Releases: wortell/AZSentinel
0.6.21
0.6.20
Fixes and new features:
- Follow official api schema #162 Thanks to @wadstromtech for the great work! the Incident configuration object is updated to follow the official API schema and is backwards compatible for existing JSON template files. see example and Readme for the new schema.
- Add Office 365 Data Connector #154 Thanks to @wez3 for adding the O365 Data Connector! for MSP and CSP please keep in mind that you needs a SPN or user account that exists in customer AAD Tenant.
- Fix/151 playbook name reference issue #163 Updated the playbook reference in class object.
- Updated readme and some docs
0.6.19
0.6.18
Fixes and new features:
- Creating Analytic Rules and attaching Playbooks in MSSP tenant fails the first time, then works the second time #151 thanks to @GeorgeAbouSamra for creating bug, issue is fixed by merging code from dev to master.
- groupingConfiguration error #132 - fixed the output format to match JSON input format
- Adding support for AlertRuleTemplate property #160 Thanks to @javiersoriano - now you can configure Template name for scheduled alert rule
0.6.17
Fixes and new features:
- Updated path to the enum folder for case sensitivity issue #156 Thanks to @deepanshumarwah for reporting
- Prevent null reference of non-required argument; fixes #148 #149 thanks to @lukiffer for fixing this issue!
- Add support for the FileHash entity #147 Thanks to @pemontto for updating the entities!
0.6.16
0.6.15
Fixes and new features:
-
Access token expiration logic #128 Thanks to awesome work from @john-crouch for reporting and fixing the issue! there was an issue in the refresh function where after 5 minutes you needed to restart your PowerShell session.
-
Bug Report #139 Thanks to @cjjnash for reporting - The described issue was caused when you switched from one subscription to another. Updated the PreCheck and Get-authentication function for a better and faster switch between subscriptions
-
Add support for Playbook attachment from MSSP tenant #138 From now you can add playbook name or playbook resource ID. the second one can be used for configuring playbooks that are in another subscription than Azure Sentinel
-
Can't import Fusion rule #133 thanks to @pemontto for reporting - we found out that in some cases the Fusion rule can be created with a name instead of GUID. Updated the Class to allow this.
0.6.14
Version 0.6.14 release only contains bug fixes and better error handling for some of the internal functions.
Fixes:
- modified token expiration logic #135 thanks to @john-crouch
- groupingConfiguration error #132 thanks to @rleal124
- Rename Alert Rule Fails With "Unable to find type [AlertProp]" #131 thanks to @RobertMihai