Microsoft Sentinel - Map ResourceGroup in Analytics Rules - kql

I'm attempting to utilize Entity Mappings to add ResourceGroup to all of my analytics rules.
This seems to be present for some of the templates, however, there are a large number of rules where this is not possible, and it appears I can not directly add this in the query itself.
The issue I'm facing is having alerts that span multiple Subscriptions & ResourceGroups that are then received by a 3rd party platform for analysis and review. I need to be able to split out these alerts by group (preferably RG or Sub) so that they can be playbooked to the appropriate team.
Question: Is there a method to which I can map/add/inject RG or Subscription into every alert that triggers in Sentinel?

Related

Azure Logic App set priority when creating Jira issue

So I am working on a project to create Jira issue automatically from Logic App.
I want to ask if there is a way to set the priority also.
For creating the ticket this is the only fields that can set.
To make it visible over Logic Apps, you need to check the required box in the field but currently Logic Apps do not support jira field types other than string, number, date and datetime.
However as an alterative, You can add a short text field to enter the priority level.
In jira
In LogicApps
For more information, You can refer Jira Connector - Known Issues and Limitations

How to build customized reports for the entities detected in IBM Watson

I am working on a conversation for a customer on the IBM Watson Bluemix space. There are two entities defined that have the same values as this is the requirement of the conversation.
User_Response: No
Exit_Chat_Unsucessful: No
Where User_Response captures both values "yes" and "no" and similar utterances while Exit_Chat_Unsuccessful tracks the count of conversations that did not end successfully.
Now since the value of both entities is set to "No", as part of the usual reporting the count for Exit_Chat_Unsuccessful would not be specific for exit chat alone.
How do I filter such values as part of reporting on Watson
It's not fully clear what you are asking, but as I understand it you want to know when a branch has been exited due to an unsuccessful reason.
There is a couple of ways to do this.
You can specify a name for the exit node. Then use this in the logs to associate which entity is priority.
You can use "branch_exited" and "branch_exited_reason" to see if you left the branch correctly.
You can also redefine the "yes" and "no" values to a single entity. There should be no instance where you would need both. If there is, you can use contextual entities to train the system to understand which is which.

How to remove business process flow

Accordint to this blog one can hide the business process flows. I'm trying to follow it but there's no flows defined for my opportunity (according to the list).
I'd like to "delete" the flow for Opportunity entity (or at least affect it somehow to display different steps/different number of steps). The reason is that we'll be migrating from an older version and they've got a picklist with percentages of the deal being done. Not sure how to map it onto the Opportunity in 2013 and even if, I'm not sure the client'd like it.
Is it at all possible to remove business process flow from Opportunity in CRM 2013?
When I do follow the guide and fool around with all flows, I get to remove the one for Opportunity but then I'm shown the error message as in the image below. So I'm assuming that it's not the correct approach. Or did the blogger referred to in the first paragraph cheat and took his screenshot after closing the warning? :)
The blogger in the blog is using the earlier version of Dynamics CRM than yours. Newer versions of Dynamics CRM will show the above warning.
Beside one way in the blog, there are a couple of way to show/hide Business Process Flow:
use Javascript to set the display attribute of process bar element:
function hideBusinessProcessFlow()
{
document.getElementById('header_process_d').style.display = "none";
}
function showBusinessProcessFlow()
{
document.getElementById('header_process_d').style.display = "block";
}
Reference: https://community.dynamics.com/crm/b/misscrm360exploration/archive/2014/07/24/show-and-hide-business-process-flow-in-crm-2011-2013.aspx
Please note that this is unsupported customization.
Update processid and stageid fields of the record. Use update these fields with Javascript or writing a plugin/workflow to do this.
Have a look at this solution: http://code.msdn.microsoft.com/Change-Dynamics-CRM-2013-a6beb85e
In your case, you just need to update processid and stageid fields to null, then the annoying warning will disappear.
Good luck!
Are you looking at the complete list of Processes under Customisations? If you're looking at an unmanaged solution it won't appear unless it's been added to that solution. It's in there OOB and called Opportunity Sales Process, I just deactivated it on a clean org. No need to delete it, just deactivate it or edit as required.
There are two things that can be done for any business process flow in MS CRM:
Deactivate BPF
Delete BPF
In order to remove Business Process Flow (BPF) from existing records, it is not enough to just deactivate BPF. Even when we deactivate BPF, records that are associated with it will still show BPF with warning message that it is deactivated.
It is true, if you delete BPF from Processes in MS Dynamics CRM, they will be removed (not showed) from the records that were associated with that BPF. However, what if you do not want to delete default BPFs, like those related to sales process on system entities (Leads, Opportunities and Accounts)? What if you want to hide these default system BPF from default system entity (i.e. Opportunity)?
In this case you need to write plugin/workflow activity to remove association of the entity record from BPF.
See my GitHub example how to do this
This MS CRM community post is also useful:
Remove business Process Flow from Account

How do I store 3rd-party API data after user interaction?

The project that I'm currently on is consuming a large volume of 3rd-party information exposed via APIs. These datasets are constantly changing and in the order of millions of entries for each.
Users are to denote their favorites and recall that data when they need it. An example may be that the user wants to "bookmark" an inventory level to their "analyze later" list.
My current thinking is that during actions like searching users are presented with "live" data from the 3rd parties. If they flag something they're interested in I copy that data to a database I control. Subsequent views of that info are served from my database, not the 3rd party, since the 3rd party entry may change (or cease to exist entirely).
Is this good API practice? What object keys are sent to the client-facing application on search? The 3rd party keys? Or do I preprocess the results of a search and determine which items I have locally, thus returning local keys in those instances? Or do I completely abstract the 3rd party sources and generate unique local keys for every returned item, which is then subsequently used if someone saves [that seems REALLY heavy, tho]? Or do I put that processing off and do the lookup as to whether something exists locally to after someone bookmarks something?

Splunk usage for UI events and activity

One of the main functions we are attempting to fill is to log/visualise application UI events from users.
We currently log events on our iPhone application to a custom built 'backend' where we can see for each user what they have done, ie start_activity, add_option, take_photo etc etc pretty much as they do it. We are needing the same for the google appengine application that we are building, for both client side and server side events.
I am wondering if splunk would be useable for this, or should we be using another tool first (like with nagios for infrastructure stuff then forwarding on)? Otherwise should we just use a Mixpanel or other app for events logging? Or can we just pump straight into splunk and build off that?
With Splunk you can easily count the number of occurrences of "events" (literal data) in log data that happen over various periods of time. For example, if you want to count the number of times a photo has been taken you would perform the following SEARCH command in Splunk:
'take_photo' | timechart span=1h count
This will count the number of log records containing "take_photo" in each hour charting the results.