From 3082f3a6bc9c2fe7359fa86ef01f29106c10297b Mon Sep 17 00:00:00 2001 From: Luca Moretto Date: Fri, 21 Nov 2025 09:08:26 +0100 Subject: [PATCH 1/5] PLAT-5837: configurable API url --- .../data_connector_definition.json | 12 ++++++++++++ .../data_connector_poller.json | 4 ++-- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/data_connector_definition.json b/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/data_connector_definition.json index 53c332fb54c..d21d49d7284 100644 --- a/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/data_connector_definition.json +++ b/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/data_connector_definition.json @@ -72,6 +72,18 @@ { "description": "Connect using OAuth2 credentials", "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "API URL (optional)", + "placeholder": "https://api.shield.ermessecurity.com", + "type": "text", + "name": "apiUrl", + "validations": { + "required": false + } + } + }, { "type": "OAuthForm", "parameters": { diff --git a/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/data_connector_poller.json b/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/data_connector_poller.json index 34c02491a0b..9938b67af60 100644 --- a/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/data_connector_poller.json +++ b/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/data_connector_poller.json @@ -16,14 +16,14 @@ "ClientSecret": "{{clientSecret}}", "ClientId": "{{clientId}}", "GrantType": "client_credentials", - "TokenEndpoint": "https://api.shield.ermessecurity.com/oauth/token", + "TokenEndpoint": "[[concat(if(empty(parameters('apiUrl')), 'https://api.shield.ermessecurity.com', parameters('apiUrl')),'/oauth/token')]", "TokenEndpointHeaders": { "Content-Type": "application/x-www-form-urlencoded" }, "TokenEndpointQueryParameters": {} }, "request": { - "apiEndpoint": "https://api.shield.ermessecurity.com/public/v1/events", + "apiEndpoint": "[[concat(if(empty(parameters('apiUrl')), 'https://api.shield.ermessecurity.com', parameters('apiUrl')),'/public/v1/events')]", "httpMethod": "GET", "queryParameters": { "max_results": 100, From 94b316180a4bd66aad89d8e324ce6d9f5f7d3169 Mon Sep 17 00:00:00 2001 From: Luca Moretto Date: Fri, 21 Nov 2025 09:28:43 +0100 Subject: [PATCH 2/5] PLAT-5871: fixed timestamp extraction and expanded collected fields to include log_data (for relevant event categories) --- .../ErmesBrowserSecurityEvents_ccp/dcr.json | 16 +++++++++++++--- .../ErmesBrowserSecurityEvents_ccp/table.json | 5 +++++ 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/dcr.json b/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/dcr.json index 9dde26814b2..0d5a21070e4 