MS Security Graph Update2 (#27695)

* Updated ModelingRules * Updated ReleaseNotes * Updated ReleaseNotes * Updated .yml configs * Reverted changes to .yml
demisto · Jul 2, 2023 · 83fc7ac · 83fc7ac
1 parent 9e62e5b
commit 83fc7ac
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 2 deletions.
diff --git a/Packs/MicrosoftGraphSecurity/ModelingRules/MicrosoftGraphSecurity/MicrosoftGraphSecurity.xif b/Packs/MicrosoftGraphSecurity/ModelingRules/MicrosoftGraphSecurity/MicrosoftGraphSecurity.xif
@@ -128,7 +128,7 @@ filter _reporting_device_name = "https://graph.microsoft.com/beta/security/alert
     xdm.target.file.size = to_integer(fileEvidence_fileDetails_fileSize),
     xdm.target.file.sha256 = fileEvidence_fileDetails_sha256,
     xdm.target.file.signer = fileEvidence_fileDetails_signer,
-    xdm.alert.mitre_techniques = mitreTechniques,
+    xdm.alert.mitre_techniques = arraymap(json_extract_array(mitreTechniques, "$"), replex("@element", "\"", "")),
     xdm.source.host.ipv4_addresses = check_ipv4,
     xdm.source.host.ipv6_addresses = check_ipv6,
     xdm.source.user.username = coalesce(mailboxEvidence_displayName, mailboxEvidence_primaryAddress, mailboxEvidence_userAccount_accountName, mailboxEvidence_userAccount_userPrincipalName, processEvidence_userAccount_accountName, processEvidence_userAccount_userPrincipalName, userEvidence_userAccount_accountName, userEvidence_userAccount_userPrincipalName, userEvidence_userAccount_displayName),

diff --git a/Packs/MicrosoftGraphSecurity/ReleaseNotes/2_1_23.md b/Packs/MicrosoftGraphSecurity/ReleaseNotes/2_1_23.md
@@ -0,0 +1,6 @@
+
+#### Modeling Rules
+
+##### Microsoft Graph Security Modeling Rules
+
+- Updated the Modeling Rule logic.
diff --git a/Packs/MicrosoftGraphSecurity/pack_metadata.json b/Packs/MicrosoftGraphSecurity/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "Microsoft Graph Security",
     "description": "Unified gateway to security insights - all from a unified Microsoft Graph\n  Security API.",
     "support": "xsoar",
-    "currentVersion": "2.1.22",
+    "currentVersion": "2.1.23",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",