + "type": "string", + "description": "Last name" + }, + { + "name": "ManagerName", + "type": "string", + "description": "Manager display name" + }, + { + "name": "ManagerId", + "type": "string", + "description": "Manager identifier" + }, + { + "name": "Department", + "type": "string", + "description": "Department" + }, + { + "name": "Location", + "type": "string", + "description": "Location" + }, + { + "name": "JobTitle", + "type": "string", + "description": "Job title" + }, + { + "name": "TenureMonths", + "type": "int", + "description": "Months with the organization" + }, + { + "name": "TenureStatus", + "type": "string", + "description": "newHire or veteran" + }, + { + "name": "StartDateTime", + "type": "datetime", + "description": "Start date with the organization" + }, + { + "name": "HumanRiskScore", + "type": "int", + "description": "Human risk score (0-100)" + }, + { + "name": "HumanRiskFactor", + "type": "string", + "description": "Human risk factor" + }, + { + "name": "AttackScore", + "type": "int", + "description": "Attack score (0-100)" + }, + { + "name": "AttackFactor", + "type": "string", + "description": "Attack factor" + }, + { + "name": "Behaviors", + "type": "dynamic", + "description": "Behavior scores and event counts" + }, + { + "name": "Attacks", + "type": "dynamic", + "description": "Attack scores and event counts" + } + ] + } + } + } +] \ No newline at end of file diff --git a/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/README.md b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/README.md new file mode 100644 index 00000000000..f7382258fd8 --- /dev/null +++ b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/README.md @@ -0,0 +1,30 @@ +# Mimecast Human Risk (CCF) + +Codeless Connector Framework (CCF) data connector for the [Mimecast Human Risk API](https://developer.services.mimecast.com/docs/human-risk/1/overview). +One Connect deploys four `RestApiPoller` rules that share a single OAuth 2.0 client-credentials configuration. + +| Poller | Endpoint | Table | Events path | +|---|---|---|---| +| Organization | `GET /human-risk/v1/organization` (`monthsBack` = user setting, `fields=attackTotal,riskResponses,totals.*`) | `MimecastHumanRisk_Organization_CL` | `$.trends[*]` and `$.totals` | +| Behaviors | `GET /human-risk/v1/organization/behaviors` (`monthsBack` = user setting, `fields=events`) | `MimecastHumanRisk_Behaviors_CL` | `$.behaviors[*]` | +| Attacks | `GET /human-risk/v1/organization/attacks` (`monthsBack` = user setting, `fields=attackTypes`) | `MimecastHumanRisk_Attacks_CL` | `$` | +| Individuals | `POST /human-risk/v1/individuals/search` (no filter: all individuals, `pageSize=1000`, all optional fields) | `MimecastHumanRisk_Individuals_CL` | `$.individuals[*]` | + +## Prerequisites +- A Mimecast API 2.0 application (Client ID / Client Secret) with the **Human Risk READ** permission. +- Your regional API base URL: `https://api.services.mimecast.com` (global), `https://uk-api.services.mimecast.com` or `https://us-api.services.mimecast.com` (no trailing slash). + +## Configuration (connector page) +- **Mimecast API Base URL**, **Client ID**, **Client Secret**: required. +- **Months of data to request**: whole number 1-12 (default 3). Applied as `monthsBack` to the three organization endpoints. Not used by the individuals search. +- **Polling interval**: dropdown (1, 4, 8, 12, 24, 48 hours, 7 days; default 12 hours). Applied as `queryWindowInMin` to all pollers. + +## Behavior notes +- The API has no event timestamps or time-window parameters. Each poll writes a snapshot and `TimeGenerated` is the ingestion time. Use `arg_max(TimeGenerated, *)` to get the latest snapshot (see the connector sample queries and the workbook). +- The organization response holds the monthly rows under `trends` and one aggregate `totals` object. Both land in `MimecastHumanRisk_Organization_CL`; the totals row has an empty `Month`. +- Individuals are paged with `meta.nextPage` -> `pageToken`. The request body is an empty `{}` (no filters, default sort `humanRiskScore:desc`), so every individual is ingested. Add a `filters` object to `queryParametersTemplate` in `MimecastHumanRisk_PollerConfig.json` to narrow it. +- Rate limits (per tenant): organization endpoints 10 RPS / 120 req/min, individuals search 2 RPS / 30 req/min. Pollers use `rateLimitQPS: 1`. + +## Files +- `Data Connectors/MimecastHumanRisk_ccf/` - connector definition (UI), DCR, tables, pollers. +- Package with `Tools/Create-Azure-Sentinel-Solution/V3/createSolutionV3.ps1`. diff --git a/Solutions/Mimecast/Data/Solution_Mimecast.json b/Solutions/Mimecast/Data/Solution_Mimecast.json index 10a41410a18..c32940ffc44 100644 --- a/Solutions/Mimecast/Data/Solution_Mimecast.json +++ b/Solutions/Mimecast/Data/Solution_Mimecast.json @@ -1,56 +1,62 @@ { - "Name": "Mimecast", - "Author": "Mimecast - dlapi@mimecast.com", - "Logo": "", - "Description": "An Azure app to enable Mimecast data to be viewed using analytical tables and charts which are brought into Azure.", - "Analytic Rules": [ - "Analytic Rules/MimecastTTP/Mimecast_TTP_Attachment.yaml", - "Analytic Rules/MimecastTTP/Mimecast_TTP_Impersonation.yaml", - "Analytic Rules/MimecastTTP/Mimecast_TTP_Url.yaml", - "Analytic Rules/MimecastAudit/Mimecast_Audit.yaml", - "Analytic Rules/MimecastSEG/MimecastCG_Attachment.yaml", - "Analytic Rules/MimecastSEG/MimecastCG_AV.yaml", - "Analytic Rules/MimecastSEG/MimecastCG_Impersonation.yaml", - "Analytic Rules/MimecastSEG/MimecastCG_Internal_Mail_Protect.yaml", - "Analytic Rules/MimecastSEG/MimecastCG_Spam_Event.yaml", - "Analytic Rules/MimecastSEG/MimecastCG_Url_Protect.yaml", - "Analytic Rules/MimecastSEG/MimecastCG_Virus.yaml", - "Analytic Rules/MimecastSEG/MimecastDLP_hold.yaml", - "Analytic Rules/MimecastSEG/MimecastDLP_Notifications.yaml" - ], - "Workbooks": [ - "Workbooks/Mimecast_Audit_Workbook.json", - "Workbooks/Mimecast_Awareness_Training_Workbook.json", - "Workbooks/Mimecast_Cloud_Integrated_Workbook.json", - "Workbooks/Mimecast_SEG_Workbook.json", - "Workbooks/Mimecast_TTP_Workbook.json" - ], - "Playbooks": [ - "Playbooks/Mimecast Data Connector Trigger Sync/azuredeploy.json" - ], - "Parsers": [ - "Parsers/MimecastAT/Mimecast_AT_Performane_Detail.yaml", - "Parsers/MimecastAT/Mimecast_AT_Safe_Score.yaml", - "Parsers/MimecastAT/Mimecast_AT_User_Data.yaml", - "Parsers/MimecastAT/Mimecast_AT_Watchlist.yaml", - "Parsers/MimecastAudit/Mimecast_Audit.yaml", - "Parsers/MimecastCI/Mimecast_Cloud_Integrated.yaml", - "Parsers/MimecastSEG/Mimecast_SEG_CG.yaml", - "Parsers/MimecastSEG/Mimecast_SEG_DLP.yaml", - "Parsers/MimecastTTP/Mimecast_TTP_Attachment.yaml", - "Parsers/MimecastTTP/Mimecast_TTP_Impersonation.yaml", - "Parsers/MimecastTTP/Mimecast_TTP_Url.yaml" - ], - "Data Connectors": [ - "Data Connectors/MimecastAT/Mimecast_AT_FunctionApp.json", - "Data Connectors/MimecastAudit/Mimecast_Audit_FunctionApp.json", - "Data Connectors/MimecastCloudIntegrated/Mimecast_Cloud_Integrated_FunctionApp.json", - "Data Connectors/MimecastSEG/Mimecast_SEG_FunctionApp.json", - "Data Connectors/MimecastTTP/Mimecast_TTP_FunctionApp.json" - ], - "BasePath": "C:\\Azure-Sentinel\\Solutions\\Mimecast", - "Version": "3.1.0", - "Metadata": "SolutionMetadata.json", - "TemplateSpec": true, - "Is1PConnector": false -} \ No newline at end of file + "Name": "Mimecast", + "Author": "Mimecast - dlapi@mimecast.com", + "Logo": "", + "Description": "An Azure app to enable Mimecast data to be viewed using analytical tables and charts which are brought into Azure.", + "Analytic Rules": [ + "Analytic Rules/MimecastTTP/Mimecast_TTP_Attachment.yaml", + "Analytic Rules/MimecastTTP/Mimecast_TTP_Impersonation.yaml", + "Analytic Rules/MimecastTTP/Mimecast_TTP_Url.yaml", + "Analytic Rules/MimecastAudit/Mimecast_Audit.yaml", + "Analytic Rules/MimecastSEG/MimecastCG_Attachment.yaml", + "Analytic Rules/MimecastSEG/MimecastCG_AV.yaml", + "Analytic Rules/MimecastSEG/MimecastCG_Impersonation.yaml", + "Analytic Rules/MimecastSEG/MimecastCG_Internal_Mail_Protect.yaml", + "Analytic Rules/MimecastSEG/MimecastCG_Spam_Event.yaml", + "Analytic Rules/MimecastSEG/MimecastCG_Url_Protect.yaml", + "Analytic Rules/MimecastSEG/MimecastCG_Virus.yaml", + "Analytic Rules/MimecastSEG/MimecastDLP_hold.yaml", + "Analytic Rules/MimecastSEG/MimecastDLP_Notifications.yaml" + ], + "Workbooks": [ + "Workbooks/Mimecast_Audit_Workbook.json", + "Workbooks/Mimecast_Awareness_Training_Workbook.json", + "Workbooks/Mimecast_Cloud_Integrated_Workbook.json", + "Workbooks/Mimecast_SEG_Workbook.json", + "Workbooks/Mimecast_TTP_Workbook.json", + "Workbooks/Mimecast_HumanRisk_Workbook.json" + ], + "Playbooks": [ + "Playbooks/Mimecast Data Connector Trigger Sync/azuredeploy.json" + ], + "Parsers": [ + "Parsers/MimecastAT/Mimecast_AT_Performane_Detail.yaml", + "Parsers/MimecastAT/Mimecast_AT_Safe_Score.yaml", + "Parsers/MimecastAT/Mimecast_AT_User_Data.yaml", + "Parsers/MimecastAT/Mimecast_AT_Watchlist.yaml", + "Parsers/MimecastAudit/Mimecast_Audit.yaml", + "Parsers/MimecastCI/Mimecast_Cloud_Integrated.yaml", + "Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Organization.yaml", + "Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Behaviors.yaml", + "Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Attacks.yaml", + "Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Individuals.yaml", + "Parsers/MimecastSEG/Mimecast_SEG_CG.yaml", + "Parsers/MimecastSEG/Mimecast_SEG_DLP.yaml", + "Parsers/MimecastTTP/Mimecast_TTP_Attachment.yaml", + "Parsers/MimecastTTP/Mimecast_TTP_Impersonation.yaml", + "Parsers/MimecastTTP/Mimecast_TTP_Url.yaml" + ], + "Data Connectors": [ + "Data Connectors/MimecastAT/Mimecast_AT_FunctionApp.json", + "Data Connectors/MimecastAudit/Mimecast_Audit_FunctionApp.json", + "Data Connectors/MimecastCloudIntegrated/Mimecast_Cloud_Integrated_FunctionApp.json", + "Data Connectors/MimecastSEG/Mimecast_SEG_FunctionApp.json", + "Data Connectors/MimecastTTP/Mimecast_TTP_FunctionApp.json", + "Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_ConnectorDefinition.json" + ], + "BasePath": "C:\\Azure-Sentinel\\Solutions\\Mimecast", + "Version": "3.1.1", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1PConnector": false +} diff --git a/Solutions/Mimecast/Package/3.1.1.zip b/Solutions/Mimecast/Package/3.1.1.zip new file mode 100644 index 00000000000..d280b815310 Binary files /dev/null and b/Solutions/Mimecast/Package/3.1.1.zip differ diff --git a/Solutions/Mimecast/Package/createUiDefinition.json b/Solutions/Mimecast/Package/createUiDefinition.json index ac858626656..df667a545bf 100644 --- a/Solutions/Mimecast/Package/createUiDefinition.json +++ b/Solutions/Mimecast/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Mimecast/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nAn Azure app to enable Mimecast data to be viewed using analytical tables and charts which are brought into Azure.\n\n**Data Connectors:** 5, **Parsers:** 11, **Workbooks:** 5, **Analytic Rules:** 13, **Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Mimecast/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nAn Azure app to enable Mimecast data to be viewed using analytical tables and charts which are brought into Azure.\n\n**Data Connectors:** 6, **Parsers:** 15, **Workbooks:** 6, **Analytic Rules:** 13, **Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -92,14 +92,14 @@ } }, { - "name": "dataconnectors-parser-text", + "name": "dataconnectors6-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "The Solution installs a parser that transforms the ingested data into Microsoft Sentinel normalized format. The normalized format enables better correlation of different types of data from different data sources to drive end-to-end outcomes seamlessly in security monitoring, hunting, incident investigation and response scenarios in Microsoft Sentinel." + "text": "This Solution installs the data connector for Mimecast Human Risk (via Codeless Connector Framework). You can get Mimecast Human Risk (via Codeless Connector Framework) data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { - "name": "dataconnectors-link5", + "name": "dataconnectors-link6", "type": "Microsoft.Common.TextBlock", "options": { "link": { @@ -205,6 +205,20 @@ } } ] + }, + { + "name": "workbook6", + "type": "Microsoft.Common.Section", + "label": "Mimecast Human Risk Workbook", + "elements": [ + { + "name": "workbook6-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "A workbook providing insights into Mimecast Human Risk, including organization risk trends, behavior and attack metrics, and the individuals, departments and locations with the highest human risk." + } + } + ] } ] }, diff --git a/Solutions/Mimecast/Package/mainTemplate.json b/Solutions/Mimecast/Package/mainTemplate.json index 2a250682d12..6a6b6294779 100644 --- a/Solutions/Mimecast/Package/mainTemplate.json +++ b/Solutions/Mimecast/Package/mainTemplate.json @@ -67,13 +67,35 @@ "metadata": { "description": "Name for the workbook" } + }, + "workbook6-name": { + "type": "string", + "defaultValue": "Mimecast Human Risk Workbook", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } } }, "variables": { "email": "dlapi@mimecast.com", "_email": "[variables('email')]", "_solutionName": "Mimecast", - "_solutionVersion": "3.1.0", + "_solutionVersion": "3.1.1", "solutionId": "mimecastnorthamerica1584469118674.azure-sentinel-solution-mimecast", "_solutionId": "[variables('solutionId')]", "analyticRuleObject1": { @@ -198,6 +220,12 @@ "workbookTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId5'))))]", "_workbookContentId5": "[variables('workbookContentId5')]", "_workbookcontentProductId5": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId5'),'-', variables('workbookVersion5'))))]", + "workbookVersion6": "1.0.0", + "workbookContentId6": "Mimecast_HumanRisk_Workbook", + "workbookId6": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId6'))]", + "workbookTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId6'))))]", + "_workbookContentId6": "[variables('workbookContentId6')]", + "_workbookcontentProductId6": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId6'),'-', variables('workbookVersion6'))))]", "Mimecast Data Connector Trigger Sync": "Mimecast Data Connector Trigger Sync", "_Mimecast Data Connector Trigger Sync": "[variables('Mimecast Data Connector Trigger Sync')]", "TemplateEmptyArray": "[json('[]')]", @@ -251,39 +279,67 @@ "parserContentId6": "MimecastCloudIntegrated-Parser" }, "parserObject7": { - "_parserName7": "[concat(parameters('workspace'),'/','MimecastCG')]", - "_parserId7": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastCG')]", - "parserTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastCG-Parser')))]", - "parserVersion7": "1.0.1", - "parserContentId7": "MimecastCG-Parser" + "_parserName7": "[concat(parameters('workspace'),'/','MimecastHumanRiskOrganization')]", + "_parserId7": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskOrganization')]", + "parserTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastHumanRiskOrganization-Parser')))]", + "parserVersion7": "1.1.0", + "parserContentId7": "MimecastHumanRiskOrganization-Parser" }, "parserObject8": { - "_parserName8": "[concat(parameters('workspace'),'/','MimecastDLP')]", - "_parserId8": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastDLP')]", - "parserTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastDLP-Parser')))]", - "parserVersion8": "1.0.1", - "parserContentId8": "MimecastDLP-Parser" + "_parserName8": "[concat(parameters('workspace'),'/','MimecastHumanRiskBehaviors')]", + "_parserId8": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskBehaviors')]", + "parserTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastHumanRiskBehaviors-Parser')))]", + "parserVersion8": "1.1.0", + "parserContentId8": "MimecastHumanRiskBehaviors-Parser" }, "parserObject9": { - "_parserName9": "[concat(parameters('workspace'),'/','MimecastTTPAttachment')]", - "_parserId9": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPAttachment')]", - "parserTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastTTPAttachment-Parser')))]", - "parserVersion9": "1.0.1", - "parserContentId9": "MimecastTTPAttachment-Parser" + "_parserName9": "[concat(parameters('workspace'),'/','MimecastHumanRiskAttacks')]", + "_parserId9": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskAttacks')]", + "parserTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastHumanRiskAttacks-Parser')))]", + "parserVersion9": "1.1.0", + "parserContentId9": "MimecastHumanRiskAttacks-Parser" }, "parserObject10": { - "_parserName10": "[concat(parameters('workspace'),'/','MimecastTTPImpersonation')]", - "_parserId10": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPImpersonation')]", - "parserTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastTTPImpersonation-Parser')))]", - "parserVersion10": "1.0.1", - "parserContentId10": "MimecastTTPImpersonation-Parser" + "_parserName10": "[concat(parameters('workspace'),'/','MimecastHumanRiskIndividuals')]", + "_parserId10": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskIndividuals')]", + "parserTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastHumanRiskIndividuals-Parser')))]", + "parserVersion10": "1.1.0", + "parserContentId10": "MimecastHumanRiskIndividuals-Parser" }, "parserObject11": { - "_parserName11": "[concat(parameters('workspace'),'/','MimecastTTPUrl')]", - "_parserId11": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPUrl')]", - "parserTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastTTPUrl-Parser')))]", + "_parserName11": "[concat(parameters('workspace'),'/','MimecastCG')]", + "_parserId11": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastCG')]", + "parserTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastCG-Parser')))]", "parserVersion11": "1.0.1", - "parserContentId11": "MimecastTTPUrl-Parser" + "parserContentId11": "MimecastCG-Parser" + }, + "parserObject12": { + "_parserName12": "[concat(parameters('workspace'),'/','MimecastDLP')]", + "_parserId12": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastDLP')]", + "parserTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastDLP-Parser')))]", + "parserVersion12": "1.0.1", + "parserContentId12": "MimecastDLP-Parser" + }, + "parserObject13": { + "_parserName13": "[concat(parameters('workspace'),'/','MimecastTTPAttachment')]", + "_parserId13": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPAttachment')]", + "parserTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastTTPAttachment-Parser')))]", + "parserVersion13": "1.0.1", + "parserContentId13": "MimecastTTPAttachment-Parser" + }, + "parserObject14": { + "_parserName14": "[concat(parameters('workspace'),'/','MimecastTTPImpersonation')]", + "_parserId14": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPImpersonation')]", + "parserTemplateSpecName14": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastTTPImpersonation-Parser')))]", + "parserVersion14": "1.0.1", + "parserContentId14": "MimecastTTPImpersonation-Parser" + }, + "parserObject15": { + "_parserName15": "[concat(parameters('workspace'),'/','MimecastTTPUrl')]", + "_parserId15": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPUrl')]", + "parserTemplateSpecName15": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastTTPUrl-Parser')))]", + "parserVersion15": "1.0.1", + "parserContentId15": "MimecastTTPUrl-Parser" }, "uiConfigId1": "MimecastATAPI", "_uiConfigId1": "[variables('uiConfigId1')]", @@ -330,6 +386,12 @@ "dataConnectorTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId5'))))]", "dataConnectorVersion5": "1.0.0", "_dataConnectorcontentProductId5": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId5'),'-', variables('dataConnectorVersion5'))))]", + "dataConnectorCCPVersion": "3.1.1", + "_dataConnectorContentIdConnectorDefinition6": "MimecastHumanRiskCCF", + "dataConnectorTemplateNameConnectorDefinition6": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition6')))]", + "_dataConnectorContentIdConnections6": "MimecastHumanRiskCCFConnections", + "dataConnectorTemplateNameConnections6": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections6')))]", + "dataCollectionEndpointId6": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]", "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ @@ -342,7 +404,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_TTP_Attachment_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Mimecast_TTP_Attachment_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -370,10 +432,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastTTPAPI", "dataTypes": [ "MimecastTTPAttachment" - ] + ], + "connectorId": "MimecastTTPAPI" } ], "tactics": [ @@ -407,10 +469,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { + "reopenClosedIncident": false, "enabled": true, "matchingMethod": "AllEntities", - "lookbackDuration": "P7D", - "reopenClosedIncident": false + "lookbackDuration": "P7D" }, "createIncident": true } @@ -467,7 +529,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_TTP_Impersonation_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Mimecast_TTP_Impersonation_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -495,10 +557,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastTTPAPI", "dataTypes": [ "MimecastTTPImpersonation" - ] + ], + "connectorId": "MimecastTTPAPI" } ], "tactics": [ @@ -533,10 +595,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { + "reopenClosedIncident": false, "enabled": true, "matchingMethod": "AllEntities", - "lookbackDuration": "P7D", - "reopenClosedIncident": false + "lookbackDuration": "P7D" }, "createIncident": true } @@ -593,7 +655,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_TTP_Url_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Mimecast_TTP_Url_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -621,10 +683,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastTTPAPI", "dataTypes": [ "MimecastTTPUrl" - ] + ], + "connectorId": "MimecastTTPAPI" } ], "tactics": [ @@ -676,10 +738,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { + "reopenClosedIncident": false, "enabled": true, "matchingMethod": "AllEntities", - "lookbackDuration": "P7D", - "reopenClosedIncident": false + "lookbackDuration": "P7D" }, "createIncident": true } @@ -736,7 +798,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_Audit_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Mimecast_Audit_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -764,10 +826,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastAuditAPI", "dataTypes": [ "MimecastAudit" - ] + ], + "connectorId": "MimecastAuditAPI" } ], "tactics": [ @@ -812,10 +874,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { + "reopenClosedIncident": false, "enabled": true, "matchingMethod": "AllEntities", - "lookbackDuration": "P7D", - "reopenClosedIncident": false + "lookbackDuration": "P7D" }, "createIncident": true } @@ -872,7 +934,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MimecastCG_Attachment_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "MimecastCG_Attachment_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -900,10 +962,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastSEGAPI", "dataTypes": [ "MimecastCG" - ] + ], + "connectorId": "MimecastSEGAPI" } ], "tactics": [ @@ -951,10 +1013,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { + "reopenClosedIncident": false, "enabled": true, "matchingMethod": "AllEntities", - "lookbackDuration": "P7D", - "reopenClosedIncident": false + "lookbackDuration": "P7D" }, "createIncident": true } @@ -1011,7 +1073,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MimecastCG_AV_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "MimecastCG_AV_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -1039,10 +1101,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastSEGAPI", "dataTypes": [ "MimecastCG" - ] + ], + "connectorId": "MimecastSEGAPI" } ], "tactics": [ @@ -1075,10 +1137,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { + "reopenClosedIncident": false, "enabled": true, "matchingMethod": "AllEntities", - "lookbackDuration": "P7D", - "reopenClosedIncident": false + "lookbackDuration": "P7D" }, "createIncident": true } @@ -1135,7 +1197,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MimecastCG_Impersonation_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "MimecastCG_Impersonation_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -1163,10 +1225,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastSEGAPI", "dataTypes": [ "MimecastCG" - ] + ], + "connectorId": "MimecastSEGAPI" } ], "tactics": [ @@ -1201,10 +1263,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { + "reopenClosedIncident": false, "enabled": true, "matchingMethod": "AllEntities", - "lookbackDuration": "P7D", - "reopenClosedIncident": false + "lookbackDuration": "P7D" }, "createIncident": true } @@ -1261,7 +1323,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MimecastCG_Internal_Mail_Protect_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "MimecastCG_Internal_Mail_Protect_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -1289,10 +1351,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastSEGAPI", "dataTypes": [ "MimecastCG" - ] + ], + "connectorId": "MimecastSEGAPI" } ], "tactics": [ @@ -1328,10 +1390,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { + "reopenClosedIncident": false, "enabled": true, "matchingMethod": "AllEntities", - "lookbackDuration": "P7D", - "reopenClosedIncident": false + "lookbackDuration": "P7D" }, "createIncident": true } @@ -1388,7 +1450,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MimecastCG_Spam_Event_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "MimecastCG_Spam_Event_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -1416,10 +1478,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastSEGAPI", "dataTypes": [ "MimecastCG" - ] + ], + "connectorId": "MimecastSEGAPI" } ], "tactics": [ @@ -1452,10 +1514,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { + "reopenClosedIncident": false, "enabled": true, "matchingMethod": "AllEntities", - "lookbackDuration": "P7D", - "reopenClosedIncident": false + "lookbackDuration": "P7D" }, "createIncident": true } @@ -1512,7 +1574,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MimecastCG_Url_Protect_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "MimecastCG_Url_Protect_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -1540,10 +1602,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastSEGAPI", "dataTypes": [ "MimecastCG" - ] + ], + "connectorId": "MimecastSEGAPI" } ], "tactics": [ @@ -1578,10 +1640,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { + "reopenClosedIncident": false, "enabled": true, "matchingMethod": "AllEntities", - "lookbackDuration": "P7D", - "reopenClosedIncident": false + "lookbackDuration": "P7D" }, "createIncident": true } @@ -1638,7 +1700,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MimecastCG_Virus_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "MimecastCG_Virus_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject11').analyticRuleVersion11]", @@ -1666,10 +1728,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastSEGAPI", "dataTypes": [ "MimecastCG" - ] + ], + "connectorId": "MimecastSEGAPI" } ], "tactics": [ @@ -1702,10 +1764,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { + "reopenClosedIncident": false, "enabled": true, "matchingMethod": "AllEntities", - "lookbackDuration": "P7D", - "reopenClosedIncident": false + "lookbackDuration": "P7D" }, "createIncident": true } @@ -1762,7 +1824,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MimecastDLP_hold_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "MimecastDLP_hold_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject12').analyticRuleVersion12]", @@ -1790,10 +1852,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastSEGAPI", "dataTypes": [ "MimecastDLP" - ] + ], + "connectorId": "MimecastSEGAPI" } ], "tactics": [ @@ -1826,10 +1888,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { + "reopenClosedIncident": false, "enabled": true, "matchingMethod": "AllEntities", - "lookbackDuration": "P7D", - "reopenClosedIncident": false + "lookbackDuration": "P7D" }, "createIncident": true } @@ -1886,7 +1948,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MimecastDLP_Notifications_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "MimecastDLP_Notifications_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject13').analyticRuleVersion13]", @@ -1914,10 +1976,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastSEGAPI", "dataTypes": [ "MimecastDLP" - ] + ], + "connectorId": "MimecastSEGAPI" } ], "tactics": [ @@ -1950,10 +2012,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { + "reopenClosedIncident": false, "enabled": true, "matchingMethod": "AllEntities", - "lookbackDuration": "P7D", - "reopenClosedIncident": false + "lookbackDuration": "P7D" }, "createIncident": true } @@ -2010,7 +2072,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_Audit_Workbook Workbook with template version 3.1.0", + "description": "Mimecast_Audit_Workbook Workbook with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -2098,7 +2160,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_Awareness_Training_Workbook Workbook with template version 3.1.0", + "description": "Mimecast_Awareness_Training_Workbook Workbook with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion2')]", @@ -2198,7 +2260,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_Cloud_Integrated_Workbook Workbook with template version 3.1.0", + "description": "Mimecast_Cloud_Integrated_Workbook Workbook with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion3')]", @@ -2286,7 +2348,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_SEG_Workbook Workbook with template version 3.1.0", + "description": "Mimecast_SEG_Workbook Workbook with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion4')]", @@ -2378,7 +2440,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_TTP_Workbook Workbook with template version 3.1.0", + "description": "Mimecast_TTP_Workbook Workbook with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion5')]", @@ -2465,6 +2527,106 @@ "version": "[variables('workbookVersion5')]" } }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('workbookTemplateSpecName6')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Mimecast_HumanRisk_Workbook Workbook with template version 3.1.1", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('workbookVersion6')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.Insights/workbooks", + "name": "[variables('workbookContentId6')]", + "location": "[parameters('workspace-location')]", + "kind": "shared", + "apiVersion": "2021-08-01", + "metadata": { + "description": "A workbook providing insights into Mimecast Human Risk, including organization risk trends, behavior and attack metrics, and the individuals, departments and locations with the highest human risk." + }, + "properties": { + "displayName": "[parameters('workbook6-name')]", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Mimecast Human Risk\\n\\nMonitor your organization's human risk posture using data from the Mimecast Human Risk connector. This workbook includes:\\n\\n- **Risk Overview** - average human risk score, risk response activity and how individuals are spread across risk factors.\\n- **Risk Trends** - monthly human risk and attack scores.\\n- **Highest Human Risks** - top 10 individuals, departments or locations by human risk score.\\n- **Human Risk Behaviors and Organization Attacks** - scores and event breakdowns by behavior and attack type.\"},\"name\":\"q1\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false,\"padding\":\"4px\"}},{\"type\":1,\"content\":{\"json\":\">**NOTE:** This workbook depends on parsers based on Kusto functions - **MimecastHumanRiskOrganization**, **MimecastHumanRiskBehaviors**, **MimecastHumanRiskAttacks** and **MimecastHumanRiskIndividuals** - which are deployed with the Microsoft Sentinel Solution.\",\"style\":\"info\"},\"name\":\"q1-note-parsers\",\"styleSettings\":{\"margin\":\"8px\"}},{\"type\":1,\"content\":{\"json\":\"Data is collected as snapshots at the polling interval chosen in the connector (default 12 hours). Each panel shows the latest snapshot inside the selected time range, so keep the time range at least as long as the polling interval.\",\"style\":\"upsell\"},\"name\":\"q1-note-snapshot\",\"styleSettings\":{\"margin\":\"8px\"}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":14400000},{\"durationMs\":28800000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":604800000},{\"durationMs\":2592000000},{\"durationMs\":7776000000},{\"durationMs\":15552000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":43200000},\"value\":{\"durationMs\":43200000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters-time\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}}],\"exportParameters\":true},\"name\":\"group-header\",\"styleSettings\":{\"margin\":\"4px\",\"padding\":\"8px\",\"showBorder\":false}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"---\\n## Risk Overview\\nAverage human risk, risk-response activity and how individuals are distributed across risk factors.\"},\"name\":\"h-overview\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| summarize Value = round(avg(HumanRiskScore), 1) | extend Metric = 'Average Human Risk Score (0-100)'\",\"size\":3,\"title\":\"Human Risk Score\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"customWidth\":\"25\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Metric\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Value\",\"formatter\":12,\"formatOptions\":{\"palette\":\"greenRed\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":4,\"maximumFractionDigits\":1}}},\"showBorder\":false,\"size\":\"auto\"},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q2\",\"customWidth\":\"25\",\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":false,\"padding\":\"8px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let T = MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by Month;\\nT | summarize Notifications = avg(Notifications), GroupChanges = avg(GroupChanges), TotalActions = avg(TotalActions)\\n| project Metric = dynamic(['Notifications','Group Changes','Risk Activity']), Value = pack_array(Notifications, GroupChanges, TotalActions)\\n| mv-expand Metric to typeof(string), Value to typeof(real)\\n| project Metric, Value = round(Value, 1)\",\"size\":3,\"title\":\"Notifications, Group Changes and Risk Activity\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Metric\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Value\",\"formatter\":12,\"formatOptions\":{\"palette\":\"greenRed\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":4,\"maximumFractionDigits\":1}}},\"showBorder\":false},\"customWidth\":\"75\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q7\",\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":false,\"padding\":\"8px\"},\"customWidth\":\"75\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| extend Bucket = case(isempty(HumanRiskFactor) or HumanRiskFactor == 'notScored', 'Not Scored', HumanRiskFactor == 'veryLow', 'Very Low', HumanRiskFactor == 'low', 'Low', HumanRiskFactor == 'medium', 'Medium', HumanRiskFactor == 'high', 'High', HumanRiskFactor == 'veryHigh', 'Very High', 'Not Scored')\\n| summarize Count = count() by Bucket\\n| extend o = case(Bucket == 'Very Low', 1, Bucket == 'Low', 2, Bucket == 'Medium', 3, Bucket == 'High', 4, Bucket == 'Very High', 5, 6) | sort by o asc | project-away o\",\"size\":3,\"title\":\"Human Risk Factor Distribution\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"customWidth\":\"50\",\"chartSettings\":{\"showLegend\":false,\"showMetrics\":false},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q3\",\"customWidth\":\"50\",\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":false,\"padding\":\"8px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| extend Bucket = case(isempty(AttackFactor) or AttackFactor == 'notScored', 'Not Scored', AttackFactor == 'veryLow', 'Very Low', AttackFactor == 'low', 'Low', AttackFactor == 'medium', 'Medium', AttackFactor == 'high', 'High', AttackFactor == 'veryHigh', 'Very High', 'Not Scored')\\n| summarize Count = count() by Bucket\\n| extend o = case(Bucket == 'Very Low', 1, Bucket == 'Low', 2, Bucket == 'Medium', 3, Bucket == 'High', 4, Bucket == 'Very High', 5, 6) | sort by o asc | project-away o\",\"size\":3,\"title\":\"Attack Factor Distribution\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"customWidth\":\"50\",\"chartSettings\":{\"showLegend\":false,\"showMetrics\":false},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q4\",\"customWidth\":\"50\",\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":false,\"padding\":\"8px\"}}],\"exportParameters\":false},\"name\":\"group-overview\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"8px\",\"showBorder\":false}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"---\\n## Risk Trends\\nMonthly organization human risk and attack scores.\"},\"name\":\"h-trends\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\\n| where isnotnull(HumanRiskScore) and isnotnull(MonthStart)\\n| project MonthStart, ['Human Risk Score'] = HumanRiskScore\\n| sort by MonthStart asc\",\"size\":0,\"title\":\"Human Risk Score Trends\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"customWidth\":\"50\",\"chartSettings\":{\"showLegend\":false,\"xAxis\":\"MonthStart\",\"yAxis\":[\"Human Risk Score\"]},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q5\",\"customWidth\":\"50\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"10px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\\n| project Month, ['Risk Responses'] = coalesce(RiskResponses, 0)\\n| sort by Month asc\",\"size\":0,\"title\":\"Human Risk Score Trends - Risk Responses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"columnchart\",\"customWidth\":\"50\",\"chartSettings\":{\"showLegend\":false,\"xAxis\":\"Month\"},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q6\",\"customWidth\":\"50\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"10px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\\n| where isnotnull(AttackScore) and isnotnull(MonthStart)\\n| project MonthStart, ['Attack Score'] = AttackScore\\n| sort by MonthStart asc\",\"size\":0,\"title\":\"Attack Score Trends\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":false,\"xAxis\":\"MonthStart\",\"yAxis\":[\"Attack Score\"]},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q12\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"10px\",\"showBorder\":true}}],\"exportParameters\":false},\"name\":\"group-trends\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"8px\",\"showBorder\":false}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"---\\n## Highest Human Risks\\nTop 10 individuals, departments or locations. Use the selector to switch views.