diff --git a/Solutions/Delinea Platform/Data Connectors/DelineaAuditLogs_ccf/Delinea_PollingConfig.json b/Solutions/Delinea Platform/Data Connectors/DelineaAuditLogs_ccf/Delinea_PollingConfig.json index 02ef2b5ab8d..b6aca0bf9b4 100644 --- a/Solutions/Delinea Platform/Data Connectors/DelineaAuditLogs_ccf/Delinea_PollingConfig.json +++ b/Solutions/Delinea Platform/Data Connectors/DelineaAuditLogs_ccf/Delinea_PollingConfig.json @@ -40,6 +40,7 @@ "queryParameters": { "api-version": "2.0", "PageSize": "200", + "Page": "1", "StartDateTime": "{_QueryWindowStartTime}", "EndDateTime": "{_QueryWindowEndTime}", "Levels": "[[parameters('auditLevels')]", diff --git a/Solutions/Delinea Platform/Data/Solution_DelineaPlatform.json b/Solutions/Delinea Platform/Data/Solution_DelineaPlatform.json index a038d7312b0..972d3f5d2cf 100644 --- a/Solutions/Delinea Platform/Data/Solution_DelineaPlatform.json +++ b/Solutions/Delinea Platform/Data/Solution_DelineaPlatform.json @@ -37,7 +37,7 @@ "Hunting Queries/DelineaRareEventTypes.yaml" ], "BasePath": ".", - "Version": "3.0.0", + "Version": "3.0.1", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false diff --git a/Solutions/Delinea Platform/Package/3.0.1.zip b/Solutions/Delinea Platform/Package/3.0.1.zip new file mode 100644 index 00000000000..af6a4aef27c Binary files /dev/null and b/Solutions/Delinea Platform/Package/3.0.1.zip differ diff --git a/Solutions/Delinea Platform/Package/mainTemplate.json b/Solutions/Delinea Platform/Package/mainTemplate.json index f8daaba7bf1..a6df471f093 100644 --- a/Solutions/Delinea Platform/Package/mainTemplate.json +++ b/Solutions/Delinea Platform/Package/mainTemplate.json @@ -77,11 +77,11 @@ }, "variables": { "_solutionName": "Delinea Platform", - "_solutionVersion": "3.0.0", + "_solutionVersion": "3.0.1", "solutionId": "delineainc1667920346745.delinea_platform_direct", "_solutionId": "[variables('solutionId')]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "dataConnectorCCPVersion": "3.0.0", + "dataConnectorCCPVersion": "3.0.1", "_dataConnectorContentIdConnectorDefinition1": "DelineaPlatformConnector", "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]", "_dataConnectorContentIdConnections1": "DelineaPlatformConnectorConnections", @@ -1366,6 +1366,7 @@ "queryParameters": { "api-version": "2.0", "PageSize": "200", + "Page": "1", "StartDateTime": "{_QueryWindowStartTime}", "EndDateTime": "{_QueryWindowEndTime}", "Levels": "[[parameters('auditLevels')]", @@ -1408,7 +1409,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ASimAuditEventDelineaPlatform Data Parser with template version 3.0.0", + "description": "ASimAuditEventDelineaPlatform Data Parser with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", @@ -1538,7 +1539,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "vimAuditEventDelineaPlatform Data Parser with template version 3.0.0", + "description": "vimAuditEventDelineaPlatform Data Parser with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject2').parserVersion2]", @@ -1668,7 +1669,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaIdentityAuthOverview Workbook with template version 3.0.0", + "description": "DelineaIdentityAuthOverview Workbook with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -1755,7 +1756,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaSecretServerVaultActivity Workbook with template version 3.0.0", + "description": "DelineaSecretServerVaultActivity Workbook with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion2')]", @@ -1842,7 +1843,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaPrivilegedAccessThreatHunting Workbook with template version 3.0.0", + "description": "DelineaPrivilegedAccessThreatHunting Workbook with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion3')]", @@ -1929,7 +1930,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaUserActivityInvestigation Workbook with template version 3.0.0", + "description": "DelineaUserActivityInvestigation Workbook with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion4')]", @@ -2016,7 +2017,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaMassSecretAccess_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "DelineaMassSecretAccess_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -2044,10 +2045,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "DelineaPlatformConnector", "dataTypes": [ "DelineaAuditEvents_CL" - ] + ], + "connectorId": "DelineaPlatformConnector" } ], "tactics": [ @@ -2060,43 +2061,43 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "User" + "columnName": "User", + "identifier": "Name" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { - "identifier": "Address", - "columnName": "SrcIP" + "columnName": "SrcIP", + "identifier": "Address" } - ], - "entityType": "IP" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Exports": "Exports", "TotalOperations": "TotalOperations", + "Exports": "Exports", "DistinctSecrets": "DistinctSecrets" }, "incidentConfiguration": { - "createIncident": true, "groupingConfiguration": { + "reopenClosedIncident": false, + "matchingMethod": "Selected", "groupByEntities": [ "Account" ], - "matchingMethod": "Selected", - "reopenClosedIncident": false, - "lookbackDuration": "P1D", - "enabled": true - } + "enabled": true, + "lookbackDuration": "P1D" + }, + "createIncident": true } } }, @@ -2150,7 +2151,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaPrivilegedAccessAnomaly_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "DelineaPrivilegedAccessAnomaly_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -2178,10 +2179,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "DelineaPlatformConnector", "dataTypes": [ "DelineaAuditEvents_CL" - ] + ], + "connectorId": "DelineaPlatformConnector" } ], "tactics": [ @@ -2193,45 +2194,45 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "Actor" + "columnName": "Actor", + "identifier": "Name" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { - "identifier": "Address", - "columnName": "SrcIP" + "columnName": "SrcIP", + "identifier": "Address" } - ], - "entityType": "IP" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "TodayAccesses": "TodayAccesses", + "AnomalyThreshold": "AnomalyThreshold", "DeviationFactor": "DeviationFactor", "BaselineAvg": "BaselineAvg", - "AnomalyThreshold": "AnomalyThreshold", - "DistinctSecrets": "DistinctSecrets", - "TodayAccesses": "TodayAccesses" + "DistinctSecrets": "DistinctSecrets" }, "incidentConfiguration": { - "createIncident": true, "groupingConfiguration": { + "reopenClosedIncident": false, + "matchingMethod": "Selected", "groupByEntities": [ "Account" ], - "matchingMethod": "Selected", - "reopenClosedIncident": false, - "lookbackDuration": "P1D", - "enabled": true - } + "enabled": true, + "lookbackDuration": "P1D" + }, + "createIncident": true } } }, @@ -2285,7 +2286,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaFailedAuthSpike_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "DelineaFailedAuthSpike_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -2313,10 +2314,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "DelineaPlatformConnector", "dataTypes": [ "DelineaAuditEvents_CL" - ] + ], + "connectorId": "DelineaPlatformConnector" } ], "tactics": [ @@ -2327,43 +2328,43 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "Actor" + "columnName": "Actor", + "identifier": "Name" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { - "identifier": "Address", - "columnName": "SrcIP" + "columnName": "SrcIP", + "identifier": "Address" } - ], - "entityType": "IP" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Failures": "Failures", + "DistinctSourceIPs": "DistinctSourceIPs", "FailReasons": "FailReasons", - "DistinctSourceIPs": "DistinctSourceIPs" + "Failures": "Failures" }, "incidentConfiguration": { - "createIncident": true, "groupingConfiguration": { + "reopenClosedIncident": false, + "matchingMethod": "Selected", "groupByEntities": [ "Account" ], - "matchingMethod": "Selected", - "reopenClosedIncident": false, - "lookbackDuration": "P1D", - "enabled": true - } + "enabled": true, + "lookbackDuration": "P1D" + }, + "createIncident": true } } }, @@ -2417,7 +2418,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaSensitiveSecretNewUser_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "DelineaSensitiveSecretNewUser_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -2445,10 +2446,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "DelineaPlatformConnector", "dataTypes": [ "DelineaAuditEvents_CL" - ] + ], + "connectorId": "DelineaPlatformConnector" } ], "tactics": [ @@ -2462,81 +2463,81 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "Actor" + "columnName": "Actor", + "identifier": "Name" }, { - "identifier": "FullName", - "columnName": "ActorEmail" + "columnName": "ActorEmail", + "identifier": "FullName" } - ], - "entityType": "Account" + ] }, { + "entityType": "File", "fieldMappings": [ { - "identifier": "Name", - "columnName": "SecretName" + "columnName": "SecretName", + "identifier": "Name" }, { - "identifier": "Directory", - "columnName": "Folder" + "columnName": "Folder", + "identifier": "Directory" } - ], - "entityType": "File" + ] }, { + "entityType": "IP", "fieldMappings": [ { - "identifier": "Address", - "columnName": "SrcIP" + "columnName": "SrcIP", + "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "Host", "fieldMappings": [ { - "identifier": "HostName", - "columnName": "TargetHost" + "columnName": "TargetHost", + "identifier": "HostName" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { - "identifier": "Address", - "columnName": "TargetIP" + "columnName": "TargetIP", + "identifier": "Address" } - ], - "entityType": "IP" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "TargetServers": "TargetServers", - "Folder": "Folder", - "Accesses": "Accesses", "SecretName": "SecretName", + "Accesses": "Accesses", "SecretKey": "SecretKey", - "AccountNames": "AccountNames" + "AccountNames": "AccountNames", + "Folder": "Folder", + "TargetServers": "TargetServers" }, "incidentConfiguration": { - "createIncident": true, "groupingConfiguration": { + "reopenClosedIncident": false, + "matchingMethod": "Selected", "groupByEntities": [ "Account" ], - "matchingMethod": "Selected", - "reopenClosedIncident": false, - "lookbackDuration": "P1D", - "enabled": true - } + "enabled": true, + "lookbackDuration": "P1D" + }, + "createIncident": true } } }, @@ -2590,7 +2591,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaPrivilegeEscalation_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "DelineaPrivilegeEscalation_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -2618,10 +2619,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "DelineaPlatformConnector", "dataTypes": [ "DelineaAuditEvents_CL" - ] + ], + "connectorId": "DelineaPlatformConnector" } ], "tactics": [ @@ -2634,43 +2635,43 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "Actor" + "columnName": "Actor", + "identifier": "Name" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { - "identifier": "Address", - "columnName": "SrcIP" + "columnName": "SrcIP", + "identifier": "Address" } - ], - "entityType": "IP" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "EventNames": "EventNames", "Targets": "Targets", - "Changes": "Changes" + "Changes": "Changes", + "EventNames": "EventNames" }, "incidentConfiguration": { - "createIncident": true, "groupingConfiguration": { + "reopenClosedIncident": false, + "matchingMethod": "Selected", "groupByEntities": [ "Account" ], - "matchingMethod": "Selected", - "reopenClosedIncident": false, - "lookbackDuration": "P1D", - "enabled": true - } + "enabled": true, + "lookbackDuration": "P1D" + }, + "createIncident": true } } }, @@ -2724,7 +2725,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaPlatformConfigChange_AnalyticalRules Analytics Rule with template version 3.0.0", + "description": "DelineaPlatformConfigChange_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -2752,10 +2753,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "DelineaPlatformConnector", "dataTypes": [ "DelineaAuditEvents_CL" - ] + ], + "connectorId": "DelineaPlatformConnector" } ], "tactics": [ @@ -2769,43 +2770,43 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "Actor" + "columnName": "Actor", + "identifier": "Name" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { - "identifier": "Address", - "columnName": "SrcIP" + "columnName": "SrcIP", + "identifier": "Address" } - ], - "entityType": "IP" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "EventNames": "EventNames", "Targets": "Targets", - "Changes": "Changes" + "Changes": "Changes", + "EventNames": "EventNames" }, "incidentConfiguration": { - "createIncident": true, "groupingConfiguration": { + "reopenClosedIncident": false, + "matchingMethod": "Selected", "groupByEntities": [ "Account" ], - "matchingMethod": "Selected", - "reopenClosedIncident": false, - "lookbackDuration": "P1D", - "enabled": true - } + "enabled": true, + "lookbackDuration": "P1D" + }, + "createIncident": true } } }, @@ -2859,7 +2860,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaAuthFailuresByAccount_HuntingQueries Hunting Query with template version 3.0.0", + "description": "DelineaAuthFailuresByAccount_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -2943,7 +2944,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaSecretAccessFanout_HuntingQueries Hunting Query with template version 3.0.0", + "description": "DelineaSecretAccessFanout_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -3027,7 +3028,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaAllEventsByUser_HuntingQueries Hunting Query with template version 3.0.0", + "description": "DelineaAllEventsByUser_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -3111,7 +3112,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaEventsBySeverity_HuntingQueries Hunting Query with template version 3.0.0", + "description": "DelineaEventsBySeverity_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -3195,7 +3196,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaFailedOperations_HuntingQueries Hunting Query with template version 3.0.0", + "description": "DelineaFailedOperations_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -3279,7 +3280,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaConfigChanges_HuntingQueries Hunting Query with template version 3.0.0", + "description": "DelineaConfigChanges_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]", @@ -3363,7 +3364,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaSecretAccessAuditTrail_HuntingQueries Hunting Query with template version 3.0.0", + "description": "DelineaSecretAccessAuditTrail_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]", @@ -3447,7 +3448,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaActivityBySourceIP_HuntingQueries Hunting Query with template version 3.0.0", + "description": "DelineaActivityBySourceIP_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]", @@ -3531,7 +3532,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaOffHoursPrivilegedActivity_HuntingQueries Hunting Query with template version 3.0.0", + "description": "DelineaOffHoursPrivilegedActivity_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject9').huntingQueryVersion9]", @@ -3615,7 +3616,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DelineaRareEventTypes_HuntingQueries Hunting Query with template version 3.0.0", + "description": "DelineaRareEventTypes_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject10').huntingQueryVersion10]", @@ -3695,7 +3696,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.0", + "version": "3.0.1", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Delinea Platform", diff --git a/Solutions/Delinea Platform/ReleaseNotes.md b/Solutions/Delinea Platform/ReleaseNotes.md index ca82a4ebe99..99ed640a689 100644 --- a/Solutions/Delinea Platform/ReleaseNotes.md +++ b/Solutions/Delinea Platform/ReleaseNotes.md @@ -1,3 +1,4 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|--------------------| | 3.0.0 | 29-09-2026 | Initial Solution Release with CCF data connector, ASIM parsers, analytic rules, hunting queries and workbooks. | +| 3.0.1 | 23-10-2026 | Fixed missing parameter in audit query. |