diff --git a/Solutions/VMware Carbon Black Cloud/Data Connectors/CarbonBlackViaAWSS3_ConnectorDefinition.json b/Solutions/VMware Carbon Black Cloud/Data Connectors/CarbonBlackViaAWSS3_ConnectorDefinition.json index 2bbeead5107..1ae0a2fbe42 100644 --- a/Solutions/VMware Carbon Black Cloud/Data Connectors/CarbonBlackViaAWSS3_ConnectorDefinition.json +++ b/Solutions/VMware Carbon Black Cloud/Data Connectors/CarbonBlackViaAWSS3_ConnectorDefinition.json @@ -122,7 +122,7 @@ "id": "carbonBlackAWSS3", "title": "VMware Carbon Black Cloud via AWS S3", "publisher": "Microsoft", - "descriptionMarkdown": "The [VMware Carbon Black Cloud](https://www.vmware.com/products/carbon-black-cloud.html) via AWS S3 data connector provides the capability to ingest watchlist, alerts, auth and endpoints events via AWS S3 and stream them to ASIM normalized tables. The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.", + "descriptionMarkdown": "The [VMware Carbon Black Cloud](https://www.broadcom.com/products/carbon-black/threat-prevention/carbon-black-cloud) via AWS S3 data connector provides the capability to ingest watchlist, alerts, auth and endpoints events via AWS S3 and stream them to ASIM normalized tables. The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.", "graphQueriesTableName": "CarbonBlack_Alerts_CL", "graphQueries": [ { @@ -2064,7 +2064,7 @@ "id": "carbonBlackAWSS3", "title": "VMware Carbon Black Cloud via AWS S3", "publisher": "Microsoft", - "descriptionMarkdown": "The [VMware Carbon Black Cloud](https://www.vmware.com/products/carbon-black-cloud.html) via AWS S3 data connector provides the capability to ingest watchlist, alerts, auth and endpoints events via AWS S3 and stream them to ASIM normalized tables. The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.", + "descriptionMarkdown": "The [VMware Carbon Black Cloud](https://www.broadcom.com/products/carbon-black/threat-prevention/carbon-black-cloud) via AWS S3 data connector provides the capability to ingest watchlist, alerts, auth and endpoints events via AWS S3 and stream them to ASIM normalized tables. The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.", "graphQueriesTableName": "CarbonBlack_Alerts_CL", "graphQueries": [ { diff --git a/Solutions/VMware Carbon Black Cloud/Data Connectors/VMwareCarbonBlackCloud_ccp/CarbonBlack_DataConnectorDefination.json b/Solutions/VMware Carbon Black Cloud/Data Connectors/VMwareCarbonBlackCloud_ccp/CarbonBlack_DataConnectorDefinition.json similarity index 97% rename from Solutions/VMware Carbon Black Cloud/Data Connectors/VMwareCarbonBlackCloud_ccp/CarbonBlack_DataConnectorDefination.json rename to Solutions/VMware Carbon Black Cloud/Data Connectors/VMwareCarbonBlackCloud_ccp/CarbonBlack_DataConnectorDefinition.json index e96be9db6e8..e3540e19b24 100644 --- a/Solutions/VMware Carbon Black Cloud/Data Connectors/VMwareCarbonBlackCloud_ccp/CarbonBlack_DataConnectorDefination.json +++ b/Solutions/VMware Carbon Black Cloud/Data Connectors/VMwareCarbonBlackCloud_ccp/CarbonBlack_DataConnectorDefinition.json @@ -8,7 +8,7 @@ "id": "carbonBlackAWSS3", "title": "VMware Carbon Black Cloud via AWS S3", "publisher": "Microsoft", - "descriptionMarkdown": "The [VMware Carbon Black Cloud](https://www.vmware.com/products/carbon-black-cloud.html) via AWS S3 data connector provides the capability to ingest watchlist, alerts, auth and endpoints events via AWS S3 and stream them to ASIM normalized tables. The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.", + "descriptionMarkdown": "The [VMware Carbon Black Cloud](https://www.broadcom.com/products/carbon-black/threat-prevention/carbon-black-cloud) via AWS S3 data connector provides the capability to ingest watchlist, alerts, auth and endpoints events via AWS S3 and stream them to ASIM normalized tables. The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.", "graphQueriesTableName": "CarbonBlack_Alerts_CL", "graphQueries": [ { @@ -310,4 +310,4 @@ ] } } -} \ No newline at end of file +} diff --git a/Solutions/VMware Carbon Black Cloud/Data Connectors/VMwareCarbonBlack_API_FunctionApp.json b/Solutions/VMware Carbon Black Cloud/Data