\"},\"name\":\"h-highest\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"groupby\",\"label\":\"Highest Risks\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[{\\\"value\\\":\\\"individuals\\\",\\\"label\\\":\\\"Individuals\\\"},{\\\"value\\\":\\\"department\\\",\\\"label\\\":\\\"Departments\\\"},{\\\"value\\\":\\\"locations\\\",\\\"label\\\":\\\"Locations\\\"}]\",\"value\":\"individuals\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters-groupby\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| project ['FULL NAME'] = coalesce(DisplayName, '-'), ['HUMAN RISK SCORE'] = HumanRiskScore, EMAIL = coalesce(EmailAddress, '-'), MANAGER = coalesce(ManagerName, '-'), DEPARTMENT = coalesce(Department, '-'), LOCATION = coalesce(Location, '-'), ['SIMULATED PHISHING'] = SimulatedPhishingScore, ['ACTUAL PHISHING'] = ActualPhishingScore, TRAINING = TrainingScore, MALWARE = MalwareScore, ['SENSITIVE DATA HANDLING'] = SensitiveDataHandlingScore, ['TENURE DURATION (MONTHS)'] = TenureMonths, ['ATTACK FACTOR'] = case(isempty(AttackFactor) or AttackFactor == 'notScored', 'Not Scored', AttackFactor == 'veryLow', 'Very Low', AttackFactor == 'low', 'Low', AttackFactor == 'medium', 'Medium', AttackFactor == 'high', 'High', AttackFactor == 'veryHigh', 'Very High', 'Not Scored')\\n| top 10 by ['HUMAN RISK SCORE'] desc\\n| serialize ['S.NO'] = row_number()\\n| project-reorder ['S.NO']\",\"size\":3,\"title\":\"Individuals Highest Human Risks\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK FACTOR\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Very Low\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Very High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Not Scored\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q8\",\"conditionalVisibilities\":[{\"comparison\":\"isEqualTo\",\"parameterName\":\"groupby\",\"value\":\"individuals\"}],\"conditionalVisibility\":{\"parameterName\":\"groupby\",\"comparison\":\"isEqualTo\",\"value\":\"individuals\"},\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":true,\"padding\":\"6px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| extend Grp = iff(isempty(Department), 'Not Provided', Department)\\n| summarize ['# OF INDIVIDUALS'] = count(), ['HUMAN RISK SCORE'] = round(avg(HumanRiskScore), 1), ['SIMULATED PHISHING'] = round(avg(SimulatedPhishingScore), 1), ['ACTUAL PHISHING'] = round(avg(ActualPhishingScore), 1), TRAINING = round(avg(TrainingScore), 1), MALWARE = round(avg(MalwareScore), 1), ['SENSITIVE DATA HANDLING'] = round(avg(SensitiveDataHandlingScore), 1) by DEPARTMENT = Grp\\n| top 10 by ['HUMAN RISK SCORE'] desc\\n| serialize ['S.NO'] = row_number()\\n| project-reorder ['S.NO']\",\"size\":3,\"title\":\"Departments Highest Human Risks\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}}],\"rowLimit\":10000},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q9\",\"conditionalVisibilities\":[{\"comparison\":\"isEqualTo\",\"parameterName\":\"groupby\",\"value\":\"department\"}],\"conditionalVisibility\":{\"parameterName\":\"groupby\",\"comparison\":\"isEqualTo\",\"value\":\"department\"},\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":true,\"padding\":\"6px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| extend Grp = iff(isempty(Location), 'Not Provided', Location)\\n| summarize ['# OF INDIVIDUALS'] = count(), ['HUMAN RISK SCORE'] = round(avg(HumanRiskScore), 1), ['SIMULATED PHISHING'] = round(avg(SimulatedPhishingScore), 1), ['ACTUAL PHISHING'] = round(avg(ActualPhishingScore), 1), TRAINING = round(avg(TrainingScore), 1), MALWARE = round(avg(MalwareScore), 1), ['SENSITIVE DATA HANDLING'] = round(avg(SensitiveDataHandlingScore), 1) by LOCATION = Grp\\n| top 10 by ['HUMAN RISK SCORE'] desc\\n| serialize ['S.NO'] = row_number()\\n| project-reorder ['S.NO']\",\"size\":3,\"title\":\"Locations Highest Human Risks\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}}],\"rowLimit\":10000},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q10\",\"conditionalVisibilities\":[{\"comparison\":\"isEqualTo\",\"parameterName\":\"groupby\",\"value\":\"locations\"}],\"conditionalVisibility\":{\"parameterName\":\"groupby\",\"comparison\":\"isEqualTo\",\"value\":\"locations\"},\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":true,\"padding\":\"6px\"}}],\"exportParameters\":true},\"name\":\"group-highest\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"8px\",\"showBorder\":false}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"---\\n## Human Risk Behaviors\"},\"name\":\"h-behaviors\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskBehaviors | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by BehaviorType\\n| project STAGE = BehaviorName, ['HUMAN RISK FACTOR'] = FactorLabel, ['HUMAN RISK SCORE'] = Score, ['TOTAL EVENTS'] = EventCount\\n| sort by ['TOTAL EVENTS'] desc\",\"size\":3,\"title\":\"Human Risk Behaviors\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"HUMAN RISK FACTOR\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Very Low\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Very High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Not Scored\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"TOTAL EVENTS\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000},\"exportFieldName\":\"STAGE\",\"exportDefaultValue\":\"none\",\"exportParameterName\":\"selected_behavior\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q13\",\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":true,\"padding\":\"6px\"}},{\"type\":1,\"content\":{\"json\":\"Click a row in the table above to see its event breakdown.\",\"style\":\"info\"},\"name\":\"h-behaviors-info\",\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskBehaviors | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by BehaviorType\\n| where BehaviorName == '{selected_behavior}'\\n| extend k = bag_keys(Events) | mv-expand k to typeof(string)\\n| project ['EVENT TYPE'] = k, COUNT = toint(Events[k])\\n| where isnotnull(COUNT)\\n| sort by COUNT desc\",\"size\":3,\"title\":\"Event Breakdown for {selected_behavior}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"COUNT\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q15\",\"conditionalVisibilities\":[{\"comparison\":\"isNotEqualTo\",\"parameterName\":\"selected_behavior\",\"value\":\"none\"}],\"conditionalVisibility\":{\"parameterName\":\"selected_behavior\",\"comparison\":\"isNotEqualTo\",\"value\":\"none\"},\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":true,\"padding\":\"6px\"}}],\"exportParameters\":true},\"name\":\"group-behaviors\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"8px\",\"showBorder\":false}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"---\\n## Organization Attacks\"},\"name\":\"h-attacks\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskAttacks | where TimeGenerated {TimeRange} | where isnotempty(AttackType) | summarize arg_max(TimeGenerated, *) by AttackType\\n| project ATTACKTYPE = AttackTypeName, ['ATTACK FACTOR'] = AttackTypeFactorLabel, ['ATTACK SCORE'] = AttackTypeScore, ['TOTAL EVENTS'] = AttackTypeTotal\\n| sort by ['TOTAL EVENTS'] desc\",\"size\":3,\"title\":\"Organization Attacks\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK FACTOR\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Very Low\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Very High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Not Scored\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"TOTAL EVENTS\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000},\"exportFieldName\":\"ATTACKTYPE\",\"exportDefaultValue\":\"none\",\"exportParameterName\":\"selected_attack\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q16\",\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":true,\"padding\":\"6px\"}},{\"type\":1,\"content\":{\"json\":\"Click a row in the table above to see its event breakdown.\",\"style\":\"info\"},\"name\":\"h-attacks-info\",\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskAttacks | where TimeGenerated {TimeRange} | where isnotempty(AttackType) | summarize arg_max(TimeGenerated, *) by AttackType\\n| where AttackTypeName == '{selected_attack}'\\n| extend k = bag_keys(AttackTypeEvents) | mv-expand k to typeof(string)\\n| project ['EVENT TYPE'] = k, COUNT = toint(AttackTypeEvents[k])\\n| where isnotnull(COUNT)\\n| sort by COUNT desc\",\"size\":3,\"title\":\"Event Breakdown for {selected_attack}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"COUNT\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q18\",\"conditionalVisibilities\":[{\"comparison\":\"isNotEqualTo\",\"parameterName\":\"selected_attack\",\"value\":\"none\"}],\"conditionalVisibility\":{\"parameterName\":\"selected_attack\",\"comparison\":\"isNotEqualTo\",\"value\":\"none\"},\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":true,\"padding\":\"6px\"}}],\"exportParameters\":true},\"name\":\"group-attacks\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"8px\",\"showBorder\":false}},{\"type\":1,\"content\":{\"json\":\"_Refresh the page to load the latest collected snapshot._\"},\"name\":\"h-footer\",\"styleSettings\":{\"margin\":\"10px\",\"showBorder\":false}}],\"exportParameters\":true},\"name\":\"group-main\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"16px\",\"showBorder\":true}}],\"fromTemplateId\":\"b8d6e9a4-3c1f-4e7a-9f52-6a0d1c7e2b35\",\"name\":\"MimecastHumanRisk\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "version": "1.0", + "sourceId": "[variables('workspaceResourceId')]", + "category": "sentinel" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId6'),'/'))))]", + "properties": { + "description": "@{workbookKey=Mimecast_HumanRisk_Workbook; logoFileName=Mimecast.svg; description=A workbook providing insights into Mimecast Human Risk, including organization risk trends, behavior and attack metrics, and the individuals, departments and locations with the highest human risk.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Mimecast Human Risk Workbook; templateRelativePath=Mimecast_HumanRisk_Workbook.json; subtitle=; provider=Mimecast}.description", + "parentId": "[variables('workbookId6')]", + "contentId": "[variables('_workbookContentId6')]", + "kind": "Workbook", + "version": "[variables('workbookVersion6')]", + "source": { + "kind": "Solution", + "name": "Mimecast", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "MimecastHumanRisk_Organization_CL", + "kind": "DataType" + }, + { + "contentId": "MimecastHumanRisk_Behaviors_CL", + "kind": "DataType" + }, + { + "contentId": "MimecastHumanRisk_Attacks_CL", + "kind": "DataType" + }, + { + "contentId": "MimecastHumanRisk_Individuals_CL", + "kind": "DataType" + }, + { + "contentId": "MimecastHumanRiskCCF", + "kind": "DataConnector" + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId6')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook6-name')]", + "contentProductId": "[variables('_workbookcontentProductId6')]", + "id": "[variables('_workbookcontentProductId6')]", + "version": "[variables('workbookVersion6')]" + } + }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", @@ -2474,7 +2636,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast-Data-Connector-Trigger-Sync Playbook with template version 3.1.0", + "description": "Mimecast-Data-Connector-Trigger-Sync Playbook with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -3174,7 +3336,7 @@ "Timer", "Trigger" ], - "lastUpdateTime": "2025-10-31T18:02:32.739Z", + "lastUpdateTime": "2026-10-30T15:26:25.889Z", "releaseNotes": { "version": "1.0", "title": "[variables('blanks')]", @@ -3206,7 +3368,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_AT_Performane_Detail Data Parser with template version 3.1.0", + "description": "Mimecast_AT_Performane_Detail Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", @@ -3215,7 +3377,7 @@ "resources": [ { "name": "[variables('parserObject1')._parserName1]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { @@ -3280,7 +3442,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject1')._parserName1]", "location": "[parameters('workspace-location')]", "properties": { @@ -3338,7 +3500,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_AT_Safe_Score Data Parser with template version 3.1.0", + "description": "Mimecast_AT_Safe_Score Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject2').parserVersion2]", @@ -3347,7 +3509,7 @@ "resources": [ { "name": "[variables('parserObject2')._parserName2]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { @@ -3412,7 +3574,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject2')._parserName2]", "location": "[parameters('workspace-location')]", "properties": { @@ -3470,7 +3632,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_AT_User_Data Data Parser with template version 3.1.0", + "description": "Mimecast_AT_User_Data Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject3').parserVersion3]", @@ -3479,7 +3641,7 @@ "resources": [ { "name": "[variables('parserObject3')._parserName3]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { @@ -3544,7 +3706,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject3')._parserName3]", "location": "[parameters('workspace-location')]", "properties": { @@ -3602,7 +3764,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_AT_Watchlist Data Parser with template version 3.1.0", + "description": "Mimecast_AT_Watchlist Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject4').parserVersion4]", @@ -3611,7 +3773,7 @@ "resources": [ { "name": "[variables('parserObject4')._parserName4]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { @@ -3676,7 +3838,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject4')._parserName4]", "location": "[parameters('workspace-location')]", "properties": { @@ -3734,7 +3896,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_Audit Data Parser with template version 3.1.0", + "description": "Mimecast_Audit Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject5').parserVersion5]", @@ -3743,7 +3905,7 @@ "resources": [ { "name": "[variables('parserObject5')._parserName5]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { @@ -3808,7 +3970,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject5')._parserName5]", "location": "[parameters('workspace-location')]", "properties": { @@ -3866,7 +4028,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_Cloud_Integrated Data Parser with template version 3.1.0", + "description": "Mimecast_Cloud_Integrated Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject6').parserVersion6]", @@ -3875,7 +4037,7 @@ "resources": [ { "name": "[variables('parserObject6')._parserName6]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { @@ -3940,7 +4102,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject6')._parserName6]", "location": "[parameters('workspace-location')]", "properties": { @@ -3998,7 +4160,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_SEG_CG Data Parser with template version 3.1.0", + "description": "Mimecast_HumanRisk_Organization Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject7').parserVersion7]", @@ -4007,15 +4169,15 @@ "resources": [ { "name": "[variables('parserObject7')._parserName7]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast SEG Cloud Gateway", + "displayName": "Parser for Mimecast Human Risk Organization", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastCG", - "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet MimecastCG_view = view() {\nunion isfuzzy=true dummy_table,\nSeg_Cg_CL\n| extend \n [\"Time Generated\"] = column_ifexists(\"TimeGenerated\", \"\"),\n [\"Url Category\"] = column_ifexists(\"urlCategory\", \"\"),\n [\"Scan Results\"] = column_ifexists(\"scanResults\", \"\"),\n [\"File Name\"] = column_ifexists(\"fileName\", \"\"),\n [\"Sha256\"] = column_ifexists(\"sha256\", \"\"),\n [\"File Extension\"] = column_ifexists(\"fileExtension\", \"\"),\n [\"Virus Found\"] = column_ifexists(\"virusFound\", \"\"),\n [\"Sha1\"] = column_ifexists(\"sha1\", \"\"),\n [\"Sender Domain\"] = column_ifexists(\"senderDomain\", \"\"),\n [\"Md5\"] = column_ifexists(\"md5\", \"\"),\n [\"Custom Threat Dictionary\"] = column_ifexists(\"customThreatDictionary\", \"\"),\n [\"Items Detected\"] = column_ifexists(\"itemsDetected\", \"\"),\n [\"Similar Custom External Domain\"] = column_ifexists(\"similarCustomExternalDomain\", \"\"),\n [\"Tagged External\"] = column_ifexists(\"taggedExternal\", \"\"),\n [\"Similar Internal Domain\"] = column_ifexists(\"similarInternalDomain\", \"\"),\n [\"New Domain\"] = column_ifexists(\"newDomain\", \"\"),\n [\"Internal User Name\"] = column_ifexists(\"internalUserName\", \"\"),\n [\"Mimecast Threat Dictionary\"] = column_ifexists(\"mimecastThreatDictionary\", \"\"),\n [\"Similar Mimecast External Domain\"] = column_ifexists(\"similarMimecastExternalDomain\", \"\"),\n [\"Custom Name Match\"] = column_ifexists(\"customNameMatch\", \"\"),\n [\"Tagged Malicious\"] = column_ifexists(\"taggedMalicious\", \"\"),\n [\"Reply Mismatch\"] = column_ifexists(\"replyMismatch\", \"\"),\n [\"Aggregate ID S\"] = column_ifexists(\"aggregateId\", \"\"),\n [\"Aggregate ID G\"] = column_ifexists(\"aggregateId\", \"\"),\n [\"Rejection Type\"] = column_ifexists(\"rejectionType\", \"\"),\n [\"Rejection Code\"] = column_ifexists(\"rejectionCode\", \"\"),\n [\"Rejection Info\"] = column_ifexists(\"rejectionInfo\", \"\"),\n [\"Delivered\"] = column_ifexists(\"delivered\", \"\"),\n [\"Destination IP\"] = column_ifexists(\"destinationIp\", \"\"),\n [\"Host Name\"] = column_ifexists(\"Hostname\", \"\"),\n [\"Delivery Attempts\"] = column_ifexists(\"deliveryAttempts\", \"\"),\n [\"TLS Used\"] = column_ifexists(\"tlsUsed\", \"\"),\n [\"Delivery Errors\"] = column_ifexists(\"deliveryErrors\", \"\"),\n [\"Attachments\"] = column_ifexists(\"attachments\", \"\"),\n [\"Route\"] = column_ifexists(\"route\", \"\"),\n [\"Processing ID\"] = column_ifexists(\"processingId\", \"\"),\n [\"Account ID\"] = column_ifexists(\"accountId\", \"\"),\n [\"Action\"] = column_ifexists(\"action\", \"\"),\n [\"Event Time\"] = column_ifexists(\"timestamp\", \"\"),\n [\"Sender Envelope\"] = column_ifexists(\"senderEnvelope\", \"\"),\n [\"Message ID\"] = column_ifexists(\"messageId\", \"\"),\n [\"Subject\"] = column_ifexists(\"subject\", \"\"),\n [\"Total of Size Attachments\"] = column_ifexists(\"totalSizeAttachments\", \"\"),\n [\"Number of Attachments\"] = column_ifexists(\"numberAttachments\", \"\"),\n [\"Email Size\"] = column_ifexists(\"emailSize\", \"\"),\n [\"Type\"] = column_ifexists(\"Logtype\", \"\"),\n [\"Sub Type\"] = column_ifexists(\"subtype\", \"\"),\n [\"Monitored Domain Source\"] = column_ifexists(\"monitoredDomainSource\", \"\"),\n [\"Similar Domain\"] = column_ifexists(\"similarDomain\", \"\"),\n [\"Offset\"] = column_ifexists(\"offset\", \"\"),\n [\"Partition\"] = column_ifexists(\"partition\", \"\"),\n [\"Hold Reason\"] = column_ifexists(\"holdReason\", \"\"),\n [\"Recipients\"] = column_ifexists(\"recipients\", \"\"),\n [\"Sender IP\"] = column_ifexists(\"senderIp\", \"\"),\n [\"Direction\"] = column_ifexists(\"direction\", \"\"),\n [\"Sender Header\"] = column_ifexists(\"senderHeader\", \"\"),\n [\"TLS Version\"] = column_ifexists(\"tlsVersion\", \"\"),\n [\"TLS Cipher\"] = column_ifexists(\"tlsCipher\", \"\"),\n [\"Spam Info\"] = column_ifexists(\"spamInfo\", \"\"),\n [\"Spam Processing Detail\"] = column_ifexists(\"spamProcessingDetail\", \"\")\n| summarize arg_max([\"Time Generated\"], *) by \n [\"Url Category\"],\n [\"Scan Results\"],\n [\"File Name\"],\n [\"Sha256\"],\n [\"File Extension\"],\n [\"Virus Found\"],\n [\"Sha1\"],\n [\"Sender Domain\"],\n [\"Md5\"],\n [\"Custom Threat Dictionary\"],\n [\"Items Detected\"],\n [\"Similar Custom External Domain\"],\n [\"Tagged External\"],\n [\"Similar Internal Domain\"],\n [\"New Domain\"],\n [\"Internal User Name\"],\n [\"Mimecast Threat Dictionary\"],\n [\"Similar Mimecast External Domain\"],\n [\"Custom Name Match\"],\n [\"Tagged Malicious\"],\n [\"Reply Mismatch\"],\n [\"Aggregate ID\"] = coalesce([\"Aggregate ID S\"], [\"Aggregate ID G\"]),\n [\"Rejection Type\"],\n [\"Rejection Code\"],\n [\"Rejection Info\"],\n [\"Delivered\"],\n [\"Destination IP\"],\n [\"Host Name\"],\n [\"Delivery Attempts\"],\n [\"TLS Used\"],\n [\"Delivery Errors\"],\n [\"Attachments\"],\n [\"Route\"],\n [\"Processing ID\"],\n [\"Account ID\"],\n [\"Action\"],\n [\"Event Time\"],\n [\"Sender Envelope\"],\n [\"Message ID\"],\n [\"Subject\"],\n [\"Total of Size Attachments\"],\n [\"Number of Attachments\"],\n [\"Email Size\"],\n [\"Type\"],\n [\"Sub Type\"],\n [\"Monitored Domain Source\"],\n [\"Similar Domain\"],\n [\"Hold Reason\"],\n [\"Recipients\"],\n [\"Sender IP\"],\n [\"Direction\"],\n [\"Sender Header\"],\n [\"TLS Version\"],\n [\"TLS Cipher\"],\n [\"Spam Info\"],\n [\"Spam Processing Detail\"]\n| extend ['Event Time'] = iff( isempty( ['Event Time']) ,now() , todatetime(unixtime_milliseconds_todatetime( tolong([\"Event Time\"]) )) )\n| extend ['Message ID'] = trim(@\"[\\<\\>]\", ['Message ID'] )\n| project \n [\"Time Generated\"],\n [\"Url Category\"],\n [\"Scan Results\"],\n [\"File Name\"],\n [\"Sha256\"],\n [\"File Extension\"],\n [\"Virus Found\"],\n [\"Sha1\"],\n [\"Sender Domain\"],\n [\"Md5\"],\n [\"Custom Threat Dictionary\"],\n [\"Items Detected\"],\n [\"Similar Custom External Domain\"],\n [\"Tagged External\"],\n [\"Similar Internal Domain\"],\n [\"New Domain\"],\n [\"Internal User Name\"],\n [\"Mimecast Threat Dictionary\"],\n [\"Similar Mimecast External Domain\"],\n [\"Custom Name Match\"],\n [\"Tagged Malicious\"],\n [\"Reply Mismatch\"],\n [\"Aggregate ID\"] = coalesce([\"Aggregate ID S\"], [\"Aggregate ID G\"]),\n [\"Rejection Type\"],\n [\"Rejection Code\"],\n [\"Rejection Info\"],\n [\"Delivered\"],\n [\"Destination IP\"],\n [\"Host Name\"],\n [\"Delivery Attempts\"],\n [\"TLS Used\"],\n [\"Delivery Errors\"],\n [\"Attachments\"],\n [\"Route\"],\n [\"Processing ID\"],\n [\"Account ID\"],\n [\"Action\"],\n [\"Event Time\"] ,\n [\"Sender Envelope\"],\n [\"Message ID\"],\n [\"Subject\"],\n [\"Total of Size Attachments\"],\n [\"Number of Attachments\"],\n [\"Email Size\"],\n [\"Type\"],\n [\"Sub Type\"],\n [\"Monitored Domain Source\"],\n [\"Similar Domain\"],\n [\"Offset\"],\n [\"Partition\"],\n [\"Hold Reason\"],\n [\"Recipients\"],\n [\"Sender IP\"],\n [\"Direction\"],\n [\"Sender Header\"],\n [\"TLS Version\"],\n [\"TLS Cipher\"],\n [\"Spam Info\"],\n [\"Spam Processing Detail\"]\n};\nMimecastCG_view\n", + "functionAlias": "MimecastHumanRiskOrganization", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') };\nlet MimecastHumanRiskOrganization_view = view() {\nunion isfuzzy=true\n dummy_table,\n MimecastHumanRisk_Organization_CL\n| extend\n Month = tostring(column_ifexists('Month', '')),\n HumanRiskScore = toint(column_ifexists('HumanRiskScore', int(null))),\n HumanRiskFactor = tostring(column_ifexists('HumanRiskFactor', '')),\n HumanRiskScoreTrend = toint(column_ifexists('HumanRiskScoreTrend', int(null))),\n AttackScore = toint(column_ifexists('AttackScore', int(null))),\n AttackFactor = tostring(column_ifexists('AttackFactor', '')),\n AttackTrend = toint(column_ifexists('AttackTrend', int(null))),\n AttackTotal = toint(column_ifexists('AttackTotal', int(null))),\n RiskResponses = toint(column_ifexists('RiskResponses', int(null))),\n TotalActions = toint(column_ifexists('TotalActions', int(null))),\n Notifications = toint(column_ifexists('Notifications', int(null))),\n OutboundActions = toint(column_ifexists('OutboundActions', int(null))),\n GroupChanges = toint(column_ifexists('GroupChanges', int(null)))\n| extend\n RecordType = iff(isempty(Month), 'Totals', 'Monthly'),\n MonthStart = todatetime(strcat(Month, '-01')),\n HumanRiskFactorLabel = FactorLabel(HumanRiskFactor),\n AttackFactorLabel = FactorLabel(AttackFactor)\n| project\n TimeGenerated,\n RecordType,\n Month,\n MonthStart,\n HumanRiskScore,\n HumanRiskFactor,\n HumanRiskScoreTrend,\n AttackScore,\n AttackFactor,\n AttackTrend,\n AttackTotal,\n RiskResponses,\n TotalActions,\n Notifications,\n OutboundActions,\n GroupChanges,\n HumanRiskFactorLabel,\n AttackFactorLabel\n};\nMimecastHumanRiskOrganization_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4034,7 +4196,7 @@ "[variables('parserObject7')._parserId7]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastCG')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskOrganization')]", "contentId": "[variables('parserObject7').parserContentId7]", "kind": "Parser", "version": "[variables('parserObject7').parserVersion7]", @@ -4064,23 +4226,23 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('parserObject7').parserContentId7]", "contentKind": "Parser", - "displayName": "Parser for Mimecast SEG Cloud Gateway", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject7').parserContentId7,'-', '1.0.1')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject7').parserContentId7,'-', '1.0.1')))]", + "displayName": "Parser for Mimecast Human Risk Organization", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject7').parserContentId7,'-', '1.1.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject7').parserContentId7,'-', '1.1.0')))]", "version": "[variables('parserObject7').parserVersion7]" } }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject7')._parserName7]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast SEG Cloud Gateway", + "displayName": "Parser for Mimecast Human Risk Organization", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastCG", - "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet MimecastCG_view = view() {\nunion isfuzzy=true dummy_table,\nSeg_Cg_CL\n| extend \n [\"Time Generated\"] = column_ifexists(\"TimeGenerated\", \"\"),\n [\"Url Category\"] = column_ifexists(\"urlCategory\", \"\"),\n [\"Scan Results\"] = column_ifexists(\"scanResults\", \"\"),\n [\"File Name\"] = column_ifexists(\"fileName\", \"\"),\n [\"Sha256\"] = column_ifexists(\"sha256\", \"\"),\n [\"File Extension\"] = column_ifexists(\"fileExtension\", \"\"),\n [\"Virus Found\"] = column_ifexists(\"virusFound\", \"\"),\n [\"Sha1\"] = column_ifexists(\"sha1\", \"\"),\n [\"Sender Domain\"] = column_ifexists(\"senderDomain\", \"\"),\n [\"Md5\"] = column_ifexists(\"md5\", \"\"),\n [\"Custom Threat Dictionary\"] = column_ifexists(\"customThreatDictionary\", \"\"),\n [\"Items Detected\"] = column_ifexists(\"itemsDetected\", \"\"),\n [\"Similar Custom External Domain\"] = column_ifexists(\"similarCustomExternalDomain\", \"\"),\n [\"Tagged External\"] = column_ifexists(\"taggedExternal\", \"\"),\n [\"Similar Internal Domain\"] = column_ifexists(\"similarInternalDomain\", \"\"),\n [\"New Domain\"] = column_ifexists(\"newDomain\", \"\"),\n [\"Internal User Name\"] = column_ifexists(\"internalUserName\", \"\"),\n [\"Mimecast Threat Dictionary\"] = column_ifexists(\"mimecastThreatDictionary\", \"\"),\n [\"Similar Mimecast External Domain\"] = column_ifexists(\"similarMimecastExternalDomain\", \"\"),\n [\"Custom Name Match\"] = column_ifexists(\"customNameMatch\", \"\"),\n [\"Tagged Malicious\"] = column_ifexists(\"taggedMalicious\", \"\"),\n [\"Reply Mismatch\"] = column_ifexists(\"replyMismatch\", \"\"),\n [\"Aggregate ID S\"] = column_ifexists(\"aggregateId\", \"\"),\n [\"Aggregate ID G\"] = column_ifexists(\"aggregateId\", \"\"),\n [\"Rejection Type\"] = column_ifexists(\"rejectionType\", \"\"),\n [\"Rejection Code\"] = column_ifexists(\"rejectionCode\", \"\"),\n [\"Rejection Info\"] = column_ifexists(\"rejectionInfo\", \"\"),\n [\"Delivered\"] = column_ifexists(\"delivered\", \"\"),\n [\"Destination IP\"] = column_ifexists(\"destinationIp\", \"\"),\n [\"Host Name\"] = column_ifexists(\"Hostname\", \"\"),\n [\"Delivery Attempts\"] = column_ifexists(\"deliveryAttempts\", \"\"),\n [\"TLS Used\"] = column_ifexists(\"tlsUsed\", \"\"),\n [\"Delivery Errors\"] = column_ifexists(\"deliveryErrors\", \"\"),\n [\"Attachments\"] = column_ifexists(\"attachments\", \"\"),\n [\"Route\"] = column_ifexists(\"route\", \"\"),\n [\"Processing ID\"] = column_ifexists(\"processingId\", \"\"),\n [\"Account ID\"] = column_ifexists(\"accountId\", \"\"),\n [\"Action\"] = column_ifexists(\"action\", \"\"),\n [\"Event Time\"] = column_ifexists(\"timestamp\", \"\"),\n [\"Sender Envelope\"] = column_ifexists(\"senderEnvelope\", \"\"),\n [\"Message ID\"] = column_ifexists(\"messageId\", \"\"),\n [\"Subject\"] = column_ifexists(\"subject\", \"\"),\n [\"Total of Size Attachments\"] = column_ifexists(\"totalSizeAttachments\", \"\"),\n [\"Number of Attachments\"] = column_ifexists(\"numberAttachments\", \"\"),\n [\"Email Size\"] = column_ifexists(\"emailSize\", \"\"),\n [\"Type\"] = column_ifexists(\"Logtype\", \"\"),\n [\"Sub Type\"] = column_ifexists(\"subtype\", \"\"),\n [\"Monitored Domain Source\"] = column_ifexists(\"monitoredDomainSource\", \"\"),\n [\"Similar Domain\"] = column_ifexists(\"similarDomain\", \"\"),\n [\"Offset\"] = column_ifexists(\"offset\", \"\"),\n [\"Partition\"] = column_ifexists(\"partition\", \"\"),\n [\"Hold Reason\"] = column_ifexists(\"holdReason\", \"\"),\n [\"Recipients\"] = column_ifexists(\"recipients\", \"\"),\n [\"Sender IP\"] = column_ifexists(\"senderIp\", \"\"),\n [\"Direction\"] = column_ifexists(\"direction\", \"\"),\n [\"Sender Header\"] = column_ifexists(\"senderHeader\", \"\"),\n [\"TLS Version\"] = column_ifexists(\"tlsVersion\", \"\"),\n [\"TLS Cipher\"] = column_ifexists(\"tlsCipher\", \"\"),\n [\"Spam Info\"] = column_ifexists(\"spamInfo\", \"\"),\n [\"Spam Processing Detail\"] = column_ifexists(\"spamProcessingDetail\", \"\")\n| summarize arg_max([\"Time Generated\"], *) by \n [\"Url Category\"],\n [\"Scan Results\"],\n [\"File Name\"],\n [\"Sha256\"],\n [\"File Extension\"],\n [\"Virus Found\"],\n [\"Sha1\"],\n [\"Sender Domain\"],\n [\"Md5\"],\n [\"Custom Threat Dictionary\"],\n [\"Items Detected\"],\n [\"Similar Custom External Domain\"],\n [\"Tagged External\"],\n [\"Similar Internal Domain\"],\n [\"New Domain\"],\n [\"Internal User Name\"],\n [\"Mimecast Threat Dictionary\"],\n [\"Similar Mimecast External Domain\"],\n [\"Custom Name Match\"],\n [\"Tagged Malicious\"],\n [\"Reply Mismatch\"],\n [\"Aggregate ID\"] = coalesce([\"Aggregate ID S\"], [\"Aggregate ID G\"]),\n [\"Rejection Type\"],\n [\"Rejection Code\"],\n [\"Rejection Info\"],\n [\"Delivered\"],\n [\"Destination IP\"],\n [\"Host Name\"],\n [\"Delivery Attempts\"],\n [\"TLS Used\"],\n [\"Delivery Errors\"],\n [\"Attachments\"],\n [\"Route\"],\n [\"Processing ID\"],\n [\"Account ID\"],\n [\"Action\"],\n [\"Event Time\"],\n [\"Sender Envelope\"],\n [\"Message ID\"],\n [\"Subject\"],\n [\"Total of Size Attachments\"],\n [\"Number of Attachments\"],\n [\"Email Size\"],\n [\"Type\"],\n [\"Sub Type\"],\n [\"Monitored Domain Source\"],\n [\"Similar Domain\"],\n [\"Hold Reason\"],\n [\"Recipients\"],\n [\"Sender IP\"],\n [\"Direction\"],\n [\"Sender Header\"],\n [\"TLS Version\"],\n [\"TLS Cipher\"],\n [\"Spam Info\"],\n [\"Spam Processing Detail\"]\n| extend ['Event Time'] = iff( isempty( ['Event Time']) ,now() , todatetime(unixtime_milliseconds_todatetime( tolong([\"Event Time\"]) )) )\n| extend ['Message ID'] = trim(@\"[\\<\\>]\", ['Message ID'] )\n| project \n [\"Time Generated\"],\n [\"Url Category\"],\n [\"Scan Results\"],\n [\"File Name\"],\n [\"Sha256\"],\n [\"File Extension\"],\n [\"Virus Found\"],\n [\"Sha1\"],\n [\"Sender Domain\"],\n [\"Md5\"],\n [\"Custom Threat Dictionary\"],\n [\"Items Detected\"],\n [\"Similar Custom External Domain\"],\n [\"Tagged External\"],\n [\"Similar Internal Domain\"],\n [\"New Domain\"],\n [\"Internal User Name\"],\n [\"Mimecast Threat Dictionary\"],\n [\"Similar Mimecast External Domain\"],\n [\"Custom Name Match\"],\n [\"Tagged Malicious\"],\n [\"Reply Mismatch\"],\n [\"Aggregate ID\"] = coalesce([\"Aggregate ID S\"], [\"Aggregate ID G\"]),\n [\"Rejection Type\"],\n [\"Rejection Code\"],\n [\"Rejection Info\"],\n [\"Delivered\"],\n [\"Destination IP\"],\n [\"Host Name\"],\n [\"Delivery Attempts\"],\n [\"TLS Used\"],\n [\"Delivery Errors\"],\n [\"Attachments\"],\n [\"Route\"],\n [\"Processing ID\"],\n [\"Account ID\"],\n [\"Action\"],\n [\"Event Time\"] ,\n [\"Sender Envelope\"],\n [\"Message ID\"],\n [\"Subject\"],\n [\"Total of Size Attachments\"],\n [\"Number of Attachments\"],\n [\"Email Size\"],\n [\"Type\"],\n [\"Sub Type\"],\n [\"Monitored Domain Source\"],\n [\"Similar Domain\"],\n [\"Offset\"],\n [\"Partition\"],\n [\"Hold Reason\"],\n [\"Recipients\"],\n [\"Sender IP\"],\n [\"Direction\"],\n [\"Sender Header\"],\n [\"TLS Version\"],\n [\"TLS Cipher\"],\n [\"Spam Info\"],\n [\"Spam Processing Detail\"]\n};\nMimecastCG_view\n", + "functionAlias": "MimecastHumanRiskOrganization", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') };\nlet MimecastHumanRiskOrganization_view = view() {\nunion isfuzzy=true\n dummy_table,\n MimecastHumanRisk_Organization_CL\n| extend\n Month = tostring(column_ifexists('Month', '')),\n HumanRiskScore = toint(column_ifexists('HumanRiskScore', int(null))),\n HumanRiskFactor = tostring(column_ifexists('HumanRiskFactor', '')),\n HumanRiskScoreTrend = toint(column_ifexists('HumanRiskScoreTrend', int(null))),\n AttackScore = toint(column_ifexists('AttackScore', int(null))),\n AttackFactor = tostring(column_ifexists('AttackFactor', '')),\n AttackTrend = toint(column_ifexists('AttackTrend', int(null))),\n AttackTotal = toint(column_ifexists('AttackTotal', int(null))),\n RiskResponses = toint(column_ifexists('RiskResponses', int(null))),\n TotalActions = toint(column_ifexists('TotalActions', int(null))),\n Notifications = toint(column_ifexists('Notifications', int(null))),\n OutboundActions = toint(column_ifexists('OutboundActions', int(null))),\n GroupChanges = toint(column_ifexists('GroupChanges', int(null)))\n| extend\n RecordType = iff(isempty(Month), 'Totals', 'Monthly'),\n MonthStart = todatetime(strcat(Month, '-01')),\n HumanRiskFactorLabel = FactorLabel(HumanRiskFactor),\n AttackFactorLabel = FactorLabel(AttackFactor)\n| project\n TimeGenerated,\n RecordType,\n Month,\n MonthStart,\n HumanRiskScore,\n HumanRiskFactor,\n HumanRiskScoreTrend,\n AttackScore,\n AttackFactor,\n AttackTrend,\n AttackTotal,\n RiskResponses,\n TotalActions,\n Notifications,\n OutboundActions,\n GroupChanges,\n HumanRiskFactorLabel,\n AttackFactorLabel\n};\nMimecastHumanRiskOrganization_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4100,7 +4262,7 @@ "[variables('parserObject7')._parserId7]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastCG')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskOrganization')]", "contentId": "[variables('parserObject7').parserContentId7]", "kind": "Parser", "version": "[variables('parserObject7').parserVersion7]", @@ -4130,7 +4292,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_SEG_DLP Data Parser with template version 3.1.0", + "description": "Mimecast_HumanRisk_Behaviors Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject8').parserVersion8]", @@ -4139,15 +4301,15 @@ "resources": [ { "name": "[variables('parserObject8')._parserName8]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast SEG Data Leak Prevention", + "displayName": "Parser for Mimecast Human Risk Behaviors", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastDLP", - "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet MimecastSEG_view = view() {\nunion isfuzzy=true dummy_table,\nSeg_Dlp_CL\n| extend [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Event Time\"] = column_ifexists('eventTime', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Policy\"] = column_ifexists('policy', ''),\n [\"Action\"] = column_ifexists('action', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Time Generated\"] = column_ifexists('TimeGenerated', '')\n| summarize arg_max(TimeGenerated, *) by [\"Sender Address\"], [\"Recipient Address\"], [\"Subject\"], [\"Route\"], [\"Policy\"], [\"Action\"], [\"Event Time\"], [\"Message ID\"]\n| extend ['Event Time'] = iff( isempty( ['Event Time']) ,now() , todatetime( tolong([\"Event Time\"]) ) )\n| project [\"Time Generated\"], [\"Sender Address\"], [\"Recipient Address\"], [\"Subject\"], [\"Route\"], [\"Policy\"], [\"Action\"], [\"Event Time\"], [\"Message ID\"]\n};\nMimecastSEG_view\n", + "functionAlias": "MimecastHumanRiskBehaviors", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') };\nlet MimecastHumanRiskBehaviors_view = view() {\nunion isfuzzy=true\n dummy_table,\n MimecastHumanRisk_Behaviors_CL\n| extend\n BehaviorType = tostring(column_ifexists('BehaviorType', '')),\n Score = toint(column_ifexists('Score', int(null))),\n Factor = tostring(column_ifexists('Factor', '')),\n EventCount = toint(column_ifexists('EventCount', int(null))),\n Trend = toint(column_ifexists('Trend', int(null))),\n Events = todynamic(column_ifexists('Events', dynamic(null)))\n| extend\n BehaviorName = case(BehaviorType == 'training', 'Training', BehaviorType == 'simulatedPhishing', 'Simulated Phishing', BehaviorType == 'actualPhishing', 'Actual Phishing', BehaviorType == 'malware', 'Malware', BehaviorType == 'sensitiveDataHandling', 'Sensitive Data Handling', BehaviorType),\n FactorLabel = FactorLabel(Factor),\n EventAssigned = toint(Events.assigned),\n EventCompleted = toint(Events.completed),\n EventOverdue = toint(Events.overdue),\n EventDelivered = toint(Events.delivered),\n EventOpened = toint(Events.opened),\n EventClicked = toint(Events.clicked),\n EventReported = toint(Events.reported),\n EventSubmittedData = toint(Events.submittedData),\n EventAttachmentOpened = toint(Events.attachmentOpened),\n EventBlocked = toint(Events.blocked),\n EventRemediated = toint(Events.remediated),\n EventFalsePositiveRemediated = toint(Events.falsePositiveRemediated),\n EventAttachmentDownloaded = toint(Events.attachmentDownloaded),\n EventDownloadAttempted = toint(Events.downloadAttempted),\n EventDownloaded = toint(Events.downloaded),\n EventExecuted = toint(Events.executed),\n EventUnknown = toint(Events.unknown),\n EventProperlyHandled = toint(Events.properlyHandled),\n EventImproperlyHandled = toint(Events.improperlyHandled)\n| project\n TimeGenerated,\n BehaviorType,\n BehaviorName,\n Score,\n Factor,\n FactorLabel,\n EventCount,\n Trend,\n Events,\n EventAssigned,\n EventCompleted,\n EventOverdue,\n EventDelivered,\n EventOpened,\n EventClicked,\n EventReported,\n EventSubmittedData,\n EventAttachmentOpened,\n EventBlocked,\n EventRemediated,\n EventFalsePositiveRemediated,\n EventAttachmentDownloaded,\n EventDownloadAttempted,\n EventDownloaded,\n EventExecuted,\n EventUnknown,\n EventProperlyHandled,\n EventImproperlyHandled\n};\nMimecastHumanRiskBehaviors_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4166,7 +4328,7 @@ "[variables('parserObject8')._parserId8]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastDLP')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskBehaviors')]", "contentId": "[variables('parserObject8').parserContentId8]", "kind": "Parser", "version": "[variables('parserObject8').parserVersion8]", @@ -4196,23 +4358,23 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('parserObject8').parserContentId8]", "contentKind": "Parser", - "displayName": "Parser for Mimecast SEG Data Leak Prevention", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject8').parserContentId8,'-', '1.0.1')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject8').parserContentId8,'-', '1.0.1')))]", + "displayName": "Parser for Mimecast Human Risk Behaviors", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject8').parserContentId8,'-', '1.1.