Skip to content

Commit

Permalink
[Hunts] Add hunts to Sentinel 2023-04-01-preview version (#23139)
Browse files Browse the repository at this point in the history
* Add hunts files

* Include update in 200 description and add defaults

* Add back 201

* Update relation properties

* Update example

---------

Co-authored-by: Derrick Lee <[email protected]>
  • Loading branch information
yummyblabla and Derrick Lee authored Mar 27, 2023
1 parent 8a0624b commit ac6b0d6
Show file tree
Hide file tree
Showing 14 changed files with 1,455 additions and 0 deletions.

Large diffs are not rendered by default.

Original file line number Diff line number Diff line change
@@ -0,0 +1,100 @@
{
"parameters": {
"api-version": "2023-04-01-preview",
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a",
"resourceGroupName": "myRg",
"workspaceName": "myWorkspace",
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f",
"hunt": {
"properties": {
"displayName": "Log4J new hunt",
"description": "Log4J Hunt Description",
"status": "New",
"hypothesisStatus": "Unknown",
"attackTactics": [
"Reconnaissance"
],
"attackTechniques": [
"T1595"
],
"labels": [
"Label1",
"Label2"
],
"owner": {
"objectId": "873b5263-5d34-4149-b356-ad341b01e123"
}
}
}
},
"responses": {
"200": {
"body": {
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f",
"name": "163e7b2a-a2ec-4041-aaba-d878a38f265f",
"etag": "\"de00c408-0000-0c00-0000-62741e350000\"",
"type": "Microsoft.SecurityInsights/hunts",
"properties": {
"displayName": "Log4J new hunt",
"description": "Log4J Hunt Description",
"status": "New",
"hypothesisStatus": "Unknown",
"attackTactics": [
"Reconnaissance"
],
"attackTechniques": [
"T1595"
],
"huntStartTimeUtc": "2022-03-11T09:47:15.438Z",
"huntEndTimeUtc": "2022-03-12T09:47:15.438Z",
"labels": [
"Label1",
"Label2"
],
"owner": {
"objectId": "873b5263-5d34-4149-b356-ad341b01e123",
"email": "[email protected]",
"assignedTo": null,
"userPrincipalName": "John Doe",
"ownerType": "User"
}
}
}
},
"201": {
"body": {
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f",
"name": "163e7b2a-a2ec-4041-aaba-d878a38f265f",
"etag": "\"de00c408-0000-0c00-0000-62741e350000\"",
"type": "Microsoft.SecurityInsights/hunts",
"properties": {
"displayName": "Log4J new hunt",
"description": "Log4J Hunt Description",
"status": "New",
"hypothesisStatus": "Unknown",
"attackTactics": [
"Reconnaissance"
],
"attackTechniques": [
"T1595"
],
"huntSequenceNumber": 0,
"huntStartTimeUtc": "2022-03-11T09:47:15.438Z",
"huntEndTimeUtc": "2022-03-12T09:47:15.438Z",
"labels": [
"Label1",
"Label2"
],
"owner": {
"objectId": "873b5263-5d34-4149-b356-ad341b01e123",
"email": "[email protected]",
"assignedTo": null,
"userPrincipalName": "John Doe",
"ownerType": "User"
}
}
}
}
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
{
"parameters": {
"api-version": "2023-04-01-preview",
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a",
"resourceGroupName": "myRg",
"workspaceName": "myWorkspace",
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f",
"huntCommentId": "2216d0e1-91e3-4902-89fd-d2df8c535096",
"huntComment": {
"properties": {
"message": "This is a test comment."
}
}
},
"responses": {
"200": {
"body": {
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f/comments/2216d0e1-91e3-4902-89fd-d2df8c123456",
"name": "2216d0e1-91e3-4902-89fd-d2df8c123456",
"etag": "\"3102f74d-0000-0c00-0000-629e6e050000\"",
"type": "Microsoft.SecurityInsights/hunts/comments",
"systemData": {
"createdAt": "2021-08-15T16:42:38.8709453Z",
"createdBy": "[email protected]",
"createdByType": "User",
"lastModifiedAt": "2021-08-19T16:42:38.8709453Z",
"lastModifiedBy": "[email protected]",
"lastModifiedByType": "User"
},
"properties": {
"message": "This is a test comment."
}
}
},
"201": {
"body": {
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f/comments/2216d0e1-91e3-4902-89fd-d2df8c123456",
"name": "2216d0e1-91e3-4902-89fd-d2df8c123456",
"etag": "\"3102f74d-0000-0c00-0000-629e6e050000\"",
"type": "Microsoft.SecurityInsights/hunts/comments",
"systemData": {
"createdAt": "2021-08-15T16:42:38.8709453Z",
"createdBy": "[email protected]",
"createdByType": "User",
"lastModifiedAt": "2021-08-19T16:42:38.8709453Z",
"lastModifiedBy": "[email protected]",
"lastModifiedByType": "User"
},
"properties": {
"message": "This is a test comment."
}
}
}
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
{
"parameters": {
"api-version": "2023-04-01-preview",
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a",
"resourceGroupName": "myRg",
"workspaceName": "myWorkspace",
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f",
"huntRelationId": "2216d0e1-91e3-4902-89fd-d2df8c535096",
"huntRelation": {
"properties": {
"relatedResourceId": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/Bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096",
"labels": [
"Test Label"
]
}
}
},
"responses": {
"200": {
"body": {
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f/relations/2216d0e1-91e3-4902-89fd-d2df8c535096",
"name": "2216d0e1-91e3-4902-89fd-d2df8c535096",
"etag": "\"26012da2-0000-0c00-0000-627ad2760000\"",
"type": "Microsoft.SecurityInsights/hunts/relations",
"properties": {
"relatedResourceId": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/Bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096",
