[Marketplace Contribution] Microsoft Sentinel - Content Pack Update

[xsoar-bot]

Status

• In Progress
• Ready
• In Hold - (Reason for hold)

Contributor

@ispRM

Notes

Improved the fetching process by retrieving only incidents that meet the defined minimum severity, optimizing time and resource consumption where previously all incidents were collected and then filtered which made the process inefficient.

Example of queries that will be made on fetch_incidents based on the chosen Mimimum severity:

Original query for all the min severities:
"properties/incidentNumber gt 233809"

After this minor change:
If min_severity == "Informational" (no changes):
- "properties/incidentNumber gt 233809"
If min_severity == "High":
- "properties/incidentNumber gt 233809 and (properties/severity eq 'High')"
If min_severity == "Medium":
- "properties/incidentNumber gt 233809 and (properties/severity eq 'Medium' or properties/severity eq 'High')"
If min_severity == "Low":
- "properties/incidentNumber gt 233809 and (properties/severity eq 'Low' or properties/severity eq 'Medium' or properties/severity eq 'High')"

Auto-Generated Documentation Requiring Modification

• Packs/AzureSentinel/Integrations/AzureSentinel/README.md

Video Link

Short demo video of the Pack usage. Speeds up the review. Optional but recommended. Use a video sharing service such as Google Drive or YouTube.

[content-bot]

Thank you for your contribution. Your generosity and caring are unrivaled! Rest assured - our content wizard @inbalapt1 will very shortly look over your proposed changes.
For your convenience, here is a link to the contributions SLAs document.

[content-bot]

Thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution, please ask the reviewer to update your information in the pack contributors file. See more information here link

[ispRM]

Thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution, please ask the reviewer to update your information in the pack contributors file. See more information here link

Thank you for your message. I appreciate the opportunity to contribute to the XSOAR marketplace. If my contribution is accepted, please update my information in the pack contributors file with my name 'Rocco Mercante'.

[inbalapt1]

Hi @ispRM
Thanks for your contribution, we really appreciate it!

I've left some comments - please review and address them.
In addition please return the removed command examples from the Readme file.

Thanks in advance!

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
15 out of 21 committers have signed the CLA.

✅ inbalapt1
✅ yasta5
✅ ispRM
✅ sdaniel6
✅ ShacharKidor
✅ eyalpalo
✅ YuvHayun
✅ ilappe
✅ talzich
✅ barryyosi-panw
✅ mmhw
✅ RotemAmit
✅ amshamah419
✅ tomer-pan
✅ kamalq97
❌ drezvani
❌ lironcohen272
❌ jlevypaloalto
❌ eepstain
❌ tcarmeli1
❌ nbensalm-palo
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[inbalapt1]

Hi @ispRM ,
Great work!
We're ready for a demo. Please check this page, and let me know when you're available for one over DFIR.
Alternatively, feel free to send me (to this email - [email protected] or over DFIR - inbal apt) or add to the PR a recording of the demo.

[ispRM]

Hi @ispRM , Great work! We're ready for a demo. Please check this page, and let me know when you're available for one over DFIR. Alternatively, feel free to send me (to this email - [email protected] or over DFIR - inbal apt) or add to the PR a recording of the demo.

Ok I'll send you a demo video asap. Thank you!

[ispRM]

Hi @ispRM , Great work! We're ready for a demo. Please check this page, and let me know when you're available for one over DFIR. Alternatively, feel free to send me (to this email - [email protected] or over DFIR - inbal apt) or add to the PR a recording of the demo.

Hi @inbalapt1,

Let me now if you see the google drive link of the demo video sent to [email protected]

[inbalapt1]

Hi @ispRM , Great work! We're ready for a demo. Please check this page, and let me know when you're available for one over DFIR. Alternatively, feel free to send me (to this email - [email protected] or over DFIR - inbal apt) or add to the PR a recording of the demo.

Hi @inbalapt1,

Let me now if you see the google drive link of the demo video sent to [email protected]

Hi @ispRM ,
Thanks for the demo, looks good overall!
Do you have a way to demonstrate that when the severity is set to medium for example, the retrieved incidents include only high and medium severities?

[content-bot]

For the Reviewer: Trigger build request has been accepted for this contribution PR.

[content-bot]

For the Reviewer: Successfully created a pipeline in GitLab with url: https://gitlab.xdr.pan.local/xdr/cortex-content/content/-/pipelines/2986117

[inbalapt1]

Requires a force merge as it is incorrectly requesting signatures from irrelevant users on the CLA.

[github-actions]

Thank you for your contribution. Your external PR has been merged and the changes are now included in an internal PR for further review. The internal PR will be merged to the master branch within 3 business days.