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject8').parserContentId8,'-', '1.1.0')))]", "version": "[variables('parserObject8').parserVersion8]" } }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject8')._parserName8]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast SEG Data Leak Prevention", + "displayName": "Parser for Mimecast Human Risk Behaviors", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastDLP", - "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet MimecastSEG_view = view() {\nunion isfuzzy=true dummy_table,\nSeg_Dlp_CL\n| extend [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Event Time\"] = column_ifexists('eventTime', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Policy\"] = column_ifexists('policy', ''),\n [\"Action\"] = column_ifexists('action', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Time Generated\"] = column_ifexists('TimeGenerated', '')\n| summarize arg_max(TimeGenerated, *) by [\"Sender Address\"], [\"Recipient Address\"], [\"Subject\"], [\"Route\"], [\"Policy\"], [\"Action\"], [\"Event Time\"], [\"Message ID\"]\n| extend ['Event Time'] = iff( isempty( ['Event Time']) ,now() , todatetime( tolong([\"Event Time\"]) ) )\n| project [\"Time Generated\"], [\"Sender Address\"], [\"Recipient Address\"], [\"Subject\"], [\"Route\"], [\"Policy\"], [\"Action\"], [\"Event Time\"], [\"Message ID\"]\n};\nMimecastSEG_view\n", + "functionAlias": "MimecastHumanRiskBehaviors", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') };\nlet MimecastHumanRiskBehaviors_view = view() {\nunion isfuzzy=true\n dummy_table,\n MimecastHumanRisk_Behaviors_CL\n| extend\n BehaviorType = tostring(column_ifexists('BehaviorType', '')),\n Score = toint(column_ifexists('Score', int(null))),\n Factor = tostring(column_ifexists('Factor', '')),\n EventCount = toint(column_ifexists('EventCount', int(null))),\n Trend = toint(column_ifexists('Trend', int(null))),\n Events = todynamic(column_ifexists('Events', dynamic(null)))\n| extend\n BehaviorName = case(BehaviorType == 'training', 'Training', BehaviorType == 'simulatedPhishing', 'Simulated Phishing', BehaviorType == 'actualPhishing', 'Actual Phishing', BehaviorType == 'malware', 'Malware', BehaviorType == 'sensitiveDataHandling', 'Sensitive Data Handling', BehaviorType),\n FactorLabel = FactorLabel(Factor),\n EventAssigned = toint(Events.assigned),\n EventCompleted = toint(Events.completed),\n EventOverdue = toint(Events.overdue),\n EventDelivered = toint(Events.delivered),\n EventOpened = toint(Events.opened),\n EventClicked = toint(Events.clicked),\n EventReported = toint(Events.reported),\n EventSubmittedData = toint(Events.submittedData),\n EventAttachmentOpened = toint(Events.attachmentOpened),\n EventBlocked = toint(Events.blocked),\n EventRemediated = toint(Events.remediated),\n EventFalsePositiveRemediated = toint(Events.falsePositiveRemediated),\n EventAttachmentDownloaded = toint(Events.attachmentDownloaded),\n EventDownloadAttempted = toint(Events.downloadAttempted),\n EventDownloaded = toint(Events.downloaded),\n EventExecuted = toint(Events.executed),\n EventUnknown = toint(Events.unknown),\n EventProperlyHandled = toint(Events.properlyHandled),\n EventImproperlyHandled = toint(Events.improperlyHandled)\n| project\n TimeGenerated,\n BehaviorType,\n BehaviorName,\n Score,\n Factor,\n FactorLabel,\n EventCount,\n Trend,\n Events,\n EventAssigned,\n EventCompleted,\n EventOverdue,\n EventDelivered,\n EventOpened,\n EventClicked,\n EventReported,\n EventSubmittedData,\n EventAttachmentOpened,\n EventBlocked,\n EventRemediated,\n EventFalsePositiveRemediated,\n EventAttachmentDownloaded,\n EventDownloadAttempted,\n EventDownloaded,\n EventExecuted,\n EventUnknown,\n EventProperlyHandled,\n EventImproperlyHandled\n};\nMimecastHumanRiskBehaviors_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4232,7 +4394,7 @@ "[variables('parserObject8')._parserId8]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastDLP')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskBehaviors')]", "contentId": "[variables('parserObject8').parserContentId8]", "kind": "Parser", "version": "[variables('parserObject8').parserVersion8]", @@ -4262,7 +4424,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_TTP_Attachment Data Parser with template version 3.1.0", + "description": "Mimecast_HumanRisk_Attacks Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject9').parserVersion9]", @@ -4271,15 +4433,15 @@ "resources": [ { "name": "[variables('parserObject9')._parserName9]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast TTP ATTACHMENT", + "displayName": "Parser for Mimecast Human Risk Attacks", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastTTPAttachment", - "query": "let dummy_table = datatable(\n TimeGenerated: datetime,\n senderAddress: string,\n recipientAddress: string,\n messageId: string\n) [];\nlet MimecastTTPAttachment = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Attachment_CL\n | summarize arg_max(TimeGenerated, *) by senderAddress, recipientAddress, messageId\n | extend\n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Mimecast Event ID\"] = 'ttp_attachment',\n [\"Mimecast Event Category\"] = 'ttp_attachment',\n [\"Action Triggered\"] = column_ifexists('actionTriggered', ''),\n [\"Event Time\"] = column_ifexists('Date', ''),\n [\"Definition\"] = column_ifexists('definition', ''),\n [\"Details\"] = column_ifexists('details', ''),\n [\"File Hash\"] = column_ifexists('fileHash', ''),\n [\"File Name\"] = column_ifexists('fileName', ''),\n [\"File Type\"] = column_ifexists('fileType', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Result\"] = column_ifexists('result', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Subject\"] = column_ifexists('subject', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Time Generated\"],\n [\"Type\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"Action Triggered\"],\n [\"Event Time\"],\n [\"Definition\"],\n [\"Details\"],\n [\"File Hash\"],\n [\"File Name\"],\n [\"File Type\"],\n [\"Message ID\"],\n [\"Recipient Address\"],\n [\"Result\"],\n [\"Route\"],\n [\"Sender Address\"],\n [\"Subject\"] \n};\nMimecastTTPAttachment\n", + "functionAlias": "MimecastHumanRiskAttacks", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') };\nlet MimecastHumanRiskAttacks_view = view() {\nunion isfuzzy=true\n dummy_table,\n MimecastHumanRisk_Attacks_CL\n| extend\n AttackScore = toint(column_ifexists('AttackScore', int(null))),\n AttackFactor = tostring(column_ifexists('AttackFactor', '')),\n AttackTypes = todynamic(column_ifexists('AttackTypes', dynamic(null)))\n| extend AttackTypesRaw = iff(gettype(AttackTypes) != 'array' or array_length(AttackTypes) == 0, dynamic([{}]), AttackTypes)\n| mv-expand AttackTypeItem = AttackTypesRaw\n| extend\n AttackFactorLabel = FactorLabel(AttackFactor),\n AttackType = tostring(AttackTypeItem.type),\n AttackTypeTotal = toint(AttackTypeItem.attackTotal),\n AttackTypeScore = toint(AttackTypeItem.attackScore),\n AttackTypeFactor = tostring(AttackTypeItem.attackFactor),\n AttackTypeTrend = toint(AttackTypeItem.trend),\n AttackTypeEvents = AttackTypeItem.events,\n EventDelivered = toint(AttackTypeItem.events.delivered),\n EventBlocked = toint(AttackTypeItem.events.blocked),\n EventRemediated = toint(AttackTypeItem.events.remediated),\n EventDownloadAttempted = toint(AttackTypeItem.events.downloadAttempted),\n EventDownloaded = toint(AttackTypeItem.events.downloaded),\n EventExecuted = toint(AttackTypeItem.events.executed),\n EventUnknown = toint(AttackTypeItem.events.unknown),\n EventAnomalous = toint(AttackTypeItem.events.anomalous),\n EventSuspicious = toint(AttackTypeItem.events.suspicious),\n EventMalicious = toint(AttackTypeItem.events.malicious),\n EventReported = toint(AttackTypeItem.events.reported)\n| extend\n AttackTypeName = case(AttackType == 'actualPhishing', 'Actual Phishing', AttackType == 'malware', 'Malware', AttackType == 'identity', 'Identity', AttackType),\n AttackTypeFactorLabel = FactorLabel(AttackTypeFactor)\n| project\n TimeGenerated,\n AttackScore,\n AttackFactor,\n AttackFactorLabel,\n AttackType,\n AttackTypeName,\n AttackTypeTotal,\n AttackTypeScore,\n AttackTypeFactor,\n AttackTypeFactorLabel,\n AttackTypeTrend,\n AttackTypeEvents,\n EventDelivered,\n EventBlocked,\n EventRemediated,\n EventDownloadAttempted,\n EventDownloaded,\n EventExecuted,\n EventUnknown,\n EventAnomalous,\n EventSuspicious,\n EventMalicious,\n EventReported,\n AttackTypes\n};\nMimecastHumanRiskAttacks_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4298,7 +4460,7 @@ "[variables('parserObject9')._parserId9]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPAttachment')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskAttacks')]", "contentId": "[variables('parserObject9').parserContentId9]", "kind": "Parser", "version": "[variables('parserObject9').parserVersion9]", @@ -4328,23 +4490,23 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('parserObject9').parserContentId9]", "contentKind": "Parser", - "displayName": "Parser for Mimecast TTP ATTACHMENT", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject9').parserContentId9,'-', '1.0.1')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject9').parserContentId9,'-', '1.0.1')))]", + "displayName": "Parser for Mimecast Human Risk Attacks", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject9').parserContentId9,'-', '1.1.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject9').parserContentId9,'-', '1.1.0')))]", "version": "[variables('parserObject9').parserVersion9]" } }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject9')._parserName9]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast TTP ATTACHMENT", + "displayName": "Parser for Mimecast Human Risk Attacks", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastTTPAttachment", - "query": "let dummy_table = datatable(\n TimeGenerated: datetime,\n senderAddress: string,\n recipientAddress: string,\n messageId: string\n) [];\nlet MimecastTTPAttachment = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Attachment_CL\n | summarize arg_max(TimeGenerated, *) by senderAddress, recipientAddress, messageId\n | extend\n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Mimecast Event ID\"] = 'ttp_attachment',\n [\"Mimecast Event Category\"] = 'ttp_attachment',\n [\"Action Triggered\"] = column_ifexists('actionTriggered', ''),\n [\"Event Time\"] = column_ifexists('Date', ''),\n [\"Definition\"] = column_ifexists('definition', ''),\n [\"Details\"] = column_ifexists('details', ''),\n [\"File Hash\"] = column_ifexists('fileHash', ''),\n [\"File Name\"] = column_ifexists('fileName', ''),\n [\"File Type\"] = column_ifexists('fileType', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Result\"] = column_ifexists('result', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Subject\"] = column_ifexists('subject', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Time Generated\"],\n [\"Type\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"Action Triggered\"],\n [\"Event Time\"],\n [\"Definition\"],\n [\"Details\"],\n [\"File Hash\"],\n [\"File Name\"],\n [\"File Type\"],\n [\"Message ID\"],\n [\"Recipient Address\"],\n [\"Result\"],\n [\"Route\"],\n [\"Sender Address\"],\n [\"Subject\"] \n};\nMimecastTTPAttachment\n", + "functionAlias": "MimecastHumanRiskAttacks", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') };\nlet MimecastHumanRiskAttacks_view = view() {\nunion isfuzzy=true\n dummy_table,\n MimecastHumanRisk_Attacks_CL\n| extend\n AttackScore = toint(column_ifexists('AttackScore', int(null))),\n AttackFactor = tostring(column_ifexists('AttackFactor', '')),\n AttackTypes = todynamic(column_ifexists('AttackTypes', dynamic(null)))\n| extend AttackTypesRaw = iff(gettype(AttackTypes) != 'array' or array_length(AttackTypes) == 0, dynamic([{}]), AttackTypes)\n| mv-expand AttackTypeItem = AttackTypesRaw\n| extend\n AttackFactorLabel = FactorLabel(AttackFactor),\n AttackType = tostring(AttackTypeItem.type),\n AttackTypeTotal = toint(AttackTypeItem.attackTotal),\n AttackTypeScore = toint(AttackTypeItem.attackScore),\n AttackTypeFactor = tostring(AttackTypeItem.attackFactor),\n AttackTypeTrend = toint(AttackTypeItem.trend),\n AttackTypeEvents = AttackTypeItem.events,\n EventDelivered = toint(AttackTypeItem.events.delivered),\n EventBlocked = toint(AttackTypeItem.events.blocked),\n EventRemediated = toint(AttackTypeItem.events.remediated),\n EventDownloadAttempted = toint(AttackTypeItem.events.downloadAttempted),\n EventDownloaded = toint(AttackTypeItem.events.downloaded),\n EventExecuted = toint(AttackTypeItem.events.executed),\n EventUnknown = toint(AttackTypeItem.events.unknown),\n EventAnomalous = toint(AttackTypeItem.events.anomalous),\n EventSuspicious = toint(AttackTypeItem.events.suspicious),\n EventMalicious = toint(AttackTypeItem.events.malicious),\n EventReported = toint(AttackTypeItem.events.reported)\n| extend\n AttackTypeName = case(AttackType == 'actualPhishing', 'Actual Phishing', AttackType == 'malware', 'Malware', AttackType == 'identity', 'Identity', AttackType),\n AttackTypeFactorLabel = FactorLabel(AttackTypeFactor)\n| project\n TimeGenerated,\n AttackScore,\n AttackFactor,\n AttackFactorLabel,\n AttackType,\n AttackTypeName,\n AttackTypeTotal,\n AttackTypeScore,\n AttackTypeFactor,\n AttackTypeFactorLabel,\n AttackTypeTrend,\n AttackTypeEvents,\n EventDelivered,\n EventBlocked,\n EventRemediated,\n EventDownloadAttempted,\n EventDownloaded,\n EventExecuted,\n EventUnknown,\n EventAnomalous,\n EventSuspicious,\n EventMalicious,\n EventReported,\n AttackTypes\n};\nMimecastHumanRiskAttacks_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4364,7 +4526,7 @@ "[variables('parserObject9')._parserId9]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPAttachment')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskAttacks')]", "contentId": "[variables('parserObject9').parserContentId9]", "kind": "Parser", "version": "[variables('parserObject9').parserVersion9]", @@ -4394,7 +4556,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_TTP_Impersonation Data Parser with template version 3.1.0", + "description": "Mimecast_HumanRisk_Individuals Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject10').parserVersion10]", @@ -4403,15 +4565,15 @@ "resources": [ { "name": "[variables('parserObject10')._parserName10]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast TTP Impersonation", + "displayName": "Parser for Mimecast Human Risk Individuals", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastTTPImpersonation", - "query": "let dummy_table = datatable(TimeGenerated: datetime, id: string) [];\nlet MimecastTTPImpersonation = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Impersonation_CL\n | summarize arg_max(TimeGenerated, *) by id\n | extend \n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Mimecast Event ID\"] = 'ttp_impersonation',\n [\"Mimecast Event Category\"] = 'ttp_impersonation',\n [\"Action\"] = column_ifexists('action', ''),\n [\"Definition\"] = column_ifexists('definition', ''),\n [\"Event Time\"] = column_ifexists('eventTime', ''),\n [\"Hits\"] = column_ifexists('hits', ''),\n [\"ID\"] = column_ifexists('id', ''),\n [\"Identifiers\"] = column_ifexists('identifiers', ''),\n [\"Impersonation Results\"] = column_ifexists('impersonationResults', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Sender IP Address\"] = column_ifexists('senderIpAddress', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Tagged External\"] = column_ifexists('taggedExternal', ''),\n [\"Tagged Malicious\"] = column_ifexists('taggedMalicious', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Time Generated\"],\n [\"ID\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"Action\"],\n [\"Definition\"],\n [\"Event Time\"],\n [\"Hits\"],\n [\"Identifiers\"],\n [\"Impersonation Results\"],\n [\"Message ID\"],\n [\"Recipient Address\"],\n [\"Sender Address\"],\n [\"Sender IP Address\"],\n [\"Subject\"],\n [\"Tagged External\"],\n [\"Tagged Malicious\"],\n [\"Type\"] \n};\nMimecastTTPImpersonation\n", + "functionAlias": "MimecastHumanRiskIndividuals", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') };\nlet MimecastHumanRiskIndividuals_view = view() {\nunion isfuzzy=true\n dummy_table,\n MimecastHumanRisk_Individuals_CL\n| extend\n IndividualId = tostring(column_ifexists('IndividualId', '')),\n DisplayName = tostring(column_ifexists('DisplayName', '')),\n EmailAddress = tostring(column_ifexists('EmailAddress', '')),\n FirstName = tostring(column_ifexists('FirstName', '')),\n LastName = tostring(column_ifexists('LastName', '')),\n ManagerName = tostring(column_ifexists('ManagerName', '')),\n ManagerId = tostring(column_ifexists('ManagerId', '')),\n Department = tostring(column_ifexists('Department', '')),\n Location = tostring(column_ifexists('Location', '')),\n JobTitle = tostring(column_ifexists('JobTitle', '')),\n TenureMonths = toint(column_ifexists('TenureMonths', int(null))),\n TenureStatus = tostring(column_ifexists('TenureStatus', '')),\n StartDateTime = todatetime(column_ifexists('StartDateTime', datetime(null))),\n HumanRiskScore = toint(column_ifexists('HumanRiskScore', int(null))),\n HumanRiskFactor = tostring(column_ifexists('HumanRiskFactor', '')),\n AttackScore = toint(column_ifexists('AttackScore', int(null))),\n AttackFactor = tostring(column_ifexists('AttackFactor', '')),\n Behaviors = todynamic(column_ifexists('Behaviors', dynamic(null))),\n Attacks = todynamic(column_ifexists('Attacks', dynamic(null)))\n| extend\n BehaviorsSrc = iff(gettype(Behaviors) != 'array' or array_length(Behaviors) == 0, dynamic([{}]), Behaviors),\n AttacksSrc = iff(gettype(Attacks) != 'array' or array_length(Attacks) == 0, dynamic([{}]), Attacks)\n| mv-apply b = BehaviorsSrc on (summarize Bhv = make_bag(bag_pack(coalesce(tostring(b.type), 'none'), b)))\n| mv-apply a = AttacksSrc on (summarize Atk = make_bag(bag_pack(coalesce(tostring(a.type), 'none'), a)))\n| extend\n HumanRiskFactorLabel = FactorLabel(HumanRiskFactor),\n AttackFactorLabel = FactorLabel(AttackFactor),\n SimulatedPhishingScore = toint(Bhv.simulatedPhishing.score),\n SimulatedPhishingFactor = tostring(Bhv.simulatedPhishing.factor),\n SimulatedPhishingTrend = toint(Bhv.simulatedPhishing.trend),\n SimulatedPhishingEventCount = toint(Bhv.simulatedPhishing.eventCount),\n SimulatedPhishingEvents = Bhv.simulatedPhishing.events,\n ActualPhishingScore = toint(Bhv.actualPhishing.score),\n ActualPhishingFactor = tostring(Bhv.actualPhishing.factor),\n ActualPhishingTrend = toint(Bhv.actualPhishing.trend),\n ActualPhishingEventCount = toint(Bhv.actualPhishing.eventCount),\n ActualPhishingEvents = Bhv.actualPhishing.events,\n TrainingScore = toint(Bhv.training.score),\n TrainingFactor = tostring(Bhv.training.factor),\n TrainingTrend = toint(Bhv.training.trend),\n TrainingEventCount = toint(Bhv.training.eventCount),\n TrainingEvents = Bhv.training.events,\n MalwareScore = toint(Bhv.malware.score),\n MalwareFactor = tostring(Bhv.malware.factor),\n MalwareTrend = toint(Bhv.malware.trend),\n MalwareEventCount = toint(Bhv.malware.eventCount),\n MalwareEvents = Bhv.malware.events,\n SensitiveDataHandlingScore = toint(Bhv.sensitiveDataHandling.score),\n SensitiveDataHandlingFactor = tostring(Bhv.sensitiveDataHandling.factor),\n SensitiveDataHandlingTrend = toint(Bhv.sensitiveDataHandling.trend),\n SensitiveDataHandlingEventCount = toint(Bhv.sensitiveDataHandling.eventCount),\n SensitiveDataHandlingEvents = Bhv.sensitiveDataHandling.events,\n ActualPhishingAttackScore = toint(Atk.actualPhishing.score),\n ActualPhishingAttackFactor = tostring(Atk.actualPhishing.factor),\n ActualPhishingAttackTrend = toint(Atk.actualPhishing.trend),\n ActualPhishingAttackEventCount = toint(Atk.actualPhishing.eventCount),\n ActualPhishingAttackEvents = Atk.actualPhishing.events,\n MalwareAttackScore = toint(Atk.malware.score),\n MalwareAttackFactor = tostring(Atk.malware.factor),\n MalwareAttackTrend = toint(Atk.malware.trend),\n MalwareAttackEventCount = toint(Atk.malware.eventCount),\n MalwareAttackEvents = Atk.malware.events,\n IdentityAttackScore = toint(Atk.identity.score),\n IdentityAttackFactor = tostring(Atk.identity.factor),\n IdentityAttackTrend = toint(Atk.identity.trend),\n IdentityAttackEventCount = toint(Atk.identity.eventCount),\n IdentityAttackEvents = Atk.identity.events\n| project\n TimeGenerated,\n IndividualId,\n DisplayName,\n EmailAddress,\n FirstName,\n LastName,\n ManagerName,\n ManagerId,\n Department,\n Location,\n JobTitle,\n TenureMonths,\n TenureStatus,\n StartDateTime,\n HumanRiskScore,\n HumanRiskFactor,\n AttackScore,\n AttackFactor,\n HumanRiskFactorLabel,\n AttackFactorLabel,\n SimulatedPhishingScore,\n SimulatedPhishingFactor,\n SimulatedPhishingTrend,\n SimulatedPhishingEventCount,\n SimulatedPhishingEvents,\n ActualPhishingScore,\n ActualPhishingFactor,\n ActualPhishingTrend,\n ActualPhishingEventCount,\n ActualPhishingEvents,\n TrainingScore,\n TrainingFactor,\n TrainingTrend,\n TrainingEventCount,\n TrainingEvents,\n MalwareScore,\n MalwareFactor,\n MalwareTrend,\n MalwareEventCount,\n MalwareEvents,\n SensitiveDataHandlingScore,\n SensitiveDataHandlingFactor,\n SensitiveDataHandlingTrend,\n SensitiveDataHandlingEventCount,\n SensitiveDataHandlingEvents,\n ActualPhishingAttackScore,\n ActualPhishingAttackFactor,\n ActualPhishingAttackTrend,\n ActualPhishingAttackEventCount,\n ActualPhishingAttackEvents,\n MalwareAttackScore,\n MalwareAttackFactor,\n MalwareAttackTrend,\n MalwareAttackEventCount,\n MalwareAttackEvents,\n IdentityAttackScore,\n IdentityAttackFactor,\n IdentityAttackTrend,\n IdentityAttackEventCount,\n IdentityAttackEvents,\n Behaviors,\n Attacks\n};\nMimecastHumanRiskIndividuals_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4430,7 +4592,7 @@ "[variables('parserObject10')._parserId10]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPImpersonation')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskIndividuals')]", "contentId": "[variables('parserObject10').parserContentId10]", "kind": "Parser", "version": "[variables('parserObject10').parserVersion10]", @@ -4460,23 +4622,23 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('parserObject10').parserContentId10]", "contentKind": "Parser", - "displayName": "Parser for Mimecast TTP Impersonation", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject10').parserContentId10,'-', '1.0.1')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject10').parserContentId10,'-', '1.0.1')))]", + "displayName": "Parser for Mimecast Human Risk Individuals", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject10').parserContentId10,'-', '1.1.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject10').parserContentId10,'-', '1.1.0')))]", "version": "[variables('parserObject10').parserVersion10]" } }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject10')._parserName10]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast TTP Impersonation", + "displayName": "Parser for Mimecast Human Risk Individuals", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastTTPImpersonation", - "query": "let dummy_table = datatable(TimeGenerated: datetime, id: string) [];\nlet MimecastTTPImpersonation = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Impersonation_CL\n | summarize arg_max(TimeGenerated, *) by id\n | extend \n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Mimecast Event ID\"] = 'ttp_impersonation',\n [\"Mimecast Event Category\"] = 'ttp_impersonation',\n [\"Action\"] = column_ifexists('action', ''),\n [\"Definition\"] = column_ifexists('definition', ''),\n [\"Event Time\"] = column_ifexists('eventTime', ''),\n [\"Hits\"] = column_ifexists('hits', ''),\n [\"ID\"] = column_ifexists('id', ''),\n [\"Identifiers\"] = column_ifexists('identifiers', ''),\n [\"Impersonation Results\"] = column_ifexists('impersonationResults', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Sender IP Address\"] = column_ifexists('senderIpAddress', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Tagged External\"] = column_ifexists('taggedExternal', ''),\n [\"Tagged Malicious\"] = column_ifexists('taggedMalicious', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Time Generated\"],\n [\"ID\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"Action\"],\n [\"Definition\"],\n [\"Event Time\"],\n [\"Hits\"],\n [\"Identifiers\"],\n [\"Impersonation Results\"],\n [\"Message ID\"],\n [\"Recipient Address\"],\n [\"Sender Address\"],\n [\"Sender IP Address\"],\n [\"Subject\"],\n [\"Tagged External\"],\n [\"Tagged Malicious\"],\n [\"Type\"] \n};\nMimecastTTPImpersonation\n", + "functionAlias": "MimecastHumanRiskIndividuals", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') };\nlet MimecastHumanRiskIndividuals_view = view() {\nunion isfuzzy=true\n dummy_table,\n MimecastHumanRisk_Individuals_CL\n| extend\n IndividualId = tostring(column_ifexists('IndividualId', '')),\n DisplayName = tostring(column_ifexists('DisplayName', '')),\n EmailAddress = tostring(column_ifexists('EmailAddress', '')),\n FirstName = tostring(column_ifexists('FirstName', '')),\n LastName = tostring(column_ifexists('LastName', '')),\n ManagerName = tostring(column_ifexists('ManagerName', '')),\n ManagerId = tostring(column_ifexists('ManagerId', '')),\n Department = tostring(column_ifexists('Department', '')),\n Location = tostring(column_ifexists('Location', '')),\n JobTitle = tostring(column_ifexists('JobTitle', '')),\n TenureMonths = toint(column_ifexists('TenureMonths', int(null))),\n TenureStatus = tostring(column_ifexists('TenureStatus', '')),\n StartDateTime = todatetime(column_ifexists('StartDateTime', datetime(null))),\n HumanRiskScore = toint(column_ifexists('HumanRiskScore', int(null))),\n HumanRiskFactor = tostring(column_ifexists('HumanRiskFactor', '')),\n AttackScore = toint(column_ifexists('AttackScore', int(null))),\n AttackFactor = tostring(column_ifexists('AttackFactor', '')),\n Behaviors = todynamic(column_ifexists('Behaviors', dynamic(null))),\n Attacks = todynamic(column_ifexists('Attacks', dynamic(null)))\n| extend\n BehaviorsSrc = iff(gettype(Behaviors) != 'array' or array_length(Behaviors) == 0, dynamic([{}]), Behaviors),\n AttacksSrc = iff(gettype(Attacks) != 'array' or array_length(Attacks) == 0, dynamic([{}]), Attacks)\n| mv-apply b = BehaviorsSrc on (summarize Bhv = make_bag(bag_pack(coalesce(tostring(b.type), 'none'), b)))\n| mv-apply a = AttacksSrc on (summarize Atk = make_bag(bag_pack(coalesce(tostring(a.type), 'none'), a)))\n| extend\n HumanRiskFactorLabel = FactorLabel(HumanRiskFactor),\n AttackFactorLabel = FactorLabel(AttackFactor),\n SimulatedPhishingScore = toint(Bhv.simulatedPhishing.score),\n SimulatedPhishingFactor = tostring(Bhv.simulatedPhishing.factor),\n SimulatedPhishingTrend = toint(Bhv.simulatedPhishing.trend),\n SimulatedPhishingEventCount = toint(Bhv.simulatedPhishing.eventCount),\n SimulatedPhishingEvents = Bhv.simulatedPhishing.events,\n ActualPhishingScore = toint(Bhv.actualPhishing.score),\n ActualPhishingFactor = tostring(Bhv.actualPhishing.factor),\n ActualPhishingTrend = toint(Bhv.actualPhishing.trend),\n ActualPhishingEventCount = toint(Bhv.actualPhishing.eventCount),\n ActualPhishingEvents = Bhv.actualPhishing.events,\n TrainingScore = toint(Bhv.training.score),\n TrainingFactor = tostring(Bhv.training.factor),\n TrainingTrend = toint(Bhv.training.trend),\n TrainingEventCount = toint(Bhv.training.eventCount),\n TrainingEvents = Bhv.training.events,\n MalwareScore = toint(Bhv.malware.score),\n MalwareFactor = tostring(Bhv.malware.factor),\n MalwareTrend = toint(Bhv.malware.trend),\n MalwareEventCount = toint(Bhv.malware.eventCount),\n MalwareEvents = Bhv.malware.events,\n SensitiveDataHandlingScore = toint(Bhv.sensitiveDataHandling.score),\n SensitiveDataHandlingFactor = tostring(Bhv.sensitiveDataHandling.factor),\n SensitiveDataHandlingTrend = toint(Bhv.sensitiveDataHandling.trend),\n SensitiveDataHandlingEventCount = toint(Bhv.sensitiveDataHandling.eventCount),\n SensitiveDataHandlingEvents = Bhv.sensitiveDataHandling.events,\n ActualPhishingAttackScore = toint(Atk.actualPhishing.score),\n ActualPhishingAttackFactor = tostring(Atk.actualPhishing.factor),\n ActualPhishingAttackTrend = toint(Atk.actualPhishing.trend),\n ActualPhishingAttackEventCount = toint(Atk.actualPhishing.eventCount),\n ActualPhishingAttackEvents = Atk.actualPhishing.events,\n MalwareAttackScore = toint(Atk.malware.score),\n MalwareAttackFactor = tostring(Atk.malware.factor),\n MalwareAttackTrend = toint(Atk.malware.trend),\n MalwareAttackEventCount = toint(Atk.malware.eventCount),\n MalwareAttackEvents = Atk.malware.events,\n IdentityAttackScore = toint(Atk.identity.score),\n IdentityAttackFactor = tostring(Atk.identity.factor),\n IdentityAttackTrend = toint(Atk.identity.trend),\n IdentityAttackEventCount = toint(Atk.identity.eventCount),\n IdentityAttackEvents = Atk.identity.events\n| project\n TimeGenerated,\n IndividualId,\n DisplayName,\n EmailAddress,\n FirstName,\n LastName,\n ManagerName,\n ManagerId,\n Department,\n Location,\n JobTitle,\n TenureMonths,\n TenureStatus,\n StartDateTime,\n HumanRiskScore,\n HumanRiskFactor,\n AttackScore,\n AttackFactor,\n HumanRiskFactorLabel,\n AttackFactorLabel,\n SimulatedPhishingScore,\n SimulatedPhishingFactor,\n SimulatedPhishingTrend,\n SimulatedPhishingEventCount,\n SimulatedPhishingEvents,\n ActualPhishingScore,\n ActualPhishingFactor,\n ActualPhishingTrend,\n ActualPhishingEventCount,\n ActualPhishingEvents,\n TrainingScore,\n TrainingFactor,\n TrainingTrend,\n TrainingEventCount,\n TrainingEvents,\n MalwareScore,\n MalwareFactor,\n MalwareTrend,\n MalwareEventCount,\n MalwareEvents,\n SensitiveDataHandlingScore,\n SensitiveDataHandlingFactor,\n SensitiveDataHandlingTrend,\n SensitiveDataHandlingEventCount,\n SensitiveDataHandlingEvents,\n ActualPhishingAttackScore,\n ActualPhishingAttackFactor,\n ActualPhishingAttackTrend,\n ActualPhishingAttackEventCount,\n ActualPhishingAttackEvents,\n MalwareAttackScore,\n MalwareAttackFactor,\n MalwareAttackTrend,\n MalwareAttackEventCount,\n MalwareAttackEvents,\n IdentityAttackScore,\n IdentityAttackFactor,\n IdentityAttackTrend,\n IdentityAttackEventCount,\n IdentityAttackEvents,\n Behaviors,\n Attacks\n};\nMimecastHumanRiskIndividuals_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4496,7 +4658,7 @@ "[variables('parserObject10')._parserId10]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPImpersonation')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskIndividuals')]", "contentId": "[variables('parserObject10').parserContentId10]", "kind": "Parser", "version": "[variables('parserObject10').parserVersion10]", @@ -4526,7 +4688,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_TTP_Url Data Parser with template version 3.1.0", + "description": "Mimecast_SEG_CG Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject11').parserVersion11]", @@ -4535,15 +4697,15 @@ "resources": [ { "name": "[variables('parserObject11')._parserName11]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast TTP URL", + "displayName": "Parser for Mimecast SEG Cloud Gateway", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastTTPUrl", - "query": "let dummy_table = datatable(\nTimeGenerated: datetime,\nuserEmailAddress: string,\nfromUserEmailAddress: string,\nmessageId: string,\nsendingIp: string,\nurl: string\n) [];\nlet MimecastTTPUrl = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Url_CL\n | summarize arg_max(TimeGenerated, *) by userEmailAddress, fromUserEmailAddress, sendingIp, messageId, url\n | extend \n [\"Category\"] = column_ifexists('category', ''),\n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Tag Map Dangerous File Ext Content Check Dangerous Mimetypes Url File Download\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_DangerousMimetypesUrlFileDownload', ''),\n [\"Tag Map Dangerous File Ext Content Check Dangerous Exts Url File Download\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_DangerousExtsUrlFileDownload', ''),\n [\"Tag Map Advanced Phishing Credential Theft Evidence\"] = column_ifexists('tagMap_AdvancedPhishing_CredentialTheftEvidence', ''),\n [\"Tag Map Advanced Phishing Credential Theft Tags\"] = column_ifexists('tagMap_AdvancedPhishing_CredentialTheftTags', ''),\n [\"Mimecast Event ID\"] = 'ttp_url',\n [\"Mimecast Event Category\"] = 'ttp_url',\n [\"Advanced Phishing Result Credential Theft Brands\"] = column_ifexists('advancedPhishingResult_CredentialTheftBrands', ''),\n [\"Advanced Phishing Result Credential Theft Evidence\"] = column_ifexists('advancedPhishingResult_CredentialTheftEvidence', ''),\n [\"Advanced Phishing Result Credential Theft Tags\"] = column_ifexists('advancedPhishingResult_CredentialTheftTags', ''),\n [\"Tag Map Url Reputation Scan Type\"] = column_ifexists('tagMap_UrlReputationScan_Type', ''),\n [\"Tag Map Url Reputation Scan Url\"] = column_ifexists('tagMap_UrlReputationScan_Url', ''),\n [\"Tag Map Dangerous File Ext Inspect File Exts\"] = column_ifexists('tagMap_DangerousFileExt_Inspect_FileExts', ''),\n [\"Tag Map Dangerous File Ext Inspect Mime Types\"] = column_ifexists('tagMap_DangerousFileExt_Inspect_MimeTypes', ''),\n [\"Tag Map Dangerous File Ext Content Check Content Scanners Blocked\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_ContentScannersBlocked', ''),\n [\"User Email Address\"] = column_ifexists('userEmailAddress', ''),\n [\"From User Email Address\"] = column_ifexists('fromUserEmailAddress', ''),\n [\"Url\"] = column_ifexists('url', ''),\n [\"Ttp Definition\"] = column_ifexists('ttpDefinition', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Action\"] = column_ifexists('action', ''),\n [\"Admin Override\"] = column_ifexists('adminOverride', ''),\n [\"User Override\"] = column_ifexists('userOverride', ''),\n [\"Scan Result\"] = column_ifexists('scanResult', ''),\n [\"Sending IP\"] = column_ifexists('sendingIp', ''),\n [\"User Awareness Action\"] = column_ifexists('userAwarenessAction', ''),\n ['Event Time'] = column_ifexists('Date', ''),\n [\"Actions\"] = column_ifexists('actions', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Creation Method\"] = column_ifexists('creationMethod', ''),\n [\"Email Parts Description\"] = column_ifexists('emailPartsDescription', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Tag Map Url Reputation Scan Url Block\"] = column_ifexists('tagMap_UrlReputationScan_UrlBlock', ''),\n [\"Tag Map Customer Managed Urls Managed Url Entry\"] = column_ifexists('tagMap_CustomerManagedUrls_ManagedUrlEntry', ''),\n [\"Tag Map Customer Managed Urls Blocklisted\"] = column_ifexists('tagMap_CustomerManagedUrls_Blocklisted', ''),\n [\"Tag Map Av Scanning Content Check Av Signature Name\"] = column_ifexists('tagMap_AvScanning_ContentCheck_AvSignatureName', ''),\n [\"Tag Map Av Scanning Scanner Info Category Trigger\"] = column_ifexists('tagMap_AvScanning_ScannerInfo_CategoryTrigger', ''),\n [\"Tag Map Av Scanning Content Check Av Signature File Exts\"] = column_ifexists('tagMap_AvScanning_ContentCheck_AvSignatureFileExts', ''),\n [\"Tag Map Av Scanning Content Check Url File Download Filename\"] = column_ifexists('tagMap_AvScanning_ContentCheck_UrlFileDownloadFilename', ''),\n [\"Tag Map Dangerous File Ext Status\"] = column_ifexists('tagMap_DangerousFileExt_Status', ''),\n [\"Tag Map Url Reputation Scan Status\"] = column_ifexists('tagMap_UrlReputationScan_Status', ''),\n [\"Tag Map ContentCheck Dangerous Mimetypes Url File Download\"] = column_ifexists('tagMap_ContentCheck_DangerousMimetypesUrlFileDownload', ''),\n [\"Tag Map ContentCheck Dangerous Exts Url File Download\"] = column_ifexists('tagMap_ContentCheck_DangerousExtsUrlFileDownload', ''),\n [\"Mimecast Event Id\"] = column_ifexists('mimecastEventId', ''),\n [\"Mimecast Event Category_\"] = column_ifexists('mimecastEventCategory', ''),\n [\"Tag Map Customer Managed Urls Status\"] = column_ifexists('tagMap_CustomerManagedUrls_Status', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Category\"],\n [\"Time Generated\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"User Email Address\"],\n [\"From User Email Address\"],\n [\"Url\"],\n [\"Ttp Definition\"],\n [\"Subject\"],\n [\"Action\"],\n [\"Admin Override\"],\n [\"User Override\"],\n [\"Scan Result\"],\n [\"Sending IP\"],\n [\"User Awareness Action\"],\n ['Event Time'],\n [\"Actions\"],\n [\"Route\"],\n [\"Creation Method\"],\n [\"Email Parts Description\"],\n [\"Message ID\"],\n [\"Tag Map Dangerous File Ext Content Check Dangerous Mimetypes Url File Download\"],\n [\"Tag Map Dangerous File Ext Content Check Dangerous Exts Url File Download\"],\n [\"Tag Map Advanced Phishing Credential Theft Evidence\"],\n [\"Tag Map Advanced Phishing Credential Theft Tags\"],\n [\"Advanced Phishing Result Credential Theft Brands\"],\n [\"Advanced Phishing Result Credential Theft Evidence\"],\n [\"Advanced Phishing Result Credential Theft Tags\"],\n [\"Tag Map Url Reputation Scan Type\"],\n [\"Tag Map Url Reputation Scan Url\"],\n [\"Tag Map Dangerous File Ext Inspect File Exts\"],\n [\"Tag Map Dangerous File Ext Inspect Mime Types\"],\n [\"Tag Map Dangerous File Ext Content Check Content Scanners Blocked\"],\n [\"Tag Map Url Reputation Scan Url Block\"],\n [\"Tag Map Customer Managed Urls Managed Url Entry\"],\n [\"Tag Map Customer Managed Urls Blocklisted\"],\n [\"Tag Map Av Scanning Content Check Av Signature Name\"],\n [\"Tag Map Av Scanning Scanner Info Category Trigger\"],\n [\"Tag Map Av Scanning Content Check Av Signature File Exts\"],\n [\"Tag Map Av Scanning Content Check Url File Download Filename\"],\n [\"Type\"],\n [\"Tag Map Dangerous File Ext Status\"],\n [\"Tag Map Url Reputation Scan Status\"],\n [\"Tag Map ContentCheck Dangerous Mimetypes Url File Download\"],\n [\"Tag Map ContentCheck Dangerous Exts Url File Download\"],\n [\"Mimecast Event Id\"],\n [\"Mimecast Event Category_\"],\n [\"Tag Map Customer Managed Urls Status\"]\n};\nMimecastTTPUrl\n", + "functionAlias": "MimecastCG", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet MimecastCG_view = view() {\nunion isfuzzy=true dummy_table,\nSeg_Cg_CL\n| extend \n [\"Time Generated\"] = column_ifexists(\"TimeGenerated\", \"\"),\n [\"Url Category\"] = column_ifexists(\"urlCategory\", \"\"),\n [\"Scan Results\"] = column_ifexists(\"scanResults\", \"\"),\n [\"File Name\"] = column_ifexists(\"fileName\", \"\"),\n [\"Sha256\"] = column_ifexists(\"sha256\", \"\"),\n [\"File Extension\"] = column_ifexists(\"fileExtension\", \"\"),\n [\"Virus Found\"] = column_ifexists(\"virusFound\", \"\"),\n [\"Sha1\"] = column_ifexists(\"sha1\", \"\"),\n [\"Sender Domain\"] = column_ifexists(\"senderDomain\", \"\"),\n [\"Md5\"] = column_ifexists(\"md5\", \"\"),\n [\"Custom Threat Dictionary\"] = column_ifexists(\"customThreatDictionary\", \"\"),\n [\"Items Detected\"] = column_ifexists(\"itemsDetected\", \"\"),\n [\"Similar Custom External Domain\"] = column_ifexists(\"similarCustomExternalDomain\", \"\"),\n [\"Tagged External\"] = column_ifexists(\"taggedExternal\", \"\"),\n [\"Similar Internal Domain\"] = column_ifexists(\"similarInternalDomain\", \"\"),\n [\"New Domain\"] = column_ifexists(\"newDomain\", \"\"),\n [\"Internal User Name\"] = column_ifexists(\"internalUserName\", \"\"),\n [\"Mimecast Threat Dictionary\"] = column_ifexists(\"mimecastThreatDictionary\", \"\"),\n [\"Similar Mimecast External Domain\"] = column_ifexists(\"similarMimecastExternalDomain\", \"\"),\n [\"Custom Name Match\"] = column_ifexists(\"customNameMatch\", \"\"),\n [\"Tagged