Add HoneyForge Threat Detection solution v1.0.0

.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json

@@ -367,5 +367,6 @@
   "CatoNetworksEventsPush",
   "RecordedFuture",
   "DelineaPlatformConnector",
-  "NetcraftIntegrationGatewayDefinition"
-]
+  "NetcraftIntegrationGatewayDefinition",
+  "HoneyForge"
+]

Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml

@@ -0,0 +1,146 @@
+id: bb3b1339-c1fa-473a-8663-3fea78c2e7e2
+name: HoneyForge - Deception Sensor Interaction
+description: |
+  Detects an interaction with a HoneyForge deception sensor. Any activity
+  involving a HoneyForge sensor must be treated as potentially unauthorised
+  until validated by the security operations team.
+
+  HoneyForge sensors are passive decoy devices  - legitimate systems and users
+  should never communicate with them. Any detected interaction may indicate
+  network scanning, lateral movement, or an actively compromised device.
+severity: High
+status: Available
+requiredDataConnectors:
+  - connectorId: HoneyForge
+    dataTypes:
+      - CommonSecurityLog
+queryFrequency: 5m
+queryPeriod: 5m
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+  - Reconnaissance
+  - InitialAccess
+relevantTechniques:
+  - T1595
+  - T1590
+  - T1190
+  - T1133
+query: |
+  CommonSecurityLog
+  | where DeviceVendor =~ "BUI"
+  | where DeviceProduct =~ "HoneyForge"
+  | extend
+      SrcIpAddr = tostring(SourceIP),
+      DstIpAddr = tostring(DestinationIP),
+      SensorID = tostring(DeviceCustomString1),
+      CustomerID = tostring(DeviceCustomString2),
+      SensorName = iff(
+          isempty(tostring(DeviceCustomString3)),
+          tostring(Computer),
+          tostring(DeviceCustomString3)
+      ),
+      EventType = iff(
+          isempty(tostring(DeviceEventClassID)),
+          "unknown",
+          tostring(DeviceEventClassID)
+      ),
+      EventActivity = tostring(Activity),
+      EventProtocol = tostring(Protocol)
+  | where isnotempty(SrcIpAddr)
+  | where isnotempty(DstIpAddr)
+  | summarize
+      TimeGenerated = max(TimeGenerated),
+      FirstSeen = min(TimeGenerated),
+      LastSeen = max(TimeGenerated),
+      EventCount = count(),
+      SourcePorts = make_set(tostring(SourcePort), 20),
+      DestinationPorts = make_set(tostring(DestinationPort), 20),
+      Protocols = make_set(EventProtocol, 10),
+      Activities = make_set(EventActivity, 20),
+      CEFSeverities = make_set(tostring(LogSeverity), 10),
+      DeviceVersions = make_set(tostring(DeviceVersion), 10),
+      Collectors = make_set(tostring(Computer), 10)
+      by
+          SrcIpAddr,
+          DstIpAddr,
+          SensorID,
+          CustomerID,
+          SensorName,
+          EventType
+  | extend
+      SourcePortList = strcat_array(SourcePorts, ", "),
+      DestinationPortList = strcat_array(DestinationPorts, ", "),
+      ProtocolList = strcat_array(Protocols, ", "),
+      ActivityList = strcat_array(Activities, ", "),
+      CEFSeverityList = strcat_array(CEFSeverities, ", "),
+      DeviceVersionList = strcat_array(DeviceVersions, ", "),
+      CollectorList = strcat_array(Collectors, ", ")
+  | project
+      TimeGenerated,
+      FirstSeen,
+      LastSeen,
+      EventCount,
+      SrcIpAddr,
+      DstIpAddr,
+      SourcePortList,
+      DestinationPortList,
+      ProtocolList,
+      SensorID,
+      SensorName,
+      CustomerID,
+      EventType,
+      ActivityList,
+      CEFSeverityList,
+      DeviceVersionList,
+      CollectorList
+suppressionDuration: 5h
+suppressionEnabled: false
+incidentConfiguration:
+  createIncident: true
+  groupingConfiguration:
+    enabled: true
+    reopenClosedIncident: false
+    lookbackDuration: 4h
+    matchingMethod: Selected
+    groupByEntities:
+      - IP
+    groupByCustomDetails:
+      - Customer
+      - Sensor
+eventGroupingSettings:
+  aggregationKind: AlertPerResult
+alertDetailsOverride:
+  alertDisplayNameFormat: "HoneyForge: {{EventType}} from {{SrcIpAddr}} on {{SensorName}}"
+  alertDescriptionFormat: |
+    HoneyForge detected {{EventCount}} event(s) targeting {{DstIpAddr}}
+    using {{ProtocolList}}. Treat this activity as unauthorised until validated.
+customDetails:
+  Customer: CustomerID
+  Sensor: SensorID
+  SensorName: SensorName
+  EventType: EventType
+  Activity: ActivityList
+  SourcePorts: SourcePortList
+  DestinationPorts: DestinationPortList
+  Protocol: ProtocolList
+  EventCount: EventCount
+  FirstSeen: FirstSeen
+  LastSeen: LastSeen
+  DeviceVersion: DeviceVersionList
+  Collector: CollectorList
+entityMappings:
+  - entityType: IP
+    fieldMappings:
+      - identifier: Address
+        columnName: SrcIpAddr
+  - entityType: IP
+    fieldMappings:
+      - identifier: Address
+        columnName: DstIpAddr
+  - entityType: Host
+    fieldMappings:
+      - identifier: HostName
+        columnName: SensorName
+version: 1.0.0
+kind: NRT