"relatedResourceName": "2216d0e1-91e3-4902-89fd-d2df8c535096",
"relatedResourceType": "Microsoft.SecurityInsights/Bookmarks",
"labels": [
"Test Label"
]
}
}
},
"201": {
"body": {
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f/relations/2216d0e1-91e3-4902-89fd-d2df8c535096",
"name": "2216d0e1-91e3-4902-89fd-d2df8c535096",
"etag": "\"26012da2-0000-0c00-0000-627ad2760000\"",
"type": "Microsoft.SecurityInsights/hunts/relations",
"properties": {
"relatedResourceId": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/Bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096",
"relatedResourceName": "2216d0e1-91e3-4902-89fd-d2df8c535096",
"relatedResourceType": "Microsoft.SecurityInsights/Bookmarks",
"labels": [
"Test Label"
]
}
}
}
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
{
"parameters": {
"api-version": "2023-04-01-preview",
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a",
"resourceGroupName": "myRg",
"workspaceName": "myWorkspace",
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f"
},
"responses": {
"200": {},
"204": {}
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
{
"parameters": {
"api-version": "2023-04-01-preview",
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a",
"resourceGroupName": "myRg",
"workspaceName": "myWorkspace",
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f",
"huntCommentId": "2216d0e1-91e3-4902-89fd-d2df8c123456"
},
"responses": {
"200": {},
"204": {}
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
{
"parameters": {
"api-version": "2023-04-01-preview",
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a",
"resourceGroupName": "myRg",
"workspaceName": "myWorkspace",
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f",
"huntRelationId": "2216d0e1-91e3-4902-89fd-d2df8c535096"
},
"responses": {
"200": {},
"204": {}
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
{
"parameters": {
"api-version": "2023-04-01-preview",
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a",
"resourceGroupName": "myRg",
"workspaceName": "myWorkspace",
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f"
},
"responses": {
"200": {
"body": {
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f",
"name": "163e7b2a-a2ec-4041-aaba-d878a38f265f",
"etag": "\"de00c408-0000-0c00-0000-62741e350000\"",
"type": "Microsoft.SecurityInsights/hunts",
"properties": {
"displayName": "Log4J new hunt ",
"description": "Log4J Hunt Description",
"status": "New",
"hypothesisStatus": "Unknown",
"attackTactics": [
"Reconnaissance"
],
"attackTechniques": [
"T1595"
],
"labels": [
"Label1",
"Label2"
],
"owner": {
"objectId": "873b5263-5d34-4149-b356-ad341b01e123",
"email": "[email protected]",
"assignedTo": null,
"userPrincipalName": "John Doe",
"ownerType": "User"
}
}
}
}
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
{
"parameters": {
"api-version": "2023-04-01-preview",
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a",
"resourceGroupName": "myRg",
"workspaceName": "myWorkspace",
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f",
"huntCommentId": "2216d0e1-91e3-4902-89fd-d2df8c535096"
},
"responses": {
"200": {
"body": {
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f/comments/2216d0e1-91e3-4902-89fd-d2df8c123456",
"name": "2216d0e1-91e3-4902-89fd-d2df8c123456",
"etag": "\"3102f74d-0000-0c00-0000-629e6e050000\"",
"type": "Microsoft.SecurityInsights/hunts/comments",
"systemData": {
"createdAt": "2021-08-15T16:42:38.8709453Z",
"createdBy": "[email protected]",
"createdByType": "User",
"lastModifiedAt": "2021-08-19T16:42:38.8709453Z",
"lastModifiedBy": "[email protected]",
"lastModifiedByType": "User"
},
"properties": {
"message": "This is a comment."
}
}
}
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
{
"parameters": {
"api-version": "2023-04-01-preview",
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a",
"resourceGroupName": "myRg",
"workspaceName": "myWorkspace",
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f"
},
"responses": {
"200": {
"body": {
"value": [
{
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f/comments/2216d0e1-91e3-4902-89fd-d2df8c123456",
"name": "2216d0e1-91e3-4902-89fd-d2df8c123456",
"etag": "\"3102f74d-0000-0c00-0000-629e6e050000\"",
"type": "Microsoft.SecurityInsights/hunts/comments",
"properties": {
"message": "This is a test comment."
}
}
]
}
}
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
{
"parameters": {
"api-version": "2023-04-01-preview",
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a",
"resourceGroupName": "myRg",
"workspaceName": "myWorkspace",
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f",
"huntRelationId": "2216d0e1-91e3-4902-89fd-d2df8c535096"
},
"responses": {
"200": {
"body": {
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f/relations/2216d0e1-91e3-4902-89fd-d2df8c535096",
"name": "2216d0e1-91e3-4902-89fd-d2df8c535096",
"etag": "\"26012da2-0000-0c00-0000-627ad2760000\"",
"type": "Microsoft.SecurityInsights/hunts/relations",
"properties": {
"relatedResourceId": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/Bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096",
"relatedResourceName": "2216d0e1-91e3-4902-89fd-d2df8c535096",
"relatedResourceType": "Microsoft.SecurityInsights/Bookmarks",
"labels": [
"label1"
]
}
}
}
}
}
Loading

0 comments on commit ac6b0d6

Please sign in to comment.