Malicious\"] = column_ifexists(\"taggedMalicious\", \"\"),\n [\"Reply Mismatch\"] = column_ifexists(\"replyMismatch\", \"\"),\n [\"Aggregate ID S\"] = column_ifexists(\"aggregateId\", \"\"),\n [\"Aggregate ID G\"] = column_ifexists(\"aggregateId\", \"\"),\n [\"Rejection Type\"] = column_ifexists(\"rejectionType\", \"\"),\n [\"Rejection Code\"] = column_ifexists(\"rejectionCode\", \"\"),\n [\"Rejection Info\"] = column_ifexists(\"rejectionInfo\", \"\"),\n [\"Delivered\"] = column_ifexists(\"delivered\", \"\"),\n [\"Destination IP\"] = column_ifexists(\"destinationIp\", \"\"),\n [\"Host Name\"] = column_ifexists(\"Hostname\", \"\"),\n [\"Delivery Attempts\"] = column_ifexists(\"deliveryAttempts\", \"\"),\n [\"TLS Used\"] = column_ifexists(\"tlsUsed\", \"\"),\n [\"Delivery Errors\"] = column_ifexists(\"deliveryErrors\", \"\"),\n [\"Attachments\"] = column_ifexists(\"attachments\", \"\"),\n [\"Route\"] = column_ifexists(\"route\", \"\"),\n [\"Processing ID\"] = column_ifexists(\"processingId\", \"\"),\n [\"Account ID\"] = column_ifexists(\"accountId\", \"\"),\n [\"Action\"] = column_ifexists(\"action\", \"\"),\n [\"Event Time\"] = column_ifexists(\"timestamp\", \"\"),\n [\"Sender Envelope\"] = column_ifexists(\"senderEnvelope\", \"\"),\n [\"Message ID\"] = column_ifexists(\"messageId\", \"\"),\n [\"Subject\"] = column_ifexists(\"subject\", \"\"),\n [\"Total of Size Attachments\"] = column_ifexists(\"totalSizeAttachments\", \"\"),\n [\"Number of Attachments\"] = column_ifexists(\"numberAttachments\", \"\"),\n [\"Email Size\"] = column_ifexists(\"emailSize\", \"\"),\n [\"Type\"] = column_ifexists(\"Logtype\", \"\"),\n [\"Sub Type\"] = column_ifexists(\"subtype\", \"\"),\n [\"Monitored Domain Source\"] = column_ifexists(\"monitoredDomainSource\", \"\"),\n [\"Similar Domain\"] = column_ifexists(\"similarDomain\", \"\"),\n [\"Offset\"] = column_ifexists(\"offset\", \"\"),\n [\"Partition\"] = column_ifexists(\"partition\", \"\"),\n [\"Hold Reason\"] = column_ifexists(\"holdReason\", \"\"),\n [\"Recipients\"] = column_ifexists(\"recipients\", \"\"),\n [\"Sender IP\"] = column_ifexists(\"senderIp\", \"\"),\n [\"Direction\"] = column_ifexists(\"direction\", \"\"),\n [\"Sender Header\"] = column_ifexists(\"senderHeader\", \"\"),\n [\"TLS Version\"] = column_ifexists(\"tlsVersion\", \"\"),\n [\"TLS Cipher\"] = column_ifexists(\"tlsCipher\", \"\"),\n [\"Spam Info\"] = column_ifexists(\"spamInfo\", \"\"),\n [\"Spam Processing Detail\"] = column_ifexists(\"spamProcessingDetail\", \"\")\n| summarize arg_max([\"Time Generated\"], *) by \n [\"Url Category\"],\n [\"Scan Results\"],\n [\"File Name\"],\n [\"Sha256\"],\n [\"File Extension\"],\n [\"Virus Found\"],\n [\"Sha1\"],\n [\"Sender Domain\"],\n [\"Md5\"],\n [\"Custom Threat Dictionary\"],\n [\"Items Detected\"],\n [\"Similar Custom External Domain\"],\n [\"Tagged External\"],\n [\"Similar Internal Domain\"],\n [\"New Domain\"],\n [\"Internal User Name\"],\n [\"Mimecast Threat Dictionary\"],\n [\"Similar Mimecast External Domain\"],\n [\"Custom Name Match\"],\n [\"Tagged Malicious\"],\n [\"Reply Mismatch\"],\n [\"Aggregate ID\"] = coalesce([\"Aggregate ID S\"], [\"Aggregate ID G\"]),\n [\"Rejection Type\"],\n [\"Rejection Code\"],\n [\"Rejection Info\"],\n [\"Delivered\"],\n [\"Destination IP\"],\n [\"Host Name\"],\n [\"Delivery Attempts\"],\n [\"TLS Used\"],\n [\"Delivery Errors\"],\n [\"Attachments\"],\n [\"Route\"],\n [\"Processing ID\"],\n [\"Account ID\"],\n [\"Action\"],\n [\"Event Time\"],\n [\"Sender Envelope\"],\n [\"Message ID\"],\n [\"Subject\"],\n [\"Total of Size Attachments\"],\n [\"Number of Attachments\"],\n [\"Email Size\"],\n [\"Type\"],\n [\"Sub Type\"],\n [\"Monitored Domain Source\"],\n [\"Similar Domain\"],\n [\"Hold Reason\"],\n [\"Recipients\"],\n [\"Sender IP\"],\n [\"Direction\"],\n [\"Sender Header\"],\n [\"TLS Version\"],\n [\"TLS Cipher\"],\n [\"Spam Info\"],\n [\"Spam Processing Detail\"]\n| extend ['Event Time'] = iff( isempty( ['Event Time']) ,now() , todatetime(unixtime_milliseconds_todatetime( tolong([\"Event Time\"]) )) )\n| extend ['Message ID'] = trim(@\"[\\<\\>]\", ['Message ID'] )\n| project \n [\"Time Generated\"],\n [\"Url Category\"],\n [\"Scan Results\"],\n [\"File Name\"],\n [\"Sha256\"],\n [\"File Extension\"],\n [\"Virus Found\"],\n [\"Sha1\"],\n [\"Sender Domain\"],\n [\"Md5\"],\n [\"Custom Threat Dictionary\"],\n [\"Items Detected\"],\n [\"Similar Custom External Domain\"],\n [\"Tagged External\"],\n [\"Similar Internal Domain\"],\n [\"New Domain\"],\n [\"Internal User Name\"],\n [\"Mimecast Threat Dictionary\"],\n [\"Similar Mimecast External Domain\"],\n [\"Custom Name Match\"],\n [\"Tagged Malicious\"],\n [\"Reply Mismatch\"],\n [\"Aggregate ID\"] = coalesce([\"Aggregate ID S\"], [\"Aggregate ID G\"]),\n [\"Rejection Type\"],\n [\"Rejection Code\"],\n [\"Rejection Info\"],\n [\"Delivered\"],\n [\"Destination IP\"],\n [\"Host Name\"],\n [\"Delivery Attempts\"],\n [\"TLS Used\"],\n [\"Delivery Errors\"],\n [\"Attachments\"],\n [\"Route\"],\n [\"Processing ID\"],\n [\"Account ID\"],\n [\"Action\"],\n [\"Event Time\"] ,\n [\"Sender Envelope\"],\n [\"Message ID\"],\n [\"Subject\"],\n [\"Total of Size Attachments\"],\n [\"Number of Attachments\"],\n [\"Email Size\"],\n [\"Type\"],\n [\"Sub Type\"],\n [\"Monitored Domain Source\"],\n [\"Similar Domain\"],\n [\"Offset\"],\n [\"Partition\"],\n [\"Hold Reason\"],\n [\"Recipients\"],\n [\"Sender IP\"],\n [\"Direction\"],\n [\"Sender Header\"],\n [\"TLS Version\"],\n [\"TLS Cipher\"],\n [\"Spam Info\"],\n [\"Spam Processing Detail\"]\n};\nMimecastCG_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4562,7 +4724,7 @@ "[variables('parserObject11')._parserId11]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPUrl')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastCG')]", "contentId": "[variables('parserObject11').parserContentId11]", "kind": "Parser", "version": "[variables('parserObject11').parserVersion11]", @@ -4592,7 +4754,7 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('parserObject11').parserContentId11]", "contentKind": "Parser", - "displayName": "Parser for Mimecast TTP URL", + "displayName": "Parser for Mimecast SEG Cloud Gateway", "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject11').parserContentId11,'-', '1.0.1')))]", "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject11').parserContentId11,'-', '1.0.1')))]", "version": "[variables('parserObject11').parserVersion11]" @@ -4600,15 +4762,15 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject11')._parserName11]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast TTP URL", + "displayName": "Parser for Mimecast SEG Cloud Gateway", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastTTPUrl", - "query": "let dummy_table = datatable(\nTimeGenerated: datetime,\nuserEmailAddress: string,\nfromUserEmailAddress: string,\nmessageId: string,\nsendingIp: string,\nurl: string\n) [];\nlet MimecastTTPUrl = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Url_CL\n | summarize arg_max(TimeGenerated, *) by userEmailAddress, fromUserEmailAddress, sendingIp, messageId, url\n | extend \n [\"Category\"] = column_ifexists('category', ''),\n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Tag Map Dangerous File Ext Content Check Dangerous Mimetypes Url File Download\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_DangerousMimetypesUrlFileDownload', ''),\n [\"Tag Map Dangerous File Ext Content Check Dangerous Exts Url File Download\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_DangerousExtsUrlFileDownload', ''),\n [\"Tag Map Advanced Phishing Credential Theft Evidence\"] = column_ifexists('tagMap_AdvancedPhishing_CredentialTheftEvidence', ''),\n [\"Tag Map Advanced Phishing Credential Theft Tags\"] = column_ifexists('tagMap_AdvancedPhishing_CredentialTheftTags', ''),\n [\"Mimecast Event ID\"] = 'ttp_url',\n [\"Mimecast Event Category\"] = 'ttp_url',\n [\"Advanced Phishing Result Credential Theft Brands\"] = column_ifexists('advancedPhishingResult_CredentialTheftBrands', ''),\n [\"Advanced Phishing Result Credential Theft Evidence\"] = column_ifexists('advancedPhishingResult_CredentialTheftEvidence', ''),\n [\"Advanced Phishing Result Credential Theft Tags\"] = column_ifexists('advancedPhishingResult_CredentialTheftTags', ''),\n [\"Tag Map Url Reputation Scan Type\"] = column_ifexists('tagMap_UrlReputationScan_Type', ''),\n [\"Tag Map Url Reputation Scan Url\"] = column_ifexists('tagMap_UrlReputationScan_Url', ''),\n [\"Tag Map Dangerous File Ext Inspect File Exts\"] = column_ifexists('tagMap_DangerousFileExt_Inspect_FileExts', ''),\n [\"Tag Map Dangerous File Ext Inspect Mime Types\"] = column_ifexists('tagMap_DangerousFileExt_Inspect_MimeTypes', ''),\n [\"Tag Map Dangerous File Ext Content Check Content Scanners Blocked\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_ContentScannersBlocked', ''),\n [\"User Email Address\"] = column_ifexists('userEmailAddress', ''),\n [\"From User Email Address\"] = column_ifexists('fromUserEmailAddress', ''),\n [\"Url\"] = column_ifexists('url', ''),\n [\"Ttp Definition\"] = column_ifexists('ttpDefinition', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Action\"] = column_ifexists('action', ''),\n [\"Admin Override\"] = column_ifexists('adminOverride', ''),\n [\"User Override\"] = column_ifexists('userOverride', ''),\n [\"Scan Result\"] = column_ifexists('scanResult', ''),\n [\"Sending IP\"] = column_ifexists('sendingIp', ''),\n [\"User Awareness Action\"] = column_ifexists('userAwarenessAction', ''),\n ['Event Time'] = column_ifexists('Date', ''),\n [\"Actions\"] = column_ifexists('actions', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Creation Method\"] = column_ifexists('creationMethod', ''),\n [\"Email Parts Description\"] = column_ifexists('emailPartsDescription', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Tag Map Url Reputation Scan Url Block\"] = column_ifexists('tagMap_UrlReputationScan_UrlBlock', ''),\n [\"Tag Map Customer Managed Urls Managed Url Entry\"] = column_ifexists('tagMap_CustomerManagedUrls_ManagedUrlEntry', ''),\n [\"Tag Map Customer Managed Urls Blocklisted\"] = column_ifexists('tagMap_CustomerManagedUrls_Blocklisted', ''),\n [\"Tag Map Av Scanning Content Check Av Signature Name\"] = column_ifexists('tagMap_AvScanning_ContentCheck_AvSignatureName', ''),\n [\"Tag Map Av Scanning Scanner Info Category Trigger\"] = column_ifexists('tagMap_AvScanning_ScannerInfo_CategoryTrigger', ''),\n [\"Tag Map Av Scanning Content Check Av Signature File Exts\"] = column_ifexists('tagMap_AvScanning_ContentCheck_AvSignatureFileExts', ''),\n [\"Tag Map Av Scanning Content Check Url File Download Filename\"] = column_ifexists('tagMap_AvScanning_ContentCheck_UrlFileDownloadFilename', ''),\n [\"Tag Map Dangerous File Ext Status\"] = column_ifexists('tagMap_DangerousFileExt_Status', ''),\n [\"Tag Map Url Reputation Scan Status\"] = column_ifexists('tagMap_UrlReputationScan_Status', ''),\n [\"Tag Map ContentCheck Dangerous Mimetypes Url File Download\"] = column_ifexists('tagMap_ContentCheck_DangerousMimetypesUrlFileDownload', ''),\n [\"Tag Map ContentCheck Dangerous Exts Url File Download\"] = column_ifexists('tagMap_ContentCheck_DangerousExtsUrlFileDownload', ''),\n [\"Mimecast Event Id\"] = column_ifexists('mimecastEventId', ''),\n [\"Mimecast Event Category_\"] = column_ifexists('mimecastEventCategory', ''),\n [\"Tag Map Customer Managed Urls Status\"] = column_ifexists('tagMap_CustomerManagedUrls_Status', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Category\"],\n [\"Time Generated\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"User Email Address\"],\n [\"From User Email Address\"],\n [\"Url\"],\n [\"Ttp Definition\"],\n [\"Subject\"],\n [\"Action\"],\n [\"Admin Override\"],\n [\"User Override\"],\n [\"Scan Result\"],\n [\"Sending IP\"],\n [\"User Awareness Action\"],\n ['Event Time'],\n [\"Actions\"],\n [\"Route\"],\n [\"Creation Method\"],\n [\"Email Parts Description\"],\n [\"Message ID\"],\n [\"Tag Map Dangerous File Ext Content Check Dangerous Mimetypes Url File Download\"],\n [\"Tag Map Dangerous File Ext Content Check Dangerous Exts Url File Download\"],\n [\"Tag Map Advanced Phishing Credential Theft Evidence\"],\n [\"Tag Map Advanced Phishing Credential Theft Tags\"],\n [\"Advanced Phishing Result Credential Theft Brands\"],\n [\"Advanced Phishing Result Credential Theft Evidence\"],\n [\"Advanced Phishing Result Credential Theft Tags\"],\n [\"Tag Map Url Reputation Scan Type\"],\n [\"Tag Map Url Reputation Scan Url\"],\n [\"Tag Map Dangerous File Ext Inspect File Exts\"],\n [\"Tag Map Dangerous File Ext Inspect Mime Types\"],\n [\"Tag Map Dangerous File Ext Content Check Content Scanners Blocked\"],\n [\"Tag Map Url Reputation Scan Url Block\"],\n [\"Tag Map Customer Managed Urls Managed Url Entry\"],\n [\"Tag Map Customer Managed Urls Blocklisted\"],\n [\"Tag Map Av Scanning Content Check Av Signature Name\"],\n [\"Tag Map Av Scanning Scanner Info Category Trigger\"],\n [\"Tag Map Av Scanning Content Check Av Signature File Exts\"],\n [\"Tag Map Av Scanning Content Check Url File Download Filename\"],\n [\"Type\"],\n [\"Tag Map Dangerous File Ext Status\"],\n [\"Tag Map Url Reputation Scan Status\"],\n [\"Tag Map ContentCheck Dangerous Mimetypes Url File Download\"],\n [\"Tag Map ContentCheck Dangerous Exts Url File Download\"],\n [\"Mimecast Event Id\"],\n [\"Mimecast Event Category_\"],\n [\"Tag Map Customer Managed Urls Status\"]\n};\nMimecastTTPUrl\n", + "functionAlias": "MimecastCG", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet MimecastCG_view = view() {\nunion isfuzzy=true dummy_table,\nSeg_Cg_CL\n| extend \n [\"Time Generated\"] = column_ifexists(\"TimeGenerated\", \"\"),\n [\"Url Category\"] = column_ifexists(\"urlCategory\", \"\"),\n [\"Scan Results\"] = column_ifexists(\"scanResults\", \"\"),\n [\"File Name\"] = column_ifexists(\"fileName\", \"\"),\n [\"Sha256\"] = column_ifexists(\"sha256\", \"\"),\n [\"File Extension\"] = column_ifexists(\"fileExtension\", \"\"),\n [\"Virus Found\"] = column_ifexists(\"virusFound\", \"\"),\n [\"Sha1\"] = column_ifexists(\"sha1\", \"\"),\n [\"Sender Domain\"] = column_ifexists(\"senderDomain\", \"\"),\n [\"Md5\"] = column_ifexists(\"md5\", \"\"),\n [\"Custom Threat Dictionary\"] = column_ifexists(\"customThreatDictionary\", \"\"),\n [\"Items Detected\"] = column_ifexists(\"itemsDetected\", \"\"),\n [\"Similar Custom External Domain\"] = column_ifexists(\"similarCustomExternalDomain\", \"\"),\n [\"Tagged External\"] = column_ifexists(\"taggedExternal\", \"\"),\n [\"Similar Internal Domain\"] = column_ifexists(\"similarInternalDomain\", \"\"),\n [\"New Domain\"] = column_ifexists(\"newDomain\", \"\"),\n [\"Internal User Name\"] = column_ifexists(\"internalUserName\", \"\"),\n [\"Mimecast Threat Dictionary\"] = column_ifexists(\"mimecastThreatDictionary\", \"\"),\n [\"Similar Mimecast External Domain\"] = column_ifexists(\"similarMimecastExternalDomain\", \"\"),\n [\"Custom Name Match\"] = column_ifexists(\"customNameMatch\", \"\"),\n [\"Tagged Malicious\"] = column_ifexists(\"taggedMalicious\", \"\"),\n [\"Reply Mismatch\"] = column_ifexists(\"replyMismatch\", \"\"),\n [\"Aggregate ID S\"] = column_ifexists(\"aggregateId\", \"\"),\n [\"Aggregate ID G\"] = column_ifexists(\"aggregateId\", \"\"),\n [\"Rejection Type\"] = column_ifexists(\"rejectionType\", \"\"),\n [\"Rejection Code\"] = column_ifexists(\"rejectionCode\", \"\"),\n [\"Rejection Info\"] = column_ifexists(\"rejectionInfo\", \"\"),\n [\"Delivered\"] = column_ifexists(\"delivered\", \"\"),\n [\"Destination IP\"] = column_ifexists(\"destinationIp\", \"\"),\n [\"Host Name\"] = column_ifexists(\"Hostname\", \"\"),\n [\"Delivery Attempts\"] = column_ifexists(\"deliveryAttempts\", \"\"),\n [\"TLS Used\"] = column_ifexists(\"tlsUsed\", \"\"),\n [\"Delivery Errors\"] = column_ifexists(\"deliveryErrors\", \"\"),\n [\"Attachments\"] = column_ifexists(\"attachments\", \"\"),\n [\"Route\"] = column_ifexists(\"route\", \"\"),\n [\"Processing ID\"] = column_ifexists(\"processingId\", \"\"),\n [\"Account ID\"] = column_ifexists(\"accountId\", \"\"),\n [\"Action\"] = column_ifexists(\"action\", \"\"),\n [\"Event Time\"] = column_ifexists(\"timestamp\", \"\"),\n [\"Sender Envelope\"] = column_ifexists(\"senderEnvelope\", \"\"),\n [\"Message ID\"] = column_ifexists(\"messageId\", \"\"),\n [\"Subject\"] = column_ifexists(\"subject\", \"\"),\n [\"Total of Size Attachments\"] = column_ifexists(\"totalSizeAttachments\", \"\"),\n [\"Number of Attachments\"] = column_ifexists(\"numberAttachments\", \"\"),\n [\"Email Size\"] = column_ifexists(\"emailSize\", \"\"),\n [\"Type\"] = column_ifexists(\"Logtype\", \"\"),\n [\"Sub Type\"] = column_ifexists(\"subtype\", \"\"),\n [\"Monitored Domain Source\"] = column_ifexists(\"monitoredDomainSource\", \"\"),\n [\"Similar Domain\"] = column_ifexists(\"similarDomain\", \"\"),\n [\"Offset\"] = column_ifexists(\"offset\", \"\"),\n [\"Partition\"] = column_ifexists(\"partition\", \"\"),\n [\"Hold Reason\"] = column_ifexists(\"holdReason\", \"\"),\n [\"Recipients\"] = column_ifexists(\"recipients\", \"\"),\n [\"Sender IP\"] = column_ifexists(\"senderIp\", \"\"),\n [\"Direction\"] = column_ifexists(\"direction\", \"\"),\n [\"Sender Header\"] = column_ifexists(\"senderHeader\", \"\"),\n [\"TLS Version\"] = column_ifexists(\"tlsVersion\", \"\"),\n [\"TLS Cipher\"] = column_ifexists(\"tlsCipher\", \"\"),\n [\"Spam Info\"] = column_ifexists(\"spamInfo\", \"\"),\n [\"Spam Processing Detail\"] = column_ifexists(\"spamProcessingDetail\", \"\")\n| summarize arg_max([\"Time Generated\"], *) by \n [\"Url Category\"],\n [\"Scan Results\"],\n [\"File Name\"],\n [\"Sha256\"],\n [\"File Extension\"],\n [\"Virus Found\"],\n [\"Sha1\"],\n [\"Sender Domain\"],\n [\"Md5\"],\n [\"Custom Threat Dictionary\"],\n [\"Items Detected\"],\n [\"Similar Custom External Domain\"],\n [\"Tagged External\"],\n [\"Similar Internal Domain\"],\n [\"New Domain\"],\n [\"Internal User Name\"],\n [\"Mimecast Threat Dictionary\"],\n [\"Similar Mimecast External Domain\"],\n [\"Custom Name Match\"],\n [\"Tagged Malicious\"],\n [\"Reply Mismatch\"],\n [\"Aggregate ID\"] = coalesce([\"Aggregate ID S\"], [\"Aggregate ID G\"]),\n [\"Rejection Type\"],\n [\"Rejection Code\"],\n [\"Rejection Info\"],\n [\"Delivered\"],\n [\"Destination IP\"],\n [\"Host Name\"],\n [\"Delivery Attempts\"],\n [\"TLS Used\"],\n [\"Delivery Errors\"],\n [\"Attachments\"],\n [\"Route\"],\n [\"Processing ID\"],\n [\"Account ID\"],\n [\"Action\"],\n [\"Event Time\"],\n [\"Sender Envelope\"],\n [\"Message ID\"],\n [\"Subject\"],\n [\"Total of Size Attachments\"],\n [\"Number of Attachments\"],\n [\"Email Size\"],\n [\"Type\"],\n [\"Sub Type\"],\n [\"Monitored Domain Source\"],\n [\"Similar Domain\"],\n [\"Hold Reason\"],\n [\"Recipients\"],\n [\"Sender IP\"],\n [\"Direction\"],\n [\"Sender Header\"],\n [\"TLS Version\"],\n [\"TLS Cipher\"],\n [\"Spam Info\"],\n [\"Spam Processing Detail\"]\n| extend ['Event Time'] = iff( isempty( ['Event Time']) ,now() , todatetime(unixtime_milliseconds_todatetime( tolong([\"Event Time\"]) )) )\n| extend ['Message ID'] = trim(@\"[\\<\\>]\", ['Message ID'] )\n| project \n [\"Time Generated\"],\n [\"Url Category\"],\n [\"Scan Results\"],\n [\"File Name\"],\n [\"Sha256\"],\n [\"File Extension\"],\n [\"Virus Found\"],\n [\"Sha1\"],\n [\"Sender Domain\"],\n [\"Md5\"],\n [\"Custom Threat Dictionary\"],\n [\"Items Detected\"],\n [\"Similar Custom External Domain\"],\n [\"Tagged External\"],\n [\"Similar Internal Domain\"],\n [\"New Domain\"],\n [\"Internal User Name\"],\n [\"Mimecast Threat Dictionary\"],\n [\"Similar Mimecast External Domain\"],\n [\"Custom Name Match\"],\n [\"Tagged Malicious\"],\n [\"Reply Mismatch\"],\n [\"Aggregate ID\"] = coalesce([\"Aggregate ID S\"], [\"Aggregate ID G\"]),\n [\"Rejection Type\"],\n [\"Rejection Code\"],\n [\"Rejection Info\"],\n [\"Delivered\"],\n [\"Destination IP\"],\n [\"Host Name\"],\n [\"Delivery Attempts\"],\n [\"TLS Used\"],\n [\"Delivery Errors\"],\n [\"Attachments\"],\n [\"Route\"],\n [\"Processing ID\"],\n [\"Account ID\"],\n [\"Action\"],\n [\"Event Time\"] ,\n [\"Sender Envelope\"],\n [\"Message ID\"],\n [\"Subject\"],\n [\"Total of Size Attachments\"],\n [\"Number of Attachments\"],\n [\"Email Size\"],\n [\"Type\"],\n [\"Sub Type\"],\n [\"Monitored Domain Source\"],\n [\"Similar Domain\"],\n [\"Offset\"],\n [\"Partition\"],\n [\"Hold Reason\"],\n [\"Recipients\"],\n [\"Sender IP\"],\n [\"Direction\"],\n [\"Sender Header\"],\n [\"TLS Version\"],\n [\"TLS Cipher\"],\n [\"Spam Info\"],\n [\"Spam Processing Detail\"]\n};\nMimecastCG_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4628,7 +4790,7 @@ "[variables('parserObject11')._parserId11]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPUrl')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastCG')]", "contentId": "[variables('parserObject11').parserContentId11]", "kind": "Parser", "version": "[variables('parserObject11').parserVersion11]", @@ -4652,189 +4814,55 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName1')]", + "name": "[variables('parserObject12').parserTemplateSpecName12]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast data connector with template version 3.1.0", + "description": "Mimecast_SEG_DLP Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion1')]", + "contentVersion": "[variables('parserObject12').parserVersion12]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "name": "[variables('parserObject12')._parserName12]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", "properties": { - "connectorUiConfig": { - "id": "[variables('_uiConfigId1')]", - "title": "Mimecast Awareness Training", - "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Awareness Training](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Targeted Threat Protection inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \n- Performance Details \n- Safe Score Details \n- User Data\n- Watchlist Details\n", - "graphQueries": [ - { - "metricName": "Total Performance Details data received", - "legend": "Awareness_Performance_Details_CL", - "baseQuery": "Awareness_Performance_Details_CL" - }, - { - "metricName": "Total Safe Score Details data received", - "legend": "Awareness_SafeScore_Details_CL", - "baseQuery": "Awareness_SafeScore_Details_CL" - }, - { - "metricName": "Total User Data received", - "legend": "Awareness_User_Data_CL", - "baseQuery": "Awareness_User_Data_CL" - }, - { - "metricName": "Total Watchlist Details data received", - "legend": "Awareness_Watchlist_Details_CL", - "baseQuery": "Awareness_Watchlist_Details_CL" - } - ], - "sampleQueries": [ - { - "description": "Awareness_Performance_Details_CL", - "query": "Awareness_Performance_Details_CL\n| sort by TimeGenerated desc" - }, - { - "description": "Awareness_SafeScore_Details_CL", - "query": "Awareness_SafeScore_Details_CL\n| sort by TimeGenerated desc" - }, - { - "description": "Awareness_User_Data_CL", - "query": "Awareness_User_Data_CL\n| sort by TimeGenerated desc" - }, - { - "description": "Awareness_Watchlist_Details_CL", - "query": "Awareness_User_Data_CL\n| sort by TimeGenerated desc" - } - ], - "dataTypes": [ - { - "name": "Awareness_Performance_Details_CL", - "lastDataReceivedQuery": "Awareness_Performance_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "Awareness_SafeScore_Details_CL", - "lastDataReceivedQuery": "Awareness_SafeScore_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "Awareness_User_Data_CL", - "lastDataReceivedQuery": "Awareness_User_Data_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "Awareness_Watchlist_Details_CL", - "lastDataReceivedQuery": "Awareness_Watchlist_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "Awareness_Performance_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Awareness_SafeScore_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Awareness_User_Data_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Awareness_Watchlist_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions on the workspace are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ], - "customs": [ - { - "name": "Azure Subscription", - "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." - }, - { - "name": "Microsoft.Web/sites permissions", - "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." - }, - { - "name": "REST API Credentials/permissions", - "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" - } - ] - }, - "instructionSteps": [ - { - "description": "You need to have a resource group created with a subscription you are going to use.", - "title": "Resource group" - }, - { - "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret\n5. Entra Object ID", - "title": "Functions app" - }, - { - "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." - }, - { - "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." - }, - { - "description": "**STEP 1 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" - }, - { - "description": "**STEP 2 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of Mimecast Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" - }, - { - "description": "**STEP 3 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" - }, - { - "description": "**STEP 4 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." - }, - { - "description": "Use this method for automated deployment of the Mimecast Awareness Training Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastAT-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastAT-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastAwarenessPerformanceDetailsTableName - Enter name of the table used to store Awareness Performance Details data. Default is 'Awareness_Performance_Details'\n\n\t k. MimecastAwarenessUserDataTableName - Enter name of the table used to store Awareness User Data data. Default is 'Awareness_User_Data'\n\n\t l. MimecastAwarenessWatchlistDetailsTableName - Enter name of the table used to store Awareness Watchlist Details data. Default is 'Awareness_Watchlist_Details'\n\n\t m. MimecastAwarenessSafeScoreDetailsTableName - Enter name of the table used to store Awareness SafeScore Details data. Default is 'Awareness_SafeScore_Details'\n\n\t n. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t o. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t p. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t q. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Azure Resource Manager (ARM) Template" - } - ] - } + "eTag": "*", + "displayName": "Parser for Mimecast SEG Data Leak Prevention", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MimecastDLP", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet MimecastSEG_view = view() {\nunion isfuzzy=true dummy_table,\nSeg_Dlp_CL\n| extend [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Event Time\"] = column_ifexists('eventTime', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Policy\"] = column_ifexists('policy', ''),\n [\"Action\"] = column_ifexists('action', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Time Generated\"] = column_ifexists('TimeGenerated', '')\n| summarize arg_max(TimeGenerated, *) by [\"Sender Address\"], [\"Recipient Address\"], [\"Subject\"], [\"Route\"], [\"Policy\"], [\"Action\"], [\"Event Time\"], [\"Message ID\"]\n| extend ['Event Time'] = iff( isempty( ['Event Time']) ,now() , todatetime( tolong([\"Event Time\"]) ) )\n| project [\"Time Generated\"], [\"Sender Address\"], [\"Recipient Address\"], [\"Subject\"], [\"Route\"], [\"Policy\"], [\"Action\"], [\"Event Time\"], [\"Message ID\"]\n};\nMimecastSEG_view\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject12')._parserId12,'/'))))]", + "dependsOn": [ + "[variables('parserObject12')._parserId12]" + ], "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastDLP')]", + "contentId": "[variables('parserObject12').parserContentId12]", + "kind": "Parser", + "version": "[variables('parserObject12').parserVersion12]", "source": { - "kind": "Solution", "name": "Mimecast", + "kind": "Solution", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -4856,27 +4884,48 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId1')]", - "contentKind": "DataConnector", - "displayName": "Mimecast Awareness Training", - "contentProductId": "[variables('_dataConnectorcontentProductId1')]", - "id": "[variables('_dataConnectorcontentProductId1')]", - "version": "[variables('dataConnectorVersion1')]" + "contentId": "[variables('parserObject12').parserContentId12]", + "contentKind": "Parser", + "displayName": "Parser for Mimecast SEG Data Leak Prevention", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject12').parserContentId12,'-', '1.0.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject12').parserContentId12,'-', '1.0.1')))]", + "version": "[variables('parserObject12').parserVersion12]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject12')._parserName12]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Mimecast SEG Data Leak Prevention", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MimecastDLP", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet MimecastSEG_view = view() {\nunion isfuzzy=true dummy_table,\nSeg_Dlp_CL\n| extend [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Event Time\"] = column_ifexists('eventTime', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Policy\"] = column_ifexists('policy', ''),\n [\"Action\"] = column_ifexists('action', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Time Generated\"] = column_ifexists('TimeGenerated', '')\n| summarize arg_max(TimeGenerated, *) by [\"Sender Address\"], [\"Recipient Address\"], [\"Subject\"], [\"Route\"], [\"Policy\"], [\"Action\"], [\"Event Time\"], [\"Message ID\"]\n| extend ['Event Time'] = iff( isempty( ['Event Time']) ,now() , todatetime( tolong([\"Event Time\"]) ) )\n| project [\"Time Generated\"], [\"Sender Address\"], [\"Recipient Address\"], [\"Subject\"], [\"Route\"], [\"Policy\"], [\"Action\"], [\"Event Time\"], [\"Message ID\"]\n};\nMimecastSEG_view\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject12')._parserId12,'/'))))]", "dependsOn": [ - "[variables('_dataConnectorId1')]" + "[variables('parserObject12')._parserId12]" ], - "location": "[parameters('workspace-location')]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastDLP')]", + "contentId": "[variables('parserObject12').parserContentId12]", + "kind": "Parser", + "version": "[variables('parserObject12').parserVersion12]", "source": { "kind": "Solution", "name": "Mimecast", @@ -4895,215 +4944,495 @@ } }, { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserObject13').parserTemplateSpecName13]", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "connectorUiConfig": { - "title": "Mimecast Awareness Training", - "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Awareness Training](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Targeted Threat Protection inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \n- Performance Details \n- Safe Score Details \n- User Data\n- Watchlist Details\n", - "graphQueries": [ - { - "metricName": "Total Performance Details data received", - "legend": "Awareness_Performance_Details_CL", - "baseQuery": "Awareness_Performance_Details_CL" - }, - { - "metricName": "Total Safe Score Details data received", - "legend": "Awareness_SafeScore_Details_CL", - "baseQuery": "Awareness_SafeScore_Details_CL" - }, - { - "metricName": "Total User Data received", - "legend": "Awareness_User_Data_CL", - "baseQuery": "Awareness_User_Data_CL" - }, - { - "metricName": "Total Watchlist Details data received", - "legend": "Awareness_Watchlist_Details_CL", - "baseQuery": "Awareness_Watchlist_Details_CL" - } - ], - "dataTypes": [ - { - "name": "Awareness_Performance_Details_CL", - "lastDataReceivedQuery": "Awareness_Performance_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "Awareness_SafeScore_Details_CL", - "lastDataReceivedQuery": "Awareness_SafeScore_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, + "description": "Mimecast_TTP_Attachment Data Parser with template version 3.1.1", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserObject13').parserVersion13]", + "parameters": {}, + "variables": {}, + "resources": [ { - "name": "Awareness_User_Data_CL", - "lastDataReceivedQuery": "Awareness_User_Data_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "name": "[variables('parserObject13')._parserName13]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Mimecast TTP ATTACHMENT", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MimecastTTPAttachment", + "query": "let dummy_table = datatable(\n TimeGenerated: datetime,\n senderAddress: string,\n recipientAddress: string,\n messageId: string\n) [];\nlet MimecastTTPAttachment = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Attachment_CL\n | summarize arg_max(TimeGenerated, *) by senderAddress, recipientAddress, messageId\n | extend\n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Mimecast Event ID\"] = 'ttp_attachment',\n [\"Mimecast Event Category\"] = 'ttp_attachment',\n [\"Action Triggered\"] = column_ifexists('actionTriggered', ''),\n [\"Event Time\"] = column_ifexists('Date', ''),\n [\"Definition\"] = column_ifexists('definition', ''),\n [\"Details\"] = column_ifexists('details', ''),\n [\"File Hash\"] = column_ifexists('fileHash', ''),\n [\"File Name\"] = column_ifexists('fileName', ''),\n [\"File Type\"] = column_ifexists('fileType', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Result\"] = column_ifexists('result', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Subject\"] = column_ifexists('subject', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Time Generated\"],\n [\"Type\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"Action Triggered\"],\n [\"Event Time\"],\n [\"Definition\"],\n [\"Details\"],\n [\"File Hash\"],\n [\"File Name\"],\n [\"File Type\"],\n [\"Message ID\"],\n [\"Recipient Address\"],\n [\"Result\"],\n [\"Route\"],\n [\"Sender Address\"],\n [\"Subject\"] \n};\nMimecastTTPAttachment\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } }, { - "name": "Awareness_Watchlist_Details_CL", - "lastDataReceivedQuery": "Awareness_Watchlist_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "Awareness_Performance_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Awareness_SafeScore_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Awareness_User_Data_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Awareness_Watchlist_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject13')._parserId13,'/'))))]", + "dependsOn": [ + "[variables('parserObject13')._parserId13]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPAttachment')]", + "contentId": "[variables('parserObject13').parserContentId13]", + "kind": "Parser", + "version": "[variables('parserObject13').parserVersion13]", + "source": { + "name": "Mimecast", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + } + } } - ], - "sampleQueries": [ - { - "description": "Awareness_Performance_Details_CL", - "query": "Awareness_Performance_Details_CL\n| sort by TimeGenerated desc" - }, - { - "description": "Awareness_SafeScore_Details_CL", - "query": "Awareness_SafeScore_Details_CL\n| sort by TimeGenerated desc" - }, + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject13').parserContentId13]", + "contentKind": "Parser", + "displayName": "Parser for Mimecast TTP ATTACHMENT", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject13').parserContentId13,'-', '1.0.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject13').parserContentId13,'-', '1.0.1')))]", + "version": "[variables('parserObject13').parserVersion13]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject13')._parserName13]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Mimecast TTP ATTACHMENT", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MimecastTTPAttachment", + "query": "let dummy_table = datatable(\n TimeGenerated: datetime,\n senderAddress: string,\n recipientAddress: string,\n messageId: string\n) [];\nlet MimecastTTPAttachment = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Attachment_CL\n | summarize arg_max(TimeGenerated, *) by senderAddress, recipientAddress, messageId\n | extend\n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Mimecast Event ID\"] = 'ttp_attachment',\n [\"Mimecast Event Category\"] = 'ttp_attachment',\n [\"Action Triggered\"] = column_ifexists('actionTriggered', ''),\n [\"Event Time\"] = column_ifexists('Date', ''),\n [\"Definition\"] = column_ifexists('definition', ''),\n [\"Details\"] = column_ifexists('details', ''),\n [\"File Hash\"] = column_ifexists('fileHash', ''),\n [\"File Name\"] = column_ifexists('fileName', ''),\n [\"File Type\"] = column_ifexists('fileType', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Result\"] = column_ifexists('result', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Subject\"] = column_ifexists('subject', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Time Generated\"],\n [\"Type\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"Action Triggered\"],\n [\"Event Time\"],\n [\"Definition\"],\n [\"Details\"],\n [\"File Hash\"],\n [\"File Name\"],\n [\"File Type\"],\n [\"Message ID\"],\n [\"Recipient Address\"],\n [\"Result\"],\n [\"Route\"],\n [\"Sender Address\"],\n [\"Subject\"] \n};\nMimecastTTPAttachment\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject13')._parserId13,'/'))))]", + "dependsOn": [ + "[variables('parserObject13')._parserId13]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPAttachment')]", + "contentId": "[variables('parserObject13').parserContentId13]", + "kind": "Parser", + "version": "[variables('parserObject13').parserVersion13]", + "source": { + "kind": "Solution", + "name": "Mimecast", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserObject14').parserTemplateSpecName14]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Mimecast_TTP_Impersonation Data Parser with template version 3.1.1", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserObject14').parserVersion14]", + "parameters": {}, + "variables": {}, + "resources": [ { - "description": "Awareness_User_Data_CL", - "query": "Awareness_User_Data_CL\n| sort by TimeGenerated desc" + "name": "[variables('parserObject14')._parserName14]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Mimecast TTP Impersonation", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MimecastTTPImpersonation", + "query": "let dummy_table = datatable(TimeGenerated: datetime, id: string) [];\nlet MimecastTTPImpersonation = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Impersonation_CL\n | summarize arg_max(TimeGenerated, *) by id\n | extend \n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Mimecast Event ID\"] = 'ttp_impersonation',\n [\"Mimecast Event Category\"] = 'ttp_impersonation',\n [\"Action\"] = column_ifexists('action', ''),\n [\"Definition\"] = column_ifexists('definition', ''),\n [\"Event Time\"] = column_ifexists('eventTime', ''),\n [\"Hits\"] = column_ifexists('hits', ''),\n [\"ID\"] = column_ifexists('id', ''),\n [\"Identifiers\"] = column_ifexists('identifiers', ''),\n [\"Impersonation Results\"] = column_ifexists('impersonationResults', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Sender IP Address\"] = column_ifexists('senderIpAddress', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Tagged External\"] = column_ifexists('taggedExternal', ''),\n [\"Tagged Malicious\"] = column_ifexists('taggedMalicious', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Time Generated\"],\n [\"ID\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"Action\"],\n [\"Definition\"],\n [\"Event Time\"],\n [\"Hits\"],\n [\"Identifiers\"],\n [\"Impersonation Results\"],\n [\"Message ID\"],\n [\"Recipient Address\"],\n [\"Sender Address\"],\n [\"Sender IP Address\"],\n [\"Subject\"],\n [\"Tagged External\"],\n [\"Tagged Malicious\"],\n [\"Type\"] \n};\nMimecastTTPImpersonation\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } }, { - "description": "Awareness_Watchlist_Details_CL", - "query": "Awareness_User_Data_CL\n| sort by TimeGenerated desc" - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions on the workspace are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject14')._parserId14,'/'))))]", + "dependsOn": [ + "[variables('parserObject14')._parserId14]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPImpersonation')]", + "contentId": "[variables('parserObject14').parserContentId14]", + "kind": "Parser", + "version": "[variables('parserObject14').parserVersion14]", + "source": { + "name": "Mimecast", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" } } - ], - "customs": [ - { - "name": "Azure Subscription", - "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." - }, - { - "name": "Microsoft.Web/sites permissions", - "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." - }, - { - "name": "REST API Credentials/permissions", - "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" - } - ] - }, - "instructionSteps": [ - { - "description": "You need to have a resource group created with a subscription you are going to use.", - "title": "Resource group" - }, - { - "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret\n5. Entra Object ID", - "title": "Functions app" - }, - { - "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." - }, - { - "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." - }, - { - "description": "**STEP 1 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" - }, - { - "description": "**STEP 2 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of Mimecast Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" - }, - { - "description": "**STEP 3 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" - }, - { - "description": "**STEP 4 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." - }, - { - "description": "Use this method for automated deployment of the Mimecast Awareness Training Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastAT-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastAT-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastAwarenessPerformanceDetailsTableName - Enter name of the table used to store Awareness Performance Details data. Default is 'Awareness_Performance_Details'\n\n\t k. MimecastAwarenessUserDataTableName - Enter name of the table used to store Awareness User Data data. Default is 'Awareness_User_Data'\n\n\t l. MimecastAwarenessWatchlistDetailsTableName - Enter name of the table used to store Awareness Watchlist Details data. Default is 'Awareness_Watchlist_Details'\n\n\t m. MimecastAwarenessSafeScoreDetailsTableName - Enter name of the table used to store Awareness SafeScore Details data. Default is 'Awareness_SafeScore_Details'\n\n\t n. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t o. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t p. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t q. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Azure Resource Manager (ARM) Template" } - ], - "id": "[variables('_uiConfigId1')]" + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject14').parserContentId14]", + "contentKind": "Parser", + "displayName": "Parser for Mimecast TTP Impersonation", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject14').parserContentId14,'-', '1.0.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject14').parserContentId14,'-', '1.0.1')))]", + "version": "[variables('parserObject14').parserVersion14]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject14')._parserName14]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Mimecast TTP Impersonation", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MimecastTTPImpersonation", + "query": "let dummy_table = datatable(TimeGenerated: datetime, id: string) [];\nlet MimecastTTPImpersonation = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Impersonation_CL\n | summarize arg_max(TimeGenerated, *) by id\n | extend \n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Mimecast Event ID\"] = 'ttp_impersonation',\n [\"Mimecast Event Category\"] = 'ttp_impersonation',\n [\"Action\"] = column_ifexists('action', ''),\n [\"Definition\"] = column_ifexists('definition', ''),\n [\"Event Time\"] = column_ifexists('eventTime', ''),\n [\"Hits\"] = column_ifexists('hits', ''),\n [\"ID\"] = column_ifexists('id', ''),\n [\"Identifiers\"] = column_ifexists('identifiers', ''),\n [\"Impersonation Results\"] = column_ifexists('impersonationResults', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Sender IP Address\"] = column_ifexists('senderIpAddress', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Tagged External\"] = column_ifexists('taggedExternal', ''),\n [\"Tagged Malicious\"] = column_ifexists('taggedMalicious', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Time Generated\"],\n [\"ID\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"Action\"],\n [\"Definition\"],\n [\"Event Time\"],\n [\"Hits\"],\n [\"Identifiers\"],\n [\"Impersonation Results\"],\n [\"Message ID\"],\n [\"Recipient Address\"],\n [\"Sender Address\"],\n [\"Sender IP Address\"],\n [\"Subject\"],\n [\"Tagged External\"],\n [\"Tagged Malicious\"],\n [\"Type\"] \n};\nMimecastTTPImpersonation\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject14')._parserId14,'/'))))]", + "dependsOn": [ + "[variables('parserObject14')._parserId14]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPImpersonation')]", + "contentId": "[variables('parserObject14').parserContentId14]", + "kind": "Parser", + "version": "[variables('parserObject14').parserVersion14]", + "source": { + "kind": "Solution", + "name": "Mimecast", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName2')]", + "name": "[variables('parserObject15').parserTemplateSpecName15]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast data connector with template version 3.1.0", + "description": "Mimecast_TTP_Url Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion2')]", + "contentVersion": "[variables('parserObject15').parserVersion15]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "name": "[variables('parserObject15')._parserName15]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", "properties": { - "connectorUiConfig": { - "id": "[variables('_uiConfigId2')]", - "title": "Mimecast Audit", + "eTag": "*", + "displayName": "Parser for Mimecast TTP URL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MimecastTTPUrl", + "query": "let dummy_table = datatable(\nTimeGenerated: datetime,\nuserEmailAddress: string,\nfromUserEmailAddress: string,\nmessageId: string,\nsendingIp: string,\nurl: string\n) [];\nlet MimecastTTPUrl = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Url_CL\n | summarize arg_max(TimeGenerated, *) by userEmailAddress, fromUserEmailAddress, sendingIp, messageId, url\n | extend \n [\"Category\"] = column_ifexists('category', ''),\n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Tag Map Dangerous File Ext Content Check Dangerous Mimetypes Url File Download\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_DangerousMimetypesUrlFileDownload', ''),\n [\"Tag Map Dangerous File Ext Content Check Dangerous Exts Url File Download\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_DangerousExtsUrlFileDownload', ''),\n [\"Tag Map Advanced Phishing Credential Theft Evidence\"] = column_ifexists('tagMap_AdvancedPhishing_CredentialTheftEvidence', ''),\n [\"Tag Map Advanced Phishing Credential Theft Tags\"] = column_ifexists('tagMap_AdvancedPhishing_CredentialTheftTags', ''),\n [\"Mimecast Event ID\"] = 'ttp_url',\n [\"Mimecast Event Category\"] = 'ttp_url',\n [\"Advanced Phishing Result Credential Theft Brands\"] = column_ifexists('advancedPhishingResult_CredentialTheftBrands', ''),\n [\"Advanced Phishing Result Credential Theft Evidence\"] = column_ifexists('advancedPhishingResult_CredentialTheftEvidence', ''),\n [\"Advanced Phishing Result Credential Theft Tags\"] = column_ifexists('advancedPhishingResult_CredentialTheftTags', ''),\n [\"Tag Map Url Reputation Scan Type\"] = column_ifexists('tagMap_UrlReputationScan_Type', ''),\n [\"Tag Map Url Reputation Scan Url\"] = column_ifexists('tagMap_UrlReputationScan_Url', ''),\n [\"Tag Map Dangerous File Ext Inspect File Exts\"] = column_ifexists('tagMap_DangerousFileExt_Inspect_FileExts', ''),\n [\"Tag Map Dangerous File Ext Inspect Mime Types\"] = column_ifexists('tagMap_DangerousFileExt_Inspect_MimeTypes', ''),\n [\"Tag Map Dangerous File Ext Content Check Content Scanners Blocked\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_ContentScannersBlocked', ''),\n [\"User Email Address\"] = column_ifexists('userEmailAddress', ''),\n [\"From User Email Address\"] = column_ifexists('fromUserEmailAddress', ''),\n [\"Url\"] = column_ifexists('url', ''),\n [\"Ttp Definition\"] = column_ifexists('ttpDefinition', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Action\"] = column_ifexists('action', ''),\n [\"Admin Override\"] = column_ifexists('adminOverride', ''),\n [\"User Override\"] = column_ifexists('userOverride', ''),\n [\"Scan Result\"] = column_ifexists('scanResult', ''),\n [\"Sending IP\"] = column_ifexists('sendingIp', ''),\n [\"User Awareness Action\"] = column_ifexists('userAwarenessAction', ''),\n ['Event Time'] = column_ifexists('Date', ''),\n [\"Actions\"] = column_ifexists('actions', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Creation Method\"] = column_ifexists('creationMethod', ''),\n [\"Email Parts Description\"] = column_ifexists('emailPartsDescription', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Tag Map Url Reputation Scan Url Block\"] = column_ifexists('tagMap_UrlReputationScan_UrlBlock', ''),\n [\"Tag Map Customer Managed Urls Managed Url Entry\"] = column_ifexists('tagMap_CustomerManagedUrls_ManagedUrlEntry', ''),\n [\"Tag Map Customer Managed Urls Blocklisted\"] = column_ifexists('tagMap_CustomerManagedUrls_Blocklisted', ''),\n [\"Tag Map Av Scanning Content Check Av Signature Name\"] = column_ifexists('tagMap_AvScanning_ContentCheck_AvSignatureName', ''),\n [\"Tag Map Av Scanning Scanner Info Category Trigger\"] = column_ifexists('tagMap_AvScanning_ScannerInfo_CategoryTrigger', ''),\n [\"Tag Map Av Scanning Content Check Av Signature File Exts\"] = column_ifexists('tagMap_AvScanning_ContentCheck_AvSignatureFileExts', ''),\n [\"Tag Map Av Scanning Content Check Url File Download Filename\"] = column_ifexists('tagMap_AvScanning_ContentCheck_UrlFileDownloadFilename', ''),\n [\"Tag Map Dangerous File Ext Status\"] = column_ifexists('tagMap_DangerousFileExt_Status', ''),\n [\"Tag Map Url Reputation Scan Status\"] = column_ifexists('tagMap_UrlReputationScan_Status', ''),\n [\"Tag Map ContentCheck Dangerous Mimetypes Url File Download\"] = column_ifexists('tagMap_ContentCheck_DangerousMimetypesUrlFileDownload', ''),\n [\"Tag Map ContentCheck Dangerous Exts Url File Download\"] = column_ifexists('tagMap_ContentCheck_DangerousExtsUrlFileDownload', ''),\n [\"Mimecast Event Id\"] = column_ifexists('mimecastEventId', ''),\n [\"Mimecast Event Category_\"] = column_ifexists('mimecastEventCategory', ''),\n [\"Tag Map Customer Managed Urls Status\"] = column_ifexists('tagMap_CustomerManagedUrls_Status', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Category\"],\n [\"Time Generated\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"User Email Address\"],\n [\"From User Email Address\"],\n [\"Url\"],\n [\"Ttp Definition\"],\n [\"Subject\"],\n [\"Action\"],\n [\"Admin Override\"],\n [\"User Override\"],\n [\"Scan Result\"],\n [\"Sending IP\"],\n [\"User Awareness Action\"],\n ['Event Time'],\n [\"Actions\"],\n [\"Route\"],\n [\"Creation Method\"],\n [\"Email Parts Description\"],\n [\"Message ID\"],\n [\"Tag Map Dangerous File Ext Content Check Dangerous Mimetypes Url File Download\"],\n [\"Tag Map Dangerous File Ext Content Check Dangerous Exts Url File Download\"],\n [\"Tag Map Advanced Phishing Credential Theft Evidence\"],\n [\"Tag Map Advanced Phishing Credential Theft Tags\"],\n [\"Advanced Phishing Result Credential Theft Brands\"],\n [\"Advanced Phishing Result Credential Theft Evidence\"],\n [\"Advanced Phishing Result Credential Theft Tags\"],\n [\"Tag Map Url Reputation Scan Type\"],\n [\"Tag Map Url Reputation Scan Url\"],\n [\"Tag Map Dangerous File Ext Inspect File Exts\"],\n [\"Tag Map Dangerous File Ext Inspect Mime Types\"],\n [\"Tag Map Dangerous File Ext Content Check Content Scanners Blocked\"],\n [\"Tag Map Url Reputation Scan Url Block\"],\n [\"Tag Map Customer Managed Urls Managed Url Entry\"],\n [\"Tag Map Customer Managed Urls Blocklisted\"],\n [\"Tag Map Av Scanning Content Check Av Signature Name\"],\n [\"Tag Map Av Scanning Scanner Info Category Trigger\"],\n [\"Tag Map Av Scanning Content Check Av Signature File Exts\"],\n [\"Tag Map Av Scanning Content Check Url File Download Filename\"],\n [\"Type\"],\n [\"Tag Map Dangerous File Ext Status\"],\n [\"Tag Map Url Reputation Scan Status\"],\n [\"Tag Map ContentCheck Dangerous Mimetypes Url File Download\"],\n [\"Tag Map ContentCheck Dangerous Exts Url File Download\"],\n [\"Mimecast Event Id\"],\n [\"Mimecast Event Category_\"],\n [\"Tag Map Customer Managed Urls Status\"]\n};\nMimecastTTPUrl\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject15')._parserId15,'/'))))]", + "dependsOn": [ + "[variables('parserObject15')._parserId15]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPUrl')]", + "contentId": "[variables('parserObject15').parserContentId15]", + "kind": "Parser", + "version": "[variables('parserObject15').parserVersion15]", + "source": { + "name": "Mimecast", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject15').parserContentId15]", + "contentKind": "Parser", + "displayName": "Parser for Mimecast TTP URL", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject15').parserContentId15,'-', '1.0.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject15').parserContentId15,'-', '1.0.1')))]", + "version": "[variables('parserObject15').parserVersion15]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject15')._parserName15]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Mimecast TTP URL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MimecastTTPUrl", + "query": "let dummy_table = datatable(\nTimeGenerated: datetime,\nuserEmailAddress: string,\nfromUserEmailAddress: string,\nmessageId: string,\nsendingIp: string,\nurl: string\n) [];\nlet MimecastTTPUrl = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Url_CL\n | summarize arg_max(TimeGenerated, *) by userEmailAddress, fromUserEmailAddress, sendingIp, messageId, url\n | extend \n [\"Category\"] = column_ifexists('category', ''),\n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Tag Map Dangerous File Ext Content Check Dangerous Mimetypes Url File Download\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_DangerousMimetypesUrlFileDownload', ''),\n [\"Tag Map Dangerous File Ext Content Check Dangerous Exts Url File Download\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_DangerousExtsUrlFileDownload', ''),\n [\"Tag Map Advanced Phishing Credential Theft Evidence\"] = column_ifexists('tagMap_AdvancedPhishing_CredentialTheftEvidence', ''),\n [\"Tag Map Advanced Phishing Credential Theft Tags\"] = column_ifexists('tagMap_AdvancedPhishing_CredentialTheftTags', ''),\n [\"Mimecast Event ID\"] = 'ttp_url',\n [\"Mimecast Event Category\"] = 'ttp_url',\n [\"Advanced Phishing Result Credential Theft Brands\"] = column_ifexists('advancedPhishingResult_CredentialTheftBrands', ''),\n [\"Advanced Phishing Result Credential Theft Evidence\"] = column_ifexists('advancedPhishingResult_CredentialTheftEvidence', ''),\n [\"Advanced Phishing Result Credential Theft Tags\"] = column_ifexists('advancedPhishingResult_CredentialTheftTags', ''),\n [\"Tag Map Url Reputation Scan Type\"] = column_ifexists('tagMap_UrlReputationScan_Type', ''),\n [\"Tag Map Url Reputation Scan Url\"] = column_ifexists('tagMap_UrlReputationScan_Url', ''),\n [\"Tag Map Dangerous File Ext Inspect File Exts\"] = column_ifexists('tagMap_DangerousFileExt_Inspect_FileExts', ''),\n [\"Tag Map Dangerous File Ext Inspect Mime Types\"] = column_ifexists('tagMap_DangerousFileExt_Inspect_MimeTypes', ''),\n [\"Tag Map Dangerous File Ext Content Check Content Scanners Blocked\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_ContentScannersBlocked', ''),\n [\"User Email Address\"] = column_ifexists('userEmailAddress', ''),\n [\"From User Email Address\"] = column_ifexists('fromUserEmailAddress', ''),\n [\"Url\"] = column_ifexists('url', ''),\n [\"Ttp Definition\"] = column_ifexists('ttpDefinition', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Action\"] = column_ifexists('action', ''),\n [\"Admin Override\"] = column_ifexists('adminOverride', ''),\n [\"User Override\"] = column_ifexists('userOverride', ''),\n [\"Scan Result\"] = column_ifexists('scanResult', ''),\n [\"Sending IP\"] = column_ifexists('sendingIp', ''),\n [\"User Awareness Action\"] = column_ifexists('userAwarenessAction', ''),\n ['Event Time'] = column_ifexists('Date', ''),\n [\"Actions\"] = column_ifexists('actions', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Creation Method\"] = column_ifexists('creationMethod', ''),\n [\"Email Parts Description\"] = column_ifexists('emailPartsDescription', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Tag Map Url Reputation Scan Url Block\"] = column_ifexists('tagMap_UrlReputationScan_UrlBlock', ''),\n [\"Tag Map Customer Managed Urls Managed Url Entry\"] = column_ifexists('tagMap_CustomerManagedUrls_ManagedUrlEntry', ''),\n [\"Tag Map Customer Managed Urls Blocklisted\"] = column_ifexists('tagMap_CustomerManagedUrls_Blocklisted', ''),\n [\"Tag Map Av Scanning Content Check Av Signature Name\"] = column_ifexists('tagMap_AvScanning_ContentCheck_AvSignatureName', ''),\n [\"Tag Map Av Scanning Scanner Info Category Trigger\"] = column_ifexists('tagMap_AvScanning_ScannerInfo_CategoryTrigger', ''),\n [\"Tag Map Av Scanning Content Check Av Signature File Exts\"] = column_ifexists('tagMap_AvScanning_ContentCheck_AvSignatureFileExts', ''),\n [\"Tag Map Av Scanning Content Check Url File Download Filename\"] = column_ifexists('tagMap_AvScanning_ContentCheck_UrlFileDownloadFilename', ''),\n [\"Tag Map Dangerous File Ext Status\"] = column_ifexists('tagMap_DangerousFileExt_Status', ''),\n [\"Tag Map Url Reputation Scan Status\"] = column_ifexists('tagMap_UrlReputationScan_Status', ''),\n [\"Tag Map ContentCheck Dangerous Mimetypes Url File Download\"] = column_ifexists('tagMap_ContentCheck_DangerousMimetypesUrlFileDownload', ''),\n [\"Tag Map ContentCheck Dangerous Exts Url File Download\"] = column_ifexists('tagMap_ContentCheck_DangerousExtsUrlFileDownload', ''),\n [\"Mimecast Event Id\"] = column_ifexists('mimecastEventId', ''),\n [\"Mimecast Event Category_\"] = column_ifexists('mimecastEventCategory', ''),\n [\"Tag Map Customer Managed Urls Status\"] = column_ifexists('tagMap_CustomerManagedUrls_Status', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Category\"],\n [\"Time Generated\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"User Email Address\"],\n [\"From User Email Address\"],\n [\"Url\"],\n [\"Ttp Definition\"],\n [\"Subject\"],\n [\"Action\"],\n [\"Admin Override\"],\n [\"User Override\"],\n [\"Scan Result\"],\n [\"Sending IP\"],\n [\"User Awareness Action\"],\n ['Event Time'],\n [\"Actions\"],\n [\"Route\"],\n [\"Creation Method\"],\n [\"Email Parts Description\"],\n [\"Message ID\"],\n [\"Tag Map Dangerous File Ext Content Check Dangerous Mimetypes Url File Download\"],\n [\"Tag Map Dangerous File Ext Content Check Dangerous Exts Url File Download\"],\n [\"Tag Map Advanced Phishing Credential Theft Evidence\"],\n [\"Tag Map Advanced Phishing Credential Theft Tags\"],\n [\"Advanced Phishing Result Credential Theft Brands\"],\n [\"Advanced Phishing Result Credential Theft Evidence\"],\n [\"Advanced Phishing Result Credential Theft Tags\"],\n [\"Tag Map Url Reputation Scan Type\"],\n [\"Tag Map Url Reputation Scan Url\"],\n [\"Tag Map Dangerous File Ext Inspect File Exts\"],\n [\"Tag Map Dangerous File Ext Inspect Mime Types\"],\n [\"Tag Map Dangerous File Ext Content Check Content Scanners Blocked\"],\n [\"Tag Map Url Reputation Scan Url Block\"],\n [\"Tag Map Customer Managed Urls Managed Url Entry\"],\n [\"Tag Map Customer Managed Urls Blocklisted\"],\n [\"Tag Map Av Scanning Content Check Av Signature Name\"],\n [\"Tag Map Av Scanning Scanner Info Category Trigger\"],\n [\"Tag Map Av Scanning Content Check Av Signature File Exts\"],\n [\"Tag Map Av Scanning Content Check Url File Download Filename\"],\n [\"Type\"],\n [\"Tag Map Dangerous File Ext Status\"],\n [\"Tag Map Url Reputation Scan Status\"],\n [\"Tag Map ContentCheck Dangerous Mimetypes Url File Download\"],\n [\"Tag Map ContentCheck Dangerous Exts Url File Download\"],\n [\"Mimecast Event Id\"],\n [\"Mimecast Event Category_\"],\n [\"Tag Map Customer Managed Urls Status\"]\n};\nMimecastTTPUrl\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject15')._parserId15,'/'))))]", + "dependsOn": [ + "[variables('parserObject15')._parserId15]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPUrl')]", + "contentId": "[variables('parserObject15').parserContentId15]", + "kind": "Parser", + "version": "[variables('parserObject15').parserVersion15]", + "source": { + "kind": "Solution", + "name": "Mimecast", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('dataConnectorTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Mimecast data connector with template version 3.1.1", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorVersion1')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "id": "[variables('_uiConfigId1')]", + "title": "Mimecast Awareness Training", "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Audit](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to audit and authentication events within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into user activity, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \nAudit\n ", + "descriptionMarkdown": "The data connector for [Mimecast Awareness Training](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Targeted Threat Protection inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \n- Performance Details \n- Safe Score Details \n- User Data\n- Watchlist Details\n", "graphQueries": [ { - "metricName": "Total Audit data received", - "legend": "Audit_CL", - "baseQuery": "Audit_CL" + "metricName": "Total Performance Details data received", + "legend": "Awareness_Performance_Details_CL", + "baseQuery": "Awareness_Performance_Details_CL" + }, + { + "metricName": "Total Safe Score Details data received", + "legend": "Awareness_SafeScore_Details_CL", + "baseQuery": "Awareness_SafeScore_Details_CL" + }, + { + "metricName": "Total User Data received", + "legend": "Awareness_User_Data_CL", + "baseQuery": "Awareness_User_Data_CL" + }, + { + "metricName": "Total Watchlist Details data received", + "legend": "Awareness_Watchlist_Details_CL", + "baseQuery": "Awareness_Watchlist_Details_CL" } ], "sampleQueries": [ { - "description": "Audit_CL", - "query": "Audit_CL\n| sort by TimeGenerated desc" + "description": "Awareness_Performance_Details_CL", + "query": "Awareness_Performance_Details_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Awareness_SafeScore_Details_CL", + "query": "Awareness_SafeScore_Details_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Awareness_User_Data_CL", + "query": "Awareness_User_Data_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Awareness_Watchlist_Details_CL", + "query": "Awareness_User_Data_CL\n| sort by TimeGenerated desc" } ], "dataTypes": [ { - "name": "Audit_CL", - "lastDataReceivedQuery": "Audit_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "name": "Awareness_Performance_Details_CL", + "lastDataReceivedQuery": "Awareness_Performance_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Awareness_SafeScore_Details_CL", + "lastDataReceivedQuery": "Awareness_SafeScore_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Awareness_User_Data_CL", + "lastDataReceivedQuery": "Awareness_User_Data_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Awareness_Watchlist_Details_CL", + "lastDataReceivedQuery": "Awareness_Watchlist_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ - "Audit_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + "Awareness_Performance_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Awareness_SafeScore_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Awareness_User_Data_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Awareness_Watchlist_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" ] } ], @@ -5151,30 +5480,34 @@ }, "instructionSteps": [ { - "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." + "description": "You need to have a resource group created with a subscription you are going to use.", + "title": "Resource group" }, { - "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret\n5. Entra Object ID", + "title": "Functions app" }, { - "description": "**STEP 1 - Configuration steps for the Mimecast API**\n\nGo to ***Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> New client secret*** and create a new secret (save the Value somewhere safe right away because you will not be able to preview it later)", - "title": "Configuration:" + "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." }, { - "description": "**STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." }, { - "description": "**STEP 3 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" + "description": "**STEP 1 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" }, { - "description": "**STEP 4 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of TenableVM Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" + "description": "**STEP 2 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of Mimecast Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" }, { - "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" + "description": "**STEP 3 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" }, { - "description": "Use this method for automated deployment of the Mimecast Audit Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastAuditAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastAuditAzureDeploy-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastAuditTableName - Enter name of the table used to store Audit data. Default is 'Audit'\n\n\t k. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t l. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t m. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t n. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Deploy the Mimecast Audit Data Connector:" + "description": "**STEP 4 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + }, + { + "description": "Use this method for automated deployment of the Mimecast Awareness Training Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastAT-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastAT-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastAwarenessPerformanceDetailsTableName - Enter name of the table used to store Awareness Performance Details data. Default is 'Awareness_Performance_Details'\n\n\t k. MimecastAwarenessUserDataTableName - Enter name of the table used to store Awareness User Data data. Default is 'Awareness_User_Data'\n\n\t l. MimecastAwarenessWatchlistDetailsTableName - Enter name of the table used to store Awareness Watchlist Details data. Default is 'Awareness_Watchlist_Details'\n\n\t m. MimecastAwarenessSafeScoreDetailsTableName - Enter name of the table used to store Awareness SafeScore Details data. Default is 'Awareness_SafeScore_Details'\n\n\t n. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t o. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t p. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t q. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "title": "Azure Resource Manager (ARM) Template" } ] } @@ -5183,12 +5516,12 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", - "contentId": "[variables('_dataConnectorContentId2')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "contentId": "[variables('_dataConnectorContentId1')]", "kind": "DataConnector", - "version": "[variables('dataConnectorVersion2')]", + "version": "[variables('dataConnectorVersion1')]", "source": { "kind": "Solution", "name": "Mimecast", @@ -5213,27 +5546,27 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId2')]", + "contentId": "[variables('_dataConnectorContentId1')]", "contentKind": "DataConnector", - "displayName": "Mimecast Audit", - "contentProductId": "[variables('_dataConnectorcontentProductId2')]", - "id": "[variables('_dataConnectorcontentProductId2')]", - "version": "[variables('dataConnectorVersion2')]" + "displayName": "Mimecast Awareness Training", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "dependsOn": [ - "[variables('_dataConnectorId2')]" + "[variables('_dataConnectorId1')]" ], "location": "[parameters('workspace-location')]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", - "contentId": "[variables('_dataConnectorContentId2')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "contentId": "[variables('_dataConnectorContentId1')]", "kind": "DataConnector", - "version": "[variables('dataConnectorVersion2')]", + "version": "[variables('dataConnectorVersion1')]", "source": { "kind": "Solution", "name": "Mimecast", @@ -5252,41 +5585,83 @@ } }, { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", "apiVersion": "2021-03-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "Mimecast Audit", + "title": "Mimecast Awareness Training", "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Audit](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to audit and authentication events within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into user activity, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \nAudit\n ", + "descriptionMarkdown": "The data connector for [Mimecast Awareness Training](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Targeted Threat Protection inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \n- Performance Details \n- Safe Score Details \n- User Data\n- Watchlist Details\n", "graphQueries": [ { - "metricName": "Total Audit data received", - "legend": "Audit_CL", - "baseQuery": "Audit_CL" - } - ], - "dataTypes": [ + "metricName": "Total Performance Details data received", + "legend": "Awareness_Performance_Details_CL", + "baseQuery": "Awareness_Performance_Details_CL" + }, { - "name": "Audit_CL", - "lastDataReceivedQuery": "Audit_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ + "metricName": "Total Safe Score Details data received", + "legend": "Awareness_SafeScore_Details_CL", + "baseQuery": "Awareness_SafeScore_Details_CL" + }, + { + "metricName": "Total User Data received", + "legend": "Awareness_User_Data_CL", + "baseQuery": "Awareness_User_Data_CL" + }, + { + "metricName": "Total Watchlist Details data received", + "legend": "Awareness_Watchlist_Details_CL", + "baseQuery": "Awareness_Watchlist_Details_CL" + } + ], + "dataTypes": [ + { + "name": "Awareness_Performance_Details_CL", + "lastDataReceivedQuery": "Awareness_Performance_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Awareness_SafeScore_Details_CL", + "lastDataReceivedQuery": "Awareness_SafeScore_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Awareness_User_Data_CL", + "lastDataReceivedQuery": "Awareness_User_Data_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Awareness_Watchlist_Details_CL", + "lastDataReceivedQuery": "Awareness_Watchlist_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ - "Audit_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + "Awareness_Performance_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Awareness_SafeScore_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Awareness_User_Data_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Awareness_Watchlist_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" ] } ], "sampleQueries": [ { - "description": "Audit_CL", - "query": "Audit_CL\n| sort by TimeGenerated desc" + "description": "Awareness_Performance_Details_CL", + "query": "Awareness_Performance_Details_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Awareness_SafeScore_Details_CL", + "query": "Awareness_SafeScore_Details_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Awareness_User_Data_CL", + "query": "Awareness_User_Data_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Awareness_Watchlist_Details_CL", + "query": "Awareness_User_Data_CL\n| sort by TimeGenerated desc" } ], "availability": { @@ -5333,88 +5708,92 @@ }, "instructionSteps": [ { - "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." + "description": "You need to have a resource group created with a subscription you are going to use.", + "title": "Resource group" }, { - "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret\n5. Entra Object ID", + "title": "Functions app" }, { - "description": "**STEP 1 - Configuration steps for the Mimecast API**\n\nGo to ***Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> New client secret*** and create a new secret (save the Value somewhere safe right away because you will not be able to preview it later)", - "title": "Configuration:" + "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." }, { - "description": "**STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." }, { - "description": "**STEP 3 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" + "description": "**STEP 1 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" }, { - "description": "**STEP 4 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of TenableVM Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" + "description": "**STEP 2 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of Mimecast Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" }, { - "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" + "description": "**STEP 3 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" }, { - "description": "Use this method for automated deployment of the Mimecast Audit Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastAuditAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastAuditAzureDeploy-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastAuditTableName - Enter name of the table used to store Audit data. Default is 'Audit'\n\n\t k. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t l. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t m. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t n. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Deploy the Mimecast Audit Data Connector:" + "description": "**STEP 4 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + }, + { + "description": "Use this method for automated deployment of the Mimecast Awareness Training Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastAT-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastAT-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastAwarenessPerformanceDetailsTableName - Enter name of the table used to store Awareness Performance Details data. Default is 'Awareness_Performance_Details'\n\n\t k. MimecastAwarenessUserDataTableName - Enter name of the table used to store Awareness User Data data. Default is 'Awareness_User_Data'\n\n\t l. MimecastAwarenessWatchlistDetailsTableName - Enter name of the table used to store Awareness Watchlist Details data. Default is 'Awareness_Watchlist_Details'\n\n\t m. MimecastAwarenessSafeScoreDetailsTableName - Enter name of the table used to store Awareness SafeScore Details data. Default is 'Awareness_SafeScore_Details'\n\n\t n. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t o. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t p. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t q. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "title": "Azure Resource Manager (ARM) Template" } ], - "id": "[variables('_uiConfigId2')]" + "id": "[variables('_uiConfigId1')]" } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName3')]", + "name": "[variables('dataConnectorTemplateSpecName2')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast data connector with template version 3.1.0", + "description": "Mimecast data connector with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion3')]", + "contentVersion": "[variables('dataConnectorVersion2')]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId3'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", "apiVersion": "2021-03-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", "kind": "GenericUI", "properties": { "connectorUiConfig": { - "id": "[variables('_uiConfigId3')]", - "title": "Mimecast Cloud Integrated", + "id": "[variables('_uiConfigId2')]", + "title": "Mimecast Audit", "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Cloud Integrated](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Cloud Integrated inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities.", + "descriptionMarkdown": "The data connector for [Mimecast Audit](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to audit and authentication events within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into user activity, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \nAudit\n ", "graphQueries": [ { - "metricName": "Total Cloud Integrated data received", - "legend": "Cloud_Integrated_CL", - "baseQuery": "Cloud_Integrated_CL" + "metricName": "Total Audit data received", + "legend": "Audit_CL", + "baseQuery": "Audit_CL" } ], "sampleQueries": [ { - "description": "Cloud_Integrated_CL", - "query": "Cloud_Integrated_CL\n| sort by TimeGenerated desc" + "description": "Audit_CL", + "query": "Audit_CL\n| sort by TimeGenerated desc" } ], "dataTypes": [ { - "name": "Cloud_Integrated_CL", - "lastDataReceivedQuery": "Cloud_Integrated_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "name": "Audit_CL", + "lastDataReceivedQuery": "Audit_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ - "Cloud_Integrated_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + "Audit_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" ] } ], @@ -5461,14 +5840,6 @@ ] }, "instructionSteps": [ - { - "description": "You need to have a resource group created with a subscription you are going to use.", - "title": "Resource group" - }, - { - "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret", - "title": "Functions app" - }, { "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." }, @@ -5492,8 +5863,8 @@ "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" }, { - "description": "Use this method for automated deployment of the Mimecast Cloud Integrated Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastCI-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastCI-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastCITableName - Enter name of the table used to store Cloud Integrated data. Default is 'Cloud_Integrated'\n\n\t k. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t l. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t m. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t n. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Azure Resource Manager (ARM) Template" + "description": "Use this method for automated deployment of the Mimecast Audit Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastAuditAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastAuditAzureDeploy-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastAuditTableName - Enter name of the table used to store Audit data. Default is 'Audit'\n\n\t k. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t l. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t m. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t n. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "title": "Deploy the Mimecast Audit Data Connector:" } ] } @@ -5502,12 +5873,12 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId3'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId3'))]", - "contentId": "[variables('_dataConnectorContentId3')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", "kind": "DataConnector", - "version": "[variables('dataConnectorVersion3')]", + "version": "[variables('dataConnectorVersion2')]", "source": { "kind": "Solution", "name": "Mimecast", @@ -5532,27 +5903,27 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId3')]", + "contentId": "[variables('_dataConnectorContentId2')]", "contentKind": "DataConnector", - "displayName": "Mimecast Cloud Integrated", - "contentProductId": "[variables('_dataConnectorcontentProductId3')]", - "id": "[variables('_dataConnectorcontentProductId3')]", - "version": "[variables('dataConnectorVersion3')]" + "displayName": "Mimecast Audit", + "contentProductId": "[variables('_dataConnectorcontentProductId2')]", + "id": "[variables('_dataConnectorcontentProductId2')]", + "version": "[variables('dataConnectorVersion2')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId3'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", "dependsOn": [ - "[variables('_dataConnectorId3')]" + "[variables('_dataConnectorId2')]" ], "location": "[parameters('workspace-location')]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId3'))]", - "contentId": "[variables('_dataConnectorContentId3')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", "kind": "DataConnector", - "version": "[variables('dataConnectorVersion3')]", + "version": "[variables('dataConnectorVersion2')]", "source": { "kind": "Solution", "name": "Mimecast", @@ -5571,41 +5942,41 @@ } }, { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId3'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", "apiVersion": "2021-03-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "Mimecast Cloud Integrated", + "title": "Mimecast Audit", "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Cloud Integrated](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Cloud Integrated inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities.", + "descriptionMarkdown": "The data connector for [Mimecast Audit](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to audit and authentication events within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into user activity, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \nAudit\n ", "graphQueries": [ { - "metricName": "Total Cloud Integrated data received", - "legend": "Cloud_Integrated_CL", - "baseQuery": "Cloud_Integrated_CL" + "metricName": "Total Audit data received", + "legend": "Audit_CL", + "baseQuery": "Audit_CL" } ], "dataTypes": [ { - "name": "Cloud_Integrated_CL", - "lastDataReceivedQuery": "Cloud_Integrated_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "name": "Audit_CL", + "lastDataReceivedQuery": "Audit_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ - "Cloud_Integrated_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + "Audit_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" ] } ], "sampleQueries": [ { - "description": "Cloud_Integrated_CL", - "query": "Cloud_Integrated_CL\n| sort by TimeGenerated desc" + "description": "Audit_CL", + "query": "Audit_CL\n| sort by TimeGenerated desc" } ], "availability": { @@ -5651,14 +6022,6 @@ ] }, "instructionSteps": [ - { - "description": "You need to have a resource group created with a subscription you are going to use.", - "title": "Resource group" - }, - { - "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret", - "title": "Functions app" - }, { "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." }, @@ -5682,80 +6045,66 @@ "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" }, { - "description": "Use this method for automated deployment of the Mimecast Cloud Integrated Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastCI-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastCI-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastCITableName - Enter name of the table used to store Cloud Integrated data. Default is 'Cloud_Integrated'\n\n\t k. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t l. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t m. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t n. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Azure Resource Manager (ARM) Template" + "description": "Use this method for automated deployment of the Mimecast Audit Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastAuditAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastAuditAzureDeploy-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastAuditTableName - Enter name of the table used to store Audit data. Default is 'Audit'\n\n\t k. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t l. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t m. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t n. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "title": "Deploy the Mimecast Audit Data Connector:" } ], - "id": "[variables('_uiConfigId3')]" + "id": "[variables('_uiConfigId2')]" } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName4')]", + "name": "[variables('dataConnectorTemplateSpecName3')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast data connector with template version 3.1.0", + "description": "Mimecast data connector with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion4')]", + "contentVersion": "[variables('dataConnectorVersion3')]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId4'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId3'))]", "apiVersion": "2021-03-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", "kind": "GenericUI", "properties": { "connectorUiConfig": { - "id": "[variables('_uiConfigId4')]", - "title": "Mimecast Secure Email Gateway", + "id": "[variables('_uiConfigId3')]", + "title": "Mimecast Cloud Integrated", "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Secure Email Gateway](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) allows easy log collection from the Secure Email Gateway to surface email insight and user activity within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. Mimecast products and features required: \n- Mimecast Cloud Gateway \n- Mimecast Data Leak Prevention\n ", + "descriptionMarkdown": "The data connector for [Mimecast Cloud Integrated](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Cloud Integrated inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities.", "graphQueries": [ { - "metricName": "Total Cloud Gateway data received", - "legend": "Seg_Cg_CL", - "baseQuery": "Seg_Cg_CL" - }, - { - "metricName": "Total Data Leak Prevention data received", - "legend": "Seg_Dlp_CL", - "baseQuery": "Seg_Dlp_CL" + "metricName": "Total Cloud Integrated data received", + "legend": "Cloud_Integrated_CL", + "baseQuery": "Cloud_Integrated_CL" } ], "sampleQueries": [ { - "description": "Seg_Cg_CL", - "query": "Seg_Cg_CL\n| sort by TimeGenerated desc" - }, - { - "description": "Seg_Dlp_CL", - "query": "Seg_Dlp_CL\n| sort by TimeGenerated desc" + "description": "Cloud_Integrated_CL", + "query": "Cloud_Integrated_CL\n| sort by TimeGenerated desc" } ], "dataTypes": [ { - "name": "Seg_Cg_CL", - "lastDataReceivedQuery": "Seg_Cg_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "Seg_Dlp_CL", - "lastDataReceivedQuery": "Seg_Dlp_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "name": "Cloud_Integrated_CL", + "lastDataReceivedQuery": "Cloud_Integrated_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ - "Seg_Cg_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Seg_Dlp_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + "Cloud_Integrated_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" ] } ], @@ -5802,6 +6151,14 @@ ] }, "instructionSteps": [ + { + "description": "You need to have a resource group created with a subscription you are going to use.", + "title": "Resource group" + }, + { + "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret", + "title": "Functions app" + }, { "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." }, @@ -5813,7 +6170,7 @@ "title": "Configuration:" }, { - "description": "****STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + "description": "**STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." }, { "description": "**STEP 3 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" @@ -5825,8 +6182,8 @@ "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" }, { - "description": "Use this method for automated deployment of the Mimecast Secure Email Gateway Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastSEGAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastSEGAzureDeploy-azuredeploy-gov)\n2. SSelect the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastCGTableName - Enter name of the table used to store CG data. Default is 'Seg_Cg'\n\n\t k. MimecastDLPTableName - Enter name of the table used to store DLP data. Default is 'Seg_Dlp'\n\n\t l. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t m. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t n. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t o. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Deploy the Mimecast Secure Email Gateway Data Connector:" + "description": "Use this method for automated deployment of the Mimecast Cloud Integrated Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastCI-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastCI-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastCITableName - Enter name of the table used to store Cloud Integrated data. Default is 'Cloud_Integrated'\n\n\t k. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t l. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t m. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t n. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "title": "Azure Resource Manager (ARM) Template" } ] } @@ -5835,12 +6192,12 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId4'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId3'),'/'))))]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId4'))]", - "contentId": "[variables('_dataConnectorContentId4')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId3'))]", + "contentId": "[variables('_dataConnectorContentId3')]", "kind": "DataConnector", - "version": "[variables('dataConnectorVersion4')]", + "version": "[variables('dataConnectorVersion3')]", "source": { "kind": "Solution", "name": "Mimecast", @@ -5865,27 +6222,27 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId4')]", + "contentId": "[variables('_dataConnectorContentId3')]", "contentKind": "DataConnector", - "displayName": "Mimecast Secure Email Gateway", - "contentProductId": "[variables('_dataConnectorcontentProductId4')]", - "id": "[variables('_dataConnectorcontentProductId4')]", - "version": "[variables('dataConnectorVersion4')]" - } + "displayName": "Mimecast Cloud Integrated", + "contentProductId": "[variables('_dataConnectorcontentProductId3')]", + "id": "[variables('_dataConnectorcontentProductId3')]", + "version": "[variables('dataConnectorVersion3')]" + } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId4'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId3'),'/'))))]", "dependsOn": [ - "[variables('_dataConnectorId4')]" + "[variables('_dataConnectorId3')]" ], "location": "[parameters('workspace-location')]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId4'))]", - "contentId": "[variables('_dataConnectorContentId4')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId3'))]", + "contentId": "[variables('_dataConnectorContentId3')]", "kind": "DataConnector", - "version": "[variables('dataConnectorVersion4')]", + "version": "[variables('dataConnectorVersion3')]", "source": { "kind": "Solution", "name": "Mimecast", @@ -5904,55 +6261,41 @@ } }, { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId4'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId3'))]", "apiVersion": "2021-03-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "Mimecast Secure Email Gateway", + "title": "Mimecast Cloud Integrated", "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Secure Email Gateway](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) allows easy log collection from the Secure Email Gateway to surface email insight and user activity within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. Mimecast products and features required: \n- Mimecast Cloud Gateway \n- Mimecast Data Leak Prevention\n ", + "descriptionMarkdown": "The data connector for [Mimecast Cloud Integrated](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Cloud Integrated inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities.", "graphQueries": [ { - "metricName": "Total Cloud Gateway data received", - "legend": "Seg_Cg_CL", - "baseQuery": "Seg_Cg_CL" - }, - { - "metricName": "Total Data Leak Prevention data received", - "legend": "Seg_Dlp_CL", - "baseQuery": "Seg_Dlp_CL" + "metricName": "Total Cloud Integrated data received", + "legend": "Cloud_Integrated_CL", + "baseQuery": "Cloud_Integrated_CL" } ], "dataTypes": [ { - "name": "Seg_Cg_CL", - "lastDataReceivedQuery": "Seg_Cg_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "Seg_Dlp_CL", - "lastDataReceivedQuery": "Seg_Dlp_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "name": "Cloud_Integrated_CL", + "lastDataReceivedQuery": "Cloud_Integrated_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ - "Seg_Cg_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Seg_Dlp_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + "Cloud_Integrated_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" ] } ], "sampleQueries": [ { - "description": "Seg_Cg_CL", - "query": "Seg_Cg_CL\n| sort by TimeGenerated desc" - }, - { - "description": "Seg_Dlp_CL", - "query": "Seg_Dlp_CL\n| sort by TimeGenerated desc" + "description": "Cloud_Integrated_CL", + "query": "Cloud_Integrated_CL\n| sort by TimeGenerated desc" } ], "availability": { @@ -5998,6 +6341,14 @@ ] }, "instructionSteps": [ + { + "description": "You need to have a resource group created with a subscription you are going to use.", + "title": "Resource group" + }, + { + "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret", + "title": "Functions app" + }, { "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." }, @@ -6009,7 +6360,7 @@ "title": "Configuration:" }, { - "description": "****STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + "description": "**STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." }, { "description": "**STEP 3 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" @@ -6021,197 +6372,1560 @@ "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" }, { - "description": "Use this method for automated deployment of the Mimecast Secure Email Gateway Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastSEGAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastSEGAzureDeploy-azuredeploy-gov)\n2. SSelect the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastCGTableName - Enter name of the table used to store CG data. Default is 'Seg_Cg'\n\n\t k. MimecastDLPTableName - Enter name of the table used to store DLP data. Default is 'Seg_Dlp'\n\n\t l. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t m. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t n. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t o. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Deploy the Mimecast Secure Email Gateway Data Connector:" + "description": "Use this method for automated deployment of the Mimecast Cloud Integrated Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastCI-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastCI-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastCITableName - Enter name of the table used to store Cloud Integrated data. Default is 'Cloud_Integrated'\n\n\t k. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t l. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t m. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t n. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "title": "Azure Resource Manager (ARM) Template" } ], - "id": "[variables('_uiConfigId4')]" + "id": "[variables('_uiConfigId3')]" } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName5')]", + "name": "[variables('dataConnectorTemplateSpecName4')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast data connector with template version 3.1.0", + "description": "Mimecast data connector with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion5')]", + "contentVersion": "[variables('dataConnectorVersion4')]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId5'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId4'))]", "apiVersion": "2021-03-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "id": "[variables('_uiConfigId4')]", + "title": "Mimecast Secure Email Gateway", + "publisher": "Mimecast", + "descriptionMarkdown": "The data connector for [Mimecast Secure Email Gateway](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) allows easy log collection from the Secure Email Gateway to surface email insight and user activity within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. Mimecast products and features required: \n- Mimecast Cloud Gateway \n- Mimecast Data Leak Prevention\n ", + "graphQueries": [ + { + "metricName": "Total Cloud Gateway data received", + "legend": "Seg_Cg_CL", + "baseQuery": "Seg_Cg_CL" + }, + { + "metricName": "Total Data Leak Prevention data received", + "legend": "Seg_Dlp_CL", + "baseQuery": "Seg_Dlp_CL" + } + ], + "sampleQueries": [ + { + "description": "Seg_Cg_CL", + "query": "Seg_Cg_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Seg_Dlp_CL", + "query": "Seg_Dlp_CL\n| sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "Seg_Cg_CL", + "lastDataReceivedQuery": "Seg_Cg_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Seg_Dlp_CL", + "lastDataReceivedQuery": "Seg_Dlp_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "Seg_Cg_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Seg_Dlp_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions on the workspace are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "name": "Azure Subscription", + "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." + }, + { + "name": "Microsoft.Web/sites permissions", + "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." + }, + { + "name": "REST API Credentials/permissions", + "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." + }, + { + "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + }, + { + "description": "**STEP 1 - Configuration steps for the Mimecast API**\n\nGo to ***Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> New client secret*** and create a new secret (save the Value somewhere safe right away because you will not be able to preview it later)", + "title": "Configuration:" + }, + { + "description": "****STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + }, + { + "description": "**STEP 3 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" + }, + { + "description": "**STEP 4 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of TenableVM Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" + }, + { + "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" + }, + { + "description": "Use this method for automated deployment of the Mimecast Secure Email Gateway Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastSEGAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastSEGAzureDeploy-azuredeploy-gov)\n2. SSelect the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastCGTableName - Enter name of the table used to store CG data. Default is 'Seg_Cg'\n\n\t k. MimecastDLPTableName - Enter name of the table used to store DLP data. Default is 'Seg_Dlp'\n\n\t l. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t m. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t n. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t o. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "title": "Deploy the Mimecast Secure Email Gateway Data Connector:" + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId4'),'/'))))]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId4'))]", + "contentId": "[variables('_dataConnectorContentId4')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion4')]", + "source": { + "kind": "Solution", + "name": "Mimecast", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId4')]", + "contentKind": "DataConnector", + "displayName": "Mimecast Secure Email Gateway", + "contentProductId": "[variables('_dataConnectorcontentProductId4')]", + "id": "[variables('_dataConnectorcontentProductId4')]", + "version": "[variables('dataConnectorVersion4')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId4'),'/'))))]", + "dependsOn": [ + "[variables('_dataConnectorId4')]" + ], + "location": "[parameters('workspace-location')]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId4'))]", + "contentId": "[variables('_dataConnectorContentId4')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion4')]", + "source": { + "kind": "Solution", + "name": "Mimecast", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId4'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "title": "Mimecast Secure Email Gateway", + "publisher": "Mimecast", + "descriptionMarkdown": "The data connector for [Mimecast Secure Email Gateway](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) allows easy log collection from the Secure Email Gateway to surface email insight and user activity within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. Mimecast products and features required: \n- Mimecast Cloud Gateway \n- Mimecast Data Leak Prevention\n ", + "graphQueries": [ + { + "metricName": "Total Cloud Gateway data received", + "legend": "Seg_Cg_CL", + "baseQuery": "Seg_Cg_CL" + }, + { + "metricName": "Total Data Leak Prevention data received", + "legend": "Seg_Dlp_CL", + "baseQuery": "Seg_Dlp_CL" + } + ], + "dataTypes": [ + { + "name": "Seg_Cg_CL", + "lastDataReceivedQuery": "Seg_Cg_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Seg_Dlp_CL", + "lastDataReceivedQuery": "Seg_Dlp_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "Seg_Cg_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Seg_Dlp_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "sampleQueries": [ + { + "description": "Seg_Cg_CL", + "query": "Seg_Cg_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Seg_Dlp_CL", + "query": "Seg_Dlp_CL\n| sort by TimeGenerated desc" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions on the workspace are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "name": "Azure Subscription", + "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." + }, + { + "name": "Microsoft.Web/sites permissions", + "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." + }, + { + "name": "REST API Credentials/permissions", + "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." + }, + { + "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + }, + { + "description": "**STEP 1 - Configuration steps for the Mimecast API**\n\nGo to ***Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> New client secret*** and create a new secret (save the Value somewhere safe right away because you will not be able to preview it later)", + "title": "Configuration:" + }, + { + "description": "****STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + }, + { + "description": "**STEP 3 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" + }, + { + "description": "**STEP 4 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of TenableVM Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" + }, + { + "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" + }, + { + "description": "Use this method for automated deployment of the Mimecast Secure Email Gateway Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastSEGAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastSEGAzureDeploy-azuredeploy-gov)\n2. SSelect the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastCGTableName - Enter name of the table used to store CG data. Default is 'Seg_Cg'\n\n\t k. MimecastDLPTableName - Enter name of the table used to store DLP data. Default is 'Seg_Dlp'\n\n\t l. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t m. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t n. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t o. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "title": "Deploy the Mimecast Secure Email Gateway Data Connector:" + } + ], + "id": "[variables('_uiConfigId4')]" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('dataConnectorTemplateSpecName5')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Mimecast data connector with template version 3.1.1", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorVersion5')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId5'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "id": "[variables('_uiConfigId5')]", + "title": "Mimecast Targeted Threat Protection", + "publisher": "Mimecast", + "descriptionMarkdown": "The data connector for [Mimecast Targeted Threat Protection](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Targeted Threat Protection inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \n- URL Protect \n- Impersonation Protect \n- Attachment Protect\n", + "graphQueries": [ + { + "metricName": "Total URL Protect data received", + "legend": "Ttp_Url_CL", + "baseQuery": "Ttp_Url_CL" + }, + { + "metricName": "Total Attachment Protect data received", + "legend": "Ttp_Attachment_CL", + "baseQuery": "Ttp_Attachment_CL" + }, + { + "metricName": "Total Impersonation Protect data received", + "legend": "Ttp_Impersonation_CL", + "baseQuery": "Ttp_Impersonation_CL" + } + ], + "sampleQueries": [ + { + "description": "Ttp_Url_CL", + "query": "Ttp_Url_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Ttp_Attachment_CL", + "query": "Ttp_Attachment_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Ttp_Impersonation_CL", + "query": "Ttp_Impersonation_CL\n| sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "Ttp_Url_CL", + "lastDataReceivedQuery": "Ttp_Url_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Ttp_Attachment_CL", + "lastDataReceivedQuery": "Ttp_Attachment_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Ttp_Impersonation_CL", + "lastDataReceivedQuery": "Ttp_Impersonation_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "Ttp_Url_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Ttp_Attachment_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Ttp_Impersonation_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions on the workspace are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "name": "Azure Subscription", + "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." + }, + { + "name": "Microsoft.Web/sites permissions", + "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." + }, + { + "name": "REST API Credentials/permissions", + "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" + } + ] + }, + "instructionSteps": [ + { + "description": "You need to have a resource group created with a subscription you are going to use.", + "title": "Resource group" + }, + { + "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret", + "title": "Functions app" + }, + { + "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." + }, + { + "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + }, + { + "description": "**STEP 1 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" + }, + { + "description": "**STEP 2 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of Mimecast Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" + }, + { + "description": "**STEP 3 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" + }, + { + "description": "**STEP 4 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + }, + { + "description": "Use this method for automated deployment of the Mimecast Targeted Threat Protection Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastTTPAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastTTPAzureDeploy-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t k. MimecastTTPAttachmentTableName - Enter name of the table used to store TTP Attachment data. Default is 'Ttp_Attachment'\n\n\t l. MimecastTTPImpersonationTableName - Enter name of the table used to store TTP Impersonation data. Default is 'Ttp_Impersonation'\n\n\t m. MimecastTTPUrlTableName - Enter name of the table used to store TTP Attachment data. Default is 'Ttp_Url'\n\n\t n. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t l. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t o. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "title": "Azure Resource Manager (ARM) Template" + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId5'),'/'))))]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId5'))]", + "contentId": "[variables('_dataConnectorContentId5')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion5')]", + "source": { + "kind": "Solution", + "name": "Mimecast", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId5')]", + "contentKind": "DataConnector", + "displayName": "Mimecast Targeted Threat Protection", + "contentProductId": "[variables('_dataConnectorcontentProductId5')]", + "id": "[variables('_dataConnectorcontentProductId5')]", + "version": "[variables('dataConnectorVersion5')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId5'),'/'))))]", + "dependsOn": [ + "[variables('_dataConnectorId5')]" + ], + "location": "[parameters('workspace-location')]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId5'))]", + "contentId": "[variables('_dataConnectorContentId5')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion5')]", + "source": { + "kind": "Solution", + "name": "Mimecast", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId5'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "title": "Mimecast Targeted Threat Protection", + "publisher": "Mimecast", + "descriptionMarkdown": "The data connector for [Mimecast Targeted Threat Protection](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Targeted Threat Protection inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \n- URL Protect \n- Impersonation Protect \n- Attachment Protect\n", + "graphQueries": [ + { + "metricName": "Total URL Protect data received", + "legend": "Ttp_Url_CL", + "baseQuery": "Ttp_Url_CL" + }, + { + "metricName": "Total Attachment Protect data received", + "legend": "Ttp_Attachment_CL", + "baseQuery": "Ttp_Attachment_CL" + }, + { + "metricName": "Total Impersonation Protect data received", + "legend": "Ttp_Impersonation_CL", + "baseQuery": "Ttp_Impersonation_CL" + } + ], + "dataTypes": [ + { + "name": "Ttp_Url_CL", + "lastDataReceivedQuery": "Ttp_Url_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Ttp_Attachment_CL", + "lastDataReceivedQuery": "Ttp_Attachment_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Ttp_Impersonation_CL", + "lastDataReceivedQuery": "Ttp_Impersonation_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "Ttp_Url_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Ttp_Attachment_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Ttp_Impersonation_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "sampleQueries": [ + { + "description": "Ttp_Url_CL", + "query": "Ttp_Url_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Ttp_Attachment_CL", + "query": "Ttp_Attachment_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Ttp_Impersonation_CL", + "query": "Ttp_Impersonation_CL\n| sort by TimeGenerated desc" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions on the workspace are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "name": "Azure Subscription", + "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." + }, + { + "name": "Microsoft.Web/sites permissions", + "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." + }, + { + "name": "REST API Credentials/permissions", + "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" + } + ] + }, + "instructionSteps": [ + { + "description": "You need to have a resource group created with a subscription you are going to use.", + "title": "Resource group" + }, + { + "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret", + "title": "Functions app" + }, + { + "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." + }, + { + "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + }, + { + "description": "**STEP 1 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" + }, + { + "description": "**STEP 2 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of Mimecast Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" + }, + { + "description": "**STEP 3 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" + }, + { + "description": "**STEP 4 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + }, + { + "description": "Use this method for automated deployment of the Mimecast Targeted Threat Protection Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastTTPAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastTTPAzureDeploy-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t k. MimecastTTPAttachmentTableName - Enter name of the table used to store TTP Attachment data. Default is 'Ttp_Attachment'\n\n\t l. MimecastTTPImpersonationTableName - Enter name of the table used to store TTP Impersonation data. Default is 'Ttp_Impersonation'\n\n\t m. MimecastTTPUrlTableName - Enter name of the table used to store TTP Attachment data. Default is 'Ttp_Url'\n\n\t n. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t l. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t o. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "title": "Azure Resource Manager (ARM) Template" + } + ], + "id": "[variables('_uiConfigId5')]" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition6'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition6')]", + "displayName": "Mimecast Human Risk (via Codeless Connector Framework)", + "contentKind": "DataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition6'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "MimecastHumanRiskCCF", + "title": "Mimecast Human Risk (via Codeless Connector Framework)", + "publisher": "Mimecast", + "logo": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Mimecast.svg", + "descriptionMarkdown": "The data connector for [Mimecast Human Risk](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with visibility into the human risk posture of their organization within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view risk trends, understand which behaviors and attacks drive risk, and identify the individuals, departments and locations with the highest human risk. \nThe Mimecast Human Risk data included within the connector are: \n- Organization risk trends \n- Behaviors \n- Attacks \n- Individuals\n", + "graphQueriesTableName": "MimecastHumanRisk_Organization_CL", + "graphQueries": [ + { + "metricName": "Total organization risk records", + "legend": "Organization", + "baseQuery": "MimecastHumanRisk_Organization_CL" + }, + { + "metricName": "Total behavior records", + "legend": "Behaviors", + "baseQuery": "MimecastHumanRisk_Behaviors_CL" + }, + { + "metricName": "Total attack records", + "legend": "Attacks", + "baseQuery": "MimecastHumanRisk_Attacks_CL" + }, + { + "metricName": "Total individual risk records", + "legend": "Individuals", + "baseQuery": "MimecastHumanRisk_Individuals_CL" + } + ], + "sampleQueries": [ + { + "description": "Organization risk score by month (latest snapshot per month)", + "query": "MimecastHumanRisk_Organization_CL\n| summarize arg_max(TimeGenerated, *) by Month\n| project Month, HumanRiskScore, HumanRiskFactor, HumanRiskScoreTrend, AttackScore, AttackFactor\n| sort by Month desc" + }, + { + "description": "Latest behavior scores", + "query": "MimecastHumanRisk_Behaviors_CL\n| summarize arg_max(TimeGenerated, *) by BehaviorType\n| project BehaviorType, Score, Factor, EventCount, Trend, Events" + }, + { + "description": "Latest attack summary by type", + "query": "MimecastHumanRisk_Attacks_CL\n| summarize arg_max(TimeGenerated, *)\n| mv-expand AttackTypes\n| project AttackType = tostring(AttackTypes.type), AttackScore = toint(AttackTypes.attackScore), AttackTotal = toint(AttackTypes.attackTotal), Events = AttackTypes.events" + }, + { + "description": "Highest-risk individuals (latest snapshot)", + "query": "MimecastHumanRisk_Individuals_CL\n| summarize arg_max(TimeGenerated, *) by IndividualId\n| project DisplayName, EmailAddress, Department, Location, HumanRiskScore, HumanRiskFactor, AttackScore\n| top 50 by HumanRiskScore desc" + }, + { + "description": "Human risk score trend per individual", + "query": "MimecastHumanRisk_Individuals_CL\n| summarize Score = max(HumanRiskScore) by IndividualId, bin(TimeGenerated, 1d)\n| render timechart" + } + ], + "dataTypes": [ + { + "name": "MimecastHumanRisk_Organization_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Organization_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "MimecastHumanRisk_Behaviors_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Behaviors_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "MimecastHumanRisk_Attacks_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Attacks_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "MimecastHumanRisk_Individuals_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Individuals_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "status": 1, + "isPreview": true + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "Mimecast API 2.0 application", + "description": "A Mimecast API 2.0 application (Client ID and Client Secret) with the Human Risk READ permission." + } + ] + }, + "instructionSteps": [ + { + "title": "1. Create a Mimecast API 2.0 application", + "description": "1. Sign in to the Mimecast Administration Console.\n2. Go to **Integrations** > **API and Platform Integrations** and create (or open) an API 2.0 application.\n3. Grant the application the **Human Risk - Read** permission.\n4. Copy the **Client ID** and **Client Secret**.