Replaced incorrect requiredtechniques with relevantTechniques

Solutions/BitSight/Analytic Rules/BitSightCompromisedSystemsDetected.yaml

@@ -14,7 +14,7 @@ triggerOperator: GreaterThan
 triggerThreshold: 0
 tactics:
   - Execution
-requiredTechniques:
+relevantTechniques:
   - T1203
 query: |
     let timeframe = 24h;
@@ -42,5 +42,5 @@ entityMappings:
         columnName: RiskVector
       - identifier: Category
         columnName: RiskCategory
-version: 1.0.1
+version: 1.0.2
 kind: Scheduled

Solutions/BitSight/Analytic Rules/BitSightDiligenceRiskCategoryDetected.yaml

@@ -15,7 +15,7 @@ triggerThreshold: 0
 tactics:
   - Execution
   - Reconnaissance
-requiredTechniques:
+relevantTechniques:
   - T1203
   - T1595.002
 query: |
@@ -44,5 +44,5 @@ entityMappings:
         columnName: RiskVector
       - identifier: Category
         columnName: RiskCategory
-version: 1.0.1
+version: 1.0.2
 kind: Scheduled

Solutions/BitSight/Analytic Rules/BitSightDropInCompanyRatings.yaml

@@ -15,7 +15,7 @@ triggerThreshold: 0
 tactics:
   - Reconnaissance
   - CommandAndControl
-requiredTechniques:
+relevantTechniques:
   - T1591
   - T1090
 query: |
@@ -35,5 +35,5 @@ alertDetailsOverride:
 customDetails:
   CompanyName: CompanyName
   CompanyRating: Rating
-version: 1.0.1
+version: 1.0.2
 kind: Scheduled

Solutions/BitSight/Analytic Rules/BitSightDropInHeadlineRating.yaml

@@ -15,7 +15,7 @@ triggerThreshold: 0
 tactics:
   - Reconnaissance
   - CommandAndControl
-requiredTechniques:
+relevantTechniques:
   - T1591
   - T1090
 query: |
@@ -34,5 +34,5 @@ alertDetailsOverride:
 customDetails:
   CompanyName: CompanyName
   CompanyRating: Rating
-version: 1.0.1
+version: 1.0.2
 kind: Scheduled

