Skip to content

Commit

Permalink
Update ReleaseNotes
Browse files Browse the repository at this point in the history
  • Loading branch information
v-rusraut committed Jul 17, 2023
1 parent 6a7b1f9 commit 5f43ce4
Show file tree
Hide file tree
Showing 3 changed files with 2 additions and 2 deletions.
Binary file modified Solutions/Legacy IOC based Threat Protection/Package/3.0.0.zip
Binary file not shown.
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
"config": {
"isWizard": false,
"basics": {
"description": "<img src ='https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg' width='75px' height='75px'>\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nMicrosoft Security Research, based on ongoing trends and exploits creates content that help identify existence of known IOCs based on known prevalent attacks and threat actor tactics/techniques, such as Nobelium, Gallium, Solorigate, etc. This solution contains packaged content written on some legacy IOCs that have been prevalent in the past but may still be relevant.\n\n**Pre-requisites:**\n\nThis is a [domain solution](https://learn.microsoft.com/azure/sentinel/sentinel-solutions-catalog#domain-solutions) and does not include any data connectors. The content in this solution supports the connectors listed below. Install one or more of the listed solutions, to unlock the value provided by this solution.\n\n1. [Squid Proxy](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-squidproxyazure-sentinel-solution-squidproxy)\n\n2. [Microsoft Windows DNS](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-dnsazure-sentinel-solution-dns)\n\n3. [Cisco ASA](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-ciscoasaazure-sentinel-solution-ciscoasa)\n\n4. [Palo Alto Networks](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-paloaltopanosazure-sentinel-solution-paloaltopanos)\n\n5. [Microsoft 365 Defender](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-microsoft365defenderazure-sentinel-solution-microsoft365defender)\n\n6. [Azure Firewall](https://ms.portal.azure.com/#create/sentinel4azurefirewall.sentinel4azurefirewallsentinel4azurefirewall)\n\n7. [ZScaler Internet Access](https://ms.portal.azure.com/#create/zscaler1579058425289.zscaler_internet_access_msszia_msentinel_v1)\n\n8. [Infoblox NIOS](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-infobloxniosazure-sentinel-solution-infobloxnios)\n\n9. [Google Cloud Platform DNS](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-gcpdnsazure-sentinel-solution-gcpdns)\n\n10. [NXLog DNS](https://ms.portal.azure.com/#create/nxlogltd1589381969261.nxlog_dns_logsnxlog-dns-plan1)\n\n11. [Cisco Umbrella](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-ciscoumbrellaazure-sentinel-solution-ciscoumbrella)\n\n12. [Corelight ](https://ms.portal.azure.com/#create/corelightinc1584998267292.corelight-for-azure-sentinelcorelight-for-azure-sentinel-solution-template)\n\n13. [Amazon Web Services](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-amazonwebservicesazure-sentinel-solution-amazonwebservices)\n\n14. [Windows Forwarded Events](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-windowsforwardedeventsazure-sentinel-solution-windowsforwardedevents)\n\n15. [Sysmon for Linux](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-sysmonforlinuxazure-sentinel-solution-sysmonforlinux)\n\n16. [Microsoft 365](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-office365azure-sentinel-solution-office365)\n\n17. [Windows Security Events](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-securityeventsazure-sentinel-solution-securityevents)\n\n18. [Azure Active Directory](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-azureactivedirectoryazure-sentinel-solution-azureactivedirectory)\n\n19. [Azure Activity](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-azureactivityazure-sentinel-solution-azureactivity)\n\n20. [F5 Advanced WAF](https://ms.portal.azure.com/#create/f5-networks.f5_bigip_mssf5-big-ip)\n\n21. [Fortinet FortiGate](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-fortinetfortigateazure-sentinel-solution-fortinetfortigate)\n\n22. [Check Point](https://ms.portal.azure.com/#create/checkpoint.checkpoint-sentinel-solutionssentinel-1)\n\n23. [Common Event Format](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-commoneventformatazure-sentinel-solution-commoneventformat)\n\n24. [Windows Firewall](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-windowsfirewallazure-sentinel-solution-windowsfirewall)\n\n**Analytic Rules:** 35, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
