Giters

jonrau1 / ElectricEye

ElectricEye is a multi-cloud, multi-SaaS Python CLI tool for Asset Management, Security Posture Management & Attack Surface Monitoring supporting 100s of services and evaluations to harden your CSP & SaaS environments with controls mapped to over 20 industry, regulatory, and best practice controls frameworks

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

[PFR] Finalize Microsoft Sentinel Integration & Collateral

jonrau1 opened this issue · comments

commented

Story
As the Author of ElectricEye, I want to complete an integration into Microsoft Sentinel (FKA Azure Sentinel) by using Log Analytics along with providing Analytics rules so that I can support users who use Microsoft Sentinel as their SIEM / SOAR / UEBA platform

Definition of Done

  • New Output for Microsoft Sentinel
  • Flatten ASFF / EE findings for better indexing and not to exceed 500 unique columns within Log Analytics Workspaces
  • Provided Analytics rules for creating Incidents / Alerts within Microsoft Sentinel
  • Document changes and new output required Parameters / Environment Variables
  • Updated CFN & TF Templates with new Fargate ENV VARs and TF Vars/CFN Params

Nice to Have
Workbook / Notebook? Complex Analytics Rules?

Additional Information
Will be using LAWS Custom code for connector

commented

Abandoning this for the meantime