Solutions/BitSight/Package/mainTemplate.json

@@ -52,11 +52,11 @@
     "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
     "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]",
     "analyticRuleObject1": {
-      "analyticRuleVersion1": "1.0.1",
+      "analyticRuleVersion1": "1.0.2",
       "_analyticRulecontentId1": "d8844f11-3a36-4b97-9062-1e6d57c00e37",
       "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd8844f11-3a36-4b97-9062-1e6d57c00e37')]",
       "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d8844f11-3a36-4b97-9062-1e6d57c00e37')))]",
-      "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d8844f11-3a36-4b97-9062-1e6d57c00e37','-', '1.0.1')))]"
+      "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d8844f11-3a36-4b97-9062-1e6d57c00e37','-', '1.0.2')))]"
     },
     "analyticRuleObject2": {
       "analyticRuleVersion2": "1.0.1",
@@ -66,25 +66,25 @@
       "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a1275c5e-0ff4-4d15-a7b7-96018cd979f5','-', '1.0.1')))]"
     },
     "analyticRuleObject3": {
-      "analyticRuleVersion3": "1.0.1",
+      "analyticRuleVersion3": "1.0.2",
       "_analyticRulecontentId3": "d68b758a-b117-4cb8-8e1d-dcab5a4a2f21",
       "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd68b758a-b117-4cb8-8e1d-dcab5a4a2f21')]",
       "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d68b758a-b117-4cb8-8e1d-dcab5a4a2f21')))]",
-      "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d68b758a-b117-4cb8-8e1d-dcab5a4a2f21','-', '1.0.1')))]"
+      "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d68b758a-b117-4cb8-8e1d-dcab5a4a2f21','-', '1.0.2')))]"
     },
     "analyticRuleObject4": {
-      "analyticRuleVersion4": "1.0.1",
+      "analyticRuleVersion4": "1.0.2",
       "_analyticRulecontentId4": "161ed3ac-b242-4b13-8c6b-58716e5e9972",
       "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '161ed3ac-b242-4b13-8c6b-58716e5e9972')]",
       "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('161ed3ac-b242-4b13-8c6b-58716e5e9972')))]",
-      "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','161ed3ac-b242-4b13-8c6b-58716e5e9972','-', '1.0.1')))]"
+      "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','161ed3ac-b242-4b13-8c6b-58716e5e9972','-', '1.0.2')))]"
     },
     "analyticRuleObject5": {
-      "analyticRuleVersion5": "1.0.1",
+      "analyticRuleVersion5": "1.0.2",
       "_analyticRulecontentId5": "b11fdc35-6368-4cc0-8128-52cd2e2cdda0",
       "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'b11fdc35-6368-4cc0-8128-52cd2e2cdda0')]",
       "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('b11fdc35-6368-4cc0-8128-52cd2e2cdda0')))]",
-      "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b11fdc35-6368-4cc0-8128-52cd2e2cdda0','-', '1.0.1')))]"
+      "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b11fdc35-6368-4cc0-8128-52cd2e2cdda0','-', '1.0.2')))]"
     },
     "analyticRuleObject6": {
       "analyticRuleVersion6": "1.0.1",
@@ -347,22 +347,26 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "BitSight",
                     "dataTypes": [
                       "BitSightGraphData"
-                    ],
-                    "connectorId": "BitSight"
+                    ]
                   }
                 ],
                 "tactics": [
                   "Reconnaissance",
                   "CommandAndControl"
                 ],
+                "techniques": [
+                  "T1591",
+                  "T1090"
+                ],
                 "eventGroupingSettings": {
                   "aggregationKind": "AlertPerResult"
                 },
                 "customDetails": {
-                  "CompanyRating": "Rating",
-                  "CompanyName": "CompanyName"
+                  "CompanyName": "CompanyName",
+                  "CompanyRating": "Rating"
                 },
                 "alertDetailsOverride": {
                   "alertDisplayNameFormat": "BitSight : Alert for >10% drop in ratings of {{CompanyName}}.",
@@ -452,10 +456,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "BitSight",
                     "dataTypes": [
                       "BitSightAlerts"
-                    ],
-                    "connectorId": "BitSight"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -470,8 +474,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Url",
-                        "columnName": "CompanyURL"
+                        "columnName": "CompanyURL",
+                        "identifier": "Url"
                       }
                     ],
                     "entityType": "URL"
@@ -481,9 +485,9 @@
                   "aggregationKind": "AlertPerResult"
                 },
                 "alertDetailsOverride": {
-                  "alertDescriptionFormat": "Alert generated on {{AlertDate}} in BitSight.\\n\\nCompany URL: {{CompanyURL}}\\nAlert GUID: {{GUID}}",
                   "alertDisplayNameFormat": "BitSight: Alert for {{Trigger}} in {{CompanyName}} from bitsight.",
-                  "alertSeverityColumnName": "Severity"
+                  "alertSeverityColumnName": "Severity",
+                  "alertDescriptionFormat": "Alert generated on {{AlertDate}} in BitSight.\\n\\nCompany URL: {{CompanyURL}}\\nAlert GUID: {{GUID}}"
                 },
                 "incidentConfiguration": {
                   "createIncident": false
@@ -569,25 +573,28 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "BitSight",
                     "dataTypes": [
                       "BitSightFindingsData"
-                    ],
-                    "connectorId": "BitSight"
+                    ]
                   }
                 ],
                 "tactics": [
                   "Execution"
                 ],
+                "techniques": [
+                  "T1203"
+                ],
                 "entityMappings": [
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Name",
-                        "columnName": "RiskVector"
+                        "columnName": "RiskVector",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "Category",
-                        "columnName": "RiskCategory"
+                        "columnName": "RiskCategory",
+                        "identifier": "Category"
                       }
                     ],
                     "entityType": "Malware"
@@ -597,9 +604,9 @@
                   "aggregationKind": "AlertPerResult"
                 },
                 "alertDetailsOverride": {
-                  "alertDescriptionFormat": "Alert is generated for {{CompanyName}}.\\n\\nRisk Vector: {{RiskVector}}\\nTemporaryId: {{TemporaryId}}\\nRisk Category: Compromised Systems",
                   "alertDisplayNameFormat": "BitSight: Alert for {{RiskVector}} in {{CompanyName}} from BitSight",
-                  "alertSeverityColumnName": "Severity"
+                  "alertSeverityColumnName": "Severity",
+                  "alertDescriptionFormat": "Alert is generated for {{CompanyName}}.\\n\\nRisk Vector: {{RiskVector}}\\nTemporaryId: {{TemporaryId}}\\nRisk Category: Compromised Systems"
                 },
                 "incidentConfiguration": {
                   "createIncident": true
@@ -685,26 +692,33 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "BitSight",
                     "dataTypes": [
                       "BitSightFindingsData"
-                    ],
-                    "connectorId": "BitSight"
+                    ]
                   }
                 ],
                 "tactics": [
                   "Execution",
                   "Reconnaissance"
                 ],
+                "subTechniques": [
+                  "T1595.002"
+                ],
+                "techniques": [
+                  "T1203",
+                  "T1595"
+                ],
                 "entityMappings": [
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Name",
-                        "columnName": "RiskVector"
+                        "columnName": "RiskVector",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "Category",
-                        "columnName": "RiskCategory"
+                        "columnName": "RiskCategory",
+                        "identifier": "Category"
                       }
                     ],
                     "entityType": "Malware"
@@ -714,9 +728,9 @@
                   "aggregationKind": "AlertPerResult"
                 },
                 "alertDetailsOverride": {
-                  "alertDescriptionFormat": "Alert is generated for {{CompanyName}}.\\n\\nRisk Vector: {{RiskVector}}\\nTemporaryId: {{TemporaryId}}\\nRisk Category: Diligence",
                   "alertDisplayNameFormat": "BitSight: Alert for {{RiskVector}} in {{CompanyName}} from BitSight",
-                  "alertSeverityColumnName": "Severity"
+                  "alertSeverityColumnName": "Severity",
+                  "alertDescriptionFormat": "Alert is generated for {{CompanyName}}.\\n\\nRisk Vector: {{RiskVector}}\\nTemporaryId: {{TemporaryId}}\\nRisk Category: Diligence"
                 },
                 "incidentConfiguration": {
                   "createIncident": false
@@ -802,22 +816,26 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "BitSight",
                     "dataTypes": [
                       "BitSightGraphData"
-                    ],
-                    "connectorId": "BitSight"
+                    ]
                   }
                 ],
                 "tactics": [
                   "Reconnaissance",
                   "CommandAndControl"
                 ],
+                "techniques": [
+                  "T1591",
+                  "T1090"
+                ],
                 "eventGroupingSettings": {
                   "aggregationKind": "AlertPerResult"
                 },
                 "customDetails": {
-                  "CompanyRating": "Rating",
-                  "CompanyName": "CompanyName"
+                  "CompanyName": "CompanyName",
+                  "CompanyRating": "Rating"
                 },
                 "alertDetailsOverride": {
                   "alertDisplayNameFormat": "BitSight : Alert for drop in the headline rating of {{CompanyName}}.",
@@ -907,10 +925,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "BitSight",
                     "dataTypes": [
                       "BitSightBreaches"
-                    ],
-                    "connectorId": "BitSight"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -925,8 +943,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Url",
-                        "columnName": "PreviwURL"
+                        "columnName": "PreviwURL",
+                        "identifier": "Url"
                       }
                     ],
                     "entityType": "URL"
@@ -936,9 +954,9 @@
                   "aggregationKind": "AlertPerResult"
                 },
                 "alertDetailsOverride": {
-                  "alertDescriptionFormat": "Alert is generated on {{DateCreated}} at BitSight.\\n\\nGUID: {{GUID}}\\nPreview URL: {{PreviwURL}}",
                   "alertDisplayNameFormat": "BitSight: Alert for new breach in {{Companyname}}.",
-                  "alertSeverityColumnName": "Severity"
+                  "alertSeverityColumnName": "Severity",
+                  "alertDescriptionFormat": "Alert is generated on {{DateCreated}} at BitSight.\\n\\nGUID: {{GUID}}\\nPreview URL: {{PreviwURL}}"
                 },
                 "incidentConfiguration": {
                   "createIncident": false

