diff --git a/CHANGELOG.md b/CHANGELOG.md index a70a121..cda8ba8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,11 @@ +# Version 4.0.3 +* Fix - problem loading some inputs on Windows system. [Issue #8](https://github.com/splunk/splunk-add-on-microsoft-azure/issues/8) and [Issue #12](https://github.com/splunk/splunk-add-on-microsoft-azure/issues/12) +* Added `name` parameter to the `[id]` stanza in `default/app.conf` +* Bumped `splunktaucclib` to version `6.0.6` to address potential credential corruption issues +* Fix - errant newline in `eventtypes.conf` for `azure_vuln` stanza. [Issue #19](https://github.com/splunk/splunk-add-on-microsoft-azure/issues/19) +* Fix - nextLink parameter is different for consumption input causing limited results. [Issue #20](https://github.com/splunk/splunk-add-on-microsoft-azure/issues/20) +* Increase REST request timeout to 60 seconds + # Version 4.0.2 * Bug fix - Problem creating new AAD Audit Input - [Issue #3](https://github.com/splunk/splunk-add-on-microsoft-azure/issues/3) * Bug fix - Azure AD User and Group pagination issue diff --git a/README.md b/README.md index b2d4bd5..4bc2b8e 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,7 @@ This add-on is built with Splunk's [UCC Generator](https://github.com/splunk/add Example: - ucc-gen --ta-version=4.0.2 + ucc-gen --ta-version=4.0.3 The add-on will be built in an `output` directory in the root of the repository. diff --git a/globalConfig.json b/globalConfig.json index 5aff6fb..4b94bb0 100644 --- a/globalConfig.json +++ b/globalConfig.json @@ -2,7 +2,7 @@ "meta": { "name": "TA-MS-AAD", "displayName": "Splunk Add-on for Microsoft Azure", - "version": "4.0.2", + "version": "4.0.3", "apiVersion": "3.0.0", "restRoot": "TA_MS_AAD", "schemaVersion": "0.0.3" diff --git a/package/app.manifest b/package/app.manifest index bef4d85..1b53e41 100644 --- a/package/app.manifest +++ b/package/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "TA-MS-AAD", - "version": "4.0.2" + "version": "4.0.3" }, "author": [ { diff --git a/package/bin/azure_consumption.py b/package/bin/azure_consumption.py index ed46274..6ad41ec 100755 --- a/package/bin/azure_consumption.py +++ b/package/bin/azure_consumption.py @@ -52,7 +52,7 @@ def get_start_date(helper, check_point_key): start_date = helper.get_arg("start_date") if (start_date not in [None,'']): d = dateutil.parser.parse(start_date) - helper.log_debug("_Splunk_ input_name=%s Getting start date. input_name=%s Start date in stanza: %s" % (input_name, start_date)) + helper.log_debug("_Splunk_ input_name=%s Getting start date. input_name=%s Start date in stanza: %s" % (input_name, input_name, start_date)) return d.strftime('%Y-%m-%d') else: # If there was no start date specified, default to 90 day ago diff --git a/package/bin/import_declare_test.py b/package/bin/import_declare_test.py index 181c233..22ee15c 100644 --- a/package/bin/import_declare_test.py +++ b/package/bin/import_declare_test.py @@ -17,7 +17,6 @@ ''' import os -import pwd import sys import warnings diff --git a/package/bin/ta_azure_utils/utils.py b/package/bin/ta_azure_utils/utils.py index babaab7..ec65c6a 100755 --- a/package/bin/ta_azure_utils/utils.py +++ b/package/bin/ta_azure_utils/utils.py @@ -26,7 +26,7 @@ from requests.packages.urllib3.util.retry import Retry import six -TIMEOUT = 5 #seconds +TIMEOUT = 60 #seconds def handle_nextLink(helper=None, response=None, session=None): if '@odata.nextLink' in response: @@ -74,14 +74,19 @@ def get_items(helper, access_token, url, items=[]): response_json = json.loads(r.content) items += response_json['value'] + nextLink = None if '@odata.nextLink' in response_json: nextLink = response_json['@odata.nextLink'] + if 'nextLink' in response_json: + nextLink = response_json['nextLink'] + + if nextLink: # This should never happen, but just in case... if not is_https(nextLink): raise ValueError("nextLink scheme is not HTTPS. nextLink URL: %s" % nextLink) - helper.log_debug("_Splunk_ nextLink URL (@odata.nextLink): %s" % nextLink) + helper.log_debug("_Splunk_ nextLink URL: %s" % nextLink) get_items(helper, access_token, nextLink, items) except Exception as e: @@ -123,11 +128,11 @@ def get_items_batch_session(helper=None, url=None, session=None): return response_json -def post_items_batch_session(helper=None, url=None, headers=None, data=None, session=None): +def post_items_batch_session(helper=None, url=None, headers=None, data=None, session=None, verify=False): t0 = time.time() try: - r = requests_retry_session(session=session).post(url=url, headers=headers, data=data, timeout=TIMEOUT) + r = requests_retry_session(session=session).post(url=url, headers=headers, data=data, timeout=TIMEOUT, verify=verify) r.raise_for_status() response_json = None response_json = json.loads(r.content) diff --git a/package/default/app.conf b/package/default/app.conf index 3e83d62..dacee7f 100644 --- a/package/default/app.conf +++ b/package/default/app.conf @@ -21,3 +21,5 @@ reload.ta_ms_aad_account = simple reload.ta_ms_aad_settings = simple reload.passwords = simple +[id] +name = TA-MS-AAD \ No newline at end of file diff --git a/package/default/data/ui/panels/aad_audit_changes_made_by_applications.xml b/package/default/data/ui/panels/aad_audit_changes_made_by_applications.xml deleted file mode 100644 index e019130..0000000 --- a/package/default/data/ui/panels/aad_audit_changes_made_by_applications.xml +++ /dev/null @@ -1,18 +0,0 @@ - - Azure AD Audit - Changes Made by Applications (Last 24 Hours) - - - sourcetype="ms:aad:audit" actorType=Application | stats count by activity actor.name "targets{}.modifiedProperties{}.oldValue" "targets{}.modifiedProperties{}.newValue" | fields - count | rename activity AS "Activity" actor.name AS "Application Name" "targets{}.name" AS "Target Name" "targets{}.modifiedProperties{}.oldValue" AS "Old Value" "targets{}.modifiedProperties{}.newValue" AS "New Value" - -24h@h - now - 1 - - - - - - - - -
- \ No newline at end of file diff --git a/package/default/data/ui/panels/aad_audit_changes_made_by_users.xml b/package/default/data/ui/panels/aad_audit_changes_made_by_users.xml deleted file mode 100644 index 00f2f9a..0000000 --- a/package/default/data/ui/panels/aad_audit_changes_made_by_users.xml +++ /dev/null @@ -1,18 +0,0 @@ - - Azure AD Audit - Changes Made by Users (Last 24 Hours) - - - sourcetype="ms:aad:audit" actorType=User | stats count by activity actor.userPrincipalName targets{}.name "targets{}.modifiedProperties{}.oldValue" "targets{}.modifiedProperties{}.newValue" | fields - count | rename activity AS "Activity" actor.userPrincipalName AS UPN "targets{}.name" AS "Target Name" "targets{}.modifiedProperties{}.oldValue" AS "Old Value" "targets{}.modifiedProperties{}.newValue" AS "New Value" - -24h@h - now - 1 - - - - - - - - -
- \ No newline at end of file diff --git a/package/default/data/ui/panels/aad_audit_top_activities.xml b/package/default/data/ui/panels/aad_audit_top_activities.xml deleted file mode 100644 index 2f796a0..0000000 --- a/package/default/data/ui/panels/aad_audit_top_activities.xml +++ /dev/null @@ -1,37 +0,0 @@ - - Azure AD Audit - Top Activities (Last 24 Hours) - - - sourcetype="ms:aad:audit"| top limit=20 activity - -24h@h - now - 1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/package/default/data/ui/panels/aad_signin_failed_signins.xml