\n5. Identify your regional API base URL: `https://api.services.mimecast.com` (global), `https://uk-api.services.mimecast.com` (UK) or `https://us-api.services.mimecast.com` (US)." + }, + { + "title": "2. Connect", + "description": "Enter the details below and click Connect.", + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "Mimecast API Base URL", + "placeholder": "https://api.services.mimecast.com", + "type": "text", + "name": "mimecastBaseUrl", + "validations": { + "required": true + } + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Include https:// and do not add a trailing slash.", + "visible": true, + "inline": false + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Client ID", + "placeholder": "Mimecast API 2.0 Client ID", + "type": "text", + "name": "clientId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Client Secret", + "placeholder": "Mimecast API 2.0 Client Secret", + "type": "password", + "name": "clientSecret", + "validations": { + "required": true + } + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Use the Client ID and Client Secret from step 1.", + "visible": true, + "inline": false + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Months of data to request", + "placeholder": "3", + "type": "number", + "name": "monthsBack", + "defaultValue": "3", + "validations": { + "required": true + }, + "toolTip": "Minimum value is 1 (maximum accepted by the Mimecast API is 12)." + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Whole number of months, minimum 1 (the Mimecast API accepts 1 to 12; default 3), sent as monthsBack to the organization, behaviors and attacks endpoints. For behaviors and attacks it counts calendar months from the 1st of the starting month through today (1 = month-to-date). It does not apply to the individuals search.", + "visible": true, + "inline": false + } + }, + { + "type": "Dropdown", + "parameters": { + "label": "Polling interval", + "name": "pollingInterval", + "options": [ + { + "key": "60", + "text": "1 hour" + }, + { + "key": "240", + "text": "4 hours" + }, + { + "key": "480", + "text": "8 hours" + }, + { + "key": "720", + "text": "12 hours" + }, + { + "key": "1440", + "text": "24 hours" + }, + { + "key": "2880", + "text": "48 hours" + }, + { + "key": "10080", + "text": "7 days" + } + ], + "placeholder": "Select polling interval (recommended: 12 hours)", + "isMultiSelect": false, + "defaultAllSelected": false, + "required": true, + "validations": { + "required": true + } + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Select how often Sentinel queries the Mimecast Human Risk API (12 hours is recommended). Each poll writes a new snapshot, so shorter intervals increase ingestion volume. The Mimecast rate limits are far above what this connector uses.", + "visible": true, + "inline": false + } + }, + { + "type": "ConnectionToggleButton", + "parameters": { + "connectLabel": "Connect", + "disconnectLabel": "Disconnect", + "name": "toggle" + } + } + ] + }, + { + "title": "3. Verify the connection (post deployment)", + "description": "After you click **Connect**, verify that the connector is working:\n1. The connector status changes to **Connected** and **Data received** shows the last received time. The first data can take up to 30 minutes to appear.\n2. In **Logs**, run the below query to confirm that data is arriving in all four tables:\n```\nunion withsource=TableName MimecastHumanRisk_Organization_CL, MimecastHumanRisk_Behaviors_CL, MimecastHumanRisk_Attacks_CL, MimecastHumanRisk_Individuals_CL\n| summarize Records = count(), LastReceived = max(TimeGenerated) by TableName\n```\n3. Confirm that the parsers return data, for example `MimecastHumanRiskIndividuals | take 10`.\n4. If a table stays empty, check the **Mimecast API Base URL**, the **Client ID**, the **Client Secret** and that the application has the **Human Risk - Read** permission, then disconnect and connect again.\n5. Each poll adds a new snapshot at the selected polling interval. Open the **Mimecast Human Risk Workbook** to view the latest data." + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition6')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition6'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition6')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections6')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "name": "MimecastHumanRiskDCR", + "apiVersion": "2022-06-01", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "[parameters('workspace-location')]", + "kind": "[variables('blanks')]", + "properties": { + "dataCollectionEndpointId": "[variables('dataCollectionEndpointId6')]", + "streamDeclarations": { + "Custom-MimecastHumanRisk_Organization_CL": { + "columns": [ + { + "name": "month", + "type": "string" + }, + { + "name": "humanRiskScore", + "type": "int" + }, + { + "name": "humanRiskFactor", + "type": "string" + }, + { + "name": "humanRiskScoreTrend", + "type": "int" + }, + { + "name": "attackScore", + "type": "int" + }, + { + "name": "attackFactor", + "type": "string" + }, + { + "name": "attackTrend", + "type": "int" + }, + { + "name": "attackTotal", + "type": "int" + }, + { + "name": "riskResponses", + "type": "int" + }, + { + "name": "totalActions", + "type": "int" + }, + { + "name": "notifications", + "type": "int" + }, + { + "name": "outboundActions", + "type": "int" + }, + { + "name": "groupChanges", + "type": "int" + } + ] + }, + "Custom-MimecastHumanRisk_Behaviors_CL": { + "columns": [ + { + "name": "type", + "type": "string" + }, + { + "name": "score", + "type": "int" + }, + { + "name": "factor", + "type": "string" + }, + { + "name": "eventCount", + "type": "int" + }, + { + "name": "trend", + "type": "int" + }, + { + "name": "events", + "type": "dynamic" + } + ] + }, + "Custom-MimecastHumanRisk_Attacks_CL": { + "columns": [ + { + "name": "attackScore", + "type": "int" + }, + { + "name": "attackFactor", + "type": "string" + }, + { + "name": "attackTypes", + "type": "dynamic" + } + ] + }, + "Custom-MimecastHumanRisk_Individuals_CL": { + "columns": [ + { + "name": "id", + "type": "string" + }, + { + "name": "displayName", + "type": "string" + }, + { + "name": "emailAddress", + "type": "string" + }, + { + "name": "firstName", + "type": "string" + }, + { + "name": "lastName", + "type": "string" + }, + { + "name": "managerName", + "type": "string" + }, + { + "name": "managerId", + "type": "string" + }, + { + "name": "department", + "type": "string" + }, + { + "name": "location", + "type": "string" + }, + { + "name": "jobTitle", + "type": "string" + }, + { + "name": "tenureMonths", + "type": "int" + }, + { + "name": "tenureStatus", + "type": "string" + }, + { + "name": "startDateTime", + "type": "string" + }, + { + "name": "humanRiskScore", + "type": "int" + }, + { + "name": "humanRiskFactor", + "type": "string" + }, + { + "name": "attackScore", + "type": "int" + }, + { + "name": "attackFactor", + "type": "string" + }, + { + "name": "behaviors", + "type": "dynamic" + }, + { + "name": "attacks", + "type": "dynamic" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "[variables('workspaceResourceId')]", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-MimecastHumanRisk_Organization_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | project TimeGenerated = now(), Month = month, HumanRiskScore = humanRiskScore, HumanRiskFactor = humanRiskFactor, HumanRiskScoreTrend = humanRiskScoreTrend, AttackScore = attackScore, AttackFactor = attackFactor, AttackTrend = attackTrend, AttackTotal = attackTotal, RiskResponses = riskResponses, TotalActions = totalActions, Notifications = notifications, OutboundActions = outboundActions, GroupChanges = groupChanges", + "outputStream": "Custom-MimecastHumanRisk_Organization_CL" + }, + { + "streams": [ + "Custom-MimecastHumanRisk_Behaviors_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | project TimeGenerated = now(), BehaviorType = type, Score = score, Factor = factor, EventCount = eventCount, Trend = trend, Events = events", + "outputStream": "Custom-MimecastHumanRisk_Behaviors_CL" + }, + { + "streams": [ + "Custom-MimecastHumanRisk_Attacks_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | project TimeGenerated = now(), AttackScore = attackScore, AttackFactor = attackFactor, AttackTypes = attackTypes", + "outputStream": "Custom-MimecastHumanRisk_Attacks_CL" + }, + { + "streams": [ + "Custom-MimecastHumanRisk_Individuals_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | project TimeGenerated = now(), IndividualId = id, DisplayName = displayName, EmailAddress = emailAddress, FirstName = firstName, LastName = lastName, ManagerName = managerName, ManagerId = managerId, Department = department, Location = location, JobTitle = jobTitle, TenureMonths = tenureMonths, TenureStatus = tenureStatus, StartDateTime = todatetime(startDateTime), HumanRiskScore = humanRiskScore, HumanRiskFactor = humanRiskFactor, AttackScore = attackScore, AttackFactor = attackFactor, Behaviors = behaviors, Attacks = attacks", + "outputStream": "Custom-MimecastHumanRisk_Individuals_CL" + } + ] + } + }, + { + "name": "MimecastHumanRisk_Organization_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, "properties": { - "connectorUiConfig": { - "id": "[variables('_uiConfigId5')]", - "title": "Mimecast Targeted Threat Protection", - "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Targeted Threat Protection](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Targeted Threat Protection inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \n- URL Protect \n- Impersonation Protect \n- Attachment Protect\n", - "graphQueries": [ + "schema": { + "name": "MimecastHumanRisk_Organization_CL", + "columns": [ { - "metricName": "Total URL Protect data received", - "legend": "Ttp_Url_CL", - "baseQuery": "Ttp_Url_CL" + "name": "TimeGenerated", + "type": "datetime", + "description": "Time the record was ingested" }, { - "metricName": "Total Attachment Protect data received", - "legend": "Ttp_Attachment_CL", - "baseQuery": "Ttp_Attachment_CL" + "name": "Month", + "type": "string", + "description": "Reporting month (YYYY-MM)" }, { - "metricName": "Total Impersonation Protect data received", - "legend": "Ttp_Impersonation_CL", - "baseQuery": "Ttp_Impersonation_CL" - } - ], - "sampleQueries": [ + "name": "HumanRiskScore", + "type": "int", + "description": "Organization human risk score (0-100)" + }, { - "description": "Ttp_Url_CL", - "query": "Ttp_Url_CL\n| sort by TimeGenerated desc" + "name": "HumanRiskFactor", + "type": "string", + "description": "Human risk factor (veryLow..veryHigh)" }, { - "description": "Ttp_Attachment_CL", - "query": "Ttp_Attachment_CL\n| sort by TimeGenerated desc" + "name": "HumanRiskScoreTrend", + "type": "int", + "description": "Human risk score change from prior month" }, { - "description": "Ttp_Impersonation_CL", - "query": "Ttp_Impersonation_CL\n| sort by TimeGenerated desc" - } - ], - "dataTypes": [ + "name": "AttackScore", + "type": "int", + "description": "Organization attack score (0-100)" + }, { - "name": "Ttp_Url_CL", - "lastDataReceivedQuery": "Ttp_Url_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "name": "AttackFactor", + "type": "string", + "description": "Attack factor (veryLow..veryHigh, notScored)" }, { - "name": "Ttp_Attachment_CL", - "lastDataReceivedQuery": "Ttp_Attachment_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "name": "AttackTrend", + "type": "int", + "description": "Attack score change from prior month" }, { - "name": "Ttp_Impersonation_CL", - "lastDataReceivedQuery": "Ttp_Impersonation_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ + "name": "AttackTotal", + "type": "int", + "description": "Total attack events for the month" + }, { - "type": "IsConnectedQuery", - "value": [ - "Ttp_Url_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Ttp_Attachment_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Ttp_Impersonation_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] + "name": "RiskResponses", + "type": "int", + "description": "Risk response events for the month" + }, + { + "name": "TotalActions", + "type": "int", + "description": "Total risk response actions" + }, + { + "name": "Notifications", + "type": "int", + "description": "Total notifications sent" + }, + { + "name": "OutboundActions", + "type": "int", + "description": "Total outbound actions" + }, + { + "name": "GroupChanges", + "type": "int", + "description": "Total group membership changes" } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions on the workspace are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ], - "customs": [ - { - "name": "Azure Subscription", - "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." - }, - { - "name": "Microsoft.Web/sites permissions", - "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." - }, - { - "name": "REST API Credentials/permissions", - "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" - } - ] - }, - "instructionSteps": [ + ] + } + } + }, + { + "name": "MimecastHumanRisk_Behaviors_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "schema": { + "name": "MimecastHumanRisk_Behaviors_CL", + "columns": [ { - "description": "You need to have a resource group created with a subscription you are going to use.", - "title": "Resource group" + "name": "TimeGenerated", + "type": "datetime", + "description": "Time the record was ingested" }, { - "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret", - "title": "Functions app" + "name": "BehaviorType", + "type": "string", + "description": "Behavior type (training, simulatedPhishing, actualPhishing, malware, sensitiveDataHandling)" }, { - "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." + "name": "Score", + "type": "int", + "description": "Behavior score (0-100)" }, { - "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + "name": "Factor", + "type": "string", + "description": "Behavior risk factor" }, { - "description": "**STEP 1 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" + "name": "EventCount", + "type": "int", + "description": "Total events for the behavior in the period" }, { - "description": "**STEP 2 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of Mimecast Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" + "name": "Trend", + "type": "int", + "description": "Score change from prior period" }, { - "description": "**STEP 3 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" + "name": "Events", + "type": "dynamic", + "description": "Behavior-specific event counts" + } + ] + } + } + }, + { + "name": "MimecastHumanRisk_Attacks_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "schema": { + "name": "MimecastHumanRisk_Attacks_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time the record was ingested" }, { - "description": "**STEP 4 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + "name": "AttackScore", + "type": "int", + "description": "Organization attack score (0-100)" }, { - "description": "Use this method for automated deployment of the Mimecast Targeted Threat Protection Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastTTPAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastTTPAzureDeploy-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t k. MimecastTTPAttachmentTableName - Enter name of the table used to store TTP Attachment data. Default is 'Ttp_Attachment'\n\n\t l. MimecastTTPImpersonationTableName - Enter name of the table used to store TTP Impersonation data. Default is 'Ttp_Impersonation'\n\n\t m. MimecastTTPUrlTableName - Enter name of the table used to store TTP Attachment data. Default is 'Ttp_Url'\n\n\t n. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t l. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t o. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Azure Resource Manager (ARM) Template" + "name": "AttackFactor", + "type": "string", + "description": "Organization attack factor" + }, + { + "name": "AttackTypes", + "type": "dynamic", + "description": "Per attack type (actualPhishing, malware, identity) scores and event counts" } ] } } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId5'),'/'))))]", + "name": "MimecastHumanRisk_Individuals_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId5'))]", - "contentId": "[variables('_dataConnectorContentId5')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion5')]", - "source": { - "kind": "Solution", - "name": "Mimecast", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Mimecast", - "email": "[variables('_email')]" - }, - "support": { - "name": "Mimecast", - "email": "support@mimecast.com", - "tier": "Partner", - "link": "https://mimecastsupport.zendesk.com/" + "schema": { + "name": "MimecastHumanRisk_Individuals_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time the record was ingested" + }, + { + "name": "IndividualId", + "type": "string", + "description": "Unique individual identifier" + }, + { + "name": "DisplayName", + "type": "string", + "description": "Display name" + }, + { + "name": "EmailAddress", + "type": "string", + "description": "Email address" + }, + { + "name": "FirstName", + "type": "string", + "description": "First name" + }, + { + "name": "LastName", + "type": "string", + "description": "Last name" + }, + { + "name": "ManagerName", + "type": "string", + "description": "Manager display name" + }, + { + "name": "ManagerId", + "type": "string", + "description": "Manager identifier" + }, + { + "name": "Department", + "type": "string", + "description": "Department" + }, + { + "name": "Location", + "type": "string", + "description": "Location" + }, + { + "name": "JobTitle", + "type": "string", + "description": "Job title" + }, + { + "name": "TenureMonths", + "type": "int", + "description": "Months with the organization" + }, + { + "name": "TenureStatus", + "type": "string", + "description": "newHire or veteran" + }, + { + "name": "StartDateTime", + "type": "datetime", + "description": "Start date with the organization" + }, + { + "name": "HumanRiskScore", + "type": "int", + "description": "Human risk score (0-100)" + }, + { + "name": "HumanRiskFactor", + "type": "string", + "description": "Human risk factor" + }, + { + "name": "AttackScore", + "type": "int", + "description": "Attack score (0-100)" + }, + { + "name": "AttackFactor", + "type": "string", + "description": "Attack factor" + }, + { + "name": "Behaviors", + "type": "dynamic", + "description": "Behavior scores and event counts" + }, + { + "name": "Attacks", + "type": "dynamic", + "description": "Attack scores and event counts" + } + ] } } } @@ -6220,188 +7934,615 @@ "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition6'),'-', variables('dataConnectorCCPVersion'))))]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId5')]", - "contentKind": "DataConnector", - "displayName": "Mimecast Targeted Threat Protection", - "contentProductId": "[variables('_dataConnectorcontentProductId5')]", - "id": "[variables('_dataConnectorcontentProductId5')]", - "version": "[variables('dataConnectorVersion5')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId5'),'/'))))]", - "dependsOn": [ - "[variables('_dataConnectorId5')]" - ], - "location": "[parameters('workspace-location')]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId5'))]", - "contentId": "[variables('_dataConnectorContentId5')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion5')]", - "source": { - "kind": "Solution", - "name": "Mimecast", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Mimecast", - "email": "[variables('_email')]" - }, - "support": { - "name": "Mimecast", - "email": "support@mimecast.com", - "tier": "Partner", - "link": "https://mimecastsupport.zendesk.com/" - } + "version": "[variables('dataConnectorCCPVersion')]" } }, { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId5'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition6'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", + "kind": "Customizable", "properties": { "connectorUiConfig": { - "title": "Mimecast Targeted Threat Protection", + "id": "MimecastHumanRiskCCF", + "title": "Mimecast Human Risk (via Codeless Connector Framework)", "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Targeted Threat Protection](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Targeted Threat Protection inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \n- URL Protect \n- Impersonation Protect \n- Attachment Protect\n", + "logo": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Mimecast.svg", + "descriptionMarkdown": "The data connector for [Mimecast Human Risk](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with visibility into the human risk posture of their organization within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view risk trends, understand which behaviors and attacks drive risk, and identify the individuals, departments and locations with the highest human risk. \nThe Mimecast Human Risk data included within the connector are: \n- Organization risk trends \n- Behaviors \n- Attacks \n- Individuals\n", + "graphQueriesTableName": "MimecastHumanRisk_Organization_CL", "graphQueries": [ { - "metricName": "Total URL Protect data received", - "legend": "Ttp_Url_CL", - "baseQuery": "Ttp_Url_CL" + "metricName": "Total organization risk records", + "legend": "Organization", + "baseQuery": "MimecastHumanRisk_Organization_CL" }, { - "metricName": "Total Attachment Protect data received", - "legend": "Ttp_Attachment_CL", - "baseQuery": "Ttp_Attachment_CL" + "metricName": "Total behavior records", + "legend": "Behaviors", + "baseQuery": "MimecastHumanRisk_Behaviors_CL" }, { - "metricName": "Total Impersonation Protect data received", - "legend": "Ttp_Impersonation_CL", - "baseQuery": "Ttp_Impersonation_CL" + "metricName": "Total attack records", + "legend": "Attacks", + "baseQuery": "MimecastHumanRisk_Attacks_CL" + }, + { + "metricName": "Total individual risk records", + "legend": "Individuals", + "baseQuery": "MimecastHumanRisk_Individuals_CL" } ], - "dataTypes": [ + "sampleQueries": [ { - "name": "Ttp_Url_CL", - "lastDataReceivedQuery": "Ttp_Url_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "description": "Organization risk score by month (latest snapshot per month)", + "query": "MimecastHumanRisk_Organization_CL\n| summarize arg_max(TimeGenerated, *) by Month\n| project Month, HumanRiskScore, HumanRiskFactor, HumanRiskScoreTrend, AttackScore, AttackFactor\n| sort by Month desc" + }, + { + "description": "Latest behavior scores", + "query": "MimecastHumanRisk_Behaviors_CL\n| summarize arg_max(TimeGenerated, *) by BehaviorType\n| project BehaviorType, Score, Factor, EventCount, Trend, Events" + }, + { + "description": "Latest attack summary by type", + "query": "MimecastHumanRisk_Attacks_CL\n| summarize arg_max(TimeGenerated, *)\n| mv-expand AttackTypes\n| project AttackType = tostring(AttackTypes.type), AttackScore = toint(AttackTypes.attackScore), AttackTotal = toint(AttackTypes.attackTotal), Events = AttackTypes.events" }, { - "name": "Ttp_Attachment_CL", - "lastDataReceivedQuery": "Ttp_Attachment_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "description": "Highest-risk individuals (latest snapshot)", + "query": "MimecastHumanRisk_Individuals_CL\n| summarize arg_max(TimeGenerated, *) by IndividualId\n| project DisplayName, EmailAddress, Department, Location, HumanRiskScore, HumanRiskFactor, AttackScore\n| top 50 by HumanRiskScore desc" }, { - "name": "Ttp_Impersonation_CL", - "lastDataReceivedQuery": "Ttp_Impersonation_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "description": "Human risk score trend per individual", + "query": "MimecastHumanRisk_Individuals_CL\n| summarize Score = max(HumanRiskScore) by IndividualId, bin(TimeGenerated, 1d)\n| render timechart" } ], - "connectivityCriterias": [ + "dataTypes": [ { - "type": "IsConnectedQuery", - "value": [ - "Ttp_Url_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Ttp_Attachment_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Ttp_Impersonation_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "sampleQueries": [ + "name": "MimecastHumanRisk_Organization_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Organization_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, { - "description": "Ttp_Url_CL", - "query": "Ttp_Url_CL\n| sort by TimeGenerated desc" + "name": "MimecastHumanRisk_Behaviors_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Behaviors_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "description": "Ttp_Attachment_CL", - "query": "Ttp_Attachment_CL\n| sort by TimeGenerated desc" + "name": "MimecastHumanRisk_Attacks_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Attacks_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "description": "Ttp_Impersonation_CL", - "query": "Ttp_Impersonation_CL\n| sort by TimeGenerated desc" + "name": "MimecastHumanRisk_Individuals_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Individuals_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" } ], "availability": { "status": 1, - "isPreview": false + "isPreview": true }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions on the workspace are required.", + "permissionsDisplayText": "Read and Write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { - "write": true, "read": true, + "write": true, "delete": true } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } } ], "customs": [ { - "name": "Azure Subscription", - "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." - }, - { - "name": "Microsoft.Web/sites permissions", - "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." - }, - { - "name": "REST API Credentials/permissions", - "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" + "name": "Mimecast API 2.0 application", + "description": "A Mimecast API 2.0 application (Client ID and Client Secret) with the Human Risk READ permission." } ] }, "instructionSteps": [ { - "description": "You need to have a resource group created with a subscription you are going to use.", - "title": "Resource group" + "title": "1. Create a Mimecast API 2.0 application", + "description": "1. Sign in to the Mimecast Administration Console.\n2. Go to **Integrations** > **API and Platform Integrations** and create (or open) an API 2.0 application.\n3. Grant the application the **Human Risk - Read** permission.\n4. Copy the **Client ID** and **Client Secret**.\n5. Identify your regional API base URL: `https://api.services.mimecast.com` (global), `https://uk-api.services.mimecast.com` (UK) or `https://us-api.services.mimecast.com` (US)." }, { - "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret", - "title": "Functions app" + "title": "2. Connect", + "description": "Enter the details below and click Connect.", + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "Mimecast API Base URL", + "placeholder": "https://api.services.mimecast.com", + "type": "text", + "name": "mimecastBaseUrl", + "validations": { + "required": true + } + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Include https:// and do not add a trailing slash.", + "visible": true, + "inline": false + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Client ID", + "placeholder": "Mimecast API 2.0 Client ID", + "type": "text", + "name": "clientId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Client Secret", + "placeholder": "Mimecast API 2.0 Client Secret", + "type": "password", + "name": "clientSecret", + "validations": { + "required": true + } + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Use the Client ID and Client Secret from step 1.", + "visible": true, + "inline": false + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Months of data to request", + "placeholder": "3", + "type": "number", + "name": "monthsBack", + "defaultValue": "3", + "validations": { + "required": true + }, + "toolTip": "Minimum value is 1 (maximum accepted by the Mimecast API is 12)." + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Whole number of months, minimum 1 (the Mimecast API accepts 1 to 12; default 3), sent as monthsBack to the organization, behaviors and attacks endpoints. For behaviors and attacks it counts calendar months from the 1st of the starting month through today (1 = month-to-date). It does not apply to the individuals search.", + "visible": true, + "inline": false + } + }, + { + "type": "Dropdown", + "parameters": { + "label": "Polling interval", + "name": "pollingInterval", + "options": [ + { + "key": "60", + "text": "1 hour" + }, + { + "key": "240", + "text": "4 hours" + }, + { + "key": "480", + "text": "8 hours" + }, + { + "key": "720", + "text": "12 hours" + }, + { + "key": "1440", + "text": "24 hours" + }, + { + "key": "2880", + "text": "48 hours" + }, + { + "key": "10080", + "text": "7 days" + } + ], + "placeholder": "Select polling interval (recommended: 12 hours)", + "isMultiSelect": false, + "defaultAllSelected": false, + "required": true, + "validations": { + "required": true + } + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Select how often Sentinel queries the Mimecast Human Risk API (12 hours is recommended). Each poll writes a new snapshot, so shorter intervals increase ingestion volume. The Mimecast rate limits are far above what this connector uses.", + "visible": true, + "inline": false + } + }, + { + "type": "ConnectionToggleButton", + "parameters": { + "connectLabel": "Connect", + "disconnectLabel": "Disconnect", + "name": "toggle" + } + } + ] }, { - "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." - }, + "title": "3. Verify the connection (post deployment)", + "description": "After you click **Connect**, verify that the connector is working:\n1. The connector status changes to **Connected** and **Data received** shows the last received time. The first data can take up to 30 minutes to appear.\n2. In **Logs**, run the below query to confirm that data is arriving in all four tables:\n```\nunion withsource=TableName MimecastHumanRisk_Organization_CL, MimecastHumanRisk_Behaviors_CL, MimecastHumanRisk_Attacks_CL, MimecastHumanRisk_Individuals_CL\n| summarize Records = count(), LastReceived = max(TimeGenerated) by TableName\n```\n3. Confirm that the parsers return data, for example `MimecastHumanRiskIndividuals | take 10`.\n4. If a table stays empty, check the **Mimecast API Base URL**, the **Client ID**, the **Client Secret** and that the application has the **Human Risk - Read** permission, then disconnect and connect again.\n5. Each poll adds a new snapshot at the selected polling interval. Open the **Mimecast Human Risk Workbook** to view the latest data." + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition6')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition6'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition6')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + }, + "dependencies": { + "criteria": [ { - "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." - }, + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections6')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections6'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnections6')]", + "displayName": "Mimecast Human Risk (via Codeless Connector Framework)", + "contentKind": "ResourcesDataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": { + "guidValue": { + "defaultValue": "[[newGuid()]", + "type": "securestring" + }, + "innerWorkspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "connectorDefinitionName": { + "defaultValue": "Mimecast Human Risk (via Codeless Connector Framework)", + "type": "securestring", + "minLength": 1 + }, + "workspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "dcrConfig": { + "defaultValue": { + "dataCollectionEndpoint": "data collection Endpoint", + "dataCollectionRuleImmutableId": "data collection rule immutableId" + }, + "type": "object" + }, + "mimecastBaseUrl": { + "defaultValue": "mimecastBaseUrl", + "type": "securestring", + "minLength": 1 + }, + "clientId": { + "defaultValue": "clientId", + "type": "securestring", + "minLength": 1 + }, + "clientSecret": { + "defaultValue": "clientSecret", + "type": "securestring", + "minLength": 1 + }, + "monthsBack": { + "defaultValue": "monthsBack", + "type": "securestring", + "minLength": 1 + }, + "pollingInterval": { + "defaultValue": "pollingInterval", + "type": "array" + } + }, + "variables": { + "_dataConnectorContentIdConnections6": "[variables('_dataConnectorContentIdConnections6')]" + }, + "resources": [ { - "description": "**STEP 1 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections6')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections6'))]", + "contentId": "[variables('_dataConnectorContentIdConnections6')]", + "kind": "ResourcesDataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + } + } }, { - "description": "**STEP 2 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of Mimecast Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'MimecastHumanRiskOrganizationPoller', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "MimecastHumanRiskCCF", + "dataType": "MimecastHumanRisk_Organization_CL", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-MimecastHumanRisk_Organization_CL" + }, + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/oauth/token')]", + "TokenEndpointHeaders": { + "Content-Type": "application/x-www-form-urlencoded", + "Accept": "application/json" + } + }, + "request": { + "apiEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/human-risk/v1/organization')]", + "httpMethod": "GET", + "queryParameters": { + "monthsBack": "[[if(equals(parameters('monthsBack'), 'monthsBack'), '3', string(parameters('monthsBack')))]", + "fields": "attackTotal,riskResponses,totals.totalActions,totals.notifications,totals.outboundActions,totals.groupChanges" + }, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-MimecastHumanRisk-CCF" + }, + "rateLimitQPS": 1, + "queryWindowInMin": "[[int(first(parameters('pollingInterval')))]", + "retryCount": 3, + "timeoutInSeconds": 120 + }, + "response": { + "eventsJsonPaths": [ + "$.trends[*]", + "$.totals" + ], + "format": "json" + }, + "isActive": true + } }, { - "description": "**STEP 3 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'MimecastHumanRiskBehaviorsPoller', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "MimecastHumanRiskCCF", + "dataType": "MimecastHumanRisk_Behaviors_CL", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-MimecastHumanRisk_Behaviors_CL" + }, + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/oauth/token')]", + "TokenEndpointHeaders": { + "Content-Type": "application/x-www-form-urlencoded", + "Accept": "application/json" + } + }, + "request": { + "apiEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/human-risk/v1/organization/behaviors')]", + "httpMethod": "GET", + "queryParameters": { + "monthsBack": "[[if(equals(parameters('monthsBack'), 'monthsBack'), '3', string(parameters('monthsBack')))]", + "fields": "events" + }, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-MimecastHumanRisk-CCF" + }, + "rateLimitQPS": 1, + "queryWindowInMin": "[[int(first(parameters('pollingInterval')))]", + "retryCount": 3, + "timeoutInSeconds": 120 + }, + "response": { + "eventsJsonPaths": [ + "$.behaviors[*]" + ], + "format": "json" + }, + "isActive": true + } }, { - "description": "**STEP 4 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'MimecastHumanRiskAttacksPoller', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "MimecastHumanRiskCCF", + "dataType": "MimecastHumanRisk_Attacks_CL", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-MimecastHumanRisk_Attacks_CL" + }, + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/oauth/token')]", + "TokenEndpointHeaders": { + "Content-Type": "application/x-www-form-urlencoded", + "Accept": "application/json" + } + }, + "request": { + "apiEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/human-risk/v1/organization/attacks')]", + "httpMethod": "GET", + "queryParameters": { + "monthsBack": "[[if(equals(parameters('monthsBack'), 'monthsBack'), '3', string(parameters('monthsBack')))]", + "fields": "attackTypes" + }, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-MimecastHumanRisk-CCF" + }, + "rateLimitQPS": 1, + "queryWindowInMin": "[[int(first(parameters('pollingInterval')))]", + "retryCount": 3, + "timeoutInSeconds": 120 + }, + "response": { + "eventsJsonPaths": [ + "$" + ], + "format": "json" + }, + "isActive": true + } }, { - "description": "Use this method for automated deployment of the Mimecast Targeted Threat Protection Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastTTPAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastTTPAzureDeploy-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t k. MimecastTTPAttachmentTableName - Enter name of the table used to store TTP Attachment data. Default is 'Ttp_Attachment'\n\n\t l. MimecastTTPImpersonationTableName - Enter name of the table used to store TTP Impersonation data. Default is 'Ttp_Impersonation'\n\n\t m. MimecastTTPUrlTableName - Enter name of the table used to store TTP Attachment data. Default is 'Ttp_Url'\n\n\t n. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t l. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t o. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Azure Resource Manager (ARM) Template" + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'MimecastHumanRiskIndividualsPoller', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "MimecastHumanRiskCCF", + "dataType": "MimecastHumanRisk_Individuals_CL", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-MimecastHumanRisk_Individuals_CL" + }, + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/oauth/token')]", + "TokenEndpointHeaders": { + "Content-Type": "application/x-www-form-urlencoded", + "Accept": "application/json" + } + }, + "request": { + "apiEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/human-risk/v1/individuals/search?pageSize=1000&fields=firstName,lastName,tenureMonths,tenureStatus,startDateTime,behaviors.eventCount,behaviors.events,attacks.eventCount,attacks.events')]", + "httpMethod": "POST", + "isPostPayloadJson": true, + "queryParametersTemplate": "{}", + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-MimecastHumanRisk-CCF" + }, + "rateLimitQPS": 1, + "queryWindowInMin": "[[int(first(parameters('pollingInterval')))]", + "retryCount": 3, + "timeoutInSeconds": 120 + }, + "response": { + "eventsJsonPaths": [ + "$.individuals[*]" + ], + "format": "json" + }, + "paging": { + "pagingType": "NextPageToken", + "nextPageTokenJsonPath": "$.meta.nextPage", + "nextPageParaName": "pageToken", + "pagingInfoPlacement": "QueryString" + }, + "isActive": true + } } - ], - "id": "[variables('_uiConfigId5')]" - } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections6'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" } }, { @@ -6409,12 +8550,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.1.0", + "version": "3.1.1", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Mimecast", "publisherDisplayName": "Mimecast", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

An Azure app to enable Mimecast data to be viewed using analytical tables and charts which are brought into Azure.

\n

Data Connectors: 5, Parsers: 11, Workbooks: 5, Analytic Rules: 13, Playbooks: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

An Azure app to enable Mimecast data to be viewed using analytical tables and charts which are brought into Azure.