100644 --- a/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/dcr.json +++ b/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/dcr.json @@ -11,7 +11,12 @@ { "name": "_created", "type": "string", - "description": "Event Timestamp" + "description": "Event creation timestamp (server ingestion/generation time)" + }, + { + "name": "timestamp", + "type": "string", + "description": "Event timestamp" }, { "name": "username", @@ -42,6 +47,11 @@ "name": "message", "type": "dynamic", "description": "Message" + }, + { + "name": "log_data", + "type": "dynamic", + "description": "Event-specific log data" } ] } @@ -62,9 +72,9 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | project TimeGenerated = todatetime([\"_created\"]), Username = username, ClientIP = client_ip, EventCategory = event_cat, EventId = event_id, Level = level, Message = tostring(message.en)", + "transformKql": "source | extend actual_timestamp = iff(isnotnull(timestamp), todatetime(timestamp), todatetime([\"_created\"])) | extend log_data_final = case(event_cat in (\"general\", \"dashboard_auth\", \"dashboard_audit\", \"device_status\"), parse_json('null'), log_data) | project TimeGenerated = actual_timestamp, Username = username, ClientIP = client_ip, EventCategory = event_cat, EventId = event_id, Level = level, Message = tostring(message.en), LogData = log_data_final", "outputStream": "Custom-ErmesBrowserSecurityEvents_CL" } ] } -}] \ No newline at end of file +}] diff --git a/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/table.json b/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/table.json index 482d61129cc..cfa28ae6f6b 100644 --- a/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/table.json +++ b/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/table.json @@ -42,6 +42,11 @@ "name": "Message", "type": "String", "description": "Message" + }, + { + "name": "LogData", + "type": "Dynamic", + "description": "Event-specific log data" } ] } From 0e5f5be2a9fecda8466ba12afd484cd5093ceea3 Mon Sep 17 00:00:00 2001 From: Luca Moretto Date: Fri, 21 Nov 2025 09:29:21 +0100 Subject: [PATCH 3/5] Fixed request configuration (time range and sorting) --- .../data_connector_poller.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/data_connector_poller.json b/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/data_connector_poller.json index 9938b67af60..abfc727c0c1 100644 --- a/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/data_connector_poller.json +++ b/Solutions/Ermes Browser Security/Data Connectors/ErmesBrowserSecurityEvents_ccp/data_connector_poller.json @@ -27,13 +27,13 @@ "httpMethod": "GET", "queryParameters": { "max_results": 