Merge branch 'master' into pr/9616

Azure · Dec 19, 2023 · 44781a5 · 44781a5
2 parents 83eaba5 + 5d38022
commit 44781a5
Show file tree

Hide file tree

Showing 402 changed files with 15,300 additions and 15,115 deletions.
diff --git a/.azure-pipelines/kqlValidations.yaml b/.azure-pipelines/kqlValidations.yaml
@@ -14,8 +14,13 @@ jobs:
         version: '$(dotnetSdkVersion)'
     - task: DotNetCoreCLI@2
       displayName: 'Run kql validation tests'
+      env:
+        GITHUBAPPID: $(GitHubAppID)
+        GITHUBAPPINSTALLATIONID: $(GitHubAppInstallationID)
+        GITHUBAPPPRIVATEKEY: $(GitHubAppPrivateKey)
       inputs:
         command: 'test'
         arguments: '--configuration $(buildConfiguration)'
         publishTestResults: true
-        projects: '**/Kqlvalidations.Tests.csproj'
+        projects: '**/Kqlvalidations.Tests.csproj'
+
diff --git a/.github/workflows/slash-command-dispatch.yaml b/.github/workflows/slash-command-dispatch.yaml
@@ -43,6 +43,7 @@ jobs:
           GeneratedToken: ${{ steps.generate_token.outputs.token }}
         with:
           token: ${{ env.GeneratedToken }}
+          permission: none
           commands: |
             package
             Package

diff --git a/.script/package-automation/checkSkipPackagingInfo.ps1 b/.script/package-automation/checkSkipPackagingInfo.ps1
@@ -1,7 +1,7 @@
 
 param ($solutionName, $pullRequestNumber, $runId, $baseFolderPath, $instrumentationKey)
 . ./Tools/Create-Azure-Sentinel-Solution/common/LogAppInsights.ps1
-
+$isPackagingRequired = $false
 try 
 {
     $customProperties = @{ 'RunId'="$runId"; 'PullRequestNumber'= "$pullRequestNumber"; "EventName"="CheckPackagingSkipStatus"; }
@@ -17,7 +17,7 @@ try
     if ($null -eq $filesList -or $filesList.Count -le 0)
     {
         Write-Host "Skipping as data file is not present!"
-        Write-Output "isPackagingRequired=$false" >> $env:GITHUB_OUTPUT
+        Write-Output "isPackagingRequired=$isPackagingRequired" >> $env:GITHUB_OUTPUT
     }
     else
     {
@@ -31,9 +31,9 @@ try
         $isCreatePackageSetToTrue = $dataFileContentObject.createPackage
         if ($hasCreatePackageAttribute -eq $true -and $isCreatePackageSetToTrue -eq $false) {
             Write-Host "::warning::Skipping Package Creation for Solution '$solutionName', as Data File has attribute 'createPackage' set to False!"
-            Write-Output "isPackagingRequired=$false" >> $env:GITHUB_OUTPUT
+            Write-Output "isPackagingRequired=$isPackagingRequired" >> $env:GITHUB_OUTPUT
 