Connectors/VMwareCarbonBlack_API_FunctionApp.json index fe796263870..fd2695287c8 100644 --- a/Solutions/VMware Carbon Black Cloud/Data Connectors/VMwareCarbonBlack_API_FunctionApp.json +++ b/Solutions/VMware Carbon Black Cloud/Data Connectors/VMwareCarbonBlack_API_FunctionApp.json @@ -2,7 +2,7 @@ "id": "VMwareCarbonBlack", "title": "VMware Carbon Black Cloud", "publisher": "VMware", - "descriptionMarkdown": "The [VMware Carbon Black Cloud](https://www.vmware.com/products/carbon-black-cloud.html) connector provides the capability to ingest Carbon Black data into Microsoft Sentinel. The connector provides visibility into Audit, Notification and Event logs in Microsoft Sentinel to view dashboards, create custom alerts, and to improve monitoring and investigation capabilities.", + "descriptionMarkdown": "The [VMware Carbon Black Cloud](https://www.broadcom.com/products/carbon-black/threat-prevention/carbon-black-cloud) connector provides the capability to ingest Carbon Black data into Microsoft Sentinel. The connector provides visibility into Audit, Notification and Event logs in Microsoft Sentinel to view dashboards, create custom alerts, and to improve monitoring and investigation capabilities.", "graphQueries": [ { "metricName": "Total data received", @@ -159,4 +159,4 @@ "description": "**3. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select **+ New application setting**.\n3. Add each of the following thirteen to sixteen (13-16) application settings individually, with their respective string values (case-sensitive): \n\t\tapiId\n\t\tapiKey\n\t\tworkspaceID\n\t\tworkspaceKey\n\t\turi\n\t\ttimeInterval\n\t\tCarbonBlackOrgKey\n\t\tCarbonBlackLogTypes \n\t\ts3BucketName \n\t\tEventPrefixFolderName \n\t\tAlertPrefixFolderName \n\t\tAWSAccessKeyId \n\t\tAWSSecretAccessKey \n\t\tSIEMapiId (Optional)\n\t\tSIEMapiKey (Optional)\n\t\tlogAnalyticsUri (optional) \n> - Enter the URI that corresponds to your region. The complete list of API URLs can be [found here](https://community.carbonblack.com/t5/Knowledge-Base/PSC-What-URLs-are-used-to-access-the-APIs/ta-p/67346). The `uri` value must follow the following schema: `https://.conferdeploy.net` - There is no need to add a time suffix to the URI, the Function App will dynamically append the Time Value to the URI in the proper format.\n> - Set the `timeInterval` (in minutes) to the default value of `5` to correspond to the default Timer Trigger of every `5` minutes. If the time interval needs to be modified, it is recommended to change the Function App Timer Trigger accordingly to prevent overlapping data ingestion.\n> - Carbon Black requires a seperate set of API ID/Keys to ingest Notification alerts. Enter the `SIEMapiId` and `SIEMapiKey` values, if needed, or omit, if not required. \n> - Note: If using Azure Key Vault, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details. \n> - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://.ods.opinsights.azure.us`\n4. Once all application settings have been entered, click **Save**." } ] -} \ No newline at end of file +} diff --git a/Solutions/VMware Carbon Black Cloud/Data/Solution_VMware Carbon Black Cloud.json b/Solutions/VMware Carbon Black Cloud/Data/Solution_VMware Carbon Black Cloud.json index f136fd66850..2dcfe2a0c9b 100644 --- a/Solutions/VMware Carbon Black Cloud/Data/Solution_VMware Carbon Black Cloud.json +++ b/Solutions/VMware Carbon Black Cloud/Data/Solution_VMware Carbon Black Cloud.json @@ -2,9 +2,9 @@ "Name": "VMware Carbon Black Cloud", "Author": "Microsoft - support@microsoft.com", "Logo": "", - "Description": "The [VMware Carbon Black Cloud](https://www.vmware.com/products/carbon-black-cloud.html) solution for Microsoft Sentinel allows ingesting Carbon Black [Audit](https://developer.carbonblack.com/reference/carbon-black-cloud/cb-defense/latest/rest-api/#audit-log-events), [Notification](https://developer.carbonblack.com/reference/carbon-black-cloud/cb-defense/latest/rest-api/#notifications) and [Event](https://developer.carbonblack.com/reference/carbon-black-cloud/platform/deprecated/data-forwarder-config-api/) logs into Microsoft Sentinel.