diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODBinaryInAttachment.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODBinaryInAttachment.yaml index b3506047d11..98bf69a24f1 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODBinaryInAttachment.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODBinaryInAttachment.yaml @@ -5,9 +5,9 @@ description: | severity: Medium status: Available requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL queryFrequency: 10m queryPeriod: 10m triggerOperator: gt @@ -35,5 +35,5 @@ entityMappings: columnName: Name - identifier: UPNSuffix columnName: UPNSuffix -version: 1.0.3 +version: 1.0.4 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODDataExfiltrationToPrivateEmail.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODDataExfiltrationToPrivateEmail.yaml index 976ba240294..d878685859e 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODDataExfiltrationToPrivateEmail.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODDataExfiltrationToPrivateEmail.yaml @@ -5,9 +5,9 @@ description: | severity: Medium status: Available requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL queryFrequency: 10m queryPeriod: 10m triggerOperator: gt @@ -36,5 +36,5 @@ entityMappings: fieldMappings: - identifier: FullName columnName: AccountCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderIPinTIList.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderIPinTIList.yaml index fec7eb6a62e..34f389a210b 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderIPinTIList.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderIPinTIList.yaml @@ -10,9 +10,9 @@ requiredDataConnectors: - connectorId: ThreatIntelligenceTaxii dataTypes: - ThreatIntelligenceIndicator - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_maillog_CL + - ProofpointPODMailLog_CL queryFrequency: 1d queryPeriod: 14d triggerOperator: gt @@ -56,5 +56,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: ClientIP -version: 1.1.1 +version: 1.1.2 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderInTIList.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderInTIList.yaml index 022167e6d7c..3ad83afa9ba 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderInTIList.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderInTIList.yaml @@ -10,9 +10,9 @@ requiredDataConnectors: - connectorId: ThreatIntelligenceTaxii dataTypes: - ThreatIntelligenceIndicator - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_maillog_CL + - ProofpointPODMailLog_CL queryFrequency: 1d queryPeriod: 14d triggerOperator: gt @@ -48,5 +48,5 @@ entityMappings: fieldMappings: - identifier: FullName columnName: ClientEmail -version: 1.1.2 +version: 1.1.3 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODHighRiskNotDiscarded.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODHighRiskNotDiscarded.yaml index df36e5a496a..13e9936b65f 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODHighRiskNotDiscarded.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODHighRiskNotDiscarded.yaml @@ -5,9 +5,9 @@ description: | severity: Low status: Available requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL queryFrequency: 10m queryPeriod: 10m triggerOperator: gt @@ -31,5 +31,5 @@ entityMappings: fieldMappings: - identifier: FullName columnName: AccountCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleArchivedAttachmentsToSameRecipient.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleArchivedAttachmentsToSameRecipient.yaml index be5f6b026cd..05bb61c8bb1 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleArchivedAttachmentsToSameRecipient.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleArchivedAttachmentsToSameRecipient.yaml @@ -5,9 +5,9 @@ description: | severity: Medium status: Available requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL queryFrequency: 30m queryPeriod: 30m triggerOperator: gt @@ -34,5 +34,5 @@ entityMappings: fieldMappings: - identifier: FullName columnName: AccountCustomEntity -version: 1.0.2 +version: 1.0.3 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleLargeEmailsToSameRecipient.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleLargeEmailsToSameRecipient.yaml index a82899218e3..d41e5e6a82e 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleLargeEmailsToSameRecipient.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleLargeEmailsToSameRecipient.yaml @@ -5,9 +5,9 @@ description: | severity: Medium status: Available requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL queryFrequency: 30m queryPeriod: 30m triggerOperator: gt @@ -33,5 +33,5 @@ entityMappings: fieldMappings: - identifier: FullName columnName: AccountCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleProtectedEmailsToUnknownRecipient.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleProtectedEmailsToUnknownRecipient.yaml index 95adc94ac0e..021041e6ffb 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleProtectedEmailsToUnknownRecipient.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleProtectedEmailsToUnknownRecipient.yaml @@ -5,9 +5,9 @@ description: | severity: Medium status: Available requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL queryFrequency: 30m queryPeriod: 30m triggerOperator: gt @@ -45,5 +45,5 @@ entityMappings: fieldMappings: - identifier: FullName columnName: AccountCustomEntity -version: 1.1.1 +version: 1.1.2 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODSuspiciousAttachment.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODSuspiciousAttachment.yaml index 5254e098fdf..84f85adba15 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODSuspiciousAttachment.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODSuspiciousAttachment.yaml @@ -5,9 +5,9 @@ description: | severity: Medium status: Available requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL queryFrequency: 10m queryPeriod: 10m triggerOperator: gt @@ -32,5 +32,5 @@ entityMappings: fieldMappings: - identifier: FullName columnName: AccountCustomEntity -version: 1.0.2 +version: 1.0.3 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODWeakCiphers.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODWeakCiphers.yaml index cd6574d0ed2..6545bc19f4c 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODWeakCiphers.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODWeakCiphers.yaml @@ -5,9 +5,9 @@ description: | severity: Low status: Available requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -28,5 +28,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.3 +version: 1.0.4 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Data/Solution_ProofPointPOD.json b/Solutions/Proofpoint On demand(POD) Email Security/Data/Solution_ProofPointPOD.json index 340b494dae7..2d429aac0e2 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Data/Solution_ProofPointPOD.json +++ b/Solutions/Proofpoint On demand(POD) Email Security/Data/Solution_ProofPointPOD.json @@ -37,7 +37,7 @@ "Data Connectors/ProofPointEmailSecurity_CCP/ProofpointPOD_Definaton.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\solutions\\Proofpoint On demand(POD) Email Security", - "Version": "3.1.4", + "Version": "3.1.5", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreAdultValue.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreAdultValue.yaml index 4cc486dd3a3..71e95bbaaa0 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreAdultValue.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreAdultValue.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Emails with high score of 'adult' filter classifier value description: | 'Search for emails with high score of 'adult' filter classifier value.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - InitialAccess query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreMalwareValue.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreMalwareValue.yaml index 60d6724bf56..e69f68fce82 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreMalwareValue.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreMalwareValue.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Emails with high score of 'malware' filter classifier valu description: | 'Search for emails with high score of 'malware' filter classifier value.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - InitialAccess query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScorePhishValue.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScorePhishValue.yaml index 4c0495bb39d..2553c46835b 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScorePhishValue.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScorePhishValue.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Emails with high score of 'phish' filter classifier value description: | 'Search for emails with high score of 'phish' filter classifier value.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - InitialAccess query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreSpamValue.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreSpamValue.yaml index 6a1953eb3b3..de2f0ca8284 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreSpamValue.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreSpamValue.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Emails with high score of 'spam' filter classifier value description: | 'Search for emails with high score of 'spam' filter classifier value.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - InitialAccess query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreSuspectValue.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreSuspectValue.yaml index ce1534af839..edf75cf7239 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreSuspectValue.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreSuspectValue.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Emails with high score of 'suspect' filter classifier valu description: | 'Search for emails with high score of 'suspect' filter classifier value.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - InitialAccess query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODLargeOutboundEmails.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODLargeOutboundEmails.yaml index ae750bf286e..0b0f78bc70c 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODLargeOutboundEmails.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODLargeOutboundEmails.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Large size outbound emails description: | 'Search for emails which size is 2 times grater than average size of outbound email for user.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - Exfiltration query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODRecipientsHighNumberDiscardReject.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODRecipientsHighNumberDiscardReject.yaml index 5906295a920..04c96f59489 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODRecipientsHighNumberDiscardReject.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODRecipientsHighNumberDiscardReject.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Recipients with high number of discarded or rejected email description: | 'Search for recipients with high number of discarded or rejected emails.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - InitialAccess query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODRecipientsLargeNumberOfCorruptedEmails.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODRecipientsLargeNumberOfCorruptedEmails.yaml index bbafa6cadf3..49afe65554e 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODRecipientsLargeNumberOfCorruptedEmails.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODRecipientsLargeNumberOfCorruptedEmails.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Recipients with large number of corrupted emails description: | 'Search for recipients with large number of corrupted emails.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - InitialAccess query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODSendersLargeNumberOfCorruptedEmails.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODSendersLargeNumberOfCorruptedEmails.yaml index a3290537e63..3d123e19bbc 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODSendersLargeNumberOfCorruptedEmails.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODSendersLargeNumberOfCorruptedEmails.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Senders with large number of corrupted messages description: | 'Search for senders with large number of corrupted messages.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - InitialAccess query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODSuspiciousFileTypesInAttachments.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODSuspiciousFileTypesInAttachments.yaml index 2f9b918e65d..b4977e521ed 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODSuspiciousFileTypesInAttachments.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODSuspiciousFileTypesInAttachments.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Suspicious file types in attachments description: | 'Hunting for suspicious file types in attachments.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - InitialAccess query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Package/3.1.5.zip b/Solutions/Proofpoint On demand(POD) Email Security/Package/3.1.5.zip new file mode 100644 index 00000000000..7bb355fde1a Binary files /dev/null and b/Solutions/Proofpoint On demand(POD) Email Security/Package/3.1.5.zip differ diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Package/createUiDefinition.json b/Solutions/Proofpoint On demand(POD) Email Security/Package/createUiDefinition.json index aaa29383849..f9d3467b20a 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Package/createUiDefinition.json +++ b/Solutions/Proofpoint On demand(POD) Email Security/Package/createUiDefinition.json @@ -316,7 +316,7 @@ "name": "huntingquery1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Search for emails with high score of 'adult' filter classifier value. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Search for emails with high score of 'adult' filter classifier value. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] @@ -330,7 +330,7 @@ "name": "huntingquery2-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Search for emails with high score of 'malware' filter classifier value. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Search for emails with high score of 'malware' filter classifier value. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] @@ -344,7 +344,7 @@ "name": "huntingquery3-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Search for emails with high score of 'phish' filter classifier value. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Search for emails with high score of 'phish' filter classifier value. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] @@ -358,7 +358,7 @@ "name": "huntingquery4-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Search for emails with high score of 'spam' filter classifier value. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Search for emails with high score of 'spam' filter classifier value. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] @@ -372,7 +372,7 @@ "name": "huntingquery5-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Search for emails with high score of 'suspect' filter classifier value. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Search for emails with high score of 'suspect' filter classifier value. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] @@ -386,7 +386,7 @@ "name": "huntingquery6-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Search for emails which size is 2 times grater than average size of outbound email for user. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Search for emails which size is 2 times grater than average size of outbound email for user. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] @@ -400,7 +400,7 @@ "name": "huntingquery7-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Search for recipients with high number of discarded or rejected emails. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Search for recipients with high number of discarded or rejected emails. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] @@ -414,7 +414,7 @@ "name": "huntingquery8-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Search for recipients with large number of corrupted emails. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Search for recipients with large number of corrupted emails. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] @@ -428,7 +428,7 @@ "name": "huntingquery9-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Search for senders with large number of corrupted messages. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Search for senders with large number of corrupted messages. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] @@ -442,7 +442,7 @@ "name": "huntingquery10-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Hunting for suspicious file types in attachments. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Hunting for suspicious file types in attachments. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Package/mainTemplate.json b/Solutions/Proofpoint On demand(POD) Email Security/Package/mainTemplate.json index 1201e04f1a3..d572112b5a0 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Package/mainTemplate.json +++ b/Solutions/Proofpoint On demand(POD) Email Security/Package/mainTemplate.json @@ -55,7 +55,7 @@ "email": "azure-support@proofpoint.com", "_email": "[variables('email')]", "_solutionName": "Proofpoint On demand(POD) Email Security", - "_solutionVersion": "3.1.4", + "_solutionVersion": "3.1.5", "solutionId": "proofpointinc1600438591120.azure-sentinel-proofpointpod", "_solutionId": "[variables('solutionId')]", "workbookVersion1": "1.0.0", @@ -123,76 +123,76 @@ "huntingQueryTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('7b281f4a-6a9a-439f-8b4f-f08eb24f2fb7')))]" }, "analyticRuleObject1": { - "analyticRuleVersion1": "1.0.3", + "analyticRuleVersion1": "1.0.4", "_analyticRulecontentId1": "eb68b129-5f17-4f56-bf6d-dde48d5e615a", "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'eb68b129-5f17-4f56-bf6d-dde48d5e615a')]", "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('eb68b129-5f17-4f56-bf6d-dde48d5e615a')))]", - "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','eb68b129-5f17-4f56-bf6d-dde48d5e615a','-', '1.0.3')))]" + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','eb68b129-5f17-4f56-bf6d-dde48d5e615a','-', '1.0.4')))]" }, "analyticRuleObject2": { - "analyticRuleVersion2": "1.0.1", + "analyticRuleVersion2": "1.0.2", "_analyticRulecontentId2": "aedc5b33-2d7c-42cb-a692-f25ef637cbb1", "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'aedc5b33-2d7c-42cb-a692-f25ef637cbb1')]", "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('aedc5b33-2d7c-42cb-a692-f25ef637cbb1')))]", - "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','aedc5b33-2d7c-42cb-a692-f25ef637cbb1','-', '1.0.1')))]" + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','aedc5b33-2d7c-42cb-a692-f25ef637cbb1','-', '1.0.2')))]" }, "analyticRuleObject3": { - "analyticRuleVersion3": "1.0.1", + "analyticRuleVersion3": "1.0.2", "_analyticRulecontentId3": "c7cd6073-6d2c-4284-a5c8-da27605bdfde", "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c7cd6073-6d2c-4284-a5c8-da27605bdfde')]", "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c7cd6073-6d2c-4284-a5c8-da27605bdfde')))]", - "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c7cd6073-6d2c-4284-a5c8-da27605bdfde','-', '1.0.1')))]" + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c7cd6073-6d2c-4284-a5c8-da27605bdfde','-', '1.0.2')))]" }, "analyticRuleObject4": { - "analyticRuleVersion4": "1.0.2", + "analyticRuleVersion4": "1.0.3", "_analyticRulecontentId4": "bda5a2bd-979b-4828-a91f-27c2a5048f7f", "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'bda5a2bd-979b-4828-a91f-27c2a5048f7f')]", "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('bda5a2bd-979b-4828-a91f-27c2a5048f7f')))]", - "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','bda5a2bd-979b-4828-a91f-27c2a5048f7f','-', '1.0.2')))]" + "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','bda5a2bd-979b-4828-a91f-27c2a5048f7f','-', '1.0.3')))]" }, "analyticRuleObject5": { - "analyticRuleVersion5": "1.0.1", + "analyticRuleVersion5": "1.0.2", "_analyticRulecontentId5": "d1aba9a3-5ab1-45ef-8ed4-da57dc3c0d32", "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd1aba9a3-5ab1-45ef-8ed4-da57dc3c0d32')]", "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d1aba9a3-5ab1-45ef-8ed4-da57dc3c0d32')))]", - "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d1aba9a3-5ab1-45ef-8ed4-da57dc3c0d32','-', '1.0.1')))]" + "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d1aba9a3-5ab1-45ef-8ed4-da57dc3c0d32','-', '1.0.2')))]" }, "analyticRuleObject6": { - "analyticRuleVersion6": "1.1.1", + "analyticRuleVersion6": "1.1.2", "_analyticRulecontentId6": "f8127962-7739-4211-a4a9-390a7a00e91f", "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f8127962-7739-4211-a4a9-390a7a00e91f')]", "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f8127962-7739-4211-a4a9-390a7a00e91f')))]", - "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f8127962-7739-4211-a4a9-390a7a00e91f','-', '1.1.1')))]" + "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f8127962-7739-4211-a4a9-390a7a00e91f','-', '1.1.2')))]" }, "analyticRuleObject7": { - "analyticRuleVersion7": "1.0.2", + "analyticRuleVersion7": "1.0.3", "_analyticRulecontentId7": "f6a51e2c-2d6a-4f92-a090-cfb002ca611f", "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