100, - "sort": "-_created", + "sort": "_created", "is_azure": "[variables('_solutionVersion')]" }, "queryWindowInMin": 5, "queryTimeFormat": "yyyy-MM-ddTHH:mm:ss.000000+00:00", - "startTimeAttributeName": "gte__created", - "endTimeAttributeName": "lt__created", + "startTimeAttributeName": "gt__created", + "endTimeAttributeName": "lte__created", "rateLimitQps": 1, "retryCount": 3, "timeoutInSeconds": 30, From 03a802f98b3c295f669aa30a2ea2b7df92d44682 Mon Sep 17 00:00:00 2001 From: Luca Moretto Date: Fri, 21 Nov 2025 09:58:47 +0100 Subject: [PATCH 4/5] PLAT-5837 PLAT-5871: version bump and changelog --- .../Data/Solution_ErmesBrowserSecurity.json | 2 +- Solutions/Ermes Browser Security/ReleaseNotes.md | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/Solutions/Ermes Browser Security/Data/Solution_ErmesBrowserSecurity.json b/Solutions/Ermes Browser Security/Data/Solution_ErmesBrowserSecurity.json index 45d993daa0e..4dd7251cf5c 100644 --- a/Solutions/Ermes Browser Security/Data/Solution_ErmesBrowserSecurity.json +++ b/Solutions/Ermes Browser Security/Data/Solution_ErmesBrowserSecurity.json @@ -7,7 +7,7 @@ "Data Connectors/ErmesBrowserSecurityEvents_ccp/data_connector_definition.json" ], "BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Ermes Browser Security", - "Version": "3.0.3", + "Version": "3.1.0", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false diff --git a/Solutions/Ermes Browser Security/ReleaseNotes.md b/Solutions/Ermes Browser Security/ReleaseNotes.md index d5462adbd8b..592b44fd447 100644 --- a/Solutions/Ermes Browser Security/ReleaseNotes.md +++ b/Solutions/Ermes Browser Security/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|----------------------------------------------------| +| 3.1.0 | 21-11-2024 | Added custom API URL support and LogData field with additional event details | | 3.0.3 | 19-02-2024 | Updated _solutionVersion to dataConnectorCCPVersion.
Removed grant_type and added the Solution version to the query parameters | | 3.0.2 | 23-01-2024 | Updated paging type in **CCP Data Connector** | | 3.0.1 | 28-11-2023 | Updated **CCP Data Connector** | From 3775d1abeac9c3c5bdaa5866beadfce6fd6637b3 Mon Sep 17 00:00:00 2001 From: Luca Moretto Date: Thu, 11 Dec 2025 00:00:20 +0100 Subject: [PATCH 5/5] PLAT-5837 PLAT-5871: updated Package files using '/Tools/Create-Azure-Sentinel-Solution/V3/createSolutionV3.ps1' --- .../Ermes Browser Security/Package/3.1.0.zip | Bin 0 -> 6608 bytes .../Package/createUiDefinition.json | 4 +- .../Package/mainTemplate.json | 105 +++++++++++++----- 3 files changed, 80 insertions(+), 29 deletions(-) create mode 100644 Solutions/Ermes Browser Security/Package/3.1.0.zip diff --git a/Solutions/Ermes Browser Security/Package/3.1.0.zip b/Solutions/Ermes Browser Security/Package/3.1.0.zip new file mode 100644 index 0000000000000000000000000000000000000000..7aecb96e7c0b5c8bf4a0445bd869cf35bcc6b0a8 GIT binary patch literal 6608 zcmZ{pWl$VYldflA@Zbd3AVC5Q65K5~gS)%C6C8pEcgUa#Zo%DMf(8vv(7|P}n{V&0 z-L37e>aIR@s{ft0>O3z*0TDz1002+{9VW5*ga_naEl2iOtU4*{M<6(Rq~z=Oy3Rbw=wqy2UaY*a0;i%T~<+X|_tXo-mAp;HO7= z3#3?HO?8c}CvZG)C2-VbKGycrXdA*K-tg|lS!?sb)VEteXpK^`d2c8!s++xnJ9i$> zd)HpN@meuk^V_;v;`ik?un7-Bs(~*lYCEjMetzXix=%L?B-Jgu=`1AO)!}>2vG?9Z zyV~MXrEU!BA=!$Z`_Wo5RSp5$8vf{{%lh+?EOPbwrP-^=wpvhW$57h)pC|wvI{9j! z#UK>a7T;k}&OGE#wPt-L^M)U?wnq2M1QmYKWoI;fgbTBCf(7`Eu1$YcCU7}j+3AwZ zM<=ICNQ%3Pa0k85U}Vi;EJflXyty{898)wtLYRCc(px~jc~nqjo;-yM8xHOB=z}0v z^ZUcGo2$-a?a~1L%MZ=ZcLx})iI0z>EU}*+AJ1i|xll>9fAlif^7qN371*(H>1@l} zg4p6MC1%jp$>^Cc&roHT{sg@s5wR8OXMnqVWO%bUmv*KehAxIX8%gWjAL=z1+n!Hc z76o4Zl~xhQQ$8-&q(~4t>VjqhX@QBo&btZc;&OTyb7m^cc2if=($dC_0$$}dT&w~q zN0N-GAaq>b8JbvV0CDfO>86>4XBzE9-uoFiFpr2#%F}RImXn|`dDQbaSy&yXG99~9^pA*$;aB+@?d1#3@uDX@1DE6=}b$P z^5TI3X2%~MSbwbo6BHE~NA#OC(kLJo)GG;~w!|;zC_?kI)-Q*{pS#r3!mEo`8Mqf_ zVSP&e2q4n!lTuc_!j z-|Rx#=5IdohQG?9pfV#f2+c~ixU{Hgz!b$wR+Tr`9OogvE>U%@TM8i*%UGdjZudo6 znys<9xIvvAJ40@ALQbB0w#!$d`gvsUVCcQH9;4_8_!c(PDjPTV!rWel0?|r@aCp3m zhpXD9I(?Ov*>RHEb`1XgW(=d{Akrj_PBpJMr-{22aFl3scJQjulOh*p0x>b;xY2ws zU+UzOeCfL{Q%H%Cnl(ABUqJSSqm@Xe;e2HYdLbDxgf%Z!ZSw|Mw5wyKyccT0`h?3Bs`Tf^O1$^2ul}cyy{VA%bNG`<`Lj#PVAxzbWLTJL~+UM+OT4A+}8J&KI zt7?o(Q^8oLmL5HsvNBk$7UWJpYsJ#)AqU(~d&JLDX=GN=A(((^fGn+mP4-K!G+N%jF%8K4eNhcpolm5}IrR@=>= z8cxiCL(d#)cl*Gh9L+j>!t`^mqeDoKVbWF>=yKF~{u$yBjm)RAbk=)csvc2mihCoE#zY)N^5AZEquh ziJVOX6Y+$NOtNNB*n9pjf*M#WhA z0->eT(D1-&dgw!pz4@^5NUmb(fVc5jK5pQTOz=9!r=YwCN;cIk!byShlYn#ES!2X7 z-#g0_1qUmV=r_OZtU0Bx0%3tLD#(8mdz@o1gcKhDunq(OaQ}(Dqp7WvhNYv6!#~OY zFPT3zgt@KqCBNo>7jyMixXfc*o>F#zZxg;^-C=j#-MyZ{sNy72r95cH*P(pTP_h0XclnoXOp8Y# zJp%3p`v705l$SerE#viYi31NDE^+(%fCd2gfZuYBS@hxvzYv*mY}X%vk|W9sSK=(a z4G7yxRhhx`VitK}XqKB1mB@i69#go8ON_E4gcvY1fU!n1ngv(}furk$uMn8Zx~Bp- zA9yETPsB#dFjpBQ$HPDrr8qbth=B4ihofXd8XeTjsM+X5vdwJ?^c%IwzP^hrjm3^g z*CI)596*dri6e($zNOw{BoB6F28c6C(clo!CAtH2PcSY3plyUFwP0*nLZ}1`@7`ty7&UhC1Q_mZW(TxkGNM8M-c`?NjDnE#1c1C|W~JeXe^AKf z#1lDbQLIpr$fX$*gKm%HQ#9yc~NzC?->4IfdasJE@e-EuJ-5hKHq2?%R)@dpSl^ z6MM;RW5qNT*5NxsCwFH34O^=qjz$?%4`sgmDG=2jM#LR5v?c$l6eHze)K;)494ZF! z^73l6Yq@ky#js=XrrcM_FG6F`Np?%T5;gDMdWrpHIp9D+rojAtdZAd=D}e^nFOc}Y zQ(XRhn7|eYBWmd!0{HnOAulZTr=CXwiR7Co{5Ou2hb#S<;x&oBa@wDVhNBJEOGKw{ z{Afvj_~F1E1EUKmO13g!HB{{?m+$*ai-o&WWFYv){i12EWu;bgaTu2ldn~rik}=vO z7~bjX47e7Jkj`XZnaF9k;8sLTVjYabMi7DGHN+nKp09W1=50WSi}K-!f92X1Q&JnZ zDyz#$ja7Id`h>qXtn77_>zX$8g7(=$yg^P2!7R61o>h^fS>qV$X?0_=4N0DdTMR8w z&3~`#o1Myv3bEgSP1gq|B_ozPcGO5+2YydWtI859KmW5fg>{{#&q&_W?TvW3{^1H} z>WduWbi2-SA{a*(tZ+J)g>7jPbuUBLeZOr8@pl23rxwE_zW?b2ZJxMduCD5Ntv@IUfuBq zC5^R#POGRkNh)cle==sdt>aBt-~3k_S$71%wx)gX(lt`3$oF@PXX$@-gn#B-x5}+sBG`54_A51ux0Si!!2Qk)kAA5H?e9v9YZEeSvbn zg;9owH>YR`Mrg`S*78sS5ryK-N6u^7C|ur{-Ip2Lxz)@N?T3$vmFoQ9^v|gmRCm6| zjU6QEN8os~bkI?UQbWzoj}oAMxk)>KOTHtEjCvBIU2YVZ#Xt1P1c5f;!