Solutions/HoneyForge/Data Connectors/HoneyForge.json

@@ -0,0 +1,128 @@
+{
+    "id":  "HoneyForge",
+    "title":  "HoneyForge Threat Detection",
+    "publisher":  "BUI",
+    "descriptionMarkdown":  "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.",
+    "logo":  "Logos/HoneyForgeLogo.svg",
+    "graphQueriesTableName":  "CommonSecurityLog",
+    "graphQueries":  [
+                         {
+                             "metricName":  "Total events received",
+                             "legend":  "HoneyForge sensor events",
+                             "baseQuery":  "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\""
+                         }
+                     ],
+    "sampleQueries":  [
+                          {
+                              "description":  "All HoneyForge events — last 24 hours",
+                              "query":  "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated \u003e= ago(24h)\n| sort by TimeGenerated desc"
+                          },
+                          {
+                              "description":  "Top source IPs interacting with sensors — last 7 days",
+                              "query":  "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated \u003e= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc"
+                          },
+                          {
+                              "description":  "Events by sensor — last 7 days",
+                              "query":  "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated \u003e= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc"
+                          }
+                      ],
+    "connectivityCriterias":  [
+                                  {
+                                      "type":  "IsConnectedQuery",
+                                      "value":  [
+                                                    "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived \u003e ago(3d)"
+                                                ]
+                                  }
+                              ],
+    "dataTypes":  [
+                      {
+                          "name":  "CommonSecurityLog (HoneyForge)",
+                          "lastDataReceivedQuery":  "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
+                      }
+                  ],
+    "availability":  {
+                         "status":  1,
+                         "isPreview":  false
+                     },
+    "permissions":  {
+                        "resourceProvider":  [
+                                                 {
+                                                     "provider":  "Microsoft.OperationalInsights/workspaces",
+                                                     "permissionsDisplayText":  "read and write permissions are required.",
+                                                     "providerDisplayName":  "Workspace",
+                                                     "scope":  "Workspace",
+                                                     "requiredPermissions":  {
+                                                                                 "read":  true,
+                                                                                 "write":  true,
+                                                                                 "delete":  true
+                                                                             }
+                                                 },
+                                                 {
+                                                     "provider":  "Microsoft.OperationalInsights/workspaces/sharedKeys",
+                                                     "permissionsDisplayText":  "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
+                                                     "providerDisplayName":  "Keys",
+                                                     "scope":  "Workspace",
+                                                     "requiredPermissions":  {
+                                                                                 "action":  true
+                                                                             }
+                                                 }
+                                             ],
+                        "customs":  [
+                                        {
+                                            "description":  "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install)"
+                                        },
+                                        {
+                                            "description":  "The **Common Event Format (CEF) via AMA** solution must be installed in your Microsoft Sentinel workspace. [Install from Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/saas/azuresentinel.azure-sentinel-solution-commoneventformat)"
+                                        }
+                                    ]
+                    },
+    "instructionSteps":  [
+                             {
+                                 "title":  "",
+                                 "description":  "\u003e**NOTE:** This connector uses the **Common Event Format (CEF)** to forward HoneyForge sensor events to Microsoft Sentinel via syslog. An ASIM parser (`HoneyForgeEvent`) is deployed with this solution to normalise the events to the ASIM NetworkSession schema."
+                             },
+                             {
+                                 "title":  "Step 1 — Deploy the CEF syslog forwarder",
+                                 "description":  "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend",
+                                 "innerSteps":  [
+                                                    {
+                                                        "title":  "1.1 — Install the Log Analytics agent and CEF collector",
+                                                        "description":  "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Microsoft Sentinel workspace values.",
+                                                        "instructions":  [
+                                                                             {
+                                                                                 "parameters":  {
+                                                                                                    "fillWith":  [
+                                                                                                                     "WorkspaceId",
+                                                                                                                     "PrimaryKey"
+                                                                                                                 ],
+                                                                                                    "label":  "Run on the Linux forwarder:",
+                                                                                                    "value":  "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py \u0026\u0026 sudo python cef_installer.py {0} {1}"
+                                                                                                },
+                                                                                 "type":  "CopyableLabel"
+                                                                             }
+                                                                         ]
+                                                    }
+                                                ]
+                             },
+                             {
+                                 "title":  "Step 2 — Configure HoneyForge syslog forwarding",
+                                 "description":  "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za)."
+                             },
+                             {
+                                 "title":  "Step 3 — Validate connectivity",
+                                 "description":  "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:",
+                                 "instructions":  [
+                                                      {
+                                                          "parameters":  {
+                                                                             "fillWith":  [
+                                                                                              "WorkspaceId"
+                                                                                          ],
+                                                                             "label":  "Run the troubleshooter on the Linux forwarder:",
+                                                                             "value":  "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py \u0026\u0026 sudo python cef_troubleshoot.py {0}"
+                                                                         },
+                                                          "type":  "CopyableLabel"
+                                                      }
+                                                  ]
+                             }
+                         ]
+}