f6a51e2c-2d6a-4f92-a090-cfb002ca611f')]", "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f6a51e2c-2d6a-4f92-a090-cfb002ca611f')))]", - "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f6a51e2c-2d6a-4f92-a090-cfb002ca611f','-', '1.0.2')))]" + "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f6a51e2c-2d6a-4f92-a090-cfb002ca611f','-', '1.0.3')))]" }, "analyticRuleObject8": { - "analyticRuleVersion8": "1.0.3", + "analyticRuleVersion8": "1.0.4", "_analyticRulecontentId8": "56b0a0cd-894e-4b38-a0a1-c41d9f96649a", "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '56b0a0cd-894e-4b38-a0a1-c41d9f96649a')]", "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('56b0a0cd-894e-4b38-a0a1-c41d9f96649a')))]", - "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','56b0a0cd-894e-4b38-a0a1-c41d9f96649a','-', '1.0.3')))]" + "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','56b0a0cd-894e-4b38-a0a1-c41d9f96649a','-', '1.0.4')))]" }, "analyticRuleObject9": { - "analyticRuleVersion9": "1.1.2", + "analyticRuleVersion9": "1.1.3", "_analyticRulecontentId9": "35a0792a-1269-431e-ac93-7ae2980d4dde", "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '35a0792a-1269-431e-ac93-7ae2980d4dde')]", "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('35a0792a-1269-431e-ac93-7ae2980d4dde')))]", - "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','35a0792a-1269-431e-ac93-7ae2980d4dde','-', '1.1.2')))]" + "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','35a0792a-1269-431e-ac93-7ae2980d4dde','-', '1.1.3')))]" }, "analyticRuleObject10": { - "analyticRuleVersion10": "1.1.1", + "analyticRuleVersion10": "1.1.2", "_analyticRulecontentId10": "78979d32-e63f-4740-b206-cfb300c735e0", "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '78979d32-e63f-4740-b206-cfb300c735e0')]", "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('78979d32-e63f-4740-b206-cfb300c735e0')))]", - "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','78979d32-e63f-4740-b206-cfb300c735e0','-', '1.1.1')))]" + "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','78979d32-e63f-4740-b206-cfb300c735e0','-', '1.1.2')))]" }, - "dataConnectorCCPVersion": "3.1.4", + "dataConnectorCCPVersion": "3.1.5", "_dataConnectorContentIdConnectorDefinition1": "ProofpointCCPDefinition", "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]", "_dataConnectorContentIdConnections1": "ProofpointCCPDefinitionConnections", @@ -210,7 +210,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPOD Workbook with template version 3.1.4", + "description": "ProofpointPOD Workbook with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -271,7 +271,7 @@ "kind": "DataType" }, { - "contentId": "ProofpointPOD", + "contentId": "ProofpointCCPDefinition", "kind": "DataConnector" } ] @@ -302,7 +302,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPOD Data Parser with template version 3.1.4", + "description": "ProofpointPOD Data Parser with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", @@ -434,7 +434,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODHighScoreAdultValue_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODHighScoreAdultValue_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -515,7 +515,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODHighScoreMalwareValue_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODHighScoreMalwareValue_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -596,7 +596,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODHighScorePhishValue_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODHighScorePhishValue_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -677,7 +677,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODHighScoreSpamValue_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODHighScoreSpamValue_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -758,7 +758,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODHighScoreSuspectValue_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODHighScoreSuspectValue_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -839,7 +839,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODLargeOutboundEmails_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODLargeOutboundEmails_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]", @@ -920,7 +920,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODRecipientsHighNumberDiscardReject_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODRecipientsHighNumberDiscardReject_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]", @@ -1001,7 +1001,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODRecipientsLargeNumberOfCorruptedEmails_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODRecipientsLargeNumberOfCorruptedEmails_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]", @@ -1082,7 +1082,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODSendersLargeNumberOfCorruptedEmails_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODSendersLargeNumberOfCorruptedEmails_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject9').huntingQueryVersion9]", @@ -1163,7 +1163,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODSuspiciousFileTypesInAttachments_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODSuspiciousFileTypesInAttachments_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject10').huntingQueryVersion10]", @@ -1244,7 +1244,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODBinaryInAttachment_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODBinaryInAttachment_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -1272,10 +1272,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_message_CL" - ] + "ProofpointPODMessage_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -1352,7 +1352,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODDataExfiltrationToPrivateEmail_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODDataExfiltrationToPrivateEmail_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -1380,10 +1380,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_message_CL" - ] + "ProofpointPODMessage_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -1456,7 +1456,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODHighRiskNotDiscarded_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODHighRiskNotDiscarded_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -1484,10 +1484,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_message_CL" - ] + "ProofpointPODMessage_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -1560,7 +1560,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODMultipleArchivedAttachmentsToSameRecipient_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODMultipleArchivedAttachmentsToSameRecipient_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -1588,10 +1588,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_message_CL" - ] + "ProofpointPODMessage_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -1664,7 +1664,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODMultipleLargeEmailsToSameRecipient_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODMultipleLargeEmailsToSameRecipient_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -1692,10 +1692,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_message_CL" - ] + "ProofpointPODMessage_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -1768,7 +1768,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODMultipleProtectedEmailsToUnknownRecipient_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODMultipleProtectedEmailsToUnknownRecipient_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -1796,10 +1796,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_message_CL" - ] + "ProofpointPODMessage_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -1872,7 +1872,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODSuspiciousAttachment_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODSuspiciousAttachment_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -1900,10 +1900,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_message_CL" - ] + "ProofpointPODMessage_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -1976,7 +1976,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODWeakCiphers_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODWeakCiphers_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -2004,10 +2004,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_message_CL" - ] + "ProofpointPODMessage_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -2080,7 +2080,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODEmailSenderInTIList_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODEmailSenderInTIList_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -2108,22 +2108,22 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_maillog_CL" - ] + "ProofpointPODMailLog_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -2198,7 +2198,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODEmailSenderIPinTIList_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODEmailSenderIPinTIList_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -2226,22 +2226,22 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_maillog_CL" - ] + "ProofpointPODMailLog_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -3084,7 +3084,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.1.4", + "version": "3.1.5", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Proofpoint On demand(POD) Email Security", diff --git a/Solutions/Proofpoint On demand(POD) Email Security/ReleaseNotes.md b/Solutions/Proofpoint On demand(POD) Email Security/ReleaseNotes.md index 64bfa892983..76a1c832c00 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/ReleaseNotes.md +++ b/Solutions/Proofpoint On demand(POD) Email Security/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|------------------------------------------------------| +| 3.1.5 | 29-10-2026 | Update **Analytic Rules**, **Hunting Queries** and **Workbook** metadata to reference the CCF data connector (ProofpointCCPDefinition) and its tables.| | 3.1.4 | 17-04-2026 | Update **ProofpointPOD_PollingConfig.json** to pass sinceTime parameter with firstWindowBackfillInMin configuration.| | 3.1.3 | 19-03-2026 | Update **ProofpointPOD_PollingConfig.json** to pass user-agent header with solution package version.| | 3.1.2 | 08-12-2025 | Update **ProofpointPOD_PollingConfig.json** to remove start and end time query params, it impacts time frames at server side and causes duplicate data ingestion.| diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json index 02c3df1f0eb..ef7878b4cc4 100644 --- a/Workbooks/WorkbooksMetadata.json +++ b/Workbooks/WorkbooksMetadata.json @@ -2949,7 +2949,7 @@ "ProofpointPOD_message_CL" ], "dataConnectorsDependencies": [ - "ProofpointPOD" + "ProofpointCCPDefinition" ], "previewImagesFileNames": [ "ProofpointPODMainBlack1.png",