Sentinel-Rules/ConvertHuntingQueryFromYamlToArm.ps1 at main · 2O0K/Sentinel-Rules · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
$jsonConversionDepth = 50
function ConvertHuntingQueryFromYamlToArm {
    param (
        # Parameter help description
        [Parameter(Mandatory)][string] $inputFilePath,
        [Parameter(Mandatory)][string] $outputFilePath
    )

    $file = Get-Item -Path $inputFilePath
    $yaml = $null
    if ($file.FullName -match "(\.yaml)$")
    {
        $rawData = Get-Content $inputFilePath
        $content = ''
        foreach ($line in $rawData)
        {
            $content = $content + "`n" + $line
        }

        try {
            $yaml = ConvertFrom-YAML $content
        }
        catch {
            Write-Host "Failed to deserialize $file $_" -ForegroundColor Red
            break;
        }
    }

    $basicJson =
    @"
{
    "`$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workspace": {
            "type": "String"
        }
    },
    "resources":[]
}
"@

    $baseHuntingObject = ConvertFrom-Json $basicJson
    $huntingQueryObj = [PSCustomObject] @{
        type       = "Microsoft.OperationalInsights/workspaces/savedSearches";
        apiVersion = "2020-08-01";
        name       = "[concat(parameters('workspace'), '/$($file.BaseName.replace(`" `", `"`"))')]";
        location   = "[resourceGroup().location]";
        properties = [PSCustomObject] @{
            eTag        = "*";
            displayName = $yaml.name;
            category    = "Hunting Queries";
            query       = $yaml.query;
            version     = 1;
            tags        = @()
        }
    }

    $huntingQueryDescription = ""
    if ($yaml.description) {
        $huntingQueryDescription = $yaml.description.substring(0, [math]::min($yaml.description.length, 254))
        $descriptionObj = [PSCustomObject]@{
            name  = "description";
            value = $huntingQueryDescription
        }
        $huntingQueryObj.properties.tags += $descriptionObj
        $huntingQueryDescription = "$huntingQueryDescription "
    }


    if ($yaml.tactics -and $yaml.tactics.Count -gt 0) {
        $tacticsObj = [PSCustomObject]@{
            name  = "tactics";
            value = $yaml.tactics -join ","
        }
        if ($tacticsObj.value.ToString() -match ' ') {
            $tacticsObj.value = $tacticsObj.value -replace ' ', ''
        }
        $huntingQueryObj.properties.tags += $tacticsObj
    }

    if ($yaml.relevantTechniques -and $yaml.relevantTechniques.Count -gt 0) {
        $techniqueObj = [PSCustomObject]@{
            name  = "relevantTechniques";
            value = $yaml.relevantTechniques -join ","
        }
        if ($techniqueObj.value.ToString() -match ' ') {
            $tactictechniqueObj.value = techniqueObj.value -replace ' ', ''
        }
        $huntingQueryObj.properties.tags += $techniqueObj
    }

    $baseHuntingObject.resources = @();
    $baseHuntingObject.resources += $huntingQueryObj;

    ConvertTo-Json $baseHuntingObject -EscapeHandling Default -Depth $jsonConversionDepth  | Set-Content -Path $outputFilePath
}