Solutions/BitSight/ReleaseNotes.md

@@ -1,7 +1,6 @@
 | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History**                                                 |
 |-------------|--------------------------------|--------------------------------------------------------------------|
-| 3.0.2       | 26-07-2024                     | Update **Analytic rules** for missing TTP                          |
+| 3.0.2       | 19-12-2024                     | Fixed typo requiredtechniques with relevantTechniques in **Analytic Rules**    |
+|             | 26-07-2024                     | Update **Analytic rules** for missing TTP      |
 | 3.0.1       | 15-04-2024                     | Added Bitsight prefix in data tables name                           |
-| 3.0.0       | 23-01-2024                     | Updated **Data Connector** code with the fix of Pagination and Checkpoint related issue |
-
-
+| 3.0.0       | 23-01-2024                     | Updated **Data Connector** code with the fix of Pagination and Checkpoint related issue |

Solutions/CTM360/Analytic Rules/LeakedCredential.yaml

@@ -15,7 +15,7 @@ triggerThreshold: 0
 tactics:
   - CredentialAccess
   - ResourceDevelopment
-requiredTechniques:
+relevantTechniques:
   - T1555
   - T1586
 query: |+
@@ -34,5 +34,5 @@ incidentConfiguration:
 eventGroupingSettings:
   aggregationKind: SingleAlert
 suppressionDuration: 5h
-version: 1.0.2
+version: 1.0.3
 kind: Scheduled

Solutions/CTM360/Analytic Rules/Phishing.yaml

@@ -15,7 +15,7 @@ triggerThreshold: 0
 tactics:
   - InitialAccess
   - Reconnaissance
-requiredTechniques:
+relevantTechniques:
   - T1566
   - T1598
 query: |+
@@ -39,5 +39,5 @@ entityMappings:
   - identifier: Url
     columnName: subject_s
 suppressionDuration: 5h
-version: 1.0.2
+version: 1.0.3
 kind: Scheduled