Solutions/HoneyForge/Data/Solution_HoneyForge.json

@@ -0,0 +1,27 @@
+{
+  "Name": "HoneyForge",
+  "Author": "BUI - support@bui.co.za",
+  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/HoneyForgeLogo.svg\" width=\"75px\" height=\"75px\">",
+  "Description": "The [HoneyForge](https://honeyforge.tech) solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.",
+  "Workbooks": [
+    "Solutions/HoneyForge/Workbooks/HoneyForge.json"
+  ],
+  "Data Connectors": [
+    "Solutions/HoneyForge/Data Connectors/HoneyForge.json"
+  ],
+  "Analytic Rules": [
+    "Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml"
+  ],
+  "Hunting Queries": [
+    "Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml",
+    "Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml",
+    "Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml",
+    "Solutions/HoneyForge/Hunting Queries/HoneyForge_RepeatedProbes.yaml",
+    "Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml"
+  ],
+  "BasePath": "C:\\GitHub\\Azure-Sentinel\\",
+  "Version": "3.0.0",
+  "Metadata": "SolutionMetadata.json",
+  "TemplateSpec": true,
+  "Is1PConnector": false
+}

Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml

@@ -0,0 +1,53 @@
+id: 7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c
+name: HoneyForge - Sensor Fleet Coverage and Health
+description: |
+  Provides a per-sensor event summary for the past 30 days, giving visibility
+  into which sensors are active, which are quiet, and which may be offline or
+  misconfigured (no events in the last 10 minutes is the offline threshold).
+
+  Use this query during routine operations to confirm full fleet coverage and
+  identify any gaps in your deception layer before an attacker does.
+requiredDataConnectors:
+  - connectorId: HoneyForge
+    dataTypes:
+      - CommonSecurityLog
+tactics:
+  - Reconnaissance
+relevantTechniques:
+  - T1595
+  - T1590
+query: |
+  let lookback = 30d;
+  let offlineThreshold = 10m;
+  CommonSecurityLog
+  | where TimeGenerated >= ago(lookback)
+  | where DeviceVendor =~ "BUI"
+  | where DeviceProduct =~ "HoneyForge"
+  | extend
+      SensorID   = tostring(DeviceCustomString1),
+      CustomerID = tostring(DeviceCustomString2),
+      SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))
+  | summarize
+      TotalEvents     = count(),
+      UniqueSources   = dcount(SourceIP),
+      FirstEvent      = min(TimeGenerated),
+      LastEvent       = max(TimeGenerated),
+      Protocols       = make_set(tostring(Protocol), 10)
+      by SensorID, SensorName, CustomerID
+  | extend
+      MinutesSinceLast = datetime_diff('minute', now(), LastEvent),
+      SensorStatus     = iff(datetime_diff('minute', now(), LastEvent) <= 10, "Online", "Offline / No Recent Events"),
+      ProtocolStr      = strcat_array(Protocols, ", ")
+  | sort by SensorStatus asc, LastEvent desc
+  | project
+      SensorName,
+      SensorID,
+      CustomerID,
+      SensorStatus,
+      MinutesSinceLast,
+      TotalEvents,
+      UniqueSources,
+      FirstEvent,
+      LastEvent,
+      ProtocolStr
+version: 1.0.0