Skip to content

Commit 02f3c1a

Browse files
piaudonnpiaudonn
authored
Merge pull request #484 from briandelmsft/exchange_module
Exchange Module Update, link deployment to new build
2 parents a57dde8 + 1980457 commit 02f3c1a

File tree

4 files changed

+82
-9
lines changed

4 files changed

+82
-9
lines changed

‎Connector/connector.json‎

Lines changed: 77 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@
3030
}
3131
},
3232
"variables": {
33-
"STATConnectorVersion": "2.0.21"
33+
"STATConnectorVersion": "2.1.0"
3434
},
3535
"resources": [
3636
{
@@ -589,8 +589,8 @@
589589
},
590590
"/api/modules/oofmodule": {
591591
"post": {
592-
"summary": "Out of Office Module",
593-
"description": "Sentinel Triage AssistanT Module for determining if user entities are out of the office.",
592+
"summary": "Exchange Online Module",
593+
"description": "Sentinel Triage AssistanT Module for reviewing Exchange Online risks.",
594594
"operationId": "OOFModule",
595595
"parameters": [
596596
{
@@ -609,6 +609,58 @@
609609
],
610610
"x-ms-visibility": "advanced"
611611
},
612+
"AddIncidentTask": {
613+
"type": "boolean",
614+
"description": "Add a task to Microsoft Sentinel Incident",
615+
"title": "",
616+
"enum": [
617+
true,
618+
false
619+
],
620+
"x-ms-visibility": "advanced"
621+
},
622+
"IncidentTaskInstructions": {
623+
"type": "string",
624+
"description": "Instructions to include in the Microsoft Sentinel Task",
625+
"x-ms-visibility": "advanced"
626+
},
627+
"LookbackInDays": {
628+
"type": "integer",
629+
"format": "int32",
630+
"description": "Number of days to lookback in EXO audit logs",
631+
"title": "",
632+
"x-ms-visibility": "advanced"
633+
},
634+
"CheckAuditLog": {
635+
"type": "boolean",
636+
"description": "Check Exchange Online Audit Logs",
637+
"title": "",
638+
"enum": [
639+
true,
640+
false
641+
],
642+
"x-ms-visibility": "advanced"
643+
},
644+
"CheckOutOfOffice": {
645+
"type": "boolean",
646+
"description": "Check Out of Office status",
647+
"title": "",
648+
"enum": [
649+
true,
650+
false
651+
],
652+
"x-ms-visibility": "advanced"
653+
},
654+
"CheckRules": {
655+
"type": "boolean",
656+
"description": "Check Exchange Online mailbox rules",
657+
"title": "",
658+
"enum": [
659+
true,
660+
false
661+
],
662+
"x-ms-visibility": "advanced"
663+
},
612664
"BaseModuleBody": {
613665
"type": "object",
614666
"description": "Body from STAT Base Module",
@@ -632,7 +684,7 @@
632684
"description": "default",
633685
"schema": {
634686
"type": "object",
635-
"description": "OOF Module Body",
687+
"description": "Exchange Module Body",
636688
"properties": {
637689
"AllUsersInOffice": {
638690
"type": "boolean",
@@ -642,7 +694,7 @@
642694
"type": "boolean",
643695
"description": "true if All users are out of the office"
644696
},
645-
"DetailedResults": {
697+
"OOF": {
646698
"type": "array",
647699
"items": {
648700
"type": "object",
@@ -667,6 +719,26 @@
667719
},
668720
"description": "Array of by user DetailedResults"
669721
},
722+
"RulesDelete": {
723+
"type": "integer",
724+
"format": "int32",
725+
"description": "Count of mail rules with deletion found"
726+
},
727+
"RulesMove": {
728+
"type": "integer",
729+
"format": "int32",
730+
"description": "Count of mail rules with move found"
731+
},
732+
"RulesForward": {
733+
"type": "integer",
734+
"format": "int32",
735+
"description": "Count of mail rules with forward found"
736+
},
737+
"DelegationsFound": {
738+
"type": "integer",
739+
"format": "int32",
740+
"description": "Count of delegation audits found"
741+
},
670742
"UsersInOffice": {
671743
"type": "integer",
672744
"format": "int32",

