-
Notifications
You must be signed in to change notification settings - Fork 3.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'master' into v-visodadasi/LinkNotWorking
- Loading branch information
Showing
51 changed files
with
4,556 additions
and
2,626 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| name: KQL Validations | ||
| run-name: KQL Validations running on ${{ github.ref_name }} | ||
| on: | ||
| pull_request: | ||
| branches: | ||
| - master | ||
| # Allows to run workflow manually from the Actions tab | ||
| workflow_dispatch: | ||
| jobs: | ||
| KqlValidations: | ||
| runs-on: ubuntu-latest | ||
| env: | ||
| buildConfiguration: Release | ||
| dotnetSdkVersion: 6.0.x | ||
| PRNUM: ${{ github.event.pull_request.number }} | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Use .NET Core SDK ${{ env.dotnetSdkVersion }} | ||
| uses: actions/setup-dotnet@v4 | ||
| with: | ||
| dotnet-version: ${{ env.dotnetSdkVersion }} | ||
| - name: Run KQL Validation tests | ||
| run: dotnet test .script/tests/KqlvalidationsTests/Kqlvalidations.Tests.csproj --configuration ${{ env.buildConfiguration }} | ||
| env: | ||
| GITHUBAPPID: ${{ secrets.APPLICATION_ID }} | ||
| GITHUBAPPINSTALLATIONID: ${{ secrets.APPLICATION_INSTALLATION_ID }} | ||
| GITHUBAPPPRIVATEKEY: ${{ secrets.APPLICATION_PRIVATE_KEY }} | ||
| SYSTEM_PULLREQUEST_ISFORK: ${{ github.event.pull_request.head.repo.fork }} | ||
|
|
113 changes: 113 additions & 0 deletions
113
.script/tests/KqlvalidationsTests/CustomTables/Rubrik_Events_Data_CL.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,113 @@ | ||
| { | ||
| "Name":"Rubrik_Events_Data_CL", | ||
| "Properties":[ | ||
| { | ||
| "Name": "TenantId", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "SourceSystem", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "MG", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "ManagementGroupName", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "TimeGenerated", | ||
| "Type": "datetime" | ||
| }, | ||
| { | ||
| "Name": "Computer", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "RawData", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "custom_details_objectId_g", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "custom_details_seriesId_g", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "custom_details_id_g", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "custom_details_clusterId_g", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "summary_s", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "source_s", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "severity_s", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "timestamp_s", | ||
| "Type": "datetime" | ||
| }, | ||
| { | ||
| "Name": "class_s", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "custom_details_type_s", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "custom_details_objectId_s", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "custom_details_objectName_s", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "custom_details_objectType_s", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "custom_details_status_s", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "custom_details_clusterName_s", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "custom_details_eventName_s", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "custom_details_auditUserName_s", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "custom_details_auditUserId_s", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "custom_details_location_s", | ||
| "Type": "string" | ||
| }, | ||
| { | ||
| "Name": "_ResourceId", | ||