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\nb. [Azure Functions](https://azure.microsoft.com/services/functions/#overview)", + "Description": "The [VMware Carbon Black Cloud](https://www.broadcom.com/products/carbon-black/threat-prevention/carbon-black-cloud) solution for Microsoft Sentinel allows ingesting Carbon Black [Audit](https://developer.carbonblack.com/reference/carbon-black-cloud/cb-defense/latest/rest-api/#audit-log-events), [Notification](https://developer.carbonblack.com/reference/carbon-black-cloud/cb-defense/latest/rest-api/#notifications) and [Event](https://developer.carbonblack.com/reference/carbon-black-cloud/platform/deprecated/data-forwarder-config-api/) logs into Microsoft Sentinel.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\nb. [Azure Functions](https://azure.microsoft.com/services/functions/#overview)", "Data Connectors": [ - "Data Connectors/VMwareCarbonBlackCloud_ccp/CarbonBlack_DataConnectorDefination.json", + "Data Connectors/VMwareCarbonBlackCloud_ccp/CarbonBlack_DataConnectorDefinition.json", "Data Connectors/VMwareCarbonBlack_API_FunctionApp.json" ], "Analytic Rules": [ @@ -21,8 +21,8 @@ "Playbooks/CarbonBlack-DeviceEnrichment/azuredeploy.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\VMware Carbon Black Cloud", - "Version": "3.0.1", + "Version": "3.0.6", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1Pconnector": false -} \ No newline at end of file +} diff --git a/Solutions/VMware Carbon Black Cloud/Data/system_generated_metadata.json b/Solutions/VMware Carbon Black Cloud/Data/system_generated_metadata.json index 0f072352ad8..ce955cee00a 100644 --- a/Solutions/VMware Carbon Black Cloud/Data/system_generated_metadata.json +++ b/Solutions/VMware Carbon Black Cloud/Data/system_generated_metadata.json @@ -2,7 +2,7 @@ "Name": "VMware Carbon Black Cloud", "Author": "Microsoft - support@microsoft.com", "Logo": "", - "Description": "The [VMware Carbon Black Cloud](https://www.vmware.com/products/carbon-black-cloud.html) solution for Microsoft Sentinel allows ingesting Carbon Black [Audit](https://developer.carbonblack.com/reference/carbon-black-cloud/cb-defense/latest/rest-api/#audit-log-events), [Notification](https://developer.carbonblack.com/reference/carbon-black-cloud/cb-defense/latest/rest-api/#notifications) and [Event](https://developer.carbonblack.com/reference/carbon-black-cloud/platform/deprecated/data-forwarder-config-api/) logs into Microsoft Sentinel.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\nb. [Azure Functions](https://azure.microsoft.com/services/functions/#overview)", + "Description": "The [VMware Carbon Black Cloud](https://www.broadcom.com/products/carbon-black/threat-prevention/carbon-black-cloud) solution for Microsoft Sentinel allows ingesting Carbon Black [Audit](https://developer.carbonblack.com/reference/carbon-black-cloud/cb-defense/latest/rest-api/#audit-log-events), [Notification](https://developer.carbonblack.com/reference/carbon-black-cloud/cb-defense/latest/rest-api/#notifications) and [Event](https://developer.carbonblack.com/reference/carbon-black-cloud/platform/deprecated/data-forwarder-config-api/) logs into Microsoft Sentinel.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\nb. [Azure Functions](https://azure.microsoft.com/services/functions/#overview)", "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\VMware Carbon Black Cloud", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, diff --git a/Solutions/VMware Carbon Black Cloud/Package/3.0.6.zip b/Solutions/VMware Carbon Black Cloud/Package/3.0.6.zip new file mode 100644 index 00000000000..3f1bea2d2ed Binary files /dev/null and b/Solutions/VMware Carbon Black Cloud/Package/3.0.6.zip differ diff --git a/Solutions/VMware Carbon Black Cloud/Package/createUiDefinition.json b/Solutions/VMware Carbon Black Cloud/Package/createUiDefinition.json index f62504fc9b7..22473fb5089 100644 --- a/Solutions/VMware Carbon Black Cloud/Package/createUiDefinition.json +++ b/Solutions/VMware Carbon Black Cloud/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/VMware%20Carbon%20Black%20Cloud/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [VMware Carbon Black Cloud](https://www.vmware.com/products/carbon-black-cloud.html) solution for Microsoft Sentinel allows ingesting Carbon Black [Audit](https://developer.carbonblack.com/reference/carbon-black-cloud/cb-defense/latest/rest-api/#audit-log-events), [Notification](https://developer.carbonblack.com/reference/carbon-black-cloud/cb-defense/latest/rest-api/#notifications) and [Event](https://developer.carbonblack.com/reference/carbon-black-cloud/platform/deprecated/data-forwarder-config-api/) logs into Microsoft Sentinel.