Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Release MS ATP 6.0.2 #3025

Merged
merged 3 commits into from
Jan 21, 2025
Merged

Release MS ATP 6.0.2 #3025

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a0933d4
SOAR-18473: Bump MS ATP to latest SDK image (#3016)
joneill-r7 Dec 19, 2024
e8e529f
SOAR-18525: rename to defender for endpoint (#3043)
joneill-r7 Jan 13, 2025
af19b36
SOAR-18525 - missed links in rename (#3049)
joneill-r7 Jan 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions plugins/microsoft_atp/.CHECKSUM
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"spec": "934e6a0e86aaf3bfeaf24c22d52b2f4f",
"manifest": "4702833d54d4ebd07beee1e4ac146a61",
"setup": "b11db1dff4ae3bd168fabd3691c4fd78",
"spec": "a042dbc96e9aab3886c0463b573a4654",
"manifest": "8f26bd28e949cfda8dfce9f0036777a3",
"setup": "9ceeb89f2b17b0f547706b3639287496",
"schemas": [
{
"identifier": "blacklist/schema.py",
Expand Down
2 changes: 1 addition & 1 deletion plugins/microsoft_atp/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM --platform=linux/amd64 rapid7/insightconnect-python-3-plugin:6.1.2
FROM --platform=linux/amd64 rapid7/insightconnect-python-3-plugin:6.2.3

LABEL organization=rapid7
LABEL sdk=python
Expand Down
6 changes: 3 additions & 3 deletions plugins/microsoft_atp/bin/komand_microsoft_atp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,10 @@ import os
import json
from sys import argv

Name = "Microsoft Windows Defender ATP"
Name = "Microsoft Defender for Endpoint"
Vendor = "rapid7"
Version = "6.0.0"
Description = "The Windows Defender Advanced Threat Protection plugin allows Rapid7 InsightConnect users to quickly take remediation actions across their organization. This plugin can isolate machines, run virus scans, and quarantine files"
Version = "6.0.1"
Description = "The Microsoft Defender for Endpoint plugin allows Rapid7 InsightConnect users to quickly take remediation actions across their organization. This plugin can isolate machines, run virus scans, and quarantine files"


def main():
Expand Down
17 changes: 7 additions & 10 deletions plugins/microsoft_atp/help.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Description

The Windows Defender Advanced Threat Protection plugin allows Rapid7 InsightConnect users to quickly take remediation actions across their organization. This plugin can isolate machines, run virus scans, and quarantine files
The Microsoft Defender for Endpoint plugin allows Rapid7 InsightConnect users to quickly take remediation actions across their organization. This plugin can isolate machines, run virus scans, and quarantine files

# Key Features

Expand All @@ -21,10 +21,6 @@ The Windows Defender Advanced Threat Protection plugin allows Rapid7 InsightConn

## Setup

This plugin uses the Windows Defender ATP API. It will use an Azure application to connect to the API and run actions from InsightConnect.

For information on how to setup your application and assign permissions go here:
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp
The connection configuration accepts the following parameters:

|Name|Type|Default|Required|Description|Enum|Example|Placeholder|Tooltip|
Expand Down Expand Up @@ -1330,11 +1326,12 @@ Example output:


## Troubleshooting
*This plugin does not contain a troubleshooting.*

* For information on how to setup your Azure application and assign permissions go [here](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp)

# Version History

* 6.0.1 - Update to latest SDK (v6.2.2) | Address vulnerabilities | Rebrand to `Microsoft Defender for Endpoint`
* 6.0.0 - Updated SDK to the latest version | Initial updates for fedramp compliance
* 5.2.0 - Add new action: Update Alert
* 5.1.0 - Adding the following as new action types to `blacklist` action ['Warn', 'Block', 'Audit'] | Add a new flag in the `blacklist` action to toggle generateAlerts flag | Bump SDK to version 5.4.9
Expand Down Expand Up @@ -1364,9 +1361,9 @@ Example output:

# Links

* [Windows Defender ATP](https://www.microsoft.com/en-us/windowsforbusiness/windows-atp)
* [Windows Defender for Endpoint](https://www.microsoft.com/en-us/security/business/endpoint-security/microsoft-defender-endpoint)

## References

* [Windows Defender ATP API Start Page](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/use-apis)
* [Windows Defender ATP API Endpoints](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/exposed-apis-list)
* [Windows Defender for Endpoint API Start Page](https://learn.microsoft.com/en-us/defender-endpoint/api/apis-intro)
* [Windows Defender for Endpoint API Endpoints](https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-list)
17 changes: 10 additions & 7 deletions plugins/microsoft_atp/plugin.spec.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@ plugin_spec_version: v2
extension: plugin
products: ["insightconnect"]
name: microsoft_atp
title: Microsoft Windows Defender ATP
description: The Windows Defender Advanced Threat Protection plugin allows Rapid7 InsightConnect users to quickly take remediation actions across their organization. This plugin can isolate machines, run virus scans, and quarantine files
version: 6.0.0
title: Microsoft Defender for Endpoint
description: The Microsoft Defender for Endpoint plugin allows Rapid7 InsightConnect users to quickly take remediation actions across their organization. This plugin can isolate machines, run virus scans, and quarantine files
version: 6.0.1
connection_version: 6
supported_versions: ["2024-05-21"]
vendor: rapid7
Expand All @@ -27,14 +27,17 @@ hub_tags:
features: []
sdk:
type: full
version: 6.1.2
version: 6.2.3
user: nobody
troubleshooting:
- "For information on how to setup your Azure application and assign permissions go [here](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp)"
links:
- "[Windows Defender ATP](https://www.microsoft.com/en-us/windowsforbusiness/windows-atp)"
- "[Windows Defender for Endpoint](https://www.microsoft.com/en-us/security/business/endpoint-security/microsoft-defender-endpoint)"
references:
- "[Windows Defender ATP API Start Page](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/use-apis)"
- "[Windows Defender ATP API Endpoints](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/exposed-apis-list)"
- "[Windows Defender for Endpoint API Start Page](https://learn.microsoft.com/en-us/defender-endpoint/api/apis-intro)"
- "[Windows Defender for Endpoint API Endpoints](https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-list)"
version_history:
- "6.0.1 - Update to latest SDK (v6.2.2) | Address vulnerabilities | Rebrand to `Microsoft Defender for Endpoint`"
- "6.0.0 - Updated SDK to the latest version | Initial updates for fedramp compliance"
- "5.2.0 - Add new action: Update Alert"
- "5.1.0 - Adding the following as new action types to `blacklist` action ['Warn', 'Block', 'Audit'] | Add a new flag in the `blacklist` action to toggle generateAlerts flag | Bump SDK to version 5.4.9"
Expand Down
4 changes: 2 additions & 2 deletions plugins/microsoft_atp/setup.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@


setup(name="microsoft_atp-rapid7-plugin",
version="6.0.0",
description="The Windows Defender Advanced Threat Protection plugin allows Rapid7 InsightConnect users to quickly take remediation actions across their organization. This plugin can isolate machines, run virus scans, and quarantine files",
version="6.0.1",
description="The Microsoft Defender for Endpoint plugin allows Rapid7 InsightConnect users to quickly take remediation actions across their organization. This plugin can isolate machines, run virus scans, and quarantine files",
author="rapid7",
author_email="",
url="",
Expand Down
Loading