| "Type": "string" | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| TimeGenerated [UTC],custom_details_objectId_g,custom_details_seriesId_g,custom_details_id_g,custom_details_clusterId_g,summary_s,source_s,severity_s,timestamp_s,class_s,custom_details_type_s,custom_details_objectId_s,custom_details_objectName_s,custom_details_objectType_s,custom_details_status_s,custom_details_clusterName_s,custom_details_eventName_s,custom_details_auditUserName_s,custom_details_auditUserId_s,custom_details_location_s | ||
| "11/8/2024, 5:30:42.136 AM",047ed0bc-6b72-4ea8-b9a0-c7fb89aa5811,01930a3b-e0cf-7b83-b02c-2db1087d3b0d,6617cef8-c37c-41db-988e-d8372bbe90f3,00000000-0000-0000-0000-000000000000,Waiting for 1 snapshot(s) to be available for file recovery.,Rubrik Security Cloud,info,2024-11-08T05:30:40.64979627Z,Index,Event,,use-test,AzureNativeVm,Running,Polaris,CloudNativeIndexSnapshotsWaitForSnappableIndexTaskStarted,,, | ||
| "11/8/2024, 5:30:50.314 AM",047ed0bc-6b72-4ea8-b9a0-c7fb89aa5811,01930a3f-f5ce-7900-8443-8a368f5baa2b,688bc4b0-f17d-4784-a96f-9a8cd387e43d,00000000-0000-0000-0000-000000000000,Successfully replicated snapshot taken at 08 Nov 24 5:00 AM UTC for the use-test Azure virtual machine in the use-test_group resource group in the TM-Lab-EA subscription to the region westus of TM-Lab-EA Azure subscription.,Rubrik Security Cloud,info,2024-11-08T05:29:57.30752593Z,Replication,Event,,use-test,AzureNativeVm,Success,Polaris,CloudNativeReplicateSnapshotsReplicateTaskSucceeded,,, | ||
| "11/8/2024, 5:25:31.234 AM",047ed0bc-6b72-4ea8-b9a0-c7fb89aa5811,01930a3b-e0cf-7b83-b02c-2db1087d3b0d,9cb57a51-4064-4c45-a10b-4693f8b5aaa7,00000000-0000-0000-0000-000000000000,Started indexing of the snapshots of the use-test Azure virtual machine in the use-test_group resource group in the TM-Lab-EA subscription.,Rubrik Security Cloud,info,2024-11-08T05:25:17.200115471Z,Index,Event,,use-test,AzureNativeVm,TaskSuccess,Polaris,CloudNativeIndexSnapshotsJobStarted,,, | ||
| "11/8/2024, 5:17:19.245 AM",,3787cdc1-a7ba-41ed-9c6e-cc5d8d4a2a27,88ece1ed-1a95-43b9-ae38-302cf05c19d8,00000000-0000-0000-0000-000000000000,xyz@gmail.com successfully created the webhook Rubrik-other-events.,Rubrik Security Cloud,info,2024-11-08T05:17:18.370059549Z,Configuration,Audit,auth0|65b91cdc85d3150aa4a1b3d0,xyz@gmail.com,User,Success,Polaris,WebhookCreated,xyz@gmail.com,auth0|65b91cdc85d3150aa4a1b3d0, | ||
| "11/8/2024, 5:18:40.088 AM",,496f42ec-e684-4a04-b191-e6a3a122d49f,efb7669b-8891-4a76-a613-d104f661b856,00000000-0000-0000-0000-000000000000,xyz@gmail.com successfully created the webhook Rubrik-AnomalyOrchestrator.,Rubrik Security Cloud,info,2024-11-08T05:18:39.20837609Z,Configuration,Audit,auth0|65b91cdc85d3150aa4a1b3d0,xyz@gmail.com,User,Success,Polaris,WebhookCreated,xyz@gmail.com,auth0|65b91cdc85d3150aa4a1b3d0, | ||
| "11/8/2024, 5:16:28.396 AM",,,,,Rubrik Polaris webhook test event,Rubrik Security Cloud,info,2024-11-08T05:16:14.067423864Z,Configuration,Event,,,,Succeeded,Rubrik Security Cloud,,,,test-location | ||
| "11/7/2024, 1:25:23.986 PM",,,,,Rubrik Polaris webhook test event,Rubrik Security Cloud,info,2024-11-07T13:25:01.215428023Z,Configuration,Event,,,,Succeeded,Rubrik Security Cloud,,,,test-location | ||
| "11/8/2024, 5:29:22.352 AM",047ed0bc-6b72-4ea8-b9a0-c7fb89aa5811,01930a3b-e0cf-7b83-b02c-2db1087d3b0d,e17bfee9-bed2-4691-b58d-0885322600c0,00000000-0000-0000-0000-000000000000,Started indexing of snapshot taken at 08 Nov 24 5:00 AM UTC.,Rubrik Security Cloud,info,2024-11-08T05:29:20.550468555Z,Index,Event,,use-test,AzureNativeVm,Running,Polaris,CloudNativeIndexSnapshotBegin,,, | ||
| "11/8/2024, 5:21:33.309 AM",,28b3ccfd-6679-4f88-b416-5658d859dc6c,f690f13a-12f9-4b80-a268-48ba26a6e917,00000000-0000-0000-0000-000000000000,xyz@gmail.com successfully created the webhook Rubrik-ThreathuntOrchestrator.,Rubrik Security Cloud,info,2024-11-08T05:21:31.535526647Z,Configuration,Audit,auth0|65b91cdc85d3150aa4a1b3d0,xyz@gmail.com,User,Success,Polaris,WebhookCreated,xyz@gmail.com,auth0|65b91cdc85d3150aa4a1b3d0, |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.