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\nb. [Azure Functions](https://azure.microsoft.com/services/functions/#overview)\n\n**Data Connectors:** 2, **Workbooks:** 1, **Analytic Rules:** 2, **Custom Azure Logic Apps Connectors:** 1, **Playbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/VMware%20Carbon%20Black%20Cloud/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [VMware Carbon Black Cloud](https://www.broadcom.com/products/carbon-black/threat-prevention/carbon-black-cloud) solution for Microsoft Sentinel allows ingesting Carbon Black [Audit](https://developer.carbonblack.com/reference/carbon-black-cloud/cb-defense/latest/rest-api/#audit-log-events), [Notification](https://developer.carbonblack.com/reference/carbon-black-cloud/cb-defense/latest/rest-api/#notifications) and [Event](https://developer.carbonblack.com/reference/carbon-black-cloud/platform/deprecated/data-forwarder-config-api/) logs into Microsoft Sentinel.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\nb. [Azure Functions](https://azure.microsoft.com/services/functions/#overview)\n\n**Data Connectors:** 2, **Workbooks:** 1, **Analytic Rules:** 2, **Custom Azure Logic Apps Connectors:** 1, **Playbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -63,6 +63,23 @@ "text": "This Solution installs the data connector for VMware Carbon Black Cloud. You can get VMware Carbon Black Cloud data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, + { + "name": "dataconnectors-link1", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more about connecting data sources", + "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources" + } + } + }, + { + "name": "dataconnectors2-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Solution installs the data connector for VMware Carbon Black Cloud. You can get VMware Carbon Black Cloud custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + } + }, { "name": "dataconnectors-link2", "type": "Microsoft.Common.TextBlock", diff --git a/Solutions/VMware Carbon Black Cloud/Package/mainTemplate.json b/Solutions/VMware Carbon Black Cloud/Package/mainTemplate.json index 062d7db1b01..5da6e10ac00 100644 --- a/Solutions/VMware Carbon Black Cloud/Package/mainTemplate.json +++ b/Solutions/VMware Carbon Black Cloud/Package/mainTemplate.json @@ -55,7 +55,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "VMware Carbon Black Cloud", - "_solutionVersion": "3.0.5", + "_solutionVersion": "3.0.6", "solutionId": "azuresentinel.azure-sentinel-solution-vmwarecarbonblack", "_solutionId": "[variables('solutionId')]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", @@ -160,7 +160,7 @@ "id": "carbonBlackAWSS3", "title": "VMware Carbon Black Cloud via AWS S3", "publisher": "Microsoft", - "descriptionMarkdown": "The [VMware Carbon Black Cloud](https://www.vmware.com/products/carbon-black-cloud.html) via AWS S3 data connector provides the capability to ingest watchlist, alerts, auth and endpoints events via AWS S3 and stream them to ASIM normalized tables. The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.", + "descriptionMarkdown": "The [VMware Carbon Black Cloud](https://www.broadcom.com/products/carbon-black/threat-prevention/carbon-black-cloud) via AWS S3 data connector provides the capability to ingest watchlist, alerts, auth and endpoints events via AWS S3 and stream them to ASIM normalized tables. The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.", "graphQueriesTableName": "CarbonBlack_Alerts_CL", "graphQueries": [ { @@ -2164,7 +2164,7 @@ "id": "carbonBlackAWSS3", "title": "VMware Carbon Black Cloud via AWS S3", "publisher": "Microsoft", - "descriptionMarkdown": "The [VMware Carbon Black