=QYmKus1k zp*fpUzTtC5CEU_#Aot1DU6zbgy}fbW1KlC(`e3D|UHn_P!?XO5BMn-wKYsxff+H3Q zkfc(dfY>x+u*_R2k)>sSkv}@R3}!f0Aai5WSCrPWWE zfRv3f3daI8kV*p>=6)N&U@=YwA3DIc?fEk9lIwAkHdpg{V=i9{b)Z{+M636y_#Hy7J!{J6b{U{#VS+eI*9gYDDki>8Arvqw&H(`bH2F=hWjOUGF{gbK>Yl2} zc0=@q01>M6Dc~JIB_*7*KuRx~oVJKNil%)s(2gU6(@1_#hEV>0Xba*($t5Uznq zD&u*q<4xP2$VF;7Ha7xLJWrek$4IcE@9T)iNU5h-Wl9{4M%G)=_kg<1Rn-qa5pO}z z47t?NnTvQK}Dj*_1!y74#Of(zvsDHLNf9rOa-@h-Z7kPfd+<`4%Gk(Yk+-Rjyu3@Pe)IeFoe zEI?`PCqef67S(fpdnuI!mK7a=BQFZx-z%)uJo>_)OaK0`$h&KQsXsjmyiQva+BBOz7UI;W+;XMjVzV}jXdY#k3XqnIhXO!AU!*>0J}C)h;85|jFVWa5TV_bdH{g(!1A z=P*jy{U;nQQi(xqa1Q<;ZD%-D;`Ui6_bMztK#@!Z8Z0W~aYkC%&+;o!B~N>H_q@_G zv6j<)O2j^E*UkVe+Y&ebdaVlU;_i9ng}x)E2@a7p_2|B~PXOjC!jE)vi&f{R|D0e3 zLum+PMO=luI>*=R1Y!Lf8}+me_h;`jdr-;40B-Zso-INZfB*Qde2F>h0JdC7j98na z>-wKpf{BywX4X^5tnWN~XkHcO) z9uh^^-i?zfm(92NY@fV&KAA2ehJSQyCH*BGU$w07 zkh8KPtYD3{blVjX>G-?c;iu}deDGa#l~V}2QK7nUpq?;R8KLVgjRseOhz@hNE(|(! zoF9O6c~SxXoBLTardwORc9B1*qS&UDEB3asQh&!{qV`m;6#$^cFh;O zy(tdn{vLS3y;tNeuj3f=$8RZjP}Qn^G1L4;S-*~i4S_%c)_CREHal((NeYjbofR9NrR)n-1X znLHwBf8&I7*Xg3QEfs@w2JBJ@f@_H2-F?*Gy&S`Dd0SEJB_DEVp0plp5SN|9rp^Gr z{=DPv#-!_}An2wCbyHlwDEz}UD`n+h=9{xC8)>fB3$F60uM7(=3HL>8`DE9C1RJkV{YM-Nu;z3)F_P}_6_)tTZj;BX;#V0=SdTo7sYS+nbQaAD)r>`H6nqSz zI!hZUCK6WJ20Fj^LcdPy=91i!-<`~|ZAB{cdZD4h!&AkUDKYp!+O#6|r*eYoMr>R( z$^%Pcw>!1mxUKksYcBIyw0fM|>xiPC*)rcR1s@rrJ>pgA+!aY8H-6Mgmi zpqu~3n>{bP&_Vxs0Ycx8mAYk|hAUh|14oo|N8Tv+);_4wGvZ$BT@fgIcxLxm69Pb5 z8(YM7n+ky!Ar}ID*~nRq}`4oIe4s(Q>;z> z!n`Av(nP!dp*4GjYZMHg#x!io_yJ6x#hZGcThdtj{k*sK|EAr{$g<|1NhG8eRMJq4 z1wvpR6V3`J({hKWn5UlPq~*V?omZ#j7m@|lYmN-oSn@O|Rz{64T(y6&Qu6Y9di1(B zYt?YPVJD&Mi&9D7nfFl5_LiiY8B?_KLso&4ifhnGz|4O7&+I$6OP779xRcRv^QW_T zouWzm;U8h5cCn2w6*VWb z`}V}N%&qi-UTL@r5;J@MUYHcCMo%3kK6l8N$)x#o1-P2C-`0&$J%$gS&k0Kk#m`Tt zQk=j9m6cn)aI>r9&%xc=7fn2nt3~x1nJXi4%c)WO5Al=UXQ6mb@2Beu-ucw&e0W-_ zc?Ng*-W)L|eC4A$tC$Y@_c=c$N?I7)LLUit_^W{$Ib4>YHhx>W-Ib0)`L3YRj1D5H z6iw67!$By@Vlf=jiG%0hDx*#hRiQA_h_hjy8vTgQ_z%;mR9ziSW-ngZ;y|S;t1U=q zJkf#`e_pE4x5z!TiVHOD%lk~n|J(v*(CfLs6l@)jlKzA#Wx<1Q}xZBP?=Op<_SMjt071g9s= zQg_LMad>88B+uKeE~ctl4XSfaX0v1=GD?H#FnQqCLQtBWa!6{Z%HzsI(XHnqy|Z)n z5wR*Sf6E7*4+H&!sf)<`xSCOGQsa(M!SZ$oR6Uz@;!zO*i=S8<&yalK>%8hA|6=A9 zaPYj-zB`wPVkN8h<>^sQP%3KQHg}U1DUUKJ*{OGCD`+Jc*PHnKhe@M?-bsFXK|?h8AcUotS2_~QGZLTDp#nk zC!Ap$fXVzN=dVj6{$!hqh*(c-t zr+**~h(Lh&fBPo?Xxe{8amat#|KXzi&n5qp$Nm2m06=lb=|4;6f6+OJ0uu6nt|0u& M@PD0$