"description": "<img src ='https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg' width='75px' height='75px'>\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Legacy%20IOC%20based%20Threat%20Protection/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nMicrosoft Security Research, based on ongoing trends and exploits creates content that help identify existence of known IOCs based on known prevalent attacks and threat actor tactics/techniques, such as Nobelium, Gallium, Solorigate, etc. This solution contains packaged content written on some legacy IOCs that have been prevalent in the past but may still be relevant.\n\n**Pre-requisites:**\n\nThis is a [domain solution](https://learn.microsoft.com/azure/sentinel/sentinel-solutions-catalog#domain-solutions) and does not include any data connectors. The content in this solution supports the connectors listed below. Install one or more of the listed solutions, to unlock the value provided by this solution.\n\n1. [Squid Proxy](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-squidproxyazure-sentinel-solution-squidproxy)\n\n2. [Microsoft Windows DNS](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-dnsazure-sentinel-solution-dns)\n\n3. [Cisco ASA](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-ciscoasaazure-sentinel-solution-ciscoasa)\n\n4. [Palo Alto Networks](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-paloaltopanosazure-sentinel-solution-paloaltopanos)\n\n5. [Microsoft 365 Defender](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-microsoft365defenderazure-sentinel-solution-microsoft365defender)\n\n6. [Azure Firewall](https://ms.portal.azure.com/#create/sentinel4azurefirewall.sentinel4azurefirewallsentinel4azurefirewall)\n\n7. [ZScaler Internet Access](https://ms.portal.azure.com/#create/zscaler1579058425289.zscaler_internet_access_msszia_msentinel_v1)\n\n8. [Infoblox NIOS](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-infobloxniosazure-sentinel-solution-infobloxnios)\n\n9. [Google Cloud Platform DNS](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-gcpdnsazure-sentinel-solution-gcpdns)\n\n10. [NXLog DNS](https://ms.portal.azure.com/#create/nxlogltd1589381969261.nxlog_dns_logsnxlog-dns-plan1)\n\n11. [Cisco Umbrella](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-ciscoumbrellaazure-sentinel-solution-ciscoumbrella)\n\n12. [Corelight ](https://ms.portal.azure.com/#create/corelightinc1584998267292.corelight-for-azure-sentinelcorelight-for-azure-sentinel-solution-template)\n\n13. [Amazon Web Services](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-amazonwebservicesazure-sentinel-solution-amazonwebservices)\n\n14. [Windows Forwarded Events](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-windowsforwardedeventsazure-sentinel-solution-windowsforwardedevents)\n\n15. [Sysmon for Linux](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-sysmonforlinuxazure-sentinel-solution-sysmonforlinux)\n\n16. [Microsoft 365](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-office365azure-sentinel-solution-office365)\n\n17. [Windows Security Events](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-securityeventsazure-sentinel-solution-securityevents)\n\n18. [Azure Active Directory](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-azureactivedirectoryazure-sentinel-solution-azureactivedirectory)\n\n19. [Azure Activity](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-azureactivityazure-sentinel-solution-azureactivity)\n\n20. [F5 Advanced WAF](https://ms.portal.azure.com/#create/f5-networks.f5_bigip_mssf5-big-ip)\n\n21. [Fortinet FortiGate](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-fortinetfortigateazure-sentinel-solution-fortinetfortigate)\n\n22. [Check Point](https://ms.portal.azure.com/#create/checkpoint.checkpoint-sentinel-solutionssentinel-1)\n\n23. [Common Event Format](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-commoneventformatazure-sentinel-solution-commoneventformat)\n\n24. [Windows Firewall](https://ms.portal.azure.com/#create/azuresentinel.azure-sentinel-solution-windowsfirewallazure-sentinel-solution-windowsfirewall)\n\n**Analytic Rules:** 35, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
"subscription": {
"resourceProviders": [
"Microsoft.OperationsManagement/solutions",
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
|-------------|--------------------------------|--------------------------------------------------------------------|
| 3.0.0 | 19-05-2023 |**Analytic Rules**Depreciating outdated IOC Based Detection Queries |
| 3.0.0 | 19-05-2023 |**Analytic Rules** deprecating outdated IOC Based Detection Queries |
| | | |

0 comments on commit 5f43ce4

Please sign in to comment.