-            $customProperties['isPackagingRequired'] = $false
+            $customProperties['isPackagingRequired'] = $isPackagingRequired
             if ($instrumentationKey -ne '')
             {
                 Send-AppInsightsTraceTelemetry -InstrumentationKey $instrumentationKey -Message "Execution for CheckPackagingSkipStatus started, Job Run Id : $runId" -Severity Information -CustomProperties $customProperties
@@ -51,7 +51,7 @@ try
             if ($changesInPackageFolder.Count -gt 0)
             {
                 # changes are in Package folder so skip packaging
-                Write-Output "isPackagingRequired=$false" >> $env:GITHUB_OUTPUT
+                Write-Output "isPackagingRequired=$isPackagingRequired" >> $env:GITHUB_OUTPUT
                 Write-Host "Skip packaging as changes are in Package folder!"
             }
             else
@@ -66,27 +66,28 @@ try
                 # there are no changes in package folder but check if changes in pr are valid and not from exclusion list
                 if ($changesInSolutionFolder.Count -gt 0)
                 {
-
+                    $isPackagingRequired = $true
                     # has changes in Solution folder and valid files
                     # WE NEED PACKAGING
-                    $customProperties['isPackagingRequired'] = $true
-                    Write-Output "isPackagingRequired=$true" >> $env:GITHUB_OUTPUT
-
+                    $customProperties['isPackagingRequired'] = $isPackagingRequired
+                    Write-Output "isPackagingRequired=$isPackagingRequired" >> $env:GITHUB_OUTPUT
+                    Write-Host "isPackagingRequired $isPackagingRequired"
                     if ($instrumentationKey -ne '')
                     {
                         Send-AppInsightsTraceTelemetry -InstrumentationKey $instrumentationKey -Message "CheckPackagingSkipStatus started, Job Run Id : $runId" -Severity Information -CustomProperties $customProperties
                     }
                 }
                 else {
-                    Write-Output "isPackagingRequired=$false" >> $env:GITHUB_OUTPUT
+                    Write-Output "isPackagingRequired=$isPackagingRequired" >> $env:GITHUB_OUTPUT
+                    Write-Host "isPackagingRequired $isPackagingRequired"
                 }
             }
         }
     }
 }
 catch
 {
-    Write-Output "isPackagingRequired=$false" >> $env:GITHUB_OUTPUT
+    Write-Output "isPackagingRequired=$isPackagingRequired" >> $env:GITHUB_OUTPUT
     Write-Host "Error in checkSkipPackagingInfo file. Error Details: $_"
     if ($instrumentationKey -ne '')
     {

diff --git a/.script/package-automation/package-service.ps1 b/.script/package-automation/package-service.ps1
@@ -5,6 +5,9 @@ Write-Host "RunId $runId, PR Number  $pullRequestNumber"
 
 
 try {
+  $baseFolderPath = $baseFolderPath + "/"
+  $baseFolderPath = $baseFolderPath.replace("//", "/")
+
   Write-Host "====Identifying Solution Name===="
   # Get Solution Name
   . $PSScriptRoot/getSolutionName.ps1 $runId $pullRequestNumber $instrumentationKey

diff --git a/.script/tests/KqlvalidationsTests/CustomTables/OracleWebLogicServerEvent.json b/.script/tests/KqlvalidationsTests/CustomTables/OracleWebLogicServerEvent.json
@@ -98,7 +98,7 @@
             "Type": "String"
         },
         {
-            "Name": "TreadId",
+            "Name": "ThreadId",
             "Type": "String"
         },
         {

diff --git a/.script/tests/KqlvalidationsTests/CustomTables/UrlClickEvents.json b/.script/tests/KqlvalidationsTests/CustomTables/UrlClickEvents.json
@@ -0,0 +1,73 @@
+{
+    "Name":"UrlClickEvents",
+    "Properties":[
+    {
+      "Name": "AccountUpn",
+      "Type": "string"
+    },
+    {
+      "Name": "ActionType",
+      "Type": "string"
+    },
+    {
+      "Name": "DetectionMethods",
+      "Type": "string"
+    },
+    {
+      "Name": "IPAddress",
+      "Type": "string"
+    },
+    {
+      "Name": "IsClickedThrough",
+      "Type": "bool"
+    },
+    {
+      "Name": "NetworkMessageId",
+      "Type": "string"
+    },
+    {
+      "Name": "ReportId",
+      "Type": "string"
+    },
+    {
+      "Name": "SourceSystem",
+      "Type": "string"
+    },
+    {
+      "Name": "TenantId",
+      "Type": "string"
+    },
+    {
+      "Name": "ThreatTypes",
+      "Type": "string"
+    },
+    {
+      "Name": "TimeGenerated",
+      "Type": "datetime"
+    },
+    {
+      "Name": "Type",
+      "Type": "string"
+    },
+    {
+      "Name": "Url",
+      "Type": "string"
+    },
+    {
+      "Name": "UrlChain",
+      "Type": "string"
+    },
+    {
+      "Name": "Workload",
+      "Type": "string"
+    },
+    {
+      "Name": "_BilledSize",
+      "Type": "real"
+    },
+    {
+      "Name": "_IsBillable",
+      "Type": "string"
+    }
+]      
+}