b/package/default/data/ui/panels/aad_signin_failed_signins.xml deleted file mode 100644 index edb9d3f..0000000 --- a/package/default/data/ui/panels/aad_signin_failed_signins.xml +++ /dev/null @@ -1,18 +0,0 @@ - - Azure AD Sing-Ins - Failed Sign-ins (Last 24 Hours) - - - sourcetype="ms:aad:signin" loginStatus=Failure | stats count by userPrincipalName userDisplayName appDisplayName failureReason deviceInformation | rename userPrincipalName AS UPN userDisplayName AS Name appDisplayName AS "Application" failureReason AS "Failure Reason" deviceInformation AS "Device Information" | fields - count - -24h@h - now - 1 - - - - - - - - -
- \ No newline at end of file diff --git a/package/default/data/ui/panels/aad_signin_login_status.xml b/package/default/data/ui/panels/aad_signin_login_status.xml deleted file mode 100644 index 2ca1cd7..0000000 --- a/package/default/data/ui/panels/aad_signin_login_status.xml +++ /dev/null @@ -1,37 +0,0 @@ - - Azure AD Sign-Ins - Login Status (Last 24 Hours) - - - sourcetype="ms:aad:signin"| timechart count by loginStatus limit=10 - -24h@h - now - 1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/package/default/data/ui/panels/aad_signin_logins_by_geography.xml b/package/default/data/ui/panels/aad_signin_logins_by_geography.xml deleted file mode 100644 index 7e10031..0000000 --- a/package/default/data/ui/panels/aad_signin_logins_by_geography.xml +++ /dev/null @@ -1,36 +0,0 @@ - - Azure AD Sign-Ins - Logins by Geography (Last 24 Hours) - - - sourcetype="ms:aad:signin" | geostats latfield=geoCoordinates.latitude longfield=geoCoordinates.longitude count by loginStatus - -24h@h - now - 1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/package/default/data/ui/panels/aad_signin_top_application_signins.xml b/package/default/data/ui/panels/aad_signin_top_application_signins.xml deleted file mode 100644 index 89141c9..0000000 --- a/package/default/data/ui/panels/aad_signin_top_application_signins.xml +++ /dev/null @@ -1,37 +0,0 @@ - - Azure AD Sign-Ins - Top Application Sign-ins (Last 24 Hours) - - - sourcetype="ms:aad:signin"| top limit=20 appDisplayName - -24h@h - now - 1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/package/default/data/ui/views/configuration.xml b/package/default/data/ui/views/configuration.xml deleted file mode 100644 index 45b7be2..0000000 --- a/package/default/data/ui/views/configuration.xml +++ /dev/null @@ -1,4 +0,0 @@ - - - - diff --git a/package/default/data/ui/views/inputs.xml b/package/default/data/ui/views/inputs.xml deleted file mode 100644 index 6902efe..0000000 --- a/package/default/data/ui/views/inputs.xml +++ /dev/null @@ -1,4 +0,0 @@ - - - - diff --git a/package/default/eventtypes.conf b/package/default/eventtypes.conf index 47b046d..e62fd18 100644 --- a/package/default/eventtypes.conf +++ b/package/default/eventtypes.conf @@ -36,5 +36,4 @@ search = sourcetype="azure:vm:stop" search = sourcetype="m365:group:member:add" [azure_vuln] -search = (sourcetype=azure:resourcegraph type="microsoft.security/assessments/subAssessments" "properties.additionalData.assessedResourceType"=ServerVulnerability -properties.additionalData.cve{}.title=*) +search = (sourcetype=azure:resourcegraph type="microsoft.security/assessments/subAssessments" "properties.additionalData.assessedResourceType"=ServerVulnerability properties.additionalData.cve{}.title=*) \ No newline at end of file diff --git a/package/lib/requirements.txt b/package/lib/requirements.txt index d97e38d..b27b9a9 100644 --- a/package/lib/requirements.txt +++ b/package/lib/requirements.txt @@ -1,3 +1,3 @@ -splunktaucclib>=4.1.0 +splunktaucclib>=6.0.6 python-dateutil>=2.8.2 six>=1.16.0 \ No newline at end of file