\n

Data Connectors: 6, Parsers: 15, Workbooks: 6, Analytic Rules: 13, Playbooks: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -6529,6 +8670,11 @@ "contentId": "[variables('_workbookContentId5')]", "version": "[variables('workbookVersion5')]" }, + { + "kind": "Workbook", + "contentId": "[variables('_workbookContentId6')]", + "version": "[variables('workbookVersion6')]" + }, { "kind": "Playbook", "contentId": "[variables('_Mimecast Data Connector Trigger Sync')]", @@ -6589,6 +8735,26 @@ "contentId": "[variables('parserObject11').parserContentId11]", "version": "[variables('parserObject11').parserVersion11]" }, + { + "kind": "Parser", + "contentId": "[variables('parserObject12').parserContentId12]", + "version": "[variables('parserObject12').parserVersion12]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject13').parserContentId13]", + "version": "[variables('parserObject13').parserVersion13]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject14').parserContentId14]", + "version": "[variables('parserObject14').parserVersion14]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject15').parserContentId15]", + "version": "[variables('parserObject15').parserVersion15]" + }, { "kind": "DataConnector", "contentId": "[variables('_dataConnectorContentId1')]", @@ -6613,6 +8779,11 @@ "kind": "DataConnector", "contentId": "[variables('_dataConnectorContentId5')]", "version": "[variables('dataConnectorVersion5')]" + }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentIdConnections6')]", + "version": "[variables('dataConnectorCCPVersion')]" } ] }, diff --git a/Solutions/Mimecast/Package/testParameters.json b/Solutions/Mimecast/Package/testParameters.json index a6004ba15f1..bb3086e31a3 100644 --- a/Solutions/Mimecast/Package/testParameters.json +++ b/Solutions/Mimecast/Package/testParameters.json @@ -60,5 +60,27 @@ "metadata": { "description": "Name for the workbook" } + }, + "workbook6-name": { + "type": "string", + "defaultValue": "Mimecast Human Risk Workbook", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } } } diff --git a/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Attacks.yaml b/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Attacks.yaml new file mode 100644 index 00000000000..938390fbf8d --- /dev/null +++ b/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Attacks.yaml @@ -0,0 +1,70 @@ +id: 8265ae28-63f1-43a8-ac57-6d5f7a1dca5f +Function: + Title: Parser for Mimecast Human Risk Attacks + Version: '1.1.0' + LastUpdated: '2026-10-21' +Category: Microsoft Sentinel Parser +FunctionName: MimecastHumanRiskAttacks +FunctionAlias: MimecastHumanRiskAttacks +FunctionQuery: | + let dummy_table = datatable(TimeGenerated: datetime) []; + let FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') }; + let MimecastHumanRiskAttacks_view = view() { + union isfuzzy=true + dummy_table, + MimecastHumanRisk_Attacks_CL + | extend + AttackScore = toint(column_ifexists('AttackScore', int(null))), + AttackFactor = tostring(column_ifexists('AttackFactor', '')), + AttackTypes = todynamic(column_ifexists('AttackTypes', dynamic(null))) + | extend AttackTypesRaw = iff(gettype(AttackTypes) != 'array' or array_length(AttackTypes) == 0, dynamic([{}]), AttackTypes) + | mv-expand AttackTypeItem = AttackTypesRaw + | extend + AttackFactorLabel = FactorLabel(AttackFactor), + AttackType = tostring(AttackTypeItem.type), + AttackTypeTotal = toint(AttackTypeItem.attackTotal), + AttackTypeScore = toint(AttackTypeItem.attackScore), + AttackTypeFactor = tostring(AttackTypeItem.attackFactor), + AttackTypeTrend = toint(AttackTypeItem.trend), + AttackTypeEvents = AttackTypeItem.events, + EventDelivered = toint(AttackTypeItem.events.delivered), + EventBlocked = toint(AttackTypeItem.events.blocked), + EventRemediated = toint(AttackTypeItem.events.remediated), + EventDownloadAttempted = toint(AttackTypeItem.events.downloadAttempted), + EventDownloaded = toint(AttackTypeItem.events.downloaded), + EventExecuted = toint(AttackTypeItem.events.executed), + EventUnknown = toint(AttackTypeItem.events.unknown), + EventAnomalous = toint(AttackTypeItem.events.anomalous), + EventSuspicious = toint(AttackTypeItem.events.suspicious), + EventMalicious = toint(AttackTypeItem.events.malicious), + EventReported = toint(AttackTypeItem.events.reported) + | extend + AttackTypeName = case(AttackType == 'actualPhishing', 'Actual Phishing', AttackType == 'malware', 'Malware', AttackType == 'identity', 'Identity', AttackType), + AttackTypeFactorLabel = FactorLabel(AttackTypeFactor) + | project + TimeGenerated, + AttackScore, + AttackFactor, + AttackFactorLabel, + AttackType, + AttackTypeName, + AttackTypeTotal, + AttackTypeScore, + AttackTypeFactor, + AttackTypeFactorLabel, + AttackTypeTrend, + AttackTypeEvents, + EventDelivered, + EventBlocked, + EventRemediated, + EventDownloadAttempted, + EventDownloaded, + EventExecuted, + EventUnknown, + EventAnomalous, + EventSuspicious, + EventMalicious, + EventReported, + AttackTypes + }; + MimecastHumanRiskAttacks_view diff --git a/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Behaviors.yaml b/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Behaviors.yaml new file mode 100644 index 00000000000..4c00e97a57c --- /dev/null +++ b/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Behaviors.yaml @@ -0,0 +1,75 @@ +id: 2716f1d3-a1e7-4979-9c41-45941c12bdf8 +Function: + Title: Parser for Mimecast Human Risk Behaviors + Version: '1.1.0' + LastUpdated: '2026-10-21' +Category: Microsoft Sentinel Parser +FunctionName: MimecastHumanRiskBehaviors +FunctionAlias: MimecastHumanRiskBehaviors +FunctionQuery: | + let dummy_table = datatable(TimeGenerated: datetime) []; + let FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') }; + let MimecastHumanRiskBehaviors_view = view() { + union isfuzzy=true + dummy_table, + MimecastHumanRisk_Behaviors_CL + | extend + BehaviorType = tostring(column_ifexists('BehaviorType', '')), + Score = toint(column_ifexists('Score', int(null))), + Factor = tostring(column_ifexists('Factor', '')), + EventCount = toint(column_ifexists('EventCount', int(null))), + Trend = toint(column_ifexists('Trend', int(null))), + Events = todynamic(column_ifexists('Events', dynamic(null))) + | extend + BehaviorName = case(BehaviorType == 'training', 'Training', BehaviorType == 'simulatedPhishing', 'Simulated Phishing', BehaviorType == 'actualPhishing', 'Actual Phishing', BehaviorType == 'malware', 'Malware', BehaviorType == 'sensitiveDataHandling', 'Sensitive Data Handling', BehaviorType), + FactorLabel = FactorLabel(Factor), + EventAssigned = toint(Events.assigned), + EventCompleted = toint(Events.completed), + EventOverdue = toint(Events.overdue), + EventDelivered = toint(Events.delivered), + EventOpened = toint(Events.opened), + EventClicked = toint(Events.clicked), + EventReported = toint(Events.reported), + EventSubmittedData = toint(Events.submittedData), + EventAttachmentOpened = toint(Events.attachmentOpened), + EventBlocked = toint(Events.blocked), + EventRemediated = toint(Events.remediated), + EventFalsePositiveRemediated = toint(Events.falsePositiveRemediated), + EventAttachmentDownloaded = toint(Events.attachmentDownloaded), + EventDownloadAttempted = toint(Events.downloadAttempted), + EventDownloaded = toint(Events.downloaded), + EventExecuted = toint(Events.executed), + EventUnknown = toint(Events.unknown), + EventProperlyHandled = toint(Events.properlyHandled), + EventImproperlyHandled = toint(Events.improperlyHandled) + | project + TimeGenerated, + BehaviorType, + BehaviorName, + Score, + Factor, + FactorLabel, + EventCount, + Trend, + Events, + EventAssigned, + EventCompleted, + EventOverdue, + EventDelivered, + EventOpened, + EventClicked, + EventReported, + EventSubmittedData, + EventAttachmentOpened, + EventBlocked, + EventRemediated, + EventFalsePositiveRemediated, + EventAttachmentDownloaded, + EventDownloadAttempted, + EventDownloaded, + EventExecuted, + EventUnknown, + EventProperlyHandled, + EventImproperlyHandled + }; + MimecastHumanRiskBehaviors_view diff --git a/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Individuals.yaml b/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Individuals.yaml new file mode 100644 index 00000000000..96e97fc9cc1 --- /dev/null +++ b/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Individuals.yaml @@ -0,0 +1,148 @@ +id: 5cba6723-ef08-4b4f-b971-71ffb16fc7e4 +Function: + Title: Parser for Mimecast Human Risk Individuals + Version: '1.1.0' + LastUpdated: '2026-10-21' +Category: Microsoft Sentinel Parser +FunctionName: MimecastHumanRiskIndividuals +FunctionAlias: MimecastHumanRiskIndividuals +FunctionQuery: | + let dummy_table = datatable(TimeGenerated: datetime) []; + let FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') }; + let MimecastHumanRiskIndividuals_view = view() { + union isfuzzy=true + dummy_table, + MimecastHumanRisk_Individuals_CL + | extend + IndividualId = tostring(column_ifexists('IndividualId', '')), + DisplayName = tostring(column_ifexists('DisplayName', '')), + EmailAddress = tostring(column_ifexists('EmailAddress', '')), + FirstName = tostring(column_ifexists('FirstName', '')), + LastName = tostring(column_ifexists('LastName', '')), + ManagerName = tostring(column_ifexists('ManagerName', '')), + ManagerId = tostring(column_ifexists('ManagerId', '')), + Department = tostring(column_ifexists('Department', '')), + Location = tostring(column_ifexists('Location', '')), + JobTitle = tostring(column_ifexists('JobTitle', '')), + TenureMonths = toint(column_ifexists('TenureMonths', int(null))), + TenureStatus = tostring(column_ifexists('TenureStatus', '')), + StartDateTime = todatetime(column_ifexists('StartDateTime', datetime(null))), + HumanRiskScore = toint(column_ifexists('HumanRiskScore', int(null))), + HumanRiskFactor = tostring(column_ifexists('HumanRiskFactor', '')), + AttackScore = toint(column_ifexists('AttackScore', int(null))), + AttackFactor = tostring(column_ifexists('AttackFactor', '')), + Behaviors = todynamic(column_ifexists('Behaviors', dynamic(null))), + Attacks = todynamic(column_ifexists('Attacks', dynamic(null))) + | extend + BehaviorsSrc = iff(gettype(Behaviors) != 'array' or array_length(Behaviors) == 0, dynamic([{}]), Behaviors), + AttacksSrc = iff(gettype(Attacks) != 'array' or array_length(Attacks) == 0, dynamic([{}]), Attacks) + | mv-apply b = BehaviorsSrc on (summarize Bhv = make_bag(bag_pack(coalesce(tostring(b.type), 'none'), b))) + | mv-apply a = AttacksSrc on (summarize Atk = make_bag(bag_pack(coalesce(tostring(a.type), 'none'), a))) + | extend + HumanRiskFactorLabel = FactorLabel(HumanRiskFactor), + AttackFactorLabel = FactorLabel(AttackFactor), + SimulatedPhishingScore = toint(Bhv.simulatedPhishing.score), + SimulatedPhishingFactor = tostring(Bhv.simulatedPhishing.factor), + SimulatedPhishingTrend = toint(Bhv.simulatedPhishing.trend), + SimulatedPhishingEventCount = toint(Bhv.simulatedPhishing.eventCount), + SimulatedPhishingEvents = Bhv.simulatedPhishing.events, + ActualPhishingScore = toint(Bhv.actualPhishing.score), + ActualPhishingFactor = tostring(Bhv.actualPhishing.factor), + ActualPhishingTrend = toint(Bhv.actualPhishing.trend), + ActualPhishingEventCount = toint(Bhv.actualPhishing.eventCount), + ActualPhishingEvents = Bhv.actualPhishing.events, + TrainingScore = toint(Bhv.training.score), + TrainingFactor = tostring(Bhv.training.factor), + TrainingTrend = toint(Bhv.training.trend), + TrainingEventCount = toint(Bhv.training.eventCount), + TrainingEvents = Bhv.training.events, + MalwareScore = toint(Bhv.malware.score), + MalwareFactor = tostring(Bhv.malware.factor), + MalwareTrend = toint(Bhv.malware.trend), + MalwareEventCount = toint(Bhv.malware.eventCount), + MalwareEvents = Bhv.malware.events, + SensitiveDataHandlingScore = toint(Bhv.sensitiveDataHandling.score), + SensitiveDataHandlingFactor = tostring(Bhv.sensitiveDataHandling.factor), + SensitiveDataHandlingTrend = toint(Bhv.sensitiveDataHandling.trend), + SensitiveDataHandlingEventCount = toint(Bhv.sensitiveDataHandling.eventCount), + SensitiveDataHandlingEvents = Bhv.sensitiveDataHandling.events, + ActualPhishingAttackScore = toint(Atk.actualPhishing.score), + ActualPhishingAttackFactor = tostring(Atk.actualPhishing.factor), + ActualPhishingAttackTrend = toint(Atk.actualPhishing.trend), + ActualPhishingAttackEventCount = toint(Atk.actualPhishing.eventCount), + ActualPhishingAttackEvents = Atk.actualPhishing.events, + MalwareAttackScore = toint(Atk.malware.score), + MalwareAttackFactor = tostring(Atk.malware.factor), + MalwareAttackTrend = toint(Atk.malware.trend), + MalwareAttackEventCount = toint(Atk.malware.eventCount), + MalwareAttackEvents = Atk.malware.events, + IdentityAttackScore = toint(Atk.identity.score), + IdentityAttackFactor = tostring(Atk.identity.factor), + IdentityAttackTrend = toint(Atk.identity.trend), + IdentityAttackEventCount = toint(Atk.identity.eventCount), + IdentityAttackEvents = Atk.identity.events + | project + TimeGenerated, + IndividualId, + DisplayName, + EmailAddress, + FirstName, + LastName, + ManagerName, + ManagerId, + Department, + Location, + JobTitle, + TenureMonths, + TenureStatus, + StartDateTime, + HumanRiskScore, + HumanRiskFactor, + AttackScore, + AttackFactor, + HumanRiskFactorLabel, + AttackFactorLabel, + SimulatedPhishingScore, + SimulatedPhishingFactor, + SimulatedPhishingTrend, + SimulatedPhishingEventCount, + SimulatedPhishingEvents, + ActualPhishingScore, + ActualPhishingFactor, + ActualPhishingTrend, + ActualPhishingEventCount, + ActualPhishingEvents, + TrainingScore, + TrainingFactor, + TrainingTrend, + TrainingEventCount, + TrainingEvents, + MalwareScore, + MalwareFactor, + MalwareTrend, + MalwareEventCount, + MalwareEvents, + SensitiveDataHandlingScore, + SensitiveDataHandlingFactor, + SensitiveDataHandlingTrend, + SensitiveDataHandlingEventCount, + SensitiveDataHandlingEvents, + ActualPhishingAttackScore, + ActualPhishingAttackFactor, + ActualPhishingAttackTrend, + ActualPhishingAttackEventCount, + ActualPhishingAttackEvents, + MalwareAttackScore, + MalwareAttackFactor, + MalwareAttackTrend, + MalwareAttackEventCount, + MalwareAttackEvents, + IdentityAttackScore, + IdentityAttackFactor, + IdentityAttackTrend, + IdentityAttackEventCount, + IdentityAttackEvents, + Behaviors, + Attacks + }; + MimecastHumanRiskIndividuals_view diff --git a/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Organization.yaml b/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Organization.yaml new file mode 100644 index 00000000000..ead5142d62f --- /dev/null +++ b/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Organization.yaml @@ -0,0 +1,55 @@ +id: 25194ae7-8559-4a86-aa1f-0081ca5189f5 +Function: + Title: Parser for Mimecast Human Risk Organization + Version: '1.1.0' + LastUpdated: '2026-10-21' +Category: Microsoft Sentinel Parser +FunctionName: MimecastHumanRiskOrganization +FunctionAlias: MimecastHumanRiskOrganization +FunctionQuery: | + let dummy_table = datatable(TimeGenerated: datetime) []; + let FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') }; + let MimecastHumanRiskOrganization_view = view() { + union isfuzzy=true + dummy_table, + MimecastHumanRisk_Organization_CL + | extend + Month = tostring(column_ifexists('Month', '')), + HumanRiskScore = toint(column_ifexists('HumanRiskScore', int(null))), + HumanRiskFactor = tostring(column_ifexists('HumanRiskFactor', '')), + HumanRiskScoreTrend = toint(column_ifexists('HumanRiskScoreTrend', int(null))), + AttackScore = toint(column_ifexists('AttackScore', int(null))), + AttackFactor = tostring(column_ifexists('AttackFactor', '')), + AttackTrend = toint(column_ifexists('AttackTrend', int(null))), + AttackTotal = toint(column_ifexists('AttackTotal', int(null))), + RiskResponses = toint(column_ifexists('RiskResponses', int(null))), + TotalActions = toint(column_ifexists('TotalActions', int(null))), + Notifications = toint(column_ifexists('Notifications', int(null))), + OutboundActions = toint(column_ifexists('OutboundActions', int(null))), + GroupChanges = toint(column_ifexists('GroupChanges', int(null))) + | extend + RecordType = iff(isempty(Month), 'Totals', 'Monthly'), + MonthStart = todatetime(strcat(Month, '-01')), + HumanRiskFactorLabel = FactorLabel(HumanRiskFactor), + AttackFactorLabel = FactorLabel(AttackFactor) + | project + TimeGenerated, + RecordType, + Month, + MonthStart, + HumanRiskScore, + HumanRiskFactor, + HumanRiskScoreTrend, + AttackScore, + AttackFactor, + AttackTrend, + AttackTotal, + RiskResponses, + TotalActions, + Notifications, + OutboundActions, + GroupChanges, + HumanRiskFactorLabel, + AttackFactorLabel + }; + MimecastHumanRiskOrganization_view diff --git a/Solutions/Mimecast/ReleaseNotes.md b/Solutions/Mimecast/ReleaseNotes.md index 0c8be41caf8..7a53d03e246 100644 --- a/Solutions/Mimecast/ReleaseNotes.md +++ b/Solutions/Mimecast/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified** | **Change History** | |---------------|--------------------------------|------------------------------------------------------------------------| +| 3.1.1 | 23-10-2026 | Added Mimecast Human Risk **Data Connector** (CCF) with **Parsers** and **Workbook**. | | 3.1.0 | 29-10-2025 | Added Log Ingestion API support in **Data Connectors**. Added Government button for support. | | 3.0.1 | 12-02-2025 | Updated default table for MimecastAudit to get the Connected label on **Data Connector** UI page. | | 3.0.0 | 09-09-2024 | Initial Solution Release | diff --git a/Solutions/Mimecast/Workbooks/Mimecast_HumanRisk_Workbook.json b/Solutions/Mimecast/Workbooks/Mimecast_HumanRisk_Workbook.json new file mode 100644 index 00000000000..d7bfd662357 --- /dev/null +++ b/Solutions/Mimecast/Workbooks/Mimecast_HumanRisk_Workbook.json @@ -0,0 +1,1511 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# Mimecast Human Risk\n\nMonitor your organization's human risk posture using data from the Mimecast Human Risk connector. This workbook includes:\n\n- **Risk Overview** - average human risk score, risk response activity and how individuals are spread across risk factors.\n- **Risk Trends** - monthly human risk and attack scores.\n- **Highest Human Risks** - top 10 individuals, departments or locations by human risk score.\n- **Human Risk Behaviors and Organization Attacks** - scores and event breakdowns by behavior and attack type." + }, + "name": "q1", + "styleSettings": { + "margin": "4px", + "showBorder": false, + "padding": "4px" + } + }, + { + "type": 1, + "content": { + "json": ">**NOTE:** This workbook depends on parsers based on Kusto functions - **MimecastHumanRiskOrganization**, **MimecastHumanRiskBehaviors**, **MimecastHumanRiskAttacks** and **MimecastHumanRiskIndividuals** - which are deployed with the Microsoft Sentinel Solution.", + "style": "info" + }, + "name": "q1-note-parsers", + "styleSettings": { + "margin": "8px" + } + }, + { + "type": 1, + "content": { + "json": "Data is collected as snapshots at the polling interval chosen in the connector (default 12 hours). Each panel shows the latest snapshot inside the selected time range, so keep the time range at least as long as the polling interval.", + "style": "upsell" + }, + "name": "q1-note-snapshot", + "styleSettings": { + "margin": "8px" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "a1", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 14400000 + }, + { + "durationMs": 28800000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 7776000000 + }, + { + "durationMs": 15552000000 + } + ], + "allowCustom": true + }, + "timeContext": { + "durationMs": 43200000 + }, + "value": { + "durationMs": 43200000 + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters-time", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + } + ], + "exportParameters": true + }, + "name": "group-header", + "styleSettings": { + "margin": "4px", + "padding": "8px", + "showBorder": false + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "---\n## Risk Overview\nAverage human risk, risk-response activity and how individuals are distributed across risk factors." + }, + "name": "h-overview", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\n| summarize Value = round(avg(HumanRiskScore), 1) | extend Metric = 'Average Human Risk Score (0-100)'", + "size": 3, + "title": "Human Risk Score", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "customWidth": "25", + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 4, + "maximumFractionDigits": 1 + } + } + }, + "showBorder": false, + "size": "auto" + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true + }, + "name": "q2", + "customWidth": "25", + "styleSettings": { + "margin": "8px", + "showBorder": false, + "padding": "8px" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let T = MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by Month;\nT | summarize Notifications = avg(Notifications), GroupChanges = avg(GroupChanges), TotalActions = avg(TotalActions)\n| project Metric = dynamic(['Notifications','Group Changes','Risk Activity']), Value = pack_array(Notifications, GroupChanges, TotalActions)\n| mv-expand Metric to typeof(string), Value to typeof(real)\n| project Metric, Value = round(Value, 1)", + "size": 3, + "title": "Notifications, Group Changes and Risk Activity", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 4, + "maximumFractionDigits": 1 + } + } + }, + "showBorder": false + }, + "customWidth": "75", + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true + }, + "name": "q7", + "styleSettings": { + "margin": "8px", + "showBorder": false, + "padding": "8px" + }, + "customWidth": "75" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\n| extend Bucket = case(isempty(HumanRiskFactor) or HumanRiskFactor == 'notScored', 'Not Scored', HumanRiskFactor == 'veryLow', 'Very Low', HumanRiskFactor == 'low', 'Low', HumanRiskFactor == 'medium', 'Medium', HumanRiskFactor == 'high', 'High', HumanRiskFactor == 'veryHigh', 'Very High', 'Not Scored')\n| summarize Count = count() by Bucket\n| extend o = case(Bucket == 'Very Low', 1, Bucket == 'Low', 2, Bucket == 'Medium', 3, Bucket == 'High', 4, Bucket == 'Very High', 5, 6) | sort by o asc | project-away o", + "size": 3, + "title": "Human Risk Factor Distribution", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "customWidth": "50", + "chartSettings": { + "showLegend": false, + "showMetrics": false + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true + }, + "name": "q3", + "customWidth": "50", + "styleSettings": { + "margin": "8px", + "showBorder": false, + "padding": "8px" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\n| extend Bucket = case(isempty(AttackFactor) or AttackFactor == 'notScored', 'Not Scored', AttackFactor == 'veryLow', 'Very Low', AttackFactor == 'low', 'Low', AttackFactor == 'medium', 'Medium', AttackFactor == 'high', 'High', AttackFactor == 'veryHigh', 'Very High', 'Not Scored')\n| summarize Count = count() by Bucket\n| extend o = case(Bucket == 'Very Low', 1, Bucket == 'Low', 2, Bucket == 'Medium', 3, Bucket == 'High', 4, Bucket == 'Very High', 5, 6) | sort by o asc | project-away o", + "size": 3, + "title": "Attack Factor Distribution", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "customWidth": "50", + "chartSettings": { + "showLegend": false, + "showMetrics": false + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true + }, + "name": "q4", + "customWidth": "50", + "styleSettings": { + "margin": "8px", + "showBorder": false, + "padding": "8px" + } + } + ], + "exportParameters": false + }, + "name": "group-overview", + "styleSettings": { + "margin": "10px", + "padding": "8px", + "showBorder": false + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "---\n## Risk Trends\nMonthly organization human risk and attack scores." + }, + "name": "h-trends", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\n| where isnotnull(HumanRiskScore) and isnotnull(MonthStart)\n| project MonthStart, ['Human Risk Score'] = HumanRiskScore\n| sort by MonthStart asc", + "size": 0, + "title": "Human Risk Score Trends", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "linechart", + "customWidth": "50", + "chartSettings": { + "showLegend": false, + "xAxis": "MonthStart", + "yAxis": [ + "Human Risk Score" + ] + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true + }, + "name": "q5", + "customWidth": "50", + "styleSettings": { + "margin": "8px", + "padding": "10px", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\n| project Month, ['Risk Responses'] = coalesce(RiskResponses, 0)\n| sort by Month asc", + "size": 0, + "title": "Human Risk Score Trends - Risk Responses", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "columnchart", + "customWidth": "50", + "chartSettings": { + "showLegend": false, + "xAxis": "Month" + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true + }, + "name": "q6", + "customWidth": "50", + "styleSettings": { + "margin": "8px", + "padding": "10px", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\n| where isnotnull(AttackScore) and isnotnull(MonthStart)\n| project MonthStart, ['Attack Score'] = AttackScore\n| sort by MonthStart asc", + "size": 0, + "title": "Attack Score Trends", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "linechart", + "chartSettings": { + "showLegend": false, + "xAxis": "MonthStart", + "yAxis": [ + "Attack Score" + ] + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true + }, + "name": "q12", + "styleSettings": { + "margin": "8px", + "padding": "10px", + "showBorder": true + } + } + ], + "exportParameters": false + }, + "name": "group-trends", + "styleSettings": { + "margin": "10px", + "padding": "8px", + "showBorder": false + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "---\n## Highest Human Risks\nTop 10 individuals, departments or locations. Use the selector to switch views." + }, + "name": "h-highest", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "b1", + "version": "KqlParameterItem/1.0", + "name": "groupby", + "label": "Highest Risks", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[{\"value\":\"individuals\",\"label\":\"Individuals\"},{\"value\":\"department\",\"label\":\"Departments\"},{\"value\":\"locations\",\"label\":\"Locations\"}]", + "value": "individuals" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters-groupby", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\n| project ['FULL NAME'] = coalesce(DisplayName, '-'), ['HUMAN RISK SCORE'] = HumanRiskScore, EMAIL = coalesce(EmailAddress, '-'), MANAGER = coalesce(ManagerName, '-'), DEPARTMENT = coalesce(Department, '-'), LOCATION = coalesce(Location, '-'), ['SIMULATED PHISHING'] = SimulatedPhishingScore, ['ACTUAL PHISHING'] = ActualPhishingScore, TRAINING = TrainingScore, MALWARE = MalwareScore, ['SENSITIVE DATA HANDLING'] = SensitiveDataHandlingScore, ['TENURE DURATION (MONTHS)'] = TenureMonths, ['ATTACK FACTOR'] = case(isempty(AttackFactor) or AttackFactor == 'notScored', 'Not Scored', AttackFactor == 'veryLow', 'Very Low', AttackFactor == 'low', 'Low', AttackFactor == 'medium', 'Medium', AttackFactor == 'high', 'High', AttackFactor == 'veryHigh', 'Very High', 'Not Scored')\n| top 10 by ['HUMAN RISK SCORE'] desc\n| serialize ['S.NO'] = row_number()\n| project-reorder ['S.NO']", + "size": 3, + "title": "Individuals Highest Human Risks", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "filter": true, + "formatters": [ + { + "columnMatch": "HUMAN RISK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SIMULATED PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ACTUAL PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "TRAINING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "MALWARE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SENSITIVE DATA HANDLING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ATTACK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ATTACK FACTOR", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Very Low", + "representation": "green", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "blue", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "yellow", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "High", + "representation": "orange", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Very High", + "representation": "redBright", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Not Scored", + "representation": "gray", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "gray", + "text": "{0}{1}" + } + ] + } + } + ], + "rowLimit": 10000 + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true + }, + "name": "q8", + "conditionalVisibilities": [ + { + "comparison": "isEqualTo", + "parameterName": "groupby", + "value": "individuals" + } + ], + "conditionalVisibility": { + "parameterName": "groupby", + "comparison": "isEqualTo", + "value": "individuals" + }, + "styleSettings": { + "margin": "8px", + "showBorder": true, + "padding": "6px" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\n| extend Grp = iff(isempty(Department), 'Not Provided', Department)\n| summarize ['# OF INDIVIDUALS'] = count(), ['HUMAN RISK SCORE'] = round(avg(HumanRiskScore), 1), ['SIMULATED PHISHING'] = round(avg(SimulatedPhishingScore), 1), ['ACTUAL PHISHING'] = round(avg(ActualPhishingScore), 1), TRAINING = round(avg(TrainingScore), 1), MALWARE = round(avg(MalwareScore), 1), ['SENSITIVE DATA HANDLING'] = round(avg(SensitiveDataHandlingScore), 1) by DEPARTMENT = Grp\n| top 10 by ['HUMAN RISK SCORE'] desc\n| serialize ['S.NO'] = row_number()\n| project-reorder ['S.NO']", + "size": 3, + "title": "Departments Highest Human Risks", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "filter": true, + "formatters": [ + { + "columnMatch": "HUMAN RISK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SIMULATED PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ACTUAL PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "TRAINING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "MALWARE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SENSITIVE DATA HANDLING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ATTACK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + } + ], + "rowLimit": 10000 + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true + }, + "name": "q9", + "conditionalVisibilities": [ + { + "comparison": "isEqualTo", + "parameterName": "groupby", + "value": "department" + } + ], + "conditionalVisibility": { + "parameterName": "groupby", + "comparison": "isEqualTo", + "value": "department" + }, + "styleSettings": { + "margin": "8px", + "showBorder": true, + "padding": "6px" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\n| extend Grp = iff(isempty(Location), 'Not Provided', Location)\n| summarize ['# OF INDIVIDUALS'] = count(), ['HUMAN RISK SCORE'] = round(avg(HumanRiskScore), 1), ['SIMULATED PHISHING'] = round(avg(SimulatedPhishingScore), 1), ['ACTUAL PHISHING'] = round(avg(ActualPhishingScore), 1), TRAINING = round(avg(TrainingScore), 1), MALWARE = round(avg(MalwareScore), 1), ['SENSITIVE DATA HANDLING'] = round(avg(SensitiveDataHandlingScore), 1) by LOCATION = Grp\n| top 10 by ['HUMAN RISK SCORE'] desc\n| serialize ['S.NO'] = row_number()\n| project-reorder ['S.NO']", + "size": 3, + "title": "Locations Highest Human Risks", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "filter": true, + "formatters": [ + { + "columnMatch": "HUMAN RISK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SIMULATED PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ACTUAL PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "TRAINING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "MALWARE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SENSITIVE DATA HANDLING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ATTACK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + } + ], + "rowLimit": 10000 + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true + }, + "name": "q10", + "conditionalVisibilities": [ + { + "comparison": "isEqualTo", + "parameterName": "groupby", + "value": "locations" + } + ], + "conditionalVisibility": { + "parameterName": "groupby", + "comparison": "isEqualTo", + "value": "locations" + }, + "styleSettings": { + "margin": "8px", + "showBorder": true, + "padding": "6px" + } + } + ], + "exportParameters": true + }, + "name": "group-highest", + "styleSettings": { + "margin": "10px", + "padding": "8px", + "showBorder": false + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "---\n## Human Risk Behaviors" + }, + "name": "h-behaviors", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskBehaviors | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by BehaviorType\n| project STAGE = BehaviorName, ['HUMAN RISK FACTOR'] = FactorLabel, ['HUMAN RISK SCORE'] = Score, ['TOTAL EVENTS'] = EventCount\n| sort by ['TOTAL EVENTS'] desc", + "size": 3, + "title": "Human Risk Behaviors", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "filter": true, + "formatters": [ + { + "columnMatch": "HUMAN RISK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SIMULATED PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ACTUAL PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "TRAINING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "MALWARE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SENSITIVE DATA HANDLING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ATTACK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "HUMAN RISK FACTOR", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Very Low", + "representation": "green", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "blue", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "yellow", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "High", + "representation": "orange", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Very High", + "representation": "redBright", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Not Scored", + "representation": "gray", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "gray", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "TOTAL EVENTS", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + } + ], + "rowLimit": 10000 + }, + "exportFieldName": "STAGE", + "exportDefaultValue": "none", + "exportParameterName": "selected_behavior", + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true + }, + "name": "q13", + "styleSettings": { + "margin": "8px", + "showBorder": true, + "padding": "6px" + } + }, + { + "type": 1, + "content": { + "json": "Click a row in the table above to see its event breakdown.", + "style": "info" + }, + "name": "h-behaviors-info", + "styleSettings": { + "margin": "8px", + "showBorder": false + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskBehaviors | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by BehaviorType\n| where BehaviorName == '{selected_behavior}'\n| extend k = bag_keys(Events) | mv-expand k to typeof(string)\n| project ['EVENT TYPE'] = k, COUNT = toint(Events[k])\n| where isnotnull(COUNT)\n| sort by COUNT desc", + "size": 3, + "title": "Event Breakdown for {selected_behavior}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "filter": true, + "formatters": [ + { + "columnMatch": "HUMAN RISK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SIMULATED PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ACTUAL PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "TRAINING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "MALWARE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SENSITIVE DATA HANDLING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ATTACK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "COUNT", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + } + ], + "rowLimit": 10000 + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true + }, + "name": "q15", + "conditionalVisibilities": [ + { + "comparison": "isNotEqualTo", + "parameterName": "selected_behavior", + "value": "none" + } + ], + "conditionalVisibility": { + "parameterName": "selected_behavior", + "comparison": "isNotEqualTo", + "value": "none" + }, + "styleSettings": { + "margin": "8px", + "showBorder": true, + "padding": "6px" + } + } + ], + "exportParameters": true + }, + "name": "group-behaviors", + "styleSettings": { + "margin": "10px", + "padding": "8px", + "showBorder": false + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "---\n## Organization Attacks" + }, + "name": "h-attacks", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskAttacks | where TimeGenerated {TimeRange} | where isnotempty(AttackType) | summarize arg_max(TimeGenerated, *) by AttackType\n| project ATTACKTYPE = AttackTypeName, ['ATTACK FACTOR'] = AttackTypeFactorLabel, ['ATTACK SCORE'] = AttackTypeScore, ['TOTAL EVENTS'] = AttackTypeTotal\n| sort by ['TOTAL EVENTS'] desc", + "size": 3, + "title": "Organization Attacks", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "filter": true, + "formatters": [ + { + "columnMatch": "HUMAN RISK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SIMULATED PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ACTUAL PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "TRAINING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "MALWARE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SENSITIVE DATA HANDLING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ATTACK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ATTACK FACTOR", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Very Low", + "representation": "green", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "blue", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "yellow", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "High", + "representation": "orange", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Very High", + "representation": "redBright", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Not Scored", + "representation": "gray", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "gray", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "TOTAL EVENTS", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + } + ], + "rowLimit": 10000 + }, + "exportFieldName": "ATTACKTYPE", + "exportDefaultValue": "none", + "exportParameterName": "selected_attack", + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true + }, + "name": "q16", + "styleSettings": { + "margin": "8px", + "showBorder": true, + "padding": "6px" + } + }, + { + "type": 1, + "content": { + "json": "Click a row in the table above to see its event breakdown.", + "style": "info" + }, + "name": "h-attacks-info", + "styleSettings": { + "margin": "8px", + "showBorder": false + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskAttacks | where TimeGenerated {TimeRange} | where isnotempty(AttackType) | summarize arg_max(TimeGenerated, *) by AttackType\n| where AttackTypeName == '{selected_attack}'\n| extend k = bag_keys(AttackTypeEvents) | mv-expand k to typeof(string)\n| project ['EVENT TYPE'] = k, COUNT = toint(AttackTypeEvents[k])\n| where isnotnull(COUNT)\n| sort by COUNT desc", + "size": 3, + "title": "Event Breakdown for {selected_attack}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "filter": true, + "formatters": [ + { + "columnMatch": "HUMAN RISK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SIMULATED PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ACTUAL PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "TRAINING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "MALWARE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SENSITIVE DATA HANDLING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ATTACK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "COUNT", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + } + ], + "rowLimit": 10000 + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true + }, + "name": "q18", + "conditionalVisibilities": [ + { + "comparison": "isNotEqualTo", + "parameterName": "selected_attack", + "value": "none" + } + ], + "conditionalVisibility": { + "parameterName": "selected_attack", + "comparison": "isNotEqualTo", + "value": "none" + }, + "styleSettings": { + "margin": "8px", + "showBorder": true, + "padding": "6px" + } + } + ], + "exportParameters": true + }, + "name": "group-attacks", + "styleSettings": { + "margin": "10px", + "padding": "8px", + "showBorder": false + } + }, + { + "type": 1, + "content": { + "json": "_Refresh the page to load the latest collected snapshot._" + }, + "name": "h-footer", + "styleSettings": { + "margin": "10px", + "showBorder": false + } + } + ], + "exportParameters": true + }, + "name": "group-main", + "styleSettings": { + "margin": "8px", + "padding": "16px", + "showBorder": true + } + } + ], + "fromTemplateId": "b8d6e9a4-3c1f-4e7a-9f52-6a0d1c7e2b35", + "name": "MimecastHumanRisk", + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json index 7cb1c90f448..302170290bd 100644 --- a/Workbooks/WorkbooksMetadata.json +++ b/Workbooks/WorkbooksMetadata.json @@ -8152,6 +8152,26 @@ "subtitle": "", "provider": "Mimecast" }, + { + "workbookKey": "Mimecast_HumanRisk_Workbook", + "logoFileName": "Mimecast.svg", + "description": "A workbook providing insights into Mimecast Human Risk, including organization risk trends, behavior and attack metrics, and the individuals, departments and locations with the highest human risk.", + "dataTypesDependencies": [ + "MimecastHumanRisk_Organization_CL", + "MimecastHumanRisk_Behaviors_CL", + "MimecastHumanRisk_Attacks_CL", + "MimecastHumanRisk_Individuals_CL" + ], + "dataConnectorsDependencies": [ + "MimecastHumanRiskCCF" + ], + "previewImagesFileNames": [], + "version": "1.0.0", + "title": "Mimecast Human Risk Workbook", + "templateRelativePath": "Mimecast_HumanRisk_Workbook.json", + "subtitle": "", + "provider": "Mimecast" + }, { "workbookKey": "Mimecast_TTP_Workbook", "logoFileName": "Mimecast.svg",