Cloud](https://www.vmware.com/products/carbon-black-cloud.html) via AWS S3 data connector provides the capability to ingest watchlist, alerts, auth and endpoints events via AWS S3 and stream them to ASIM normalized tables. The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.", + "descriptionMarkdown": "The [VMware Carbon Black Cloud](https://www.broadcom.com/products/carbon-black/threat-prevention/carbon-black-cloud) via AWS S3 data connector provides the capability to ingest watchlist, alerts, auth and endpoints events via AWS S3 and stream them to ASIM normalized tables. The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.", "graphQueriesTableName": "CarbonBlack_Alerts_CL", "graphQueries": [ { @@ -2636,7 +2636,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "VMware Carbon Black Cloud data connector with template version 3.0.5", + "description": "VMware Carbon Black Cloud data connector with template version 3.0.6", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -2654,7 +2654,7 @@ "id": "[variables('_uiConfigId2')]", "title": "VMware Carbon Black Cloud (using Azure Functions)", "publisher": "VMware", - "descriptionMarkdown": "The [VMware Carbon Black Cloud](https://www.vmware.com/products/carbon-black-cloud.html) connector provides the capability to ingest Carbon Black data into Microsoft Sentinel. The connector provides visibility into Audit, Notification and Event logs in Microsoft Sentinel to view dashboards, create custom alerts, and to improve monitoring and investigation capabilities.", + "descriptionMarkdown": "The [VMware Carbon Black Cloud](https://www.broadcom.com/products/carbon-black/threat-prevention/carbon-black-cloud) connector provides the capability to ingest Carbon Black data into Microsoft Sentinel. The connector provides visibility into Audit, Notification and Event logs in Microsoft Sentinel to view dashboards, create custom alerts, and to improve monitoring and investigation capabilities.", "graphQueries": [ { "metricName": "Total data received", @@ -2887,7 +2887,7 @@ "connectorUiConfig": { "title": "VMware Carbon Black Cloud (using Azure Functions)", "publisher": "VMware", - "descriptionMarkdown": "The [VMware Carbon Black Cloud](https://www.vmware.com/products/carbon-black-cloud.html) connector provides the capability to ingest Carbon Black data into Microsoft Sentinel. The connector provides visibility into Audit, Notification and Event logs in Microsoft Sentinel to view dashboards, create custom alerts, and to improve monitoring and investigation capabilities.", + "descriptionMarkdown": "The [VMware Carbon Black Cloud](https://www.broadcom.com/products/carbon-black/threat-prevention/carbon-black-cloud) connector provides the capability to ingest Carbon Black data into Microsoft Sentinel. The connector provides visibility into Audit, Notification and Event logs in Microsoft Sentinel to view dashboards, create custom alerts, and to improve monitoring and investigation capabilities.", "graphQueries": [ { "metricName": "Total data received", @@ -3049,7 +3049,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CriticalThreatDetected_AnalyticalRules Analytics Rule with template version 3.0.5", + "description": "CriticalThreatDetected_AnalyticalRules Analytics Rule with template version 3.0.6", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -3094,8 +3094,8 @@ "entityType": "Host", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Device_Name" + "columnName": "Device_Name", + "identifier": "FullName" } ] }, @@ -3103,8 +3103,8 @@ "entityType": "IP", "fieldMappings": [ { - "identifier": "Address", - "columnName": "Internal_IP" + "columnName": "Internal_IP", + "identifier": "Address" } ] } @@ -3162,7 +3162,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "KnownMalwareDetected_AnalyticalRules Analytics Rule with template version 3.0.5", + "description": "KnownMalwareDetected_AnalyticalRules Analytics Rule with template version 3.0.6", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -3207,8 +3207,8 @@ "entityType": "Account", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "processDetails_fullUserName_s" + "columnName": "processDetails_fullUserName_s", + "identifier": "FullName" } ] }, @@ -3216,8 +3216,8 @@ "entityType": "Host", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "deviceDetails_deviceName_s" + "columnName": "deviceDetails_deviceName_s", + "identifier": "FullName" } ] }, @@ -3225,8 +3225,8 @@ "entityType": "IP", "fieldMappings": [ { - "identifier": "Address", - "columnName": "deviceDetails_deviceIpAddress_s" + "columnName": "deviceDetails_deviceIpAddress_s", + "identifier": "Address" } ] } @@ -3284,7 +3284,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "VMwareCarbonBlack Workbook with template version 3.0.5", + "description": "VMwareCarbonBlack Workbook with template version 3.0.6", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -3380,7 +3380,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CarbonBlackConnector Playbook with template version 3.0.5", + "description": "CarbonBlackConnector Playbook with template version 3.0.6", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -5014,7 +5014,7 @@ ], "metadata": { "comments": "This connector used to perform different actions on alerts , device and threats using CarbonBlack cloud endpoint API.", - "lastUpdateTime": "2025-07-15T19:57:46.028Z", + "lastUpdateTime": "2026-01-20T17:43:11.841Z", "releaseNotes": { "version": "1.0", "title": "[variables('blanks')]", @@ -5046,7 +5046,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EndpointTakeActionFromTeams-CarbonBlack Playbook with template version 3.0.5", + "description": "EndpointTakeActionFromTeams-CarbonBlack Playbook with template version 3.0.6", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion2')]", @@ -6849,7 +6849,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IsolateEndpoint-CarbonBlack Playbook with template version 3.0.5", + "description": "IsolateEndpoint-CarbonBlack Playbook with template version 3.0.6", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion3')]", @@ -7592,7 +7592,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EndpointEnrichment-CarbonBlack Playbook with template version 3.0.5", + "description": "EndpointEnrichment-CarbonBlack Playbook with template version 3.0.6", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion4')]", @@ -8016,12 +8016,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.5", + "version": "3.0.6", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "VMware Carbon Black Cloud", "publisherDisplayName": "Microsoft Sentinel, Microsoft", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The VMware Carbon Black Cloud solution for Microsoft Sentinel allows ingesting Carbon Black Audit, Notification and Event logs into Microsoft Sentinel.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n

  1. Azure Monitor HTTP Data Collector API

    \n
    2. \n

  2. Azure Functions

    \n
    3. \n
\n

Data Connectors: 2, Workbooks: 1, Analytic Rules: 2, Custom Azure Logic Apps Connectors: 1, Playbooks: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The VMware Carbon Black Cloud solution for Microsoft Sentinel allows ingesting Carbon Black Audit, Notification and Event logs into Microsoft Sentinel.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n

  1. Azure Monitor HTTP Data Collector API

    \n
    2. \n

  2. Azure Functions

    \n
    3. \n
\n

Data Connectors: 2, Workbooks: 1, Analytic Rules: 2, Custom Azure Logic Apps Connectors: 1, Playbooks: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", diff --git a/Solutions/VMware Carbon Black Cloud/ReleaseNotes.md b/Solutions/VMware Carbon Black Cloud/ReleaseNotes.md index 7c9bf345869..f0a29b32a05 100644 --- a/Solutions/VMware Carbon Black Cloud/ReleaseNotes.md +++ b/Solutions/VMware Carbon Black Cloud/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|-----------------------------------------------------------| +| 3.0.6 | 28-01-2026 | Updated all VMware Carbon Black Cloud product page URLs to now point to the new **Broadcom URL** | | 3.0.5 | 22-01-2025 | Removed Custom Entity mappings from **Analytic rules** | | 3.0.4 | 19-11-2024 | Modified TransformKQL queries of CCP **Data Connector** | | 3.0.3 | 28-10-2024 | Added Sample Queries to the CCP **Data Connector** template |