‎Deploy/GrantPermissions.ps1‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,7 @@ function Set-RBACPermissions ($MSIName, $Role) {
154154
Set-RBACPermissions -MSIName $STATIdentityName -Role "Microsoft Sentinel Responder"
155155
Set-APIPermissions -MSIName $STATIdentityName -AppId "ca7f3f0b-7d91-482c-8e09-c5d840d0eac5" -PermissionName "Data.Read"
156156
Set-APIPermissions -MSIName $STATIdentityName -AppId "00000003-0000-0000-c000-000000000000" -PermissionName "MailboxSettings.Read"
157+
Set-APIPermissions -MSIName $STATIdentityName -AppId "00000003-0000-0000-c000-000000000000" -PermissionName "Mail.ReadBasic.All"
157158
Set-APIPermissions -MSIName $STATIdentityName -AppId "fc780465-2017-40d4-a0c5-307022471b92" -PermissionName "AdvancedQuery.Read.All"
158159
Set-APIPermissions -MSIName $STATIdentityName -AppId "fc780465-2017-40d4-a0c5-307022471b92" -PermissionName "Machine.Read.All"
159160
Set-APIPermissions -MSIName $STATIdentityName -AppId "fc780465-2017-40d4-a0c5-307022471b92" -PermissionName "File.Read.All"

‎Deploy/deployui.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -546,7 +546,7 @@
546546
"type": "Microsoft.Common.TextBox",
547547
"label": "STAT Function ZIP Package",
548548
"placeholder": "",
549-
"defaultValue": "https://github.com/briandelmsft/STAT-Function/releases/download/v2.0.21/stat.zip",
549+
"defaultValue": "https://github.com/briandelmsft/STAT-Function/releases/download/v2.1.0/stat.zip",
550550
"toolTip": "Full path to the STAT Function ZIP deployment package",
551551
"constraints": {
552552
"required": true,
@@ -580,7 +580,7 @@
580580
"STATConnectorName": "[coalesce(steps('namingStep').customNaming.statConnectorName, 'SentinelTriageAssistantv2')]",
581581
"STATConnectorDisplayName": "[coalesce(steps('namingStep').customNaming.statConnectorDisplayName, 'STAT v2')]",
582582
"storageAccountType": "Standard_LRS",
583-
"FunctionPackage": "[coalesce(steps('additionalStep').advanced.functionPackage, 'https://github.com/briandelmsft/STAT-Function/releases/download/v2.0.21/stat.zip')]",
583+
"FunctionPackage": "[coalesce(steps('additionalStep').advanced.functionPackage, 'https://github.com/briandelmsft/STAT-Function/releases/download/v2.1.0/stat.zip')]",
584584
"MSGraphEndpoint": "[coalesce(steps('apiStep').customApi.graphApi,'graph.microsoft.com')]",
585585
"M365Endpoint": "[coalesce(steps('apiStep').customApi.m365Api,'api.security.microsoft.com')]",
586586
"MDEEndpoint": "[coalesce(steps('apiStep').customApi.mdeApi,'api.securitycenter.microsoft.com')]",

‎Modules/versions.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@
99
"RelatedAlerts": "0.3.0",
1010
"RunPlaybook": "0.0.1",
1111
"ScoringModule": "0.1.0",
12-
"STATConnector": "1.5.1",
13-
"STATFunction": "2.0.14",
12+
"STATConnector": "2.1.0",
13+
"STATFunction": "2.1.0",
1414
"TIModule": "0.2.0",
1515
"UEBAModule": "0.1.1",
1616
"WatchlistModule": "0.1.0"

0 commit comments

Comments
 (0)