Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Daviditkin bhe solution #11569

Merged
merged 52 commits into from
Dec 26, 2024
Merged

Daviditkin bhe solution #11569

merged 52 commits into from
Dec 26, 2024

Conversation

daviditkin
Copy link
Contributor

@daviditkin daviditkin commented Dec 16, 2024 •
edited
Loading

Required items, please complete

Change(s):

  • Analytic Rules/BloodHoundEnterpriseCriticalAttackPaths.yaml modified: query fixes
  • Solutions/BloodHound Enterprise/Analytic Rules/BloodHoundEnterpriseExposure.yaml modified: query fixes
  • Analytic Rules/BloodHoundEnterpriseTierZeroAssets.yaml modified: query fixes
  • Data Connectors/ pkg/ and handler.go modified to fix queries and transformations
  • Workbooks/BloodHoundEnterpriseAttackPathDetails.json fix queries and UI
  • Workbooks/BloodHoundEnterpriseAttackPathOverview.json fix queries and UI
  • Workbooks/BloodHoundEnterpriseAuditLogs.json fix queries and UI
  • Workbooks/BloodHoundEnterpriseAuditLogs.json fix queries and UI
  • Workbooks/BloodHoundEnterprisePosture.json fix queries and UI
  • Workbooks/BloodHoundEnterpriseTierZeroSearch.json fix queries and UI

Reason for Change(s):
Improvements to backend queries, transformation of data and query and UI in workbooks.

Version Updated:
-BloodHoundEnterpriseCriticalAttackPaths.yaml

  • BloodHoundEnterpriseExposure.yaml
  • BloodHoundEnterpriseTierZeroAssets.yaml

Testing Completed:

  • Yes

Checked that the validations are passing and have addressed any issues that are present:

  • Yes

Version updated:

  • Need Help
  • Analytic rules queries fixed.
  • Workbooks modified to fix

Checked that the validations are passing and have addressed any issues that are present:

  • Need Help

@daviditkin
Updating urls to reference daviditkin/Azure-Sentinel the daviditkin-b…
f350933 
…he-solution branch (this branch)
@daviditkin
updated deploy url to daviditkin
2b37854
@daviditkin
updated urls
396206a
@daviditkin
config error
96e8d2f
@daviditkin
remove local debug mods. oops
613a532
@daviditkin
map path_type to path title for aggregate data data_type finding_export
d261e3a
@daviditkin
typo minor
a19d7c0
@daviditkin
forgot to push bhe-funcapp.zip
90ee848
@daviditkin
clean up path title
cff2254
@daviditkin
debugging missing path_title for finding_export records.
5b6b7c4
@daviditkin
Modifications to workbooks based on craig comments. Not Audit yet.
ada828f
@daviditkin
Exposure % and max % correct
a0d4ee7
@daviditkin
remove hardcoded domain when getting path titles.
89ecf71
@daviditkin
Updated length of table and width of columns
51dc45f
@daviditkin
Time fixed, always show all audit log types regardless of time range.
abe19d3
@daviditkin
Types are now based on time range selected.
ef52093
@daviditkin
Posture times shown in y axis correctly.
65f9410
@daviditkin
Audit logs should show all the possible event types that are in the a…
93e9e80 
…udit log table
@daviditkin
Allows custom time range and type selection supports all.
8f3f1db
@daviditkin
refactor retrieving asset data for use by tier0 principal name lookup
ea2f57a
@daviditkin
minor check error
26e47da
@daviditkin
tier0 data now properly calculated / filtered
19a50a6
@daviditkin
New labels
1081c86
@daviditkin
connector and tier0 mods
5ad84c3
@daviditkin
skipping any errors retrieving tier0 data, like with audit. TODO prob…
b8d3148 
…ably should make all retrieval like this
@daviditkin
forgot zip deployed funcapp
e7e933a
@daviditkin
simplify. Are domainsid and domainid redundant?
0143f85
@daviditkin
update zip deploy of funcapp
2f2d8da
@daviditkin
fixed batch size calc.
dde3a1a
@daviditkin
new zip deploy
f56fb74
@daviditkin daviditkin requested review from a team as code owners December 16, 2024 16:38
@v-prasadboke v-prasadboke self-assigned this Dec 17, 2024
@v-prasadboke v-prasadboke added Connector Connector specialty review needed Solution Solution specialty review needed labels Dec 17, 2024
@v-prasadboke
Copy link
Contributor

Hello @daviditkin, Please update the branch from master once

@daviditkin
Copy link
Contributor Author

@v-prasadboke Is there any additional information you need from me?

@v-atulyadav v-atulyadav merged commit 18d5196 into Azure:master Dec 26, 2024
50 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@v-atulyadav v-atulyadav v-atulyadav approved these changes

@v-prasadboke v-prasadboke v-prasadboke approved these changes

Assignees

@v-prasadboke v-prasadboke

Labels
Connector Connector specialty review needed Solution Solution specialty review needed
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@daviditkin @v-prasadboke @v-atulyadav