Updating ForescoutHostPropertyMonitor solution for a new release

[rao-peraka]

  Changes(s):

• Created a new workbook ForescoutHostPropertyMonitorWorkbook.json
• Created preview files for new workbook
• Updated WorkbooksMetadata.json to include new workbook
• Updated schema of customer table ForescoutHostProperties_CL
• Added two new Custom tables ForescoutComplianceStatus_CL, ForescoutPolicyStatus_CL
• Updated playbook Forescout-DNSSniffEventPlaybook.json
• Updated Analytic Rule ForeScout-DNSSniffEventMonitor.yaml
• Updated/created new KqlValidationTests for CustomTables
• Added ReadMe files
• Updated a ReadMe files

Reason for Change(s):

• New schema used for Custom Table, and addition of two new Custom Tables
• Analytic Rules/Playbook changes corresponding to Customer table changes
• New workbook
• Updates to ReadMe files to capture new changes

Version Updated:

• Yes

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes (Tools\Create-Azure-Sentinel-Solution\V2\createSolutionV2.ps1 is used for validation checks)

[rao-peraka]

Thanks for the checks.
I have updated the files.
Appreciate if you could run the validation checks again.
Thanks a lot!

[rao-peraka]

Thanks for the checks.
I have updated the files.
Appreciate if you could run the validation checks again.
Thanks a lot!

[v-prasadboke]

Please add metadata back. This is required.
Playbook wont be visible in automation blade if metadata is not present

[rao-peraka]

Thanks for the comments.
We added metadata block to Playbook and regenerated package file.
Thanks a lot!

[v-prasadboke]

I have created a new PR which is a duplicate of this PR
PR #11830

can you proivde me a custom table schema for table ForescoutPolicyStatus_CL
for reference https://github.com/Azure/Azure-Sentinel/blob/master/.script/tests/KqlvalidationsTests/CustomTables

[rao-peraka]

Hi Prasad,
Following is schema of 2 new custom tables that were added:

ForescoutPolicyStatus_CL:
{
"Name": "ForescoutPolicyStatus_CL",
"Properties": [
{
"name": "TimeGenerated",
"type": "datetime"
},
{
"name": "UploadTime",
"type": "datetime"
},
{
"name": "Ipv4Addr",
"type": "string"
},
{
"name": "Ipv6Addr",
"type": "dynamic"
},
{
"name": "MacAddr",
"type": "string"
},
{
"name": "EmIpAddr",
"type": "string"
},
{
"name": "HostProperties",
"type": "dynamic"
}

]
}

ForescoutComplianceStatus_CL:
{
"Name": "ForescoutComplianceStatus_CL",
"Properties": [
{
"name": "TimeGenerated",
"type": "datetime"
},
{
"name": "UploadTime",
"type": "datetime"
},
{
"name": "Ipv4Addr",
"type": "string"
},
{
"name": "Ipv6Addr",
"type": "dynamic"
},
{
"name": "MacAddr",
"type": "string"
},
{
"name": "EmIpAddr",
"type": "string"
},
{
"name": "HostProperties",
"type": "dynamic"
}
]
}

Thanks!