Defend rebrand from Egress to KnowBe4

[olliespires]

Required items, please complete

Change(s):

• Changed display wording from Egress to KnowBe4
• Changed file names and folders to match

Reason for Change(s):

• Egress has been purchased by KnowBe4

Version Updated:

• Yes, from 3.0.0 to 3.1.0, was this correct?

Testing Completed:

• Yes
• Tested using the V3 solution builder
• Tested in our Sentinel Dev environment, see below screenshot of events coming through

• Also tested with the UI definition sandbox as shown below, can see KnowBe4 Defend rather than Egress Defend wording:

Checked that the validations are passing and have addressed any issues that are present:

• Yes (check, will finish this when they have run)

Before the submission has been made, please look at running the KQL and Yaml Validation Checks locally.
https://github.com/Azure/Azure-Sentinel#run-kql-validation-locally

Checked that the validations are passing and have addressed any issues that are present:

• Yes/No/Need Help

Note: Let us know if you have tried fixing the validation error and need help.

References:

• Guidance for Detection checks
• General contribution guidance
• PR validation troubleshooting

---

[olliespires]

@olliespires please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

• (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.

@microsoft-github-policy-service agree

• (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.

@microsoft-github-policy-service agree company="Microsoft"

Contributor License Agreement

@microsoft-github-policy-service agree [company="KnowBe4"]

[olliespires]

@olliespires the command you issued was incorrect. Please try again.

Examples are:

@microsoft-github-policy-service agree

and

@microsoft-github-policy-service agree company="your company"

@microsoft-github-policy-service agree company="KnowBe4"

[olliespires]

Hi @v-maheshbh, I have copied the KnowBe4 logo into the workbooks logos folder, correct me if I'm wrong but from the error I think that should fix the failing Workbooks validation.

I also saw the KQL validation failed, should I be removing the DefendAuditData.txt from the parsers folder? Will this affect anything?

[v-maheshbh]

Hi @olliespires

BasePath Format:
Modify the BasePath to the following structure:
C:\GitHub\Azure-Sentinel\solutions\Solution Name
Release Notes Version:
Update the version in the ReleaseNotes to 3.0.1
Ensure that the latest version is listed first in the release notes and include an appropriate comment.
and please refer to the detailed solution and the corresponding folder structure below for further clarity
https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CiscoMeraki

Thanks!

[v-maheshbh]

Hi @olliespires

Kindly review the comments mentioned above.

Thanks!

[olliespires]

Hi @olliespires

Kindly review the comments mentioned above.

Thanks!

Hi @v-maheshbh,

Apologies I have been off for 2 weeks over the holidays, just looking at these now. Thanks

[olliespires]

Hi @olliespires
Kindly review the comments mentioned above.
Thanks!

Hi @v-maheshbh,

Apologies I have been off for 2 weeks over the holidays, just looking at these now. Thanks

Hi @v-maheshbh,

I have made the changes requested above, can you check if you are happy with them please?

Thanks!

[olliespires]

Hi @v-maheshbh ,

Are there any further changes I need to make here and were the last ones ok?

Thanks

[v-maheshbh]

Hi @olliespires

Kindly update the file extension, as only .yaml is allowed under the Parsers folder.

and renamed the workbook preview images in the below‑mentioned path as well. Also, kindly check the release notes and remove any extra dotted lines.
https://github.com/Azure/Azure-Sentinel/tree/master/Workbooks/Images/Preview

Thanks!

[olliespires]

Hi @olliespires

Kindly update the file extension, as only .yaml is allowed under the Parsers folder.

and renamed the workbook preview images in the below‑mentioned path as well. Also, kindly check the release notes and remove any extra dotted lines. https://github.com/Azure/Azure-Sentinel/tree/master/Workbooks/Images/Preview

Thanks!

Hi @v-maheshbh ,

Thanks, I have removed that text file, was this from the old packaging flow?
Sorry not sure what you mean about the rename, we have intentionally renamed those logos as part of the rebrand, will that not work?
I have checked the release notes and they look ok to me unless I'm missing something

Cheers!

[v-maheshbh]

Hi @olliespires
As you have renamed the workbook preview images under the solution’s Images folder, kindly apply the same renaming to the items mentioned below. This will resolve the workbook metadata validation failure,

Thanks!

[olliespires]

Hi @olliespires As you have renamed the workbook preview images under the solution’s Images folder, kindly apply the same renaming to the items mentioned below. This will resolve the workbook metadata validation failure,

Thanks!

Morning @v-maheshbh ,

Ah I see, I have updated those

Thanks!

[v-maheshbh]

Hi @olliespires

Kindly update the parser file extension to .yaml in the data file.

Thanks!

[olliespires]

Hi @olliespires

Kindly update the parser file extension to .yaml in the data file.

Thanks!

Hi @v-maheshbh ,

Nice, updated that

Thanks!